codelaw-rules-security-html 0.3.0__py3-none-any.whl

codelaw_rules_security_html/LICENSE

@@ -0,0 +1,23 @@
+MIT License
+
+Copyright (c) 2026 Arpit Arya
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+SPDX-License-Identifier: MIT

codelaw_rules_security_html/NOTICE

@@ -0,0 +1,9 @@
+@codelaw/rules-security-html · codelaw-rules-security-html
+
+Every rule in this pack is written for codelaw. The catalogue was read against
+the OWASP HTML5 Security, Content Security Policy and Cross-Site Request
+Forgery cheat sheets (CC BY-SA 4.0; ideas only, no text taken), MDN's
+Subresource Integrity page and CodeQL's query list (MIT; ideas only).
+Rule sets under a copyleft or source-available licence — eslint-plugin-no-unsanitized
+(MPL-2.0), njsscan (LGPL-3.0), Semgrep's rules (the Semgrep Rules License) — are
+read for ideas only; no text, pattern or code is taken from them (L2).

codelaw_rules_security_html/README.md

@@ -0,0 +1,98 @@
+# `@codelaw/rules-security-html` · `codelaw-rules-security-html`
+
+codelaw's HTML security rules (CSP, mixed content, iframes, forms, template sinks) — one of codelaw's first-party rule packs
+([SR-RULE-PACKS](../../records/0101_rule-packs.md)). The same files ship on npm as `@codelaw/rules-security-html` and on PyPI as
+`codelaw-rules-security-html`. Its presets **extend** `codelaw:html/security`,
+so the html pack's five security rules (`html/require-sri`,
+`html/target-blank-rel`, `html/no-inline-script`, `html/autocomplete-password`,
+`html/meta-refresh`) run without being copied here; it needs the html pack
+(`@codelaw/rules-html` or `codelaw-rules-html`) installed beside it.
+
+```toml
+# codelaw.toml
+extends = ["codelaw:html/recommended", "codelaw:sec-html/recommended"]
+preview = true   # every rule is `preview` until a corpus run promotes it
+```
+
+`codelaw init` does not add it: a security pack is chosen, not detected.
+
+## Presets
+
+<!-- docs-sync:presets -->
+
+| preset | rules | ported from |
+|---|---|---|
+| `sec-html/recommended` | 19 | extends `html/security` (the html pack's five security rules); high-confidence rules, at `error` |
+| `sec-html/strict` | 24 | `sec-html/recommended` and the heuristic rules, at `warn` |
+
+<!-- /docs-sync:presets -->
+
+`recommended` holds only high-confidence rules, at `error`; `strict` adds the
+heuristic ones, at `warn`, so a team can start without noise.
+
+## Rules
+
+| rule | flags | CWE | OWASP 2025 | fix | preset |
+|---|---|---|---|---|---|
+| `sec-html/no-inline-event-handler` | `onclick=`, `onerror=` … attributes (they block a strict CSP) | 79 | A05 | manual | `recommended` |
+| `sec-html/no-javascript-url` | `javascript:` in `href`, `src`, `action`, `formaction`, `xlink:href`, `<object data>` | 79 | A05 | manual | `recommended` |
+| `sec-html/no-mixed-content` | `http://` in `src`, `action`, a stylesheet/script `href`, a download link | 319 | A04 | suggest | `recommended` |
+| `sec-html/password-form-post` | a password form with `method=get`, no `method`, or an `http:` action | 598 | A04 | suggest | `recommended` |
+| `sec-html/iframe-sandbox` | `<iframe>` without `sandbox`, or `allow-scripts` with `allow-same-origin` | 1021 | A02 | suggest | `recommended` |
+| `sec-html/csp-meta-unsafe` | a meta CSP with `'unsafe-inline'`, `'unsafe-eval'`, `*` or `data:` in script sources | 693 | A02 | manual | `recommended` |
+| `sec-html/no-credentials-in-url` | `user:pass@host` in a URL attribute | 522 | A07 | manual | `recommended` |
+| `sec-html/no-template-html-sink` | Angular `[innerHTML]`, Vue `v-html`, Alpine `x-html` | 79 | A05 | manual | `recommended` |
+| `sec-html/referrer-policy` | `referrerpolicy` or `<meta name=referrer>` set to `unsafe-url` or `no-referrer-when-downgrade` | 200 | A02 | suggest | `recommended` |
