Detecting JavaScript Code with Known Vulnerabilites

Prace se zabyva problematikou detekce zranitelnych JavaScriptovych knihoven a NPM balicku. Na zaklade existujicich studii shrnuje technologicky zaklad platformy Node.js a dale se hloubeji venuje vybranym zranitelnostem systemu NPM a stavajicim ochrannym prostredkum. Bylo vytvoreno rozsireni prohlizece Chrome, ktere ma za cil detekovat a opravit JavaScriptovy kod se znamymi zranitelnostmi na strane weboveho prohlizece. Vytvoreny nastroj byl otestovan pruchodem 50 000 webovymi strankami. Bylo detekovano 8 129 zranitelnych skriptu. Rozsireni bylo publikovano na Chrome Web Store pod nazvem JS Vulnerability Detector .This thesis deals with the detection of vulnerable JavaScript libraries and NPM packages. Based on existing studies, it summarizes the technological core of the Node.js platform and further focuses on selected vulnerabilities of the NPM system and existing means of protection. A Chrome browser extension able to detect and fix JavaScript code with known vulnerabilities on the web browser had been introduced. The tool was tested in a crawl of 50 000 websites. 8 129 vulnerable scripts were detected. The extension has been published to the Chrome Web Store as JS Vulnerability Detector .