Secure Your Node.js Web Application

To expect the unexpected shows a thoroughly modern intellect.

Oscar Wilde

Chapter 4Avoid Code Injections

Great job so far—you learned how to use your tools, set up your environment correctly, and fortify your network communications. You’re now finally ready to look at your application and learn about the most popular attack vector out there: code injection.

Injection is an attack vector where the attacker introduces, or injects, malicious code into the application to trick the program into executing it. Generally, the user sends specific data to the application, which is passed on to the interpreter to execute. If the application doesn’t properly validate the data, then any commands embedded inside are executed.

With code injection, the attacker ...