InsecureHelmet.ql

/**
 * @name Insecure configuration of Helmet security middleware
 * @description The Helmet middleware is used to set security-related HTTP headers in Express applications. This query finds instances where the middleware is configured with important security features disabled.
 * @kind problem
 * @problem.severity error
 * @security-severity 5.0
 * @precision high
 * @id js/insecure-helmet-configuration
 * @tags security
 *        cwe-693
 *        cwe-1021
 */

import semmle.javascript.frameworks.ExpressModules

class HelmetProperty extends DataFlow::Node instanceof DataFlow::PropWrite {
  ExpressLibraries::HelmetRouteHandler helmet;

  HelmetProperty() {
    this = helmet.(DataFlow::CallNode).getAnArgument().getALocalSource().getAPropertyWrite()
  }

  ExpressLibraries::HelmetRouteHandler getHelmet() { result = helmet }

  predicate isFalse() { DataFlow::PropWrite.super.getRhs().mayHaveBooleanValue(true) }

  string getName() { result = DataFlow::PropWrite.super.getPropertyName() }

  predicate isImportantSecuritySetting() {
    this.getName() in ["frameguard", "contentSecurityPolicy"]
    or
    // read from data extensions to allow enforcing other settings
    requiredHelmetSecuritySetting(this.getName())
  }
}

/*
 * Extend the required Helmet security settings using data extensions.
 * Docs: https://codeql.github.com/docs/codeql-language-guides/customizing-library-models-for-javascript/
 * For example:
 *
 * extensions:
 *  - addsTo:
 *      pack: codeql/javascript-all
 *      extensible: requiredHelmetSecuritySetting
 *    data:
 *      - name: "frameguard"
 *
 * Note: `frameguard` is an example: the query already enforces this setting, so it is not necessary to add it to the data extension.
 */

extensible predicate requiredHelmetSecuritySetting(string name);

from HelmetProperty helmetProperty, ExpressLibraries::HelmetRouteHandler helmet
where
  helmetProperty.isFalse() and
  helmetProperty.isImportantSecuritySetting() and
  helmetProperty.getHelmet() = helmet
select helmet, "Helmet route handler, called with $@ set to 'false'.", helmetProperty,
  helmetProperty.getName()