the-web-application-hackers-handbook

740 Chapter 19 n Finding Vulnerabilities in Source Code
will be used, the taint mode protection fails, and the application is still vulnerable.
In effect, the taint mode mechanism reminds programmers to perform
suitable validation on all input before using it in dangerous operations. It cannot
guarantee that the input validation implemented will be adequate.
JavaScript
Client-side JavaScript can, of course, be accessed without requiring any privileged
access to the application, enabling you to perform a security-focused
code review in any situation. A key focus of this review is to identify any
vulnerabilities such as DOM-based XSS, which are introduced on the client
component and leave users vulnerable to attack (see Chapter 12). A further
reason for reviewing JavaScript is to understand what kinds of input validation
are implemented on the client, and also how dynamically generated user
interfaces are constructed.
When reviewing JavaScript, you should be sure to include both .js files and
scripts embedded in HTML content.
The key APIs to focus on are those that read from DOM-based data and that
write to or otherwise modify the current document, as shown in Table 19-12.
Table 19-12: JavaScript APIs That Read from DOM-Based Data
API
document.location
document.URL
document.URLUnencoded
DESCRIPTION
Can be used to access DOM data that may be
controllable via a crafted URL, and may therefore
represent an entry point for crafted data to
attack other application users.
document.referrer
window.location
document.write()
document.writeln()
document.body.innerHtml
eval()
window.execScript()
Can be used to update the document’s contents
and to dynamically execute JavaScript
code. If attacker-controllable data is passed to
any of these APIs, this may provide a way to
execute arbitrary JavaScript within a victim’s
browser.
window.setInterval()
window.setTimeout()