New Blog Post by me!
Refactoring a Web Performance Snippet for Security and Best Practice
https://nooshu.com/blog/2025/01/02/refactoring-a-web-performance-snippet-for-security-and-best-practice/
Refactoring a Web Performance Snippet for Security and Best Practice
https://nooshu.com/blog/2025/01/02/refactoring-a-web-performance-snippet-for-security-and-best-practice/
Comments
Do you have any docs for this @therealnooshu.bsky.social? It’s not something I’ve come across before… afaik setTimeout doesn’t evaluate arbitrary strings as code, so I’m curious as to how it’s dangerous.
https://www.blackduck.com/blog/javascript-security-best-practices.html
2nd bullet point under Write quality code.
Still, it doesn’t appear dangerous if you’re passing your own function to it… only in the case it’s given a string that could contain user-input. Therefore, I don’t believe Matt’s usage was problematic.