Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 9aec443

Browse files
author
Stephan Brandauer
committed
polish qhelp for CWE-830 and add test file
1 parent 44d8656 commit 9aec443

2 files changed

Lines changed: 46 additions & 6 deletions

File tree

‎javascript/ql/src/Security/CWE-830/FunctionalityFromUntrustedSource.qhelp‎

Lines changed: 23 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
<overview>
66
<p>
77

8-
Including functionality from an external source via an http link may
8+
Including functionality from an external source via an http URL may
99
allow an attacker to inject malicious code via a MITM (man-in-the-middle) attack.
1010

1111
</p>
@@ -15,16 +15,33 @@
1515
<recommendation>
1616
<p>
1717

18-
When including external pages or behaviour, use <em>https</em> links (instead of http)
19-
to be certain that you are getting a response from the intended server, not
20-
someone else.
18+
When including external pages or behaviour, use <em>https</em> URLs to make sure you're
19+
getting the intended data, or users will be vulnerable to MITM attacks.
2120

2221
</p>
2322

2423
<p>
2524

26-
Using http links is unsafe because the request sent may be intercepted by an attacker,
27-
and malicious data may be sent back in reply.
25+
When including external behaviour in iframe or script elements, using http URLs is
26+
unsafe because the request sent may be intercepted by an attacker, and malicious data
27+
may be sent back in reply.
28+
29+
</p>
30+
31+
32+
<p>
33+
34+
Even when https is used, an attacker might still compromise the server the page is
35+
receving data from.
36+
37+
When including scripts from a CDN (content-delivery network), it is therefore recommended
38+
to set the integrity-attribute on the script tag to the hash of the script you're expecting
39+
to receive.
40+
41+
This makes it impossible for an attacker to inject any code into the page, because the
42+
integrity check would fail &mdash; even when the CDN is compromised.
43+
44+
See the reference on Subresource Integrity for more information.
2845

2946
</p>
3047

‎javascript/ql/test/query-tests/Security/CWE-830/StaticCreationOfUntrustedSourceUse.html‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
</head>
5+
<body>
6+
<script src="http://test.local/foo.js"></script>> <!-- NOT OK -->
7+
<script src="http://test.local/foo.js" integrity="some-integrity-hash"></script>> <!-- OK (integrity digest present) -->
8+
<script src="https://test.local/bar.js"></script>> <!-- OK (https) -->
9+
<iframe src="http://test.local/foo.html"></iframe> <!-- NOT OK -->
10+
<iframe src="https://test.local/foo.html"></iframe> <!-- OK (https) -->
11+
<iframe src="//test.local/foo.html"></iframe> <!-- OK (protocol-relative url is allowed as a http url of
12+
the page is vulnerable in the first place) -->
13+
<iframe src="http://::1/foo.html"></iframe> <!-- OK (localhost) -->
14+
<iframe src="http://[::1]:80/foo.html"></iframe> <!-- OK (localhost) -->
15+
<iframe src="http://127.0.0.1:444/foo.html"></iframe> <!-- OK (localhost) -->
16+
17+
<!-- Some CDNs recommend using the integrity attribute — for those, we demand it even with https links -->
18+
<!-- OK (digest present) -->
19+
<script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.8.2/angular.min.js" integrity="sha512-7oYXeK0OxTFxndh0erL8FsjGvrl2VMDor6fVqzlLGfwOQQqTbYsGPv4ZZ15QHfSk80doyaM0ZJdvkyDcVO7KFA==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
20+
<!-- NOT OK (digest missing) -->
21+
<script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.8.2/angular.min.js" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
22+
</body>
23+
</html>

0 commit comments

Comments
 (0)