Skip to content

Instantly share code, notes, and snippets.

@qntm
Last active August 1, 2020 16:07
Show Gist options
  • Save qntm/d8431d444aa8e52291ad0bec7d97ce37 to your computer and use it in GitHub Desktop.
Save qntm/d8431d444aa8e52291ad0bec7d97ce37 to your computer and use it in GitHub Desktop.
Defeating AppScan false positives in JavaScript
// AppScan may flag up a call like this as "Insecure Use of Document.Write"
// because it isn't intelligent enough to know that this a call to a totally
// unrelated method also named `write`
const diffBuffer = PNG.sync.write(diffPng)
// Replace with:
// eslint-disable-next-line no-useless-call
const diffBuffer = PNG.sync.write.call(PNG.sync, diffPng)
///////////////////////////////
// AppScan raises "Authentication.Credentials.Unprotected" when it sees
// the key "password" in a JavaScript object
const obj = {
user: 'user1',
password: '********' // literal asterisks, we do not return the real password
}
// Simply quoting the string defeats this
const obj = {
user: 'user1',
// eslint-disable-next-line quote-props
'password': '********'
}
@qntm
Copy link
Author

qntm commented Mar 28, 2020

We had a requirement to start running HCL AppScan against all of our JavaScript code. It raised hundreds of false positive flags. However, AppScan provides no mechanism to individually exclude those flags in the source code itself. Instead, I found a variety of techniques to modify the code to equivalent code which AppScan is too unintelligent to flag.

Note that these changes may cause ESLint to complain, because it is intelligent. Luckily, ESLint is also smart enough to provide an exclusion mechanism.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment