logo

Database

Typescript Local Storage With Sensitive Data

Description

Detects when sensitive data from HTTP responses is stored in the browser's localStorage, which is an insecure client-side storage mechanism. This poses a security risk since localStorage data is stored in plaintext and accessible via JavaScript, potentially exposing sensitive information to cross-site scripting (XSS) attacks.

Weakness:

344 - Lack of data validation - Non Sanitized Variables

Category: Unexpected Injection

Detection Strategy

    • Identifies calls to localStorage.setItem() or similar localStorage methods

    • Checks if the data being stored comes from HTTP responses or contains sensitive information

    • Reports a vulnerability when sensitive HTTP response data is saved to localStorage without proper encryption or security measures

Vulnerable code example

import axios, { AxiosResponse } from 'axios';

async function fetchAndStore(): Promise<void> {
  // Vulnerable: Storing raw HTTP response object in localStorage by force-casting to string
  const response: AxiosResponse = await axios.get('https://api.example.com/data');
  // This cast bypasses TypeScript checks and may store sensitive data unsafely
  localStorage.setItem('apiData', response as unknown as string);
...

✅ Secure code example

import axios, { AxiosResponse } from 'axios';

async function fetchAndStore(): Promise<void> {
  // Safe: Extract and store only the response data as JSON string
  const response: AxiosResponse = await axios.get('https://api.example.com/data');
  localStorage.setItem('apiData', JSON.stringify(response.data));

  // Safe: Convert fetch response to JSON before storing and type the result...