Top 10 OWASP rules for JS

[gotbadger]

We want to improve curio to cover more general security related issues.

To do this we want to implement JS rules that cover the top 10 OWASP issues:

• A01:2021-Broken Access Control
  • [x] CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') -->
  • https://github.com/Bearer/bearer/pull/645
  • https://github.com/Bearer/bearer/pull/709
  • [x] CWE-548 Exposure of Information Through Directory Listing
  • https://github.com/Bearer/curio/pull/617
  • [x] CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
  • https://github.com/Bearer/bearer/pull/641
  • [x] CWE-706 Use of Incorrectly-Resolved Name or Reference
  • https://github.com/Bearer/bearer/pull/634
• A02:2021-Cryptographic Failures
  • [x] CWE-319 Cleartext Transmission of Sensitive Information
  • https://github.com/Bearer/bearer/pull/551
  • [x] CWE-327 Use of a Broken or Risky Cryptographic Algorithm
  • Existing JWT rule: https://github.com/Bearer/bearer/blob/main/pkg/commands/process/settings/rules/javascript/lang/jwt_weak_encryption.yml
  • [x] CWE-523 Unprotected Transport of Credentials
  • https://github.com/Bearer/bearer/pull/687
  • [x] CWE-916 Use of Password Hash With Insufficient Computational Effort
  • https://github.com/Bearer/bearer/pull/689
• A03:2021-Injection
  • [x] CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
  • https://github.com/Bearer/bearer/pull/661
  • [x] CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • https://github.com/Bearer/bearer/pull/643
  • https://github.com/Bearer/bearer/pull/693
  • [x] CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
  • https://github.com/Bearer/bearer/pull/648
  • https://github.com/Bearer/bearer/pull/655
  • [x] CWE-94 Improper Control of Generation of Code ('Code Injection')
  • https://github.com/Bearer/bearer/pull/726
  • [x] CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
  • https://github.com/Bearer/bearer/pull/658
  • [x] CWE-943 Improper Neutralization of Special Elements in Data Query Logic
  • https://github.com/Bearer/bearer/pull/664
  • [x] CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
  • https://github.com/Bearer/bearer/pull/712
• A04:2021-Insecure Design
  • [x] CWE-73 External Control of File Name or Path
  • https://github.com/Bearer/bearer/pull/622
  • [x] CWE-451 User Interface (UI) Misrepresentation of Critical Information
  • https://github.com/Bearer/bearer/pull/651
  • [ ] CWE-522 Insufficiently Protected Credentials
  • [x] CWE-525 Use of Web Browser Cache Containing Sensitive Information
  • https://github.com/Bearer/bearer/pull/695
  • [x] CWE-1021 Improper Restriction of Rendered UI Layers or Frames
  • https://github.com/Bearer/bearer/pull/651
• A05:2021-Security Misconfiguration
  • [x] CWE-611 Improper Restriction of XML External Entity Reference
  • https://github.com/Bearer/bearer/pull/619
  • https://github.com/Bearer/bearer/pull/640
• A06:2021-Vulnerable and Outdated Components
• A07:2021-Identification and Authentication Failures
  • [x] CWE-346 Origin Validation Error
  • https://github.com/Bearer/bearer/pull/707
  • [x] CWE-798 Use of Hard-coded Credentials
  • https://github.com/Bearer/bearer/pull/678
  • https://github.com/Bearer/bearer/pull/705
• A08:2021-Software and Data Integrity Failures
  • [ ] CWE-345 Insufficient Verification of Data Authenticity
  • [x] CWE-502 Deserialization of Untrusted Data
  • https://github.com/Bearer/bearer/pull/630
• A09:2021-Security Logging and Monitoring Failures
• A10:2021-Server-Side Request Forgery
  • [x] CWE-918 Server-Side Request Forgery (SSRF)
  • https://github.com/Bearer/bearer/pull/636

[gotbadger]

closed for milestone 2