Update: Third_Party_Javascript_Management_Cheat_Sheet, DOM_Clobbering_Prevention_Cheat_Sheet, AJAX_Security_Cheat_Sheet, DOM_based_XSS_Prevention_Cheat_Sheet

[tghosth]

What is missing or needs to be updated?

There are currently a bunch of different cheat sheets which relate to JavaScript.

I have found so far:

• https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.md
• https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/DOM_Clobbering_Prevention_Cheat_Sheet.md
• https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/AJAX_Security_Cheat_Sheet.md
• https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.md

I also have other content which probably is not enough for a cheat sheet on its own but would be good to add to an existing cheatsheet such as:

• Protecting against Prototype Pollution

How should this be resolved?

I think that all these cheat sheets should be unified into a new unified JavaScript Cheat Sheet.

keen to hear your thoughts @manicode @mackowski @kwwall @szh

[mackowski]

Thanks @tghosth for the issue!
In general this is a good idea but I am afraid that such cheatsheet will be too long.
But on the other hand we already have similar cheatsheets.
Summarizing: In my opinion this is a good idea and also an opportunity to refresh JS content but we must be aware about length of the cheatsheet and try to no make it too long.

@jmanico @szh @kwwall thoughts?

[szh]

I agree with @mackowski. There could be value in having it all unified but if we want more details it's worthwhile to have them separated out so we don't end up with the master one being too long. At some point it's hard to call it a "cheat sheet" when it's too long. Then it's just a reference.

[tghosth]

So I hear that but at the same time I think a unified reference for security in a language is a worthy goal.

The dotnet cheat sheet is currently about ~1,100 lines and unifying the JS cheat sheet would make it ~1,200 lines so I don't think that is completely out of proportion.

Would you like me to proceed. My main goal is to get the Protecting against Prototype Pollution content integrated into the cheatsheets project in a logical way so I don't want to try and start a huge content change exercise.

[szh]

I think it's worthwhile to have a summary or checklist of main points for each topic in the main cheat sheet, and then link to the individual cheat sheet for more details. What do you think @mackowski @jmanico @kwwall ?

[tghosth]

Problem is, how does that solve my main goal:

My main goal is to get the Protecting against Prototype Pollution content integrated into the cheatsheets project in a logical way

[szh]

Ah, I see. Looking at the existing cheat sheets, they are on the shorter side, so maybe it wouldn't be so bad to combine them...
On the other hand, maybe you can create a master JavaScript cheat sheet which includes Protecting Against Prototype Pollution and also has summaries of the topics covered in the other cheat sheets, and then links to them for a full treatment, rather than fully migrating them into the new sheet. This would allow for a more concise master cheat sheet while still having the more detailed ones available for those who want to dig deeper. Thoughts?

[tghosth]

I just think it would be weird to have a cheatsheet with a lot of detail on parameter pollution and then summaries of a bunch of other topics. Do you have examples of where that has been done elsewhere in the cheatsheets project?

[kwwall]

Sorry I'm late to the thread on this; too many other irons in the fire and this kept getting pushed down in my TODO list.

My personal preference is that each wiki page should be topic specific, so my preference would be just to create a new separate Prototype Pollution Prevention Cheat Sheet (or whatever you were going to name it) and then, if you wish, create a new JavaScript Security Cheat Sheet that gives a 1 or 2 line summary of all the JS related cheat sheets and a link to each of them.

I think the big advantage of that is that it makes search engine results more useful.

But hey, that's just my opinion, so take it or leave it.
-kevin
P.S.- In the JavaScript Security Cheat Sheet, there should be a section called "Node and NPM" and instead of a link to another cheat sheet, it should say in big freaking letters,

RUN AWAY! RUN AWAY!

[jmanico]

PS: the W3C is working on a standard to “lock” JavaScript on a page so prototype pollution is not possible. It will take •years• but someday this problem will go away.

[tghosth]

Ok so it sounds like consensus is in the direction of creating a new cheatsheet specifically for parameter pollution rather than trying to create one large cheatsheet, correct?

[szh]

Ok so it sounds like consensus is in the direction of creating a new cheatsheet specifically for parameter pollution rather than trying to create one large cheatsheet, correct?

Yup

[tghosth]

Ok merged in #1157 so I will close this