logo

Database

Typescript Reflected Xss Protection Disabled

Description

Detects code patterns in TypeScript/JavaScript applications where Cross-Site Scripting (XSS) protections are explicitly disabled or weakened, potentially allowing malicious scripts to be injected and executed. This creates security risks by permitting untrusted content to run in users' browsers.

Weakness:

008 - Reflected cross-site scripting (XSS)

Category: Unexpected Injection

Detection Strategy

    • Identifies assignments or configurations that disable XSS protections in content security settings

    • Detects when dangerous HTML rendering options are enabled like dangerouslySetInnerHTML in React

    • Flags instances where content sanitization is explicitly bypassed

    • Checks for unsafe content insertion into DOM elements without proper escaping

    • Reports vulnerabilities when content security policies are set to unsafe-inline or unsafe-eval

Vulnerable code example

const express = require('express');
const app = express();

app.get('/hello', (req, res) => {
  const user = req.query.user;
  res.setHeader('X-XSS-Protection', '0');  // Deliberately disabling XSS protection
  res.send(`
    <html>...

✅ Secure code example

const express = require('express');
const app = express();

// Validate user input to only allow safe characters
function validateUser(input) {
  const str = String(input || '');
  return /^[\w .-]{1,100}$/.test(str) ? str : ''; // Restrict to alphanumeric, spaces, dots, dashes
}...