#javascript

ci

r2c

Scan for runtime errors, logic bugs, and high-confidence security vulnerabilities. Recommended for use in CI to block serious issues from reaching production. Supports Python, Java, JavaScript, and Go.

r2c

Grayson Hardaway

Default ruleset, by r2c

r2c-ci

r2c

Scan for runtime errors, logic bugs, and high-confidence security vulnerabilities. Recommended for use in CI to block serious issues from reaching production. Supports Python, Java, JavaScript, and Go.

r2c-security-audit

r2c

Scan code for potential security issues that require additional review. Recommended for teams looking to set up guardrails or to flag troublesome spots for further review.

nodejsscan

Ajin Abraham

Rules from the preeminent Node.js security scanner, NodeJSScan.

javascript

Default ruleset for JavaScript, written by ajinabraham, and r2c

clientside-js

Vasilii Ermilov

Most common clientside JavaScript XSS vulnerabilities

xss

Grayson Hardaway

Secure defaults for XSS prevention across 5 different languages

minusworld.express-xss

r2c

Cross-site scripting (XSS) secure defaults for Express.js

jwt

Vasilii Ermilov

Avoid common JWT security mistakes

colleend.insecure-transport-nodejs

r2c

Rule pack for detecting insecure transport in node js

security-audit

r2c

Scan code for potential security issues that require additional review. Recommended for teams looking to set up guardrails or to flag troublesome spots for further review.

r2c-best-practices

r2c

A collection of opinionated rules for best practices in popular languages. Recommended for users who want really strict coding standards.

eslint-plugin-security

Selected rules from eslint-plugin-security, a security plugin for ESLint, rewritten in Semgrep.

minusworld.omni-xss

r2c

Secure defaults for XSS prevention

r2c-bug-scan

r2c

Find common bugs, errors, and logic issues in popular languages.

insecure-transport

Colleen Dai

Ensure your code communicates over encrypted channels instead of plaintext.

r2c-owasp-presentation

Grayson Hardaway

Ruleset accompanying r2c OWASP presentation.

r2c

Scan for runtime errors, logic bus, and high-confidence security vulnerabilities. Recommended for use in CI to block serious issues from reaching production.

r2c

Rule pack for detecting insecure transport in node js

auto

r2c

Use recommended rulesets specific to your project. Auto config is not a ruleset but a mode that scans for languages and frameworks and then uses the Semgrep Registry to select recommended rules. Semgrep will send a list of languages, frameworks, and your project URL to the Registry when using auto mode (but code is never uploaded).

command-injection

r2c

Secure defaults for Command injection prevention across 5 different languages

r2c

Omni pack for insecure transport rules

r2c

electron desktop app

Default ruleset for Express.js, written by ajinabraham and r2c

eslint rules in Gitlab SAST, written by Gitlab, ajinabraham, and r2c

Vasilii Ermilov

Insecure usage of most popular headless browser APIs

Vasilii Ermilov

Secure defaults for Command injection prevention

r2c

Scan for runtime errors, logic bus, and high-confidence security vulnerabilities. Recommended for use in CI to block serious issues from reaching production. Supports Python, Java, JavaScript, and Go.

Colleen Dai

SQL injection guardrails. Checks for non-constant SQL queries and other SQLi.

Default ruleset for Node.js, written by ajinabraham and r2c

Grayson Hardaway

Ruleset for OWASP SF

r2c

The OWASP Top 10 is an industry-recognized report of top web application security risks. Use this ruleset to scan for OWASP Top 10 vulnerabilities.

Colleen Dai

SQL injection guardrails. Checks for non-constant SQL queries and other SQLi.

Experimental features are not expected to be in production ready applications.

ajinabraham.njsscan.security_electronjs.electron_disable_websecurity

Disabling webSecurity will disable the same-origin policy and allows the execution of insecure code from any domain.

ajinabraham.njsscan.security_electronjs.electron_allow_http

Application can load content over HTTP and that makes the app vulnerable to Man in the middle attacks.

Blink's expirimental features are enabled in this application. Some of the features may affect the security of the application.

