Njsscan - A Semantic Aware SAST Tool That Can Find Insecure Code Patterns In Your Node.js Applications

$ njsscan
usage: njsscan [-h] [--json] [--sarif] [--sonarqube] [--html] [-o OUTPUT] [-c CONFIG] [--missing-controls] [-w] [-v] [path ...]

positional arguments:
path Path can be file(s) or directories with source code

optional arguments:
-h, --help show this help message and exit
--json set output format as JSON
--sarif set output format as SARIF 2.1.0
--sonarqube set output format compatible with SonarQube
--html set output format as HTML
-o OUTPUT, --output OUTPUT
output filename to save the result
-c CONFIG, --config CONFIG
Location to .njsscan config file
--missing-controls enable missing security controls check
-w, --exit-warning non zero exit code on warning
-v, --version show njsscan ve rsion

Cross Site Scripting Vulnerability. │ ├─────────────┼───────────────────────────────────────────────────────────────────────────────────────────────┤ │ SEVERITY │ ERROR │ ├─────────────┼───────────────────────────────────────────────────────────────────────────────────────────────┤ │ FILES │ ╒════════════════╤═══════════════════════════════════════════════╕ │ │ │ │ File │ test.js │ │ │ │ ├────────────────┼───────────────────────────────────────────────┤ │ │ │ │ Match Position │ 5 - 46 │ │ │ │ ├────────────────┼───────────────────────────────────────────────┤ │ │ │ │ Line Number(s) │ 7: 8 │ │ │ │ ├────────────────┼───────────────────────────────────────────────┤ │ │ │ │ Match String │ const { name } = req.query; │ │ │ │ │ │ res.send('<h1> Hello :' + name + "</h1>") │ │ │ │ ╘════════════════╧═══════════════════════════════════════════════╛ │ ╘═════════════╧═══════════════════════════════════════════════════════════════════════════════════════════════╛">

$ njsscan test.js
- Pattern Match ███████████████████████&#9608 ;████████████████████████████████████ 1
- Semantic Grep ███████████████████████████ 160

njsscan: v0.1.9 | Ajin Abraham | opensecurity.in
╒═════════════╤═══════════════════════════════════════════════════&#9 552;═══════════════════════════════════════════╕
│ RULE ID │ express_xss │
├─────────────┼─────────────────────────────────────────────────────────────── ────────────────────────────────┤
│ OWASP │ A1: Injection │
├─────────────┼──────────────────────────────────────────────────────────────────────────&#94 72;────────────────────┤
│ CWE │ CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') │
├─────────────┼──────────────────────────────────────────────────────────────────────────────────────& #9472;────────┤
│ DESCRIPTION │ Untrusted User Input in Response will result in Reflected Cross Site Scripting Vulnerability. │
├─────────────┼───────────────────────────────────────────────────────────────────────────────────────────────┤
│ SEVERITY │ ERROR │
├─────────────┼───────────────────────────────────────────────────────────────────────────────────────────────┤
│ FILES │ ╒═══════&#95 52;════════╤═══════════════════════════════════════════════╕ │
│ │ │ File │ test.js │ │
│ │ ├────────────────┼───────────────────────────────────&#94 72;───────────┤ │
│ │ │ Match Position │ 5 - 46 │ │
│ │ ├────────────────┼───────────────────────────────────────────────┤ │
│ │ │ Line Number(s) │ 7: 8 │ │
│ │ ├& #9472;───────────────┼───────────────────────────────────────────────┤ │
│ │ │ Match String │ const { name } = req.query; │ │
│ │ │ │ res.send('<h1> Hello :' + name + "</h1>") │ │
│ │ ╘════════════════╧════&#955 2;══════════════════════════════════════════╛ │
╘═════════════╧══════════════════════════════════════════════════════════════════════════════&#9 552;════════════════╛

>>> from njsscan.njsscan import NJSScan
>>> node_source = '/node_source/true_positives/sqli_node.js'
>>> scanner = NJSScan([node_source], json=True, check_controls=False)
>>> scanner.scan()
{
'templates': {},
'nodejs': {
'node_sqli_injection': {
'files': [{
'file_path': '/node_source/true_positives/sqli_node.js',
'match_position': (1, 24),
'match_lines': (4, 11),
'match_string': 'var employeeId = req.foo;\n\nvar sql = "SELECT * FROM trn_employee WHERE employee_id = " + employeeId;\n\n\n\nconnection.query(sql, function (error, results, fields) {\n\n if (error) {\n\n throw error;\n\n }\n\n console.log(results);'
}],
'metadata': {
'owasp': 'A1: Injection',
'cwe': "CWE-89: Improper Neutralization of Special Element s used in an SQL Command ('SQL Injection')",
'description': 'Untrusted input concatinated with raw SQL query can result in SQL Injection.',
'severity': 'ERROR'
}
}
},
'errors': []
}

---
- nodejs-extensions:
- .js

template-extensions:
- .new
- .hbs
- ''

ignore-filenames:
- skip.js

ignore-paths:
- __MACOSX
- skip_dir
- node_modules

ignore-extensions:
- .jsx

ignore-rules:
- regex_injection_dos
- pug_jade_template

severity-filter:
- WARNING
- ERROR

app.get('/some/redirect', function (req, res) {
var target = req.param("target");
res.redirect(target); // njsscan-ignore: express_open_redirect
});

name: njsscan
on:
push:
branches: [ master, main ]
pull_request:
branches: [ master, main ]
jobs:
njsscan:
runs-on: ubuntu-latest
name: njsscan check
steps:
- name: Checkout the code
uses: actions/[email protected]
- name: nodejsscan scan
id: njsscan
uses: ajinabraham/[email protected]
with:
args: '.'

name: njsscan sarif
on:
push:
branches: [ master, main ]
pull_request:
branches: [ master, main ]
jobs:
njsscan:
runs-on: ubuntu-latest
name: njsscan code scanning
steps:
- name: Checkout the code
uses: actions/[email protected]
- name: nodejsscan scan
id: njsscan
uses: ajinabraham/[email protected]
with:
args: '. --sarif --output results.sarif || true'
- name: Upload njsscan report
uses: github/codeql-action/[email protected]
with:
sarif_file: results.sarif

stages:
- test
njsscan:
image: python
before_script:
- pip3 install --upgrade njsscan
script:
- njsscan .

language: python
install:
- pip3 install --upgrade njsscan
script:
- njsscan .

version: 2.1
jobs:
njsscan:
docker:
- image: cimg/python:3.9.6
steps:
- checkout
- run:
name: Install njsscan
command: pip install --upgrade njsscan
- run:
name: njsscan check
command: njsscan .

docker pull opensecurity/njsscan
docker run -v /path-to-source-dir:/src opensecurity/njsscan /src

docker build -t njsscan .
docker run -v /path-to-source-dir:/src njsscan /src