rules.xml

<rules>
    <!-- All String Comparison Rules Go here -->
    <!--tags
                'rce': 'Remote Command Execution',
                'rci': 'Remote Code Injection',
                'ssrf': 'Server Side Request Forgery',
                'module': 'Vulnerable Node Module',
                'node': 'Application Related',
                'web': 'Web Security',
                'dir': 'Directory Traversal',
                'opr': 'Open Redirect Vulnerability',
                'sqli': 'SQL Injection (SQLi)',
                'xss': 'Cross Site Scripting (XSS)',
                'nosqli': 'NoSQL Injection',
                'hhi': 'HTTP Header Injection',
-->
    <rule name="Express BodyParser Tempfile Creation Issue">
        <signature>bodyParser()</signature>
        <description>POST Request to Express Body Parser 'bodyParser()' can create Temporary files and consume space.</description>
        <tag>module</tag>
    </rule>
    <rule name="Handlebars Unescaped String">
        <signature>handlebars.SafeString(</signature>
        <description>Handlebars SafeString will not escape the data passed through it. Untrusted user input passing through SafeString can cause XSS.</description>
        <tag>module</tag>
    </rule>
    <!-- All Regex Rules Go here -->
    <regex name="Server Side Injection(SSI) - eval()">
        <signature>(eval\()(.{0,40000})(req\.|req\.query|req\.body|req\.param)</signature>
        <description>User controlled data in eval() can result in Server Side Injection (SSI) or Remote Code Execution (RCE).</description>
        <tag>rci</tag>
    </regex>
    <regex name="Server Side Injection(SSI) - setTimeout()">
        <signature>(setTimeout\()(.{0,40000})(req\.|req\.query|req\.body|req\.param)</signature>
        <description>User controlled data in 'setTimeout()' can result in Server Side Injection (SSI) or Remote Code Execution (RCE).</description>
        <tag>rci</tag>
    </regex>
    <regex name="Server Side Injection(SSI) -setInterval()">
        <signature>(setInterval\()(.{0,40000})(req\.|req\.query|req\.body|req\.param)</signature>
        <description>User controlled data in 'setInterval()' can result in Server Side Injection (SSI) or Remote Code Execution (RCE).</description>
        <tag>rci</tag>
    </regex>
    <regex name="Server Side Injection(SSI) - new Function()">
        <signature>(new Function\()(.{0,40000})(req\.|req\.query|req\.body|req\.param)</signature>
        <description>User controlled data in 'new Function()' can result in Server Side Injection (SSI) or Remote Code Execution (RCE).</description>
        <tag>rci</tag>
    </regex>
    <regex name="Deserialization Remote Code Injection">
        <signature>(deserialize\(|unserialize\()</signature>
        <description>User controlled data in 'unserialize()' or 'deserialize()' function can result in Object Injection or Remote Code Injection.</description>
        <tag>rci</tag>
    </regex>
    <regex name="Loading of untrusted YAML can cause Remote Code Injection">
        <signature>(require\('js-yaml'\)\.load\(|yaml\.load\()</signature>
        <description>User controlled data in 'load()' function can result in Remote Code Injection.</description>
        <tag>rci</tag>
    </regex>
    <regex name="Accept Self Signed Certificates">
        <signature>(\[)*('|")*NODE_TLS_REJECT_UNAUTHORIZED('|")*(\])*(\s)*=(\s)*('|")*0('|")*</signature>
        <description>'Setting 'NODE_TLS_REJECT_UNAUTHORIZED' to 0 will allow node server to accept self signed certificates and is not an secure behaviour.</description>
        <tag>node</tag>
    </regex>
    <regex name="Escaping is Disabled">
        <signature>noEscape(\s)*:(\s)*true</signature>
        <description>Disabling Escaping Handlebars is not a secure behaviour.</description>
        <tag>module</tag>
    </regex>
