42 Rules
| ID | Name | Severity |
|---|---|---|
| 1020700 | Avoid the lack of error handling in the Node.js callbacks |
medium
|
| 1020702 | Avoid using nodejs process.exit() |
medium
|
| 1020704 | Avoid using string concatenation when using __dirname and __filename |
medium
|
| 1020706 | Ensure the Content-Security-Policy is activated (Node.js) |
high
|
| 1020708 | Ensure the X-Powered-By header is disabled |
high
|
| 1020710 | Ensure the X-XSS-Protection header is enabled |
critical
|
| 1020712 | Ensure the X-Frame-Options header is setup (Node.js) |
high
|
| 1020714 | Avoid having multiple routes for the same path with Node.js Express App |
critical
|
| 1020716 | Avoid using the call of web service with Node.js http.get or http.request inside a loop |
critical
|
| 1020718 | Ensure that browser cannot cache or store a page |
medium
|
| 1020720 | Avoid unsecure connection to the Node.js server |
high
|
| 1020722 | Avoid enabling unsecure Node.js server |
high
|
| 1020724 | Ensure that marked is sanitized |
high
|
| 1020726 | Ensure that CSRF Protection is enabled (Node.js) |
critical
|
| 1020728 | Avoid creating cookie without setting httpOnly option (Node.js) |
high
|
| 1020730 | Ensure Node.js filesystem are closed |
medium
|
| 1020732 | Avoid using risky cryptographic hash (Node.js) |
critical
|
| 1020734 | Avoid using unsecured cookie (Node.js) |
high
|
| 1020736 | Avoid bypassing self-signed ssl certificate (Node.js) |
high
|
| 1020738 | Avoid disabling SSL verification in node-curl |
high
|
| 1020740 | Avoid creating cookie with overly broad path (Node.js) |
high
|
| 1020742 | Avoid creating cookie with overly broad domain (Node.js) |
high
|
| 1020744 | Avoid using TLS library before Node.js 9.11.2 and 10.4.1 |
critical
|
| 1020746 | Avoid using HTTP/2 library with vulnerable versions |
critical
|
| 1020748 | Avoid using the call of data service with Node.js inside a loop |
critical
|
| 1020750 | Avoid using the file path validation with Node.js 8.5.0 |
critical
|
| 1020758 | Avoid using Buffer.fill() and/or Buffer.alloc() with vulnerable versions |
critical
|
| 1020760 | Avoid using Buffer library and UCS-2 encoding with vulnerable versions |
critical
|
| 1020762 | Avoid using url.parse() with vulnerable versions |
critical
|
| 1020764 | Avoid using path library parsing functions with vulnerable versions |
critical
|
| 1020766 | Avoid using Node.js ps library with vulnerable versions |
critical
|
| 1020768 | Avoid using net.Socket object as stream with vulnerable version of Node.js |
critical
|
| 1020770 | Avoid using Node.js query-mysql third-party before 0.0.3 |
critical
|
| 1020772 | Avoid Javascript string interpolations to prevent SQL injections |
critical
|
| 1020774 | Avoid having multiple Artifacts updating data on the same NoSQL Collection (Javascript) |
medium
|
| 1020776 | Avoid having multiple Artifacts inserting data on the same NoSQL Collection (Javascript) |
medium
|
| 1020778 | Avoid having multiple artifacts deleting data on the same NoSQL collections (Javascript) |
medium
|
| 1020780 | Avoid using Node.js synchronous FileSystem API without try/catch block |
medium
|
| 1020782 | Avoid using Buffer deprecated APIs |
critical
|
| 1020784 | Avoid using node-serialize 0.0.4 with Node.js |
critical
|
| 1020786 | Avoid using serialize-to-js 0.5.0 with Node.js |
critical
|
| 1020788 | Avoid using moment before 2.19.3 with Node.js |
critical
|
