Package: njsscan
njsscannjsscanis a static application testing (SAST) tool that can find insecure code patterns in your node.js applications using simple pattern matcher fromlibsastand syntax-aware semantic code pattern search toolsemgrep.Made within IndiaSupport njsscanDonate via Paypal:Sponsor the Project:e-Learning Courses & CertificationsOpSecX Node.js Security: Pentesting and Exploitation - NJSInstallationpip install njsscanRequires Python 3.7+ and supports only Mac and LinuxCommand Line Options$njsscan
usage:njsscan[-h][--json][--sarif][--sonarqube][--html][-oOUTPUT][-cCONFIG][--missing-controls][-w][-v][path...]positionalarguments:pathPathcanbefile(s)ordirectorieswithsourcecode

optionalarguments:-h,--helpshowthishelpmessageandexit--jsonsetoutputformatasJSON--sarifsetoutputformatasSARIF2.1.0--sonarqubesetoutputformatcompatiblewithSonarQube--htmlsetoutputformatasHTML-oOUTPUT,--outputOUTPUToutputfilenametosavetheresult-cCONFIG,--configCONFIGLocationto.njsscanconfigfile--missing-controlsenablemissingsecuritycontrolscheck-w,--exit-warningnonzeroexitcodeonwarning-v,--versionshownjsscanversionExample Usage$njsscantest.js
-PatternMatch████████████████████████████████████████████████████████████1-SemanticGrep███████████████████████████160njsscan:v0.1.9|AjinAbraham|opensecurity.in
╒═════════════╤═══════════════════════════════════════════════════════════════════════════════════════════════╕
│RULEID│express_xss│
├─────────────┼───────────────────────────────────────────────────────────────────────────────────────────────┤
│OWASP│A1:Injection│
├─────────────┼───────────────────────────────────────────────────────────────────────────────────────────────┤
│CWE│CWE-79:ImproperNeutralizationofInputDuringWebPageGeneration('Cross-site Scripting')│
├─────────────┼───────────────────────────────────────────────────────────────────────────────────────────────┤
│DESCRIPTION│UntrustedUserInputinResponsewillresultinReflectedCrossSiteScriptingVulnerability.│
├─────────────┼───────────────────────────────────────────────────────────────────────────────────────────────┤
│SEVERITY│ERROR│
├─────────────┼───────────────────────────────────────────────────────────────────────────────────────────────┤
│FILES│╒════════════════╤═══════════════════════════════════════════════╕│
│││File│test.js││
││├────────────────┼───────────────────────────────────────────────┤│
│││MatchPosition│5-46││
││├────────────────┼───────────────────────────────────────────────┤│
│││LineNumber(s)│7:8││
││├────────────────┼───────────────────────────────────────────────┤│
│││MatchString│const{name}=req.query;││
││││res.send('<h1> Hello :'+name+"</h1>")││
││╘════════════════╧═══════════════════════════════════════════════╛│
╘═════════════╧═══════════════════════════════════════════════════════════════════════════════════════════════╛nodejsscan SASTnodejsscan, built on top ofnjsscanprovides a full fledged vulnerability management user interface along with other nifty integrations.SeenodejsscanPython API>>>fromnjsscan.njsscanimportNJSScan>>>node_source='/node_source/true_positives/sqli_node.js'>>>scanner=NJSScan([node_source],json=True,check_controls=False)>>>scanner.scan(){'templates':{},'nodejs':{'node_sqli_injection':{'files':[{'file_path':'/node_source/true_positives/sqli_node.js','match_position':(1,24),'match_lines':(4,11),'match_string':'var employeeId = req.foo;\n\nvar sql = "SELECT * FROM trn_employee WHERE employee_id = " + employeeId;\n\n\n\nconnection.query(sql, function (error, results, fields) {\n\nif (error) {\n\nthrow error;\n\n}\n\nconsole.log(results);'}],'metadata':{'owasp':'A1: Injection','cwe':"CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",'description':'Untrusted input concatinated with raw SQL query can result in SQL Injection.','severity':'ERROR'}}},'errors':[]}Configure njsscanA.njsscanfile in the root of the source code directory allows you to configure njsscan. You can also use a custom.njsscanfile using--configargument.----nodejs-extensions:-.jstemplate-extensions:-.new-.hbs-''ignore-filenames:-skip.jsignore-paths:-__MACOSX-skip_dir-node_modulesignore-extensions:-.jsxignore-rules:-regex_injection_dos-pug_jade_templateseverity-filter:-WARNING-ERRORSuppress FindingsYou can suppress findings from javascript source files by adding the comment// njsscan-ignore: rule_id1, rule_id2to the line that trigger the findings.Example:app.get('/some/redirect',function(req,res){vartarget=req.param("target");res.redirect(target);// njsscan-ignore: express_open_redirect});CI/CD IntegrationsYou can enable njsscan in your CI/CD or DevSecOps pipelines.Github ActionAdd the following to the file.github/workflows/njsscan.yml.name:njsscanon:push:branches:[master,main]pull_request:branches:[master,main]jobs:njsscan:runs-on:ubuntu-latestname:njsscan checksteps:-name:Checkout the codeuses:actions/checkout@v2-name:nodejsscan scanid:njsscanuses:ajinabraham/njsscan-action@masterwith:args:'.'Example:dvna with njsscan github actionGithub Code Scanning IntegrationAdd the following to the file.github/workflows/njsscan_sarif.yml.name:njsscan sarifon:push:branches:[master,main]pull_request:branches:[master,main]jobs:njsscan:runs-on:ubuntu-latestname:njsscan code scanningsteps:-name:Checkout the codeuses:actions/checkout@v2-name:nodejsscan scanid:njsscanuses:ajinabraham/njsscan-action@masterwith:args:'.--sarif--outputresults.sarif||true'-name:Upload njsscan reportuses:github/codeql-action/upload-sarif@v1with:sarif_file:results.sarifGitlab CI/CDAdd the following to the file.gitlab-ci.yml.stages:-testnjsscan:image:pythonbefore_script:-pip3 install --upgrade njsscanscript:-njsscan .Example:dvna with njsscan gitlabTravis CIAdd the following to the file.travis.yml.language:pythoninstall:-pip3 install --upgrade njsscanscript:-njsscan .Circle CIAdd the following to the file.circleci/config.yamlversion:2.1jobs:njsscan:docker:-image:cimg/python:3.9.6steps:-checkout-run:name:Install njsscancommand:pip install --upgrade njsscan-run:name:njsscan checkcommand:njsscan .DockerPrebuilt image fromDockerHubdockerpullopensecurity/njsscan
dockerrun-v/path-to-source-dir:/srcopensecurity/njsscan/srcBuild Locallydocker build -t njsscan .
docker run -v /path-to-source-dir:/src njsscan /src