XSS is not a feature that can be enabled in jQuery.  It would be very **very** unusual if the jQuery core had an XSS vulnerability, but it is possible and its called [DOM-based XSS][1].  

&quot;Cross-Origin Resource Sharing&quot; or CORS isn&#39;t the same as XSS, **BUT**,  but if a web application had an XSS vulnerability, then an attacker would have CORS-like access to all resources on that domain.   In short, CORS gives you control over how you break the [same origin policy][2] such that you don&#39;t need to introduce a full on XSS vulnerability.  

The `$.support.cors` query feature relies upon the `Access-Control-Allow-Origin` HTTP response header.  This *could be* a vulnerability. For example, if a web application had `Access-Control-Allow-Origin: *` on every page, then an attacker would have the same level of access as an XSS vulenrablity.   Be careful what pages you introduce CORS headers,  and try and avoid `*` as much as possible. 

So to answer your question:  **NO** a web application never needs to introduce an XSS vulnerability because there are way around the SOP such as CORS/jsonp/cross domain proxies/[access-control-origin][3].  


  [1]: https://www.owasp.org/index.php/DOM_Based_XSS
  [2]: http://code.google.com/p/browsersec/wiki/Part2
  [3]: http://www.w3.org/TR/2008/WD-access-control-20080912/#access-control-allow-origin

It can help only if you have CORS enabled in your browser but it isn&#39;t supported by jQuery yet:

&gt; To enable cross-domain requests in environments that do not support
&gt; cors yet but do allow cross-domain XHR requests (windows gadget, etc),
&gt; set $.support.cors = true;. CORS WD

Just setting this property to true can&#39;t cause security vulnerability.

When a hacker is able to inject script code to change the requests to another domain, he is also able to set this javascript flag in the script.

So wether this flag is set doesn&#39;t change much at this point of the intrusion.

While looking through some example C code, I came across this:  

    y -= m &lt; 3;

What does this do? It it some kind of condensed for loop or something? It&#39;s impossible to google for as far as I know.

What does y -= m &lt; 3 mean?

When running the following code (in Python 2.7.1 on a mac with Mac OS X 10.7)

    while True:
        return False

I get the following error

    SyntaxError: &#39;return&#39; outside function

I&#39;ve carefully checked for errant tabs and/or spaces. I can confirm that the code fails with the above error when I use the recommended 4 spaces of indentation. This behavior also happens when the return is placed inside of other control statements (e.g. if, for, etc.).

Any help would be appreciated. Thanks!

Python return statement error &quot; &#39;return&#39; outside function&quot;

I was trying to hit a web service on a different domain using jQuery&#39;s ajax method.  After doing some research it looks like it does not allow this is by design to prevent cross site scripting.  

I came across a work around which was to include this line:

    $.support.cors = true;

at the top of my javascript code.  From what I understand this enables cross site scripting in jQuery.

Does having this line of code make my site more vulnerable to attack?  I&#39;ve always heard XSS discussed as a security issue, are there legitimate uses for XSS?

Is it safe to use $.support.cors = true; in jQuery?

I was trying to hit a web service on a different domain using jQuery's ajax method. After doing some research it looks like it does not allow this is by design to prevent cross site scripting.
I came across a work around which was to include this line:
<pre><code class="hljs language-ini">$.support.cors = true;
</code></pre>
at the top of my javascript code. From what I understand this enables cross site scripting in jQuery.
Does having this line of code make my site more vulnerable to attack? I've always heard XSS discussed as a security issue, are there legitimate uses for XSS?

I&#39;m looking to loop through a JSON array and display the key and value.  

It should be a simplified version of the following post, but I don&#39;t seem to have the syntax correct: *[jQuery &#39;each&#39; loop with JSON array][1]*

I also saw the post *[Get name of key in key/value pair in JSON using jQuery?][2]*, but it also seemed like lots of code for a simple activity.

This illustrates what I&#39;m looking for (but it doesn&#39;t work):

    var result = &#39;{&quot;FirstName&quot;:&quot;John&quot;,&quot;LastName&quot;:&quot;Doe&quot;,&quot;Email&quot;:&quot;johndoe@johndoe.com&quot;,&quot;Phone&quot;:&quot;123 dead drive&quot;}&#39;;
    $.each(result, function(k, v) {
                 //display the key and value pair
                alert(k + &#39; is &#39; + v);
            });

There is no mandatory jQuery requirement, but it is available. I can also restructure the JSON if it cuts down the required code.

