contrib.nodejsscan.security_electronjs.electron_context_isolation

profile photo of returntocorpreturntocorp
Author
99
Download Count*
GPLv3
License

Disabling context isolation can introduce Prototype Pollution vulnerabilities.

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: electron_context_isolation
    patterns:
      - pattern-either:
          - pattern: |
              new BrowserWindow({webPreferences: {contextIsolation: false}});
          - pattern: |
              var $X = {webPreferences: {contextIsolation: false}};
    message: Disabling context isolation can introduce Prototype Pollution
      vulnerabilities.
    languages:
      - javascript
    severity: WARNING
    metadata:
      owasp: A06:2017 - Security Misconfiguration
      cwe: "CWE-693: Protection Mechanism Failure"
      category: security
      technology:
        - electron
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]