Suche senden
Hochladen
So you thought you were safe using AngularJS.. Think again!
•
3 gefällt mir
•
2,939 views
L
Lewis Ardern
Folgen
From the talk https://conferences.oreilly.com/fluent/fl-ca/public/schedule/detail/58543
Weniger lesen
Mehr lesen
Internet
Melden
Teilen
Melden
Teilen
1 von 50
Jetzt herunterladen
Downloaden Sie, um offline zu lesen
Empfohlen
Reviewing AngularJS
Reviewing AngularJS
Lewis Ardern
OWASP London - So you thought you were safe using AngularJS.. Think again!
OWASP London - So you thought you were safe using AngularJS.. Think again!
Lewis Ardern
OWASP Portland - OWASP Top 10 For JavaScript Developers
OWASP Portland - OWASP Top 10 For JavaScript Developers
Lewis Ardern
How Secure Is AngularJS?
How Secure Is AngularJS?
Ksenia Peguero
AppSec Tel Aviv - OWASP Top 10 For JavaScript Developers
AppSec Tel Aviv - OWASP Top 10 For JavaScript Developers
Lewis Ardern
OWASP SF - Reviewing Modern JavaScript Applications
OWASP SF - Reviewing Modern JavaScript Applications
Lewis Ardern
Manual JavaScript Analysis Is A Bug
Manual JavaScript Analysis Is A Bug
Lewis Ardern
XSS Magic tricks
XSS Magic tricks
GarethHeyes
Empfohlen
Reviewing AngularJS
Reviewing AngularJS
Lewis Ardern
OWASP London - So you thought you were safe using AngularJS.. Think again!
OWASP London - So you thought you were safe using AngularJS.. Think again!
Lewis Ardern
OWASP Portland - OWASP Top 10 For JavaScript Developers
OWASP Portland - OWASP Top 10 For JavaScript Developers
Lewis Ardern
How Secure Is AngularJS?
How Secure Is AngularJS?
Ksenia Peguero
AppSec Tel Aviv - OWASP Top 10 For JavaScript Developers
AppSec Tel Aviv - OWASP Top 10 For JavaScript Developers
Lewis Ardern
OWASP SF - Reviewing Modern JavaScript Applications
OWASP SF - Reviewing Modern JavaScript Applications
Lewis Ardern
Manual JavaScript Analysis Is A Bug
Manual JavaScript Analysis Is A Bug
Lewis Ardern
XSS Magic tricks
XSS Magic tricks
GarethHeyes
BSides Leeds - Performing JavaScript Static Analysis
BSides Leeds - Performing JavaScript Static Analysis
Lewis Ardern
ng-owasp: OWASP Top 10 for AngularJS Applications
ng-owasp: OWASP Top 10 for AngularJS Applications
Kevin Hakanson
Breaking AngularJS Javascript sandbox
Breaking AngularJS Javascript sandbox
Mathias Karlsson
Top Ten Web Application Defenses v12
Top Ten Web Application Defenses v12
Jim Manico
Top Ten Java Defense for Web Applications v2
Top Ten Java Defense for Web Applications v2
Jim Manico
Development Security Framework based on Owasp Esapi for JSF2.0
Development Security Framework based on Owasp Esapi for JSF2.0
Rakesh Kachhadiya
Top Ten Proactive Web Security Controls v5
Top Ten Proactive Web Security Controls v5
Jim Manico
Cross Site Scripting (XSS) Defense with Java
Cross Site Scripting (XSS) Defense with Java
Jim Manico
Access Control Pitfalls v2
Access Control Pitfalls v2
Jim Manico
Server-side template injection- Slides
Server-side template injection- Slides
Amit Dubey
DefCamp 2013 - Http header analysis
DefCamp 2013 - Http header analysis
DefCamp
GitBucket: The perfect Github clone by Scala
GitBucket: The perfect Github clone by Scala
takezoe
Ten Commandments of Secure Coding
Ten Commandments of Secure Coding
Mateusz Olejarka
Java Web Application Security - Utah JUG 2011
Java Web Application Security - Utah JUG 2011
Matt Raible
Secure coding in C#
Secure coding in C#
Siddharth Bezalwar
Ajax Security
Ajax Security
Roberto Suggi Liverani
Web Application Defences
Web Application Defences
Damilola Longe, CISSP, CCSP, MSc
When Ajax Attacks! Web application security fundamentals
When Ajax Attacks! Web application security fundamentals
Simon Willison
Bsidesvienna sentinel v0.4
Bsidesvienna sentinel v0.4
nibod
Open source security
Open source security
lrigknat
Effective DevSecOps
Effective DevSecOps
Pawel Krawczyk
ASP .Net Core SPA Templates
ASP .Net Core SPA Templates
Eamonn Boyle
Weitere ähnliche Inhalte
Was ist angesagt?
