# Owasp Javascript

> Maps JavaScript/TypeScript vulnerabilities to OWASP Top 10 (2021) with detection patterns, code examples, and remediation. Use during security audits, when the user mentions OWASP, or when categorizing security findings.

- Skill: `leo4135/owasp-javascript` (Agent Skill)
- Install (CLI): `npx skillmds@latest add leo4135/owasp-javascript`
- Raw SKILL.md: https://api.skillmd.com/api/skills/leo4135/owasp-javascript/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: leo4135 (https://skillmd.com/u/leo4135)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/leo4135/owasp-javascript

---


# OWASP Top 10 — JavaScript/TypeScript

Map every finding to an OWASP category. Use CWE IDs where applicable.

## A01: Broken Access Control

**Look for:**
- Missing auth middleware on routes
- IDOR: `GET /api/orders/:id` without ownership check
- Client-side-only access control
- JWT role claims trusted without server verification
- Directory traversal in file serving

```bash
rg -n "router\.(get|post|put|delete)|app\.(get|post)" --glob "*.{js,ts}" -A3 | rg -v "auth|requireAuth|isAuthenticated"
rg -n "req\.(params|query|body)\.\w+.*find|findOne|findUnique" --glob "*.{js,ts}"
```

**Remediation:** Enforce authorization server-side on every request. Use RBAC/ABAC. Deny by default.

---

## A02: Cryptographic Failures

**Look for:**
- Passwords stored with MD5/SHA1
- Hardcoded encryption keys
- `Math.random()` for tokens
- TLS verification disabled
- Sensitive data in logs

```bash
rg -n "md5|sha1|createHash\('md5|Math\.random\(\)" --glob "*.{js,ts}"
rg -n "rejectUnauthorized:\s*false" --glob "*.{js,ts}"
```

**Remediation:** bcrypt/argon2 for passwords, `crypto.randomBytes` for tokens, TLS everywhere.

---

## A03: Injection

**Look for:**
- SQL/NoSQL injection via string concatenation
- Command injection via `child_process`
- LDAP/XPath injection
- Template injection in server-side rendering

```bash
rg -n "query\(\`|query\(\s*['\"].*\+|exec\(|execSync\(|spawn\(" --glob "*.{js,ts}"
rg -n "\$where|mapReduce|aggregate.*\$" --glob "*.{js,ts}"
```

**Remediation:** Parameterized queries, ORM safe APIs, input validation, never pass user input to shell.

---

## A04: Insecure Design

**Look for:**
- No rate limiting on sensitive flows
- Missing threat model for critical features
- Business logic flaws (negative prices, race conditions)
- Unlimited resource consumption

**Remediation:** Threat modeling, secure design patterns, business logic tests, quotas.

---

## A05: Security Misconfiguration

**Look for:**
- Default credentials
- Verbose error pages in production
- Missing security headers
- Unnecessary features enabled (GraphQL introspection, debug endpoints)
- Open S3 buckets / public cloud storage

```bash
rg -n "NODE_ENV|stack|err\.message|err\.stack" --glob "*.{js,ts}"
rg -n "introspection|graphiql|playground" --glob "*.{js,ts}" -i
```

**Remediation:** Hardening guides, automated config scanning, principle of least privilege.

---

## A06: Vulnerable and Outdated Components

**Look for:**
- Known CVEs in dependencies
- Unpinned dependencies
- Abandoned packages

Load [dependency-audit](../dependency-audit/SKILL.md) for full workflow.

---

## A07: Identification and Authentication Failures

**Look for:**
- Weak password policy
- Credential stuffing (no rate limit)
- Session not invalidated on logout
- JWT without expiry or with `alg: none`
- Missing MFA for admin

```bash
rg -n "jwt\.sign|jsonwebtoken" --glob "*.{js,ts}" -A5
rg -n "session|cookie" --glob "*.{js,ts}" -i
```

**Remediation:** MFA, secure session management, account lockout, OAuth best practices.

---

## A08: Software and Data Integrity Failures

**Look for:**
- Unsigned auto-updates
- CI/CD pipeline without integrity checks
- `npm install` without lockfile verification
- Unsigned webhooks

Load [supply-chain-security](../supply-chain-security/SKILL.md).

---

## A09: Security Logging and Monitoring Failures

**Look for:**
- No logging on auth failures
- Logs missing correlation IDs
- Sensitive data in logs
- No alerting on anomalies

**Remediation:** Structured logging, SIEM integration, alert on brute force / privilege changes.

---

## A10: Server-Side Request Forgery (SSRF)

**Look for:**
- `fetch(userProvidedUrl)`
- Image/document processors fetching URLs
- Webhook URL validators missing
- PDF generators with URL input

```bash
rg -n "fetch\(.*req\.|axios\.(get|post)\(.*req\.|request\(.*user" --glob "*.{js,ts}"
```

**Remediation:** Allowlist destinations, block private IP ranges, disable redirects.

---

## OWASP Mapping Table Template

```markdown
| OWASP | Finding | Severity | Location | Status |
|-------|---------|----------|----------|--------|
| A01 | IDOR on /api/orders/:id | High | routes/orders.ts:42 | Open |
| A03 | SQL injection in search | Critical | db/search.ts:18 | Open |
| A05 | Missing CSP header | Medium | server.ts | Open |
```

## XSS (Often A03)

JavaScript-specific XSS patterns:

```bash
rg -n "innerHTML|outerHTML|document\.write|dangerouslySetInnerHTML|v-html|\{@html\}" --glob "*.{js,ts,jsx,tsx,vue,svelte}"
```

| Context | Safe approach |
|---------|---------------|
| HTML body | Encode or DOMPurify |
| HTML attribute | Encode quotes |
| JavaScript | `JSON.stringify` in script context |
| URL | Validate scheme (block `javascript:`) |

## CSRF (Often A01)

Required when using cookie-based session auth:
- CSRF tokens on state-changing requests
- `SameSite=Strict` or `Lax` cookies
- Verify `Origin`/`Referer` headers

## Report Section

Include in audit reports:

```markdown
## OWASP Coverage
| Category | Findings | Highest Severity |
|----------|----------|------------------|
| A01 Broken Access Control | 3 | High |
| A03 Injection | 1 | Critical |
| ... | | |
```