History
Creation at Netscape
The first popularAdoption by Microsoft
The rise of JScript
In November 1996, Netscape submitted JavaScript toGrowth and standardization
During the period ofReaching maturity
Ambitious work on the language continued for several years, culminating in an extensive collection of additions and refinements being formalized with the publication ofTrademark
"JavaScript" is aWebsite client-side usage
JavaScript is the dominantExamples of scripted behavior
* Loading new web page content without reloading the page, viaLibraries and frameworks
Over 80% of websites use a third-party JavaScriptOther usage
The use of JavaScript has expanded beyond itsFeatures
The following features are common to all conforming ECMAScript implementations unless explicitly specified otherwise.Imperative and structured
JavaScript supports much of the structured programming syntax from C (e.g.,if
statements, while
loops, switch
statements, do while
loops, etc.). One partial exception is scoping: originally JavaScript only had var
; block scoping was added in ECMAScript 2015 with the keywords let
and const
In some programming languages, const is a type qualifier (a keyword applied to a data type) that indicates that the data is read-only. While this can be used to declare constants, in the C family of languages differs from similar constructs i ...
. Like C, JavaScript makes a distinction between expressions and Weakly typed
JavaScript is weakly typed, which means certain types are implicitly cast depending on the operation used. * The binary+
operator casts both operands to a string unless both operands are numbers. This is because the addition operator doubles as a concatenation operator
* The binary -
operator always casts both operands to a number
* Both unary operators (+
, -
) always cast the operand to a number
Values are cast to strings like the following:
* Strings are left as-is
* Numbers are converted to their string representation
* Arrays have their elements cast to strings after which they are joined by commas (,
)
* Other objects are converted to the string bject Object/code> where Object
is the name of the constructor of the object
Values are cast to numbers by casting to strings and then casting the strings to numbers. These processes can be modified by defining toString
and valueOf
functions on the prototype for string and number casting respectively.
JavaScript has received criticism for the way it implements these conversions as the complexity of the rules can be mistaken for inconsistency. For example, when adding a number to a string, the number will be cast to a string before performing concatenation, but when subtracting a number from a string, the string is cast to a number before performing subtraction.
Often also mentioned is + []
resulting in 0
(number). This is misleading: the
is interpreted as an empty code block instead of an empty object, and the empty array is cast to a number by the remaining unary +
operator. If you wrap the expression in parentheses ( + [])
the curly brackets are interpreted as an empty object and the result of the expression is "[object Object]"
as expected.
Dynamic
; Typing:JavaScript is dynamically typed
In computer programming, a type system is a logical system comprising a set of rules that assigns a property called a type to every "term" (a word, phrase, or other set of symbols). Usually the terms are various constructs of a computer progra ...
like most other scripting language
A scripting language or script language is a programming language that is used to manipulate, customize, and automate the facilities of an existing system. Scripting languages are usually interpreted at runtime rather than compiled.
A scripting ...
s. A type is associated with a value
Value or values may refer to:
Ethics and social
* Value (ethics) wherein said concept may be construed as treating actions themselves as abstract objects, associating value to them
** Values (Western philosophy) expands the notion of value beyo ...
rather than an expression. For example, a variable
Variable may refer to:
* Variable (computer science), a symbolic name associated with a value and whose associated value may be changed
* Variable (mathematics), a symbol that represents a quantity in a mathematical expression, as used in many ...
initially bound to a number may be reassigned to a string. JavaScript supports various ways to test the type of objects, including duck typing
Duck typing in computer programming is an application of the duck test—"If it walks like a duck and it quacks like a duck, then it must be a duck"—to determine whether an object can be used for a particular purpose. With nominative ty ...
.
; Run-time evaluation: JavaScript includes an eval
In some programming languages, eval , short for the English evaluate, is a function which evaluates a string as though it were an expression in the language, and returns a result; in others, it executes multiple lines of code as though they had ...
function that can execute statements provided as strings at run-time.
Object-orientation (prototype-based)
Prototypal inheritance in JavaScript is described by Douglas Crockford
Douglas Crockford is an American computer programmer who is involved in the development of the JavaScript language. He specified the data format JSON (JavaScript Object Notation), and has developed various JavaScript related tools such as the st ...
as:
In JavaScript, an object
Object may refer to:
General meanings
* Object (philosophy), a thing, being, or concept
** Object (abstract), an object which does not exist at any particular time or place
** Physical object, an identifiable collection of matter
* Goal, an ...
is an associative array
In computer science, an associative array, map, symbol table, or dictionary is an abstract data type that stores a collection of (key, value) pairs, such that each possible key appears at most once in the collection. In mathematical terms an ...
, augmented with a prototype (see below); each key provides the name for an object property
Property is a system of rights that gives people legal control of valuable things, and also refers to the valuable things themselves. Depending on the nature of the property, an owner of property may have the right to consume, alter, share, r ...
, and there are two syntactical ways to specify such a name: dot notation (obj.x = 10
) and bracket notation (obj x'nbsp;= 10
). A property may be added, rebound, or deleted at run-time. Most properties
Property is the ownership of land, resources, improvements or other tangible objects, or intellectual property.
