Can you spot the vulnerability? #16022023 — Intigriti
Given Code Snippet: Code review: easy-eval.js if (window.debug) {
    eval(window.debug.toString()); //using eval at DOM element with id "debug"
  //only a and area tag can be used in attack as they are capable of using href attribute. toString get only that attribute
} easy-xss.js const pos = document.URL.indexOf('name=') + 5; //user input
const name…
Can you spot the vulnerability? #16022023 — Intigriti Given Code Snippet: Code review: easy-eval.js if (window.debug) {
    eval(window.debug.toString()); //using eval at DOM element with id "debug"
  //only a and area tag can be used in attack as they are capable of using href attribute. toString get only that attribute
} easy-xss.js const pos = document.URL.indexOf('name=') + 5; //user input
const name… information-security
spot vulnerability 16022023 — Intigriti Given Code Snippet Code review easyevaljs windowdebug evalwindowdebugtoString using eval DOM element id debug area tag used attack capable using href attribute toString get attribute easyxssjs const po documentURLindexOfname 5 user input const name… informationsecurity