Skip to content

Commit 385a8af

Browse files
ESS-ENNSakshis
ESS-ENN
and
Sakshis
authored
Add security rules for detecting hard-coded secrets in TypeScript apps (#77)
* express-session-hardcoded-secret-typescript * express-jwt-hardcoded-secret-typescript * modification in express-jwt-hardcoded-secret-typescript * modification in express-session-hardcoded-secret-typescript * modification in express-session-hardcoded-secret-typescript * modification in express-session-hardcoded-secret-typescript * Update express-session-hardcoded-secret-typescript * Modification of express-jwt-hardcoded-secret-typescript * Modification in express-session-hardcoded-secret-typescript * Added rule detect-angular-sce-disabled-typescript --------- Co-authored-by: Sakshis <sakshil@abc.com>
1 parent a248264 commit 385a8af

11 files changed

+1825
-39
lines changed

‎package-lock.json

Lines changed: 32 additions & 39 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎rules/typescript/security/detect-angular-sce-disabled-typescript.yml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
id: detect-angular-sce-disabled-typescript
2+
language: typescript
3+
severity: warning
4+
message: >-
5+
$sceProvider is set to false. Disabling Strict Contextual escaping
6+
(SCE) in an AngularJS application could provide additional attack surface
7+
for XSS vulnerabilities.
8+
note: >-
9+
[CWE-79] Improper Neutralization of Input During Web Page Generation.
10+
[REFERENCES]
11+
- https://docs.angularjs.org/api/ng/service/$sce
12+
- https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
13+
rule:
14+
kind: expression_statement
15+
regex: ^\$sceProvider
16+
has:
17+
kind: call_expression
18+
stopBy: end
19+
all:
20+
- has:
21+
kind: member_expression
22+
nthChild: 1
23+
all:
24+
- has:
25+
kind: identifier
26+
regex: ^\$sceProvider$
27+
- has:
28+
kind: property_identifier
29+
regex: ^enabled$
30+
precedes:
31+
kind: arguments
32+
has:
33+
kind: 'false'
34+
nthChild: 1
35+
not:
36+
has:
37+
nthChild: 2

0 commit comments

Comments
 (0)