Sha256: d2138ac886ad4a947b410704615a6caa3559503a15b566cf80381435ed5c205b
Contents?: true
Size: 1.36 KB
Versions: 23
Compression:
Stored size: 1.36 KB
Contents
# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
# frozen_string_literal: true
module Contrast
module Agent
module Assess
module Policy
module TriggerValidation
# Validator used to assert a Reflected XSS finding is actually
# vulnerable before serializing that finding as a DTM to report to
# the service.
module XSSValidator
XSS_RULE = 'reflected-xss'
SAFE_CONTENT_TYPES = %w[
/csv
/javascript
/json
/pdf
/x-javascript
/x-json
].cs__freeze
# A finding is valid for XSS if the response type is not one of
# those assumed to be safe
# https://bitbucket.org/contrastsecurity/assess-specifications/src/master/rules/dataflow/reflected_xss.md
def self.valid? patcher, _object, _ret, _args
return true unless XSS_RULE == patcher&.rule_id
content_type = Contrast::Agent::REQUEST_TRACKER.current&.response&.content_type
return true unless content_type
content_type = content_type.downcase
SAFE_CONTENT_TYPES.none? { |safe_type| content_type.index(safe_type) }
end
end
end
end
end
end
end
Version data entries
23 entries across 23 versions & 1 rubygems