+| `sec-html/no-srcdoc-script` | `<iframe srcdoc>` holding a script, handler or `javascript:` | 79 | A05 | manual | `recommended` |
+| `sec-html/sri-crossorigin` | `integrity` on a cross-origin file without `crossorigin` | 353 | A08 | suggest | `recommended` |
+| `sec-html/no-secret-in-hidden-input` | a hidden `password`/`token`/`secret`/`api-key` input with a literal value (CSRF tokens excluded) | 798, 200 | A07 | manual | `recommended` |
+| `sec-html/angularjs-url-expression` | `href="{{…}}"` / `src="{{…}}"` in an AngularJS page | 79 | A05 | suggest | `recommended` |
+| `sec-html/no-unsafe-template-interpolation` | Handlebars `{{{ }}}`, `|safe`, `{% autoescape off %}`, EJS `<%-` | 79 | A05 | manual | `recommended` |
+| `sec-html/no-external-base` | `<base href>` on another origin | — | A05 | manual | `strict` |
+| `sec-html/no-plugin-embed` | `<object>`, `<embed>`, `<applet>` | — | A02 | manual | `strict` |
+| `sec-html/no-sensitive-comments` | an HTML comment with a password, key, internal host or a note to remove | 615 | A02 | auto | `strict` |
+| `sec-html/form-csrf-token` | a `method=post` form with no CSRF field (extra names: `names` option) | 352 | A01 | manual | `strict` |
+| `sec-html/iframe-allow-powerful` | a cross-origin `<iframe allow="camera; microphone; …">` | 250 | A02 | manual | `strict` |
+
+Each rule is native (a Rust implementation in the engine, read with the same
+document model as the `html/*` rules) and is pattern-level: one start tag,
+one attribute, one comment or one run of template syntax. A value that is
+template code (`{{ }}`, `<% %>`) is judged by its literal prefix only, and
+the AngularJS rule runs only on a page that shows AngularJS. The catalogue
+and its sources are [W-56](../../archive/open/W-56-security-html-pack.md) and the
+OWASP HTML5, CSP and Cross-Site Request Forgery cheat sheets.
+
+`sec-html/no-inline-event-handler` and `sec-html/no-javascript-url` overlap
+`html/no-inline-script`, which the preset also turns on: a handler is
+reported twice, once with its CWE. Turn either off in `[rules]` if one report
+is enough.
+
+`suggest` fixes (`https://`, `method="post"`, `sandbox`, `crossorigin`,
+`referrerpolicy`) apply with `codelaw fix --unsafe`. A fix is not applied when
+it would add a finding the file did not have: under `strict`, turning a form
+to POST is refused while `sec-html/form-csrf-token` has nothing to see.
+
+Every rule here carries `security: { cwe, owasp, severity }`
+([SR-RULE-FORMAT](../../records/0112_rule-format.md) decision 2a), so
+
+- its finding names the CWE (`sec-html/<rule> (CWE-79) …`);
+- `codelaw rules --tag cwe:79` and `--tag owasp:A05` find it, and
+  `codelaw rules --security-coverage` puts it in the OWASP Top 10:2025 matrix;
+- SARIF carries its `security` and `external/cwe/cwe-<n>` tags and a
+  `security-severity` that GitHub code scanning ranks by
+  ([SR-CLI-MCP](../../records/0115_cli-and-mcp.md) decision 4).
+
+## `from_source:` is not taint analysis
+
+A rule here that asks whether a sink's argument comes from a request
+uses the `from_source:` predicate ([SR-RULE-FORMAT](../../records/0112_rule-format.md)
+decision 3a). It holds when the argument **is** a listed request source
+(or a method called on one), is built from one by concatenation,
+interpolation or `?:`, or is a local name bound to one **in the same
+function** — one or more assignments or destructurings away. It never
+follows a call, a return value, a parameter, a closure's outer variable or
+another file, so a value that crosses a function boundary is not seen
+(cross-function flow waits on a deeper analysis, as B-049's type-aware
+rules do). Every rule
+page that uses it says so. The sources are listed per framework in this
+pack's `data/sources/<framework>.json`.