Node integration exposes node.js APIs to the electron app and this can introduce remote code execution vulnerabilities to the application if the app is vulnerable to Cross Site Scripting (XSS).

Disabling context isolation can introduce Prototype Pollution vulnerabilities.

User controlled data in 'child_process.exec()' can result in Remote OS Command Execution.

User controlled data in 'child_process.exec()' can result in Remote OS Command Execution.

ajinabraham

Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine.

ajinabraham

Untrusted input concatinated with raw SQL query using knex raw() or whereRaw() functions can result in SQL Injection.

ajinabraham

This application has anti CSRF protection which prevents cross site request forgery attacks.

ajinabraham

Content Security Policy header is present. More Information: https://helmetjs.github.io/docs/csp/

ajinabraham

X-Permitted-Cross-Domain-Policies header set to off. More information: https://helmetjs.github.io/docs/crossdomain/

ajinabraham

Expect-CT header is present. More information: https://helmetjs.github.io/docs/expect-ct/

ajinabraham

Feature-Policy header is present. More information: https://helmetjs.github.io/docs/feature-policy/

ajinabraham

X-Frame-Options header is present. More information: https://helmetjs.github.io/docs/frameguard/

ajinabraham

X-DNS-Prefetch-Control header is present and DNS Prefetch Control is enabled. More information: https://helmetjs.github.io/docs/dns-prefetch-control/

ajinabraham

Default X-Powered-By is removed or modified. More information: https://helmetjs.github.io/docs/hide-powered-by/

ajinabraham

HSTS header is present. More information: https://helmetjs.github.io/docs/hsts/

ajinabraham

X-Download-Options header is present. More information: https://helmetjs.github.io/docs/ienoopen/

ajinabraham

Content-Type-Options header is present. More information: https://helmetjs.github.io/docs/dont-sniff-mimetype/

ajinabraham

Referrer-Policy header is present. More information: https://helmetjs.github.io/docs/referrer-policy/

ajinabraham

X-XSS-Protection header is present. More information: https://helmetjs.github.io/docs/xss-filter/

ajinabraham

This application has API rate limiting controls.

Detected use of express.csrf() middleware before express.methodOverride(). This can allow GET requests (which are not checked by csrf) to turn into POST requests later.

Detected eval(variable), which could allow a malicious actor to run arbitrary code.

Detected non-literal calls to child_process.exec(). This could lead to a command injection vulnerability.

Detected usage of crypto.pseudoRandomBytes, which does not produce secure random numbers.

Markup escaping disabled. This can be used with some template engines to escape disabling of HTML entities, which can lead to XSS attacks.

Detected the use of require(variable). Calling require with a non-literal argument might allow an attacker to load an run arbitrary code, or access arbitrary files.

Detected usage of noassert in Buffer API, which allows the offset the be beyond the end of the buffer. This could result in writing or reading beyond the end of the buffer.

String comparisons using '===', '!==', '!=' and '==' is vulnerable to timing attacks. More info: https://snyk.io/blog/node-js-timing-attack-ccc-ctf/

RegExp() called with a variable, this might allow an attacker to DOS your application with a long-running regular expression.

A variable is present in the filename argument of fs calls, this might allow an attacker to access anything on your system.

Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype, leading to possible code execution.

Missing 'noopener' on an anchor tag where target='_blank'. This could introduce a reverse tabnabbing vulnerability. Include 'noopener' when using target='_blank'.

Setting HTML from code is risky because it’s easy to inadvertently expose your users to a cross-site scripting (XSS) attack.

returntocorp

Make sure that unverified user data can not reach `vm2`.

returntocorp

Make sure that unverified user data can not reach `vm2`.

returntocorp

Make sure that unverified user data can not reach vm.runInContext.

returntocorp

Make sure that unverified user data can not reach vm.runInNewContext.

returntocorp

Make sure that unverified user data can not reach vm.compileFunction.

returntocorp

Make sure that unverified user data can not reach vm instance.

returntocorp

Path constructed with user input can result in Path Traversal. Ensure that user input does not reach `join()` or `resolve()`.

