feat(JS rules): add rule for express cross-site scripting

integration/rules/javascript_test.go

@@ -50,6 +50,7 @@ func TestJavascriptExpressUnsafeDeserialization(t *testing.T) {
 }
 
 func TestJavascriptExpressInsecureRefResolution(t *testing.T) {
+	t.Parallel()
 	getRunner(t).runTest(t, javascriptRulesPath+"express/insecure_ref_resolution")
 }
 
@@ -58,7 +59,13 @@ func TestJavascriptExpressExposedDirListing(t *testing.T) {
 	getRunner(t).runTest(t, javascriptRulesPath+"express/exposed_dir_listing")
 }
 
+func TestJavascriptExpressCrossSiteScripting(t *testing.T) {
+	t.Parallel()
+	getRunner(t).runTest(t, javascriptRulesPath+"express/cross_site_scripting")
+}
+
 func TestJavascriptExpressServerSideRequestForgery(t *testing.T) {
+	t.Parallel()
 	getRunner(t).runTest(t, javascriptRulesPath+"express/server_side_request_forgery")
 }
 

pkg/commands/process/settings/rules/javascript/express/cross_site_scripting.yml

@@ -0,0 +1,28 @@
+patterns:
+  - pattern: |
+      res.write($<EXPRESS_REQ>)
+    filters:
+      - variable: EXPRESS_REQ
+        detection: javascript_express_cross_site_scripting_request_obj
+  - pattern: |
+      res.send($<EXPRESS_REQ>)
+    filters:
+      - variable: EXPRESS_REQ
+        detection: javascript_express_cross_site_scripting_request_obj
+auxiliary:
+  - id: javascript_express_cross_site_scripting_request_obj
+    patterns:
+      - req.$<_>
+languages:
+  - javascript
+trigger: presence
+severity:
+  default: low
+metadata:
+  description: "Cross-site scripting (XSS) vulnerability detected."
+  remediation_message: |
+    ## Description
+    TODO
+  cwe_id:
+    - 79
+  id: "javascript_express_cross_site_scripting"

pkg/commands/process/settings/rules/javascript/express/cross_site_scripting/.snapshots/TestJavascriptExpressCrossSiteScripting--no_xss.yml

@@ -0,0 +1,3 @@
+{}
+
+

pkg/commands/process/settings/rules/javascript/express/cross_site_scripting/.snapshots/TestJavascriptExpressCrossSiteScripting--res_send_xss.yml

@@ -0,0 +1,11 @@
+low:
+    - rule_dsrid: ""
+      rule_display_id: javascript_express_cross_site_scripting
+      rule_description: Cross-site scripting (XSS) vulnerability detected.
+      rule_documentation_url: https://docs.bearer.com/reference/rules/javascript_express_cross_site_scripting
+      line_number: 5
+      filename: res_send_xss.js
+      parent_line_number: 5
+      parent_content: res.send("<p>" + req.body.customer.name + "</p>")
+
+

pkg/commands/process/settings/rules/javascript/express/cross_site_scripting/.snapshots/TestJavascriptExpressCrossSiteScripting--res_write_xss.yml

@@ -0,0 +1,11 @@
+low:
+    - rule_dsrid: ""
+      rule_display_id: javascript_express_cross_site_scripting
+      rule_description: Cross-site scripting (XSS) vulnerability detected.
+      rule_documentation_url: https://docs.bearer.com/reference/rules/javascript_express_cross_site_scripting
+      line_number: 6
+      filename: res_write_xss.js
+      parent_line_number: 6
+      parent_content: res.write("<h3> Greetings " + customerName + "</h3>")
+
+

pkg/commands/process/settings/rules/javascript/express/cross_site_scripting/testdata/no_xss.js

@@ -0,0 +1,6 @@
+const express = require("express");
+const app = express();
+
+app.get("/goos", (_, res) => {
+  res.send("<p>hello world</p>")
+})

pkg/commands/process/settings/rules/javascript/express/cross_site_scripting/testdata/res_send_xss.js

@@ -0,0 +1,6 @@
+const express = require("express");
+const app = express();
+
+app.get("/bad", (req, res) => {
+  res.send("<p>" + req.body.customer.name + "</p>")
+})

pkg/commands/process/settings/rules/javascript/express/cross_site_scripting/testdata/res_write_xss.js

@@ -0,0 +1,7 @@
+const express = require("express");
+const app = express();
+
+app.get("/bad", (req, res) => {
+  var customerName = req.body.customer.name
+  res.write("<h3> Greetings " + customerName + "</h3>")
+})