5 ms·

> One of the discoveries the report mentions is that an analysis of around 433,000 sites found that 77% of them use at least one front-end JavaScript library wi

by merb 9y ago

> One of the discoveries the report mentions is that an analysis of around 433,000 sites found that 77% of them use at least one front-end JavaScript library with a known security vulnerability. Does that even matter? No Front-End JS Library should actually make your backend vulnerable.

bastawhiz 9y ago
An XSS issue could make your users' data vulnerable.
- merb 9y ago
  is still only an issue if you pass untrusted data to your js code.
  - Klathmon 9y ago
    And there is a pretty good chance of that happening in most JS projects. Anywhere you take or show input from the user (an input box, a URL query, displaying data stored by some other system on the DB, etc...) could be a vector for an XSS attack. And it's not just data passed to JS, but data passed to HTML or any data that could make it's way into CSS in many cases!
  - sakshyamshah 9y ago
    turns out that most of times, untrusted user supplied data slips through JS codes https://www.owasp.org/index.php/Top_10_2017-Top_10 https://www.owasp.org/index.php/Top_10_2017-Top_10
- oneweekwonder 9y ago
  But cors[0] headers can mitigate some of the risk? [0]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
  - thefreeman 9y ago
    Not really. CORS headers are set by the destination of the XHR. In the case of XSS it would be an attacker controlled server used to exfiltrate user cookies, etc.
  - amenghra 9y ago
    You want CSP headers to mitigate XSS risks.
- zaarn 9y ago
  Your backend should be double-checking any escaping the frontend does. Otherwise you can throw your fancy anti-XSS on the frontend in the bin. Also CSP helps.
wrinkl3 9y ago
Vulnerabilities don't have to affect the backend - most of JQuery-related CVEs that I could find had to do with XSS.
- merb 9y ago
  which can only happen if you pass wrong data from the backend to the jquery related function. I.e. dynamically generate input for $()...
  - PetahNZ 9y ago
    Well not really backend exclusive: `$('#foo').append('Showing search results for ' + (new URL(location)).searchParams.search);`
sakshyamshah 9y ago
Only if your front end is SPA and backend just serves through data via api. even in that case, xss in front-end can compromise admin's web sessions to pivot into backend services.
will4274 9y ago
> No Front-End JS Library should actually make your backend vulnerable. FUD. Most SPAs keep the authentication token accessible to JavaScript so it can be sent to the API server. And XSS in the FE JS can permit an attacker to steal the user's authentication token and then the attacker could impersonate the user and take any action as the user.

by merb 9y ago

bastawhiz 9y ago

An XSS issue could make your users' data vulnerable.

merb 9y ago
is still only an issue if you pass untrusted data to your js code.
- Klathmon 9y ago
  And there is a pretty good chance of that happening in most JS projects. Anywhere you take or show input from the user (an input box, a URL query, displaying data stored by some other system on the DB, etc...) could be a vector for an XSS attack. And it's not just data passed to JS, but data passed to HTML or any data that could make it's way into CSS in many cases!
- sakshyamshah 9y ago
  turns out that most of times, untrusted user supplied data slips through JS codes https://www.owasp.org/index.php/Top_10_2017-Top_10 https://www.owasp.org/index.php/Top_10_2017-Top_10
oneweekwonder 9y ago
But cors[0] headers can mitigate some of the risk? [0]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
- thefreeman 9y ago
  Not really. CORS headers are set by the destination of the XHR. In the case of XSS it would be an attacker controlled server used to exfiltrate user cookies, etc.
- amenghra 9y ago
  You want CSP headers to mitigate XSS risks.
zaarn 9y ago
Your backend should be double-checking any escaping the frontend does. Otherwise you can throw your fancy anti-XSS on the frontend in the bin. Also CSP helps.

wrinkl3 9y ago

Vulnerabilities don't have to affect the backend - most of JQuery-related CVEs that I could find had to do with XSS.

merb 9y ago
which can only happen if you pass wrong data from the backend to the jquery related function. I.e. dynamically generate input for $()...
- PetahNZ 9y ago
  Well not really backend exclusive: `$('#foo').append('Showing search results for ' + (new URL(location)).searchParams.search);`

sakshyamshah 9y ago

Only if your front end is SPA and backend just serves through data via api. even in that case, xss in front-end can compromise admin's web sessions to pivot into backend services.

will4274 9y ago

> No Front-End JS Library should actually make your backend vulnerable. FUD. Most SPAs keep the authentication token accessible to JavaScript so it can be sent to the API server. And XSS in the FE JS can permit an attacker to steal the user's authentication token and then the attacker could impersonate the user and take any action as the user.