example code to teach obfuscated vulnerabilities in svg
- Minified/unreadable code supplied can be harmful when the person who implements this can't understand it.
- Trusted colleagues with bad intentions or breached
- Third parties with bad intentions or breached
- Sidecar injection by supplied code; intentional or unintentionally (breached) (dependancies)
- Breached front-ends can be harder to spot than compromised systems
- Writing hacks are made to fool/hide it's malicious intent
- It's a specialized business
- Co-workers under pressure may not see this and may trust the coder
- Use CSP rules to reject sending data to unknown targets & prevent unsafe evaluation
- Don't accept supplied minified code
- SISO/parties involved should have a signed agreement in case of data-breaches
- Have a small team of various experts to take a look when implementing third party code
- Use malware scanners like Acunetix etc to find these issues