Secure Way of Inserting Dynamic Values in External JavaScript Files

Secure way of inserting dynamic values in external JavaScript files

$('#@ViewData.TemplateInfo.GetFullHtmlFieldName(string.Empty)')

Yeah this isn't a good approach in general. Razor will HTML-escape by default but the context isn't simply HTML here, it's:

an identifier, inside
a CSS selector, inside
a JavaScript string literal, inside
a JavaScript statement, inside
an HTML CDATA element (<script>)

so just HTML-escaping is the wrong thing - any characters that are special in the context of selectors or JS string literals (such as dot, backslash, apostrophe, line separators...) would break this statement.

Maybe that's not super-important for this specific example, assuming the result of GetFullHtmlFieldName is always going to be something safe, but that's not a good assumption for the general case.

C# Generated JavaScript: a bit clunky and it kind of defeats some of the advantages of using a CSP

Agreed, avoid this. Getting the caching right and transferring the information from the ASP that generates the page content to the page that generates the script is typically a pain.

Also generating JavaScript is not necessarily that simple. ASP and Razor templates don't give you an automatic JS escaper. JSON encoding nearly does it, except for the niggling differences between JSON and JS (ie U+2028 and U+2029).

Hidden Form Fields

More generally, putting the information in the DOM. Hidden form fields are one way to do this; data- attributes are another commonly-used one. Either way I strongly prefer the DOM approach.

When using hidden form fields you should probably remove the name attribute as if they're inside a real <form> you typically don't actually want to submit the data you were passing into JS.

This way you can inject the content into the template using normal default-on HTML escaping. If you need more structure you can always JSON-encode the data to be passed. jQuery's data() helper will automatically JSON.parse them for you too in that case.

<body data-mcefields="@Json.Encode(GetListOfHtmlFields())">
...
var mce_array = $('body').data('mcefields');
$.each(mce_array, function() {
    var element = document.getElementById(this);
    $(element).tinymce({ ... });
});

(Although... for the specific case of selecting elements to apply an HTML editor to, perhaps the simpler way would be just to use class="tinymce" and apply with $('.tinymce').tinymce(...)?)

Dynamically load JS inside JS

jQuery's $.getScript() is buggy sometimes, so I use my own implementation of it like:

jQuery.loadScript = function (url, callback) {
    jQuery.ajax({
        url: url,
        dataType: 'script',
        success: callback,
        async: true
    });
}

and use it like:

if (typeof someObject == 'undefined') $.loadScript('url_to_someScript.js', function(){
    //Stuff to do after someScript has loaded
});

Dynamically load a JavaScript file

You may create a script element dynamically, using Prototypes:

new Element("script", {src: "myBigCodeLibrary.js", type: "text/javascript"});

The problem here is that we do not know when the external script file is fully loaded.

We often want our dependant code on the very next line and like to write something like:

if (iNeedSomeMore) {
    Script.load("myBigCodeLibrary.js"); // includes code for myFancyMethod();
    myFancyMethod(); // cool, no need for callbacks!
}

There is a smart way to inject script dependencies without the need of callbacks. You simply have to pull the script via a synchronous AJAX request and eval the script on global level.

If you use Prototype the Script.load method looks like this:

var Script = {
    _loadedScripts: [],
    include: function(script) {
        // include script only once
        if (this._loadedScripts.include(script)) {
            return false;
        }
        // request file synchronous
        var code = new Ajax.Request(script, {
            asynchronous: false,
            method: "GET",
            evalJS: false,
            evalJSON: false
        }).transport.responseText;
        // eval code on global level
        if (Prototype.Browser.IE) {
            window.execScript(code);
        } else if (Prototype.Browser.WebKit) {
            $$("head").first().insert(Object.extend(
                new Element("script", {
                    type: "text/javascript"
                }), {
                    text: code
                }
            ));
        } else {
            window.eval(code);
        }
        // remember included script
        this._loadedScripts.push(script);
    }
};

How to create dynamic external javascript files?

Consider carefully whether generating a dynamic JS file is necessary at all. Instead of generating dynamic JS, you can often simply inject static script(s) and use separate JSON to support dynamic configuration into your page.

If you view source on this (or about any) StackOverflow page you'll see that they're using this same pattern: Static external .js files that reference a separate centralized chunk of JSON for configuration. That JSON is what provides dynamism.