returntocorp

Possible writing outside of the destination, make sure that the target path is nested in the intended destination

returntocorp

Make sure that unverified user data can not reach vm.compileFunction.

returntocorp

Make sure that unverified user data can not reach vm.runInContext.

returntocorp

Make sure that unverified user data can not reach vm.SourceTextModule.

returntocorp

Make sure that unverified user data can not reach vm.runInNewContext.

returntocorp

Unrusted data in `sandbox` can result in code injection.

returntocorp

Untrusted user input reaching `vm2` can result in code injection.

returntocorp

Untrusted user input reaching `vm2` sandbox can result in context injection.

returntocorp

Untrusted user input in `vm.runInContext()` can result in code injection.

returntocorp

Untrusted user input in `vm.runInNewContext()` can result in code injection.

returntocorp

Untrusted user input in `vm.compileFunction()` can result in code injection.

returntocorp

Untrusted user input reaching `vm` can result in code injection.

returntocorp

Untrusted user input in templating engine's compile() function can result in Remote Code Execution via server side template injection.

returntocorp

Possible open redirect

returntocorp

Possible writing outside of the destination, make sure that the target path is nested in the intended destination

returntocorp

Make sure that unverified user data can not reach vm.runInContext.

returntocorp

Make sure that unverified user data can not reach vm.runInNewContext.

returntocorp

Make sure that unverified user data can not reach vm.Script.

returntocorp

Make sure that unverified user data can not reach vm.runInThisContext.

returntocorp

Make sure that unverified user data can not reach vm.compileFunction.

returntocorp

Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk.

returntocorp

Remote debugging protocol does not perform any authentication, so exposing it too widely can be a security risk.

returntocorp

Make sure that unverified user data can not reach `sandbox`.

returntocorp

If unverified user data can reach the `exec` method it can result in Remote Code Execution

returntocorp

Make sure that unverified user data can not reach `vm2`.

returntocorp

Make sure that unverified user data can not reach `vm2`.

returntocorp

Detected `express` being required and used, meaning this app uses the ExpressJS web framework.

returntocorp

Feature-Policy header is present. More information: https://helmetjs.github.io/docs/feature-policy/

returntocorp

X-Frame-Options header is present. More information: https://helmetjs.github.io/docs/frameguard/

returntocorp

X-DNS-Prefetch-Control header is present and DNS Prefetch Control is enabled. More information: https://helmetjs.github.io/docs/dns-prefetch-control/

returntocorp

Default X-Powered-By is removed or modified. More information: https://helmetjs.github.io/docs/hide-powered-by/

returntocorp

HSTS header is present. More information: https://helmetjs.github.io/docs/hsts/

returntocorp

X-Download-Options header is present. More information: https://helmetjs.github.io/docs/ienoopen/

returntocorp

Content-Type-Options header is present. More information: https://helmetjs.github.io/docs/dont-sniff-mimetype/

returntocorp

Referrer-Policy header is present. More information: https://helmetjs.github.io/docs/referrer-policy/

returntocorp

X-XSS-Protection header is present. More information: https://helmetjs.github.io/docs/xss-filter/

returntocorp

This application has API rate limiting controls.

returntocorp

Disabling context isolation can introduce Prototype Pollution vulnerabilities.

returntocorp

Make sure that unverified user data can not reach `$VM`.

returntocorp

Make sure that unverified user data can not reach `vm2`.

returntocorp

Experimental features are not expected to be in production ready applications.

returntocorp

Untrusted input concatinated with raw SQL query can result in SQL Injection.

returntocorp

`ref` usage found. refs give direct DOM access and may create a possibility for XSS, which could cause sensitive information such as user cookies to be retrieved by an attacker. Instead, avoid direct DOM manipulation or use DOMPurify to sanitize HTML before writing it into the page.

returntocorp

Make sure that unverified user data can not reach `sandbox`.

returntocorp

Detected user input used in bracket notation accessor. This could lead to object injection through $FIELD, which could grant access to every property available in the object and therefore sensitive information. Instead, avoid the use of user input in property name fields or create a whitelist of allowed input.

typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml

returntocorp

Detected setting HTML from code. This is risky because it’s easy to inadvertently expose your users to a cross-site scripting (XSS) attack. This can lead to attackers accessing sensitive information. Instead, do this without dangerouslySetInnerHTML or use DOMPurify to santize your HTML.

returntocorp

Error messages with stack traces can expose sensitive information about the application.

returntocorp

Error messages with stack traces may expose sensitive information about the application.

returntocorp

Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine.

returntocorp

This application has anti CSRF protection which prevents cross site request forgery attacks.

returntocorp

Content Security Policy header is present. More Information: https://helmetjs.github.io/docs/csp/

returntocorp

X-Permitted-Cross-Domain-Policies header set to off. More information: https://helmetjs.github.io/docs/crossdomain/

returntocorp

Expect-CT header is present. More information: https://helmetjs.github.io/docs/expect-ct/

returntocorp

A hardcoded secret is identified. Store it properly in an environment variable.

returntocorp

A hardcoded username in plain text is identified. Store it properly in an environment variable.

returntocorp

Application can load content over HTTP and that makes the app vulnerable to Man in the middle attacks.

returntocorp

Blink's experimental features are enabled in this application. Some of the features may affect the security of the application.

ajinabraham

MD5 is a a weak hash which is known to have collision. Use a strong hashing function.

ajinabraham

SHA1 is a a weak hash which is known to have collision. Use a strong hashing function.

ajinabraham

AES with ECB mode is deterministic in nature and not suitable for encrypting large amount of repetitive data.

ajinabraham

AES algorithms requires an initialization vector (IV). Providing no or null IV in some implementation results to a 0 IV. Use of a deterministic IV makes dictionary attacks easier.

ajinabraham

A weak or broken cryptographic algorithm was identified. Using these functions will introduce vulnerabilities or downgrade the security of your application.

ajinabraham

crypto.pseudoRandomBytes()/Math.random() is a cryptographically weak random number generator.

ajinabraham

String comparisons using '===', '!==', '!=' and '==' is vulnerable to timing attacks. More info: https://snyk.io/blog/node-js-timing-attack-ccc-ctf/

ajinabraham

Setting 'NODE_TLS_REJECT_UNAUTHORIZED' to 0 will allow node server to accept self signed certificates and is not a secure behaviour.

ajinabraham

SSL Certificate verification for node-curl is disabled.

ajinabraham

Untrusted user input in findOne() function can result in NoSQL Injection.

ajinabraham

Untrusted user input in MongoDB $where operator can result in NoSQL JavaScript Injection.

returntocorp

Node integration exposes node.js APIs to the electron app and this can introduce remote code execution vulnerabilities to the application if the app is vulnerable to Cross Site Scripting (XSS).

returntocorp

Hardcoded JWT secret or private key was found. Store it properly in an environment variable.

returntocorp

Hardcoded JWT secret was found. Store it properly in an environment variable.

ajinabraham

The Sequelize connection string indicates that database server does not use TLS. Non TLS connections are susceptible to man in the middle (MITM) attacks.

ajinabraham

The Sequelize connection string indicates that TLS certificate vailidation of database server is disabled. This is equivalent to not having TLS. An attacker can present any invalid certificate and Sequelize will make database connection ignoring certificate errors. This setting make the connection susceptible to man in the middle (MITM) attacks. Not applicable to SQLite database.

returntocorp

User controlled data is used for application business logic decision making. This expose protected data or functionality.

ajinabraham

The Sequelize connection string indicates that an older version of TLS is in use. TLS1.0 and TLS1.1 are deprecated and should be used. By default, Sequelize use TLSv1.2 but it's recommended to use TLS1.3. Not applicable to SQLite database.

ajinabraham

Untrusted input concatinated with raw SQL query can result in SQL Injection.

ajinabraham

Untrusted input concatinated with raw SQL query using knex raw() or whereRaw() functions can result in SQL Injection.

ajinabraham

POST Request to Express Body Parser 'bodyParser()' can create Temporary files and consume space.

