Javascript Security

How to secure JavaScript with minimal Steps

step 1: Test for NPM Vulnerabilities

 npm run audit
        

Common practice is to run NPM command in the CI snippets for each PR to identify vulnerabilities

notes: Github has a bot named Dependabot to scan NPM depend automaticallty

step 2: Automated Upgrading Minor and Patch Version

using the ^ or ~ symbol in front of the NPM packages version Technically will allow you to update with the latest version reducing security risks. Usual Minor and patch versions are both backward compatible.

//Minor releases: 1 or 1.x or ^1.0.4
{
  boostrap: ^1.0.0 
}

//or

//Patch releases: 1.0 or 1.0.x or ~1.0.4 
{
  boostrap: ~1.0.4 
}        

step 3: Check JavaScript files from 3rd-party with Integrity Checks

<script
       src="https://cdn.jsdelivr.net/npm/bootstrap@5.2.1/dist/js/bootstrap.bundle.min.js"
  data-stripped-integrity="sha384-u1OknCvxWvY5kfmNBILK2hRnQC3Pr17a+RTT6rIHI7NnikvbZlHgTPOOmMi466C8"
  crossorigin="anonymous"
></script>        

the integrity attribute allows the modern browser to check the fetched file to ensure that the code is never been manipulated. In case is manipulated the file, the browser will block the fetching operation

step 4: Filter JS injections (XSS)

filter the text from the form submitted or before you save it in the database

example:

<script></script> => replace "<" with "^lt;" and ">" with "^tl;"

<style></style> => remove HTML tags with a helper function

step 5: Lint working Code

Linters help to keep the quality of code and avoid common mistakes;

Few popular tools:

• JSLint
• JSHint
• ESLint

Tools like SonarCloud can be used to identify code smells and security vulnerabilities with a Sonar report.

step 6: Keep String Mode On

benefits of "strict mode" is on:

Throw errors when "unsafe" actions are taken( gain access and manipulate the global object)

throw errors for the uses case when errors were kept silent

Forbidden the use of reserved words which are used in future versions of ECMAScript

step 7: Minify & Normalize Production Code

As a common practice, in the case of minifying and normalizing Javascript code, it is difficult to exploit the vulnerabilities in the written code.

is not recommended to have a readable source code in the production build, usual will increase the attacks from hackers