View source and look for this:

StackExchange.init({...

Most server side languages make it trivial to serialize an object to JSON so you can inject it into your page.

Here's ten reasons utilizing external static js files is preferable:

Cached
Code colored
Syntax checked
Separation of concerns
Reusable
Easier to read.
One less layer of abstraction
Can serve minified and obfuscated
Avoids string parsing on every request
StackOverflow and all the cool kids are doing it (hey, I promised 10 reasons.)

More info here: http://www.bitnative.com/2013/10/06/javascript-configuration-object-pattern/

Safe way to send value from jsp to javascript

You could write your jsp data in a text/json block which will be ignored by the browser:

<script id="demo" type="text/json">
  ${jspvariable}
</script>

You can then parse the values in your javascript file on dom ready:

console.log(JSON.parse(document.getElementById('demo').innerHTML));

A XSS injection could lead only to a JSON parse error

How do I include a JavaScript file in another JavaScript file?

The old versions of JavaScript had no import, include, or require, so many different approaches to this problem have been developed.

But since 2015 (ES6), JavaScript has had the ES6 modules standard to import modules in Node.js, which is also supported by most modern browsers.

For compatibility with older browsers, build tools like Webpack and Rollup and/or transpilation tools like Babel can be used.

ES6 Modules

ECMAScript (ES6) modules have been supported in Node.js since v8.5, with the --experimental-modules flag, and since at least Node.js v13.8.0 without the flag. To enable "ESM" (vs. Node.js's previous CommonJS-style module system ["CJS"]) you either use "type": "module" in package.json or give the files the extension .mjs. (Similarly, modules written with Node.js's previous CJS module can be named .cjs if your default is ESM.)

Using package.json:

{
    "type": "module"
}

Then module.js:

export function hello() {
  return "Hello";
}

Then main.js:

import { hello } from './module.js';
let val = hello();  // val is "Hello";

Using .mjs, you'd have module.mjs:

export function hello() {
  return "Hello";
}

Then main.mjs:

import { hello } from './module.mjs';
let val = hello();  // val is "Hello";

ECMAScript modules in browsers

Browsers have had support for loading ECMAScript modules directly (no tools like Webpack required) since Safari 10.1, Chrome 61, Firefox 60, and Edge 16. Check the current support at caniuse. There is no need to use Node.js' .mjs extension; browsers completely ignore file extensions on modules/scripts.

<script type="module">
  import { hello } from './hello.mjs'; // Or the extension could be just `.js`
  hello('world');
</script>

// hello.mjs -- or the extension could be just `.js`
export function hello(text) {
  const div = document.createElement('div');
  div.textContent = `Hello ${text}`;
  document.body.appendChild(div);
}

Read more at https://jakearchibald.com/2017/es-modules-in-browsers/

Dynamic imports in browsers

Dynamic imports let the script load other scripts as needed:

<script type="module">
  import('hello.mjs').then(module => {
      module.hello('world');
    });
</script>

Read more at https://developers.google.com/web/updates/2017/11/dynamic-import

Node.js require

The older CJS module style, still widely used in Node.js, is the module.exports/require system.

// mymodule.js
module.exports = {
   hello: function() {
      return "Hello";
   }
}

// server.js
const myModule = require('./mymodule');
let val = myModule.hello(); // val is "Hello"

There are other ways for JavaScript to include external JavaScript contents in browsers that do not require preprocessing.

AJAX Loading

You could load an additional script with an AJAX call and then use eval to run it. This is the most straightforward way, but it is limited to your domain because of the JavaScript sandbox security model. Using eval also opens the door to bugs, hacks and security issues.

Fetch Loading

Like Dynamic Imports you can load one or many scripts with a fetch call using promises to control order of execution for script dependencies using the Fetch Inject library:

fetchInject([
  'https://cdn.jsdelivr.net/momentjs/2.17.1/moment.min.js'
]).then(() => {
  console.log(`Finish in less than ${moment().endOf('year').fromNow(true)}`)
})

jQuery Loading

The jQuery library provides loading functionality in one line:

$.getScript("my_lovely_script.js", function() {
   alert("Script loaded but not necessarily executed.");
});

Dynamic Script Loading

You could add a script tag with the script URL into the HTML. To avoid the overhead of jQuery, this is an ideal solution.

