@hclsoftware/secagent/src/RequestRules/InsecureLogin.js

IAST agent

//IASTIGNORE
/*
 * ****************************************************
 * Licensed Materials - Property of HCL.
 * (c) Copyright HCL Technologies Ltd. 2017, 2025.
 * Note to U.S. Government Users *Restricted Rights.
 * ****************************************************
 */

const {RequestRule, AdditionalInfoKey} = require('./RequestRule')
const Vulnerability = require('../Vulnerability')
const Entity = require('../Entity')
const SessionTracker = require('../SessionTracker')
const Utils = require('../Utils/Utils')

class InsecureLogin extends RequestRule {
  constructor () {
    super(Vulnerability.INSECURE_LOGIN, true)
  }

  isVulnerable (requestInfo, responseText, additionalInfo) {
    if (requestInfo.isSecure) {
      return false
    }
    const parameterNames = Object.keys(requestInfo.allParameters)
    const userName = SessionTracker.getUserNameFromVariants(parameterNames)

    if (userName == null) {
      return false
    }
    const passwordName = SessionTracker.getPasswordFromVariants(parameterNames)
    if (passwordName == null) {
      return false
    }
    additionalInfo[AdditionalInfoKey] = additionalInfo[AdditionalInfoKey].origConcat(`request is not secure (e.g. not using HTTPS); username parameter detected: [${userName}]; password parameter detected: [${passwordName}]`)
    this.setEntity(new Entity.Entity(passwordName, Utils.PASSWORD_TEXT, Entity.EntityType.PARAMETER))
    return true
  }
}
module.exports = InsecureLogin