BSides Leeds - Performing JavaScript Static Analysis
BSides Leeds - Performing JavaScript Static Analysis
Lewis Ardern
ng-owasp: OWASP Top 10 for AngularJS Applications
ng-owasp: OWASP Top 10 for AngularJS Applications
Kevin Hakanson
Breaking AngularJS Javascript sandbox
Breaking AngularJS Javascript sandbox
Mathias Karlsson
Top Ten Web Application Defenses v12
Top Ten Web Application Defenses v12
Jim Manico
Top Ten Java Defense for Web Applications v2
Top Ten Java Defense for Web Applications v2
Jim Manico
Development Security Framework based on Owasp Esapi for JSF2.0
Development Security Framework based on Owasp Esapi for JSF2.0
Rakesh Kachhadiya
Top Ten Proactive Web Security Controls v5
Top Ten Proactive Web Security Controls v5
Jim Manico
Cross Site Scripting (XSS) Defense with Java
Cross Site Scripting (XSS) Defense with Java
Jim Manico
Access Control Pitfalls v2
Access Control Pitfalls v2
Jim Manico
Server-side template injection- Slides
Server-side template injection- Slides
Amit Dubey
DefCamp 2013 - Http header analysis
DefCamp 2013 - Http header analysis
DefCamp
GitBucket: The perfect Github clone by Scala
GitBucket: The perfect Github clone by Scala
takezoe
Ten Commandments of Secure Coding
Ten Commandments of Secure Coding
Mateusz Olejarka
Java Web Application Security - Utah JUG 2011
Java Web Application Security - Utah JUG 2011
Matt Raible
Secure coding in C#
Secure coding in C#
Siddharth Bezalwar
Ajax Security
Ajax Security
Roberto Suggi Liverani
Web Application Defences
Web Application Defences
Damilola Longe, CISSP, CCSP, MSc
When Ajax Attacks! Web application security fundamentals
When Ajax Attacks! Web application security fundamentals
Simon Willison
Bsidesvienna sentinel v0.4
Bsidesvienna sentinel v0.4
nibod
Open source security
Open source security
lrigknat
Was ist angesagt?
(20)
BSides Leeds - Performing JavaScript Static Analysis
BSides Leeds - Performing JavaScript Static Analysis
ng-owasp: OWASP Top 10 for AngularJS Applications
ng-owasp: OWASP Top 10 for AngularJS Applications
Breaking AngularJS Javascript sandbox
Breaking AngularJS Javascript sandbox
Top Ten Web Application Defenses v12
Top Ten Web Application Defenses v12
Top Ten Java Defense for Web Applications v2
Top Ten Java Defense for Web Applications v2
Development Security Framework based on Owasp Esapi for JSF2.0
Development Security Framework based on Owasp Esapi for JSF2.0
Top Ten Proactive Web Security Controls v5
Top Ten Proactive Web Security Controls v5
Cross Site Scripting (XSS) Defense with Java
Cross Site Scripting (XSS) Defense with Java
Access Control Pitfalls v2
Access Control Pitfalls v2
Server-side template injection- Slides
Server-side template injection- Slides
DefCamp 2013 - Http header analysis
DefCamp 2013 - Http header analysis
GitBucket: The perfect Github clone by Scala
GitBucket: The perfect Github clone by Scala
Ten Commandments of Secure Coding
Ten Commandments of Secure Coding
Java Web Application Security - Utah JUG 2011
Java Web Application Security - Utah JUG 2011
Secure coding in C#
Secure coding in C#
Ajax Security
Ajax Security
Web Application Defences
Web Application Defences
When Ajax Attacks! Web application security fundamentals
When Ajax Attacks! Web application security fundamentals
Bsidesvienna sentinel v0.4
Bsidesvienna sentinel v0.4
Open source security
Open source security
Ähnlich wie So you thought you were safe using AngularJS.. Think again!
Effective DevSecOps
Effective DevSecOps
Pawel Krawczyk
ASP .Net Core SPA Templates
ASP .Net Core SPA Templates
Eamonn Boyle
AngularJS + CSP: A Perfect Match or Unhappy Marriage?
AngularJS + CSP: A Perfect Match or Unhappy Marriage?
David Johansson
Web Application Security Reloaded for the HTML5 era
Web Application Security Reloaded for the HTML5 era
Carlo Bonamico
Anjular js
Anjular js
Naga Dinesh
Rails and Content Security Policies
Rails and Content Security Policies
Matias Korhonen
How do JavaScript frameworks impact the security of applications?
How do JavaScript frameworks impact the security of applications?
Ksenia Peguero
Tech io spa_angularjs_20130814_v0.9.5
Tech io spa_angularjs_20130814_v0.9.5
Ganesh Kondal
Angular 6 Training with project in hyderabad india
Angular 6 Training with project in hyderabad india
php2ranjan
4 Anguadasdfasdasdfasdfsdfasdfaslar (1).pptx
4 Anguadasdfasdasdfasdfsdfasdfaslar (1).pptx
tilejak773
NodeJS security - still unsafe at most speeds - v1.0
NodeJS security - still unsafe at most speeds - v1.0
Dinis Cruz
API Design Essentials - Akana Platform Overview
API Design Essentials - Akana Platform Overview
Akana
Angular Js
Angular Js
Knoldus Inc.
