Description

Detects the presence of debugger statements in TypeScript/JavaScript code which could expose sensitive debugging information in production environments. When executed, these statements trigger debugging breakpoints that can be exploited by attackers to analyze application flow and gather information about the application's internal workings.

Detection Strategy

• Scans for 'debugger' statements in TypeScript/JavaScript source code

• Reports a vulnerability when debugger statements are found in application code

• Each discovered debugger statement triggers a distinct vulnerability report since they each represent a potential security exposure point

Vulnerable code example

function processUserData(userData) {
  try {
    // Process some sensitive data
    const result = userData.process();
    debugger;  // SECURITY: Debugger statement can expose sensitive data in production
    return result;
  } catch (error) {
    console.error('Error processing user data');...

✅ Secure code example

function processUserData(userData) {
  try {
    // Process some sensitive data
    const result = userData.process();
    // Removed debugger statement to prevent exposing sensitive data
    return result;
  } catch (error) {
    // Proper error logging without exposing details...