  [1]: https://stackoverflow.com/questions/3030321/jquery-each-loop-with-json-array
  [2]: https://stackoverflow.com/questions/5572708/get-name-of-key-in-key-value-pair-in-json-using-jquery


Loop and get key/value pair for JSON array using jQuery

http://jsfiddle.net/nicktheandroid/tVHYg/

When hovering `.wrapper`, it&#39;s child element `.contents` should animate from `0px` to it&#39;s natural width. Then when the mouse is removed from `.wrapper`, it should animate back down to `0px`. The `.wrapper` element should only be as wide as it needs to be (allowing `.contents` to grow), so `.wrapper` should grow in width and shrink in width as `.contents` does. There should be no set width for `.contents`. I&#39;m using CSS3, but it could be accomplished in jQuery, that would be fine.


**The problem:**
See the JSfiddle 

 1. `.wrapper` is not only as wide as it needs to be.
 2. when `.contents` grows, when it&#39;s almost at it&#39;s full width, it jumps down to the next line
 3. When hovering off of `.wrapper`, `.contents` vanishes, when it should animate down to `0px`

&lt;!-- begin snippet: js hide: false console: true --&gt;

&lt;!-- language: lang-css --&gt;

    .wrapper {
        display: inline-block;

        height: 20px;
        width: auto;
      
        padding:10px;
      
        background:#DDD;
    }

    .contents {
        display:inline-block;
      
        width:0%;
      
        white-space:nowrap;
        overflow:hidden;
      
        background:#c3c;
    }

    .wrapper:hover .contents {
        -webkit-transition: width 1s ease-in-out;
        -moz-transition: width 1s ease-in-out;
        -o-transition: width 1s ease-in-out;
        transition: width 1s ease-in-out;

        width:100%;
    }

&lt;!-- language: lang-html --&gt;

    &lt;div class=&quot;wrapper&quot;&gt;
        &lt;span&gt;+&lt;/span&gt;
        &lt;div class=&quot;contents&quot;&gt;These are the contents of this div&lt;/div&gt;
    &lt;/div&gt;

&lt;!-- end snippet --&gt;



Animate an element&#39;s width from 0 to 100%, with it and it&#39;s wrapper being only as wide as they need to be, without a pre-set width, in CSS3 or jQuery

D3 has a force directed layout [here][1]. Is there a way to add zooming to this graph? Currently, I was able to capture the mouse wheel event but am not really sure how to write the redraw function itself. Any suggestions?
```
var vis = d3.select(&quot;#graph&quot;)
  .append(&quot;svg:svg&quot;)
  .call(d3.behavior.zoom().on(&quot;zoom&quot;, redraw)) // &lt;-- redraw function
  .attr(&quot;width&quot;, w)
  .attr(&quot;height&quot;, h);
```

  [1]: http://mbostock.github.com/d3/ex/force.html

Is there a way to zoom into a D3 force layout graph?

I have the following HTML code:

    &lt;a class=&quot;toggle&quot; href=&quot;#toggle&quot;&gt;
        &lt;img src=&quot;app/css/images/tock.png&quot; alt=&quot;No&quot; data-id=&quot;4&quot; data-block=&quot;1&quot;&gt;
    &lt;/a&gt;

I want to update the value of the `src` and `data-block` attributes using jQuery. How do I do this?

**Update:** As I have many image elements, I want to update the value of a specific image by using `data-id`.

Updating the value of data attribute using jQuery

How to simply flatten array in jQuery? I have: 

    [1, 2, [3, 4], [5, 6], 7]

And I want: 

    [1, 2, 3, 4, 5, 6, 7]

How to flatten array in jQuery?

So I&#39;ve been toying around with HTTP for fun in telnet now (i.e. just typing in `telnet google.com 80` and putting in random GETs and POSTs with different headers and the like) but I&#39;ve come across something that google.com transmits in it&#39;s headers that I don&#39;t know.

