securityJS

Comments should be removed from the public code of a web application, since it can give an aggressor critical insights into the inner structure of the program. By using this information, the attacker could easier understand how the user session is handled by javascript or figure out the pathway data is sent to the server.

• /*! jQuery v1.12.4 | (c) jQuery Foundation | jquery.org/license | WordPress 2019-05-16 */[https://essayswriting.org/wp-includes/js/jquery/jquery.js?ver=1.12.4]
• /*! jQuery Migrate v1.4.1 | (c) jQuery Foundation and other contributors | jquery.org/license */[https://essayswriting.org/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1]
• /* if($.inArray(72,[4,17,8,12,14])>-1 && $.inArray(elem_form['subject'],['1','14','35','38','19','36','29'])>-1 && !($.inArray(elem_form['deadline'],['7215','7233','7234'])>-1 && elem_form['academic_level']==7201) && elem_form['type_of_work']==1 && top_coef!=1){ coef =1+coef*1; }*/[https://essayswriting.org/public/js/order_count_price.js?ver=1.1.1]
• /*For page prices START*/[https://essayswriting.org/public/js/order_count_price.js?ver=1.1.1]
• /*client_id == 4 && elem_form['preferred_writer'] > 1*/[https://essayswriting.org/public/js/order_count_price.js?ver=1.1.1]
• /*if (client_id == 4) { temp =result * 0.58; tmp = temp.toFixed(2); } else { temp = result * parseFloat(pref_writer_coef); tmp = temp.toFixed(2); }*/[https://essayswriting.org/public/js/order_count_price.js?ver=1.1.1]
• /*For page prices END*/[https://essayswriting.org/public/js/order_count_price.js?ver=1.1.1]
• /*! jQuery v2.1.1 | (c) 2005, 2014 jQuery Foundation, Inc. | jquery.org/license */[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/jquery.min.js?ver=1.1]
• /*! * Bootstrap v3.3.7 (http://getbootstrap.com) * Copyright 2011-2016 Twitter, Inc. * Licensed under the MIT license */[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/bootstrap.min.js?ver=1.2]
• /*new style of dp*/[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/datetimepicker/bootstrap-datetimepicker_b3.js?ver=1.1]
• /******************************************************************************** * * Private functions * ********************************************************************************/[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/datetimepicker/bootstrap-datetimepicker_b3.js?ver=1.1]
• /** * Hides the widget. Possibly will emit dp.hide */[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/datetimepicker/bootstrap-datetimepicker_b3.js?ver=1.1]
• /******************************************************************************** * * Widget UI interaction functions * ********************************************************************************/[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/datetimepicker/bootstrap-datetimepicker_b3.js?ver=1.1]
• /** * Shows the widget. Possibly will emit dp.show and dp.change */[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/datetimepicker/bootstrap-datetimepicker_b3.js?ver=1.1]
• /** * Shows or hides the widget */[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/datetimepicker/bootstrap-datetimepicker_b3.js?ver=1.1]
• /******************************************************************************** * * Public API functions * ===================== * * Important: Do not expose direct references to private objects or the options * object to the outer world. Always return a clone when returning values or make * a clone when setting a private variable. * ********************************************************************************/[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/datetimepicker/bootstrap-datetimepicker_b3.js?ver=1.1]
• /** * Returns the component's model current viewDate, a moment object or null if not set. Passing a null value unsets the components model current moment. Parsing of the newDate parameter is made using moment library with the options.format and options.useStrict components configuration. * @param {Takes string, viewDate, moment, null parameter.} newDate * @returns {viewDate.clone()} */[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/datetimepicker/bootstrap-datetimepicker_b3.js?ver=1.1]
• /******************************************************************************** * * jQuery plugin constructor and defaults object * ********************************************************************************/[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/datetimepicker/bootstrap-datetimepicker_b3.js?ver=1.1]
• /** * See (http://jquery.com/). * @name jQuery * @class * See the jQuery Library (http://jquery.com/) for full details. This just * documents the function and classes that are added to jQuery by this plug-in. */[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/datetimepicker/bootstrap-datetimepicker_b3.js?ver=1.1]
• /** * See (http://jquery.com/) * @name fn * @class * See the jQuery Library (http://jquery.com/) for full details. This just * documents the function and classes that are added to jQuery by this plug-in. * @memberOf jQuery */[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/datetimepicker/bootstrap-datetimepicker_b3.js?ver=1.1]
• /** * Show comments * @class datetimepicker * @memberOf jQuery.fn */[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/datetimepicker/bootstrap-datetimepicker_b3.js?ver=1.1]
• /*look for any elements with the class "custom-select-form":*/[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• /*for each element, create a new DIV that will act as the selected item:*/[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• /*custom select placeholder color*/[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• /*for each element, create a new DIV that will contain the option list:*/[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• /*for each option in the original select element, create a new DIV that will act as an option item:*/[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• /*Set attribute disabled Start*/[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• /*Set attribute disabled End*/[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• /*when an item is clicked, update the original select box, and the selected item:*/[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• /*when the select box is clicked, close any other select boxes, and open/close the current select box:*/[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• /*a function that will close all select boxes in the document, except the current select box:*/[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• /*if the user clicks anywhere outside the select box, then close all select boxes:*/[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• /* */[https://essayswriting.org/public/js/data_count_price.js?ver=1.25]

