diff --git a/pkg/commands/process/settings/rules/javascript/lang/http_insecure.yml b/pkg/commands/process/settings/rules/javascript/lang/http_insecure.yml index f2879edf4..09bff2eba 100644 --- a/pkg/commands/process/settings/rules/javascript/lang/http_insecure.yml +++ b/pkg/commands/process/settings/rules/javascript/lang/http_insecure.yml @@ -14,6 +14,11 @@ patterns: - post - patch - delete + - pattern: | + axios($) + filters: + - variable: INSECURE_CONFIG + detection: javascript_http_insecure_axios_object - pattern: | fetch($$<...>) filters: @@ -29,6 +34,14 @@ patterns: - req - request - xhttp +auxiliary: + - id: javascript_http_insecure_axios_object + patterns: + - pattern: | + { url: $ } + filters: + - variable: INSECURE_URL + detection: insecure_url languages: - javascript trigger: presence diff --git a/pkg/commands/process/settings/rules/javascript/lang/http_insecure/.snapshots/TestJavascriptHTTPInsecure--axios_with_config_insecure.yml b/pkg/commands/process/settings/rules/javascript/lang/http_insecure/.snapshots/TestJavascriptHTTPInsecure--axios_with_config_insecure.yml new file mode 100644 index 000000000..6603ceb18 --- /dev/null +++ b/pkg/commands/process/settings/rules/javascript/lang/http_insecure/.snapshots/TestJavascriptHTTPInsecure--axios_with_config_insecure.yml @@ -0,0 +1,13 @@ +low: + - rule: + cwe_ids: + - "319" + id: javascript_http_insecure + description: Connection with an unsecure HTTP communication detected. + documentation_url: https://docs.bearer.com/reference/rules/javascript_http_insecure + line_number: 7 + filename: axios_with_config_insecure.js + parent_line_number: 7 + parent_content: axios(config) + + diff --git a/pkg/commands/process/settings/rules/javascript/lang/http_insecure/testdata/axios_with_config_insecure.js b/pkg/commands/process/settings/rules/javascript/lang/http_insecure/testdata/axios_with_config_insecure.js new file mode 100644 index 000000000..f95e15f99 --- /dev/null +++ b/pkg/commands/process/settings/rules/javascript/lang/http_insecure/testdata/axios_with_config_insecure.js @@ -0,0 +1,7 @@ +const insecure_url = "http://domain.com/api/movies"; +const config = { + method: "GET", + headers: { "content-type": "application/json" }, + url: insecure_url, +}; +axios(config);