mirror of
https://github.com/github/codeql.git
synced 2026-01-12 06:00:23 +01:00
19 lines
572 B
Plaintext
19 lines
572 B
Plaintext
/**
|
|
* @name Disabling Electron webSecurity
|
|
* @description Disabling webSecurity can cause critical security vulnerabilities.
|
|
* @kind problem
|
|
* @problem.severity error
|
|
* @precision very-high
|
|
* @tags security
|
|
* frameworks/electron
|
|
* @id js/disabling-electron-websecurity
|
|
*/
|
|
|
|
import javascript
|
|
|
|
from DataFlow::PropWrite webSecurity, Electron::WebPreferences preferences
|
|
where
|
|
webSecurity = preferences.getAPropertyWrite("webSecurity") and
|
|
webSecurity.getRhs().mayHaveBooleanValue(false)
|
|
select webSecurity, "Disabling webSecurity is strongly discouraged."
|