!
1. New routes being added!!
2. State changing routes being added
!
Dynamic analysis !
Slide 19
Slide 19 text
git-watchdog
Collects post-receive from GitHub and
alerts you on security errors
Slide 20
Slide 20 text
Cross-Site Scripting
(XSS)
Slide 21
Slide 21 text
Imagine an injection context
inside a JS variable
var a = “—-user-input-here—”;
alert(‘Finished’);
Slide 22
Slide 22 text
Just strip out / escape the “ character
(Double Quotes)
Slide 23
Slide 23 text
Guess what happens ?
var a = “”;
alert(‘Finished’);
Slide 24
Slide 24 text
HTML Parser have preference over JS Parser.
Slide 25
Slide 25 text
Principle of Un-obtrusive Javascript
Client-Side Templating
Content Security Policy
Reduce the entry point to one
What defensive front-end architecture looks like
Slide 26
Slide 26 text
Templating & XSS
<%= %>, {{ }} — HTML Encoded - Usually XSS
Safe
<%- %>, {{{ }}} — No Encoding - Causes XSS in
any context. Your design should naturally avoid
this.
Slide 27
Slide 27 text
This works until someone who doesn’t understands your
code starts committing to production.
Slide 28
Slide 28 text
Things to look out
Anything which has <%- or {{{ needs some
attention.
Write a simple module which checks the code
commits for that.
Slide 29
Slide 29 text
Writing an XSS checker in git-watchdog
Slide 30
Slide 30 text
ExpressJS!
Web Application framework for node
Slide 31
Slide 31 text
Scan on new routes being
added?
In Express, app._router.stack gives you all
the registered routes.
Pretty useful if you want to trigger a scan for a
newly added end-point.!
Figure out what works for your framework!