JS/TS: insecure Helmet middleware (new query) #16540
Conversation
|
QHelp previews: javascript/ql/src/Security/CWE-693/InsecureHelmet.qhelperrors/warnings: |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
QHelp previews: javascript/ql/src/Security/CWE-693/InsecureHelmet.qhelpInsecure configuration of Helmet security middlewareHelmet is a collection of middleware functions for securing Express apps. It sets various HTTP headers to guard against common web vulnerabilities. This query detects Helmet misconfigurations that can lead to security vulnerabilities, specifically:
RecommendationTo help mitigate these vulnerabilities, ensure that the following Helmet functions are not disabled, and are configured appropriately to your application:
ExampleThe following code snippet demonstrates Helmet configured in an insecure manner: In this example, the defaults are used, which enables frame protection and a default Content Security Policy. You can also enable a custom Content Security Policy by passing an object to the References |
…ub.com/aegilops/codeql into aegilops/js/insecure-helmet-middleware
|
QHelp previews: javascript/ql/src/Security/CWE-693/InsecureHelmet.qhelpInsecure configuration of Helmet security middlewareHelmet is a collection of middleware functions for securing Express apps. It sets various HTTP headers to guard against common web vulnerabilities. This query detects Helmet misconfigurations that can lead to security vulnerabilities, specifically:
Users of the query can extend the set of required Helmet features by adding additional checks for them, using CodeQL data extensions in a CodeQL model pack. See `CUSTOMIZING.md` in the query source for more information. RecommendationTo help mitigate these vulnerabilities, ensure that the following Helmet functions are not disabled, and are configured appropriately to your application:
ExampleThe following code snippet demonstrates Helmet configured in an insecure manner: const helmet = require('helmet');
app.use(helmet({
frameguard: false,
contentSecurityPolicy: false
}));In this example, the defaults are used, which enables frame protection and a default Content Security Policy. app.use(helmet());You can also enable a custom Content Security Policy by passing an object to the app.use(
helmet({
contentSecurityPolicy: {
directives: {
"script-src": ["'self'", "example.com"],
"style-src": null,
},
},
})
);References |
…ub.com/aegilops/codeql into aegilops/js/insecure-helmet-middleware
|
I'm not sure what to do about the change note failure. Do I need to document this change in a change note, and if so, where please? |
Yes. See this doc on change-notes for what to put there: https://github.com/github/codeql/blob/main/docs/change-notes.md |
|
I've got those updates done for you @erik-krogh, thanks so much for the review so far 🙏
|
…ced md doc instead
|
QHelp previews: javascript/ql/src/Security/CWE-693/InsecureHelmet.qhelpInsecure configuration of Helmet security middlewareHelmet is a collection of middleware functions for securing Express apps. It sets various HTTP headers to guard against common web vulnerabilities. This query detects Helmet misconfigurations that can lead to security vulnerabilities, specifically:
Users of the query can extend the set of required Helmet features by adding additional checks for them, using CodeQL data extensions in a CodeQL model pack. See RecommendationTo help mitigate these vulnerabilities, ensure that the following Helmet functions are not disabled, and are configured appropriately to your application:
ExampleThe following code snippet demonstrates Helmet configured in an insecure manner: const helmet = require('helmet');
app.use(helmet({
frameguard: false,
contentSecurityPolicy: false
}));In this example, the defaults are used, which enables frame protection and a default Content Security Policy. app.use(helmet());You can also enable a custom Content Security Policy by passing an object to the app.use(
helmet({
contentSecurityPolicy: {
directives: {
"script-src": ["'self'", "example.com"],
"style-src": null,
},
},
})
);References
|
|
👋 I fixed the expected result, added more references, and fixed a bit of markup in the query help. I just updated my branch with |
There was a problem hiding this comment.
Nice, this looks good to me 👍
One below comment about dataExtensions:. I don't know what the right answer is 🤷
I did some evaluations to check that the results/performance look OK.
(nightly, default (internal links)).
Performance was great 👍
And the evaluations found a single new TP, which looked like the below, so that's nice.
app.use(helmet({
contentSecurityPolicy: false, // @TODO implement
javascript/ql/lib/semmle/javascript/frameworks/helmet/Helmet.Required.Setting.model.yml
Show resolved
Hide resolved
|
One future enhancement would be to look for places where a config is defined that flows to the I'm not going to do that right now, since I don't know if it is done in real use, but it's a possibility. I wanted to keep the initial implementation simple and performant, and to work for cases I saw in real code. There may also be other variations in how the middleware is activated, which I can look out for in future. |
The Helmet 🪖 middleware is used to set security-related HTTP headers in Express applications. This query finds instances where the middleware is configured with important⚠️ security features disabled 🚫.
I've included a new data extension, specific to this query, called
requiredHelmetSecuritySetting, which users can set to a string of extra features that should not be disabled, beyond the defaults in the query. The extension is specific to this query, rather than general purpose; I don't know of other similar queries for other frameworks, so designing something that would work well in other contexts would be speculative.I'd like to discuss 🗣️ what numeric severity 🔢 to give this, since it's a configuration and not a direct vulnerability on its own.