Safeguarding Large-Scale Projects: Navigating TypeScript Security Pitfalls
summary
Large TypeScript codebases repeatedly show concrete, fixable failures: unsanitized HTML via dangerouslySetInnerHTML leads to XSS and the recommended mitigation is DOMPurify kept up to date; building links from user input allows javascript: schemes so validate schemes to only http/https; postMessage handlers must compare event.origin for equality not substring/regex; SSR preload JSON must escape </script>; merging user objects enables prototype pollution; catastrophic regex backtracking causes ReDoS; remove hard‑coded secrets and use secret managers.
AI-written summary · about
chapters (5)
- 0:00Introduction and speaker intro
- 1:09JavaScript and TypeScript basics
- 10:14Common TypeScript security pitfalls
- 23:40PostMessage API security flaws
- 31:11Hardcoded secrets and takeaways
related talks
54mArchitecting Fortresses: A Deep Dive into Advanced Security Measures for ReactJS Apps
50mBuilding Secure React Applications
56mBuilding Secure ReactJS Applications: Mastering Advanced Security Techniques
19mCritical Security Mistakes in Frontend Applications
58mPractical Secure Development and Operations with JavaScript in 2020
48mSecurity Risk: Single-Page Applications.
01h 00mSecuring React: Prompt Engineering for Robust and Secure Code Generation
59mSecure Coding Back to Basics