FilesExpand file tree

 main

/

DisablingWebSecurity.ql

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

20 lines (18 loc) · 628 Bytes

 main

/

DisablingWebSecurity.ql

Copy path

Top

File metadata and controls

• Code
• Blame

20 lines (18 loc) · 628 Bytes

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

/**

* @name Disabling Electron webSecurity

* @description Disabling webSecurity can cause critical security vulnerabilities.

* @kind problem

* @problem.severity error

* @security-severity 6.1

* @precision very-high

* @tags security

* frameworks/electron

* external/cwe/cwe-079

* @id js/disabling-electron-websecurity

*/

import javascript

from DataFlow::PropWrite webSecurity, Electron::WebPreferences preferences

where

webSecurity = preferences.getAPropertyWrite("webSecurity") and

webSecurity.getRhs().mayHaveBooleanValue(false)

select webSecurity, "Disabling webSecurity is strongly discouraged."