React Security
summary
Live demos show XSS stealing cookies, SQL injection dumping and deleting SQLite tables, XXE reading files, zip slip via adm-zip writing files into system directories, and deserialization leading to arbitrary code execution that lists root files. npm tooling recommendation is npm audit and monthly fixes; claim that some vulnerable packages have ~2 million weekly downloads. Advice on defenses: OAuth2 tokens, whitelist/blacklist throttling, least-privilege DB users, WAFs. Examples run successfully on stage and are reproducible with the shown payloads.
AI-written summary · about
chapters (14)
- 0:00Start
- 0:24Who Am I
- 0:50Main Languages
- 1:11Agenda
- 1:35Best Practices for Rfgs Security
- 2:05Cross-Site Scripting Attacks
- 5:42Continuous Presentation Authentication
- 9:08Sq Injection
- 9:57Demo
- 17:51Arbitrary Code Execution
- 18:01What Is the Arbitrary Code Equation
- 25:55White List
- 27:16Best Practices for Connection to the Database
- 32:01Risk of Npm Dependencies
related talks
32mWriting Secure JavaScript Code
58mModern web application bugs
24mStrangerDanger: Finding Security Vulnerabilities Before They Find You!
32mLet me show you how React applications get hacked in the real-world
23mJavaScript attack surface
19mCritical Security Mistakes in Frontend Applications
47mBlack Clouds and Silver Linings in Node.js Security
56mModern Web Vulnerabilities 2020