Owasp Javascript

OWASP Top 10 — JavaScript/TypeScript

Map every finding to an OWASP category. Use CWE IDs where applicable.

A01: Broken Access Control

Look for:

• Missing auth middleware on routes
• IDOR: GET /api/orders/:id without ownership check
• Client-side-only access control
• JWT role claims trusted without server verification
• Directory traversal in file serving

rg -n "router\.(get|post|put|delete)|app\.(get|post)" --glob "*.{js,ts}" -A3 | rg -v "auth|requireAuth|isAuthenticated"
rg -n "req\.(params|query|body)\.\w+.*find|findOne|findUnique" --glob "*.{js,ts}"

Remediation: Enforce authorization server-side on every request. Use RBAC/ABAC. Deny by default.

A02: Cryptographic Failures

Look for:

• Passwords stored with MD5/SHA1
• Hardcoded encryption keys
• Math.random() for tokens
• TLS verification disabled
• Sensitive data in logs

rg -n "md5|sha1|createHash\('md5|Math\.random\(\)" --glob "*.{js,ts}"
rg -n "rejectUnauthorized:\s*false" --glob "*.{js,ts}"

Remediation: bcrypt/argon2 for passwords, crypto.randomBytes for tokens, TLS everywhere.

A03: Injection

Look for:

• SQL/NoSQL injection via string concatenation
• Command injection via child_process
• LDAP/XPath injection
• Template injection in server-side rendering

rg -n "query\(\`|query\(\s*['\"].*\+|exec\(|execSync\(|spawn\(" --glob "*.{js,ts}"
rg -n "\$where|mapReduce|aggregate.*\$" --glob "*.{js,ts}"

Remediation: Parameterized queries, ORM safe APIs, input validation, never pass user input to shell.

A04: Insecure Design

Look for:

• No rate limiting on sensitive flows
• Missing threat model for critical features
• Business logic flaws (negative prices, race conditions)
• Unlimited resource consumption

Remediation: Threat modeling, secure design patterns, business logic tests, quotas.

A05: Security Misconfiguration

Look for:

• Default credentials
• Verbose error pages in production
• Missing security headers
• Unnecessary features enabled (GraphQL introspection, debug endpoints)
• Open S3 buckets / public cloud storage

rg -n "NODE_ENV|stack|err\.message|err\.stack" --glob "*.{js,ts}"
rg -n "introspection|graphiql|playground" --glob "*.{js,ts}" -i

Remediation: Hardening guides, automated config scanning, principle of least privilege.

A06: Vulnerable and Outdated Components

Look for:

• Known CVEs in dependencies
• Unpinned dependencies
• Abandoned packages

Load dependency-audit for full workflow.

A07: Identification and Authentication Failures

Look for:

• Weak password policy
• Credential stuffing (no rate limit)
• Session not invalidated on logout
• JWT without expiry or with alg: none
• Missing MFA for admin

rg -n "jwt\.sign|jsonwebtoken" --glob "*.{js,ts}" -A5
rg -n "session|cookie" --glob "*.{js,ts}" -i

Remediation: MFA, secure session management, account lockout, OAuth best practices.

A08: Software and Data Integrity Failures

Look for:

• Unsigned auto-updates
• CI/CD pipeline without integrity checks
• npm install without lockfile verification
• Unsigned webhooks

Load supply-chain-security.

A09: Security Logging and Monitoring Failures

Look for:

• No logging on auth failures
• Logs missing correlation IDs
• Sensitive data in logs
• No alerting on anomalies

Remediation: Structured logging, SIEM integration, alert on brute force / privilege changes.

A10: Server-Side Request Forgery (SSRF)

Look for:

• fetch(userProvidedUrl)
• Image/document processors fetching URLs
• Webhook URL validators missing
• PDF generators with URL input

rg -n "fetch\(.*req\.|axios\.(get|post)\(.*req\.|request\(.*user" --glob "*.{js,ts}"

Remediation: Allowlist destinations, block private IP ranges, disable redirects.

OWASP Mapping Table Template

| OWASP | Finding | Severity | Location | Status |
|-------|---------|----------|----------|--------|
| A01 | IDOR on /api/orders/:id | High | routes/orders.ts:42 | Open |
| A03 | SQL injection in search | Critical | db/search.ts:18 | Open |
| A05 | Missing CSP header | Medium | server.ts | Open |

XSS (Often A03)

JavaScript-specific XSS patterns:

rg -n "innerHTML|outerHTML|document\.write|dangerouslySetInnerHTML|v-html|\{@html\}" --glob "*.{js,ts,jsx,tsx,vue,svelte}"

CSRF (Often A01)

Required when using cookie-based session auth:

• CSRF tokens on state-changing requests
• SameSite=Strict or Lax cookies
• Verify Origin/Referer headers

Report Section

Include in audit reports:

## OWASP Coverage
| Category | Findings | Highest Severity |
|----------|----------|------------------|
| A01 Broken Access Control | 3 | High |
| A03 Injection | 1 | Critical |
| ... | | |