The common vulnerability classes in web applications and APIs, such as injection, XSS, CSRF, broken access control and SSRF, how each one works, and how to prevent it in code and in your build pipeline.
You’re reading a free preview. Sign up to see every topic and question — and to play this deck as games.
How cross-site scripting gets script into a page, how output encoding and framework escaping stop it, and how a Content Security Policy limits the damage.
36 total questions
Card #1
Cross-site scripting (XSS)
Card #2
Stored XSS
Card #3
Reflected XSS
1. A React profile page renders each user's bio with dangerouslySetInnerHTML so that line breaks show. What risk does this add?
2. A server places a user value inside a JavaScript string in an inline script block and HTML-entity-encodes it first. What is the best fix?
3. Users can set a website link on their profile, and the app HTML-encodes it before putting it in an href. What can still go wrong?
1. In a CSP, the ___ directive limits where scripts may be loaded from.
Hint: Named after the resource type plus "src".
2. The CSP directive ___ restricts the URLs that a page's forms can submit to.
Hint: Named after the form attribute that holds the target URL.
3. In Vue, the ___ directive inserts raw HTML and skips Vue's escaping.
Hint: Vue directives start with v-.
