Auth

Authentication is present in almost all web applications nowadays.

• Suggest named credentials for authentication

  Suggest named credentials for authentication

  PMD (Legacy)

• Prohibit hard coded passwords

  Prohibit using hard coded passwords, consider placing them in config files or keystores instead.

  Codacy ScalaMeta Pro

CSRF

Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated.

• Avoid calling VF action upon page load

  Avoid calling VF action upon page load

  PMD (Legacy)
• Avoid making DML operations in Apex class constructor/init method

  Avoid making DML operations in Apex class constructor/init method

  PMD (Legacy)

• Prohibit CSRF middleware before methodOverride

  Prohibits express.csrf() middleware before express.methodOverride().

  ESLint

Cookies

An HTTP cookie is a small piece of data sent from a website and stored on the user's computer by the browser while the user is browsing.

• Untrusted session cookie value

  Check for usage of the sessionId cookie in spray

  Codacy ScalaMeta Pro
• Prohibit creating insecure cookies.

  Cookie without the secure flag could be sent in clear text if a HTTP URL is visited.

  Codacy ScalaMeta Pro
• Prohibit creating cookies without HttpOnly set

  Cookie that is not marked as HttpOnly could be read by a malicious script in the browser.

  Codacy ScalaMeta Pro

Cryptography

Cryptography is a security technique widely used and there are several cryptographic functions, but not all of them are secure.

• Prohibit potential hot spot string comparisons

  Prohibits potential hot spot string comparisons of passwords, secrets and hashes.

  ESLint
• Prohibit crypto.pseudoRandomBytes

  Prohibits crypto.pseudoRandomBytes since it's not cryptographically strong.

  ESLint

• Apex classes should use random IV/key

  Apex classes should use random IV/key

  PMD (Legacy)

• Enforce secure RSA usage

  RSA algorithm must have padding set.

  Codacy ScalaMeta Pro
• Prohibit hard coded cryptographic keys

  Prohibit using hard coded keys, consider placing them in config files or keystores instead.

  Codacy ScalaMeta Pro
• Prohibit unencrypted sockets

  Communication channels should use encrypted connections

  Codacy ScalaMeta Pro
• Avoid using the NullCipher

  The NullCipher is rarely used intentionally in production applications.

  Codacy ScalaMeta Pro
• Prohibit weak message Digest

  Do not use a weak message digest algorithm

  Codacy ScalaMeta Pro
• Prohibit custom message Digest

  Do not use your own custom message digest algorithm

  Codacy ScalaMeta Pro
• Prohibit RSA usage with short key

  RSA Laboratories currently recommends key sizes of 1024 bits

  Codacy ScalaMeta Pro
• Prohibit Blowfish usage with short key

  At least 128 bits of entropy should be used when using Blowfish

  Codacy ScalaMeta Pro
• Prohibit insecure ciphers

  Using ciphers like DES and 3DES should be avoided

  Codacy ScalaMeta Pro
• Prohibit weak Random

  Do not use java.util.Random, its pseudo random generator can be predictable

  Codacy ScalaMeta Pro

DoS

The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed.

• Avoid implementing dangerous Regexs

  Regular expressions are frequently subject to Denial of Service attacks

  Codacy ScalaMeta Pro

• Prohibit Buffer with noAssert

  Prohibits buffer read / write calls that use noAssert set to true.

  ESLint

File Access

An attacker may use special paths to access files that should not be accessible.

• Potential filename injection

  Prevents possible filename injection by unfiltered input.

  Codacy ScalaMeta Pro

• Prohibit calls to fs functions with expression

  Prohibits calls to fs functions that take a non Literal value as the filename parameter.

  ESLint

Firefox OS

Sensitive APIs of Firefox OS.

• device-storage:music permission

  Usage of sensitive API

  ESLint
• mobile network permission

  Usage of sensitive API

  ESLint
• Usage of mozPower

  This function is only available to higher privileged Firefox OS applications. It allows access to power management features.

  ESLint
• Usage of mozNetworkStats

  Usage of sensitive API

  ESLint
• video-capture permission

  This function allows prompting for audio and video recording.

  ESLint
• Usage of getDeviceStorage

  Usage of sensitive API

  ESLint
• Message handler

  Check to make sure message handler validates to protect against malicious cross-origin message.

  ESLint
• Usage of mozWifiManager

  This function is only available to higher privileged Firefox OS applications. It allows managing the Wifi features of the phone.

