mobbdev 0.0.170 → 0.0.171

package/dist/index.mjs

@@ -122,6 +122,7 @@ var IssueType_Enum = /* @__PURE__ */ ((IssueType_Enum2) => {
   IssueType_Enum2["ErroneousStringCompare"] = "ERRONEOUS_STRING_COMPARE";
   IssueType_Enum2["ErrorCondtionWithoutAction"] = "ERROR_CONDTION_WITHOUT_ACTION";
   IssueType_Enum2["GraphqlDepthLimit"] = "GRAPHQL_DEPTH_LIMIT";
+  IssueType_Enum2["HardcodedDomainInHtml"] = "HARDCODED_DOMAIN_IN_HTML";
   IssueType_Enum2["HardcodedSecrets"] = "HARDCODED_SECRETS";
   IssueType_Enum2["HeaderManipulation"] = "HEADER_MANIPULATION";
   IssueType_Enum2["HtmlCommentInJsp"] = "HTML_COMMENT_IN_JSP";
@@ -144,6 +145,7 @@ var IssueType_Enum = /* @__PURE__ */ ((IssueType_Enum2) => {
   IssueType_Enum2["LogForging"] = "LOG_FORGING";
   IssueType_Enum2["MissingAntiforgeryValidation"] = "MISSING_ANTIFORGERY_VALIDATION";
   IssueType_Enum2["MissingCheckAgainstNull"] = "MISSING_CHECK_AGAINST_NULL";
+  IssueType_Enum2["MissingCspHeader"] = "MISSING_CSP_HEADER";
   IssueType_Enum2["MissingEqualsOrHashcode"] = "MISSING_EQUALS_OR_HASHCODE";
   IssueType_Enum2["MissingHstsHeader"] = "MISSING_HSTS_HEADER";
   IssueType_Enum2["NonFinalPublicStaticField"] = "NON_FINAL_PUBLIC_STATIC_FIELD";
@@ -1539,7 +1541,9 @@ var fixDetailsData = {
   ["NO_LIMITS_OR_THROTTLING" /* NoLimitsOrThrottling */]: {
     issueDescription: "The lack of a rate limit can allow denial-of-service attacks, in which an attacker can cause the application to crash or become unresponsive by issuing a large number of requests simultaneously.",
     fixInstructions: "Use express-rate-limit npm package to set a rate limit."
-  }
+  },
+  ["MISSING_CSP_HEADER" /* MissingCspHeader */]: void 0,
+  ["HARDCODED_DOMAIN_IN_HTML" /* HardcodedDomainInHtml */]: void 0
 };
 
 // src/features/analysis/scm/shared/src/getIssueType.ts
@@ -1615,7 +1619,9 @@ var issueTypeMap = {
   ["POOR_ERROR_HANDLING_EMPTY_CATCH_BLOCK" /* PoorErrorHandlingEmptyCatchBlock */]: "Poor Error Handling: Empty Catch Block",
   ["ERRONEOUS_STRING_COMPARE" /* ErroneousStringCompare */]: "Erroneous String Compare",
   ["UNVALIDATED_PUBLIC_METHOD_ARGUMENT" /* UnvalidatedPublicMethodArgument */]: "Unvalidated Public Method Argument",
-  ["AUTO_ESCAPE_FALSE" /* AutoEscapeFalse */]: "Auto-escape False"
+  ["AUTO_ESCAPE_FALSE" /* AutoEscapeFalse */]: "Auto-escape False",
+  ["MISSING_CSP_HEADER" /* MissingCspHeader */]: "Missing CSP Header",
+  ["HARDCODED_DOMAIN_IN_HTML" /* HardcodedDomainInHtml */]: "Hardcoded Domain in HTML"
 };
 var issueTypeZ = z4.nativeEnum(IssueType_Enum);
 var getIssueTypeFriendlyString = (issueType) => {
@@ -2613,6 +2619,15 @@ Make sure to pick a value large enough to allowed the nessecary amount of nested
   }
 };
 
