add support for nodeintegrationinsubframes in HTML, close #52

doyensec · Oct 28, 2019 · 02d9ea1 · 02d9ea1
1 parent 3bc9453
commit 02d9ea1
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/src/finder/checks/AtomicChecks/NodeIntegrationHTMLCheck.js b/src/finder/checks/AtomicChecks/NodeIntegrationHTMLCheck.js
@@ -14,7 +14,9 @@ export default class NodeIntegrationHTMLCheck {
     const self = this;
     webviews.each(function (i, elem) {
       const nodeintegration = cheerioObj(this).attr('nodeintegration');
-      if (nodeintegration !== undefined) {
+      const nodeintegrationInSubframes = cheerioObj(this).attr('nodeintegrationinsubframes');
+
+      if (nodeintegration !== undefined || nodeintegrationInSubframes !== undefined) {
         loc.push({ line: content.substr(0, elem.startIndex).split('\n').length, column: 0, id: self.id, description: self.description, severity: severity.HIGH, confidence: confidence.FIRM, manualReview: false });
       }
     });

diff --git a/test/checks/AtomicChecks/NODE_INTEGRATION_HTML_CHECK_5_1.html b/test/checks/AtomicChecks/NODE_INTEGRATION_HTML_CHECK_5_1.html
@@ -0,0 +1 @@
+<webview src="https://doyensec.com/" nodeintegrationinsubframes></webview>