I&#39;ve been looking through http://www.w3.org/Protocols/rfc2616/rfc2616.html and have found no definition for this particular http-header that google seems to be spouting out:


    GET / HTTP/1.1
    
    HTTP/1.1 200 OK
    Date: Wed, 01 Feb 2012 03:42:24 GMT
    Expires: -1
    Cache-Control: private, max-age=0
    Content-Type: text/html; charset=ISO-8859-1
    Set-Cookie: PREF=ID=6ddbc0a0342e7e63:FF=0:TM=1328067744:LM=1328067744:S=4d4farvCGl5Ww0C3; expires=Fri, 31-Jan-2014 03:42:24 GMT; path=/; domain=.google.com
    Set-Cookie: NID=56=PgRwCKa8EltKnHS5clbFuhwyWsd3cPXiV1-iXzgyKsiy5RKXEKbg89gWWpjzYZjLPWTKrCWhOUhdInOlYU56LOb2W7XpC7uBnKAjMbxQSBw1UIprzw2BFK5dnaY7PRji; expires=Thu, 02-Aug-2012 03:42:24 GMT; path=/; domain=.google.com; HttpOnly
    P3P: CP=&quot;This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&amp;answer=151657 for more info.&quot;
    Server: gws
    X-XSS-Protection: 1; mode=block
    X-Frame-Options: SAMEORIGIN
    Transfer-Encoding: chunked
    
    1000

Anyone know what `X-XSS-Protection` is?




What is the http-header &quot;X-XSS-Protection&quot;?

I have unescaped data from users. 

So is it safe to use like this:

    var data = &#39;&lt;test&gt;a&amp;f&quot;#&lt;/test&gt;&#39;; // example data from ajax response
    if (typeof(data) === &#39;string&#39;)
        $(&#39;body&#39;).text(data);

Can I use like this or there is some problems like encoding or some specific symbols that I should be careful and add more strict validation?

Is jQuery .text() method XSS safe?

I read this on the React tutorial. What does this mean? 

&gt; React is safe. We are not generating HTML strings so XSS protection is the default.

How do XSS attacks work if React is safe? How is this safety achieved?

What does it mean when they say React is XSS protected?

I want to set the background image of a DIV in a Component Template in my Angular 2 app. However I keep getting the following warning in my console and I don&#39;t get the desired effect... I am unsure if the dynamic CSS background image is being blocked due to security restrictions in Angular2 or if my HTML template is broken.

This is the warning I see in my console (I have changed my img url to `/img/path/is/correct.png `:

&gt; WARNING: sanitizing unsafe style value url(SafeValue must use [property]=binding: /img/path/is/correct.png (see http://g.co/ng/security#xss)) (see http://g.co/ng/security#xss).

The thing is I do sanitize what is injected into my template using the `DomSanitizationService` in Angular2. Here is my HTML that I have in my template:

    &lt;div&gt;
        &lt;div&gt;
            &lt;div class=&quot;header&quot;
                 *ngIf=&quot;image&quot;
                 [style.background-image]=&quot;&#39;url(&#39; + image + &#39;)&#39;&quot;&gt;
            &lt;/div&gt;
    
            &lt;div class=&quot;zone&quot;&gt;
                &lt;div&gt;
                    &lt;div&gt;
                        &lt;h1 [innerHTML]=&quot;header&quot;&gt;&lt;/h1&gt;
                    &lt;/div&gt;
                    &lt;div class=&quot;zone__content&quot;&gt;
                        &lt;p
                           *ngFor=&quot;let contentSegment of content&quot;
                           [innerHTML]=&quot;contentSegment&quot;&gt;&lt;/p&gt;
                    &lt;/div&gt;
                &lt;/div&gt;
            &lt;/div&gt;
        &lt;/div&gt;
    &lt;/div&gt;

Here is the component...

    Import {
        DomSanitizationService,
        SafeHtml,
        SafeUrl,
        SafeStyle
    } from &#39;@angular/platform-browser&#39;;
    
    @Component({
                   selector: &#39;example&#39;,
                   templateUrl: &#39;src/content/example.component.html&#39;
               })
    export class CardComponent implements OnChanges {
    
        public header:SafeHtml;
        public content:SafeHtml[];
        public image:SafeStyle;
        public isActive:boolean;
        public isExtended:boolean;
    
        constructor(private sanitization:DomSanitizationService) {
        }
    
        ngOnChanges():void {
            map(this.element, this);
    
            function map(element:Card, instance:CardComponent):void {
                if (element) {
                    instance.header = instance.sanitization.bypassSecurityTrustHtml(element.header);
    
                    instance.content = _.map(instance.element.content, (input:string):SafeHtml =&gt; {
                        return instance.sanitization.bypassSecurityTrustHtml(input);
                    });
    
                    if (element.image) {
                        /* Here is the problem... I have also used bypassSecurityTrustUrl */ 
                        instance.image = instance.sanitization.bypassSecurityTrustStyle(element.image);
                    } else {
                        instance.image = null;
                    }
    
                }
            }
        }
    }

Please note that when I just bound to the template using [src]=&quot;image&quot;, for example: 

    &lt;div *ngIf=&quot;image&quot;&gt;
        &lt;img [src]=&quot;image&quot;&gt;
    &lt;/div&gt;

and `image` was passed using `bypassSecurityTrustUrl` everything seemed to work well... can anyone see what I am doing wrong?