The JavaScript debugging functions should always removed after development stage, because they could expose informations on the inner workings of the code. In production, it is a loophole and could show a possible attacker where to find possibly exploitable vulnerabilities or interesting variables.

• console.log("JQMIGRATE: Migrate is installed"+(a.migrateMute?"":" with logging active")+", version "+a.migrateVersion),a.migrateTrace===c&&(a.migrateTrace=!0),a.migrateReset=function(){f={},a.migrateWarnings.length=0},"BackCompat"===document.compatMode&&d("jQuery is not compatible with Quirks Mode");[https://essayswriting.org/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1]
• console.log('1', elem_form['subject'], elem_form['deadline'], elem_form['academic_level'], elem_form['type_of_work']);[https://essayswriting.org/public/js/order_count_price.js?ver=1.1.1]
• console.log('2');[https://essayswriting.org/public/js/order_count_price.js?ver=1.1.1]
• console.log(deadline_val);[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• console.log('name_top_lower');[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• console.log('validate');[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• console.log('1111',academic_level, type_of_paper, deadline, tow, admission_help, questions, problems, pages, null, top_other);[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• console.log('decrQuantity');[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• console.log('incrQuantity');[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• console.log('test1');[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• console.log('test');[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• console.log('test2');[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• console.log('test3');[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• console.log(diff_in_seconds);[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• console.log('enableCurrentDayForChoose setTimeout');[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• console.log(' .day.today click');[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• console.log('additionalCustomSelect start', $select.parent().find('.select-items').length);[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• console.log('additionalCustomSelect selectedOption', selectedOption.text());[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• console.log('additionalCustomSelect inside name length', "div:contains('" + option.text() + "')", customDivValue.length);[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• console.log('additionalCustomSelect inside customDivValue', customDivValue.text());[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• console.log('additionalCustomSelect inside customDivValue selected');[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• console.log('additionalCustomSelect inside customDivValue not selected');[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• console.log('additionalCustomSelect inside customDivValue disabled');[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]
• console.log('additionalCustomSelect inside customDivValue not disabled');[https://essayswriting.org/wp-content/themes/essayswriting/assets/js/calc_new.js?ver=1603325609]

The window.open("https://example.com/", "_blanc", "noopener"); attribute should always be added to the window.open() function, which open a site in a new tab, to reduce the risk of reverse tabnabbing. Otherwise javascript on the new page has full control over the previous visited page, including permission to change the DOM object and possibly steal session cookies.

The window.open("https://example.com/", "_blanc", "referrer"); attribute should always be added to the window.open() function to prevent reverse tabnabbing for older browser, which do not support the noopener attribute and to prevent phishing attacks.

Comments should be removed from the public code of a web application, since it can give an aggressor critical insights into the inner structure of the program. By using this information, the attacker could easier understand how the user session is handled by javascript or figure out the pathway data is sent to the server.

The JavaScript debugging functions should always removed after development stage, because they could expose informations on the inner workings of the code. In production, it is a loophole and could show a possible attacker where to find possibly exploitable vulnerabilities or interesting variables.

eval() is eval! This functions and similar ones (document.write(), document.writeln(), element.innerHTML, element.outerHTML, element.insertAdjacentHTML()) should never be used in production stage of a website, because the parsing of the executable string is often not secure and result therefore often in a cross-site scripting vulnerability. Instead of these functions create html elements by script and add it to the DOM object.