JavaScript Security - Tom van Cutsem

JavaScript Security, by Tom van Cutsem

As one of the key technologies underlying advanced web applications, JavaScript is becoming ever more important. As a developer, you need to understand what features of the language you can embrace fully, and which ones to stay away from. Doing so will help you write more securable code (i.e. code that can be more easily and readily deployed inside a secured JavaScript environment).
In this talk, I will give an overview of the Good and the Bad parts of JavaScript, focus on the latest features added in ECMAScript 5 (such as "strict-mode") and even look ahead at some relevant features to come in ECMAScript 6 (ECMAScript is the name of the JavaScript subset that is standardized across all major browsers). Finally, I will give a brief introduction to Secure ECMAScript (SES), which is a secure JavaScript dialect that enables the safe embedding of third-party scripts in a webpage, and which currently protects various Google properties.

Learning Objectives

You will learn about:
+ The Good and the Bad parts of the JavaScript language.
+ Recent ECMAScript 5 features that help you write more securable code.
+ Upcoming ECMAScript 6 additions to the language.
+ Secure ECMAScript, a secure JavaScript dialect.

Tom Van Cutsem delivered this lecture at SecAppDev 2013.

Tom Van Cutsem is a professor of computer science at the Vrije Universiteit Brussel in Brussels, Belgium. He is also a member of the ECMA International TC39 committee in charge of standardizing JavaScript. While on a research stay at Google, he designed the Proxy meta-programming API for ECMAScript 6, together with Mark S. Miller. Tom's broader research interests lie in concurrent, distributed and parallel programming languages. He received his PhD in 2008 from the Vrije Universiteit Brussel for his research on AmbientTalk, a distributed scripting language for mobile phones.