Presented at
RVAsec 2018,
June 8, 2018, 10:10 a.m.
(50 minutes).
According to a StackOverflow survey, JavaScript is the most commonly used programming language on earth. Today just the client-side JavaScript ecosystem has over 50 frameworks available, and JavaScript is successfully conquering the server-side space. The amount of application logic that is executed in the browser is growing every year, which means the attack surface is growing as well. Which security issues are most common in JavaScript applications? Do new frameworks provide the security controls needed to protect the growing amount of client-side code? In this talk we will answer these questions and, as an example, we will look at one of the hottest JavaScript frameworks today – React. We will discuss its new features like components and server-side DOM rendering, analyze React’s security posture and demonstrate existing vulnerabilities.
Presenters:
-
Ksenia Peguero
- Synopsys
Ksenia Peguero is a Sr. Research Lead within Synopsys Software Integrity Group. She has eight years of experience in application security and five years in software development. Ksenia is a subject matter expert in static analysis and JavaScript frameworks and technologies. Before diving into research, she worked in a variety of software security practices including penetration testing, threat modeling, code review, static analysis tool design, customization, and deployment. Over the years, she performed numerous engagements for clients in financial services, entertainment, telecommunications, energy, and enterprise security industries. Throughout her consulting career, Ksenia has established and evolved secure coding guidance for many different firms, and has delivered numerous software security training sessions. Ksenia speaks regularly at events around the world, such as BSides Security in London, Nullcon in India, RSA in Singapore, and AppSec Europe in Italy. She has also served on review boards of AppSec USA and AppSec EU conferences.
Links:
Similar Presentations: