JavaScript: Difference between revisions

Line 42:

*[[wikipedia:Arbitrary_code_execution|Arbitrary code execution]] and [[wikipedia:Code_injection|code injection]]. Typically caused by <code>[https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval eval]</code> (part of ES), but there are Web APIs (such as <code>[https://developer.mozilla.org/en-US/docs/Web/API/Window/setTimeout setTimeout]</code> and <code>[https://developer.mozilla.org/en-US/docs/Web/API/Window/setInterval setInterval]</code>) that can be misused as well.

*Remote code execution. This is used by hackers and crackers to build [[wikipedia:Botnet|bot-nets]] for [[wikipedia:Ddos#Distributed_DoS|DDoS]] or [[wikipedia:Cryptocurrency|crypto]]-mining, but it's mostly used for spyware since it can hide more easily.

=== Performance ===

If a JS [[wikipedia:Web_framework|framework]] is used to dynamically generate the DOM, the user must wait longer before the browser can display content. This is because HTML+CSS can be parsed and rendered incrementally (immediately as the bytes arrive to the client), while JS must (typically) be completely parsed and then executed.

===Scraping===

@@ Line 42: / Line 42: @@
 *[[wikipedia:Arbitrary_code_execution|Arbitrary code execution]] and [[wikipedia:Code_injection|code injection]]. Typically caused by <code>[https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval eval]</code> (part of ES), but there are Web APIs (such as <code>[https://developer.mozilla.org/en-US/docs/Web/API/Window/setTimeout setTimeout]</code> and <code>[https://developer.mozilla.org/en-US/docs/Web/API/Window/setInterval setInterval]</code>) that can be misused as well.
 *Remote code execution. This is used by hackers and crackers to build [[wikipedia:Botnet|bot-nets]] for [[wikipedia:Ddos#Distributed_DoS|DDoS]] or [[wikipedia:Cryptocurrency|crypto]]-mining, but it's mostly used for spyware since it can hide more easily.
+=== Performance ===
+If a JS [[wikipedia:Web_framework|framework]] is used to dynamically generate the DOM, the user must wait longer before the browser can display content. This is because HTML+CSS can be parsed and rendered incrementally (immediately as the bytes arrive to the client), while JS must (typically) be completely parsed and then executed.
 ===Scraping===