What is Local Storage
Local storage is a built in function in JavaScript. It requires no other websites, sign-in’s or anything but a couple lines of code. It stores data on to the device based on what you tell it to store. So the information I store onto the website from one device doesn’t carry over to another device with the same account. Almost like cookies, but better.
It is easy to use
It is super easy to implement into your code, and it is super powerful.
What did I create?
I created this Local Storage Example which allows you to see the last thing you entered from the device onto the website, even if you reload, delete, reopen the tab, it will still remember what you entered. I added comments to every single line of code in the JavaScript and CSS so you could see exactly what each line of code did.
The localstorage feature is incredible and is useful for highscores and much more!
neat way of explaining what localStorage is!
btw the “view source” button doesn’t work - it’s linking to the editor for a project called local-storage-example-2, but that doesn’t exist. it should be local-storage-example:
<!-- This is the "View Source" button showing this file -->
- <a href="https://glitch.com/edit/#!/local-storage-example-2"><button>
+ <a href="https://glitch.com/edit/#!/local-storage-example"><button>
View Source
</button></a>
Cross-Site Scripting (XSS) is a type of security vulnerability found in web applications that allows attackers to inject malicious scripts into web pages viewed by other users.
Here’s an example:
Using the code <h1>omg xss</h1><img src="<pic link here>" onload="alert('omg xss')"> on the input we would be able to trigger this next time the page is loaded:
(ignore Uni, I just needed an image for this to work)
In this case, preventing XSS is pretty easy. In the script.js, sanitize data before showing it:
- document.getElementById("entered").innerHTML = `The last thing you entered: "${data}"`;
+ document.getElementById("entered").innerHTML = `The last thing you entered: "${data.replace(/</g, "<").replace(/>/g, ">")}"`;
If this isn’t possible, e.g. if you still want HTML elements to show up but don’t want JS running, removing the ability for the attacker to do worse stuff, you could use something like DOMPurify.
If, for example, you were to implement a system where other people would be able to see what you put, e.g. comments, this could get pretty dangerous.
For example, I could steal everyone’s passwords if it had auth, make them perform actions on the website, redirect everyone that opens the website to pictures of cats (or other websites), steal their IPs, etc…
Still if you did not have something like that it could still be dangerous. E.g. if you had a way to pass a string via a URL parameter, I could use that to almost do the same thing, they just had to click on an URL on my website instead of it automatically running when they visit your website.
tl;dr: If your website has an XSS vulnerability, that means attackers can execute any code they want on your website - that’s specially bad if your website has something like comments OR the injection can occur via a URL parameter. To solve, sanitize the data by changing this line in your script file:
- document.getElementById("entered").innerHTML = `The last thing you entered: "${data}"`;
+ document.getElementById("entered").innerHTML = `The last thing you entered: "${data.replace(/</g, "<").replace(/>/g, ">")}"`;
I agree, but sometimes it can be really helpful when, for example, you get a more complex UI where you don’t want to create each element individually or to use ids
tl;dr: 99.9999999999999999999999999999999999% of the times no, websites are sandboxed
Only the website could be damaged. Websites are sandboxed and usually can’t harm your computer directly (yes, “visiting a website is enough to install malware on ur pc” is a myth). They might try to overload your system (e.g., system-lag.glitch.me), but modern browsers isolate tabs (and extensions) into separate processes to prevent a full browser or system crash.
That’s what this message is about - the website process crashed.
adding more complexity to this: “visiting a website can’t install malware on your PC” is a security goal of web browsers, but there have been and continue to be bugs that cause major browsers to fail to enforce this
after you.
