Questions tagged [jquery]

jQuery is a JavaScript library used for DOM manipulation.

Filter by
Sorted by
Tagged with
0 votes
0 answers
111 views

What are the security considerations for coding a website with interactive scripts but no backend?

I am developing a simple grammar study website with Bootstrap 5, JQuery and Javascript. It will have interactive grammar quizzes and flashcards. I would like users to be able to type in answers to ...
1 vote
0 answers
129 views

Prevent XSS in 3rd party (self hosted) application

We have an application which have purchased from a 3rd party and host in our own environment. The application consists of its own UI and back-end, and is included in our own application through an ...
0 votes
1 answer
145 views

Is JQuery in chrome extension a security concern?

This is the relevant part of my manifest.json file: "content_scripts": [ { "css": ["style.css"], "matches": [ "<all_urls>&...
  • 103
1 vote
1 answer
951 views

XSS - Setting Values and Attributes w/ jQuery

I was looking at the answer here and got curious if a function I use may be susceptible to XSS. Mostly because of this statement: Some HTML attributes are inherently dangerous. This includes href, ...
0 votes
1 answer
6k views

How to prevent XSS attack on selected window.location in javascript

This is my code where i have a userId in a method SwitchUser_Click. I need to prevent or somehow encode the return value from the switchUser_Click as it includes the UserId of a user vulnerable to ...
6 votes
1 answer
2k views

DOM Based XSS and Adding HTML Elements

So as a rule of thumb I once learned that adding or removing HTML with JavaScript/JQuery (.html(),.append(), etc) leaves yourself wide open for DOM Based XSS Attacks. It is now my understanding that ...
0 votes
0 answers
454 views

DOM XSS via JQuery function init()

Burp reported potential DOM XSS. Data is read from location and passed to the 'init()' function of JQuery via: var table = location['table'] || location['sysparm_table']; snPresence.init(table, ...
-4 votes
1 answer
129 views

I want to hide my youtube embeded code from my source code [closed]

I have iframe in my website i want it to be encrypted so that user can't understand the link and when user try to paste on browser it should show the video <iframe id="<?php echo $...
38 votes
5 answers
12k views

Is it really Security Misconfiguration to show a version number?

Our web application uses a HTML file with jQuery embedded inside. According to the jQuery license (https://jquery.org/license/), we have to leave the license header intact, including the version ...
1 vote
1 answer
229 views

When signing up a new user, is there a way to secure the password using jQuery/PHP?

I'm of the opinion that HTTPS is sufficient for securing passwords from would-be MITM (man-in-the-middle) attacks, but I'm curious to know if there's anything else I should be doing. During signup, ...
2 votes
1 answer
4k views

How to exploit publicy known vunerable version of jquery?

i searched no-stop for a lot of time trying to see how the publicy known "Vulnerable version of the library jquery" can be exploit to make proof of concepts to website owners. Let's say we have The ...
1 vote
1 answer
730 views

Bypass a simple XSS filter that only looks at <

Say, I have a page where the input from the user is taken and is passed through a simple client-side XSS filter. That filter only replaces < characters with ''. in = in.replace(/[<]/g, ''); ...
  • 223
3 votes
1 answer
17k views

Is there a way to exploit jquery 1.12.4 vulnerability?

According to https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=jquery+1.12.4 and https://snyk.io/test/npm/jquery/1.12.4, I see that jQuery 1.12.4 has medium serevrity vulnerability. I checked on ...
  • 133
0 votes
0 answers
438 views

Is this code vulnerable to DOM based XSS? jquery wrap()

Data is read from window.location and passed to the wrap() function of function of jQuery via the following statement: t.Location.wrap(window.location) The version of jQuery in use is the 1.12.1 - ...
3 votes
3 answers
1k views

Are jQuery vulnerabilities exposed by the file being served from the server of by usage of the vulnerable code?

I've recently been asked to update a legacy web application, installed on numerous client servers, to use the current version of jQuery 3.3.1, rather than 1.10.2 which has a number of vulnerabilities. ...
  • 133
10 votes
1 answer
795 views

XSS with escaped equal sign inside jQuery selector

Web-site uses jQuery 1.8.3 which has known XSS vulnerability in selector. (https://snyk.io/vuln/npm:jquery:20120206). It passes filtered and urldecoded document.location.hash (val2 below) value ...
0 votes
1 answer
715 views

Is this code vulnerable to dom based XSS? [duplicate]

Is this code vulnerable to DOM based XSS? The application is using jQuery 3.3.1 and i noticed that Data is read from window.location.hash and passed to $() via the following statements: var hash = ...
  • 11
1 vote
1 answer
3k views

What would be the impact of a CVE-2015-9251 vulnerability?

I've seen that in jQuery versions older than jQuery 3 there is the CVE-2015-9251 vulnerability which can result in cross-site scripting. Is this a limited vulnerability? What could be its possible ...
2 votes
2 answers
644 views

Are there XSS vulnerabilities while image preview before uploading it?

I wrote a JQuery tool to preview images before uploads. User A clicks the explore button to select an image selects it a change-event displays the image If user A selects a prepared SVG image as "...
  • 121
7 votes
3 answers
5k views

Exploiting XSS in jQuery without equal character?

