84 lines
2.5 KiB
Plaintext
84 lines
2.5 KiB
Plaintext
Using HTML-style comments in a page that will be generated or interpolated server-side before being served to the user increases the risk of exposing data that should be kept private. For instance, a developer comment or line of debugging information that's left in a page could easily (and has) inadvertently expose:
|
|
|
|
|
|
* Version numbers and host names
|
|
* Full, server-side path names
|
|
* Sensitive user data
|
|
|
|
Every other language has its own native comment format, thus there is no justification for using HTML-style comments in anything other than a pure HTML or XML file.
|
|
|
|
|
|
== Ask Yourself Whether
|
|
|
|
* The comment contains sensitive information.
|
|
* The comment can be removed.
|
|
|
|
|
|
== Recommended Secure Coding Practices
|
|
|
|
It is recommended to remove the comment or change its style so that it is not output to the client.
|
|
|
|
|
|
== Sensitive Code Example
|
|
|
|
----
|
|
<%
|
|
out.write("<!-- ${username} -->"); // Sensitive
|
|
%>
|
|
<!-- <% out.write(userId) %> --> // Sensitive
|
|
<!-- #{userPhone} --> // Sensitive
|
|
<!-- ${userAddress} --> // Sensitive
|
|
|
|
<!-- Replace 'world' with name --> // Sensitive
|
|
<h2>Hello world!</h2>
|
|
----
|
|
|
|
|
|
== Compliant Solution
|
|
|
|
[source,html]
|
|
----
|
|
<%-- Replace 'world' with name --%> // Compliant
|
|
<h2>Hello world!</h2>
|
|
----
|
|
|
|
|
|
== See
|
|
|
|
* OWASP - https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[Top 10 2017 Category A3 - Sensitive Data Exposure]
|
|
* CWE - https://cwe.mitre.org/data/definitions/615[CWE-615 - Information Exposure Through Comments]
|
|
|
|
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
=== Message
|
|
|
|
Make sure that the HTML comment does not contain sensitive information.
|
|
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
=== is related to: S1531
|
|
|
|
=== on 29 Jul 2014, 11:38:41 Freddy Mallet wrote:
|
|
According to the discussion we had yesterday, do you confirm that we can remove those comments @Ann ? Thanks
|
|
|
|
=== on 29 Jul 2014, 15:46:41 Ann Campbell wrote:
|
|
\[~freddy.mallet] It's in my ToDo list to merge this with RSPEC-1531
|
|
|
|
=== on 30 Jul 2014, 20:35:52 Freddy Mallet wrote:
|
|
Feedback [~ann.campbell.2]:
|
|
|
|
* As obvious as this rule can be, I would add some "Noncompliant/Compliant" sections
|
|
* Even if this rule is classified in the "Security" category I would decrease the severity to "Minor" or "Major" as the risk to have an HTML comment containing a sensitive information remains low
|
|
* We should decide if we want to use bullet points or table for the See section
|
|
|
|
endif::env-github,rspecator-view[]
|