Should we be concerned about the ethics of running javascript that is fetched through an AJAX request?

Currently, I am working on updating an existing web application that allows for user administration and login capabilities. One of the features involves modifying a user's details through a dialog box, where the updated data is then sent to the server via AJAX. Upon receiving the update response with some lines of JavaScript code to be executed in order to reflect these changes on the current page, I find this method questionable. Is it safe to execute externally acquired JavaScript?

In my opinion, a better approach would be to have the AJAX call responsible for sending the updates also trigger another function to retrieve the most recent data from the server via AJAX or simply refresh the page. Would implementing this change offer any advantages in terms of security or overall system architecture, or am I being too cautious?

javascriptajax

Answer №1

When discussing the use of eval on non-JSON data, it's important to consider the consequences.

Various opinions exist on this topic, but one common argument is that using eval can result in code that is difficult to maintain and may lead to challenging bug tracing.

Security is another issue to take into account. While some may argue that JavaScript security is solely the responsibility of the client, it's crucial to recognize that anything originating from your site should also be a concern for you.

All things considered, there seems to be little justification for evaluating JavaScript on the server side. It is generally better practice to pass data from the server and have client-side JavaScript respond to that information.

Answer №2

Every piece of JavaScript code executed on a web browser is obtained remotely.

The server responsible for sending the JS/JSON data through AJAX is also the same server that initially sent the HTML triggering the AJAX request.

If there is a potential security risk, it can still be exploited regardless of whether you choose to evaluate the result of the AJAX call or not.

Answer №3

Personally, I fail to see any significant issue with this situation. Although there are concerns about potential code execution client-side, if a malicious individual can exploit that vulnerability, then the root problem lies elsewhere - not in the ability to modify the code itself.

In all honesty, there are more urgent matters at hand than worrying about this particular aspect. It would be more beneficial to spend approximately 10 minutes reviewing your code for flaws rather than focusing on finding an alternative to eval(). Strengthening your code will likely enhance your overall security by a considerable margin.

Regarding Mike Samuel's mention of MITM attacks, I question its relevance. If you are vulnerable to such attacks, it is possible that malicious code could be injected directly into the initial HTML page (although admittedly at a slightly increased risk). However, is this truly a cause for major concern? The decision ultimately rests with you.

Answer №4

If you have complete trust in the developer who wrote all of the JavaScript code and ensure that it is protected just like the rest of your HTML page, then there should be no cause for concern.

However, even if the JavaScript code comes from a trusted source, if it is served over an insecure HTTP connection, it becomes vulnerable to attacks like Man-in-the-Middle (MITM) where attackers can tamper with the code while it is being transmitted over the network.

This opens up possibilities for malicious activities such as installing keyloggers to capture user passwords, redirecting users to phishing websites, and other harmful actions.

An attack scenario could involve intercepting a request for a JavaScript file, modifying it in transit to include malicious code, and executing it in the user's browser to steal sensitive information.

By ensuring that your website uses HTTPS protocol without any mixed content, you can mitigate the risk of MITM attacks and safeguard against such security vulnerabilities.

Answer №5

To avoid displaying incorrect information in case of a failed data update, it is not recommended to directly call another function after sending the update. Instead, the current model allows your service to customize the javascript response based on the success or failure of the update. It might be beneficial to have the service return a simple true/false value, with the callback function responsible for updating the UI accordingly.

Answer №6

Answer: Absolutely

Explanation: It is highly recommended to transmit data instead of code for both security purposes and to maintain clear separation between various implementations.

User-submitted content or ads that have not been properly sanitized can potentially introduce malicious code and execute it. While this may require a targeted attack, it is important to consider potential risks. Whether you are working on a promising startup or developing a forum platform, any security vulnerabilities can pose significant threats. In a scenario where even with a small user base, the presence of security loopholes remains detrimental to both the service provider and its users. Additionally, inaccurate security guidance shared on platforms like SO can inadvertently influence others to make poor decisions.

Think about the complexity involved in ensuring the dynamically generated code sent to clients functions flawlessly under all circumstances. What if multiple individuals are collaborating on different parts of the system? Will they possess comprehensive knowledge of each variable name to prevent conflicts? Transmitting data simplifies client/server communication, reducing the risk of unforeseen errors that could be challenging to troubleshoot effectively.

Similar questions

If you have not found the answer to your question or you are interested in this topic, then look at other similar questions below or use the search

What is the duration that browsers retain downloaded assets during a single session?

Is it necessary to preload data from the server in order to have immediate access when needed? The data is stored in a file named "data.json". Initially, I considered storing data.json in an object and referencing it whenever required. However, given tha ...

javascriptjsonajax

Do we need to employ strict mode when utilizing specific ES6 functions in Node.js?

