Description

Detects insecure compression algorithm configurations in webpack applications using compression-webpack-plugin. Improper compression settings can lead to security vulnerabilities like BREACH attacks, where attackers can exploit compression to recover sensitive data from encrypted traffic.

Detection Strategy

• Search for imports or requires of 'compression-webpack-plugin' in project dependencies

• Analyze webpack configuration files for compression plugin usage

• Check compression algorithm settings in plugin configuration

• Report vulnerability when potentially insecure compression settings are detected in webpack configurations

Vulnerable code example

const CompressionPlugin = require("compression-webpack-plugin");

// Vulnerable: Uses insecure gzip compression algorithm
new CompressionPlugin({
    filename: "[path][base].gz",
    algorithm: "gzip",  // Security risk: gzip compression is vulnerable to BREACH attacks
    test: /\.js$/,
    threshold: 10240...

✅ Secure code example

const CompressionPlugin = require("compression-webpack-plugin");
const zlib = require("zlib");

// Safe: Uses brotli compression which is resistant to BREACH attacks
new CompressionPlugin({
    filename: "[path][base].br",
    algorithm: "brotliCompress",  // Using secure brotli compression instead of gzip
    test: /\.js$/,...