    <regex name="node-curl SSL Verification is Disabled">
        <signature>SSL_VERIFYPEER(\s)*:(\s)*0</signature>
        <description>SSL Certificate verification for node-curl is disabled.</description>
        <tag>node</tag>
    </regex>
    <regex name="Weak Hash used - MD5">
        <signature>createHash\(('|")md5('|")</signature>
        <description>MD5 is a a weak hash which is known to have collision. Use a strong hashing function.</description>
        <tag>node</tag>
    </regex>
    <regex name="Weak Hash used - SHA1">
        <signature>createHash\(('|")sha1('|")</signature>
        <description>SHA1 is a a weak hash which is known to have collision. Use a strong hashing function.</description>
        <tag>node</tag>
    </regex>
    <regex name="Password Hardcoded">
        <signature>password\s*=\s*['|"].+['|"]\s{0,5}[;|.]</signature>
        <description>A hardcoded password in plain text was identified.</description>
        <tag>node</tag>
    </regex>
    <regex name="Password Hardcoded">
        <signature>\s*['|\"]password['|\"]\s*:</signature>
        <description>A hardcoded password in plain text was identified.</description>
        <tag>node</tag>
    </regex>
    <regex name="Secret Hardcoded">
        <signature>\s*['|\"]+secret['|\"]+\s*:|\s*secret\s*:\s*['|\"]+</signature>
        <description>A hardcoded secret was identified.</description>
        <tag>node</tag>
    </regex>
    <regex name="Username Hardcoded">
        <signature>username\s*=\s*['|"].+['|"]\s{0,5}[;|.]</signature>
        <description>A hardcoded username in plain text was identified. Store it properly in a config file.</description>
        <tag>node</tag>
    </regex>
    <regex name="XSS Filter is turned off">
        <signature>lusca.xssProtection\(false\)|X-XSS-Protection('|")*(\s)*(:|,)(\s)*('|")*0</signature>
        <description>X-XSS-Protection header is set to 0. This will disable the browser's XSS Filter.</description>
        <tag>node</tag>
    </regex>
    <regex name="Directory Traversal - (createReadStream())">
        <signature>(\.createReadStream\()(.{0,40000})(req\.|req\.query|req\.body|req\.param)</signature>
        <description>Untrusted user input in createReadStream() can endup in Directory Traversal Attacks</description>
        <tag>dir</tag>
    </regex>
    <regex name="Directory Traversal - (readFile())">
        <signature>(\.readFile\()(.{0,40000})(req\.|req\.query|req\.body|req\.param)</signature>
        <description>Untrusted user input in readFile() can endup in Directory Traversal Attacks</description>
        <tag>dir</tag>
    </regex>
    <regex name="Open Redirect">
        <signature>(res\.redirect\()( *)(req\.|req\.query|req\.body|req\.param)</signature>
        <description>Untrusted user input in redirect() can result in Open Redirect vulnerability</description>
        <tag>opr</tag>
    </regex>
    <regex name="SQLi - SQL Injection">
        <signature>(SELECT|INSERT|UPDATE|DELETE|CREATE|EXPLAIN)(.{0,40000})(req\.|req\.query|req\.body|req\.param)</signature>
        <description>Untrusted User Input in RAW SQL Query can cause SQL Injection</description>
        <tag>sqli</tag>
    </regex>
    <regex name ="NoSQLi - NoSQL JavaScript Injection">
        <signature>(\.)(find|drop|create|explain|delete|count|bulk|copy)(.{0,4000})({(.{0,4000})\$where:)(.{0,4000})(req\.|req\.query|req\.body|req\.param)</signature>
        <description>Untrusted User Input in Vulnerable Mongo DB functions can cause NoSQLi JavaScript Injection</description>
        <tag>nosqli</tag>
    </regex>
    <regex name="XSS - Reflected Cross Site Scripting">
        <signature>(res\.(write|send)\()(.{0,40000})(req\.|req\.query|req\.body|req\.param)</signature>
        <description>Untrusted User Input in Response will result in Reflected Cross Site Scripting Vulnerability</description>
        <tag>xss</tag>
