Writing Secure JavaScript Code

on YouTube ↗32m

" summary

Demo app uses popular npm modules and shows concrete exploits: marked XSS via HTML entity decoding, ms regular‑expression ReDoS that freezes the Node event loop, and NoSQL injection by sending an object as a JSON password, plus a Dust.js path that leads to server‑side command execution. Exploits run with curl/httpie against the demo and a Snyk‑style dependency scan reveals about one in seven libraries carry vulnerabilities. Fixes are upgrades, patches or CI/blocking on vulnerability pull requests; automated alerts speed remediation.

AI-written summary · about

" chapters (18)

1. 0:00Introduction
2. 0:48What makes JavaScript great
3. 10:51MS Vulnerability
4. 13:39Regular Expressions
5. 14:11The Event Loop
6. 15:23Catastrophic Backtracking
7. 17:11Redose
8. 18:41Attack Manipulation
9. 20:24JSON as Input
10. 22:51Type Manipulation
11. 23:51DustJS
12. 24:46About Page
13. 25:18Playing with About Page
14. 27:18Wrapping Up
15. 27:45Takeaways
16. 28:12Libraries have bugs
17. 28:56Microsoft Sonar and Lighthouse
18. 29:52Upgrade

" related talks

• 24mWriting Secure JavaScriptGuy Podjarny · JS Kongress 2016
• 23mJavaScript attack surfaceDavit Karapetyan · JavaScript Summit Armenia 2023
• 24mStrangerDanger: Finding Security Vulnerabilities Before They Find You!Liran Tal · JSConf Budapest 2019
• 55mNode.js Security: Breaking The LoopLiran Tal · JSHeroes 2017
• 35mStrangerDanger: Finding Security Vulnerabilities Before They Find You!Liran Tal · DevDays Europe 2019
• 43mReact SecurityDimitur Jilanov · foss-north 2022
• 47mNode.js Security: Breaking The LoopLiran Tal · jsDay 2018
• 01h 02meXential XSS (Cross Site Scripting)Alex Mackey · NDC Melbourne 2022