codelaw-rules-security-html 0.3.0__py3-none-any.whl

codelaw_rules_security_html/rules/sec-html/no-external-base.cases.md

@@ -0,0 +1,21 @@
+# sec-html/no-external-base — cases
+
+### case: a protocol-relative base
+
+```html
+<base href="//cdn.example.com/">
+```
+
+```expect
+1:7 sec-html/no-external-base
+```
+
+### case: a path
+
+```html
+<base href="/app/" target="_self">
+```
+
+```expect
+(none)
+```

codelaw_rules_security_html/rules/sec-html/no-external-base.md

@@ -0,0 +1,39 @@
+---
+id: sec-html/no-external-base
+title: "<base> stays on this origin"
+languages: [html]
+fix: manual
+fix_reason: "which origin the page may use is a decision for its owner"
+stability: preview
+security: { owasp: ["A05:2025"], severity: medium }
+since: 0.2.0
+---
+
+A `<base href>` is a path, not a URL on another origin.
+
+**Why:** Every relative URL, form action and script on the page resolves against `<base>`, so one that points elsewhere hands them all to that site.
+
+```codelaw
+native: sec-html/no-external-base
+```
+
+## How to fix
+
+1. Delete the `<base>` and write the URLs you need in full.
+2. Or make its `href` a path on this origin, such as `/app/`.
+
+## Examples
+
+### HTML
+
+#### Don't
+
+```html
+<base href="https://cdn.example.com/app/">
+```
+
+#### Do
+
+```html
+<base href="/app/">
+```

codelaw_rules_security_html/rules/sec-html/no-inline-event-handler.cases.md

@@ -0,0 +1,32 @@
+# sec-html/no-inline-event-handler — cases
+
+### case: two handlers on one element
+
+```html
+<button onclick="a()" onfocus="b()">x</button>
+```
+
+```expect
+1:9 sec-html/no-inline-event-handler
+1:23 sec-html/no-inline-event-handler
+```
+
+### case: framework bindings and data attributes are not handlers
+
+```html
+<button data-onclick="a" (click)="b" @click="c" onboarding="d">x</button>
+```
+
+```expect
+(none)
+```
+
+### case: an image error handler
+
+```html
+<img src="a.png" alt="" onerror="fallback(this)">
+```
+
+```expect
+1:25 sec-html/no-inline-event-handler
+```

codelaw_rules_security_html/rules/sec-html/no-inline-event-handler.md

@@ -0,0 +1,40 @@
+---
+id: sec-html/no-inline-event-handler
+title: "No inline event handlers"
+languages: [html]
+fix: manual
+fix_reason: "the handler's code has to move into a script that attaches it"
+stability: preview
+security: { cwe: [79], owasp: ["A05:2025"], severity: medium }
+since: 0.2.0
+---
+
+No element has an inline event handler (`onclick`, `onerror`, `onload`, …).
+
+**Why:** An inline handler runs script from an attribute, so a strict Content Security Policy that blocks inline script blocks it too, and a value interpolated into it becomes cross-site scripting.
+
+```codelaw
+native: sec-html/no-inline-event-handler
+```
+
+## How to fix
+
+1. Give the element an id or a class.
+2. Attach the listener with `addEventListener` in a script file.
+3. Delete the `on…` attribute.
+
+## Examples
+
+### HTML
+
+#### Don't
+
+```html
+<button type="button" onclick="save()">Save</button>
+```
+
+#### Do
+
+```html
+<button type="button" id="save">Save</button>
+```

codelaw_rules_security_html/rules/sec-html/no-javascript-url.cases.md

@@ -0,0 +1,61 @@
+# sec-html/no-javascript-url — cases
+
+### case: case and leading space do not hide it
+
+```html
+<a href=" JavaScript:alert(1)">a</a>
+```
+
+```expect
+1:4 sec-html/no-javascript-url
+```
+
+### case: a tab inside the scheme is still javascript:
+
+```html
+<a href="java	script:alert(1)">a</a>
+```
+
+```expect
+1:4 sec-html/no-javascript-url
+```
+
+### case: formaction
+
+```html
+<button formaction="javascript:go()">a</button>
+```
+
+```expect
+1:9 sec-html/no-javascript-url
+```
+
+### case: object data
+
+```html
+<object data="javascript:go()"></object>
+```
+
+```expect
+1:9 sec-html/no-javascript-url
+```
+
+### case: data on another element is not a URL
+
+```html
+<div data="javascript:go()">a</div>
+```
+
+```expect
+(none)
+```
+
+### case: an ordinary link
+
+```html
+<a href="/javascript:">a</a>
+```
+
+```expect
+(none)
+```

