client-side code execution

8 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Never use eval() or new Function()

The eval() function is dangerous and should never be used. Using eval() or new Function() opens doors to remote code execution and XSS. If you feel the need to use eval(), it usually indicates a problem in your design.

Permissions overreach - request only necessary permissions

Browser extensions should request only the permissions that are absolutely necessary. Follow the Principle of Least Privilege (PoLP). Use optional permissions whenever possible instead of granting full access upfront. Regularly audit and remove any permissions that are no longer needed.

Code injection - use CSP and avoid eval()

To prevent code injection in extensions: use Content Security Policy (CSP) to restrict script sources, avoid using eval() and innerHTML as they can execute malicious code, and prefer using extension messaging APIs instead of injecting scripts into web pages.

Malicious updates - sign updates and verify integrity

Sign extension updates with digital signatures to ensure authenticity. Instead of fetching updates within the extension, rely on updates from the extension marketplace. Implement integrity checks before executing any fetched code. Do not fetch and eval remote scripts.

Third-party dependencies - audit for vulnerabilities

Regularly audit third-party dependencies for security vulnerabilities using tools like npm audit or OWASP Dependency-Check to detect risks. Prefer actively maintained libraries with frequent security updates.

Privacy controls - require privacy policy and consent

Implement a clear privacy policy that explains data collection practices. Allow users to opt out of data collection. Disclose data-sharing practices to comply with GDPR, CCPA, and other privacy regulations.

Insecure message passing - validate sender in Service Worker

In Service Workers, when receiving messages via chrome.runtime.onMessage, always validate sender.id to ensure the message originates from your own extension (compare with chrome.runtime.id), validate sender.url or sender.origin to restrict which extension pages or content scripts may communicate, avoid allowing webpages to indirectly influence privileged logic through content scripts, and perform strict validation and allow-listing of request.action and all request parameters.

Insecure message passing - content scripts less trustworthy than extension pages

Chrome explicitly states that content scripts are less trustworthy than extension pages and must be treated accordingly when validating incoming messages in Service Workers.

Give your agent this brain