Description

This detector identifies TypeScript code that lacks proper XSS protection headers, making web applications vulnerable to cross-site scripting attacks. Missing or misconfigured XSS protection headers allow malicious scripts to be executed in users' browsers.

Detection Strategy

• Analyzes TypeScript source code files for HTTP response header configurations

• Identifies missing or improperly configured X-XSS-Protection headers in web application frameworks

• Flags code that handles HTTP responses without setting appropriate XSS protection mechanisms

• Reports vulnerabilities when TypeScript applications fail to implement reflected XSS protection headers

Vulnerable code example

import { Router } from "express";
var router = Router();

router.get("test", function (req, res) {
  var user = req.params["user"];
  res.setHeader("X-XSS-Protection", "1"); // XSS header set but ineffective
  res.send(`<h1>Hello ${user}</h1>`); // Direct insertion without sanitization
});...

✅ Secure code example

import { Router } from "express";
var router = Router();

router.get("/test/:user", function (req, res) {
  var user = req.params["user"];
  res.setHeader("X-XSS-Protection", "0");
  res.send(`<h1>Hello ${sanitizeInput(user)}</h1>`); // HTML entities escaped to prevent XSS
});...