logo

Database

Typescript Sensitive Information Indexeddb

Description

This detector identifies potential security risks when sensitive information is stored in IndexedDB without proper protection. IndexedDB data is stored locally on the client-side and can be accessed by other scripts or malicious extensions, potentially exposing sensitive data.

Weakness:

085 - Sensitive data stored in client-side storage

Category: Information Collection

Detection Strategy

    • Scans TypeScript/JavaScript code for usage of IndexedDB APIs

    • Identifies calls to IndexedDB methods like open(), transaction(), objectStore(), add(), put()

    • Flags locations where data is being stored to IndexedDB that may contain sensitive information

    • Reports vulnerabilities when sensitive data storage patterns are detected in client-side code

Vulnerable code example

function storeUserCredentials(): void {
    const password: string = document.referrer; // External data source
    const request: IDBOpenDBRequest = indexedDB.open("userDB", 1);

    request.onsuccess = function (): void {
        const db: IDBDatabase = request.result;
        const tx: IDBTransaction = db.transaction("users", "readwrite");
        const store: IDBObjectStore = tx.objectStore("users");...

✅ Secure code example

function storeUserCredentials(): void {
    const userInput: string = document.referrer; // External data source
    const request: IDBOpenDBRequest = indexedDB.open("userDB", 1);

    request.onsuccess = function (): void {
        const db: IDBDatabase = request.result;
        const tx: IDBTransaction = db.transaction("users", "readwrite");
        const store: IDBObjectStore = tx.objectStore("users");...