Angular - Chapter 1 - Introduction
Angular - Chapter 1 - Introduction
WebStackAcademy
Web Security - CSP & Web Cryptography
Web Security - CSP & Web Cryptography
Samsung Open Source Group
Introduction+to+AngularJS+with+logo+from+digital+ocean.pdf
Introduction+to+AngularJS+with+logo+from+digital+ocean.pdf
ahmadfaisal744721
Building ext js apps with ES2015 using sencha visual studio code plugin
Building ext js apps with ES2015 using sencha visual studio code plugin
Sandeep Adwankar
Native - Hybrid - Web Mobile Architectures
Native - Hybrid - Web Mobile Architectures
Phong Le Duy
apidays LIVE Australia 2020 - Evaluating the usability of security APIs by Dr...
apidays LIVE Australia 2020 - Evaluating the usability of security APIs by Dr...
apidays
How to React to JavaScript Insecurity
How to React to JavaScript Insecurity
Ksenia Peguero
Ähnlich wie So you thought you were safe using AngularJS.. Think again!
(20)
Effective DevSecOps
Effective DevSecOps
ASP .Net Core SPA Templates
ASP .Net Core SPA Templates
AngularJS + CSP: A Perfect Match or Unhappy Marriage?
AngularJS + CSP: A Perfect Match or Unhappy Marriage?
Web Application Security Reloaded for the HTML5 era
Web Application Security Reloaded for the HTML5 era
Anjular js
Anjular js
Rails and Content Security Policies
Rails and Content Security Policies
How do JavaScript frameworks impact the security of applications?
How do JavaScript frameworks impact the security of applications?
Tech io spa_angularjs_20130814_v0.9.5
Tech io spa_angularjs_20130814_v0.9.5
Angular 6 Training with project in hyderabad india
Angular 6 Training with project in hyderabad india
4 Anguadasdfasdasdfasdfsdfasdfaslar (1).pptx
4 Anguadasdfasdasdfasdfsdfasdfaslar (1).pptx
NodeJS security - still unsafe at most speeds - v1.0
NodeJS security - still unsafe at most speeds - v1.0
API Design Essentials - Akana Platform Overview
API Design Essentials - Akana Platform Overview
Angular Js
Angular Js
Angular - Chapter 1 - Introduction
Angular - Chapter 1 - Introduction
Web Security - CSP & Web Cryptography
Web Security - CSP & Web Cryptography
Introduction+to+AngularJS+with+logo+from+digital+ocean.pdf
Introduction+to+AngularJS+with+logo+from+digital+ocean.pdf
Building ext js apps with ES2015 using sencha visual studio code plugin
Building ext js apps with ES2015 using sencha visual studio code plugin
Native - Hybrid - Web Mobile Architectures
Native - Hybrid - Web Mobile Architectures
apidays LIVE Australia 2020 - Evaluating the usability of security APIs by Dr...
apidays LIVE Australia 2020 - Evaluating the usability of security APIs by Dr...
How to React to JavaScript Insecurity
How to React to JavaScript Insecurity
Kürzlich hochgeladen
Nanded City ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready ...
Nanded City ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready ...
tanu pandey
Katraj ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For S...
Katraj ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For S...
tanu pandey
Shikrapur - Call Girls in Pune Neha 8005736733 | 100% Gennuine High Class Ind...
Shikrapur - Call Girls in Pune Neha 8005736733 | 100% Gennuine High Class Ind...
SUHANI PANDEY
Al Barsha Night Partner +0567686026 Call Girls Dubai
Al Barsha Night Partner +0567686026 Call Girls Dubai
Escorts Call Girls
Yerawada ] Independent Escorts in Pune - Book 8005736733 Call Girls Available...
Yerawada ] Independent Escorts in Pune - Book 8005736733 Call Girls Available...
SUHANI PANDEY
Enjoy Night⚡Call Girls Dlf City Phase 3 Gurgaon >༒8448380779 Escort Service
Enjoy Night⚡Call Girls Dlf City Phase 3 Gurgaon >༒8448380779 Escort Service
Delhi Call girls
Dubai=Desi Dubai Call Girls O525547819 Outdoor Call Girls Dubai
Dubai=Desi Dubai Call Girls O525547819 Outdoor Call Girls Dubai
kojalkojal131
Wagholi & High Class Call Girls Pune Neha 8005736733 | 100% Gennuine High Cla...
Wagholi & High Class Call Girls Pune Neha 8005736733 | 100% Gennuine High Cla...
SUHANI PANDEY
valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...
valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...
Call Girls In Delhi Whatsup 9873940964 Enjoy Unlimited Pleasure
Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.
soniya singh
Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRL
Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRL
imonikaupta
Moving Beyond Twitter/X and Facebook - Social Media for local news providers
Moving Beyond Twitter/X and Facebook - Social Media for local news providers
Damian Radcliffe
VIP Model Call Girls NIBM ( Pune ) Call ON 8005736733 Starting From 5K to 25K...