  ESLint
• Usage of mozMobileConnections

  Usage of sensitive API

  ESLint
• Usage of mozPermissionSettings

  This function is only available to higher privileged Firefox OS applications. It allows managing and revoking apps permissions.

  ESLint
• Input manage permission

  Usage of sensitive API

  ESLint
• device-storage:sdcard permission

  Usage of sensitive API

  ESLint
• Cellbroadcast permission

  Usage of sensitive API

  ESLint
• Usage of mozTelephony

  Usage of sensitive API

  ESLint
• device-storage: apps permission

  Usage of sensitive API

  ESLint
• mozSystem object

  XMLHttpRequests of type system may contact and read data from third party origins

  ESLint
• embed-apps permission

  Usage of sensitive API

  ESLint
• Usage of mozDownloadManager

  Usage of sensitive API

  ESLint
• Usage pf cell broadcasts

  Usage of sensitive API

  ESLint
• Usage of mozFMRadio

  This function is only available to higher privileged Firefox OS applications.

  ESLint
• network-events permission

  Usage of sensitive API

  ESLint
• device-storage:videos permission

  Usage of sensitive API

  ESLint
• Usage of mozNotification

  Usage of sensitive API

  ESLint
• Usage of mozMobileConnection

  Usage of sensitive API

  ESLint
• Usage of mozKeyboard

  Usage of sensitive API

  ESLint
• handle system message

  This function allows registering message handlers for Web Activities.

  ESLint
• Usage of mozSettings

  This function is only available to higher privileged Firefox OS applications. It allows access to the phone's settings

  ESLint
• Call addEventListener

  Certain events (like message) may cause untrusted third party data.

  ESLint
• Usage of mozInputMethod

  Usage of sensitive API

  ESLint
• device-storage:crashes permission

  Usage of sensitive API

  ESLint
• handle mozActivity

  This function allows registering message handlers for Web Activities.

  ESLint
• Receive InterAppCommunication

  This function sets a handler for inter app communication messages. In general, mozSetMessageHandler allows handling WebActivities. The origin of the activity and its data might be untrusted.

  ESLint
• Webapps manage

  This function is only available to higher privileged Firefox OS applications. It allows managing the phone's app.

  ESLint
• Browser permission

  This function is only available to higher privileged Firefox OS applications. MozBrowser frames have specific, elevated permissions.

  ESLint
• Make InterAppCommunication

  ESLint
• wappush permission

  This specifies a handler for WAP Push notifications. In general, mozSetMessageHandler allows handling WebActivities. The origin of the activity and its data might be untrusted.

  ESLint
• Time permission

  This function is only available to higher privileged Firefox OS applications.

  ESLint
• Usage of mozContacts

  This function allows reading and modifying the phone's contacts. It is only available to higher privileged Firefox OS applications.

  ESLint
• device-storage:pictures permission

  Usage of sensitive API

  ESLint
• camera permission

  This function allows reading and modifying camera settings and is only available to higher privileged Firefox OS application.

  ESLint
• network-events permission

  Usage of sensitive API

  ESLint
• Usage of mozNfc

  Usage of sensitive API

  ESLint
• Create contextual fragment

  Writing user specified HTML to the DOM may lead to Cross-Site Scripting

  ESLint
• Access datastore

  This API allows access to datastores that may be used to serve or retrieve data from third party apps

  ESLint
• mobile network permission

  Usage of sensitive API

  ESLint
• alarms permission

  This function is only available to higher privileged Firefox OS applications and allows setting and editing alarms. Frequent alarms might prevent power saving and drain the battery.

  ESLint
• new MozActivity()

  This function creates new Web Activities and can transfer data from one app to another

  ESLint
• Background sensors permission

  This exercises the proximity API to check whether the phone is close to something (i.e. held to the ear).

  ESLint
• geolocation permission

  This function gives access to information about the user's location.

  ESLint
• bluetooth permission

  This function is only available to higher privileged Firefox OS applications.

  ESLint
• Usage of mozTCPSocket

  This function allows creating connections and communicating with remote servers.

  ESLint
• Usage of mozVoicemail

  This function is only available to higher privileged Firefox OS applications. It allows controlling the phone's Voicemail features.

  ESLint
• Usage of mozMobileMessage

  Usage of sensitive API

  ESLint
• speaker-control permission

  Usage of sensitive API

  ESLint
• Idle permission

  This function is only available to higher privileged Firefox OS applications.

  ESLint
• Usage of mozPhoneNumberService

  Usage of sensitive API

  ESLint

HTTP

HTTP headers are a common attack vector for malign users.

