headless-browser

Vasilii Ermilov

Author

unknown

Download Count*

LGPL Commons Clause

License

Insecure usage of most popular headless browser APIs

Run Locally

Rules (19)

javascript.playwright.security.audit.playwright-exposed-chrome-devtools.playwright-exposed-chrome-devtools

returntocorp

Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk.

javascript.puppeteer.security.audit.puppeteer-exposed-chrome-devtools.puppeteer-exposed-chrome-devtools

returntocorp

Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk.

javascript.phantom.security.audit.phantom-injection.phantom-injection

returntocorp

If unverified user data can reach the `phantom` page methods it can result in Server-Side Request Forgery vulnerabilities

javascript.playwright.security.audit.playwright-addinitscript-code-injection.playwright-addinitscript-code-injection

returntocorp

If unverified user data can reach the `addInitScript` method it can result in Server-Side Request Forgery vulnerabilities

javascript.playwright.security.audit.playwright-evaluate-arg-injection.playwright-evaluate-arg-injection

returntocorp

If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities

javascript.playwright.security.audit.playwright-evaluate-code-injection.playwright-evaluate-code-injection

returntocorp

If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities

javascript.playwright.security.audit.playwright-goto-injection.playwright-goto-injection

returntocorp

If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities

javascript.playwright.security.audit.playwright-setcontent-injection.playwright-setcontent-injection

returntocorp

If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities

javascript.puppeteer.security.audit.puppeteer-evaluate-arg-injection.puppeteer-evaluate-arg-injection

returntocorp

If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities

javascript.puppeteer.security.audit.puppeteer-evaluate-code-injection.puppeteer-evaluate-code-injection

returntocorp

If unverified user data can reach the `evaluate` method it can result in Server-Side Request Forgery vulnerabilities

javascript.puppeteer.security.audit.puppeteer-goto-injection.puppeteer-goto-injection

returntocorp

If unverified user data can reach the `goto` method it can result in Server-Side Request Forgery vulnerabilities

javascript.puppeteer.security.audit.puppeteer-setcontent-injection.puppeteer-setcontent-injection

returntocorp

If unverified user data can reach the `setContent` method it can result in Server-Side Request Forgery vulnerabilities

javascript.wkhtmltoimage.security.audit.wkhtmltoimage-injection.wkhtmltoimage-injection

returntocorp

If unverified user data can reach the `wkhtmltoimage` it can result in Server-Side Request Forgery vulnerabilities

javascript.wkhtmltopdf.security.audit.wkhtmltopdf-injection.wkhtmltopdf-injection

returntocorp

If unverified user data can reach the `wkhtmltopdf` it can result in Server-Side Request Forgery vulnerabilities

javascript.chrome-remote-interface.security.audit.chrome-remote-interface-compilescript-injection.chrome-remote-interface-compilescript-injection

returntocorp

If unverified user data can reach the `compileScript` method it can result in Server-Side Request Forgery vulnerabilities

javascript.chrome-remote-interface.security.audit.chrome-remote-interface-evaluate-injection.chrome-remote-interface-evaluate-injection

returntocorp

this rule has been deprecated.

javascript.chrome-remote-interface.security.audit.chrome-remote-interface-navigate-injection.chrome-remote-interface-navigate-injection

returntocorp

this rule has been deprecated.

javascript.chrome-remote-interface.security.audit.chrome-remote-interface-printtopdf-injection.chrome-remote-interface-printtopdf-injection

returntocorp

this rule has been deprecated.

javascript.chrome-remote-interface.security.audit.chrome-remote-interface-setdocumentcontent-injection.chrome-remote-interface-setdocumentcontent-injection

returntocorp

this rule has been deprecated.