codelaw_rules_security_html/rules/sec-html/no-javascript-url.md

@@ -0,0 +1,39 @@
+---
+id: sec-html/no-javascript-url
+title: "No javascript: URLs"
+languages: [html]
+fix: manual
+fix_reason: "the script has to move out of the URL into a listener or a real link"
+stability: preview
+security: { cwe: [79], owasp: ["A05:2025"], severity: high }
+since: 0.2.0
+---
+
+An `href`, `src`, `action`, `formaction`, `xlink:href` or `<object data>` is never a `javascript:` URL.
+
+**Why:** A `javascript:` URL runs script from an attribute, so it is cross-site scripting waiting for one interpolated value, and a strict Content Security Policy blocks it.
+
+```codelaw
+native: sec-html/no-javascript-url
+```
+
+## How to fix
+
+1. Replace a `javascript:` link with a `<button type="button">` and attach the listener with `addEventListener`.
+2. Point `href`, `src`, `action` or `formaction` at a real URL.
+
+## Examples
+
+### HTML
+
+#### Don't
+
+```html
+<a href="javascript:void(0)">Menu</a>
+```
+
+#### Do
+
+```html
+<button type="button" id="menu">Menu</button>
+```

codelaw_rules_security_html/rules/sec-html/no-mixed-content.cases.md

@@ -0,0 +1,79 @@
+# sec-html/no-mixed-content — cases
+
+### case: loopback is trusted
+
+```html
+<img src="http://localhost:3000/a.png" alt="">
+```
+
+```expect
+(none)
+```
+
+### case: a stylesheet link is fixed
+
+```html
+<link rel="stylesheet" href="http://a.example/s.css">
+```
+
+```expect
+1:24 sec-html/no-mixed-content
+```
+
+```fixed
+<link rel="stylesheet" href="https://a.example/s.css">
+```
+
+### case: a canonical link is only a pointer
+
+```html
+<link rel="canonical" href="http://a.example/">
+```
+
+```expect
+(none)
+```
+
+### case: a plain link is navigation, a download is not
+
+```html
+<a href="http://a.example/x">a</a>
+<a href="http://a.example/x.pdf" download>b</a>
+```
+
+```expect
+2:4 sec-html/no-mixed-content
+```
+
+```fixed
+<a href="http://a.example/x">a</a>
+<a href="https://a.example/x.pdf" download>b</a>
+```
+
+### case: a form action
+
+```html
+<form action="http://a.example/p"></form>
+```
+
+```expect
+1:7 sec-html/no-mixed-content
+```
+
+```fixed
+<form action="https://a.example/p"></form>
+```
+
+### case: the scheme is read in any case
+
+```html
+<img src="HTTP://a.example/p.png" alt="">
+```
+
+```expect
+1:6 sec-html/no-mixed-content
+```
+
+```fixed
+<img src="https://a.example/p.png" alt="">
+```

codelaw_rules_security_html/rules/sec-html/no-mixed-content.md

@@ -0,0 +1,34 @@
+---
+id: sec-html/no-mixed-content
+title: "Subresources and forms load over HTTPS"
+languages: [html]
+fix: suggest
+fix_reason: "the host may not serve HTTPS; check that it does before switching"
+stability: preview
+security: { cwe: [319], owasp: ["A04:2025"], severity: medium }
+since: 0.2.0
+---
+
+A `src`, a form `action`, a stylesheet or script `href` and a download link never use `http://`.
+
+**Why:** A resource fetched over plain HTTP can be read and changed by anyone on the network, and a browser blocks or warns about it on an HTTPS page.
+
+```codelaw
+native: sec-html/no-mixed-content
+```
+
+## Examples
+
+### HTML
+
+#### Don't
+
+```html
+<script src="http://cdn.example.com/lib.js"></script>
+```
+
+#### Do
+
+```html
+<script src="https://cdn.example.com/lib.js"></script>
+```