VIP Model Call Girls NIBM ( Pune ) Call ON 8005736733 Starting From 5K to 25K...
SUHANI PANDEY
Russian Call Girls in %(+971524965298 )# Call Girls in Dubai
Russian Call Girls in %(+971524965298 )# Call Girls in Dubai
Dubai call girls 971524965298 Call girls in Bur Dubai
Top Rated Pune Call Girls Daund ⟟ 6297143586 ⟟ Call Me For Genuine Sex Servi...
Top Rated Pune Call Girls Daund ⟟ 6297143586 ⟟ Call Me For Genuine Sex Servi...
Call Girls in Nagpur High Profile
Call Now ☎ 8264348440 !! Call Girls in Shahpur Jat Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Shahpur Jat Escort Service Delhi N.C.R.
soniya singh
Trump Diapers Over Dems t shirts Sweatshirt
Trump Diapers Over Dems t shirts Sweatshirt
rahman018755
Call Girls in Prashant Vihar, Delhi 💯 Call Us 🔝9953056974 🔝 Escort Service
Call Girls in Prashant Vihar, Delhi 💯 Call Us 🔝9953056974 🔝 Escort Service
9953056974 Low Rate Call Girls In Saket, Delhi NCR
Call Girls Sangvi Call Me 7737669865 Budget Friendly No Advance BookingCall G...
Call Girls Sangvi Call Me 7737669865 Budget Friendly No Advance BookingCall G...
roncy bisnoi
(INDIRA) Call Girl Pune Call Now 8250077686 Pune Escorts 24x7
(INDIRA) Call Girl Pune Call Now 8250077686 Pune Escorts 24x7
Call Girls in Nagpur High Profile Call Girls
Kürzlich hochgeladen
(20)
Nanded City ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready ...
Nanded City ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready ...
Katraj ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For S...
Katraj ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For S...
Shikrapur - Call Girls in Pune Neha 8005736733 | 100% Gennuine High Class Ind...
Shikrapur - Call Girls in Pune Neha 8005736733 | 100% Gennuine High Class Ind...
Al Barsha Night Partner +0567686026 Call Girls Dubai
Al Barsha Night Partner +0567686026 Call Girls Dubai
Yerawada ] Independent Escorts in Pune - Book 8005736733 Call Girls Available...
Yerawada ] Independent Escorts in Pune - Book 8005736733 Call Girls Available...
Enjoy Night⚡Call Girls Dlf City Phase 3 Gurgaon >༒8448380779 Escort Service
Enjoy Night⚡Call Girls Dlf City Phase 3 Gurgaon >༒8448380779 Escort Service
Dubai=Desi Dubai Call Girls O525547819 Outdoor Call Girls Dubai
Dubai=Desi Dubai Call Girls O525547819 Outdoor Call Girls Dubai
Wagholi & High Class Call Girls Pune Neha 8005736733 | 100% Gennuine High Cla...
Wagholi & High Class Call Girls Pune Neha 8005736733 | 100% Gennuine High Cla...
valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...
valsad Escorts Service ☎️ 6378878445 ( Sakshi Sinha ) High Profile Call Girls...
Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Green Park Escort Service Delhi N.C.R.
Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRL
Lucknow ❤CALL GIRL 88759*99948 ❤CALL GIRLS IN Lucknow ESCORT SERVICE❤CALL GIRL
Moving Beyond Twitter/X and Facebook - Social Media for local news providers
Moving Beyond Twitter/X and Facebook - Social Media for local news providers
VIP Model Call Girls NIBM ( Pune ) Call ON 8005736733 Starting From 5K to 25K...
VIP Model Call Girls NIBM ( Pune ) Call ON 8005736733 Starting From 5K to 25K...
Russian Call Girls in %(+971524965298 )# Call Girls in Dubai
Russian Call Girls in %(+971524965298 )# Call Girls in Dubai
Top Rated Pune Call Girls Daund ⟟ 6297143586 ⟟ Call Me For Genuine Sex Servi...
Top Rated Pune Call Girls Daund ⟟ 6297143586 ⟟ Call Me For Genuine Sex Servi...
Call Now ☎ 8264348440 !! Call Girls in Shahpur Jat Escort Service Delhi N.C.R.
Call Now ☎ 8264348440 !! Call Girls in Shahpur Jat Escort Service Delhi N.C.R.
Trump Diapers Over Dems t shirts Sweatshirt
Trump Diapers Over Dems t shirts Sweatshirt
Call Girls in Prashant Vihar, Delhi 💯 Call Us 🔝9953056974 🔝 Escort Service
Call Girls in Prashant Vihar, Delhi 💯 Call Us 🔝9953056974 🔝 Escort Service
Call Girls Sangvi Call Me 7737669865 Budget Friendly No Advance BookingCall G...
Call Girls Sangvi Call Me 7737669865 Budget Friendly No Advance BookingCall G...