WARNING: sanitizing unsafe style value url

I am trying to get the certificate of a remote server, which I can then use to add to my keystore and use within my Java application.


A senior dev (who is on holidays :( ) informed me I can run this:


    openssl s_client -connect host.host:9999


to get a raw certificate dumped out, which I can then copy and export. I receive the following output:

    depth=1 /C=NZ/ST=Test State or Province/O=Organization Name/OU=Organizational Unit Name/CN=Test CA
    verify error:num=19:self signed certificate in certificate chain
    verify return:0
    23177:error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure:s3_pkt.c:1086:SSL alert number 40
    23177:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188:

I have also tried it with this option:

    -showcerts

and this one (running on Debian mind you):

    -CApath /etc/ssl/certs/

But I get the same error.

[This source][1] says I can use that CApath flag but it doesn&#39;t seem to help. I tried multiple paths to no avail.

Please let me know where I&#39;m going wrong.


  [1]: http://gagravarr.org/writing/openssl-certs/personal.shtml


Using openssl to get the certificate from a server

This is just a question out of curiosity. I am wondering how safe it is generally considered to host sensitive data on repository websites like Github, Bitbucket, etc.? Is it safe enough to get rid of all code on local machines and just store it all on there? How about safety in the sense of keeping company secrets? I notice these sites tout big companies like Google and Yahoo use their services, but do these big companies actually store their trade secrets and important company code on websites like this?

Github has a page ([http://help.github.com/security][1]), which has some interesting information, that shows they are marketing it as something fool proof like I described. But in practice, do big companies like Google really find that their proprietary secrets and massive amounts of code are really safe from prying eyes and disastrous occurrences on sites like these?


  [1]: http://help.github.com/security

How safe is it to host sensitive data on repository sites like github, bitbucket, etc.?

**EDIT**

What one means by &quot;a ***secure*** cookie&quot; is ambiguous. To clarify:

 1. Secure as in sent over the *https://* protocol — ie. cookie is **not** sent in plaintext. Known as the &quot;secure flag&quot;

 2. Secure as in the cookie cannot be read by Javascript running in the
    browser — ie.
    `document.cookie` will not work. Known as the &quot;HttpOnly&quot; flag.

This edit is to clarify that the original question is asking about the 2nd case.


----------


**Original Question**

Is there any way to read a secure cookie with JavaScript?&lt;br /&gt;
I tried to do it using `document.cookie` and as far as I can see on &lt;a href=&quot;http://securitymusings.com/article/909/secure-cookies-the-httponly-flag&quot;&gt;this article about secure cookies and HttpOnly flag&lt;/a&gt;, I cannot access a secure cookie this way.

Can anyone suggest a workaround?

How to read a HttpOnly cookie using JavaScript

I have read up on these two topics, and I can&#39;t seem to quite grasp the difference between salting and noncing hashes.

What is the difference between hash salting and noncing?

Yes this is a pretty general question but I&#39;m trying to get a feel for the best way to handle an app that touches base w/ a webserver that distributes sensitive data to the app.  Any links, general information advice etc.. would be appreciated. 

Since the app would store persistant data retreived from the database for a certain amount of time.. everything becomes somewhat touchy.  

Content Type	Original Author	Original Content on Stackoverflow
Question	Abe Miessler	View Question on Stackoverflow
Solution 1 - Jquery	rook	View Answer on Stackoverflow
Solution 2 - Jquery	bjornd	View Answer on Stackoverflow
Solution 3 - Jquery	Tim	View Answer on Stackoverflow

Is it safe to use $.support.cors = true; in jQuery?

Jquery Problem Overview

Jquery Solutions

Solution 1 - Jquery

Solution 2 - Jquery

Solution 3 - Jquery

Python return statement error " 'return' outside function"

What does y -= m < 3 mean?

Attributions