JavaScript: Is There A Problem Here?: JavaScript

Showing posts with label JavaScript. Show all posts

20131101

Problem ID: 3505445824327656442
Entered by: Ben Simo

The Healthcare.gov application that can't

I keep pressing Save & Continue, but nothing happens.

I take a look at my browser's console window, and see a whole bunch of errors -- one for each time I clicked the Save & Continue button.

No matter what I enter into the "First name" field, the browser reports "Cannot set property 'firstName' of null".

The application gets stuck in this same place each time I leave the site and login fresh. Oh, and it also requires I re-enter half the information it already has each time I restart.

This application now appears to be in a state that it cannot be completed. And since the system only allows one open application at a time, this kind of error likely encourages users to create a new Healthcare.gov account -- if they don't totally give up in frustration.

UPDATE 11/03: After a bit of debugging of the Javascript that is hitting the above error, I don't see how anyone with an application that contains more than one person can get past this step. The error is occurring in code that checks for a combination of a duplicate first name and birthdate (if you have twins with the same first name, you can't get them insured); however, this code is attempting to compare first names of family members that haven't yet been entered into the system. Javascript throws a type error when you try to get the lowercase text of a variable with a null value.

Edit

20110816

Problem ID: 8203821244118012748
Entered by: Ben Simo

Illegal Character

Perhaps a border fence could help keep out those illegal characters. ;)

None of the illegal characters shown in this dialog exist in my code.

Edit

20100115

Problem ID: 737371699380718988
Entered by: Ben Simo

Submit Your Complaint

Q: What is worse than having a bad experience with a company's products or services?

A: Having a bad experience contacting the company about your bad experience.

Here's an example exchange I saw on Twitter:

@gibsonclan: @ThomasCookUK When flying Thomas Cook god forbid u have a bad experience - customer service does not exist.

@ThomasCookUK: Sorry to hear this @gibsonclan Do you have a reference number when you logged your call so it can be investigated further? Thank you.

@gibsonclan: @ThomasCookUK Thank you for responding and for looking into this - Incident: 100104-000369

@ThomasCookUK: Hi @gibsonclan If you fill in this link then your complaint/query will enter an automated system & someone be in touch http://bit.ly/7N5Om6

@gibsonclan: @ThomasCookUK I have tried countless attempts to submit it but I continue to receive an error message

@gibsonclan: @ThomasCookUK I have tried the original date 17/12/2009 and I have tried multiple future dates -same error. Is there someone email u can DM

@gibsonclan: @ThomasCookUK Sorted. Browser issue FF worked fine. Thanks, this will be the 2nd Incident I will have filed -would be nice to talk to some1 about

So, it appears that Brad encountered an issue with the Thomas Cook online complaint reporting system. So I opened up Chrome to give it a try.

The first thing I noticed is a stated endeavour to respond within seven days. I think that if a company is going to do business on the Internet, people are going to expect a response in less than seven days.

The complaint reporting system prompts me to enter a date. I click on the date field in the form to enter a date, and a calendar pops up. I navigate the calendar and select 17 December 2009.

The calendar disappears and the date I selected appears in the date field in the form. So far, good.

I then fill in the rest of the required fields and submit the form. An error message is displayed.

It appears that the system doesn't recognize 2009 as being between 1970 and 2010.

I wonder if Thomas Cook will really consider complaints about travel that took place 40 years ago.

Like Brad, I then try some other dates and repeatedly get the error dialog telling me to enter a valid date.

I then try Firefox and can proceed to the next page in the submission process.

Curious as to why Firefox and Chrome behave differently, I try stepping through the JavaScript code that gets executed in the browser when the form is submitted. My first observation is that there is a lot of complex date processing code for what I think should be simple. It appears that, in Chrome, the field value isn't in the place the code expects to find it.

I haven't tried Internet Explorer, but I did see some comments in the JavaScript about issues with IE and Windows XP. There are also comments in the code about not being able to "make heads or tails" of date values. Maybe I'm missing something, but I don't see a reason for the complexity of the date validating code on a web form for submitting a complaint. Perhaps an example of over-automating a solution.

I hope this form is not an example of the complexity of processes implemented by this company.

Edit

20100113

Problem ID: 6551220649272512055
Entered by: Ben Simo

Passwords in client-side Javascript

Tweeted by MatTipton.

Wow! Don't put your password on a sticky note under the keyboard when you can hide it in client-side Javascript code. This may meet the technical requirements given to the developer but it fails to meet the expectations, and purpose, of access control systems.

Edit

20090217

Problem ID: 1766988525608121422
Entered by: Ben Simo

Yes, there is a problem here.

Only a few days after launching this blog, I hit the main URL of http://blog.isthereaproblemhere.com/ and find that there are no stories. I see that my browser is warning me of some code errors on the page. I haven't made any code changes that I can remember since I last saw it working. So I investigate. The last change I made was to some sidebar text. So I go look at that sidebar text and I find the problem.

Blogger's HTML/JavaScript editor apparently has a feature that automatically inserts
tags in the middle of JavaScript code if the Rich Text link is clicked. My looking at sidebar text in the Rich Text editor broke the JavaScript code. :(

Edit

Usability Heuristics

• Visibility of system status Visibility of system status: The system should always keep users informed about what is going on, through appropriate feedback within reasonable time.

