ajinabraham.njsscan.layer7_object_dos.layer7_object_dos

Author
1,129
Download Count*
License
Layer7 Denial of Service. Looping over user controlled objects can result in DoS.
Run Locally
Run in CI
Defintion
rules:
- id: layer7_object_dos
patterns:
- pattern-either:
- pattern-inside: function ($REQ, $RES, ...) {...}
- pattern-inside: function $FUNC($REQ, $RES, ...) {...}
- pattern-inside: $X = function $FUNC($REQ, $RES, ...) {...}
- pattern-inside: var $X = function $FUNC($REQ, $RES, ...) {...};
- pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, ...) {...})
- pattern-either:
- pattern-inside: |
$OBJ = $REQ.body;
...
- pattern-inside: |
$OBJ = $REQ.body.$FOO;
...
- pattern-inside: |
for(...){...}
- pattern: |
$OBJ.length
message: Layer7 Denial of Service. Looping over user controlled objects can
result in DoS.
languages:
- javascript
severity: ERROR
metadata:
owasp-web: a6
cwe: cwe-400
license: LGPL-3.0-or-later
Short Link: https://sg.run/OPj7