codelaw_rules_security_html/codelaw-pack.toml

@@ -0,0 +1,6 @@
+name = "@codelaw/rules-security-html"
+version = "0.3.0"
+min_codelaw = "0.2.0"
+languages = ["html"]
+presets = ["sec-html/recommended", "sec-html/strict"]
+description = "codelaw's security rules for HTML; its presets also turn on the html pack's security rules (SR-RULE-PACKS)"

codelaw_rules_security_html/corpus.toml

@@ -0,0 +1,23 @@
+# `codelaw test --corpus` finding counts (SR-RULE-AUTHORING decision 4).
+# Rewrite with --update-snapshot, and review the change.
+
+[findings]
+"sec-html/angularjs-url-expression" = 0
+"sec-html/csp-meta-unsafe" = 0
+"sec-html/form-csrf-token" = 9
+"sec-html/iframe-allow-powerful" = 0
+"sec-html/iframe-sandbox" = 3
+"sec-html/no-credentials-in-url" = 0
+"sec-html/no-external-base" = 0
+"sec-html/no-inline-event-handler" = 1
+"sec-html/no-javascript-url" = 0
+"sec-html/no-mixed-content" = 0
+"sec-html/no-plugin-embed" = 0
+"sec-html/no-secret-in-hidden-input" = 0
+"sec-html/no-sensitive-comments" = 0
+"sec-html/no-srcdoc-script" = 0
+"sec-html/no-template-html-sink" = 0
+"sec-html/no-unsafe-template-interpolation" = 27
+"sec-html/password-form-post" = 0
+"sec-html/referrer-policy" = 0
+"sec-html/sri-crossorigin" = 0

codelaw_rules_security_html/presets/sec-html/recommended.toml

@@ -0,0 +1,18 @@
+description = "html/security and the high-confidence HTML security rules, at error"
+extends = ["codelaw:html/security"]
+
+[rules]
+"sec-html/angularjs-url-expression" = "error"
+"sec-html/csp-meta-unsafe" = "error"
+"sec-html/iframe-sandbox" = "error"
+"sec-html/no-credentials-in-url" = "error"
+"sec-html/no-inline-event-handler" = "error"
+"sec-html/no-javascript-url" = "error"
+"sec-html/no-mixed-content" = "error"
+"sec-html/no-secret-in-hidden-input" = "error"
+"sec-html/no-srcdoc-script" = "error"
+"sec-html/no-template-html-sink" = "error"
+"sec-html/no-unsafe-template-interpolation" = "error"
+"sec-html/password-form-post" = "error"
+"sec-html/referrer-policy" = "error"
+"sec-html/sri-crossorigin" = "error"

codelaw_rules_security_html/presets/sec-html/strict.toml

@@ -0,0 +1,9 @@
+description = "sec-html/recommended and the heuristic HTML security rules, at warn"
+extends = ["codelaw:sec-html/recommended"]
+
+[rules]
+"sec-html/form-csrf-token" = "warn"
+"sec-html/iframe-allow-powerful" = "warn"
+"sec-html/no-external-base" = "warn"
+"sec-html/no-plugin-embed" = "warn"
+"sec-html/no-sensitive-comments" = "warn"

codelaw_rules_security_html/rules/sec-html/angularjs-url-expression.cases.md

@@ -0,0 +1,26 @@
+# sec-html/angularjs-url-expression — cases
+
+### case: href and src
+
+```html
+<div ng-app><a href="{{url}}">a</a><img src="{{ p }}" alt=""></div>
+```
+
+```expect
+1:16 sec-html/angularjs-url-expression
+1:41 sec-html/angularjs-url-expression
+```
+
+```fixed
+<div ng-app><a ng-href="{{url}}">a</a><img ng-src="{{ p }}" alt=""></div>
+```
+
+### case: a Flask page is not AngularJS
+
+```html
+<a href="{{ url_for('x') }}">a</a>
+```
+
+```expect
+(none)
+```

