Adds XSJS CSRF and authorization queries #144
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
javascript/frameworks/xsjs/test/queries/XSJSAccess/service/exposed/.xsaccess
Fixed
Show fixed
Hide fixed
| { | ||
| "exposed": false, | ||
| "prevent_xsrf": false, | ||
| "authentication": null |
Check failure
Code scanning / CodeQL
Broken XSJS authentication
| { | ||
| "exposed": false, | ||
| "prevent_xsrf": true | ||
| } No newline at end of file |
Check failure
Code scanning / CodeQL
Broken XSJS authentication
| @@ -0,0 +1,18 @@ | |||
| { | |||
| "welcomeFile": "index.html", | |||
| "authenticationMethod": "none", | |||
Check failure
Code scanning / CodeQL
Broken XSJS authentication
| { | ||
| "source": "/bad/(.*)", | ||
| "destination": "srv_api", | ||
| "csrfProtection": false, |
Check failure
Code scanning / CodeQL
Disabled XSJS CSRF protection
| "source": "/bad/(.*)", | ||
| "destination": "srv_api", | ||
| "csrfProtection": false, | ||
| "authenticationType": "none" |
Check failure
Code scanning / CodeQL
Broken XSJS authentication
javascript/frameworks/xsjs/src/XSJSAuthentication/XSJSAuthentication.md
Outdated
Show resolved
Hide resolved
javascript/frameworks/xsjs/src/XSJSAuthentication/XSJSAuthentication.md
Outdated
Show resolved
Hide resolved
| ``` | ||
|
|
||
| ## References | ||
|
|
There was a problem hiding this comment.
A link to the documentation page about xs-app.json may be a useful addition: https://help.sap.com/docs/SAP_HANA_PLATFORM/4505d0bdaf4948449b7f7379d24d0f0d/5f77e58ec01b46f6b64ee1e2afe3ead7.html
javascript/frameworks/xsjs/lib/advanced_security/javascript/frameworks/xsjs/Xsaccess.qll
Outdated
Show resolved
Hide resolved
javascript/frameworks/xsjs/lib/advanced_security/javascript/frameworks/xsjs/Xsaccess.qll
Show resolved
Hide resolved
javascript/frameworks/xsjs/src/XSJSAuthentication/XSJSAuthentication.md
Outdated
Show resolved
Hide resolved
javascript/frameworks/xsjs/src/XSJSAuthentication/XSJSAuthentication.ql
Outdated
Show resolved
Hide resolved
javascript/frameworks/xsjs/src/XSJSCsrfDisabled/XSJSCsrfDisabled.md
Outdated
Show resolved
Hide resolved
javascript/frameworks/xsjs/src/XSJSCsrfDisabled/XSJSCsrfDisabled.md
Outdated
Show resolved
Hide resolved
javascript/frameworks/xsjs/src/XSJSAuthentication/XSJSAuthentication.md
Outdated
Show resolved
Hide resolved
javascript/frameworks/xsjs/src/XSJSCsrfDisabled/XSJSCsrfDisabled.ql
Outdated
Show resolved
Hide resolved
jeongsoolee09
left a comment
jeongsoolee09
left a comment
There was a problem hiding this comment.
We're off to a good start! I've left some thoughts here and there.
Co-authored-by: Jeongsoo Lee <[email protected]>
| { | ||
| "exposed": false, | ||
| "authentication": null | ||
| } No newline at end of file |
Check failure
Code scanning / CodeQL
Disabled XSJS CSRF protection
Adds 2 queries and related tests: