Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock ( ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
Defending TypeScript Applications Against Code Injection
Code injection is an attack that occurs when an application takes untrusted data and uses it to execute code. If an attacker can send data that will be executed as code, they can take control of the application and attack the infrastructure it is running on. This happens when the attacker can run any code with the same privileges as the application. Functions that execute data as code are dangerous, and it is best to avoid passing user input to these functions.
Course Overview
Learning Objectives
This Defending TypeScript Skill Lab provides a virtual environment with a vulnerable application to help developers identify and fix code injection vulnerabilities. The learner will get hands-on experience testing for code injection vulnerabilities and implementing an appropriate mitigation. The recommended way to mitigate code injection is to remove the ability to execute data as code and use a different approach to implement the application's functionality.
Framework Connections
The materials within this course focus on the NICE Framework Task, Knowledge, and Skill statements identified within the indicated NICE Framework component(s):
Competency Areas
Work Roles
Feedback
If you would like to provide feedback on this course, please e-mail the NICCS team at NICCS@mail.cisa.dhs.gov. Please keep in mind that NICCS does not own this course or accept payment for course entry. If you have questions related to the details of this course, such as cost, prerequisites, how to register, etc., please contact the course training provider directly. You can find course training provider contact information by following the link that says “Visit course page for more information...” on this page.