Skip to main content
5 votes

Why does OWASP recommend to never return JSON arrays not wrapped in objects?

The OWASP does provide a rationale by referencing the Angular documentation on the underlying attack (which is exactly the Array constructor attack you already mentioned). There's also a slightly more ...
Ja1024's user avatar
  • 6,037
3 votes

Is JSON vulnerability still possible?

JSON Hijacking is pretty much dead - it's been patched in all major browsers for years. My colleague did some research into this in 2016 but all the bugs mentioned are now patched: https://portswigger....
albinowax's user avatar
  • 121
2 votes

Secure way to output encoding HTML for insert raw html via javascript

If you want to insert untrusted HTML markup as text, then you should use the textContent property, not innerHTML. The textContent property reliably prevents XSS attacks, because the content is only ...
Ja1024's user avatar
  • 6,037
1 vote

CSRF on JSON with origin

There's a few things that could explain the problem, though you should seek out additional information. However, there are also some reasons that this shouldn't work at all, as written. I'll go over ...
CBHacking's user avatar
  • 48.5k

Only top scored, non community-wiki answers of a minimum length are eligible