codelaw-rules-security-js 0.3.0__py3-none-any.whl

codelaw_rules_security_js/rules/sec-js/angularjs-sce-disabled.md

@@ -0,0 +1,132 @@
+---
+id: sec-js/angularjs-sce-disabled
+title: "No AngularJS strict contextual escaping switched off"
+languages: [javascript, jsx, typescript, tsx]
+fix: manual
+fix_reason: "which sources the application loads from is a decision for the author"
+stability: preview
+security: { cwe: [79], owasp: ["A05:2025"], severity: high }
+since: 0.3.0
+options:
+  sanitizers:
+    type: "call[]"
+    description: "functions whose result may reach the sink: a callee path (global) or { name, module }; `sanitizers_mode: replace` makes them the only ones that count"
+    default:
+      - { name: DOMPurify.sanitize, module: [dompurify, isomorphic-dompurify] }
+      - DOMPurify.sanitize
+      - { name: sanitizeHtml, module: sanitize-html }
+      - { name: xss, module: xss }
+      - { name: filterXSS, module: xss }
+      - { name: escapeHtml, module: escape-html }
+      - { name: escape, module: [lodash, lodash-es, lodash/escape, he] }
+      - { name: _.escape, module: [lodash, lodash-es] }
+      - { name: he.escape, module: he }
+      - "*.createHTML"
+---
+
+AngularJS's `$sce` stays on, `resourceUrlWhitelist` has no `"**"`, the href and image whitelists are not match-everything, and `$sce.trustAs*` is not given an unsanitized value.
+
+**Your sanitizer:** a value passes when it is a call to one of the `sanitizers`: the built-in list (DOMPurify, sanitize-html, xss, escape-html, lodash and he `escape`, Trusted Types `createHTML`) plus your own, each matched by name and by the module it is imported from, so a local `function sanitize(x) { return x }` does not pass. `sanitizers_mode = "replace"` makes yours the only ones that count. It does not follow a value through a variable: `const c = clean(x)` then `c` at the sink is not a call. Add a project function with `sanitizers = [{ name = "sanitizeHtml", module = "@acme/security" }]`.
+
+**Why:** `$sce` is what stops a bound string from becoming HTML, a script or a frame source; switching it off or trusting every value turns each binding into an XSS sink (CWE-79).
+
+```codelaw
+match:
+  any:
+    - pattern: $sceProvider.enabled(false)
+    - all:
+        - pattern: $SD.resourceUrlWhitelist($A)
+        - regex: '["'']\*\*["'']'
+    - all:
+        - pattern: $CP.$M($R)
+        - regex: '(aHref|imgSrc)SanitizationWhitelist\(\s*/(\^?\.\*?\$?|\^)/[a-z]*\s*\)'
+    - pattern: $SCE.trustAsHtml($V)
+    - pattern: $SCE.trustAsJs($V)
+    - pattern: $SCE.trustAsUrl($V)
+    - pattern: $SCE.trustAsResourceUrl($V)
+constraints:
+  V: { not: { any: [ { kind: string }, { regex: '^`[^`$]*`$' } ] } }
+where:
+  $V: { not: { calls: sanitizers } }
+message: "AngularJS's strict contextual escaping is weakened here"
+```
+
+## How to fix
+
+1. Leave `$sceProvider.enabled` at its default (`true`).
+2. List the hosts a template may load from in `resourceUrlWhitelist`: `["self", "https://cdn.example.com/**"]`, not `"**"`.
+3. Pass a value to `$sce.trustAsHtml` only after a sanitizer (`$sanitize`, DOMPurify) has cleaned it.
+
+## Examples
+
+### JavaScript
+
+#### Don't
+
+```js
+app.config(function ($sceProvider) {
+  $sceProvider.enabled(false);
+});
+```
+
+#### Do
+
+```js
+app.config(function ($sceProvider) {
+  $sceProvider.enabled(true);
+});
+```
+
+### JSX
+
+#### Don't
+
+```jsx
+app.config(function ($sceProvider) {
+  $sceProvider.enabled(false);
+});
+```
+
+#### Do
+
+```jsx
+app.config(function ($sceProvider) {
+  $sceProvider.enabled(true);
+});
+```
+
+### TypeScript
+
+#### Don't
+
+```ts
+app.config(function ($sceProvider) {
+  $sceProvider.enabled(false);
+});
+```
+
+#### Do
+
+```ts
+app.config(function ($sceProvider) {
+  $sceProvider.enabled(true);
+});
+```
+
+### TSX
+
+#### Don't
+
+```tsx
+app.config(function ($sceProvider) {
+  $sceProvider.enabled(false);
+});
+```
+
+#### Do
+
+```tsx
+app.config(function ($sceProvider) {
+  $sceProvider.enabled(true);
+});
+```