The script can even reside on a different server. Furthermore, the browser evaluates the code. The <script> tag can be injected into either the web page <head>, or inserted just before the closing </body> tag.

Here is an example of how this could work:

function dynamicallyLoadScript(url) {
    var script = document.createElement("script");  // create a script DOM node
    script.src = url;  // set its src to the provided URL
   
    document.head.appendChild(script);  // add it to the end of the head section of the page (could change 'head' to 'body' to add it to the end of the body section instead)
}

This function will add a new <script> tag to the end of the head section of the page, where the src attribute is set to the URL which is given to the function as the first parameter.

Both of these solutions are discussed and illustrated in JavaScript Madness: Dynamic Script Loading.

Detecting when the script has been executed

Now, there is a big issue you must know about. Doing that implies that you remotely load the code. Modern web browsers will load the file and keep executing your current script because they load everything asynchronously to improve performance. (This applies to both the jQuery method and the manual dynamic script loading method.)

It means that if you use these tricks directly, you won't be able to use your newly loaded code the next line after you asked it to be loaded, because it will be still loading.

For example: my_lovely_script.js contains MySuperObject:

var js = document.createElement("script");

js.type = "text/javascript";
js.src = jsFilePath;

document.body.appendChild(js);

var s = new MySuperObject();

Error : MySuperObject is undefined

Then you reload the page hitting F5. And it works! Confusing...

So what to do about it ?

Well, you can use the hack the author suggests in the link I gave you. In summary, for people in a hurry, he uses an event to run a callback function when the script is loaded. So you can put all the code using the remote library in the callback function. For example:

function loadScript(url, callback)
{
    // Adding the script tag to the head as suggested before
    var head = document.head;
    var script = document.createElement('script');
    script.type = 'text/javascript';
    script.src = url;

    // Then bind the event to the callback function.
    // There are several events for cross browser compatibility.
    script.onreadystatechange = callback;
    script.onload = callback;

    // Fire the loading
    head.appendChild(script);
}

Then you write the code you want to use AFTER the script is loaded in a lambda function:

var myPrettyCode = function() {
   // Here, do whatever you want
};

Then you run all that:

loadScript("my_lovely_script.js", myPrettyCode);

Note that the script may execute after the DOM has loaded, or before, depending on the browser and whether you included the line script.async = false;. There's a great article on Javascript loading in general which discusses this.

Source Code Merge/Preprocessing

As mentioned at the top of this answer, many developers use build/transpilation tool(s) like Parcel, Webpack, or Babel in their projects, allowing them to use upcoming JavaScript syntax, provide backward compatibility for older browsers, combine files, minify, perform code splitting etc.

Dynamically load external Javascript file, and wait for it to load - without using JQuery

February 21, 2017 - how jQuery does it

jQuery.getScript is now just a wrapper for jQuery.get

getScript: function( url, callback ) {
    return jQuery.get( url, undefined, callback, "script" );
}

jQuery.get is just a wrapper of jQuery.ajax – it is defined using metaprogramming as ...

jQuery.each( [ "get", "post" ], function( i, method ) {
    jQuery[ method ] = function( url, data, callback, type ) {

        // Shift arguments if data argument was omitted
        if ( jQuery.isFunction( data ) ) {
            type = type || callback;
            callback = data;
            data = undefined;
        }

        // The url can be an options object (which then must have .url)
        return jQuery.ajax( jQuery.extend( {
            url: url,
            type: method,
            dataType: type,
            data: data,
            success: callback
        }, jQuery.isPlainObject( url ) && url ) );
    };
} );

jQuery.ajax is this 430+ LOC monster

ajax: function( url, options ) {

  // If url is an object, simulate pre-1.5 signature
  if ( typeof url === "object" ) {
    options = url;
    url = undefined;
  }

  // Force options to be an object
  options = options || {};

  var transport,

    // URL without anti-cache param
    cacheURL,

    // Response headers
    responseHeadersString,
    responseHeaders,

    // timeout handle
    timeoutTimer,

    // Url cleanup var
    urlAnchor,

    // Request state (becomes false upon send and true upon completion)
    completed,