codelaw_rules_security_html/rules/sec-html/no-plugin-embed.cases.md

@@ -0,0 +1,25 @@
+# sec-html/no-plugin-embed — cases
+
+### case: object, embed and applet
+
+```html
+<object data="a.swf"></object>
+<embed src="a.swf">
+<applet code="A"></applet>
+```
+
+```expect
+1:1 sec-html/no-plugin-embed
+2:1 sec-html/no-plugin-embed
+3:1 sec-html/no-plugin-embed
+```
+
+### case: an object that holds an image
+
+```html
+<object type="image/svg+xml" data="a.svg"></object>
+```
+
+```expect
+(none)
+```

codelaw_rules_security_html/rules/sec-html/no-plugin-embed.md

@@ -0,0 +1,40 @@
+---
+id: sec-html/no-plugin-embed
+title: "No <object>, <embed> or <applet>"
+languages: [html]
+fix: manual
+fix_reason: "what replaces the plugin depends on what it showed"
+stability: preview
+security: { owasp: ["A02:2025"], severity: low }
+since: 0.2.0
+---
+
+The page does not use `<object>`, `<embed>` or `<applet>` (an `<object>` that holds an image is fine).
+
+**Why:** They load a plugin or another document with the page's trust, and the plugins that needed them are gone from browsers.
+
+```codelaw
+native: sec-html/no-plugin-embed
+```
+
+## How to fix
+
+1. Use `<img>`, `<video>` or `<audio>` for media.
+2. Use a sandboxed `<iframe>` for another document.
+3. Use `<a download>` for a file to fetch.
+
+## Examples
+
+### HTML
+
+#### Don't
+
+```html
+<embed src="movie.swf">
+```
+
+#### Do
+
+```html
+<video src="movie.mp4" controls></video>
+```

codelaw_rules_security_html/rules/sec-html/no-secret-in-hidden-input.cases.md

@@ -0,0 +1,31 @@
+# sec-html/no-secret-in-hidden-input — cases
+
+### case: a literal key
+
+```html
+<input type="hidden" name="api_key" value="sk_live_1">
+```
+
+```expect
+1:37 sec-html/no-secret-in-hidden-input
+```
+
+### case: csrf tokens are fine
+
+```html
+<input type="hidden" name="csrf_token" value="abc"><input type="hidden" name="_token" value="abc">
+```
+
+```expect
+(none)
+```
+
+### case: a value filled in at render time or empty
+
+```html
+<input type="hidden" name="api_key" value="{{ key }}"><input type="hidden" name="api_key" value="">
+```
+
+```expect
+(none)
+```

codelaw_rules_security_html/rules/sec-html/no-secret-in-hidden-input.md

@@ -0,0 +1,39 @@
+---
+id: sec-html/no-secret-in-hidden-input
+title: "No secret in a hidden input"
+languages: [html]
+fix: manual
+fix_reason: "where the secret should live is a design decision"
+stability: preview
+security: { cwe: [798, 200], owasp: ["A07:2025"], severity: high }
+since: 0.2.0
+---
+
+A hidden input named like a password, token, secret or API key does not hold a literal value (CSRF tokens are excluded).
+
+**Why:** A hidden field is part of the page everyone receives, so a secret written into it is disclosed to every visitor.
+
+```codelaw
+native: sec-html/no-secret-in-hidden-input
+```
+
+## How to fix
+
+1. Keep the secret on the server and send a session or a reference instead.
+2. If the field is an anti-forgery token, name it `csrf_token`, `_csrf` or the framework's own name.
+
+## Examples
+
+### HTML
+
+#### Don't
+
+```html
+<input type="hidden" name="api_key" value="sk_live_51Habc">
+```
+
+#### Do
+
+```html
+<input type="hidden" name="csrf_token" value="{{ csrf_token }}">
+```

