Semgrep rule to detect potential xss in rest handlers

phantomcyber / dev-cicd-tools

Apache License 2.0

4 stars 1 forks source link

Closed pzhou-splunk closed 2 years ago

pzhou-splunk commented 2 years ago

Adding a semgrep rule to detect potential XSS from the return values of REST handlers
- see https://splunk.atlassian.net/browse/PAPP-10251 for an example
- The OAuth/SAML question in the ProdSec questionnaire was actually intended to catch this issue