    // To know if global events are to be dispatched
    fireGlobals,

    // Loop variable
    i,

    // uncached part of the url
    uncached,

    // Create the final options object
    s = jQuery.ajaxSetup( {}, options ),

    // Callbacks context
    callbackContext = s.context || s,

    // Context for global events is callbackContext if it is a DOM node or jQuery collection
    globalEventContext = s.context &&
      ( callbackContext.nodeType || callbackContext.jquery ) ?
        jQuery( callbackContext ) :
        jQuery.event,

    // Deferreds
    deferred = jQuery.Deferred(),
    completeDeferred = jQuery.Callbacks( "once memory" ),

    // Status-dependent callbacks
    statusCode = s.statusCode || {},

    // Headers (they are sent all at once)
    requestHeaders = {},
    requestHeadersNames = {},

    // Default abort message
    strAbort = "canceled",

    // Fake xhr
    jqXHR = {
      readyState: 0,

      // Builds headers hashtable if needed
      getResponseHeader: function( key ) {
        var match;
        if ( completed ) {
          if ( !responseHeaders ) {
            responseHeaders = {};
            while ( ( match = rheaders.exec( responseHeadersString ) ) ) {
              responseHeaders[ match[ 1 ].toLowerCase() ] = match[ 2 ];
            }
          }
          match = responseHeaders[ key.toLowerCase() ];
        }
        return match == null ? null : match;
      },

      // Raw string
      getAllResponseHeaders: function() {
        return completed ? responseHeadersString : null;
      },

      // Caches the header
      setRequestHeader: function( name, value ) {
        if ( completed == null ) {
          name = requestHeadersNames[ name.toLowerCase() ] =
            requestHeadersNames[ name.toLowerCase() ] || name;
          requestHeaders[ name ] = value;
        }
        return this;
      },

      // Overrides response content-type header
      overrideMimeType: function( type ) {
        if ( completed == null ) {
          s.mimeType = type;
        }
        return this;
      },

      // Status-dependent callbacks
      statusCode: function( map ) {
        var code;
        if ( map ) {
          if ( completed ) {

            // Execute the appropriate callbacks
            jqXHR.always( map[ jqXHR.status ] );
          } else {

            // Lazy-add the new callbacks in a way that preserves old ones
            for ( code in map ) {
              statusCode[ code ] = [ statusCode[ code ], map[ code ] ];
            }
          }
        }
        return this;
      },

      // Cancel the request
      abort: function( statusText ) {
        var finalText = statusText || strAbort;
        if ( transport ) {
          transport.abort( finalText );
        }
        done( 0, finalText );
        return this;
      }
    };

  // Attach deferreds
  deferred.promise( jqXHR );

  // Add protocol if not provided (prefilters might expect it)
  // Handle falsy url in the settings object (#10093: consistency with old signature)
  // We also use the url parameter if available
  s.url = ( ( url || s.url || location.href ) + "" )
    .replace( rprotocol, location.protocol + "//" );

  // Alias method option to type as per ticket #12004
  s.type = options.method || options.type || s.method || s.type;

  // Extract dataTypes list
  s.dataTypes = ( s.dataType || "*" ).toLowerCase().match( rnothtmlwhite ) || [ "" ];

  // A cross-domain request is in order when the origin doesn't match the current origin.
  if ( s.crossDomain == null ) {
    urlAnchor = document.createElement( "a" );

    // Support: IE <=8 - 11, Edge 12 - 13
    // IE throws exception on accessing the href property if url is malformed,
    // e.g. http://example.com:80x/
    try {
      urlAnchor.href = s.url;

      // Support: IE <=8 - 11 only
      // Anchor's host property isn't correctly set when s.url is relative
      urlAnchor.href = urlAnchor.href;
      s.crossDomain = originAnchor.protocol + "//" + originAnchor.host !==
        urlAnchor.protocol + "//" + urlAnchor.host;
    } catch ( e ) {

      // If there is an error parsing the URL, assume it is crossDomain,
      // it can be rejected by the transport if it is invalid
      s.crossDomain = true;
    }
  }

  // Convert data if not already a string
  if ( s.data && s.processData && typeof s.data !== "string" ) {
    s.data = jQuery.param( s.data, s.traditional );
  }

  // Apply prefilters
  inspectPrefiltersOrTransports( prefilters, s, options, jqXHR );

  // If request was aborted inside a prefilter, stop there
  if ( completed ) {
    return jqXHR;
  }