There has been a debate circulating at my workplace regarding whether or not it is necessary to include 'use strict' when using ES6 in Node.js without Babel. Some argue that certain ES6 methods may not function correctly without it, but I haven&a ...

javascriptnode.jsuse-strict

The then() function in Node.js is triggered before the promise is fully resolved

I'm struggling to get my Promise function working as intended. Here's what I need to accomplish: I am receiving file names from stdout, splitting them into lines, and then copying them. Once the copy operation is complete, I want to initiate oth ...

javascriptnode.jspromise

Having difficulty retrieving items from Mongoose-Node database

I am currently working with a Mongodb database that stores resume objects. These objects contain various skills information and I have set up a node-express server to query the database based on specific skills. For example, when querying for a skill like ...

javascriptnode.jsmongodbexpressmongoose

There seems to be a complete absence of rendering in this particular vue

Upon initializing a fresh Vue project using Vue CLI 3 and removing all default views and components, I proceeded to add two new views. To my surprise, these views did not render when changing the URL; instead, I was met with a blank page and no error messa ...

javascriptvue.jsvuejs2vue-router

Waiting for AJAX request to complete in Selenium following a button click

After completing a form and clicking the submit button, I aim to delay checking for the newly inserted data in my view until the call is made. I'm exploring ways to make this work. Upon inspecting the page markup, it seems that the view refreshes aut ...

javaajaxseleniumselenium-webdriver

What is the best way to utilize useRef on a component that is not accessible within React BigCalendar?

I'm currently working with React Big Calendar (https://github.com/intljusticemission/react-big-calendar) and facing a challenge with responsive styling. I need to detach the horizontal scrollbar (overflow-x) of a specific div, .rbc-agenda-view, and at ...

javascriptreactjsoverflowreact-big-calendar

When using jQuery and Laravel, why does the element not appear when setting its display to block after receiving a response?

Trying to handle data (id) retrieved from the database and stored in a button, which appears in a modal like this: There are buttons for "Add" and "Remove", but the "Remove" button is hidden. What I want to achieve: When the user clicks on the "Add" but ...

javascriptphpjqueryajaxlaravel

AngularJS does not support the use of $(this) syntax

I have encountered an issue while developing a Chrome extension using AngularJS. I would like to add buttons to my popup page, and I want the ancestor node to disappear when a button is clicked. Here is the code snippet: in popup.html <div class="dea ...

javascriptjqueryangularjs

Looping through properties of objects with the help of angularJS ng-repeat is known as using objects['propertyname&#

What is the best way to iterate over an object with property names like this? $scope.myobjects = [ { 'property1': { id: 0, name: 'someone' } }, { 'property2': { id: 1, name: ' ...

javascriptangularjs

What is the best way to display my table?

In the index.php view, you will find my table located <table class="striped"> <thead> <tr> <th>Id</th> <th>Name</th> <th ...

javascriptphpjqueryajaxcodeigniter

How can you determine in Chrome when the content of an iframe has been modified by using document.write?

When working with iFrames in different browsers, there can be challenges. For example, in Internet Explorer (IE), we can effectively use the onreadystatechange event to track changes in an iFrame's content when using document.write. However, this meth ...

javascriptgoogle-chromeiframe

Encountering the error message "Unable to locate module '.nextserverpages-manifest.json'" while attempting to include `babel.config.js` in a Next.js application

During the process of setting up testing for my current next app, we incorporated some new dependencies including jest, babel-jest, @babel/preset-env, @babel/preset-react, and react-test-renderer. We also created a babel.config.js file to configure Babel s ...

javascriptnode.jsreactjstestingnext.js

Building a visual bubble representation with Reactjs and D3

I am currently encountering an issue while attempting to create a bubble chart using React + D3. Although there are npm modules available for this solution, I am unable to implement them in the project I am working on. Moreover, the lack of examples demons ...

javascriptreactjsd3.jscharts

A guide on combining two counters in Vue to create a unified value

Is there a way to track the number of times two buttons are clicked individually as well as together? <div id="app"> <p><button v-on:click="counter1 += 1">Add One More Click</button></p> <p>&l ...

javascriptvue.js

Exploring the world of nested observables in Angular through cascading HTTP requests

My plan involves the following steps: Make a request to https://reqres.in/api/users/2 This request will return the following response. { "data": { "id": 2, "first_name": "Janet", "last_name": "Weaver", "avatar": "https://s3.ama ...

ajaxangularrxjsangular2-observables

Unable to redirect with Asp response.redirect

I have a Login popup form where I use an ajax post request to Login.asp script in order to prevent the page from going to the POST URL after submission. <script> $(function() { $('#contactForm').submit(function(e){ e.preventDe ...

javascriptajaxhttp-redirectasp-classic

Utilizing Promises with Chained .then() Functions

I am struggling with simplifying the readability of my code. I have separated it into two main functions, but I am still dealing with nested .then() statements. I am looking for advice on how to structure these functions more effectively. It is important ...

javascriptnode.jswebpromise

Calculating the total value of individual sections using Jquery

I have multiple sections, each containing three input fields: <div class="product_quantity"> <div class="color-quantity"> <input onkeydown="return myFunction(event);" name="custom_small" class="custom_small" type="text"> ...

javascriptjqueryajaxinput

preventing firefox from highlighting text on a webpage

Similar Question: What's the most effective method to prevent text highlighting when clicking inside a div using JavaScript? Is there a way to prevent Firefox from highlighting content when a user clicks and drags? ...

javascriptfirefoxhighlighting