Launch Announcement: DOTENET (Digg Clone)

firoz.ansari — Sun, 18 Mar 2007 06:46:00 GMT

Its give me immense pleasure to announcement .NET portal - DOTENET (URL: www.dotenet.com). It’s "Digg" style web application dedicated to .NET and relative technologies. This portal will serve as central hub to share articles, tutorials, blog post etc.

When I was planning to create this portal two months back, I was sure that first release of this project will have minimum "must to have" features and later I will add features which are "good to have". And that’s why you will notice many blank pages on this portal. These blank pages are place-holder for features which I will add in coming weeks (depending upon available bandwidth).

The desired goal of creating a community portal cannot be achieved without your active participation. Please register yourself to this portal and share any article or post which you think useful to .NET community. If you find any existing link useful in DOTNET portal, please vote for that link so that link can be push to popular segment.

As you continue participating in this portal, please keep in mind that this community portal needs your feedback to remain alive. Please provide your feedback/opinion/suggestion to my blog (URL: Announcement: DOTENET)

URL: Home Page

URL: Registration Page

Vulnerable JavaScript Comments

firoz.ansari — Fri, 26 May 2006 12:10:00 GMT

Today while checking balance in my banker’s web portal, which is self acclaimed as one of the most secured online banking portal of India, I curiously thought of inspecting their HTML content using View Source. But I really shocked (and I almost got heart attack) to see whole bunch of JavaScript comment placed all over their pages. Most interesting thing was that these JavaScript snippets not only tell you bug numbers, who have done those modifications, on which date, but also what was the actual issue and how they have resolved that issue.

The most interesting part was:
<script language="JavaScript1.2"> function alert_keycode(){ /* Abhilash.


This script was added bcze on pressing enter key on pwd field used to get Submittted but since the Command Action invoked was diff one that of OK button, it was not producing desired results. The solution was create a temp hidden field and changing Pwd field name to that of Ok button dynamically, assigning tmp-hidden field name/value with original Pwd Field name/value. 
And submit is invoked
*/

frm = document.confirmFrm; if(event.keyCode==13) { blah blah blah

I love this “detailed” and technically well explained comment provided by developer in HTML code.

On serious note, I never prefer to put these JavaScript comments in my code as you can realize from comments like these, it might give lead to reveal any vulnerability or security hole in application. Even if you don’t want to consider the increase of payload of page because of these JavaScript comment but still putting comments with all kind technical or business explanations is major security risk to your application. Don’t do that!

IMO, these code comments are for developer and not for user. My suggestion to all web developers to use server side comments instead of any client side comment specially if you are developing application for financial institutions etc.

What is your opinion if I modify above code like this:
<script language="JavaScript1.2"> function alert_keycode(){ <% /*Abhilash.

This script was added bcze on pressing enter key on pwd field used to get Submittted but since the Command Action invoked was diff one that of OK button, it was not producing desired results. The solution was create a temp hidden field and changing Pwd field name to that of Ok button dynamically, assigning tmp-hidden field name/value with original Pwd Field name/value. And submit is invoked */ %> frm = document.confirmFrm; if(event.keyCode==13) { blah blah blah </script>

I guess later one is more secured than the original one. Do you agree with me??

Please provide your comment here:

http://www.firoz.name/2006/05/26/vulnerable-javascript-comments/

Firoz Ansari's Weblog : ASP.NET

Launch Announcement: DOTENET (Digg Clone)

Vulnerable JavaScript Comments