Property may also refer to:
Mathematics
* Property (mathematics)
Philosophy and science
* Property (philosophy), in philosophy an ...
of an object (and any property that belongs to an object's prototype inheritance chain) can be enumerated using a for...in
loop.
; Prototypes: JavaScript uses prototypes
A prototype is an early sample, model, or release of a product built to test a concept or process. It is a term used in a variety of contexts, including semantics, design, electronics, and software programming. A prototype is generally used to ...
where many other object-oriented languages use classes for inheritance
Inheritance is the practice of receiving private property, titles, debts, entitlements, privileges, rights, and obligations upon the death of an individual. The rules of inheritance differ among societies and have changed over time. Officia ...
. It is possible to simulate many class-based features with prototypes in JavaScript.
; Functions as object constructors: Functions double as object constructors, along with their typical role. Prefixing a function call with ''new'' will create an instance of a prototype, inheriting properties and methods from the constructor (including properties from the Object
prototype). ECMAScript 5 offers the Object.create
method, allowing explicit creation of an instance without automatically inheriting from the Object
prototype (older environments can assign the prototype to null
). The constructor's prototype
property determines the object used for the new object's internal prototype. New methods can be added by modifying the prototype of the function used as a constructor. JavaScript's built-in constructors, such as Array
or Object
, also have prototypes that can be modified. While it is possible to modify the Object
prototype, it is generally considered bad practice because most objects in JavaScript will inherit methods and properties from the Object
prototype, and they may not expect the prototype to be modified.
; Functions as methods: Unlike many object-oriented languages, there is no distinction between a function definition and a method
Method ( grc, μέθοδος, methodos) literally means a pursuit of knowledge, investigation, mode of prosecuting such inquiry, or system. In recent centuries it more often means a prescribed process for completing a task. It may refer to:
*Scien ...
definition. Rather, the distinction occurs during function calling: when a function is called as a method of an object, the function's local ''this'' keyword is bound to that object for that invocation.
Functional
JavaScript function
Function or functionality may refer to:
Computing
* Function key, a type of key on computer keyboards
* Function model, a structured representation of processes in a system
* Function object or functor or functionoid, a concept of object-oriente ...
s are first-class; a function is considered to be an object. As such, a function may have properties and methods, such as .call()
and .bind()
. A ''nested'' function is a function defined within another function. It is created each time the outer function is invoked. In addition, each nested function forms a lexical closure: the lexical scope
In computer programming, the scope of a name binding (an association of a name to an entity, such as a variable) is the part of a program where the name binding is valid; that is, where the name can be used to refer to the entity. In other parts ...
of the outer function (including any constant, local variable, or argument value) becomes part of the internal state of each inner function object, even after execution of the outer function concludes. JavaScript also supports anonymous functions.
Delegative
JavaScript supports implicit and explicit delegation.
; Functions as roles (Traits and Mixins): JavaScript natively supports various function-based implementations of Role
A role (also rôle or social role) is a set of connected behaviors, rights, moral obligation, obligations, beliefs, and social norm, norms as conceptualized by people in a social situation. It is an expected or free or continuously changing behavi ...
patterns like Traits and Mixin
In object-oriented programming languages, a mixin (or mix-in) is a class that contains methods for use by other classes without having to be the parent class of those other classes. How those other classes gain access to the mixin's methods depen ...
s. Such a function defines additional behavior by at least one method bound to the this
keyword within its function
body. A Role then has to be delegated explicitly via call
or apply
to objects that need to feature additional behavior that is not shared via the prototype chain.
; Object composition and inheritance: Whereas explicit function-based delegation does cover composition
Composition or Compositions may refer to:
Arts and literature
*Composition (dance), practice and teaching of choreography
*Composition (language), in literature and rhetoric, producing a work in spoken tradition and written discourse, to include v ...
in JavaScript, implicit delegation already happens every time the prototype chain is walked in order to, e.g., find a method that might be related to but is not directly owned by an object. Once the method is found it gets called within this object's context. Thus inheritance
Inheritance is the practice of receiving private property, titles, debts, entitlements, privileges, rights, and obligations upon the death of an individual. The rules of inheritance differ among societies and have changed over time. Officia ...
in JavaScript is covered by a delegation automatism that is bound to the prototype property of constructor functions.
Miscellaneous
JavaScript is a zero-index language.
; Run-time environment:JavaScript typically relies on a run-time environment (e.g., a web browser
A web browser is application software for accessing websites. When a user requests a web page from a particular website, the browser retrieves its files from a web server and then displays the page on the user's screen. Browsers are used o ...