codelaw_rules_security_js/rules/sec-js/cookie-flags.cases.md

@@ -0,0 +1,41 @@
+# sec-js/cookie-flags — cases
+
+### case: options that lack sameSite have no mechanical fix
+
+```js
+res.cookie("sid", sid, { httpOnly: true, secure: true });
+```
+
+```expect
+1:1 sec-js/cookie-flags
+```
+
+### case: all three flags
+
+```js
+res.cookie("sid", sid, { httpOnly: true, secure: true, sameSite: "strict" });
+```
+
+```expect
+(none)
+```
+
+### case: koa
+
+```js
+ctx.cookies.set("sid", id);
+```
+
+```expect
+1:1 sec-js/cookie-flags
+```
+
+### case: fastify
+
+```js
+reply.setCookie("sid", id);
+```
+
+```expect
+1:1 sec-js/cookie-flags
+```

codelaw_rules_security_js/rules/sec-js/cookie-flags.md

@@ -0,0 +1,117 @@
+---
+id: sec-js/cookie-flags
+title: "A cookie sets httpOnly, secure and sameSite"
+languages: [javascript, jsx, typescript, tsx]
+fix: suggest
+fix_reason: "a cookie a script must read, or one used cross-site, needs different flags"
+stability: preview
+security: { cwe: [614, 1004], owasp: ["A02:2025"], severity: medium }
+since: 0.3.0
+---
+
+`res.cookie`, `reply.setCookie` and `ctx.cookies.set` pass an options object with `httpOnly`, `secure` and `sameSite`.
+
+**Why:** Without `httpOnly` a script reads the cookie, without `secure` it travels over plain HTTP, and without `sameSite` the browser sends it on cross-site requests (CWE-614, CWE-1004, CWE-352).
+
+```codelaw
+match:
+  any:
+    - pattern: $C($N, $V)
+    - pattern: $C2($N2, $V2, $OPTS)
+constraints:
+  C: { regex: '^(res|response)\.cookie$|^reply\.setCookie$|^ctx\.cookies\.set$' }
+  C2: { regex: '^(res|response)\.cookie$|^reply\.setCookie$|^ctx\.cookies\.set$' }
+  OPTS:
+    any:
+      - not: { regex: 'httpOnly' }
+      - not: { regex: 'secure' }
+      - not: { regex: 'sameSite' }
+message: "This cookie is missing `httpOnly`, `secure` or `sameSite`"
+fix:
+  - replace: "$C($N, $V, { httpOnly: true, secure: true, sameSite: \"lax\" })"
+```
+
+## How to fix
+
+
+## Examples
+
+### JavaScript
+
+#### Don't
+
+```js
+res.cookie("sid", sid);
+```
+
+#### Do
+
+```js
+res.cookie("sid", sid, { httpOnly: true, secure: true, sameSite: "lax" });
+```
+
+#### Fixed
+
+```js
+res.cookie("sid", sid, { httpOnly: true, secure: true, sameSite: "lax" });
+```
+
+### JSX
+
+#### Don't
+
+```jsx
+res.cookie("sid", sid);
+```
+
+#### Do
+
+```jsx
+res.cookie("sid", sid, { httpOnly: true, secure: true, sameSite: "lax" });
+```
+
+#### Fixed
+
+```jsx
+res.cookie("sid", sid, { httpOnly: true, secure: true, sameSite: "lax" });
+```
+
+### TypeScript
+
+#### Don't
+
+```ts
+res.cookie("sid", sid);
+```
+
+#### Do
+
+```ts
+res.cookie("sid", sid, { httpOnly: true, secure: true, sameSite: "lax" });
+```
+
+#### Fixed
+
+```ts
+res.cookie("sid", sid, { httpOnly: true, secure: true, sameSite: "lax" });
+```
+
+### TSX
+
+#### Don't
+
+```tsx
+res.cookie("sid", sid);
+```
+
+#### Do
+
+```tsx
+res.cookie("sid", sid, { httpOnly: true, secure: true, sameSite: "lax" });
+```
+
+#### Fixed
+
+```tsx
+res.cookie("sid", sid, { httpOnly: true, secure: true, sameSite: "lax" });
+```

codelaw_rules_security_js/rules/sec-js/express-hardening.cases.md

@@ -0,0 +1,12 @@
+# sec-js/express-hardening — cases
+
+### case: disabled in the file
+
+```js
+const app = express();
+app.disable("x-powered-by");
+```
+
+```expect
+(none)
+```

