Writing Secure JavaScript
summary
Live exploits show NPM supply-chain failures and concrete bugs: the st package yields directory traversal via URL-encoding, marked allows HTML entity evasion causing XSS despite sanitizers, ms suffers catastrophic backtracking regex DoS (60k‑char payloads freeze the event loop), and mongoose/new Buffer usage enables Buffer allocations leaking memory that expose keys and source. The demo uses a scanner called snake to find vulnerable deps and shows fixes like caps, proper type checks, and targeted sanitization.
AI-written summary · about
chapters (7)
- 0:00Start
- 0:26About Me
- 13:37Catastrophic Backtracking
- 21:07Type Manipulation
- 22:15NoSQL Injection
- 23:31JavaScript Takeaways
- 23:55npm packages takeaway Find vulnerabilities
related talks
32mWriting Secure JavaScript Code
47mNode.js Security: Breaking The Loop
55mNode.js Security: Breaking The Loop
23mJavaScript attack surface
24mStrangerDanger: Finding Security Vulnerabilities Before They Find You!
35mStrangerDanger: Finding Security Vulnerabilities Before They Find You!
29mA Node.js Security Roadmap
51mStranger Danger: Your Node.js Attack Surface Just Got Bigger