(INDIRA) Call Girl Pune Call Now 8250077686 Pune Escorts 24x7
(INDIRA) Call Girl Pune Call Now 8250077686 Pune Escorts 24x7
So you thought you were safe using AngularJS.. Think again!
1.
Lewis Ardern So you
thought you were safe using AngularJS. . . . Think again!
2.
© 2016 Synopsys,
Inc. 2 Who Am I? • Lewis Ardern • Ph.D. candidate Leeds Beckett University • Security Consultant at Synopsys, previously Cigital • Twitter @LewisArdern Research Interests: • Browser Security • JavaScript • HTML5 • Static analysis
3.
© 2016 Synopsys,
Inc. 3 Agenda • AngularJS Pop Quiz • AngularJS Security Protections • AngularJS Security Issues • Third-Party Library Security Issues • Look to the future
4.
© 2016 Synopsys,
Inc. 4 AngularJS Pop Quiz What is AngularJS?
5.
© 2016 Synopsys,
Inc. 5 AngularJS Pop Quiz What is the current version of AngularJS?
6.
© 2016 Synopsys,
Inc. 6 AngularJS Pop Quiz What software design pattern is used for implementing user interfaces?
7.
© 2016 Synopsys,
Inc. 7 AngularJS Pop Quiz Who invented and who maintains AngularJS?
8.
© 2016 Synopsys,
Inc. 8 AngularJS Pop Quiz What are the benefits of AngularJS?
9.
© 2016 Synopsys,
Inc. 9 AngularJS Pop Quiz If AngularJS is on the front-end, what technologies are used on the back end?
10.
© 2016 Synopsys,
Inc. 10 AngularJS Pop Quiz What are the common and popular types of applications that AngularJS enables?
11.
© 2016 Synopsys,
Inc. 11 AngularJS Pop Quiz - Answers • AngularJS is an open source front-end JavaScript framework • What is the current version of AngularJS: – Angular 1.6.4 – Angular 4.2.2 • Angular – MVC - Model View Controller – MVVM - Model View ViewModel – MVW - Model View Whatever • Originally developed by Miško Hevery, then open sourced, and now maintained by Google • What are the benefits of AngularJS? – Separation of HTML, CSS, and JavaScript logic – Convenience in DOM manipulations – Performance • If AngularJS is on the front-end, what technologies are used on the back end? – Whatever: NodeJS, Java, C#, you name it • A lot of Angular applications are built as single-page applications (SPA)
12.
© 2016 Synopsys,
Inc. 12 Angular and OWASP Top 10 • OWASP Top 10 issues that Angular code may have: OWASP Top 10 Injection (SQL, Command, LDAP) Broken AuthN and Session Management Cross-site scripting Insecure Direct Object Reference Security Misconfiguration Sensitive Data Exposure Missing Function Level Access Control CSRF Using Components with Known Vulnerabilities Unvalidated Redirects and Forwards Kinda Kinda
13.
© 2016 Synopsys,
Inc. 13 AngularJS Security Protections
14.
© 2016 Synopsys,
Inc. 14 XSS Protection: Output Encoding • Automatic output encoding –Encoding is context aware (HTML element, attribute, URL) –All unsafe symbols are encoded, nothing is removed –Used with ng-bind <p ng-bind=“htmlCtrl.welcome"></p>
15.
© 2016 Synopsys,
Inc. 15 XSS Protection: Strict Contextual Escaping • Before AngularJS version 1.2 – ng-bind-html-unsafe directive • SCE (Strict Contextual Escaping) – uses ngSanitize module – Sanitization for a particular context: HTML, URL, CSS – Used with ng-bind-html – Enabled by default in versions 1.2 and later, but can be disabled – $sceProvider.enabled(false) – $sce.trustAs(type, value) or $sce.trustAsHtml(value) – Other $sce.trustAs methods can be in custom directives
16.
© 2016 Synopsys,
Inc. 16 XSS Protection: Content Security Policy • CSP disallows the use of eval() and inline scripts by default • CSP is configurable • Angular separates HTML, CSS, and JavaScript > no inline scripts! • Angular code is compatible with CSP out of the box • Caveats: – Angular uses eval() internally to parse expressions – https://github.com/angular/angular.js/blob/0694af8fc4c856f5174545450091602e51f02a11/src/Angular.js#L1120 – Angular may use inline styles, not inline scripts (for ngCloack, ngHide) – https://github.com/angular/angular.js/blob/0694af8fc4c856f5174545450091602e51f02a11/src/Angular.js#L1111 – Angular without unsafe eval() runs 30% slower when parsing expressions
17.