codelaw_rules_security_js/rules/sec-js/express-hardening.md

@@ -0,0 +1,135 @@
+---
+id: sec-js/express-hardening
+title: "An Express app turns off x-powered-by or uses helmet"
+languages: [javascript, jsx, typescript, tsx]
+fix: suggest
+fix_reason: "`app.use(helmet())` is the better fix and needs an import; the inserted line only hides the framework"
+stability: preview
+security: { cwe: [200], owasp: ["A02:2025"], severity: low }
+since: 0.3.0
+---
+
+A file that creates an Express app also calls `helmet()` or disables `x-powered-by`.
+
+**Why:** The default `X-Powered-By: Express` header names the framework for every scanner, and without `helmet` the app sends none of the headers that limit framing, sniffing and mixed content (CWE-200).
+
+```codelaw
+match:
+  all:
+    - pattern: const $A = express()
+    - not:
+        inside:
+          kind: program
+          stopBy: end
+          has:
+            stopBy: end
+            regex: 'helmet|x-powered-by'
+message: "This Express app does not call `helmet()` or disable `x-powered-by`"
+fix:
+  - insert-after: "\n$A.disable(\"x-powered-by\");"
+```
+
+## How to fix
+
+
+## Examples
+
+### JavaScript
+
+#### Don't
+
+```js
+const app = express();
+app.get("/", handler);
+```
+
+#### Do
+
+```js
+const app = express();
+app.use(helmet());
+app.get("/", handler);
+```
+
+#### Fixed
+
+```js
+const app = express();
+app.disable("x-powered-by");
+app.get("/", handler);
+```
+
+### JSX
+
+#### Don't
+
+```jsx
+const app = express();
+app.get("/", handler);
+```
+
+#### Do
+
+```jsx
+const app = express();
+app.use(helmet());
+app.get("/", handler);
+```
+
+#### Fixed
+
+```jsx
+const app = express();
+app.disable("x-powered-by");
+app.get("/", handler);
+```
+
+### TypeScript
+
+#### Don't
+
+```ts
+const app = express();
+app.get("/", handler);
+```
+
+#### Do
+
+```ts
+const app = express();
+app.use(helmet());
+app.get("/", handler);
+```
+
+#### Fixed
+
+```ts
+const app = express();
+app.disable("x-powered-by");
+app.get("/", handler);
+```
+
+### TSX
+
+#### Don't
+
+```tsx
+const app = express();
+app.get("/", handler);
+```
+
+#### Do
+
+```tsx
+const app = express();
+app.use(helmet());
+app.get("/", handler);
+```
+
+#### Fixed
+
+```tsx
+const app = express();
+app.disable("x-powered-by");
+app.get("/", handler);
+```

codelaw_rules_security_js/rules/sec-js/express-session-secret.cases.md

@@ -0,0 +1,21 @@
+# sec-js/express-session-secret — cases
+
+### case: secure false
+
+```js
+session({ secret: key, cookie: { secure: false } });
+```
+
+```expect
+1:1 sec-js/express-session-secret
+```
+
+### case: cookie-session keys
+
+```js
+cookieSession({ keys: ["a"] });
+```
+
+```expect
+1:1 sec-js/express-session-secret
+```

codelaw_rules_security_js/rules/sec-js/express-session-secret.md

@@ -0,0 +1,101 @@
+---
+id: sec-js/express-session-secret
+title: "express-session has a secret from the environment and a secure cookie"
+languages: [javascript, jsx, typescript, tsx]
+fix: manual
+fix_reason: "where the secret comes from is a deployment decision"
+stability: preview
+security: { cwe: [798, 614], owasp: ["A07:2025"], severity: high }
+since: 0.3.0
+---
+
+`express-session`, `cookie-session` and `session()` are not given a literal `secret`, and their cookie does not set `secure: false`.
+
+**Why:** A secret in the source is in every clone and every build; anyone who has it forges a session cookie, and `secure: false` lets the cookie travel over plain HTTP (CWE-798, CWE-614).
+
+```codelaw
+match:
+  any:
+    - all:
+        - any:
+            - pattern: session($$$A)
+            - pattern: expressSession($$$A)
+            - pattern: cookieSession($$$A)
+        - has:
+            kind: pair
+            stopBy: end
+            regex: '^["'']?(secret|keys?)["'']?\s*:\s*(["'']|\[\s*["''])'
+    - all:
+        - any:
+            - pattern: session($$$B)
+            - pattern: expressSession($$$B)
+            - pattern: cookieSession($$$B)
+        - has:
+            kind: pair
+            stopBy: end
+            regex: '^["'']?secure["'']?\s*:\s*false\s*$'
+message: "The session secret is a literal in the source, or the session cookie is not marked secure"
+```
+
+## How to fix
+
+1. Read the secret from the environment or a secret store, and rotate it if it was ever committed.
+2. Set `cookie: { secure: true, httpOnly: true, sameSite: "lax" }` in production (behind a proxy, set `trust proxy`).
+
+## Examples
+
+### JavaScript
+
+#### Don't
+
+```js
+app.use(session({ secret: "keyboard cat", resave: false }));
+```
+
+#### Do
+
+```js
+app.use(session({ secret: process.env.SESSION_SECRET, resave: false }));
+```
+
+### JSX
+
+#### Don't
+
+```jsx
+app.use(session({ secret: "keyboard cat", resave: false }));
+```
+
+#### Do
+
+```jsx
+app.use(session({ secret: process.env.SESSION_SECRET, resave: false }));
+```
+
+### TypeScript
+
+#### Don't
+
+```ts
+app.use(session({ secret: "keyboard cat", resave: false }));
+```
+
+#### Do
+
+```ts
+app.use(session({ secret: process.env.SESSION_SECRET, resave: false }));
+```
+
+### TSX
+
+#### Don't
+
+```tsx
+app.use(session({ secret: "keyboard cat", resave: false }));
+```
+
+#### Do
+
+```tsx
+app.use(session({ secret: process.env.SESSION_SECRET, resave: false }));
+```