    </regex>
    <regex name="HTTP Header Injection Vulnerability">
        <signature>(res\.set\()(.{0,40000})(req\.|req\.query|req\.body|req\.param)</signature>
        <description>Untrusted user input in set() will result in HTTP Header Injection or Splitting Attacks</description>
        <tag>hhi</tag>
    </regex>
    <!-- Template Rules -->
    <regex name="Unescaped variable in Mustache.js/Handlebars.js template file">
        <signature>{{{\s*[\w.\[\]\(\)]+\s*}}}</signature>
        <description>The Handlebar.js/Mustache.js template has an unescaped variable. Untrusted user input passed to this variable results in Cross Site Scripting (XSS).</description>
        <tag>xss</tag>
    </regex>
    <regex name="Unescaped variable in Dust.js template file">
        <signature>{\s*[\w.\[\]\(\)]+\s*\|\s*s\s*}</signature>
        <description>The Dust.js template has an unescaped variable. Untrusted user input passed to this variable results in Cross Site Scripting (XSS).</description>
        <tag>xss</tag>
    </regex>
    <regex name="Unescaped variable in Pug.js template file">
        <signature>#{\s*[\w.\[\]\(\)\'\"]+\s*}</signature>
        <description>The Pug.js template has an unescaped variable. Untrusted user input passed to this variable results in Cross Site Scripting (XSS).</description>
        <tag>xss</tag>
    </regex>
    <regex name="Unescaped variable in EJS template file">
        <signature>&lt;%-\s*[\w.\[\]\(\)]+\s*%&gt;</signature>
        <description>The EJS template has an unescaped variable. Untrusted user input passed to this variable results in Cross Site Scripting (XSS).</description>
        <tag>xss</tag>
    </regex>
    <regex name="Unescaped variable in ECT template file">
        <signature>&lt;%-\s*@+[\w.\[\]\(\)]+\s*%&gt;</signature>
        <description>The ECT template has an unescaped variable. Untrusted user input passed to this variable results in Cross Site Scripting (XSS).</description>
        <tag>xss</tag>
    </regex>
    <!--Multi Match Regex-->
    <mulregex name="Remote OS Command Execution - (child_process.exec())">
        <sig_source>require( )*(\()( *)('|")child_process('|")( *)(\))</sig_source>
        <sig_line>(\.exec\()(.{0,40000})(req\.|req\.query|req\.body|req\.param)</sig_line>
        <description>User controlled data in 'child_process.exec()' can result in Remote OS Command Execution.</description>
        <tag>rce</tag>
    </mulregex>
    <!--Dynamic Regex -->
    <dynregex name="SSRF - Server Side Request Forgery - request()">
        <signature>require( )*(\()( *)('|")request('|")( *)(\))</signature>
        <!--variable(req.body.x)-->
        <dyn_sig>(\()(.*?)(req\.|req\.query|req\.body|req\.param)</dyn_sig>
        <description>User controlled data in 'request()' can result in Server Side Request Forgery (SSRF).</description>
        <tag>ssrf</tag>
    </dynregex>
    <dynregex name="SSRF - Server Side Request Forgery - request.get()">
        <signature>require( )*(\()( *)('|")request('|")( *)(\))</signature>
        <!--variable.get(req.body.x)-->
        <dyn_sig>\.get( *)(\()(.*?)(req\.|req\.query|req\.body|req\.param)</dyn_sig>
        <description>User controlled data in 'request.get()' can result in Server Side Request Forgery (SSRF).</description>
        <tag>ssrf</tag>
    </dynregex>
    <dynregex name="SSRF - Server Side Request Forgery - needle()">
        <signature>require( )*(\()( *)('|")needle('|")( *)(\))</signature>
        <!--variable.get(req.body.x)-->
        <dyn_sig>\.get( *)(\()(.*?)(req\.|req\.query|req\.body|req\.param)</dyn_sig>
        <description>User controlled data in 'needle.get()' can result in Server Side Request Forgery (SSRF).</description>
        <tag>ssrf</tag>
    </dynregex>
    <!-- All missing Secure Code goes here -->
    <!---if express is used express.limit\(('|")-->