+// src/features/analysis/scm/shared/src/storedQuestionData/js/hardcodedDomainInHtml.ts
+var hardcodedDomainInHtml = {
+  isCDNFixedVersion: {
+    content: ({ url }) => `Does the content of \`${url}\` change over time? If it does, we can't offer this fix.`,
+    description: () => "You need to make sure the content of the file you are loading from the external source is persistent. To guarantee the integrity hash does not change over time, please make sure you use a proper CDN and version of the script you are loading is pinned.",
+    guidance: () => ""
+  }
+};
+
 // src/features/analysis/scm/shared/src/storedQuestionData/js/hardcodedSecrets.ts
 var hardcodedSecrets2 = {
   envVarName: {
@@ -2679,6 +2694,43 @@ var logForging3 = {
   }
 };
 
+// src/features/analysis/scm/shared/src/storedQuestionData/js/missingCSPHeader.ts
+var cspHeaderValue = {
+  cspHeaderValue: {
+    content: () => "Please provide the value for the Content-Security-Policy header",
+    description: () => `The Content-Security-Policy (CSP) header is a critical security measure that helps protect websites from various attacks, particularly Cross-Site Scripting (XSS) and other code injection attacks. Here's a concise explanation:
+    
+     
+ 
+    **What it does**:
+    
+     
+ 
+    CSP lets you specify which content sources the browser should consider valid, essentially creating a whitelist of trusted content. It controls things like:
+    
+     
+ 
+    - Which scripts can execute.    
+     - Where images can be loaded from.    
+     - Which styles can be applied.    
+     - Which forms can be submitted to.    
+     - What domains can be connected to.    
+     
+     Default value explanation:    
+     
+     - default-src 'self: Only allows resources from the same origin by default.    
+     - script-src 'self': Only allows scripts to be loaded from the same origin.    
+     - style-src 'self': Only allows styles from the same origin.    
+&nbsp;    - object-src 'none': Disallows <object>, <embed>, and <applet> elements.    
+&nbsp;    - base-uri 'self': Restricts where the <base> tag can point to.    
+&nbsp;    - frame-ancestors 'self': Ensures that only the same origin can embed the page using an iframe.
+    
+&nbsp;    
+&nbsp;    **This kind of \`CSP\` is more secure but may require adjustments for your specific application, especially if you need to load resources from external domains or use inline scripts/styles.**`,
+    guidance: () => ``
+  }
+};
+
 // src/features/analysis/scm/shared/src/storedQuestionData/js/missingHSTSHeader.ts
 var headerMaxAge = {
   headerMaxAge: {
@@ -2833,7 +2885,9 @@ var vulnerabilities9 = {
   ["HARDCODED_SECRETS" /* HardcodedSecrets */]: hardcodedSecrets2,
   ["MISSING_HSTS_HEADER" /* MissingHstsHeader */]: headerMaxAge,
   ["UNCHECKED_LOOP_CONDITION" /* UncheckedLoopCondition */]: uncheckedLoopCondition2,
-  ["NO_LIMITS_OR_THROTTLING" /* NoLimitsOrThrottling */]: noLimitsOrThrottling2
+  ["NO_LIMITS_OR_THROTTLING" /* NoLimitsOrThrottling */]: noLimitsOrThrottling2,
+  ["MISSING_CSP_HEADER" /* MissingCspHeader */]: cspHeaderValue,
+  ["HARDCODED_DOMAIN_IN_HTML" /* HardcodedDomainInHtml */]: hardcodedDomainInHtml
 };
 var js_default = vulnerabilities9;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mobbdev",
-  "version": "0.0.170",
+  "version": "0.0.171",
   "description": "Automated secure code remediation tool",
   "repository": "git+https://github.com/mobb-dev/bugsy.git",
   "main": "dist/index.js",