Write JS Rules #504

cfabianski · 2023-02-06T16:11:52Z

Analytics and logging libraries currently unsupported

Druid
- https://druid.apache.org/docs/latest/development/javascript.html
- Can’t find official lib on NPM; unofficial query libs < 5K weekly downloads

Analytics libraries we support for Ruby but that we won't support for JS yet:

InfluxDB
- Node.js (44K weekly downloads on NPM)
- JavaScript browser client (~2K weekly downloads on NPM)
  - https://docs.influxdata.com/influxdb/cloud/api-guide/client-libraries/browserjs/
  - https://www.npmjs.com/package/@influxdata/influxdb-client-browser
ClickHouse JS (~8K weekly downloads on NPM)
- https://clickhouse.com/docs/en/integrations/language-clients/nodejs/
AWS Redshift (6K weekly downloads on NPM)
- https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-redshift/index.html
- https://www.npmjs.com/package/@aws-sdk/client-redshift
Splunk (4k weekly downloads on NPM)
- https://dev.splunk.com/enterprise/docs/devtools/javascript/sdk-javascript/
- https://www.npmjs.com/package/splunk-sdk
ScoutAPM (~2K weekly downloads on NPM)
- https://scoutapm.com/docs/node
- https://www.npmjs.com/package/@scout_apm/scout-apm
Google Dataflow (1,200 weekly downloads on NPM)
- https://cloud.google.com/nodejs/docs/reference/dataflow/latest

Code Snippets Examples

Loggers

const users = []

function generateUsername(firstname, surname) {
    return `${firstname[0]}-${surname}`.toLowerCase();
}

arr.forEach(element => {
	const username = generateUsername(user.firstname, user.surname);

	users.push({
		email: user.email,
		first_name: user.firstname,
		username
	})
});

console.log("user successfully connected", user.email);
console.table(users)

// Winston specific
const ctx = {
	{ 
		user: {
			email: "",
		}
	}
};

// catch the sensitive information from the context
logger.child({ context: ctx }).info('Order "1234" was processed successfully'); 

const childLogger = logger.child({ context: ctx });
childLogger.info('Order "1234" was processed successfully'); 

logger.log({
  level: 'info',
  message: 'user successfully connected' + user.email
});

// constructor function
function Person () {
    this.name = 'John',
    this.age = 23,
}

// create objects
const person1 = new Person();
const person2 = new Person();

// access properties
console.log(person1.name);  // John
console.log(person2.name);  // John

Cookies

const session = require('cookie-session')
const express = require('express')
const app = express()

app.use(session({
	...
  cookie: {
    secure: true, // Ensures the browser only sends the cookie over HTTPS.
    httpOnly: true, // Ensures the cookie is sent only over HTTP(S), not client JavaScript, helping to protect against cross-site scripting attacks.
    domain: 'example.com', // indicates the domain of the cookie; use it to compare against the domain of the server in which the URL is being requested. If they match, then check the path attribute next.
    path: 'foo/bar', // indicates the path of the cookie; use it to compare against the request path. If this and domain match, then send the cookie in the request.
    expires: expiryDate // use to set expiration date for persistent cookies.
  }
}))


// ...

const cookieConfig = {
  httpOnly: true, // to disable accessing cookie via client side js
  //secure: true, // to force https (if you use it)
  maxAge: 1000000, // ttl in seconds (remove this option and cookie will die when browser is closed)
  signed: true // if you use the secret with cookieParser
};
app.get('/set', (req, res) => {
  res.cookie('test', user.email, cookieConfig);
});

Links

https://expressjs.com/en/advanced/best-practice-security.html#use-cookies-securely

File Generation

fs.writeFile('<filename>', <content>, callback);
fs.appendFile('<filename>', <content>, callback);

//

const users = []

function generateUsername(firstname, surname) {
    return `${firstname[0]}-${surname}`.toLowerCase();
}

arr.forEach(element => {
	const username = generateUsername(user.firstname, user.surname);

	users.push({
		email: user.email,
		first_name: user.firstname,
		username
	})
});

const fs = require("fs");

fs.writeFile("data.csv", data, "utf-8", (err) => {
  if (err) console.log(err);
  else console.log("Data saved");
});

Session / Local Storage

localStorage.setItem("User email", user.email)

Sentry

Sentry.configureScope(scope => {
  scope.setExtra('email', user.email);
  scope.setTag('user_email', user.email);
  scope.setUser({ email: user.email });
  // scope.clear();
});

Sentry.addBreadcrumb({
  message: 'My Breadcrumb',
  // ...
});

Sentry.captureMessage('Hello, world!');
Sentry.captureException(new Error('Good bye'));
Sentry.captureEvent({
  message: 'Manual',
  stacktrace: [
    // ...
  ],
});

Exceptions

throw new CustomError(`Error with ${user.email}`)
throw `${user.email}`

reject('Error with user ' + user.email);

Promise.reject(new Error('fail' + user.email))