• Play untrusted http-header: User-Agent

  The User-Agent header can be controlled by the client. As such, its value should not be used in any security critical decisions.

  Codacy ScalaMeta Pro
• Prohibit untrusted Http-Request parameter

  Check for usage of the values obtained from GET and POST parameters in spray.

  Codacy ScalaMeta Pro
• Prohibit untrusted Http-Request parameter

  Check for usage of the values obtained from http requests parameters in play-framework.

  Codacy ScalaMeta Pro
• Spray untrusted http-header: User-Agent

  The User-Agent header can be controlled by the client. As such, its value should not be used in any security critical decisions.

  Codacy ScalaMeta Pro
• Spray untrusted http-header: Host

  The hostname header can be controlled by the client. As such, its value should not be used in any security critical decisions.

  Codacy ScalaMeta Pro
• Play untrusted http-headers

  Request headers can easily be altered by the requesting user.

  Codacy ScalaMeta Pro
• Spray untrusted Content-Type header

  Check for usage of the 'Content-Type' header in spray.

  Codacy ScalaMeta Pro
• Play untrusted Content-Type header

  Check for usage of the 'Content-Type' header in play

  Codacy ScalaMeta Pro
• Spray untrusted http-headers

  Request headers can easily be altered by the requesting user.

  Codacy ScalaMeta Pro
• Play untrusted http-header: Referrer

  The Referer header can be controlled by the client. As such, its value should not be used in any security critical decisions.

  Codacy ScalaMeta Pro
• Spray untrusted http-header: Referrer

  The Referer header can be controlled by the client. As such, its value should not be used in any security critical decisions.

  Codacy ScalaMeta Pro

Input validation

Input not validated may originate SQL Injection attacks for instance.

• Validate CRUD permission before SOQL/DML operation

  Validate CRUD permission before SOQL/DML operation

  PMD (Legacy)
• Avoid unescaped user controlled content in EL

  Avoid unescaped user controlled content in EL

  PMD (Legacy)

• new Function()

  Controlling of the first argument to Function(...) results in direct script execution.

  ESLint
• Call generateCRMFRequest

  Due to a bug in Firefox, this function may be used as an obfuscated way to call execute scripts from strings (like eval). This may lead to Cross-Site-Scripting.

  ESLint
• Call setInterval

  Calling setInterval with a first argument as string (or string concatenation) with user input may lead to XSS

  ESLint
• Call setTimeout

  Calling setTimeout with a first argument as string (or string concatenation) with user input may lead to XSS

  ESLint
• Call eval

  Controlling of the first argument to eval(...) results in direct script execution.

  ESLint
• ESLint_no-unsafe-innerhtml_no-unsafe-innerhtml

  ESLint_no-unsafe-innerhtml_no-unsafe-innerhtml

  ESLint
• Call function

  Controlling of the first argument to Function(...) results in direct script execution.

  ESLint
• Prohibit calls to require with expression

  Prohibits calls to require with non-literal argument.

  ESLint
• Prohibit eval with expression

  Prohibits eval statement with non Literal argument types.

  ESLint
• Call setImmediate

  Calling setImmediate with a first argument as string (or string concatenation) with user input may lead to XSS

  ESLint
• Prohibit no Markup escaping in Mustache

  Prohibits having disabled Markup escaping in Mustache.

  ESLint
• desktop-notification permission

  This function generate notifications from the app. It is only available to higher privileged Firefox OS applications.

  ESLint
• Call execScript

  Using execScript with user input leads to Cross Site Scripting (Internet Explorer only)

  ESLint
• Prohibit Script URLs

  Prohibits using return of a script as URL, you have to parse it first

  ESLint
• Usage parseFromString

  This function creates a DOM from strings. Depending on their source it is likely important to sanitize it before an insertion into the DOM happens

  ESLint
• Prohibit eval()

  Prohibits the usage of eval()

  ESLint
• Prohibit RegExp's with expression

  Prohibits RegExp's created from non-literal strings.

  ESLint

• Spray unvalidated redirect

  Check if call to redirect comes directly from an input

  Codacy ScalaMeta Pro
• Prevent XML parsing attacks

  Avoid Xml Entity Expansion attacks.

  Codacy ScalaMeta Pro
• Play unvalidated redirect

  Check if call to redirect comes directly from an input

  Codacy ScalaMeta Pro
• Prevent Path Traversal

  Prevents potential path traversal attacks

  Codacy ScalaMeta Pro
• Avoid Object deserialization of untrusted data

  Object deserialization of untrusted data can lead to remote code execution.