ajinabraham

Layer7 Denial of Service. Looping over user controlled objects can result in DoS.

returntocorp

User controlled data in RegExp() can make the application vulnerable to layer 7 DoS.

returntocorp

Disabling webSecurity will disable the same-origin policy and allows the execution of insecure code from any domain.

ajinabraham

Ensure that the regex used to compare with user supplied input is safe from regular expression denial of service.

ajinabraham

User controlled data in RegExp() can make the application vulnerable to layer 7 DoS.

ajinabraham

Disabling webSecurity will disable the same-origin policy and allows the execution of insecure code from any domain.

ajinabraham

Application can load content over HTTP and that makes the app vulnerable to Man in the middle attacks.

ajinabraham

Blink's expirimental features are enabled in this application. Some of the features may affect the security of the application.

ajinabraham

Node integration exposes node.js APIs to the electron app and this can introduce remote code execution vulnerabilities to the application if the app is vulnerable to Cross Site Scripting (XSS).

ajinabraham

Disabling context isolation can introduce Prototype Pollution vulnerabilities.

ajinabraham

Experimental features are not expected to be in production ready applications.

returntocorp

String comparisons using '===', '!==', '!=' and '==' is vulnerable to timing attacks. More info: https://snyk.io/blog/node-js-timing-attack-ccc-ctf/

ajinabraham

User controlled data in 'unserialize()' or 'deserialize()' function can result in Object Injection or Remote Code Injection.

returntocorp

User controlled data in XML Parsers can result in XML Internal Entity Processing vulnerabilities like in DoS.

ajinabraham

User controlled data in 'unserialize()' or 'deserialize()' function can result in Object Injection or Remote Code Injection.

ajinabraham

Found an insecure gRPC connection. This creates a connection without encryption to a gRPC client/server. A malicious attacker could tamper with the gRPC message, which could compromise the machine.

ajinabraham

User controlled data in eval() or similar functions may result in Server Side Injection or Remote Code Injection

returntocorp

Markup escaping disabled. This can be used with some template engines to escape disabling of HTML entities, which can lead to XSS attacks.

ajinabraham

Untrusted user input in `require()` function allows an attacker to load arbitrary code.

returntocorp

Untrusted user input reaching `serialize-javascript` with `unsafe` attribute can cause Cross Site Scripting (XSS).

ajinabraham

Unrusted data in `sandbox` can result in code injection.

ajinabraham

Untrusted user input reaching `vm2` can result in code injection.

ajinabraham

Untrusted user input reaching `vm2` sandbox can result in context injection.

ajinabraham

Untrusted user input in `vm.runInContext()` can result in code injection.

ajinabraham

Untrusted user input in `vm.runInNewContext()` can result in code injection.

ajinabraham

Untrusted user input in `vm.compileFunction()` can result in code injection.

ajinabraham

Untrusted user input reaching `vm` can result in code injection.

ajinabraham.njsscan.eval_yaml_deserialize.yaml_deserialize

ajinabraham

User controlled data in 'yaml.load()' function can result in Remote Code Injection.

ajinabraham

Untrusted user input in templating engine's compile() function can result in Remote Code Execution via server side template injection.

ajinabraham

User controlled data in 'child_process.exec()' can result in Remote OS Command Execution.

ajinabraham

User controlled data in 'shelljs.exec()' can result in Remote OS Command Execution.

ajinabraham

Error messages with stack traces can expose sensitive information about the application.

ajinabraham

Error messages with stack traces may expose sensitive information about the application.

ajinabraham

Hardcoded plain text secret used for Passport Strategy. Store it properly in an environment variable.

ajinabraham

A hardcoded password in plain text is identified. Store it properly in an environment variable.

ajinabraham

A hardcoded username in plain text is identified. Store it properly in an environment variable.

ajinabraham

A hardcoded API Key is identified. Store it properly in an environment variable.

ajinabraham

A hardcoded secret is identified. Store it properly in an environment variable.

ajinabraham

User controlled data is used for application business logic decision making. This expose protected data or functionality.

