Unsafe jQuery plugin¶
ID: js/unsafe-jquery-plugin
Kind: path-problem
Security severity: 6.1
Severity: warning
Precision: high
Tags:
- security
- external/cwe/cwe-079
- external/cwe/cwe-116
- frameworks/jquery
Query suites:
- javascript-code-scanning.qls
- javascript-security-extended.qls
- javascript-security-and-quality.qls
Click to see the query in the CodeQL repository
Library plugins, such as those for the jQuery library, are often configurable through options provided by the clients of the plugin. Clients, however, do not know the implementation details of the plugin, so it is important to document the capabilities of each option. The documentation for the plugin options that the client is responsible for sanitizing is of particular importance. Otherwise, the plugin may write user input (for example, a URL query parameter) to a web page without properly sanitizing it first, which allows for a cross-site scripting vulnerability in the client application through dynamic HTML construction.
Recommendation¶
Document all options that can lead to cross-site scripting attacks, and guard against unsafe inputs where dynamic HTML construction is not intended.
Example¶
The following example shows a jQuery plugin that selects a DOM element, and copies its text content to another DOM element. The selection is performed by using the plugin option sourceSelector
as a CSS selector.
jQuery.fn.copyText = function(options) {
// BAD may evaluate `options.sourceSelector` as HTML
var source = jQuery(options.sourceSelector),
text = source.text();
jQuery(this).text(text);
}
This is, however, not a safe plugin, since the call to jQuery
interprets sourceSelector
as HTML if it is a string that starts with <
.
Instead of documenting that the client is responsible for sanitizing sourceSelector
, the plugin can use jQuery.find
to always interpret sourceSelector
as a CSS selector:
jQuery.fn.copyText = function(options) {
// GOOD may not evaluate `options.sourceSelector` as HTML
var source = jQuery.find(options.sourceSelector),
text = source.text();
jQuery(this).text(text);
}
References¶
OWASP DOM Based XSS.
Wikipedia: Cross-site scripting.
jQuery: Plugin creation.
Bootstrap: XSS vulnerable bootstrap plugins.
Common Weakness Enumeration: CWE-79.
Common Weakness Enumeration: CWE-116.