rspec/rules/S4502/javascript/rule.adoc

include::../description.adoc[]

include::../ask-yourself.adoc[]

include::../recommended.adoc[]

== Sensitive Code Example

https://www.npmjs.com/package/csurf[Express.js CSURF middleware] protection is not found on an unsafe HTTP method like POST method:

----
let csrf = require('csurf');
let express = require('express');

let csrfProtection = csrf({ cookie: true });

let app = express();

// Sensitive: this operation doesn't look like protected by CSURF middleware (csrfProtection is not used)
app.post('/money_transfer', parseForm, function (req, res) { 
  res.send('Money transferred');
});
----

Protection provided by https://www.npmjs.com/package/csurf[Express.js CSURF middleware] is globally disabled on unsafe methods:

----
let csrf = require('csurf');
let express = require('express');

app.use(csrf({ cookie: true, ignoreMethods: ["POST", "GET"] })); // Sensitive as POST is unsafe method
----

== Compliant Solution

https://www.npmjs.com/package/csurf[Express.js CSURF middleware] protection is used on unsafe methods:

----
let csrf = require('csurf');
let express = require('express');

let csrfProtection = csrf({ cookie:  true });

let app = express();

app.post('/money_transfer', parseForm, csrfProtection, function (req, res) { // Compliant
  res.send('Money transferred')
}); 
----

Protection provided by https://www.npmjs.com/package/csurf[Express.js CSURF middleware] is enabled on unsafe methods:

----
let csrf = require('csurf');
let express = require('express');

app.use(csrf({ cookie: true, ignoreMethods: ["GET"] })); // Compliant
----

include::../see.adoc[]