codelaw_rules_security_html/rules/sec-html/angularjs-url-expression.md

@@ -0,0 +1,34 @@
+---
+id: sec-html/angularjs-url-expression
+title: "AngularJS URLs use ng-href and ng-src"
+languages: [html]
+fix: suggest
+fix_reason: "the expression's value should be checked too; the rename is only the first step"
+stability: preview
+security: { cwe: [79], owasp: ["A05:2025"], severity: medium }
+since: 0.2.0
+---
+
+In a page that uses AngularJS, `href="{{…}}"` and `src="{{…}}"` are written `ng-href` and `ng-src`.
+
+**Why:** The browser requests the literal `{{…}}` before AngularJS fills it in, and an unvetted expression in a URL is an injection point; the `ng-` forms are set only after interpolation.
+
+```codelaw
+native: sec-html/angularjs-url-expression
+```
+
+## Examples
+
+### HTML
+
+#### Don't
+
+```html
+<div ng-app><a href="{{ profileUrl }}">Profile</a></div>
+```
+
+#### Do
+
+```html
+<div ng-app><a ng-href="{{ profileUrl }}">Profile</a></div>
+```

codelaw_rules_security_html/rules/sec-html/csp-meta-unsafe.cases.md

@@ -0,0 +1,51 @@
+# sec-html/csp-meta-unsafe — cases
+
+### case: unsafe-inline and unsafe-eval
+
+```html
+<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline' 'unsafe-eval'">
+```
+
+```expect
+1:44 sec-html/csp-meta-unsafe
+```
+
+### case: default-src applies when there is no script-src
+
+```html
+<meta http-equiv="content-security-policy" content="default-src *">
+```
+
+```expect
+1:44 sec-html/csp-meta-unsafe
+```
+
+### case: data: as a script source
+
+```html
+<meta http-equiv="Content-Security-Policy" content="script-src 'self' data:">
+```
+
+```expect
+1:44 sec-html/csp-meta-unsafe
+```
+
+### case: unsafe-inline in style-src is another rule
+
+```html
+<meta http-equiv="Content-Security-Policy" content="script-src 'self'; style-src 'unsafe-inline'">
+```
+
+```expect
+(none)
+```
+
+### case: a nonce makes the browser ignore unsafe-inline
+
+```html
+<meta http-equiv="Content-Security-Policy" content="script-src 'nonce-abc' 'unsafe-inline'">
+```
+
+```expect
+(none)
+```

codelaw_rules_security_html/rules/sec-html/csp-meta-unsafe.md

@@ -0,0 +1,40 @@
+---
+id: sec-html/csp-meta-unsafe
+title: "A meta Content Security Policy does not allow unsafe script"
+languages: [html]
+fix: manual
+fix_reason: "the page's scripts have to be given nonces or hashes, or moved to files"
+stability: preview
+security: { cwe: [693], owasp: ["A02:2025"], severity: medium }
+since: 0.2.0
+---
+
+A `<meta http-equiv="Content-Security-Policy">` does not allow `'unsafe-inline'`, `'unsafe-eval'`, `*` or `data:` as a script source.
+
+**Why:** Each of them lets injected script run, which is what the policy exists to stop.
+
+```codelaw
+native: sec-html/csp-meta-unsafe
+```
+
+## How to fix
+
+1. Move inline script into files, or give it a nonce or a hash (`'nonce-…'`, `'sha256-…'`).
+2. Remove `'unsafe-eval'` and replace `eval`, `new Function` and string timers.
+3. List the origins scripts load from instead of `*` or `data:`.
+
+## Examples
+
+### HTML
+
+#### Don't
+
+```html
+<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'">
+```
+
+#### Do
+
+```html
+<meta http-equiv="Content-Security-Policy" content="script-src 'self' 'nonce-r4nd0m'">
+```