This is some vulnerable JavaScript code: $(document).ready(function(){ var payload = unescape(document.location.hash.substr(1)); $(payload); document.body.innerText = "The payload is: " + ...
1 vote
1 answer
2k views

jQuery $.get HTML code and XSS

JS code var id = $(this).data("id"); $.get("/api.php",{id:encodeURIComponent(id)}).done(function(data){ $('<div>'+data+'</div>').appendTo('.parent'); }); api.php: echo json_encode('&...
  • 13
2 votes
2 answers
1k views

CSRF testing of an api endpoint using GET requests

I have an api endpoint that returns a new api token in JSON to the user if they're logged in to my website with only their session cookies being used to authenticate. I'm trying to write a piece of ...
  • 131
4 votes
3 answers
1k views

How to audit JavaScript written by someone else before including it on my site?

I want to include a feature to add a sort function on an HTML table on my site, using the tablesorter library. I would be using this on a part of the site that requires a login to access data. But I ...
13 votes
4 answers
19k views

Is XSS possible with jQuery(location.hash)?

Is it possible to exploit XSS in the following code? jQuery(window.location.hash) It seems to me that window.location.hash always starts with a hash #, and modern jQuery always interpretes this as ...
  • 28.7k
4 votes
1 answer
11k views

Is there a base version of jQuery which has no XSS vulnerability?

I am working on an enterprise project and we have a upcoming new release. The security team runs a security scan, in that vulnerability report there is one point that I am struggling with. The project ...
27 votes
1 answer
5k views

What is meant by "Vulnerable with: css class selector" for JQuery?

I'm mostly a beginner in cybersecurity. I came across this the other day about how JQuery 1.3.2 is vulnerable to CSS Selectors and Location Hash (source). I understand how XSS works and I know what ...
  • 403
0 votes
2 answers
1k views

Adding Escaped HTML to DOM

I am learning about XSS and am in the process of trying to understand why escaped HTML added to the DOM is triggering XSS vulnerability. The application will draw a modal overlay for a form (...
3 votes
2 answers
5k views

Is there a possability to inject XSS into the jQuery attr function?

I was wondering if this function would be vulnerable to XSS. var url = "google.com"; if (url.indexOf("http") != 0) { url = "http://" + url; } $("<a/>").attr("href", url); The 'url' is ...
  • 143
-4 votes
1 answer
8k views

Get MAC address of client using PHP, Angular js, jQuery/JavaScript [closed]

ipAddress=$_SERVER['REMOTE_ADDR']; $macAddr=false; #run the external command, break output into lines $arp=`arp -a $ipAddress`; $lines=explode("\n", $arp); #look for the output line describing our ...
  • 1
5 votes
1 answer
12k views

jquery.js Dynamic Code Evaluation: Code Injection on setTimeout() line

I am working on fixing a potential security issue. I ran my HP fortify SCA and I got a critical priority report on my jquery.js file. Category : Dynamic Code Evaluation: Code Injection (3 Issues). ...
  • 53
3 votes
1 answer
126 views

How to handle 3rd party vulnerable code?

We have recently done a static analysis of our application/s, and there are few critical findings for a 3rd party code i.e. jquery and swagger UI. What are security best practices in this case to ...
  • 103
9 votes
3 answers
1k views

Is Content Security Policy only enforced during initial rendering?

Is CSP enforced only during initial rendering, meaning there is no continuous coverage after your document loads? Here is an example of what I'm talking about: Let's say your page, example.com, has ...
3 votes
3 answers
2k views

What is more secure practice? Hosting from CDN or Main website

There has been a long Debate on CSP modelling, I have a Web application and I use JQuery in it, For that i use JQuery main site http://code.jquery.com/jquery-x.yy.z.min.js to Host it on my Site to ...
1 vote
2 answers
2k views

Is jQuery 2.1.1 vulnerable to OS command injection?

Barracuda has found multiple instances of OS Command Injection vulnerabilities in a static website. In each instance, the vulnerable URL was the jQuery plugin itself (version 2.1.1). Barracuda rates ...
  • 137
1 vote
1 answer
3k views

DOM based XSS: jQuery("#HiddenReferral").val(jQuery(location).attr('href'));

DOM based XSS has been reported by Burp Suite and showed this query as vulnerable: The application may be vulnerable to DOM-based cross-site scripting. Data is read from location and passed to jQuery(...
  • 1,781
6 votes
2 answers
3k views

Is this codes usage of document.location.toString() a DOM based XSS vulnerability?

I have come across the following JS code in multiple web applications. I think the reason for the popularity of this code snippet is this accepted answer on SO. Developers seem to be using this code a ...
  • 4,259
0 votes
2 answers
802 views

Is it secure to get auth TOKEN from server with javascript?

Is it secure to manipulate with auth token inside client side javascript over https ? I want to pass that token to websocket after login. $.getJSON( $SCRIPT_ROOT + '/jscript_get_auth_token', {}, ...
  • 1
3 votes
1 answer
20k views

exploiting XSS in jQuery selector

My static code analyser flags this piece of Javascript on my client's web site as a potential DOM based XSS: var x = $('#' + window.location.hash.substr(1)) x.addClass('highlighted').find('div').show(...
  • 1,311