) to provide objects and methods by which scripts can interact with the environment (e.g., a web page DOM). These environments are single- threaded. JavaScript also relies on the run-time environment to provide the ability to include/import scripts (e.g., HTML
The HyperText Markup Language or HTML is the standard markup language for documents designed to be displayed in a web browser. It can be assisted by technologies such as Cascading Style Sheets (CSS) and scripting languages such as JavaSc ...
elements). This is not a language feature per se, but it is common in most JavaScript implementations. JavaScript processes messages from a queue __NOTOC__
Queue () may refer to:
* Queue area, or queue, a line or area where people wait for goods or services
Arts, entertainment, and media
*''ACM Queue'', a computer magazine
* ''The Queue'' (Sorokin novel), a 1983 novel by Russian author ...
one at a time. JavaScript calls a function
Function or functionality may refer to:
Computing
* Function key, a type of key on computer keyboards
* Function model, a structured representation of processes in a system
* Function object or functor or functionoid, a concept of object-oriente ...
associated with each new message, creating a call stack
In computer science, a call stack is a stack data structure that stores information about the active subroutines of a computer program. This kind of stack is also known as an execution stack, program stack, control stack, run-time stack, or m ...
frame with the function's arguments
An argument is a statement or group of statements called premises intended to determine the degree of truth or acceptability of another statement called conclusion. Arguments can be studied from three main perspectives: the logical, the dialectic ...
and local variable
In computer science, a local variable is a variable that is given ''local scope''. A local variable reference in the function or block in which it is declared overrides the same variable name in the larger scope. In programming languages with o ...
s. The call stack shrinks and grows based on the function's needs. When the call stack is empty upon function completion, JavaScript proceeds to the next message in the queue. This is called the event loop In computer science, the event loop is a programming construct or design pattern that waits for and dispatches events or messages in a program. The event loop works by making a request to some internal or external "event provider" (that generally ...
, described as "run to completion" because each message is fully processed before the next message is considered. However, the language's concurrency model describes the event loop as non-blocking: program input/output
In computing, input/output (I/O, or informally io or IO) is the communication between an information processing system, such as a computer, and the outside world, possibly a human or another information processing system. Inputs are the signals ...
is performed using events
Event may refer to:
Gatherings of people
* Ceremony, an event of ritual significance, performed on a special occasion
* Convention (meeting), a gathering of individuals engaged in some common interest
* Event management, the organization of ev ...
and callback functions. This means, for instance, that JavaScript can process a mouse click while waiting for a database query to return information.
; Variadic functions: An indefinite number of parameters can be passed to a function. The function can access them through formal parameters and also through the local arguments
object. Variadic functions can also be created by using the bind
/code> method.
; Array and object literals: Like many scripting languages, arrays and objects (associative arrays
In computer science, an associative array, map, symbol table, or dictionary is an abstract data type that stores a collection of (key, value) pairs, such that each possible key appears at most once in the collection. In mathematical terms an a ...
in other languages) can each be created with a succinct shortcut syntax. In fact, these literals form the basis of the JSON data format.
; Regular expressions: JavaScript also supports regular expression
A regular expression (shortened as regex or regexp; sometimes referred to as rational expression) is a sequence of characters that specifies a search pattern in text. Usually such patterns are used by string-searching algorithms for "find" ...
s in a manner similar to Perl
Perl is a family of two high-level, general-purpose, interpreted, dynamic programming languages. "Perl" refers to Perl 5, but from 2000 to 2019 it also referred to its redesigned "sister language", Perl 6, before the latter's name was offic ...
, which provide a concise and powerful syntax for text manipulation that is more sophisticated than the built-in string functions.
; Promises and Async/await: JavaScript supports promises and Async/await
In computer programming, the async/await pattern is a syntactic feature of many programming languages that allows an asynchronous, non-blocking function to be structured in a way similar to an ordinary synchronous function. It is semantically rel ...
for handling asynchronous operations. A built-in Promise object provides functionality for handling promises and associating handlers with an asynchronous action's eventual result. Recently, combinator methods were introduced in the JavaScript specification, which allows developers to combine multiple JavaScript promises and do operations based on different scenarios. The methods introduced are: Promise.race, Promise.all, Promise.allSettled and Promise.any. Async/await allows an asynchronous, non-blocking function to be structured in a way similar to an ordinary synchronous function. Asynchronous, non-blocking code can be written, with minimal overhead, structured similar to traditional synchronous, blocking code.
Vendor-specific extensions
Historically, some JavaScript engine
A JavaScript engine is a software component that executes JavaScript code. The first JavaScript engines were mere interpreters, but all relevant modern engines use just-in-time compilation for improved performance.
JavaScript engines are typica ...
s supported these non-standard features:
* conditional catch
clauses (like Java)
* array comprehensions and generator expressions (like Python)
* concise function expressions (function(args) expr
; this experimental syntax predated arrow functions)
* ECMAScript for XML ECMAScript for XML (E4X) is the standarprogramming language extension that adds native XML support to ECMAScript (which includes ActionScript, JavaScript, and JScript). The goal is to provide an alternative to DOM interfaces that uses a simpler syn ...
(E4X), an extension that adds native XML support to ECMAScript (unsupported in Firefox since version 21)
Syntax
Simple examples
Variables in JavaScript can be defined using either the var
, let
or const
keywords. Variables defined without keywords will be defined at the global scope.
// Declares a function-scoped variable named `x`, and implicitly assigns the
// special value `undefined` to it. Variables without value are automatically
// set to undefined.
