javascript-injection

JavaScript Injection Security Rule

actions:

• type: enforce conditions:

  • pattern: "eval\(([^)](req|request|query|param|user|input)[^)])\)" severity: "critical" message: | 🔴 CRITICAL: Potential code injection vulnerability detected.

    Impact: Attackers can execute arbitrary code in your application context. CWE Reference: CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code)

    ❌ Insecure: eval(req.body.data)

    ✅ Secure Alternative: // Use safer alternatives like JSON.parse for JSON data try { const data = JSON.parse(req.body.data); // Process data safely } catch (error) { // Handle parsing errors } learn_more_url: "https://owasp.org/www-community/attacks/Direct_Dynamic_Code_Evaluation_Eval_Injection"

  • pattern: "\$\(\s*(['"])<[^>]+>\1\s*\)" severity: "high" message: | 🟠 HIGH: jQuery HTML injection vulnerability detected.

    Impact: This can lead to Cross-Site Scripting (XSS) attacks. CWE Reference: CWE-79 (Improper Neutralization of Input During Web Page Generation)

    ❌ Insecure: $("" + userProvidedData + "")

    ✅ Secure Alternative: // Create element safely, then set text content const div = $(""); div.text(userProvidedData); learn_more_url: "https://cheatsheetseries.owasp.org/cheatsheets/jQuery_Security_Cheat_Sheet.html"

  • pattern: "document\.write\(|document\.writeln\(" severity: "high" message: | 🟠 HIGH: Potential DOM-based XSS vulnerability.

    Impact: Attackers can inject malicious HTML/JavaScript into your page. CWE Reference: CWE-79 (Improper Neutralization of Input During Web Page Generation)

    ❌ Insecure: document.write("" + userGeneratedContent + "");

    ✅ Secure Alternative: // Use safer DOM manipulation methods const h1 = document.createElement("h1"); h1.textContent = userGeneratedContent; document.body.appendChild(h1); learn_more_url: "https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html"

  • pattern: "innerHTML\s*=|outerHTML\s*=" pattern_negate: "sanitize|DOMPurify|escapeHTML" severity: "high" message: | 🟠 HIGH: Potential DOM-based XSS through innerHTML/outerHTML.

    Impact: Setting HTML content directly can allow script injection. CWE Reference: CWE-79 (Improper Neutralization of Input During Web Page Generation)

    ❌ Insecure: element.innerHTML = userProvidedData;

    ✅ Secure Alternative: // Option 1: Use textContent instead for text element.textContent = userProvidedData;

    // Option 2: Sanitize if HTML is required import DOMPurify from 'dompurify'; element.innerHTML = DOMPurify.sanitize(userProvidedData); learn_more_url: "https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html"

  • pattern: "\$\(.*\)\.html\(" pattern_negate: "sanitize|DOMPurify|escapeHTML" severity: "high" message: | 🟠 HIGH: jQuery HTML injection risk detected.

    Impact: Setting HTML content can lead to XSS vulnerabilities. CWE Reference: CWE-79 (Improper Neutralization of Input During Web Page Generation)

    ❌ Insecure: $("#element").html(userProvidedData);