  Codacy ScalaMeta Pro

Insecure Storage

Storing sensitive data using this APIs is not safe.

• Local Storage

  Client-side data storage.

  ESLint
• Local Storage

  Client-side data storage.

  ESLint
• IndexedDB

  Client-side data storage.

  ESLint
• Session Storage

  Client-side data storage.

  ESLint
• ESLint_scanjs-rules_property_indexedDB

  ESLint_scanjs-rules_property_indexedDB

  ESLint
• Session storage

  Client-side data storage.

  ESLint

Insecure modules/libraries

Consider possible security implications associated with some modules.

• Calling potentially dangerous method

  Calling potentially dangerous method

  PMD (Legacy)
• Apex classes should declare a sharing model if DML or SOQL/SOSL is used

  Apex classes should declare a sharing model if DML or SOQL/SOSL is used

  PMD (Legacy)

Other

Other language specific security issues.

• Prohibit instances of child_process

  Prohibits instances of child_process.

  ESLint
• Prohibit instances of var[var]

  Prohibits instances of var[var].

  ESLint

Regex

Regex can be used in a Denial of Service attack, that exploits the fact that most Regular Expression implementations may reach heavy computation situations that cause them to work very slowly (exponentially related to input size).

• Prohibit Unsafe Regular Expression

  Prohibits Unsafe Regular Expression (new RegExp).

  ESLint

Routes

Badly configured routes can give unintended access to an attacker.

• Apex classes should safely redirect to a known location

  Apex classes should safely redirect to a known location

  PMD (Legacy)
• Apex callouts should use encrypted communication channels

  Apex callouts should use encrypted communication channels

  PMD (Legacy)

SQL Injection

A SQL injection attack consists of insertion or 'injection' of a SQL query via the input data from the client to the application.

• Prohibit SELECT *

  Prohibits SQL queries that start with SELECT *

  Codacy ScalaMeta Pro

• Avoid untrusted/unescaped variables in DML query

  Avoid untrusted/unescaped variables in DML query

  PMD (Legacy)

Unexpected behaviour

Assigning values to private APIs might lead to unexpected behaviour.

• Checks for assignments in condition tests.

  Unintended use of AssignmentExpression in If Statement.

  ESLint
• Assign to onmessage

  Check to make sure message handler validates to protect against malicious cross-origin message.

  ESLint
• Assign to href

  Assignments to the document's location may lead to spoofing and unexpected redirects. Furthermore, it can cause Cross-Site Scripting, when javascipt: URIs are used.

  ESLint
• Assign to location

  Assignments to the document's location may lead to spoofing and unexpected redirects. Furthermore, it can cause Cross-Site Scripting, when javascipt: URIs are used

  ESLint
• Assign to hostname

  Assignments to the document's location may lead to spoofing and unexpected redirects.

  ESLint
• Assign to mozAudioChannelType

  This function is only available to higher privileged Firefox OS applications.

  ESLint
• Assign to protocol

  Assignments to the document's location may lead to spoofing and unexpected redirects.

  ESLint
• Assign to pathname

  Assignments to the document's location may lead to spoofing and unexpected redirects.

  ESLint
• Assign to mozAudioChannel

  This function is only available to higher privileged Firefox OS applications.

  ESLint
• Assign to src

  Assignments to the document's location may lead to spoofing and unexpected redirects. It may also lead to script execution, depending on the affected HTML Tag (i.e. object)

  ESLint
• Assign to search

  Assignments to the document's location may lead to spoofing and unexpected redirects.

  ESLint

XSS

XSS enables attackers to inject client-side scripts into web pages viewed by other users.

• Prevent XML XSS

  Prevent possible XML XSS attack

  Codacy ScalaMeta Pro

• Apex classes should escape/sanitize Strings obtained from URL parameters

  Apex classes should escape/sanitize Strings obtained from URL parameters

  PMD (Legacy)
• Apex classes should escape Strings in error messages

  Apex classes should escape Strings in error messages

  PMD (Legacy)

• Call document.write

  Writing user specified HTML to the DOM may lead to Cross-Site Scripting

  ESLint
• attention permission

  Attention popups fill the whole display. URLs pointing to javascript: and data: protocols can lead to XSS. Popups can also confuse and misdirect users.

  ESLint
• Call document.writeln

  Writing user specified HTML to the DOM may lead to Cross-Site Scripting

  ESLint
• ESLint_scanjs-rules_call_open_remote=true

  ESLint_scanjs-rules_call_open_remote=true

  ESLint