codelaw_rules_security_html/rules/sec-html/form-csrf-token.cases.md

@@ -0,0 +1,51 @@
+# sec-html/form-csrf-token — cases
+
+### case: no token
+
+```html
+<form method="post" action="/a"><input name="x"></form>
+```
+
+```expect
+1:1 sec-html/form-csrf-token
+```
+
+### case: a hidden field
+
+```html
+<form method="post"><input type="hidden" name="csrfmiddlewaretoken" value="x"></form>
+```
+
+```expect
+(none)
+```
+
+### case: a template tag that writes the field
+
+```html
+<form method="post">{% csrf_token %}</form>
+```
+
+```expect
+(none)
+```
+
+### case: a form that posts to another site
+
+```html
+<form method="post" action="https://pay.example/"><input name="x"></form>
+```
+
+```expect
+(none)
+```
+
+### case: GET needs none
+
+```html
+<form method="get"><input name="q"></form>
+```
+
+```expect
+(none)
+```

codelaw_rules_security_html/rules/sec-html/form-csrf-token.md

@@ -0,0 +1,41 @@
+---
+id: sec-html/form-csrf-token
+title: "A POST form carries a CSRF token"
+languages: [html]
+fix: manual
+fix_reason: "which token the server checks depends on its framework"
+stability: preview
+options:
+  names: { type: "string[]", default: [], description: "extra names (field names or template tags) that count as a CSRF token, besides csrf, xsrf, authenticity_token, antiforgery, csrfmiddlewaretoken, __requestverificationtoken and _token" }
+security: { cwe: [352], owasp: ["A01:2025"], severity: medium }
+since: 0.2.0
+---
+
+A `<form method="post">` has a hidden anti-forgery field, or a template tag that writes one.
+
+**Why:** Without a token another site can submit the form with the signed-in user's cookies.
+
+```codelaw
+native: sec-html/form-csrf-token
+```
+
+## How to fix
+
+1. Add the framework's field: `{% csrf_token %}` (Django), `@csrf` (Laravel), `<%= csrf_meta_tags %>` / `authenticity_token` (Rails), `{{ form.hidden_tag() }}` (Flask-WTF), or a hidden `_csrf` input.
+2. If the form posts to another site, ignore it with `exceptions`.
+
+## Examples
+
+### HTML
+
+#### Don't
+
+```html
+<form method="post" action="/transfer"><input name="to"></form>
+```
+
+#### Do
+
+```html
+<form method="post" action="/transfer"><input type="hidden" name="csrf_token" value="{{ csrf_token }}"><input name="to"></form>
+```

codelaw_rules_security_html/rules/sec-html/iframe-allow-powerful.cases.md

@@ -0,0 +1,31 @@
+# sec-html/iframe-allow-powerful — cases
+
+### case: camera and microphone
+
+```html
+<iframe src="https://a.example/e" allow="camera; microphone; fullscreen"></iframe>
+```
+
+```expect
+1:35 sec-html/iframe-allow-powerful
+```
+
+### case: withheld with none
+
+```html
+<iframe src="https://a.example/e" allow="camera 'none'"></iframe>
+```
+
+```expect
+(none)
+```
+
+### case: same origin
+
+```html
+<iframe src="/e" allow="camera"></iframe>
+```
+
+```expect
+(none)
+```

codelaw_rules_security_html/rules/sec-html/iframe-allow-powerful.md

@@ -0,0 +1,39 @@
+---
+id: sec-html/iframe-allow-powerful
+title: "A cross-origin iframe is not given a powerful feature"
+languages: [html]
+fix: manual
+fix_reason: "which framed sites deserve the permission is the owner's decision"
+stability: preview
+security: { cwe: [250], owasp: ["A02:2025"], severity: low }
+since: 0.2.0
+---
+
+An `<iframe>` whose `src` is on another origin does not list `camera`, `microphone`, `geolocation`, `payment` or another powerful feature in `allow`.
+
+**Why:** The framed site gets the permission prompt, with the page's name on it, and whatever that site serves later inherits the grant.
+
+```codelaw
+native: sec-html/iframe-allow-powerful
+```
+
+## How to fix
+
+1. Drop the feature from `allow`.
+2. Or limit it to the origin that needs it: `allow="camera https://meet.example.com"`, and keep `'none'` for the rest.
+
+## Examples
+
+### HTML
+
+#### Don't
+
+```html
+<iframe src="https://meet.example.com/room" allow="camera; microphone"></iframe>
+```
+
+#### Do
+
+```html
+<iframe src="https://meet.example.com/room" allow="fullscreen"></iframe>
+```

