cure53 / mustache-security Goto Github PK

Hey,

I've just stumbled upon your security audits and they are very well done. I was 
wondering if you would be interested in auditing the web framework I'm working 
on: React.

Website: http://facebook.github.io/react/
Where to report issues: https://www.facebook.com/whitehat
Source: http://fb.me/react-0.5.1.js

React is a different beast than all the other frameworks you evaluated and I 
hope that you will find interesting ways to attack it :)

Some random information:
 - React is CSP compliant without any modification.
 - The weakest point we know about is the `style` attribute. It doesn't have a proper parser and may be an XSS vector. However, we been able to come up with any working attack.
 - React is heavily being used at Facebook and Instagram, so any vulnerability found is likely to be rewarded in the Whitehat program.

One thing I came across, that has actually gotten much better, is what the 
secure defaults were for various client-side templating engines regarding XSS.  
HTML encode-by-default should probably be the standard since most cases should 
not need to render markup as markup.

For example, on the .Net side, Razor templates are significantly more secure by 
default than Webforms against XSS since Razor HTML encodes by default where it 
takes using special syntax in Webforms to do this.  

Looking at the client-side engines, I recall seeing that underscore.js had no 
HTML encoding in the default usage.  Similarly, JsRender did not html encode by 
default and required special syntax to trigger it, which is very prone to 
developer error and very hard to ensure everything is encoded properly 
(especially when 99% of your template substitutions should not generally need 
to render HTML as HTML -- it's Simon Says security, which is not very secure).  

Most of the other templating engines that I recall were secure by default.  
This should probably be one of the key criteria in evaluating the ongoing 
security offered by each platform.

Great work so far!

-Jason

Describe bypasses for AngularJS <1.2.19 / <1.3.0-beta.14.