Description

Detects potential Reflected Cross-Site Scripting (XSS) vulnerabilities in Scala Play Framework applications where unvalidated user input could be reflected back in HTTP responses. This could allow attackers to inject malicious scripts that execute in users' browsers.

Detection Strategy

• Checks if Play Framework MVC library (play.api.mvc) is imported in the codebase

• Analyzes controller action methods that return responses to the client

• Identifies insecure return statements that could reflect unvalidated user input directly in the response

• Reports potential XSS vulnerabilities when user-controlled data flows to response outputs without proper encoding or sanitization

Vulnerable code example

import play.api.mvc._

class SimpleController(cc: ControllerComponents) extends AbstractController(cc) {
  def displayName = Action { request =>
    val name = request.getQueryString("name").getOrElse("")
    Ok("<div>Hello " + name + "</div>")  // Vulnerable: Direct concatenation of user input into HTML
  }
}

✅ Secure code example

import play.api.mvc._
import play.twirl.api.HtmlFormat

class SimpleController(cc: ControllerComponents) extends AbstractController(cc) {
  def displayName = Action { request =>
    val name = request.getQueryString("name").getOrElse("")
    Ok("<div>Hello " + HtmlFormat.escape(name) + "</div>")  // Secure: User input is HTML escaped
  }...