@hclsoftware/secagent/src/RequestRules/PasswordLeakage.js

IAST agent

//IASTIGNORE
/*
 * ****************************************************
 * Licensed Materials - Property of HCL.
 * (c) Copyright HCL Technologies Ltd. 2017, 2025.
 * Note to U.S. Government Users *Restricted Rights.
 * ****************************************************
 */

const {RequestRule, AdditionalInfoKey} = require('./RequestRule')
const Vulnerability = require('../Vulnerability')
const Entity = require('../Entity')
const SessionTracker = require('../SessionTracker')

class PasswordLeakage extends RequestRule {
  constructor () {
    super(Vulnerability.PASSWORD_LEAKAGE, true)
  }

  isVulnerable (requestInfo, responseText, additionalInfo) {
    const parameterNames = Object.keys(requestInfo.queryParameters)
    const passwordName = SessionTracker.getPasswordFromVariants(parameterNames)
    if (passwordName == null) {
      return false
    }
    additionalInfo[AdditionalInfoKey] = additionalInfo[AdditionalInfoKey].origConcat(`password parameter detected: [${passwordName}]`)
    this.setEntity(new Entity.Entity(passwordName, requestInfo.queryParameters[passwordName], Entity.EntityType.PARAMETER))
    return true
  }
}

module.exports = PasswordLeakage