Javascript Security
"an insecure mess"
High level overview
High level overview
Introducing
JSprime is a light-weight source code scanner for identifying security issues (DOM XSS) using static analysis
It is written in JavaScript to analyze JavaScript
How it works ?
-
It pushes the code to Esprima, to generate AST
-
Parse the JSON AST, to locate all sources and keeping track of their scopes.
-
Parse the AST, to locate sinks and sink aliases keeping trak of the scope they are in.
-
Parse AST to locate functions which are fed with sources as arguments.
How it works ?
-
Once all the sources are collected it will remove the sources which won't pass a set of predefined filters.
-
Remaining sources are tracked for assignments or pass as argument operation to the collected sinks.
-
After that a report is generated with different color coding.
Demo time.
What it can't do?
-
It can't detect 100% of the issues.
-
It can't learn sources and sinks automaticaly.
-
It can't handle obfuscated JavaScript.
-
It can't analyze dynamically generated JavaScript using 'eval' or similar methods.
What about the rest of the code ?
Introducing Retire.js
"What you require you must also retire."
Can scan a web application or node app for use of vulnerable JavaScript libraries and Node modules.
Retire.js
It can be run in multiple ways:
-
Command line scanner
-
Grunt/Glup plugin/task
-
Chrome and Firefox extension
How it works ?
Retire.js
How it works ?
(focus on command line)
Running "retire" in cmd on the root of the application.
After that the tool will check the libraries dependencies used in the project and compare them to the ones listed in the 2 files.
Retire.js
How it works ?
(focus on command line)
