I am simply suggesting that you must be aware... I don't think you have to go and ahead learn how to build things using a framework but if you have to find bugs, you should be able to read through the code...
I encourage you to think about whether knowing the framework was relevant here at all. Knowing JavaScript was the only requirement to find this bug.
And yes, I think that "web application security" is a joke. If you want to have a secure application, do not put it in the weakest part of the computer (your web browser)!
It matters in so far as: at the end of the day you have to provide guidance to developers, who may or may not understand the security implications at a deep level. These developers are possibly using "common" frameworks and you need to know what these frameworks do and don't bring to the table. Some do common validation and output encoding for example. Some use functions with cryptographic weaknesses ECT ECT ECT. You wouldn't be able to provide guidance to them if you don't understand the framework they are using (ie the way the language is implemented).
Its also important in pentesting because it allows you to target commonly used packages and implementation for research or do hit known vulnerabilities.
I am simply suggesting that you must be aware... I don't think you have to go and ahead learn how to build things using a framework but if you have to find bugs, you should be able to read through the code...
Which is easier when you just know the language. You can't specialize in moving targets (a.k.a. this week's JS framework).
Please suggest a weekly source for the best frameworks used.
There is no "best framework".
commonly used..
jQuery, Angular and React, I guess. Everything else cannot be said.
Also, it does not matter for web security at all.
If it doesn't matter for web security then Web Application Security is a joke.
I encourage you to refer to this security report :
CRITICAL Account takeover via AngularJS template injection in connect.squareup.com
hackerone.com/reports/26700
$2000 bounty paid by Square...
I encourage you to think about whether knowing the framework was relevant here at all. Knowing JavaScript was the only requirement to find this bug.
And yes, I think that "web application security" is a joke. If you want to have a secure application, do not put it in the weakest part of the computer (your web browser)!
OK...
It matters in so far as: at the end of the day you have to provide guidance to developers, who may or may not understand the security implications at a deep level. These developers are possibly using "common" frameworks and you need to know what these frameworks do and don't bring to the table. Some do common validation and output encoding for example. Some use functions with cryptographic weaknesses ECT ECT ECT. You wouldn't be able to provide guidance to them if you don't understand the framework they are using (ie the way the language is implemented).
Its also important in pentesting because it allows you to target commonly used packages and implementation for research or do hit known vulnerabilities.
We are talking about security researchers. read this article again.