Out of Memory: javascript

Showing posts with label javascript. Show all posts

Wednesday, April 23, 2014

Avoid XSS and allow some html tags with JavaScript

In order to prevent Application from XSS attacks I usually use following rules:

Determine the level of security for your application.
There are several tools that can protect your application as for me better security is provided by OWASPtools: ESAPI or AntySami.
Note:Using Sanitization does not guarantee filtering of all malicious code, so tools can be more or less secure.
Understand whether you need to perform sanitization on client, server or both sides. In most cases it's enough to do this on server side.
Understand whether you need to preserve html tags (and what tags you need to preserve) or not. As it was stated previously not allowing html tags is more secure solution.

Based on this you can find a proper decision.
1. Personally for server code sanitization I used jSoup. As for me it's pretty good tool to do this.
Usually In order to check input vulnerability I am using following vector:

';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//-->

">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>

In case you need prevent XSS on client side you can use following tools:
a) JSSANItazer seems a bit outdated
b) Dust - maintained by twitter;

These tools easily can allow you to sanitize your input and mainly is answer for your question.

Server side tools mentioned above.

Regarding 3rd point. In case you don't need to handle html tags you can easily use ESAPI on server side andESAPI4JS on client side. As I understand it doesn't work for you.

When I read your task I understood that you are storing email message therefore In your case it's required to sanitize input on server side (using one of tools) and it's as per you to add it or not on client side. You need only decide whether add another sanitization on UI side or render your "preview page" on server.

http://stackoverflow.com/questions/19824338/avoid-xss-and-allow-some-html-tags-with-javascript/19943011#19943011

Tuesday, February 5, 2013

JSP Variable Accessing in JavaScript

alert("${variable}");

alert("<%=var%>");

or full example

<html> 
<head>
<script language="javascript"> 
function access(){ 
<% String str="Hello World"; %>
var s="<%=str%>"; 
alert(s); 
} 
</script> 
</head> 
<body onload="access()"> 
</body> 
</html>

source

http://stackoverflow.com/questions/4803906/jsp-variable-accessing-in-javascript

Saturday, November 17, 2012

Difference between using var and not using var in JavaScript

If you're in the global scope then there's no difference.
If you're in a function then "var" will create a local variable, "no var" will look up the scope chain until it finds the variable or hits the global scope (at which point it will create it):

// These are both globals
var foo = 1;
bar = 2;

function()
{
    var foo = 1; // Local
    bar = 2;     // Global

    // Execute an anonymous function
    (function()
    {
        var wibble = 1; // Local
        foo = 2; // Inherits from scope above (creating a closure)
        moo = 3; // Global
    }())
}

If you're not doing an assignment then you need to use var:

var x; // Declare x

http://stackoverflow.com/questions/1470488/difference-between-using-var-and-not-using-var-in-javascript

Wednesday, September 26, 2012

Getting of selected records

There is no such method, and 2.9 is no longer supported .... so,

var recIndices = myDT.getSelectedRows();
var recs = [];
for(var i=0; i recs.push( myDT.getRecord(recIndices[i]) );

// leaves you with recs an Array of Records ....

// if you want a recordset of only the selected ones ... follow up with,

var newRS = new YAHOO.widget.RecordSet();
newRS.addRecords(recs);

http://yuilibrary.com/forum/viewtopic.php?p=34368

Sunday, September 23, 2012

JavaScript === vs == : Does it matter which “equal” operator I use?

The identity (===) operator behaves identically to the equality (==) operator except no type conversion is done, and the types must be the same to be considered equal.

Reference: Javascript Tutorial: Comparison Operators

The == operator will compare for equality after doing any necessary type conversions. The ===operator will not do the conversion, so if two values are not the same type === will simply returnfalse. It's this case where === will be faster, and may return a different result than ==. In all other cases performance will be the same.

