46 lines
1.8 KiB
Plaintext
46 lines
1.8 KiB
Plaintext
Executing code dynamically is security-sensitive. It has led in the past to the following vulnerabilities:
|
|
|
|
* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9807[CVE-2017-9807]
|
|
* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9802[CVE-2017-9802]
|
|
|
|
Some APIs enable the execution of dynamic code by providing it as strings at runtime. These APIs might be useful in some very specific meta-programming use-cases. However most of the time their use is frowned upon as they also increase the risk of https://owasp.org/www-community/attacks/Code_Injection[Injected Code]. Such attacks can either run on the server or in the client (exemple: XSS attack) and have a huge impact on an application's security.
|
|
|
|
|
|
This rule raises issues on calls to ``++eval++`` and ``++Function++`` constructor. This rule does not detect code injections. It only highlights the use of APIs which should be used sparingly and very carefully. The goal is to guide security code reviews.
|
|
|
|
The rule also flags string literals starting with ``++javascript:++`` as the code passed in ``++javascript:++`` URLs is evaluated the same way as calls to ``++eval++`` or ``++Function++`` constructor.
|
|
|
|
include::../ask-yourself.adoc[]
|
|
|
|
include::../recommended.adoc[]
|
|
|
|
== Sensitive Code Example
|
|
|
|
----
|
|
let value = eval('obj.' + propName); // Sensitive
|
|
let func = Function('obj' + propName); // Sensitive
|
|
location.href = 'javascript:void(0)'; // Sensitive
|
|
----
|
|
|
|
== Exceptions
|
|
|
|
This rule will not raise an issue when the argument of the ``++eval++`` or ``++Function++`` is a literal string as it is reasonably safe.
|
|
|
|
include::../see.adoc[]
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
include::../message.adoc[]
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
include::../comments-and-links.adoc[]
|
|
|
|
endif::env-github,rspecator-view[]
|