// var is generally considered bad practice and let and const are usually preferred.
var x;
// Variables can be manually set to `undefined` like so
let x2 = undefined;
// Declares a block-scoped variable named `y`, and implicitly sets it to
// `undefined`. The `let` keyword was introduced in ECMAScript 2015.
let y;
// Declares a block-scoped, un-reassignable variable named `z`, and sets it to
// a string literal. The `const` keyword was also introduced in ECMAScript 2015,
// and must be explicitly assigned to.
// The keyword `const` means constant, hence the variable cannot be reassigned
// as the value is `constant`.
const z = "this value cannot be reassigned!";
// Declares a global-scoped variable and assigns 3. This is generally considered
// bad practice, and will not work if strict mode is on.
t = 3;
// Declares a variable named `myNumber`, and assigns a number literal (the value
// `2`) to it.
let myNumber = 2;
// Reassigns `myNumber`, setting it to a string literal (the value `"foo"`).
// JavaScript is a dynamically-typed language, so this is legal.
myNumber = "foo";
Note the comments in the example above, all of which were preceded with two forward slashes.
There is no built-in Input/output
In computing, input/output (I/O, or informally io or IO) is the communication between an information processing system, such as a computer, and the outside world, possibly a human or another information processing system. Inputs are the signals ...
functionality in JavaScript, instead it is provided by the run-time environment. The ECMAScript specification in edition 5.1 mentions that "there are no provisions in this specification for input of external data or output of computed results".
However, most runtime environments have a console
object that can be used to print output. Here is a minimalist Hello World program
''Hello'' is a salutation or greeting in the English language. It is first attested in writing from 1826. Early uses
''Hello'', with that spelling, was used in publications in the U.S. as early as the 18 October 1826 edition of the '' Norwich ...
in JavaScript in a runtime environment with a console object:
console.log("Hello, World!");
In HTML documents, a program like this is required for an output:
// Text nodes can be made using the "write" method.
// This is frowned upon, as it can overwrite the document if the document is fully loaded.
document.write('foo');
// Elements can be made too. First, they have to be created in the DOM.
const myElem = document.createElement('span');
// Attributes like classes and the id can be set as well
myElem.classList.add('foo');
myElem.id = 'bar';
// After setting this, the tag will look like this: ``
myElem.setAttribute('data-attr', 'baz'); // Which could also be written as `myElem.dataset.attr = 'baz'`
// Finally append it as a child element to the in the HTML
document.body.appendChild(myElem);
// Elements can be imperatively grabbed with querySelector for one element, or querySelectorAll for multiple elements that can be looped with forEach
document.querySelector('.class'); // Selects the first element with the "class" class
document.querySelector('#id'); // Selects the first element with an `id` of "id"
document.querySelector(' ata-other); // Selects the first element with the "data-other" attribute
document.querySelectorAll('.multiple'); // Returns an Array of all elements with the "multiple" class
A simple recursive
Recursion (adjective: ''recursive'') occurs when a thing is defined in terms of itself or of its type. Recursion is used in a variety of disciplines ranging from linguistics to logic. The most common application of recursion is in mathematics ...
function to calculate the factorial of a natural number
In mathematics, the natural numbers are those numbers used for counting (as in "there are ''six'' coins on the table") and ordering (as in "this is the ''third'' largest city in the country").
Numbers used for counting are called ''cardinal ...
:
function factorial(n)
factorial(3); // Returns 6
An anonymous function (or lambda):
const counter = function() ;
const x = counter();
x(); // Returns 1
x(); // Returns 2
x(); // Returns 3
This example shows that, in JavaScript, function closures capture their non-local variables by reference.
Arrow functions were first introduced in 6th Edition - ECMAScript 2015. They shorten the syntax for writing functions in JavaScript. Arrow functions are anonymous, so a variable is needed to refer to them in order to invoke them after their creation, unless surrounded by parenthesis and executed immediately.
Example of arrow function:
// Arrow functions let us omit the `function` keyword.
// Here `long_example` points to an anonymous function value.
const long_example = (input1, input2) => ;
// If there are no braces, the arrow function simply returns the expression
// So here it's (input1 + input2)
const short_example = (input1, input2) => input1 + input2;
long_example(2, 3); // Prints "Hello, World!" and returns 5
short_example(2, 5); // Returns 7
// If an arrow function has only one parameter, the parentheses can be removed.
const no_parentheses = input => input + 2;
no_parentheses(3); // Returns 5
// An arrow function, like other function definitions, can be executed in the same statement as they are created.
// This is useful when writing libraries to avoid filling the global scope, and for closures.
let three = ((a, b) => a + b) (1, 2);
const generate_multiplier_function = a => (b => isNaN(b) , , !b ? a : a*=b);
const five_multiples = generate_multiplier_function(5); // The supplied argument "seeds" the expression and is retained by a.
five_multiples(1); // Returns 5
five_multiples(3); // Returns 15
five_multiples(4); // Returns 60
In JavaScript, objects
Object may refer to:
General meanings
* Object (philosophy), a thing, being, or concept
** Object (abstract), an object which does not exist at any particular time or place
** Physical object, an identifiable collection of matter
* Goal, an ...
can be created as instances of a class
Class or The Class may refer to:
Common uses not otherwise categorized
* Class (biology), a taxonomic rank
* Class (knowledge representation), a collection of individuals or objects
* Class (philosophy), an analytical concept used differentl ...