codelaw_rules_security_html/rules/sec-html/iframe-sandbox.cases.md

@@ -0,0 +1,63 @@
+# sec-html/iframe-sandbox — cases
+
+### case: no sandbox
+
+```html
+<iframe src="/a"></iframe>
+```
+
+```expect
+1:1 sec-html/iframe-sandbox
+```
+
+```fixed
+<iframe sandbox src="/a"></iframe>
+```
+
+### case: a sandbox with other tokens is fine
+
+```html
+<iframe sandbox="allow-forms" src="/a"></iframe>
+```
+
+```expect
+(none)
+```
+
+### case: scripts and the same origin together
+
+```html
+<iframe sandbox="allow-scripts allow-same-origin" src="/a"></iframe>
+```
+
+```expect
+1:9 sec-html/iframe-sandbox
+```
+
+```fixed
+<iframe sandbox="allow-scripts" src="/a"></iframe>
+```
+
+### case: the same origin token first
+
+```html
+<iframe sandbox="allow-same-origin allow-scripts"></iframe>
+```
+
+```expect
+1:9 sec-html/iframe-sandbox
+```
+
+```fixed
+<iframe sandbox="allow-scripts"></iframe>
+```
+
+### case: a templated sandbox is not judged
+
+```html
+<iframe sandbox="{{ tokens }}" src="/a"></iframe>
+```
+
+```expect
+(none)
+```

codelaw_rules_security_html/rules/sec-html/iframe-sandbox.md

@@ -0,0 +1,34 @@
+---
+id: sec-html/iframe-sandbox
+title: "An iframe is sandboxed"
+languages: [html]
+fix: suggest
+fix_reason: "the framed page may need `allow-*` tokens, which only its author knows"
+stability: preview
+security: { cwe: [1021], owasp: ["A02:2025"], severity: medium }
+since: 0.2.0
+---
+
+An `<iframe>` has a `sandbox` attribute, and one that allows scripts does not also allow the same origin.
+
+**Why:** A framed page without `sandbox` runs with every power a top-level page has; `allow-scripts` with `allow-same-origin` lets it remove its own sandbox.
+
+```codelaw
+native: sec-html/iframe-sandbox
+```
+
+## Examples
+
+### HTML
+
+#### Don't
+
+```html
+<iframe src="/widget"></iframe>
+```
+
+#### Do
+
+```html
+<iframe sandbox src="/widget"></iframe>
+```

codelaw_rules_security_html/rules/sec-html/no-credentials-in-url.cases.md

@@ -0,0 +1,21 @@
+# sec-html/no-credentials-in-url — cases
+
+### case: a username alone is not a secret
+
+```html
+<a href="https://user@host.example/">a</a>
+```
+
+```expect
+(none)
+```
+
+### case: a protocol-relative image URL
+
+```html
+<img src="//u:p@h.example/a.png" alt="">
+```
+
+```expect
+1:6 sec-html/no-credentials-in-url
+```

codelaw_rules_security_html/rules/sec-html/no-credentials-in-url.md

@@ -0,0 +1,39 @@
+---
+id: sec-html/no-credentials-in-url
+title: "No username and password in a URL"
+languages: [html]
+fix: manual
+fix_reason: "where the credential should live is the author's decision"
+stability: preview
+security: { cwe: [522], owasp: ["A07:2025"], severity: high }
+since: 0.2.0
+---
+
+A URL attribute does not carry `user:password@` in front of its host.
+
+**Why:** A URL is stored in history, logs, referrers and bookmarks, so a credential written into one is disclosed to all of them.
+
+```codelaw
+native: sec-html/no-credentials-in-url
+```
+
+## How to fix
+
+1. Remove the credentials from the URL.
+2. Send them in an `Authorization` header, or keep the request on the server.
+
+## Examples
+
+### HTML
+
+#### Don't
+
+```html
+<a href="https://admin:hunter2@intranet.example.com/">Admin</a>
+```
+
+#### Do
+
+```html
+<a href="https://intranet.example.com/">Admin</a>
+```