    <!--end if-->
    <missing_header name="Missing Security Header - Content-Security-Policy (CSP)">
        <signature>require\(('|")helmet-csp('|")\)|helmet.csp|lusca.csp\(|Content-Security-Policy</signature>
        <description>Content Security Policy (CSP), a mechanism web applications can use to mitigate a broad class of content injection vulnerabilities, such as cross-site scripting (XSS). CSP Header was not found.</description>
        <tag>web</tag>
    </missing_header>
    <missing_header name="Missing Security Header - X-Frame-Options (XFO)">
        <signature>helmet.xframe|lusca.xframe\(|require\(('|")frameguard('|")\)|frameguard\(|X-Frame-Options</signature>
        <description>X-Frame-Options (XFO) header provides protection against Clickjacking attacks.</description>
        <tag>web</tag>
    </missing_header>
    <missing_header name="Missing Security Header - Strict-Transport-Security (HSTS)">
        <signature>helmet.hsts\({|lusca.hsts\({|hsts\({|require\(('|")hsts('|")\)|Strict-Transport-Security</signature>
        <description>Strict-Transport-Security (HSTS) header enforces secure (HTTP over SSL/TLS) connections to the server.</description>
        <tag>web</tag>
    </missing_header>
    <missing_header name="Missing Security Header - Public-Key-Pins (HPKP)">
        <signature>Public-Key-Pins(:|,)*</signature>
        <description>Public-Key-Pins (HPKP) ensures that certificate is Pinned.</description>
        <tag>web</tag>
    </missing_header>
    <missing_header name="Missing Security Header - X-XSS-Protection:1">
        <signature>helmet.xssFilter\(\)|lusca.xssProtection\(true\)|X-XSS-Protection('|")*(\s)*(:|,)(\s)*('|")*1</signature>
        <description>X-XSS-Protection header set to 1 enables the Cross-site scripting (XSS) filter built into most recent web browsers.</description>
        <tag>web</tag>
    </missing_header>
    <missing_header name="Missing Security Header - X-Content-Type-Options">
        <signature>helmet.noSniff|require\(('|")dont-sniff-mimetype('|")\)|nosniff\(\)|X-Content-Type-Options('|")*(\s)*(:|,)(\s)*('\"")*nosniff</signature>
        <description>X-Content-Type-Options header prevents Internet Explorer and Google Chrome from MIME-sniffing a response away from the declared content-type.</description>
        <tag>web</tag>
    </missing_header>
    <missing_header name="Missing Security Header - X-Download-Options: noopen">
        <signature>require\(('|")ienoopen('|")\)|ienoopen\(|helmet.ienoopen\(|X-Download-Options('|")*(\s)*(:|,)(\s)*('\"")*noopen</signature>
        <description>X-Download-Options header set to noopen prevents IE users from directly opening and executing downloads in your site's context.</description>
        <tag>web</tag>
    </missing_header>
    <missing_header name="Missing 'httpOnly' in Cookie">
        <signature>httpOnly(\s)*:(\s)*true|httpOnly</signature>
        <description>JavaScript can access Cookies if they are not marked httpOnly.</description>
        <tag>web</tag>
    </missing_header>
    <missing_header name="Infromation Disclosure - X-Powered-By">
        <signature>.disable\(('|")x-powered-by('|")\)|require\(('|")hide-powered-by('|")\)|hidePoweredBy\(|helmet.hidePoweredBy\(|removeHeader\(('|")X-Powered-By('|")\)</signature>
        <description>Remove the X-Powered-By header to prevent information gathering.</description>
        <tag>web</tag>
    </missing_header>
    <!--Good to have Security Libs -->
    <good_to_have name="Use Strict">
        <signature>("|')use strict("|');</signature>
        <description>Strict Mode allows you to place a program, or a function, in a "strict" operating context. This strict context prevents certain actions from being taken and throws more exceptions.</description>
        <tag>node</tag>
    </good_to_have>
</rules>
<!--Need List of Known Bad Regex -->