.
Object class example:
class Ball ;
const myBall = new Ball(5); // Creates a new instance of the ball object with radius 5
myBall.radius++; // Object properties can usually be modified from the outside
myBall.show(); // Using the inherited "show" function logs "6"
In JavaScript, objects
Object may refer to:
General meanings
* Object (philosophy), a thing, being, or concept
** Object (abstract), an object which does not exist at any particular time or place
** Physical object, an identifiable collection of matter
* Goal, an ...
can be instantiated directly from a function.
Object functional example:
function Ball(radius) ;
const myBall = Ball(5); // Creates a new ball object with radius 5. No "new" keyword needed.
myBall.radius++; // The instance property can be modified.
myBall.show(); // Using the "show" function logs "6" - the new instance value.
Variadic function
In mathematics and in computer programming, a variadic function is a function of indefinite arity, i.e., one which accepts a variable number of arguments. Support for variadic functions differs widely among programming languages.
The term ''vari ...
demonstration (arguments
is a special variable
Variable may refer to:
* Variable (computer science), a symbolic name associated with a value and whose associated value may be changed
* Variable (mathematics), a symbol that represents a quantity in a mathematical expression, as used in many ...
):
function sum()
sum(1, 2); // Returns 3
sum(1, 2, 3); // Returns 6
// As of ES6, using the rest operator.
function sum(...args)
sum(1, 2); // Returns 3
sum(1, 2, 3); // Returns 6
Immediately-invoked function expression
An immediately invoked function expression (or IIFE, pronounced "iffy", IPA /ˈɪf.i/) is a programming language idiom which produces a lexical scope using function scoping. It was popular in JavaScript as a method to support modular programming b ...
s are often used to create closures. Closures allow gathering properties and methods in a namespace and making some of them private:
let counter = (function() )(); // Module
counter.get(); // Returns 0
counter.set(6);
counter.increment(); // Returns 7
counter.increment(); // Returns 8
Generator objects (in the form of generator functions) provide a function which can be called, exited, and re-entered while maintaining internal context (statefulness).
function* rawCounter()
function* dynamicCounter()
// Instances
const counter1 = rawCounter();
const counter2 = dynamicCounter();
// Implementation
counter1.next(); //
counter1.next(); //
counter1.next(); //
counter2.next(); //
counter2.next(); //
counter2.next(); //
// ...infinitely
JavaScript can export and import from modules:
Export example:
/* mymodule.js */
// This function remains private, as it is not exported
let sum = (a, b) =>
// Export variables
export let name = 'Alice';
export let age = 23;
// Export named functions
export function add(num1, num2)
// Export class
export class Multiplication
Import example:
// Import one property
import from './mymodule.js';
console.log(add(1, 2));
//> 3
// Import multiple properties
import from './mymodule.js';
console.log(name, age);
//> "Alice", 23
// Import all properties from a module
import * from './module.js'
console.log(name, age);
//> "Alice", 23
console.log(add(1,2));
//> 3
More advanced example
This sample code displays various JavaScript features.
/* Finds the lowest common multiple (LCM) of two numbers */
function LCMCalculator(x, y)
// The prototype of object instances created by a constructor is
// that constructor's "prototype" property.
LCMCalculator.prototype = ;
// Define generic output function; this implementation only works for Web browsers
function output(x)
// Note: Array's map() and forEach() are defined in JavaScript 1.6.
// They are used here to demonstrate JavaScript's inherent functional nature.
____[25,_55
____[21,_56.html"_;"title="5,_55.html"_;"title="____[25,_55">____[25,_55
____[21,_56">5,_55.html"_;"title="____[25,_55">____[25,_55
____[21,_56
____[22,_58.html" ;"title="5,_55">____[25,_55
____[21,_56.html" ;"title="5,_55.html" ;"title=" [25, 55"> [25, 55
[21, 56">5,_55.html" ;"title=" [25, 55"> [25, 55
[21, 56
[22, 58">5,_55">____[25,_55
____[21,_56.html" ;"title="5,_55.html" ;"title=" [25, 55"> [25, 55
[21, 56">5,_55.html" ;"title=" [25, 55"> [25, 55
[21, 56
[22, 58
[28, 56]
].map(function(pair) ).sort((a, b) => a.lcm() - b.lcm()) // sort with this comparative function; => is a shorthand form of a function, called "arrow function"
.forEach(printResult);
function printResult(obj)
The following output should be displayed in the browser window.
LCMCalculator: a = 28, b = 56, gcd = 28, lcm = 56
LCMCalculator: a = 21, b = 56, gcd = 7, lcm = 168
LCMCalculator: a = 25, b = 55, gcd = 5, lcm = 275
LCMCalculator: a = 22, b = 58, gcd = 2, lcm = 638
Security
JavaScript and the DOM provide the potential for malicious authors to deliver scripts to run on a client computer via the Web. Browser authors minimize this risk using two restrictions. First, scripts run in a sandbox in which they can only perform Web-related actions, not general-purpose programming tasks like creating files. Second, scripts are constrained by the same-origin policy: scripts from one Web site do not have access to information such as usernames, passwords, or cookies sent to another site. Most JavaScript-related security bugs are breaches of either the same origin policy or the sandbox.
