Secure Coding mailing list archives
JavaScript Hijacking
From: brian at fortifysoftware.com (Brian Chess)
Date: Thu, 19 Apr 2007 11:47:41 -0700
Frederik De Keukelaere <EB41704 at jp.ibm.com> writes:
Would you mind sharing the different data formats you came across for exchanging data in mashups/Web 2.0? Considering the challenges you recently discovered, it might be good to have such an overview to look at it from a security point of view.
Oops, sorry for taking so long to respond. In addition to JSON, I've seen two other uses of JavaScript as a data transport format. 1) JavaScript arrays Example: [ "a", "b", "c" ] Technically speaking, this is a subset of JSON, but in these systems there is no notion of an object, only an array. These systems are more vulnerable than systems using JSON because they're guaranteed to always use array syntax. 2) Function calls Example: addRecord("a", "b", "c"); This format is even easier to hijack, just define the named function. This is the worst of the bunch from a confidentiality standpoint. Regards, Brian
Current thread:
- JavaScript Hijacking Brian Chess (Apr 01)
- <Possible follow-ups>
- JavaScript Hijacking Stefano Di Paola (Apr 02)
- JavaScript Hijacking Brian Chess (Apr 02)
- JavaScript Hijacking Stefano Di Paola (Apr 03)
- JavaScript Hijacking Frederik De Keukelaere (Apr 05)
- Foundations of Security: What Every Programmer Needs to Know McGovern, James F (HTSC, IT) (Apr 04)
- JavaScript Hijacking Brian Chess (Apr 02)
- JavaScript Hijacking Brian Chess (Apr 19)