• Match between system and the real world Match between system and the real world: The system should speak the users' language, with words, phrases and concepts familiar to the user, rather than system-oriented terms. Follow real-world conventions, making information appear in a natural and logical order.

• User control and freedom User control and freedom: Users often choose system functions by mistake and will need a clearly marked "emergency exit" to leave the unwanted state without having to go through an extended dialogue. Support undo and redo.

• Consistency and standards Consistency and standards: Users should not have to wonder whether different words, situations, or actions mean the same thing. Follow platform conventions.

• Error prevention Error prevention: Even better than good error messages is a careful design which prevents a problem from occurring in the first place. Either eliminate error-prone conditions or check for them and present users with a confirmation option before they commit to the action.

• Recognition rather than recall Recognition rather than recall: Minimize the user's memory load by making objects, actions, and options visible. The user should not have to remember information from one part of the dialogue to another. Instructions for use of the system should be visible or easily retrievable whenever appropriate.

• Flexibility and efficiency of use Flexibility and efficiency of use: Accelerators -- unseen by the novice user -- may often speed up the interaction for the expert user such that the system can cater to both inexperienced and experienced users. Allow users to tailor frequent actions.

• Aesthetic and minimalist design Aesthetic and minimalist design: Dialogues should not contain information which is irrelevant or rarely needed. Every extra unit of information in a dialogue competes with the relevant units of information and diminishes their relative visibility.

• Help users recognize, diagnose, and recover from errors Help users recognize, diagnose, and recover from errors: Error messages should be expressed in plain language (no codes), precisely indicate the problem, and constructively suggest a solution.

• Help and documentation Help and documentation: Even though it is better if the system can be used without documentation, it may be necessary to provide help and documentation. Any such information should be easy to search, focused on the user's task, list concrete steps to be carried out, and not be too large.

Consistency Heuristics

-F amiliar Familiar: The product is not consistent with the pattern of any familiar problem.

E xplainable Explainable: The product is explainable.

W orld World: The product is consistent with the real world.

H istory History: The present version of the product is consistent with past versions of it.

I mage Image: The product is consistent with an image that the organization wants to project.

C omparable Products Comparable Products: The product is consistent with comparable systems.

C laims Claims: The product is consistent with what important people say it’s supposed to be.

U ser Expectations User Expectations: The product is consistent with what users want.

P roduct Product: Each element of the product is consistent with comparable elements in the same system.

P urpose Purpose: The product is consistent with its purposes, both explicit and implicit.

S tatutes Statutes: The product is consistent with applicable laws.

FAILURE Heuristics

F unctional Functional: The error detecting, reporting, and handling functions properly.

A ppropriate Appropriate: Errors are reported at the appropriate time in an appropriate manner.

I mpact Impact: The impact of the failure is communicated to those impacted.

L og Log: The error is appropriately logged; or not logged.

U ser Interface User Interface: The error is reported in the user interface in terms that the user understands.

R ecovery Recovery: The user is informed of what they need to do to recover from the error.

E motions Emotions: The error handling and reporting has a positive influence on user emotions.

Security Vulnerabilities

1. Injection Injection: Injection flaws occur when untrusted data is sent to an interpreter as part of a command. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without authorization.

2. Broken authentication and session management Broken authentication and session management: Application functions related to authentication and session management are often not implemented correctly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities.

3. Cross-Site Scripting Cross-Site Scripting (XSS): XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation or escaping. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites.

4. Insecure Direct Object References Insecure Direct Object References: A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, or database key. Without an access control check or other protection, attackers can manipulate these references to gain unauthorized access to data.

5. Security Misconfiguration Security Misconfiguration: Good security requires having a secure configuration defined and deployed for the application, frameworks, application server, web server, database server, and platform. Secure settings should be defined, implemented, and maintained, as defaults are often insecure. Additionally, software should be kept up to date.

6. Sensitive Data Exposure Sensitive Data Exposure: Many web applications do not properly protect sensitive data, such as credit cards, tax IDs, and authentication credentials. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data deserves extra protection such as encryption at rest or in transit, as well as special precautions when exchanged with the browser.

7. Missing Function Level Access Control Missing Function Level Access Control: Most web applications verify function level access rights before making that functionality visible in the UI. However, applications need to perform the same access control checks on the server when each function is accessed. If requests are not verified, attackers will be able to forge requests in order to access functionality without proper authorization.

8. Cross-Site Request Forgery Cross-Site Request Forgery (CSRF): A CSRF attack forces a logged-on victim’s browser to send a forged HTTP request, including the victim’s session cookie and any other automatically included authentication information, to a vulnerable web application. This allows the attacker to force the victim’s browser to generate requests the vulnerable application thinks are legitimate requests from the victim.

9. Using Components with Known Vulnerabilities Using Components with Known Vulnerabilities: Running software components with known vulnerabilities can compromise the vulnerable components and anything those components can access -- undermining defenses.

10. Unvalidated Redirects and Forwards Unvalidated Redirects and Forwards: Using untrusted data, without validation, to determine the destination of redirects and forwards can enable attackers to redirect victims to phisihing or malware sites.

Is There A Problem Here?

20131101

The Healthcare.gov application that can't

20110816

Illegal Character

20100115

Submit Your Complaint

20100113

Passwords in client-side Javascript

20090217

Yes, there is a problem here.

Problem or no problem?

Usability Heuristics

Consistency Heuristics

FAILURE Heuristics

Security Vulnerabilities

Popular

Recent Problems

Recent Comments