Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use diff instead of js to mark a diff block #18477

Merged
merged 3 commits into from
Jul 18, 2022
Merged

Use diff instead of js to mark a diff block #18477

Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
dbf318d
Update good vs bad example
OnkarRuikar Jul 18, 2022
138ea9c
fix a typo
OnkarRuikar Jul 18, 2022
c3d5c35
marking it as diff
OnkarRuikar Jul 18, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
13 changes: 9 additions & 4 deletions ...s/en-us/web/api/web_crypto_api/non-cryptographic_uses_of_subtle_crypto/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,10 +98,15 @@ At this point you may be thinking to yourself "*I can use this on my own website
- Executable downloads should **always** be done over HTTPS. This prevents intermediate parties from performing attacks like this so it would be redundant.
- If the attacker is able to replace the download file on the original server, then they can also simply replace the code which invokes the SubtleCrypto interface to bypass it and just state that everything is fine. Probably something sneaky like replacing [strict equality](/en-US/docs/Web/JavaScript/Equality_comparisons_and_sameness#strict_equality_using_), which can be a pain to spot in your own code:

```js
--- if (checksum === correctCheckSum) return true;
+++ if (checksum = correctCheckSum) return true;
```
```js
// original code
if (checksum === correctCheckSum) return true;
```

```js example-bad
// tampered code
if (checksum = correctCheckSum) return true;
```

One place it may be worthwhile, is if you want to test a file from a third party download source, which you do not control. This would be the case as long as the download location has [CORS](/en-US/docs/Glossary/CORS) headers enabled to let you scan the file before you make it available to your users. Unfortunately not many servers have CORS turned on by default.

Expand Down