51369b610e
When an include is not surrounded by empty lines, its content is inlined on the same line as the adjacent content. That can lead to broken tags and other display issues. This PR fixes all such includes and introduces a validation step that forbids introducing the same problem again.
79 lines
1.9 KiB
Plaintext
79 lines
1.9 KiB
Plaintext
include::../description.adoc[]
|
|
|
|
include::../ask-yourself.adoc[]
|
|
|
|
include::../recommended.adoc[]
|
|
|
|
== Sensitive Code Example
|
|
|
|
https://www.npmjs.com/package/csurf[Express.js CSURF middleware] protection is not found on an unsafe HTTP method like POST method:
|
|
|
|
----
|
|
let csrf = require('csurf');
|
|
let express = require('express');
|
|
|
|
let csrfProtection = csrf({ cookie: true });
|
|
|
|
let app = express();
|
|
|
|
// Sensitive: this operation doesn't look like protected by CSURF middleware (csrfProtection is not used)
|
|
app.post('/money_transfer', parseForm, function (req, res) {
|
|
res.send('Money transferred');
|
|
});
|
|
----
|
|
|
|
Protection provided by https://www.npmjs.com/package/csurf[Express.js CSURF middleware] is globally disabled on unsafe methods:
|
|
|
|
----
|
|
let csrf = require('csurf');
|
|
let express = require('express');
|
|
|
|
app.use(csrf({ cookie: true, ignoreMethods: ["POST", "GET"] })); // Sensitive as POST is unsafe method
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
https://www.npmjs.com/package/csurf[Express.js CSURF middleware] protection is used on unsafe methods:
|
|
|
|
[source,javascript]
|
|
----
|
|
let csrf = require('csurf');
|
|
let express = require('express');
|
|
|
|
let csrfProtection = csrf({ cookie: true });
|
|
|
|
let app = express();
|
|
|
|
app.post('/money_transfer', parseForm, csrfProtection, function (req, res) { // Compliant
|
|
res.send('Money transferred')
|
|
});
|
|
----
|
|
|
|
Protection provided by https://www.npmjs.com/package/csurf[Express.js CSURF middleware] is enabled on unsafe methods:
|
|
|
|
[source,javascript]
|
|
----
|
|
let csrf = require('csurf');
|
|
let express = require('express');
|
|
|
|
app.use(csrf({ cookie: true, ignoreMethods: ["GET"] })); // Compliant
|
|
----
|
|
|
|
include::../see.adoc[]
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
include::../message.adoc[]
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
include::../comments-and-links.adoc[]
|
|
|
|
endif::env-github,rspecator-view[]
|