contrib.nodejsscan.header_cors_star.express_cors

profile photo of returntocorpreturntocorp
Author
99
Download Count*
GPLv3
License

Access-Control-Allow-Origin response header is set to "*". This will disable CORS Same Origin Policy restrictions.

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: express_cors
    message: Access-Control-Allow-Origin response header is set to "*". This will
      disable CORS Same Origin Policy restrictions.
    severity: WARNING
    metadata:
      likelihood: LOW
      impact: LOW
      confidence: LOW
      category: security
      cwe:
        - "CWE-346: Origin Validation Error"
      owasp:
        - A07:2021 - Identification and Authentication Failures
      references:
        - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
      technology:
        - web
      subcategory:
        - audit
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
    languages:
      - javascript
    patterns:
      - pattern-either:
          - pattern-inside: function ($REQ, $RES, ...) {...}
          - pattern-inside: function $FUNC($REQ, $RES, ...) {...}
          - pattern-inside: $X = function $FUNC($REQ, $RES, ...) {...}
          - pattern-inside: var $X = function $FUNC($REQ, $RES, ...) {...};
          - pattern-inside: $APP.$METHOD(..., function $FUNC($REQ, $RES, ...) {...})
      - pattern-either:
          - pattern: |
              $APP.options('*', cors(...))
          - pattern: |
              $RES.set("=~/access-control-allow-origin/i", '*', ...)
          - pattern: |
              $RES.set(..., { "=~/access-control-allow-origin/i" : '*' }, ...)
          - pattern: |
              $RES.header("=~/access-control-allow-origin/i", '*', ...)
          - pattern: >
              $RES.writeHead(..., {"=~/access-control-allow-origin/i": '*' },
              ...)

Examples

header_cors_star.js

const express = require('express');

const app = express();

// ruleid:generic_cors
app.options('*', cors())
app.get('/', function (req, res) {

    res.set(ffff)
});

app.get('/', function (req, res) {
    var y = 1;
    var x = '*';
    //sgrep bug - https://github.com/returntocorp/sgrep/issues/512
    // ruleid:express_cors
    res.writeHead(200, { 'Access-Control-Allow-Origin': '*' });
    // ruleid:express_cors
    res.set('access-control-allow-origin', '*');
    //do not match - sgrep bug -rewrite-rule
    res.set('Access-Control-Allow-Origin', 'google.com');
    // ruleid:express_cors
    res.set('Access-Control-Allow-Origin', '*');
    // ruleid:express_cors
    res.set({
        'Content-Length': 123,
        'access-control-allow-origin': '*',
        'ETag': '12345'
    })
    // ruleid:express_cors
    res.writeHead(200, { 'Access-Control-Allow-Origin': '*' })

    // ruleid:express_cors
    res.set('access-control-allow-origin', x);

    // do not detect - sgrep bug
    res.set('access-control-allow-origin', 'xyz.com');
    //do not detect - sgrep bug
    res.set('access-control-allow-origin', null);

});