News for hackers. Stuff that matters.

A comment on Looking at how many sites use vulnerable JavaScript libraries. Parent comment

Re:Looking at how many sites use vulnerable JavaScript libra... by bastawhiz on Wednesday November 22, 2017 @03:14PM (#15760162)
An XSS issue could make your users' data vulnerable.
[ Parent | on HN ]
Re:Looking at how many sites use vulnerable JavaScript libra... by oneweekwonder on Wednesday November 22, 2017 @03:47PM (#15760475)
But cors[0] headers can mitigate some of the risk?

[0]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

[ Parent | on HN ]
Re:Looking at how many sites use vulnerable JavaScript libra... by amenghra on Wednesday November 22, 2017 @05:17PM (#15761177)
You want CSP headers to mitigate XSS risks.
[ Parent | on HN ]
Re:Looking at how many sites use vulnerable JavaScript libra... by thefreeman on Wednesday November 22, 2017 @04:51PM (#15761016)
Not really. CORS headers are set by the destination of the XHR. In the case of XSS it would be an attacker controlled server used to exfiltrate user cookies, etc.
[ Parent | on HN ]
Re:Looking at how many sites use vulnerable JavaScript libra... by zaarn on Thursday November 23, 2017 @08:17AM (#15764815)
Your backend should be double-checking any escaping the frontend does.

Otherwise you can throw your fancy anti-XSS on the frontend in the bin.

Also CSP helps.

[ Parent | on HN ]
Re:Looking at how many sites use vulnerable JavaScript libra... by merb on Wednesday November 22, 2017 @03:14PM (#15760171)
is still only an issue if you pass untrusted data to your js code.
[ Parent | on HN ]
Re:Looking at how many sites use vulnerable JavaScript libra... by Klathmon on Wednesday November 22, 2017 @03:22PM (#15760247)
And there is a pretty good chance of that happening in most JS projects.

Anywhere you take or show input from the user (an input box, a URL query, displaying data stored by some other system on the DB, etc...) could be a vector for an XSS attack.

And it's not just data passed to JS, but data passed to HTML or any data that could make it's way into CSS in many cases!

[ Parent | on HN ]
Re:Looking at how many sites use vulnerable JavaScript libra... by sakshyamshah on Thursday November 23, 2017 @01:24AM (#15763209)
turns out that most of times, untrusted user supplied data slips through JS codes https://www.owasp.org/index.php/Top_10_2017-Top_10
[ Parent | on HN ]