ajinabraham

Consider changing the default session cookie name. An attacker can use it to fingerprint the server and target attacks accordingly.

ajinabraham

Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS.

ajinabraham

Default session middleware settings: `sameSite` attribute is not configured to strict or lax. These configurations provides protection against Cross Site Request Forgery attacks.

ajinabraham

Session middleware settings: `httpOnly` is explicitly set to false. It ensures that sensitive cookies cannot be accessed by client side JavaScript and helps to protect against cross-site scripting attacks.

ajinabraham

Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested. If they match, then check the path attribute next.

ajinabraham

Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request.

ajinabraham

Session middleware settings: `maxAge` not set. Use it to set expiration date for cookies.

ajinabraham

Access-Control-Allow-Origin response header is set to "*". This will disable CORS Same Origin Policy restrictions.

ajinabraham

Access-Control-Allow-Origin response header is set to "*". This will disable CORS Same Origin Policy restrictions.

ajinabraham

One or more Security Response header is explicitly disabled in Helmet.

ajinabraham

Untrusted user input in response header will result in HTTP Header Injection or Response Splitting Attacks.

ajinabraham

X-XSS-Protection header is set to 0. This will disable the browser's XSS Filter.

ajinabraham

X-XSS-Protection header is set to 0. This will disable the browser's XSS Filter.

ajinabraham

Using untrusted Host header for generating dynamic URLs can result in web cache and or password reset poisoning.

ajinabraham

Password is exposed through JWT token payload. This is not encrypted and the password could be compromised. Do not store passwords in JWT tokens.

ajinabraham

The object is passed strictly to jose.JWT.sign(...). Make sure that sensitive information is not exposed through JWT token payload.

ajinabraham

Hardcoded JWT secret or private key was found. Store it properly in an environment variable.

ajinabraham

Hardcoded JWT secret was found. Store it properly in an environment variable.

ajinabraham

Algorithm is set to none for JWT token. This can nullify the integrity of JWT signature.

ajinabraham

No token revoking configured for `express-jwt`. A leaked token could still be used and unable to be revoked. Consider using function as the `isRevoked` option.

ajinabraham

Detected usage of noassert in Buffer API, which allows the offset the be beyond the end of the buffer. This could result in writing or reading beyond the end of the buffer.

ajinabraham

Untrusted user input in redirect() can result in Open Redirect vulnerability.

ajinabraham

Untrusted user input in response header('Location') can result in Open Redirect vulnerability.

ajinabraham

User controlled URL in http client libraries can result in Server Side Request Forgery (SSRF).

ajinabraham

If unverified user data can reach the `phantom` methods it can result in Server-Side Request Forgery vulnerabilities.

ajinabraham

If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities.

ajinabraham

If unverified user data can reach the `puppeteer` methods it can result in Server-Side Request Forgery vulnerabilities.

ajinabraham

User controlled URL reached to `wkhtmltoimage` can result in Server Side Request Forgery (SSRF).

ajinabraham

User controlled URL reached to `wkhtmltopdf` can result in Server Side Request Forgery (SSRF).

ajinabraham

Insecure ZIP archive extraction can result in arbitrary path over write and can result in code injection.

ajinabraham

Insecure ZIP archive extraction can result in arbitrary path over write and can result in code injection.

ajinabraham

Insecure ZIP archive extraction using adm-zip can result in arbitrary path over write and can result in code injection.

ajinabraham

Insecure TAR archive extraction can result in arbitrary path over write and can result in code injection.

ajinabraham

Untrusted user input in express render() function can result in arbitrary file read when hbs templating is used.

ajinabraham

Untrusted user input in express render() function can result in arbitrary file read if hbs templating is used.

ajinabraham

Untrusted user input in readFile()/readFileSync() can endup in Directory Traversal Attacks.

ajinabraham

Path constructed with user input can result in Path Traversal. Ensure that user input does not reach `join()` or `resolve()`.

ajinabraham

User controlled data in XML Parsers can result in XML Internal Entity Processing vulnerabilities like in DoS.