  // We can fire global events as of now if asked to
  // Don't fire events if jQuery.event is undefined in an AMD-usage scenario (#15118)
  fireGlobals = jQuery.event && s.global;

  // Watch for a new set of requests
  if ( fireGlobals && jQuery.active++ === 0 ) {
    jQuery.event.trigger( "ajaxStart" );
  }

  // Uppercase the type
  s.type = s.type.toUpperCase();

  // Determine if request has content
  s.hasContent = !rnoContent.test( s.type );

  // Save the URL in case we're toying with the If-Modified-Since
  // and/or If-None-Match header later on
  // Remove hash to simplify url manipulation
  cacheURL = s.url.replace( rhash, "" );

  // More options handling for requests with no content
  if ( !s.hasContent ) {

    // Remember the hash so we can put it back
    uncached = s.url.slice( cacheURL.length );

    // If data is available, append data to url
    if ( s.data ) {
      cacheURL += ( rquery.test( cacheURL ) ? "&" : "?" ) + s.data;

      // #9682: remove data so that it's not used in an eventual retry
      delete s.data;
    }

    // Add or update anti-cache param if needed
    if ( s.cache === false ) {
      cacheURL = cacheURL.replace( rantiCache, "$1" );
      uncached = ( rquery.test( cacheURL ) ? "&" : "?" ) + "_=" + ( nonce++ ) + uncached;
    }

    // Put hash and anti-cache on the URL that will be requested (gh-1732)
    s.url = cacheURL + uncached;

  // Change '%20' to '+' if this is encoded form body content (gh-2658)
  } else if ( s.data && s.processData &&
    ( s.contentType || "" ).indexOf( "application/x-www-form-urlencoded" ) === 0 ) {
    s.data = s.data.replace( r20, "+" );
  }

  // Set the If-Modified-Since and/or If-None-Match header, if in ifModified mode.
  if ( s.ifModified ) {
    if ( jQuery.lastModified[ cacheURL ] ) {
      jqXHR.setRequestHeader( "If-Modified-Since", jQuery.lastModified[ cacheURL ] );
    }
    if ( jQuery.etag[ cacheURL ] ) {
      jqXHR.setRequestHeader( "If-None-Match", jQuery.etag[ cacheURL ] );
    }
  }

  // Set the correct header, if data is being sent
  if ( s.data && s.hasContent && s.contentType !== false || options.contentType ) {
    jqXHR.setRequestHeader( "Content-Type", s.contentType );
  }

  // Set the Accepts header for the server, depending on the dataType
  jqXHR.setRequestHeader(
    "Accept",
    s.dataTypes[ 0 ] && s.accepts[ s.dataTypes[ 0 ] ] ?
      s.accepts[ s.dataTypes[ 0 ] ] +
        ( s.dataTypes[ 0 ] !== "*" ? ", " + allTypes + "; q=0.01" : "" ) :
      s.accepts[ "*" ]
  );

  // Check for headers option
  for ( i in s.headers ) {
    jqXHR.setRequestHeader( i, s.headers[ i ] );
  }

  // Allow custom headers/mimetypes and early abort
  if ( s.beforeSend &&
    ( s.beforeSend.call( callbackContext, jqXHR, s ) === false || completed ) ) {

    // Abort if not done already and return
    return jqXHR.abort();
  }

  // Aborting is no longer a cancellation
  strAbort = "abort";

  // Install callbacks on deferreds
  completeDeferred.add( s.complete );
  jqXHR.done( s.success );
  jqXHR.fail( s.error );

  // Get transport
  transport = inspectPrefiltersOrTransports( transports, s, options, jqXHR );

  // If no transport, we auto-abort
  if ( !transport ) {
    done( -1, "No Transport" );
  } else {
    jqXHR.readyState = 1;

    // Send global event
    if ( fireGlobals ) {
      globalEventContext.trigger( "ajaxSend", [ jqXHR, s ] );
    }

    // If request was aborted inside ajaxSend, stop there
    if ( completed ) {
      return jqXHR;
    }

    // Timeout
    if ( s.async && s.timeout > 0 ) {
      timeoutTimer = window.setTimeout( function() {
        jqXHR.abort( "timeout" );
      }, s.timeout );
    }

    try {
      completed = false;
      transport.send( requestHeaders, done );
    } catch ( e ) {

