7. Design and logic issues Yes Memory corruption (buffer overflows) Yes-- Malicious script injection --Yes

11. Vulnerability example: exposing WinRT to the web WinJS.xhr({url:”http://contoso.com/fetchcmd”}).done( function fulfilled(result) { var cmd = JSON.parse(result.responseText); eval(cmd.evalMe); }

12. Vulnerability example: exposing WinRT to the web WinJS.xhr({url:”http://contoso.com/fetchcmd”}).done( function fulfilled(result) { var cmd = JSON.parse(result.responseText); switch(cmd.apiNum) { case 0: localFolder.createFileAsync(cmd.filename).then(function (f){ windows.Storage.FilIO.writeTextAsync(f,cmd.content); } case 1: …

21. Windows Runtime and capabilities YesNo Cross-domain XHR requests YesNo External script references NoYes Automatic toStaticHTML validation YesNo

25. Following established patterns can produce code that’s easier to test and debug.

30. Validate source of postMessage event // Secure message handler, validates message domain origin window.addEventListener('message', function (e) { if (e.origin === 'http://data.contoso.com') { div.innerHTML = window.toStaticHTML(e.data); } }, false);

31. Sanitizing HTML from share source if(shareOperation.data.contains(StandardDataFormats.html)) { shareOperation.data.getHtmlFormatAsync().then(function (ut_html) { if (ut_html !== null) { var s_htmlFragment = HtmlFormatHelper.getStaticFragment(ut_html); var myDiv = document.getElementById("htmlContent"); myDiv.innerHTML = s_htmlFragment; } });

32. You can now navigate a WebView directly to saved content in your AppData directory. The domain for saved content is based on the directory. Preserve same-origin policy. Save HTML content from different domains to different directories.

33. Vulnerability: SOP violation (pseudo code) page1 = xhr(“http://contoso.com/page1.html”); page2 = xhr(“http://adnetwork.net/1-78235-872.html”); Windows.Storage.ApplicationData.current.localFolder.createFolderAsync( “MySaved”); // save page1 and page2 content to files in MySaved folder // navigate to page2.html myWebView.navigate(“ms-appdata:///local/MySaved/page2.html”) // page2 can access contents of page 1.

36. Custom certificate in the app manifest

37. Encrypt sensitive data using WinRT API Windows.Security.Cryptography.DataProtection Use XDomainRequest instead of XHR when cookies are not needed See MSDN documentation and links in resources for more details.