Skip to content

Commit d00f670

Browse files
joefarebrotherjoefarebrother
committed
Add qhelp
1 parent 3107edf commit d00f670

File tree

6 files changed

+119
-7
lines changed

6 files changed

+119
-7
lines changed

‎go/ql/src/Security/CWE-1004/CookieWithoutHttpOnly.qhelp‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
6+
<overview>
7+
<p>Cookies without the <code>HttpOnly</code> flag set are accessible to client-side scripts such as JavaScript running in the same origin.
8+
In case of a Cross-Site Scripting (XSS) vulnerability, the cookie can be stolen by a malicious script.
9+
If a sensitive cookie does not need to be accessed directly by client-side JS, the <code>HttpOnly</code> flag should be set.</p>
10+
</overview>
11+
12+
<recommendation>
13+
<p>
14+
Set the <code>HttpOnly</code> flag to <code>true</code> for authentication cookies to ensure they are not accessible to client-side scripts.
15+
</p>
16+
</recommendation>
17+
18+
<example>
19+
<p>
20+
In the following example, in the case marked BAD, the <code>HttpOnly</code> flag is not set, so the default value of <code>false</code> is used.
21+
In the case marked GOOD, the <code>HttpOnly</code> flag is set to <code>true</code>.
22+
</p>
23+
<sample src="examples/CookieWithoutHttpOnly.go"/>
24+
25+
26+
</example>
27+
28+
<references>
29+
30+
<li>MDN: <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie">Set-Cookie</a> Header.</li>
31+
<li>PortSwigger: <a href="https://portswigger.net/kb/issues/00500600_cookie-without-httponly-flag-set">Cookie without HttpOnly flag set</a></li>
32+
33+
</references>
34+
</qhelp>

‎go/ql/src/Security/CWE-1004/CookieWithoutHttpOnly.ql‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,7 @@
11
/**
2-
* @name 'HttpOnly' attribute is not set to true
3-
* @description Omitting the 'HttpOnly' attribute for security sensitive data allows
4-
* malicious JavaScript to steal it in case of XSS vulnerability. Always set
5-
* 'HttpOnly' to 'true' to authentication related cookie to make it
6-
* not accessible by JavaScript.
2+
* @name Cookie 'HttpOnly' attribute is not set to true
3+
* @description Sensitive cookies without the `HttpOnly` property set are accessible by client-side scripts such as JavaScript.
4+
* This makes them more vulnerable to being stolen by an XSS attack.
75
* @kind path-problem
86
* @problem.severity warning
97
* @precision high

‎go/ql/src/Security/CWE-1004/example/CookieWithoutHttpOnly.go‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
package main
2+
3+
import (
4+
"net/http"
5+
)
6+
7+
func handlerBad(w http.ResponseWriter, r *http.Request) {
8+
c := http.Cookie{
9+
Name: "session",
10+
Value: "secret",
11+
}
12+
http.SetCookie(w, &c) // BAD: The HttpOnly flag is set to false by default.
13+
}
14+
15+
func handlerGood(w http.ResponseWriter, r *http.Request) {
16+
c := http.Cookie{
17+
Name: "session",
18+
Value: "secret",
19+
HttpOnly: true,
20+
}
21+
http.SetCookie(w, &c) // GOOD: The HttpOnly flag is set to true.
22+
}

‎go/ql/src/Security/CWE-614/CookieWithoutSecure.qhelp‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
<!DOCTYPE qhelp PUBLIC
2+
"-//Semmle//qhelp//EN"
3+
"qhelp.dtd">
4+
<qhelp>
5+
6+
<overview>
7+
<p>Cookies without the <code>Secure</code> flag set may be transmitted using HTTP instead of HTTPS.
8+
This leaves them vulnerable to being read by a third party attacker. If a sensitive cookie such as a session
9+
key is intercepted this way, it would allow the attacker to perform actions on a user's behalf.</p>
10+
</overview>
11+
12+
<recommendation>
13+
<p>
14+
Set the <code>Secure</code> flag to <code>true</code> to ensure cookies are only transmitted over secure HTTPS connections.
15+
</p>
16+
</recommendation>
17+
18+
<example>
19+
<p>
20+
In the following example, in the case marked BAD, the <code>Secure</code> flag is set to <code>false</code> by default.
21+
In the case marked GOOD, the <code>Secure</code> flag is set to <code>true</code>.
22+
</p>
23+
<sample src="examples/CookieWithoutSecure.go"/>
24+
25+
26+
</example>
27+
28+
<references>
29+
30+
<li>MDN: <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie">Set-Cookie</a> Header.</li>
31+
<li>Detectify: <a href="https://support.detectify.com/support/solutions/articles/48001048982-cookie-lack-secure-flag">Cookie lack Secure flag</a>.</li>
32+
<li>PortSwigger: <a href="https://portswigger.net/kb/issues/00500200_tls-cookie-without-secure-flag-set">TLS cookie without secure flag set</a>.</li>
33+
34+
</references>
35+
</qhelp>

‎go/ql/src/Security/CWE-614/CookieWithoutSecure.ql‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
/**
2-
* @name 'Secure' attribute is not set to true
3-
* @description todo
2+
* @name Cookie 'Secure' attribute is not set to true
3+
* @description Cookies without the `Secure` flag may be sent in cleartext.
4+
* This makes them vulnerable to be intercepted by an attacker.
45
* @kind problem
56
* @problem.severity warning
67
* @precision high

‎go/ql/src/Security/CWE-614/example/CookieWithoutSecure.go‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
package main
2+
3+
import (
4+
"net/http"
5+
)
6+
7+
func handlerBad(w http.ResponseWriter, r *http.Request) {
8+
c := http.Cookie{
9+
Name: "session",
10+
Value: "secret",
11+
}
12+
http.SetCookie(w, &c) // BAD: The Secure flag is set to false by default.
13+
}
14+
15+
func handlerGood(w http.ResponseWriter, r *http.Request) {
16+
c := http.Cookie{
17+
Name: "session",
18+
Value: "secret",
19+
Secure: true,
20+
}
21+
http.SetCookie(w, &c) // GOOD: The Secure flag is set to true.
22+
}

0 commit comments

Comments
 (0)