There are subsets of general JavaScript—ADsafe, Secure ECMAScript (SES)—that provide greater levels of security, especially on code created by third parties (such as advertisements). Closure Toolkit is another project for safe embedding and isolation of third-party JavaScript and HTML.
Content Security Policy
Content Security Policy (CSP) is a computer security standard introduced to prevent cross-site scripting (XSS), clickjacking and other code injection attacks resulting from execution of malicious content in the trusted web page context. It is a C ...
is the main intended method of ensuring that only trusted code is executed on a Web page.
Cross-site vulnerabilities
A common JavaScript-related security problem is cross-site scripting
Cross-site scripting (XSS) is a type of security vulnerability that can be found in some web applications. XSS attacks enable attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability m ...
(XSS), a violation of the same-origin policy. XSS vulnerabilities occur when an attacker can cause a target Web site, such as an online banking website, to include a malicious script in the webpage presented to a victim. The script in this example can then access the banking application with the privileges of the victim, potentially disclosing secret information or transferring money without the victim's authorization. A solution to XSS vulnerabilities is to use ''HTML escaping'' whenever displaying untrusted data.
Some browsers include partial protection against ''reflected'' XSS attacks, in which the attacker provides a URL including malicious script. However, even users of those browsers are vulnerable to other XSS attacks, such as those where the malicious code is stored in a database. Only correct design of Web applications on the server-side can fully prevent XSS.
XSS vulnerabilities can also occur because of implementation mistakes by browser authors.
Another cross-site vulnerability is cross-site request forgery
Cross-site request forgery, also known as one-click attack or session riding and abbreviated as CSRF (sometimes pronounced ''sea-surf'') or XSRF, is a type of malicious exploit of a website or web application where unauthorized commands are submitt ...
(CSRF). In CSRF, code on an attacker's site tricks the victim's browser into taking actions the user did not intend at a target site (like transferring money at a bank). When target sites rely solely on cookies for request authentication, requests originating from code on the attacker's site can carry the same valid login credentials of the initiating user. In general, the solution to CSRF is to require an authentication value in a hidden form field, and not only in the cookies, to authenticate any request that might have lasting effects. Checking the HTTP Referrer header can also help.
"JavaScript hijacking" is a type of CSRF attack in which a
tag on an attacker's site exploits a page on the victim's site that returns private information such as JSON or JavaScript. Possible solutions include:
* requiring an authentication token in the POST
Post or POST commonly refers to:
*Mail, the postal system, especially in Commonwealth of Nations countries
**An Post, the Irish national postal service
**Canada Post, Canadian postal service
**Deutsche Post, German postal service
**Iraqi Post, Ira ...
and GET
Get or GET may refer to:
* Get (animal), the offspring of an animal
* Get (divorce document), in Jewish religious law
* GET (HTTP), a type of HTTP request
* "Get" (song), by the Groggers
* Georgia Time, used in the Republic of Georgia
* Get AS, a ...
parameters for any response that returns private information.
Misplaced trust in the client
Developers of client-server applications must recognize that untrusted clients may be under the control of attackers. The application author cannot assume that their JavaScript code will run as intended (or at all) because any secret embedded in the code could be extracted by a determined adversary. Some implications are:
* Web site authors cannot perfectly conceal how their JavaScript operates because the raw source code must be sent to the client. The code can be obfuscated
Obfuscation is the obscuring of the intended meaning of communication by making the message difficult to understand, usually with confusing and ambiguous language. The obfuscation might be either unintentional or intentional (although intent u ...
, but obfuscation can be reverse-engineered.
* JavaScript form validation only provides convenience for users, not security. If a site verifies that the user agreed to its terms of service, or filters invalid characters out of fields that should only contain numbers, it must do so on the server, not only the client.
* Scripts can be selectively disabled, so JavaScript cannot be relied on to prevent operations such as right-clicking on an image to save it.
* It is considered very bad practice to embed sensitive information such as passwords in JavaScript because it can be extracted by an attacker.
Misplaced trust in developers
Package management systems such as npm and Bower are popular with JavaScript developers. Such systems allow a developer to easily manage their program's dependencies upon other developers' program libraries. Developers trust that the maintainers of the libraries will keep them secure and up to date, but that is not always the case. A vulnerability has emerged because of this blind trust. Relied-upon libraries can have new releases that cause bugs or vulnerabilities to appear in all programs that rely upon the libraries. Inversely, a library can go unpatched with known vulnerabilities out in the wild. In a study done looking over a sample of 133,000 websites, researchers found 37% of the websites included a library with at least one known vulnerability. "The median lag between the oldest library version used on each website and the newest available version of that library is 1,177 days in ALEXA, and development of some libraries still in active use ceased years ago." Another possibility is that the maintainer of a library may remove the library entirely. This occurred in March 2016 when Azer Koçulu removed his repository from npm. This caused tens of thousands of programs and websites depending upon his libraries to break.