codelaw_rules_security_js/rules/sec-js/graphql-hardening.cases.md

@@ -0,0 +1,21 @@
+# sec-js/graphql-hardening — cases
+
+### case: introspection
+
+```js
+const o = { introspection: true };
+```
+
+```expect
+1:13 sec-js/graphql-hardening
+```
+
+### case: yoga without limits
+
+```js
+createYoga({ schema });
+```
+
+```expect
+1:1 sec-js/graphql-hardening
+```

codelaw_rules_security_js/rules/sec-js/graphql-hardening.md

@@ -0,0 +1,116 @@
+---
+id: sec-js/graphql-hardening
+title: "A GraphQL server limits query depth and cost, and hides introspection"
+languages: [javascript, jsx, typescript, tsx]
+fix: manual
+fix_reason: "the limits that fit the schema are a decision for the author"
+stability: preview
+security: { cwe: [200, 770], owasp: ["A02:2025"], severity: medium }
+since: 0.3.0
+---
+
+An Apollo, Yoga or express-graphql server names a depth or cost limit in its options, and does not set `introspection: true`.
+
+**Why:** A query can nest or fan out without bound and exhaust the server, and introspection hands an attacker the whole schema (CWE-770, CWE-200).
+
+```codelaw
+match:
+  any:
+    - all:
+        - any:
+            - pattern: new ApolloServer($$$A)
+            - pattern: createYoga($$$A)
+            - pattern: graphqlHTTP($$$A)
+            - pattern: createHandler($$$A)
+        - not:
+            has:
+              stopBy: end
+              regex: '(?i)depthLimit|costLimit|queryComplexity|maxDepth|validationRules|cost|complexity|armor'
+    - pattern:
+        context: '({ introspection: true })'
+        selector: pair
+message: "This GraphQL server has no depth or cost limit, or leaves introspection on"
+```
+
+## How to fix
+
+1. Add a depth limit (`graphql-depth-limit`) and a cost or complexity limit to `validationRules`, and cap the page size of list fields.
+2. Turn introspection off in production, and use persisted queries where the clients are your own.
+
+## Examples
+
+### JavaScript
+
+#### Don't
+
+```js
+const server = new ApolloServer({ typeDefs, resolvers });
+```
+
+#### Do
+
+```js
+const server = new ApolloServer({
+  typeDefs,
+  resolvers,
+  validationRules: [depthLimit(8)],
+  introspection: process.env.NODE_ENV !== "production",
+});
+```
+
+### JSX
+
+#### Don't
+
+```jsx
+const server = new ApolloServer({ typeDefs, resolvers });
+```
+
+#### Do
+
+```jsx
+const server = new ApolloServer({
+  typeDefs,
+  resolvers,
+  validationRules: [depthLimit(8)],
+  introspection: process.env.NODE_ENV !== "production",
+});
+```
+
+### TypeScript
+
+#### Don't
+
+```ts
+const server = new ApolloServer({ typeDefs, resolvers });
+```
+
+#### Do
+
+```ts
+const server = new ApolloServer({
+  typeDefs,
+  resolvers,
+  validationRules: [depthLimit(8)],
+  introspection: process.env.NODE_ENV !== "production",
+});
+```
+
+### TSX
+
+#### Don't
+
+```tsx
+const server = new ApolloServer({ typeDefs, resolvers });
+```
+
+#### Do
+
+```tsx
+const server = new ApolloServer({
+  typeDefs,
+  resolvers,
+  validationRules: [depthLimit(8)],
+  introspection: process.env.NODE_ENV !== "production",
+});
+```