diff --git a/http/misconfiguration/missing-sri.yaml b/http/misconfiguration/missing-sri.yaml index 7f80445fcf7..9e5631e2221 100644 --- a/http/misconfiguration/missing-sri.yaml +++ b/http/misconfiguration/missing-sri.yaml @@ -2,16 +2,16 @@ id: missing-sri info: name: Missing Subresource Integrity - author: lucky0x0d,PulseSecurity.co.nz,sullo + author: lucky0x0d, PulseSecurity.co.nz, sullo, amarsct severity: info description: | - Checks if script tags within the HTML response have Subresource Integrity implemented via the integrity attribute. + Checks if external script and stylesheet tags in the HTML response are missing the Subresource Integrity (SRI) attribute. reference: - https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html#subresource-integrity - https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity metadata: max-request: 1 - tags: compliance,js,sri,misconfig + tags: compliance,js,css,sri,misconfig http: - raw: @@ -22,21 +22,20 @@ http: redirects: true max-redirects: 5 - matchers-condition: and + matchers-condition: or matchers: - type: xpath part: body xpath: - - "//script[contains(@src,'//') and not(matches(translate(@integrity,'ABCDEFGHIJKLMNOPQRSTUVWXYZ+/-=','abcdefghijklmnopqrstuvwxyz+/-='), '^sha(256|384|512)-'))]" - - - type: word - words: - - "text/html" - part: header + - "//script[contains(@src, '//') and (not(@integrity) or not(matches(translate(@integrity, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ+/-=', 'abcdefghijklmnopqrstuvwxyz+/-='), '^sha(256|384|512)-')))]" + - "//link[@rel='stylesheet' and contains(@href, '//') and (not(@integrity) or not(matches(translate(@integrity, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ+/-=', 'abcdefghijklmnopqrstuvwxyz+/-='), '^sha(256|384|512)-')))]" extractors: - type: xpath attribute: src xpath: - - "//script[contains(@src,'//') and not(matches(translate(@integrity,'ABCDEFGHIJKLMNOPQRSTUVWXYZ+/-=','abcdefghijklmnopqrstuvwxyz+/-='), '^sha(256|384|512)-'))]" -# digest: 4a0a00473045022035cc74528d4015de4becb701fde9486481cc1755194095f79be9ea515b97f28f022100978e639ff5b38a9be40269679b57d3775c3097ff80a8bdb7ea987b5bcf5f19c3:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - "//script[contains(@src, '//') and (not(@integrity) or not(matches(translate(@integrity, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ+/-=', 'abcdefghijklmnopqrstuvwxyz+/-='), '^sha(256|384|512)-')))]" + - type: xpath + attribute: href + xpath: + - "//link[@rel='stylesheet' and contains(@href, '//') and (not(@integrity) or not(matches(translate(@integrity, 'ABCDEFGHIJKLMNOPQRSTUVWXYZ+/-=', 'abcdefghijklmnopqrstuvwxyz+/-='), '^sha(256|384|512)-')))]"