InsecureHelmet.qhelp

<!DOCTYPE qhelp SYSTEM "qhelp.dtd">
<qhelp>
    <overview>
        <p>
            <a href="https://helmetjs.github.io/">Helmet</a> is a collection of middleware functions for securing Express apps. It sets various HTTP headers to guard against common web vulnerabilities.<br>

            This query detects Helmet misconfigurations that can lead to security vulnerabilities, specifically:
        </p>

        <ul>
            <li>Disabling frame protection</li>
            <li>Disabling Content Security Policy</li>
        </ul>

        <p>
            Content Security Policy (CSP) helps spot and prevent injection attacks such as Cross-Site Scripting (XSS).<br>

            Removing frame protections exposes an application to attacks such as clickjacking, where an attacker can trick a user into clicking on a button or link on a targeted page when they intended to click on the page carrying out the attack.
        </p>

        <p>
            Users of the query can extend the set of required Helmet features by adding additional checks for them, using CodeQL <a href="https://codeql.github.com/docs/codeql-language-guides/customizing-library-models-for-javascript/">data extensions</a>.
        </p>

        <pre>
        extensions:
          - addsTo:
              pack: codeql/javascript-all
              extensible: requiredHelmetSecuritySetting
            data:
              - name: "frameguard"
        </pre>

        <p>
            Note: <code>frameguard</code> is an example: the query already enforces this setting, so it is not necessary to add it to the data extension. 
        </p>

    </overview>
    <recommendation>
        <p>
            To help mitigate these vulnerabilities, ensure that the following Helmet functions are not disabled, and are configured appropriately to your application:
        </p>

        <ul>
            <li><code>frameguard</code></li>
            <li><code>contentSecurityPolicy</code></li>
        </ul>
    </recommendation>
    <example>
        <p>
            The following code snippet demonstrates Helmet configured in an insecure manner:
        </p>

        <pre>
            const helmet = require('helmet');
            app.use(helmet({
                frameguard: false,
                contentSecurityPolicy: false
            }));
        </pre>

        <p>
            In this example, the defaults are used, which enables frame protection and a default Content Security Policy.
        </p>

        <pre>
            app.use(helmet());
        </pre>

        <p>
            You can also enable a custom Content Security Policy by passing an object to the <code>contentSecurityPolicy</code> key. For example, taken from the <a href="https://helmetjs.github.io/#content-security-policy">Helmet docs</a>:
        </p>

        <pre>
            app.use(
                helmet({
                    contentSecurityPolicy: {
                        directives: {
                            "script-src": ["'self'", "example.com"],
                            "style-src": null,
                        },
                    },
                })
            );
        </pre>

    </example>
    <references>
        <li>
            <a href="https://helmetjs.github.io/">helmet.js website</a>
        </li>
    </references>
</qhelp>