Weak Encryption

var crypto = require('crypto');

var key = 'secret key';
var encrypted = crypto.createHmac('sha1', key).update(user.password)
var hashmd5 = crypto.createHash('md5').update(user.password)

var encrypted = crypto.createHmac('sha1', key).update(password)
var hashmd5 = crypto.createHash('md5').update(password)

// Should use BCrypt or Scrypt for encrypting password

SSL Verification

const express = require('express')
const app = express()
const helmet = require('helmet')
app.use(helmet())

// import express from "express";
// import { express } from "express";
// const express = require('express')

// 
app.use(helmet.hsts()); // default configuration
app.use(helmet.hsts("<max-age>", "<includeSubdomains>")); // custom configuration

Links

https://expressjs.com/en/advanced/best-practice-security.html#use-tls

JWT

var jwt = require('jsonwebtoken');
var token = jwt.sign({ user: { email: 'bar' }}, 'shhhhh');

var token = jwt.sign({ foo: 'bar' }, privateKey, { algorithm: 'RS256' });
jwt.sign({ foo: 'bar' }, privateKey, { algorithm: 'RS256' }, function(err, token) {
  console.log(token);
});

Links

https://github.com/auth0/node-jsonwebtoken

HTTP Get/Post

Detect Insecure URL + Insecure params

import axios from 'axios';
//const axios = require('axios'); // legacy way
axios.get(`http://example.com/user?email=${user.email}`)
  .then(function (response) {
    // handle success
    console.log(response);
  });

axios.get('http://example.com/user', {
    params: {
      email: user.email
    }
  })
  .then(function (response) {
    console.log(response);
  });

const response = await axios.get('http://example.com/user?email=' + user.email);

// GET request for remote image in node.js
axios({
  method: 'get',
  url: 'http://example.com',
})
  .then(function (response) {
    response.data.pipe(fs.createWriteStream('ada_lovelace.jpg'))
  });

import fetch from 'node-fetch';

const response = await fetch('https://github.com/');

Detect Insecure URL

axios.post('http://example.com/user', {
    firstName: 'Fred',
    lastName: 'Flintstone'
  })
  .then(function (response) {
    console.log(response);
  })

// Send a POST request
axios({
  method: 'post',
  url: '/user/12345',
  data: {
    firstName: 'Fred',
    lastName: 'Flintstone'
  }
});

import fetch from 'node-fetch';

const user = { email:  "", gender: "" };

const response = await fetch('http://httpbin.org/post', {
	method: 'post',
	body: JSON.stringify(user),
	headers: {'Content-Type': 'application/json'}

import fetch from 'node-fetch';
const params = new URLSearchParams();
params.append('email', user.email);

const response = await fetch('https://httpbin.org/post', {method: 'POST', body: params});

Functions

function getUserAccount() {
  return axios.get('/user/12345');
}

The text was updated successfully, but these errors were encountered:

elsapet · 2023-02-17T08:08:40Z

Closing as all pertinent tasks have been completed.

Tasks listed that we are not handling now:

SSL Verification - this is not feasible to do
Snippet support (e.g. <script> tags in HTML files) for logging/analytics library detection
Less popular logging/analytics libraries, some of which we handle for Ruby

cfabianski added the enhancement New feature or request label Feb 6, 2023

gotbadger mentioned this issue Feb 6, 2023

Milestone 1 #415

Closed

19 tasks

cfabianski assigned vjerci Feb 6, 2023

gotbadger added this to the Milestone 1 milestone Feb 6, 2023

vjerci mentioned this issue Feb 8, 2023

feat: cookie rule #517

Merged

4 tasks

This was referenced Feb 8, 2023

feat(rules): add sentry rules #526

Merged

feat(rules): add js rules for exceptions #540

Merged

feat(rules): add file_generation rule for JS #546

Merged

This was referenced Feb 10, 2023

feat: add javascript jwt support #549

Merged

feat: javascript http insecure rule #551

Merged

feat: add javascript rule for google tag manager #554

Merged

cfabianski assigned elsapet Feb 14, 2023

elsapet closed this as completed Feb 17, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Write JS Rules #504

Write JS Rules #504

cfabianski commented Feb 6, 2023 •

edited by elsapet

Loggers

Cookies

Links

File Generation

Session / Local Storage

Sentry

Exceptions

Weak Encryption

SSL Verification

Links

JWT

Links

HTTP Get/Post

Detect Insecure URL + Insecure params

Detect Insecure URL

Functions

elsapet commented Feb 17, 2023

Write JS Rules #504

Write JS Rules #504

Comments

cfabianski commented Feb 6, 2023 • edited by elsapet

Analytics and logging libraries currently unsupported

Code Snippets Examples

Loggers

Cookies

Links

File Generation

Session / Local Storage

Sentry

Exceptions

Weak Encryption

SSL Verification

Links

JWT

Links

HTTP Get/Post

Detect Insecure URL + Insecure params

Detect Insecure URL

Functions

elsapet commented Feb 17, 2023

cfabianski commented Feb 6, 2023 •

edited by elsapet