XSS, CSRF & Injection

Preview — 3 of 10 questions

What security vulnerability exists in this code?

javascript

// User navigates to: https://example.com#<img src=x onerror='alert("hacked")'>

const fragment = window.location.hash.slice(1); // Get URL fragment
const element = document.getElementById("content");
element.innerHTML = `<div>${fragment}</div>`; // Vulnerable!

ANo vulnerability; hash is not accessible to server.

BDOM-based XSS vulnerability.

CCSRF vulnerability.

DSQL injection vulnerability.

What CSP configuration is most restrictive while still allowing the site to function?

javascript

// Option A: Allows everything (no protection)
"default-src *"
→ Scripts, styles, images from anywhere

// Option B: Only same origin (recommended)
"default-src 'self'"
→ Scripts, styles, images only from https://example.com
→ Blocks: external CDNs, inline scripts, eval()

// Option C: Allows dangerous features (defeats CSP)
"default-src 'unsafe-inline' 'unsafe-eval'"
→ Inline scripts allowed
→ eval() allowed
→ XSS protection is weakened

// Option D: Blocks everything (breaks site)
"default-src 'none'"
→ Nothing loads, site is broken

AContent-Security-Policy: *

BContent-Security-Policy: default-src 'self'

CContent-Security-Policy: default-src 'unsafe-inline' 'unsafe-eval'

DContent-Security-Policy: default-src 'none'

What security issue exists in this password comparison?

javascript

function comparePasswords(input, stored) {
  for (let i = 0; i < input.length; i++) {
    if (input[i] !== stored[i]) {
      return false; // Early return
    }
  }
  return true;
}

if (comparePasswords(userInput, hashedPassword)) {
  login();
}

ANo issue; comparison is correct.

BEarly return creates timing attack vulnerability.

CPasswords should not be compared.

DThe function is too slow.

Answer all 10 questions (7 more), see explanations for every answer, and track your score.