detect-angular-sce-disabled-typescript

ESS-ENN · ESS-ENN · commit c3aaeba90084 · 2024-09-25T18:06:37.000+05:30
diff --git a/rules/typescript/security/detect-angular-sce-disabled-typescript.yml b/rules/typescript/security/detect-angular-sce-disabled-typescript.yml
@@ -0,0 +1,15 @@
+id: detect-angular-sce-disabled-typescript
+language: typescript
+severity: warning
+message: >-
+  $sceProvider is set to false. Disabling Strict Contextual escaping
+  (SCE) in an AngularJS application could provide additional attack surface
+  for XSS vulnerabilities.
+note: >-
+  [CWE-79] Improper Neutralization of Input During Web Page Generation.
+  [REFERENCES]
+      - https://docs.angularjs.org/api/ng/service/$sce
+      - https://owasp.org/www-chapter-london/assets/slides/OWASPLondon20170727_AngularJS.pdf
+rule:
+  pattern: |
+    $sceProvider.enabled(false);
diff --git a/tests/typescript/detect-angular-sce-disabled-typescript-test.yml b/tests/typescript/detect-angular-sce-disabled-typescript-test.yml
@@ -0,0 +1,7 @@
+id: detect-angular-sce-disabled-typescript
+valid:
+  - |
+
+invalid:
+  - |
+    $sceProvider.enabled(false);