ajinabraham

User controlled data in xpath.parse() can result in XPATH injection vulnerability.

ajinabraham

Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities.

ajinabraham

User controlled data in XML parsers can result in XML External or Internal Entity (XXE) Processing vulnerabilities

ajinabraham

Use of 'ondoctype' in 'sax' library detected. By default, 'sax' won't do anything with custom DTD entity definitions. If you're implementing a custom DTD entity definition, be sure not to introduce XML External Entity (XXE) vulnerabilities, or be absolutely sure that external entities received from a trusted source while processing XML.

ajinabraham

Make sure that unverified user data can not reach the XML Parser, as it can result in XML External or Internal Entity (XXE) Processing vulnerabilities.

ajinabraham

Markup escaping disabled. This can be used with some template engines to escape disabling of HTML entities, which can lead to XSS attacks.

ajinabraham

Untrusted User Input in Response will result in Reflected Cross Site Scripting Vulnerability.

ajinabraham

Untrusted user input reaching `serialize-javascript` with `unsafe` attribute can cause Cross Site Scripting (XSS).

ajinabraham

Handlebars SafeString will not escape the data passed through it. Untrusted user input passing through SafeString can cause XSS.

ajinabraham.njsscan.xss_templates.handlebars_noescape

ajinabraham

Disabling Escaping in Handlebars is not a secure behaviour. This can introduce XSS vulnerabilties.

ajinabraham.njsscan.xss_templates.squirrelly_autoescape

ajinabraham

Handlebars SafeString will not escape the data passed through it. Untrusted user input passing through SafeString can cause XSS.

returntocorp

This code contains bidirectional (bidi) characters. While this is useful for support of right-to-left languages such as Arabic or Hebrew, it can also be used to trick language parsers into executing code in a manner that is different from how it is displayed in code editing and review tools. If this is not what you were expecting, please review this code in an editor that can reveal hidden Unicode characters.

returntocorp

User controlled data in a HTML string may result in XSS

returntocorp

Bracket object notation with user input is present, this might allow an attacker to access all properties of the object and even it's prototype. Use literal values for object properties.

returntocorp

Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability.

returntocorp

User data flows into the host portion of this manually-constructed URL. This could allow an attacker to send data to their own server, potentially exposing sensitive data such as cookies or authorization information sent with this request. They could also probe internal servers or other resources that the server runnig this code can access. (This is called server-side request forgery, or SSRF.) Do not allow arbitrary hosts. Instead, create an allowlist for approved hosts hardcode the correct host.

returntocorp

Detected user input used to manually construct a SQL string. This is usually bad practice because manual construction could accidentally result in a SQL injection. An attacker could use a SQL injection to steal or modify contents of the database. Instead, use a parameterized query which is available by default in most database engines. Alternatively, consider using an object-relational mapper (ORM) such as Sequelize which will protect your queries.

returntocorp

User controlled data in eval() or similar functions may result in Code Injection

returntocorp

A variable is present in the filename argument of fs calls, this might allow an attacker to access anything on your system.

returntocorp

RegExp() called with a variable, this might allow an attacker to DOS your application with a long-running regular expression.

returntocorp

It looks like MD5 is used as a password hash. MD5 is not considered a secure password hash because it can be cracked by an attacker in a short amount of time. Use a suitable password hashing function such as bcrypt. You can use the `bcrypt` node.js package.

returntocorp

Possibility of prototype polluting assignment detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object.

returntocorp

Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object.

returntocorp

Possibility of prototype polluting function detected. By adding or modifying attributes of an object prototype, it is possible to create attributes that exist on every object, or replace critical attributes with malicious ones. This can be problematic if the software depends on existence or non-existence of certain attributes, or uses pre-defined attributes of object prototype (such as hasOwnProperty, toString or valueOf). Possible mitigations might be: freezing the object prototype, using an object without prototypes (via Object.create(null) ), blocking modifications of attributes that resolve to object prototype, using Map instead of object.

returntocorp

Detected string concatenation with a non-literal variable in a util.format / console.log function. If an attacker injects a format specifier in the string, it will forge the log message. Try to use constant values for the format string.