Browser and plugin coding errors
JavaScript provides an interface to a wide range of browser capabilities, some of which may have flaws such as buffer overflow
In information security and programming, a buffer overflow, or buffer overrun, is an anomaly whereby a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory locations.
Buffers are areas of memo ...
s. These flaws can allow attackers to write scripts that would run any code they wish on the user's system. This code is not by any means limited to another JavaScript application. For example, a buffer overrun exploit can allow an attacker to gain access to the operating system's API
An application programming interface (API) is a way for two or more computer programs to communicate with each other. It is a type of software interface, offering a service to other pieces of software. A document or standard that describes how ...
with superuser privileges.
These flaws have affected major browsers including Firefox, Internet Explorer, and Safari.
Plugins, such as video players, Adobe Flash
Adobe Flash (formerly Macromedia Flash and FutureSplash) is a multimedia software platform used for production of animations, rich web applications, desktop applications, mobile apps, mobile games, and embedded web browser video players. Fla ...
, and the wide range of ActiveX
ActiveX is a deprecated software framework created by Microsoft that adapts its earlier Component Object Model (COM) and Object Linking and Embedding (OLE) technologies for content downloaded from a network, particularly from the World Wide We ...
controls enabled by default in Microsoft Internet Explorer, may also have flaws exploitable via JavaScript (such flaws have been exploited in the past).
In Windows Vista, Microsoft has attempted to contain the risks of bugs such as buffer overflows by running the Internet Explorer process with limited privileges. Google Chrome similarly confines its page renderers to their own " sandbox".
Sandbox implementation errors
Web browsers are capable of running JavaScript outside the sandbox, with the privileges necessary to, for example, create or delete files. Such privileges are not intended to be granted to code from the Web.
Incorrectly granting privileges to JavaScript from the Web has played a role in vulnerabilities in both Internet Explorer and Firefox. In Windows XP Service Pack 2, Microsoft demoted JScript's privileges in Internet Explorer.
Microsoft Windows allows JavaScript source files on a computer's hard drive to be launched as general-purpose, non-sandboxed programs (see: Windows Script Host
The Microsoft Windows Script Host (WSH) (formerly named Windows Scripting Host) is an automation technology for Microsoft Windows operating systems that provides scripting abilities comparable to batch files, but with a wider range of supported fe ...
). This makes JavaScript (like VBScript
VBScript (''"Microsoft Visual Basic Scripting Edition"'') is an Active Scripting language developed by Microsoft that is modeled on Visual Basic. It allows Microsoft Windows system administrators to generate powerful tools for managing computers ...
) a theoretically viable vector for a Trojan horse
The Trojan Horse was a wooden horse said to have been used by the Greeks during the Trojan War to enter the city of Troy and win the war. The Trojan Horse is not mentioned in Homer's ''Iliad'', with the poem ending before the war is concluded, ...
, although JavaScript Trojan horses are uncommon in practice.
Hardware vulnerabilities
In 2015, a JavaScript-based proof-of-concept implementation of a rowhammer
Row hammer (also written as rowhammer) is a security exploit that takes advantage of an unintended and undesirable side effect in dynamic random-access memory (DRAM) in which memory cells interact electrically between themselves by leaking the ...
attack was described in a paper by security researchers.
In 2017, a JavaScript-based attack via browser was demonstrated that could bypass ASLR
Address space layout randomization (ASLR) is a computer security technique involved in preventing Exploit (computer security), exploitation of memory corruption Vulnerability (computing), vulnerabilities. In order to prevent an attacker from reli ...
. It's called "ASLR⊕Cache" or AnC.
In 2018, the paper that announced the Spectre
Spectre, specter or the spectre may refer to:
Religion and spirituality
* Vision (spirituality)
* Apparitional experience
* Ghost
Arts and entertainment Film and television
* ''Spectre'' (1977 film), a made-for-television film produced and writ ...
attacks against Speculative Execution in Intel and other processors included a JavaScript implementation.
Development tools
Important tools have evolved with the language.
* Every major web browser has built-in web development tools, including a JavaScript debugger
A debugger or debugging tool is a computer program used to test and debug other programs (the "target" program). The main use of a debugger is to run the target program under controlled conditions that permit the programmer to track its executi ...
.
* Static program analysis
In computer science, static program analysis (or static analysis) is the analysis of computer programs performed without executing them, in contrast with dynamic program analysis, which is performed on programs during their execution.
The term ...
tools, such as ESLint
ESLint is a static code analysis tool for identifying problematic patterns found in JavaScript code. It was created by Nicholas C. Zakas in 2013. Rules in ESLint are configurable, and customized rules can be defined and loaded. ESLint covers bo ...
and JSLint
JSLint is a static code analysis tool used in software development for checking if JavaScript source code complies with coding rules. It is provided primarily as a browser-based web application accessible through the domain jslint.com, but ther ...
, scan JavaScript code for conformance to a set of standards and guidelines.
