Mike Samuel mikesamuel

Options for Hardening React &| JSX

Background
Problem
Options
Hybrid of Before Desugar and Mutate Reconciler

Node Frenemies

Lets project teams trust code they know with more than code they don't.

Goal
Non-goals
Use Case Summary
Solution: Node module loader acts as trusted intermediary to enable mutual suspicion
- Reliable Channel Example

Example Code

URL Classifier Builder

This is now implemented: https://github.com/OWASP/url-classifier

Problem

Matching URLs with regular expressions is hard. Even experienced programmers who are familiar with the URL spec produce code like /http:\/\/example.com/ which spuriously matches unintended URLs like

Secure Header Set

_{^{tinyurl.com/sec-header-sets}}

A proposed library that provides safe defaults (with opt-out) for security-relevant HTTP response headers.

Secure Header Set
Background

1. Clone your fork:

git clone [email protected]:YOUR-USERNAME/YOUR-FORKED-REPO.git

2. Add remote from original repository in your forked repository:

cd into/cloned/fork-repo
git remote add upstream git://github.com/ORIGINAL-DEV-USERNAME/REPO-YOU-FORKED-FROM.git
git fetch upstream

	"use strict";

	// Prompted by https://esdiscuss.org/topic/json-canonicalize

	// Given a string of JSON produces a string of JSON without unnecessary
	// degrees of freedom like whitespace, optional escape sequences, and
	// unnecessary variance in number representation.
	function hashable(json) {
	const strs = [] // Side table to collect string bodies
	return reorderProperties(

	image: java:8-jdk

	stages:
	- build
	- test
	- deploy

	before_script:
	# - echo `pwd` # debug
	# - echo "$CI_BUILD_NAME, $CI_BUILD_REF_NAME $CI_BUILD_STAGE" # debug

	"use strict";
	const vm = require("vm");

	const sandbox = { anObject: {} };
	const whatIsThis = vm.runInNewContext(`
	const ForeignObject = anObject.constructor;
	const ForeignFunction = ForeignObject.constructor;
	const process = ForeignFunction("return process")();
	const require = process.mainModule.require;
	require("fs");