You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: javascript/ql/src/Security/CWE-693/InsecureHelmet.qhelp
+22-22Lines changed: 22 additions & 22 deletions
Original file line number
Diff line number
Diff line change
@@ -23,12 +23,12 @@
23
23
</p>
24
24
25
25
<pre>
26
-
extensions:
27
-
- addsTo:
28
-
pack: codeql/javascript-all
29
-
extensible: requiredHelmetSecuritySetting
30
-
data:
31
-
- name: "frameguard"
26
+
extensions:
27
+
- addsTo:
28
+
pack: codeql/javascript-all
29
+
extensible: requiredHelmetSecuritySetting
30
+
data:
31
+
- name: "frameguard"
32
32
</pre>
33
33
34
34
<p>
@@ -52,36 +52,36 @@
52
52
</p>
53
53
54
54
<pre>
55
-
const helmet = require('helmet');
56
-
app.use(helmet({
57
-
frameguard: false,
58
-
contentSecurityPolicy: false
59
-
}));
55
+
const helmet = require('helmet');
56
+
app.use(helmet({
57
+
frameguard: false,
58
+
contentSecurityPolicy: false
59
+
}));
60
60
</pre>
61
61
62
62
<p>
63
63
In this example, the defaults are used, which enables frame protection and a default Content Security Policy.
64
64
</p>
65
65
66
66
<pre>
67
-
app.use(helmet());
67
+
app.use(helmet());
68
68
</pre>
69
69
70
70
<p>
71
71
You can also enable a custom Content Security Policy by passing an object to the <code>contentSecurityPolicy</code> key. For example, taken from the <ahref="https://helmetjs.github.io/#content-security-policy">Helmet docs</a>:
0 commit comments