* Some browsers have built-in profilers. Stand-alone profiling libraries have also been created, such as benchmark.js and jsbench.
* Many text editor
A text editor is a type of computer program that edits plain text. Such programs are sometimes known as "notepad" software (e.g. Windows Notepad). Text editors are provided with operating systems and software development packages, and can be ...
s have syntax highlighting support for JavaScript code.
Related technologies
Java
A common misconception is that JavaScript is the same as Java
Java (; id, Jawa, ; jv, ꦗꦮ; su, ) is one of the Greater Sunda Islands in Indonesia. It is bordered by the Indian Ocean to the south and the Java Sea to the north. With a population of 151.6 million people, Java is the world's mos ...
. Both indeed have a C-like syntax (the C language being their most immediate common ancestor language). They are also typically sandboxed (when used inside a browser), and JavaScript was designed with Java's syntax and standard library in mind. In particular, all Java keywords were reserved in original JavaScript, JavaScript's standard library follows Java's naming conventions, and JavaScript's and objects are based on classes from Java 1.0.
Java
Java (; id, Jawa, ; jv, ꦗꦮ; su, ) is one of the Greater Sunda Islands in Indonesia. It is bordered by the Indian Ocean to the south and the Java Sea to the north. With a population of 151.6 million people, Java is the world's mos ...
and JavaScript both first appeared in 1995, but Java was developed by James Gosling
James Gosling (born May 19, 1955) is a Canadian computer scientist, best known as the founder and lead designer behind the Java programming language.
Gosling was elected a member of the National Academy of Engineering in 2004 for the conception ...
of Sun Microsystems and JavaScript by Brendan Eich
Brendan Eich (; born July 4, 1961) is an American computer programmer and technology executive. He created the JavaScript programming language and co-founded the Mozilla project, the Mozilla Foundation, and the Mozilla Corporation. He served ...
of Netscape Communications.
The differences between the two languages are more prominent than their similarities. Java has static typing
In computer programming, a type system is a logical system comprising a set of rules that assigns a property called a type to every "term" (a word, phrase, or other set of symbols). Usually the terms are various constructs of a computer progra ...
, while JavaScript's typing is dynamic
Dynamics (from Greek δυναμικός ''dynamikos'' "powerful", from δύναμις ''dynamis'' "power") or dynamic may refer to:
Physics and engineering
* Dynamics (mechanics)
** Aerodynamics, the study of the motion of air
** Analytical dyna ...
. Java is loaded from compiled bytecode, while JavaScript is loaded as human-readable source code. Java's objects are class-based
Class-based programming, or more commonly class-orientation, is a style of object-oriented programming (OOP) in which inheritance (object-oriented programming), inheritance occurs via defining ''class (computer programming), classes'' of object ...
, while JavaScript's are prototype-based. Finally, Java did not support functional programming until Java 8, while JavaScript has done so from the beginning, being influenced by Scheme.
JSON
JSON, or JavaScript Object Notation, is a general-purpose data interchange format that is defined as a subset of JavaScript's object literal syntax.
TypeScript
TypeScript (TS) is a strictly-typed variant of JavaScript. TS differs by introducing type annotations to variables and functions, and introducing a type language to describe the types within JS. Otherwise TS shares much the same featureset as JS, to allow it to be easily transpiled to JS for running client-side, and to interoperate with other JS code.
WebAssembly
Since 2017, web browsers have supported WebAssembly
WebAssembly (sometimes abbreviated Wasm) defines a portable binary-code format and a corresponding text format for executable programs as well as software interfaces for facilitating interactions between such programs and their host environment ...
, a binary format that enables a JavaScript engine
A JavaScript engine is a software component that executes JavaScript code. The first JavaScript engines were mere interpreters, but all relevant modern engines use just-in-time compilation for improved performance.
JavaScript engines are typica ...
to execute performance-critical portions of web page scripts close to native speed. WebAssembly code runs in the same sandbox as regular JavaScript code.
asm.js is a subset of JavaScript that served as the forerunner of WebAssembly.
Transpilers
JavaScript is the dominant client-side language of the Web, and many websites are script-heavy. Thus transpiler
A source-to-source translator, source-to-source compiler (S2S compiler), transcompiler, or transpiler is a type of translator that takes the source code of a program written in a programming language as its input and produces an equivalent sou ...
s have been created to convert code written in other languages, which can aid the development process.
References
Further reading
* Flanagan, David. ''JavaScript: The Definitive Guide''. 7th edition. Sebastopol, California: O'Reilly, 2020.
* Haverbeke, Marijn. ''Eloquent JavaScript''. 3rd edition. No Starch Press, 2018. 472 pages. .''(download)''
/small>
* Zakas, Nicholas. ''Principles of Object-Oriented JavaScript'', 1st edition. No Starch Press, 2014. 120 pages. .
External links
*
*
{{Authority control
American inventions
Articles with example JavaScript code
Cross-platform software
Dynamically typed programming languages
Functional languages
Object-based programming languages
High-level programming languages
Programming languages created in 1995
Programming languages with an ISO standard
Prototype-based programming languages
Scripting languages
Web programming