© 2016 Synopsys,
Inc. 17 XSS Protection: Enforcing Content Security Policy Note: inline styles may be abused by attackers • See Mario Heiderich’s paper on scriptless attacks – https://www.nds.rub.de/media/emma/veroeffentlichungen/2012/08/16/scriptlessAttacks-ccs2012.pdf Instead of allowing ‘unsafe-inline’ for styles, developers can include angular-csp.css in the HTML for ngCloak and ngHide directives to work. Angular Setting Code Angular Behavior Nothing <body ng-app> Use inline scripts, check for unsafe eval in the CSP header Default CSP <body ng-app ng-csp> No inline scripts, no eval No-unsafe-eval <body ng-app ng-csp="no-unsafe-eval"> Eval cannot be used, but it’s ok to use inline styles CSP must have: style-src ‘unsafe-inline’ No-inline-style <body ng-app ng-csp="no-inline-style"> Angular can use eval, but cannot use inline styles CSP must have: script-src ‘unsafe-eval’
18.
© 2016 Synopsys,
Inc. 18 XSS Protection: Bypassing The Content Security Policy Slightly modified CSP bypass example from http://sirdarckcat.github.io/csp/angular.html#f Assume this content is injected on page • Injected content can abuse Angular to execute code despite the CSP http://sebastian-lekies.de/csp/bypasses.php
19.
© 2016 Synopsys,
Inc. 19 XSS Protection: Sandbox? Not Really • All versions of Angular up to 1.6 executed Angular Expressions in a sandbox • Every version had a sandbox escape “vulnerability” • Sandbox was never considered to protect code for security reasons • What does it mean “to escape a sandbox”? – Directly manipulate the DOM – Execute plain old vanilla JavaScript • Example payload: {{x = {'y':''.constructor.prototype}; x['y'].charAt=[].join;$eval('x=alert(1)');}} – http://blog.portswigger.net/2016/01/xss-without-html-client-side-template.html • As of Angular 1.6 sandbox has been completely removed – https://blogs.synopsys.com/software-integrity/2016/12/28/angularjs-1-6-0-sandbox/
20.
© 2016 Synopsys,
Inc. 20 https://www.youtube.com/playlist?list=PLhixgUqwRTjwJTIkNopKuGLk3Pm9Ri1sF
21.
© 2016 Synopsys,
Inc. 21 CSRF Protection: Help from the Client • CSRF token must be generated and validated on the server side • Angular automatically reads a cookie sent from the server and appends the value to an HTTP header • What a developer needs to do: – Securely generate CSRF token on the server-side – Add a cookie XSRF-TOKEN with the token value – Angular will add a custom header X-XSRF-TOKEN with the token value – Verify on the server if the X-XSRF-TOKEN value matches the cookie XSRF-TOKEN value – If the token and the cookie values do not match, reject the request – The cookie and header values may be changed in Angular via the $http.xsrfHeaderName and $http.xsrfCookieName options to support whatever backend solution https://www.synopsys.com/blogs/software-security/angularjs-security-http-service/
22.
© 2016 Synopsys,
Inc. 22 AngularJS Security Issues
23.
© 2016 Synopsys,
Inc. 23 Loading Angular templates insecurely • The templateURL which is used to render angular templates for routing, directives, ngSrc, ngInclude, etc • By default resources are restricted to the same domain and protocol as the application document • To load templates from other domains or protocols you may either whitelist or wrap them as trusted values • You can change these by setting your own custom whitelists and blacklists for matching such URLs.
24.
© 2016 Synopsys,
Inc. 24 Loading Angular templates insecurely • To solve the problem of not being able to load resources from another domain, an insecure whitelist may have been created in which any domain is allowed by configuring the $sceDelegateProvider.resourceUrlWhitelist using wildcards like the example below angular.module('myApp', []).config(function($sceDelegateProvider) { $sceDelegateProvider.resourceUrlWhitelist([ // Insecure - the wildcard allows resource loading from any domain using any protocol '**' ]); }); angular.module('myApp', []).config(function($sceDelegateProvider) { $sceDelegateProvider.resourceUrlWhitelist([ // Insecure - loads over HTTP, wildcard allows for any subdomain and any directory ‘http://**.example.com/**' ]); });
25.
© 2016 Synopsys,
Inc. 25 Loading Angular templates securely (Remediation) • Configure the specific protocol and domain or sub domain(s) for the resources you trust • Never use just the double asterisk (**) wildcard to allow arbitrary domains and protocols • Never use the double asterisk (**) wildcard as part of the protocol or domain, only at the end of a URL • Ensure resources are loaded over a secure protocol (e.g, only allow https:// URLs) • The blacklist can be used as a defense-in-depth measure to prevent resourcing templates that have known vulnerabilities within your application
26.
© 2016 Synopsys,
Inc. 26 Server-side templates Client-side templates JavaScript: Jade, ejs, Pug AngularJS ReactJS Java: JSP PHP: Smarty Expression Injection • Mixing server-side and client-side templates can cause XSS without the need to inject HTML tags • User input added to server-side template and then sent to client-side template: – Server-side template engine only escapes malicious HTML characters (e.g., <, >, “, ‘) – Attacker can place AngularJS expression language within {{ }} – Will not be escaped by server-side code – Will be executed by the client-side AngularJS template – Will run within a sandbox with limited execution of JavaScript (prior to version 1.6) – Sandbox bypass is always possible! • Avoid using both client-side and server-side templates! – Keep app logic on server side and presentation on client side
27.
