Common Vulnerabilities — Series 3

Preview — 3 of 10 questions

Which of these is safe to call with a string that came from the user?

javascript

setTimeout(userInput, 100);            // A
new Function(userInput)();             // B
setTimeout(() => render(userInput), 100); // C
eval(userInput);                       // D

Which line produces a value suitable for a password-reset token?

javascript

const a = Math.random().toString(36).slice(2);              // A
const b = Date.now().toString(36);                          // B
const c = btoa(userEmail + Date.now());                     // C
const d = crypto.randomUUID();                              // D

A checkout form posts { productId, price }, where price comes from a hidden input the page filled in. What is the problem?

AThe client controls every field it sends, so the server must look the price up from the product itself and ignore the submitted value.

BNothing — a hidden field is not visible in the UI, so it cannot be edited.

CNothing, as long as the field is also validated in JavaScript before submitting.

DOnly that hidden fields are bad for accessibility.

Answer all 10 questions (7 more), see explanations for every answer, and track your score.