Skip to content

Commit 46efd55

Browse files
ESS-ENNESS-ENN
authored
Merge branch 'coderabbitai:main' into main
2 parents 308e947 + 385a8af commit 46efd55

11 files changed

+1825
-39
lines changed

‎package-lock.json

Lines changed: 32 additions & 39 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎rules/typescript/security/detect-angular-sce-disabled-typescript.yml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
id: detect-angular-sce-disabled-typescript
2+
language: typescript
3+
severity: warning
4+
message: >-
5+
$sceProvider is set to false. Disabling Strict Contextual escaping
6+
(SCE) in an AngularJS application could provide additional attack surface
7+
for XSS vulnerabilities.
8+
note: >-
9+
[CWE-79] Improper Neutralization of Input During Web Page Generation.
10+
[REFERENCES]
11+
- https://docs.angularjs.org/api/ng/service/$sce
12+
- https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
13+
rule:
14+
kind: expression_statement
15+
regex: ^\$sceProvider
16+
has:
17+
kind: call_expression
18+
stopBy: end
19+
all:
20+
- has:
21+
kind: member_expression
22+
nthChild: 1
23+
all:
24+
- has:
25+
kind: identifier
26+
regex: ^\$sceProvider$
27+
- has:
28+
kind: property_identifier
29+
regex: ^enabled$
30+
precedes:
31+
kind: arguments
32+
has:
33+
kind: 'false'
34+
nthChild: 1
35+
not:
36+
has:
37+
nthChild: 2

0 commit comments

Comments
 (0)