© 2016 Synopsys,
Inc. 27 Expression Injection Angular Template User Input HTML Encoding Mechanism Template Engine AngularJS template View compile Malicious AngularJS code is injected through input Only HTML special characters are encoded Angular engine renders AngularJS expressions including malicious code Malicious code executes within the view 1 2 4 5 Server-Side Client-SideAngularJS expression written to template 3
28.
© 2016 Synopsys,
Inc. 28 Expression Injection (Remediation) • Where possible re-write Angular templates to be purely an AngularJS page instead of being rendered from the server – Assign the returned data to a $scope object and display that data within an expression – Return data to ng-bind or ng-bind-html • Reduce the scope of the ng-app directive. Bind to a specific <div>, <table>, etc. rather than <body> • Use the ng-non-bindable directive • Sanitize untrusted input to remove curly braces • Note: An attacker with the ability to inject HTML markup could bypass these controls <body> ... <div ng-app='myApp'> ... </div> </body> <p ng-non-bindable id='message'></p>
29.
© 2016 Synopsys,
Inc. 29 Demo Expression Injection
30.
© 2016 Synopsys,
Inc. 30 Untrusted input treated as Angular expressions • Angular expressions are code snippets (similar to JavaScript) that can be executed through various methods in Angular • AngularJS can evaluate expressions • AngularJS can order data using expressions • AngularJS can parse expressions
31.
© 2016 Synopsys,
Inc. 31 Untrusted input treated as Angular expressions Services $compile(element, transclude, maxPriority); $parse(expression); $interpolate(text, [mustHaveExpression], [trustedContext], [allOrNothing]); $scope Methods $eval([expression], [locals]); $evalAsync([expression], [locals]); $apply([exp]); $applyAsync([exp]); $watch(watchExpression, listener, [objectEquality]); $watchGroup(watchExpressions, listener); $watchCollection(obj, listener); orderBy {{ collection | orderBy: expression : reverse : comparator}} $filter('orderBy')(collection, expression, reverse, comparator) angular.controller(‘ExampleController’, [‘$scope’, ‘orderByFilter’, function($scope, orderByFilter) { … $scope.friends = orderByFilter(collection, expression, reverse, comparator); }]) http://blog.portswigger.net/2017/05/dom-based-angularjs-sandbox-escapes.html
32.
© 2016 Synopsys,
Inc. 32 Untrusted input treated as Angular expressions (Remediation) • If possible, avoid using user-input to create expressions. • If user-input needs to be used in expressions, only use it as data within those expressions, not as part of the expression code. • If user-input needs to be evaluated as part of the expression code, strict input validation must be used to prevent arbitrary code execution. if(window.location.search) { var orderby = decodeURIComponent(window.location.search.split("=")[1]); //Using the external Object.prototype.hasOwnProperty.call() in the unlikely event that 'hasOwnProperty' has been overwritten on the object we check //In most cases, the simpler $scope.friends[0].hasOwnProperty(orderby) would work fine. if($scope.friends[0] !== undefined && Object.prototype.hasOwnProperty.call($scope.friends[0], orderby)) { $scope.orderby = orderby; } } $scope.$evalAsync('result = "Hello " + userInput + "!"');
33.
© 2016 Synopsys,
Inc. 33 Demo OrderBy Filter
34.
© 2016 Synopsys,
Inc. 34 angular.element • Angular provides its own subset of the JQuery language that is accessible via the angular.element global function • Using untrusted input in some of the element functions may lead to XSS – angular.element.after – angular.element.append – angular.element.html – angular.element.prepend – angular.element.replaceWith – angular.element.wrap • Validate the input before sending it to the angular.element functions with functions such as $sce.getTrustedHtml or $sanitize.
35.
© 2016 Synopsys,
Inc. 35 XSS in angular.element <form> <label>After:</label><input type="text" ng-model="afterinput" /> <button type="submit" ng-click="aftersubmit()">Submit</button> </form> <div ng-controller="View1Ctrl"> <div id="testDiv">{{name}}</div> </div> controller('View1Ctrl', ['$scope', '$document', function($scope, $document) { $scope.name = "ChangeMe"; var element = angular.element($document[0].querySelector('#testDiv')); $scope.aftersubmit=function() { if($scope.afterinput) element.after($scope.afterinput); } • Reading data from user • Inserting data in Angular code
36.
© 2016 Synopsys,
Inc. 36 XSS in angular.element • Payload: <p onmouseover=alert('after');>After</p> • Why is there an injection? • SCE is not automatically applied to angular.element
37.
© 2016 Synopsys,
Inc. 37 Third-Party Library Security Issues
38.
© 2016 Synopsys,
Inc. 38 Third-Party Libraries • Third-party libraries enhance our applications • There is always a risk with using third-party code • AngularJS libraries are no different • When looking at incorporating libraries in to your application you should: – Review the projects Github issue list – Use OSS tools such as ESLint (eslint-plugin-scanjs-rules) – Identify components with known vulnerabilities using Retire.js and Snyk – Look for XSS with tools such as Blue Closure Detect – Manually review the code (time consuming)
39.
