the-web-application-hackers-handbook

Chapter 3 n Web Application Technologies 61
In the earliest days of web application security, CSS was largely overlooked
and was considered to have no security implications. Today, CSS is increasingly
relevant both as a source of security vulnerabilities in its own right and as a
means of delivering effective exploits for other categories of vulnerabilities (see
Chapters 12 and 13 for more information).
JavaScript
Hyperlinks and forms can be used to create a rich user interface that can easily
gather most kinds of input that web applications require. However, most applications
employ a more distributed model, in which the client side is used not
simply to submit user data and actions but also to perform actual processing
of data. This is done for two primary reasons:
n It can improve the application’s performance, because certain tasks can
be carried out entirely on the client component, without needing to make
a round trip of request and response to the server.
n It can enhance usability, because parts of the user interface can be dynamically
updated in response to user actions, without needing to load an
entirely new HTML page delivered by the server.
JavaScript is a relatively simple but powerful programming language that
can be easily used to extend web interfaces in ways that are not possible using
HTML alone. It is commonly used to perform the following tasks:
n Validating user-entered data before it is submitted to the server to avoid
unnecessary requests if the data contains errors
n Dynamically modifying the user interface in response to user actions — for
example, to implement drop-down menus and other controls familiar
from non-web interfaces
n Querying and updating the document object model (DOM) within the
browser to control the browser’s behavior (the browser DOM is described
in a moment)
VBScript
VBScript is an alternative to JavaScript that is supported only in the Internet
Explorer browser. It is modeled on Visual Basic and allows interaction with
the browser DOM. But in general it is somewhat less powerful and developed
than JavaScript.
Due to its browser-specific nature, VBScript is scarcely used in today’s web
applications. Its main interest from a security perspective is as a means of
delivering exploits for vulnerabilities such as cross-site scripting in occasional
situations where an exploit using JavaScript is not feasible (see Chapter 12).