returntocorp

Depending on the context, user control data in `Object.assign` can cause web response to include data that it should not have or can lead to a mass assignment vulnerability.

returntocorp

If user input reaches `HoverProvider` while `supportHml` is set to `true` it may introduce an XSS vulnerability. Do not produce HTML for hovers with dynamically generated input.

returntocorp

Untrusted user input in response header will result in HTTP Header Injection or Response Splitting Attacks.

typescript.react.security.audit.react-http-leak.react-http-leak

returntocorp

This HTML element '$EL' and attribute '$ATTR' together may load an external resource. This means that if dynamic content can enter this attribute it may be possible for an attacker to send HTTP requests to unintended locations which may leak data about your users. If this element is reaching out to a known host, consider hardcoding the host (or loading from a configuration) and appending the dynamic path. See https://github.com/cure53/HTTPLeaks for more information.

returntocorp

Insecure ZIP archive extraction can result in arbitrary path over write and can result in code injection.

returntocorp

Insecure ZIP archive extraction can result in arbitrary path over write and can result in code injection.

returntocorp

Insecure ZIP archive extraction using adm-zip can result in arbitrary path over write and can result in code injection.

returntocorp

Insecure TAR archive extraction can result in arbitrary path over write and can result in code injection.

returntocorp

Detected usage of noassert in Buffer API, which allows the offset the be beyond the end of the buffer. This could result in writing or reading beyond the end of the buffer.

returntocorp

MD5 is a a weak hash which is known to have collision. Use a strong hashing function.

returntocorp

SHA1 is a a weak hash which is known to have collision. Use a strong hashing function.

returntocorp

AES with ECB mode is deterministic in nature and not suitable for encrypting large amount of repetitive data.

returntocorp

A weak or broken cryptographic algorithm was identified. Using these functions will introduce vulnerabilities or downgrade the security of your application.

returntocorp

crypto.pseudoRandomBytes()/Math.random() is a cryptographically weak random number generator.

returntocorp

User controlled data in 'unserialize()' or 'deserialize()' function can result in Object Injection or Remote Code Injection.

returntocorp

User controlled data in 'unserialize()' or 'deserialize()' function can result in Object Injection or Remote Code Injection.

returntocorp

User controlled data in eval() or similar functions may result in Server Side Injection or Remote Code Injection

returntocorp

Untrusted user input in `require()` function allows an attacker to load arbitrary code.

returntocorp

User controlled data in 'yaml.load()' function can result in Remote Code Injection.

returntocorp

User controlled data in 'child_process.exec()' can result in Remote OS Command Execution.

returntocorp

User controlled data in 'shelljs.exec()' can result in Remote OS Command Execution.

returntocorp

POST Request to Express Body Parser 'bodyParser()' can create Temporary files and consume space.

returntocorp

Hardcoded plain text secret used for Passport Strategy. Store it properly in an environment variable.

returntocorp

A hardcoded password in plain text is identified. Store it properly in an environment variable.

returntocorp

A hardcoded API Key is identified. Store it properly in an environment variable.

returntocorp

Consider changing the default session cookie name. An attacker can use it to fingerprint the server and target attacks accordingly.

returntocorp

Default session middleware settings: `secure` not set. It ensures the browser only sends the cookie over HTTPS.

returntocorp

Default session middleware settings: `sameSite` attribute is not configured to strict or lax. These configurations provides protection against Cross Site Request Forgery attacks.

returntocorp

Default session middleware settings: `httpOnly` not set. It ensures the sensitive cookies cannot be accessed by client side JavaScript and helps to protect against cross-site scripting attacks.

returntocorp

Default session middleware settings: `domain` not set. It indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested. If they match, then check the path attribute next.

returntocorp

Default session middleware settings: `path` not set. It indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request.

returntocorp

Default session middleware settings: `expires` not set. Use it to set expiration date for persistent cookies.

returntocorp

Access-Control-Allow-Origin response header is set to "*". This will disable CORS Same Origin Policy restrictions.