codelaw_rules_security_html/rules/sec-html/no-sensitive-comments.cases.md

@@ -0,0 +1,64 @@
+# sec-html/no-sensitive-comments — cases
+
+### case: a comment on its own line goes with the line
+
+```html
+<p>a</p>
+  <!-- password: hunter2 -->
+<p>b</p>
+
+```
+
+```expect
+2:3 sec-html/no-sensitive-comments
+```
+
+```fixed
+<p>a</p>
+<p>b</p>
+
+```
+
+### case: a comment after other markup
+
+```html
+<p>a</p><!-- TODO remove this -->
+```
+
+```expect
+1:9 sec-html/no-sensitive-comments
+```
+
+```fixed
+<p>a</p>
+```
+
+### case: a private address
+
+```html
+<!-- the API is at 10.0.3.7 -->
+```
+
+```expect
+1:1 sec-html/no-sensitive-comments
+```
+
+### case: an ordinary comment
+
+```html
+<!-- navigation -->
+```
+
+```expect
+(none)
+```
+
+### case: a conditional comment is not a note
+
+```html
+<!--[if IE]><p>password: x</p><![endif]-->
+```
+
+```expect
+(none)
+```

codelaw_rules_security_html/rules/sec-html/no-sensitive-comments.md

@@ -0,0 +1,34 @@
+---
+id: sec-html/no-sensitive-comments
+title: "No comment that exposes a secret or an internal host"
+languages: [html]
+fix: auto
+stability: preview
+security: { cwe: [615], owasp: ["A02:2025"], severity: low }
+since: 0.2.0
+---
+
+An HTML comment does not hold a password, key, token, private IP address, internal host name, or a note to remove it before release.
+
+**Why:** Comments are sent to every visitor, so a developer's note becomes a disclosure.
+
+```codelaw
+native: sec-html/no-sensitive-comments
+```
+
+## Examples
+
+### HTML
+
+#### Don't
+
+```html
+<!-- password: hunter2 -->
+<p>Welcome</p>
+```
+
+#### Do
+
+```html
+<p>Welcome</p>
+```

codelaw_rules_security_html/rules/sec-html/no-srcdoc-script.cases.md

@@ -0,0 +1,21 @@
+# sec-html/no-srcdoc-script — cases
+
+### case: an event handler inside srcdoc
+
+```html
+<iframe srcdoc="&lt;p onclick=x()&gt;a&lt;/p&gt;"></iframe>
+```
+
+```expect
+1:9 sec-html/no-srcdoc-script
+```
+
+### case: plain markup
+
+```html
+<iframe srcdoc="&lt;p&gt;hello&lt;/p&gt;"></iframe>
+```
+
+```expect
+(none)
+```

codelaw_rules_security_html/rules/sec-html/no-srcdoc-script.md

@@ -0,0 +1,39 @@
+---
+id: sec-html/no-srcdoc-script
+title: "An iframe's srcdoc holds no script"
+languages: [html]
+fix: manual
+fix_reason: "the framed document has to become a file or be sandboxed"
+stability: preview
+security: { cwe: [79], owasp: ["A05:2025"], severity: high }
+since: 0.2.0
+---
+
+An `<iframe srcdoc>` does not contain a `<script>`, an event handler or a `javascript:` URL.
+
+**Why:** `srcdoc` content runs with the origin of the page that holds it unless the iframe is sandboxed, so script in it is script in the page.
+
+```codelaw
+native: sec-html/no-srcdoc-script
+```
+
+## How to fix
+
+1. Move the document to its own file and load it with `src`.
+2. Add `sandbox` without `allow-same-origin`.
+
+## Examples
+
+### HTML
+
+#### Don't
+
+```html
+<iframe srcdoc="&lt;script&gt;track()&lt;/script&gt;"></iframe>
+```
+
+#### Do
+
+```html
+<iframe sandbox src="/track.html"></iframe>
+```

codelaw_rules_security_html/rules/sec-html/no-template-html-sink.cases.md

@@ -0,0 +1,23 @@
+# sec-html/no-template-html-sink — cases
+
+### case: Vue and Angular
+
+```html
+<p v-html="a"></p>
+<div [innerHTML]="b"></div>
+```
+
+```expect
+1:4 sec-html/no-template-html-sink
+2:6 sec-html/no-template-html-sink
+```
+
+### case: a text binding
+
+```html
+<i [textContent]="c"></i>
+```
+
+```expect
+(none)
+```