To quote Douglas Crockford's excellent JavaScript: The Good Parts,

JavaScript has two sets of equality operators: === and !==, and their evil twins == and !=. The good ones work the way you would expect. If the two operands are of the same type and have the same value, then === produces true and !== produces false. The evil twins do the right thing when the operands are of the same type, but if they are of different types, they attempt to coerce the values. the rules by which they do that are complicated and unmemorable. These are some of the interesting cases:
'' == '0'           // false
0 == ''             // true
0 == '0'            // true
false == 'false'    // false
false == '0'        // true
false == undefined  // false
false == null       // false
null == undefined   // true
' \t\r\n ' == 0     // true
The lack of transitivity is alarming. My advice is to never use the evil twins. Instead, always use ===and !==. All of the comparisons just shown produce false with the === operator.

Update:

A good point was brought up by @Casebash in the comments and in @Phillipe Laybaert's answerconcerning reference types. For reference types == and === act consistently with one another (except in a special case).

var a = [1,2,3];
var b = [1,2,3];
var c = { x: 1, y: 2 };
var d = { x: 1, y: 2 };
var e = "text";
var f = "te" + "xt";

a == b            // false
a === b           // false

c == d            // false
c === d           // false

e == f            // true
e === f           // true

The special case is when you compare a string literal with a string object created with the Stringconstructor.

"abc" == new String("abc")    // true
"abc" === new String("abc")   // false

Here the == operator is checking the values of the two objects and returning true, but the === is seeing that they're not the same type and returning false. Which one is correct? That really depends on what you're trying to compare. My advice is to bypass the question entirely and just don't use theString constructor to create string objects.

http://stackoverflow.com/questions/359494/javascript-vs-does-it-matter-which-equal-operator-i-use

JavaScript By Example

Callback functions make functions in JavaScriot far more flexiblwe than they would otherwise be.By passing a function into another function as a parameter we make the function it is passed to more flexible in that part of its processing is now determined by the function we pass to it.

In this example we have a generic processArray function that will run our callback function for every single entry in the array. Just what that processing will be is not defined in our processArray function but is instead determined by the function passed into the second argument.Unless we need to be able to call the callback function from elsewhere in our code outside the function we are passing it to we can also simplify our code by just passing it as an anonymous function. For the purpose of the example we pass in an anonymous function that will multiply each of the entries in the array by two. Should we want to change what is to be done with each entry in the array we'd just change the content of the function that we are using as the second parameter.

var myary = [4, 8, 2, 7, 5];

processArray = function(ary, callback) {
for (var i = ary.length-1; i >= 0; i--)
&nsp; ary[i] = callback(ary[i]);
}
return ary;
}

myary = processArray(myary, function(a) {return a * 2;});

http://javascript.about.com/od/byexample/a/usingfunctions-callbackfunction-example.htm

Friday, August 17, 2012

Issue with maxCacheEntries

I am sure you would have solved the problem by now. I have joined the forum recently and have seen this post just now. But for this, simply add a bustCache=(new Date()).getTime() parameter to your URL. It will work fine in every browser. You should do it at "getEmployeeList?bustCache="+(new Date()).getTime(). The problem is not because of YUI, but because of cache of browser.

http://yuilibrary.com/forum/viewtopic.php?f=90&t=10334

Saturday, November 19, 2011

tablesorter

tablesorter is a jQuery plugin for turning a standard HTML table with THEAD and TBODY tags into a sortable table without page refreshes. tablesorter can successfully parse and sort many types of data including linked data in a cell. It has many useful features including:

Multi-column sorting
Parsers for sorting text, URIs, integers, currency, floats, IP addresses, dates (ISO, long and short formats), time. Add your own easily
Support secondary "hidden" sorting (e.g., maintain alphabetical sort when sorting on other criteria)
Extensibility via widget system
Cross-browser: IE 6.0+, FF 2+, Safari 2.0+, Opera 9.0+
Small code size

http://tablesorter.com/docs/

Out of Memory