Description

Detects potential Server-Side Request Forgery (SSRF) vulnerabilities in Playwright's addInitScript usage. This occurs when untrusted content is passed to addInitScript(), which could allow injection of malicious JavaScript code that makes unauthorized network requests from the browser automation context.

Detection Strategy

• Check if the source file imports the 'playwright' module

• Identify calls to the 'addInitScript' method

• Analyze the arguments passed to addInitScript to determine if they contain untrusted or dynamic content

• Report a vulnerability if potentially unsafe content is passed to addInitScript

Vulnerable code example

import { chromium } from 'playwright';

async function processUrl(userInput) {
  const browser = await chromium.launch();
  const context = await browser.newContext();
  
  // Vulnerable: Unsanitized user input directly injected into script
  await context.addInitScript(`fetch(${userInput})`);...

✅ Secure code example

import { chromium } from 'playwright';

async function processUrl(userInput) {
  // Validate URL format and sanitize input
  let safeUrl;
  try {
    const url = new URL(userInput); // Validate URL format
    if (!url.protocol.match(/^https?:$/)) { // Only allow http/https...