Safety Not Guaranteed
summary
A practical security checklist that names failures not just concepts: the mustache security wiki supplies copy‑paste proof‑of‑concepts that execute if a framework uses runtime eval in templates, exposing XSS; many frameworks break when CSP blocks eval. Underscore’s remedy is server‑side template compilation; Angular and Ember show active fixes and security processes. Action items: run the wiki tests, look for runtime template eval, and confirm the app delivers a CSP header.
AI-written summary · about
chapters (8)
- 0:00Start
- 6:14Resulting Security Matrix
- 7:14What is Content Security Policy(CSP)?
- 7:40Same Origin Policy (SOP)
- 8:12Cross Site Scripting (XSS) bypasses SOP
- 10:01Searching for security issues on github
- 10:23Searching on Github for issues
- 14:16Has an IMDB rating of 7.1/10
related talks
31mBoosting the security of your Angular 2 application
48mSecurity Risk: Single-Page Applications.
34mHow Do JavaScript Frameworks Impact The Security Of Applications?
58mPractical Secure Development and Operations with JavaScript in 2020
01h 00mSafety not Guaranteed
18mWriting an (in)secure webapp
47m30 Tips for Secure JavaScript
32mSecurity-First Web Apps