patmigliaccio.com/client-side-security 7/27/17

client-side-security-svg.js

function requestGeneratedSVG(){
	return xhr('/assets/css/svg/generate')
			.then(response => {
				let content = parseSVGResponse(response.data);

				// Decoded sensitive data would be handled here.
				return JSON.parse(atob(content));
			});
}

// Note: Unnecessary complexity added to logic to increase level of ambiguity.
function parseSVGResponse(data){
	// Puts the last 64 chars in the front.
	let dataAry = data.split('');
	for (let i = 0; i < 64; i++) {
		let lastChars = dataAry.pop().trim();

		dataAry.unshift(lastChars);
	}

	// Reverses the order of the string.
	let dataOut = [];
	dataAry.forEach(x => dataOut.unshift(x))

	return dataOut.join('');
}