JAVASCRIPT PROGRAMMING
- IN -
SECURITY DESIGN, EXPRESSIONS
AND WEB DEVELOPMENT
BOOK
JAVASCRIPT SECURITY DESIGN
CODE EXECUTION & VULNERABILITY EXPLOITATION
BOOK
JAVASCRIPT EXPRESSIONS
OPERATORS, LOOPS, & SWITCH STATEMENTS
BOOK
JAVASCRIPT WEB DEVELOPMENT
BUILDING REST APIS WITH NODE AND EXPRESS JS
RICHIE MILLER
Copyright
All rights reserved.
No part of this book may be reproduced in any form or by any electronic, print or mechanical means, including information storage and retrieval systems, without permission in writing from the publisher.
Copyright 2023 Richie Miller
Disclaimer
Every effort was made to produce this book as truthful as possible, but no warranty is implied. The author shall have neither liability nor responsibility to any person or entity concerning any loss or damages ascending from the information contained in this book. The information in the following pages are broadly considered to be truthful and accurate of facts, and such any negligence, use or misuse of the information in question by the reader will render any resulting actions solely under their purview.
Table of Contents Book
Introduction
Chapter How Browser Execute JavaScript Code
Chapter Exploiting the Vulnerability
Chapter Fixing & Preventing Code Injection Attacks
Chapter Dynamic Code Execution & Unsafe Functions
Chapter Finding Unsafe Code & Exploiting the Vulnerability
Chapter Impact of Code Injection Attacks & Fixing the Code
Chapter Unsafe Code in Third-party Libraries
Chapter Defending against Prototype Pollution
Chapter Finding Prototype Pollution in the Code
Chapter Exploiting the Profile Management
Chapter Security Testing Techniques
Chapter Popular Security Testing Tools for JavaScript
Table of Contents Book
Introduction
Chapter How the Switch Statement Works
Chapter Block-level Scope Issue with Switch Statements
Chapter Using a for/in Loop
Chapter Break and Continue Statements
Chapter Mathematical Operators
Chapter Assignment and Ternary Operators
Chapter Logical Operators
Chapter Short Circuiting & Operator Precedence
Chapter Utilizing JavaScript Exception Handling
Chapter How to Detect the Error Type
Chapter How to Determine JavaScript Variable Data Types
Chapter Helper Functions for the Constructor Property
Chapter Understanding 'this' in JavaScript
Chapter Copy an Array
Chapter Using Spread to Pass Parameters
Chapter Shallow Copy on Object Literals
Table of Contents Book
Introduction
Chapter How to Get the Right Tools
Chapter How to Create Express Server
Chapter How to Retrieve and Search for Data Using REST API Methods
Chapter How to Create a Module
Chapter How to Get a Single Piece of Data
Chapter How to Search for Data
Chapter How to Create POST Endpoint to Insert Data
Chapter How to Create DELETE Endpoint to Delete Data
Chapter How to Create PATCH Endpoint to Patch Data
Chapter How to Handle Exceptions in REST API Methods
Chapter How to Build a Reusable Error Module
Chapter How to Call REST API from an HTML Page
Conclusion
About Richie Miller
BOOK
JAVASCRIPT SECURITY DESIGN
CODE EXECUTION & VULNERABILITY EXPLOITATION
RICHIE MILLER
Introduction
The web runs on JavaScript is the dominant programming language for writing browser applications, and thanks to the Node.js runtime, it is increasingly common to see it in the back end too. The quality of JavaScript code is crucial for security of web applications. This book, however, is not about general web application security. We will not address problems that can affect applications written in any programming language. We will focus on security issues that are unique to JavaScript, and they are a result of its dynamic nature. I will teach you how to identify such vulnerabilities, how to fix them, and prevent those issues from creeping into your code. First, we will focus on the fundamental role that JavaScript plays in web application security. JavaScript can contain vulnerabilities, but in some cases it may even become an attack vector. There are two popular environments for running JavaScript code, and both of them have very different security properties. First, we will take a look at how browsers run JavaScript, and then we will see how Node.js is different. Then, we will look at language features that may lead to security vulnerabilities, dynamic typing, dynamic code execution, and prototypal inheritance. We will wrap up with an example of a simple coding mistake, literally just a missing character, that leads to a significant leak of sensitive data. Information security professionals are well known for specific jargon to use. We will not use it here, but it is important to understand some basic concepts of web security. Attacks against web applications are carried out by people. You may have an image of a person in a black hoodie typing at their keyboard in their basement, but the reality is much more nuanced. Attackers differ based on their capabilities and motivations. They can be teenagers wanting to impress their friends, fired employees seeking revenge, as well as criminals breaking into applications for money. Attacks would not be possible without vulnerabilities. Vulnerabilities are technical flaws in the system that allow people with malicious intent to break into our applications and systems. They can be simple bugs in the code, fundamental architecture flaws or configuration mistakes. All of them can lead to data breaches. Those that usually hit the headlines are about leaking millions of sensitive data records, such as credit card numbers. Data breaches can also involve abusing application functionality, for example toward their goods without paying or getting a refund for goods that were never purchased in the first place. The most common web application architecture has three tiers, the browser, the server, and the database JavaScript code can run both in the browser and the user's device, such as a laptop or smartphone, or on the server using Node.js. Vulnerabilities in code may allow attackers to breach access to the application datastore. A successful attack in a database may lead to a data breach that involves many users. The impact of a vulnerability in code is typically limited to a single user. That sounds like good news. Unfortunately, bugs in JavaScript code running in a browser may allow attackers to impersonate the victim and to perform actions on their behalf. In this case, the vulnerable JavaScript code becomes an attack vector.
Chapter How Browser Execute JavaScript Code
JavaScript was created to add interactivity to HTML pages. Web browsers are the native environment to run JavaScript code. In fact, JavaScript is the dominant programming language in this space. When the user visits a web page, the browser downloads the HTML code of that page, as well as all the other assets needed to display this page. This includes CSS style sheets, images, and JavaScript code. Browsers allow users to visit multiple pages at the same time in tabs or separate browser windows. This means that at any given time, JavaScript code downloaded from several different sites is executed in the same browser. If one of those sites is infected or even owned by the attacker, aren't we at risk of malicious code stealing our data from legitimate sites? Luckily, browsers do not allow for this, and every website executes JavaScript code in its own sandbox within the browser. Code from one website cannot access data or functionality from another website. This is one of the most fundamental security properties of the web. Some browsers use very sophisticated sandboxing mechanisms, like running each tab in a separate operating system process. Downloading code over the Secure HTTP Protocol and using Subresource Integrity, or SRI for short, prevents attackers from injecting their own malicious code into benign sites. JavaScript code running in the browser is restricted in what it can do. It has no access to local resources in a user's computer, and this applies to devices such as webcams or microphones, the file system, and the local network. The code can use those resources only using very limited browser APIs. This allows the browser to minimize the attack surface and ask the user for explicit consent for using those resources. Code originating from different sites cannot access each other's data and functionality. This allows for even stronger protection of data and code execution within the browser.