© 2016 Synopsys,
Inc. 39 XSS in angular-translate • Plugin angular-translate is used for pages internationalization angular.module('app').config(function($translateProvider) { $translateProvider.translations('en', {GREETING: 'Hello <b>{{name}}</b>'}); $translateProvider.translations('de', {GREETING: 'Hallo <b>{{name}}</b>'}); $translateProvider.preferredLanguage('en'); }); angular.module('app').controller('Ctrl', function($scope, $translate, $routeParams, $route, $translateSanitization){ $translateSanitization.useStrategy(); $scope.translateValues = {name: $routeParams.name}; var lang = $routeParams.lang; if (lang !== undefined) { $translate.use(lang); } ... } <div translate="GREETING" translate-values="{translateValues.name}"></div> • Setting translation strategy to ‘null’ or leaving it out (default) leads to XSS
40.
© 2016 Synopsys,
Inc. 40 textAngular • The textAngular module is a WYSIWYG editor with collaborative editing functionality • The editor processes the input and displays it (including HTML tags) • textAngular uses textAngular-sanitizer module – Only verifies that an href starts with “http” – The string is then encoded and saved on the server • textAngular parses the link and creates a new element with the content of the link as an unencoded HTML element
41.
© 2016 Synopsys,
Inc. 41 XSS in TextAngular • Sample payload: http://A/A<img src=x onerror=alert('XSS_Success')> <p> Enter your comment <a target="" href="http://A/A<img src=x onerror=alert('XSS_Success')>">here!</a> </p>
42.
© 2016 Synopsys,
Inc. 42 XSS in TypeAhead • TypeAhead module shows hints as the user starts typing in a text field • The list of hints is not sanitized if at least one condition is met: – ui.bootstrap version prior to 0.13.4 is used – ngSanitize is not included <form ng-submit="submit()"> <input type="text" ng-submit="submit()" ng-model="search_val" typeahead="search_val for search_val in searches" class="form-control"> <input type="submit" value="Search"/> </form> module.controller( 'TypeaheadCtrl', function($scope,$http) { $scope.selected = undefined; $scope.searches = [ decodeURIComponent(window.location.search.split("?")[1]) ]; } <script src="http://angular-ui.github.io/bootstrap/ui-bootstrap-tpls-0.13.3.js"></script> var module = angular.module('app', ['ui.bootstrap']
43.
© 2016 Synopsys,
Inc. 43 Look to the future Angular 2,4,*,*,*
44.
© 2016 Synopsys,
Inc. 44 Angular 2, 4 and beyond • It’s difficult to write complex but secure applications • Angular 1.X contained many features that could introduce security problems • Angular 2 attack surface is much smaller
45.
© 2016 Synopsys,
Inc. 45 Angular 2, 4 and beyond • Unidirectional data binding – Interpolation, One/two way binding, Event Binding • No more watchers, $apply/$applyAsync, $compile, $interpolate, $eval • Vulnerable features not introduced • ES6
46.
© 2016 Synopsys,
Inc. 46 Angular 2, 4 and beyond • Encoding and Sanitization by default • Harmonizes with the Content Security Policy (CSP) • Better naming conventions – bypassSecurityTrustHtml(value: string) – bypassSecurityTrustStyle(value: string) – bypassSecurityTrustScript(value: string) – bypassSecurityTrustUrl(value: string – bypassSecurityTrustResourceUrl(value: string) • Build-time security – Precompiled templates (see AoT https://angular.io/docs/ts/latest/cookbook/aot-compiler.html)
47.
© 2016 Synopsys,
Inc. 47 Angular 2, 4 and beyond Important notes: • AngularJS is a client-side framework – The production flag can be disabled by the user – Client elements can be modified – ngShow and ngHide – RouteGuards are boolean – Sensitive data can be retrieved from localStorage and sessionStorage • Security should be enforced on the server – Access control – AuthN/AuthZ – Strict input validation – Escaping/Encoding/Sanitization
48.
© 2016 Synopsys,
Inc. 48 Angular 2, 4 and beyond Important notes: • XSS can still occur through – Explicitly trusting user data – Expression injection – Third-party libraries – Server-side interaction $('#message').text(params['user']); <?php echo htmlentities($_GET["myParameter"]) ?>
49.
© 2016 Synopsys,
Inc. 49 Conclusion • Use Angular, as it is a very secure framework: – Contextually-aware encoding – Strict contextual escaping – Separation of HTML and JavaScript – CSP compatible • Do not mix server-side and client-side templates • Do not directly use user-input in expressions • Check plugins for security issues and use the latest version • Embrace the Angular Migration from 1 to 4 • … • Profit
50.
© 2016 Synopsys,
Inc. 50 Thank you! Questions Lewis Ardern Lewis.Ardern@Synopsys.com Twitter: @LewisArdern https://www.synopsys.com/software
Jetzt herunterladen