XSS Attacks: The Next Wave
snyk.io
XSS Attacks: The Next Wave
1–10 of 47 posts
Re: XSS Attacks: The Next Wave
#2The rise in the client doing heavy lifting via libraries such as React is driving an increase in vulnerabilities.
Developers getting into React don't always realize that all the code is executed in the client and any input validation and authentication they come up with has to also exist on the server storing that data.
Re: XSS Attacks: The Next Wave
#3The rise in the client doing heavy lifting via libraries such as React is driving an increase in vulnerabilities. Developers getting into React don't always realize that all the code is executed in the client and any input validation and authentication they come up with has to also exist on the server storing that data.
Developers who don't realize such basic elements of how their application actually works have no chance of creating a secure web-app.
Re: XSS Attacks: The Next Wave
#4The rise in the client doing heavy lifting via libraries such as React is driving an increase in vulnerabilities. Developers getting into React don't always realize that all the code is executed in the client and any input validation and authentication they come up with has to also exist on the server storing that data.
This has been the case since the advent of client side JavaScript. Validation can/should occur on the client side, but it MUST occur on the server side. These aren't new issues due to the use of new JavaScript libraries - they are problems that might be new to some developers.
Re: XSS Attacks: The Next Wave
#5The rise in the client doing heavy lifting via libraries such as React is driving an increase in vulnerabilities. Developers getting into React don't always realize that all the code is executed in the client and any input validation and authentication they come up with has to also exist on the server storing that data.
Completely agree! The post actually alludes to that a bit towards the end.
> Single Page Apps increase the amount of client side logic and user input processing. This makes them more likely to be vulnerable to DOM-based XSS, which, as previously mentioned, is very difficult for website owners to detect.
The more significant work we do on the client, the more interesting it becomes as an attack vector.
Re: XSS Attacks: The Next Wave
#6The rise in the client doing heavy lifting via libraries such as React is driving an increase in vulnerabilities. Developers getting into React don't always realize that all the code is executed in the client and any input validation and authentication they come up with has to also exist on the server storing that data.
Snyk's done some analysis on that aspect specifically too: https://snyk.io/blog/77-percent-of-sites-use-vulnerable-js-l...
Re: XSS Attacks: The Next Wave
#7The rise in the client doing heavy lifting via libraries such as React is driving an increase in vulnerabilities. Developers getting into React don't always realize that all the code is executed in the client and any input validation and authentication they come up with has to also exist on the server storing that data.
React by default has pretty good XSS protection. That being said, "don't trust the client" has been something developers have struggled with ever since we started writing client/server software.
Re: XSS Attacks: The Next Wave
#8IIRC the GitHub Open Source Survey noted that the people surveyed were more likely to trust OSS software in terms of security because of the transparency with vulnerabilities and the community surrounding it.
This article mentions increased use of OSS libs as a rising source of XSS. I'm really not sure what's worse - OSS that can be fixed and audited easily or proprietary software that's closed and lacking visibility.
Re: XSS Attacks: The Next Wave
#9The rise in the client doing heavy lifting via libraries such as React is driving an increase in vulnerabilities. Developers getting into React don't always realize that all the code is executed in the client and any input validation and authentication they come up with has to also exist on the server storing that data.
While those kinds of "junior developer confused by client vs server" vulnerabilities may be more common, the XSS vulnerabilities described in the article are likely being reduced by libraries like React. You really have to go through some contortions (including manipulating a property called dangerouslySetInnerHTML) to create the kind of insidious XSS vulnerabilities that were commonplace in server-rendered code a few years ago.
It used to be very easy for even experienced developers to accidentally forget to escape a variable somewhere. It took framework developers a while to realize that "escape" should be the default, and now we're at "escape by default and make the developer sign forms in triplicate to override". Which is healthy, I think.
Re: XSS Attacks: The Next Wave
#10"Single Page Apps increase the amount of client side logic and user input processing. This makes them more likely to be vulnerable to DOM-based XSS, which, as previously mentioned, is very difficult for website owners to detect."
Hmmm...assuming your back end has all the requisite validation and other security in place, how can a SPA cause an XSS? Are there any purely client side attack vectors (XSS or otherwise) that need to be considered if your back end is fully protected?