      // Rethrow post-completion exceptions
      if ( completed ) {
        throw e;
      }

      // Propagate others as results
      done( -1, e );
    }
  }

  // Callback for when everything is done
  function done( status, nativeStatusText, responses, headers ) {
    var isSuccess, success, error, response, modified,
      statusText = nativeStatusText;

    // Ignore repeat invocations
    if ( completed ) {
      return;
    }

    completed = true;

    // Clear timeout if it exists
    if ( timeoutTimer ) {
      window.clearTimeout( timeoutTimer );
    }

    // Dereference transport for early garbage collection
    // (no matter how long the jqXHR object will be used)
    transport = undefined;

    // Cache response headers
    responseHeadersString = headers || "";

    // Set readyState
    jqXHR.readyState = status > 0 ? 4 : 0;

    // Determine if successful
    isSuccess = status >= 200 && status < 300 || status === 304;

    // Get response data
    if ( responses ) {
      response = ajaxHandleResponses( s, jqXHR, responses );
    }

    // Convert no matter what (that way responseXXX fields are always set)
    response = ajaxConvert( s, response, jqXHR, isSuccess );

    // If successful, handle type chaining
    if ( isSuccess ) {

      // Set the If-Modified-Since and/or If-None-Match header, if in ifModified mode.
      if ( s.ifModified ) {
        modified = jqXHR.getResponseHeader( "Last-Modified" );
        if ( modified ) {
          jQuery.lastModified[ cacheURL ] = modified;
        }
        modified = jqXHR.getResponseHeader( "etag" );
        if ( modified ) {
          jQuery.etag[ cacheURL ] = modified;
        }
      }

      // if no content
      if ( status === 204 || s.type === "HEAD" ) {
        statusText = "nocontent";

      // if not modified
      } else if ( status === 304 ) {
        statusText = "notmodified";

      // If we have data, let's convert it
      } else {
        statusText = response.state;
        success = response.data;
        error = response.error;
        isSuccess = !error;
      }
    } else {

      // Extract error from statusText and normalize for non-aborts
      error = statusText;
      if ( status || !statusText ) {
        statusText = "error";
        if ( status < 0 ) {
          status = 0;
        }
      }
    }

    // Set data for the fake xhr object
    jqXHR.status = status;
    jqXHR.statusText = ( nativeStatusText || statusText ) + "";

    // Success/Error
    if ( isSuccess ) {
      deferred.resolveWith( callbackContext, [ success, statusText, jqXHR ] );
    } else {
      deferred.rejectWith( callbackContext, [ jqXHR, statusText, error ] );
    }

    // Status-dependent callbacks
    jqXHR.statusCode( statusCode );
    statusCode = undefined;

    if ( fireGlobals ) {
      globalEventContext.trigger( isSuccess ? "ajaxSuccess" : "ajaxError",
        [ jqXHR, s, isSuccess ? success : error ] );
    }

    // Complete
    completeDeferred.fireWith( callbackContext, [ jqXHR, statusText ] );

    if ( fireGlobals ) {
      globalEventContext.trigger( "ajaxComplete", [ jqXHR, s ] );

      // Handle the global AJAX counter
      if ( !( --jQuery.active ) ) {
        jQuery.event.trigger( "ajaxStop" );
      }
    }
  }

  return jqXHR;
}

So yeah, this is obviously ridiculous to try to remove all the dependencies from this code. You're better off just including jQuery if you want to use jQuery's method for loading external scripts asynchronously.

Or, consider using a different tool altogether.

July 16, 2013 - from jQuery guts with no dependencies ^{[source code citation needed]}

function getScript(src, callback) {
  var s = document.createElement('script');
  s.src = src;
  s.async = true;
  s.onreadystatechange = s.onload = function() {
    if (!callback.done && (!s.readyState || /loaded|complete/.test(s.readyState))) {
      callback.done = true;
      callback();
    }
  };
  document.querySelector('head').appendChild(s);
}

How do I load a javascript file dynamically?

You cannot embed HTML in Javascript in that way. Basically, what you want is to embed a script element, pointing to a certain javascript file when clicking a button. That can be done with combining events with DOM:

Secure Way of Inserting Dynamic Values in External JavaScript Files