org.sonar.l10n.web.rules.Web.AvoidHtmlCommentCheck.html Maven / Gradle / Ivy

Go to download

Show more of this group Show more artifacts with this name
Show all versions of sonar-html-plugin Show documentation

Code analyzer for HTML

The newest version!

Using HTML-style comments in a page that will be generated or interpolated server-side before being served to the user increases the risk of
exposing data that should be kept private. For instance, a developer comment or line of debugging information that’s left in a page could easily (and
has) inadvertently expose:

   Version numbers and host names 
   Full, server-side path names 
   Sensitive user data 

Every other language has its own native comment format, thus there is no justification for using HTML-style comments in anything other than a pure
HTML or XML file.
Ask Yourself Whether

   The comment contains sensitive information. 
   The comment can be removed. 

Recommended Secure Coding Practices
It is recommended to remove the comment or change its style so that it is not output to the client.
Sensitive Code Example
  <%
      out.write("<!-- ${username} -->");  // Sensitive
  %>
      <!-- <% out.write(userId) %> -->  // Sensitive
      <!-- #{userPhone} -->  // Sensitive
      <!-- ${userAddress} --> // Sensitive

      <!-- Replace 'world' with name --> // Sensitive
      <h2>Hello world!</h2>

Compliant Solution
      <%-- Replace 'world' with name --%>  // Compliant
      <h2>Hello world!</h2>

See

   OWASP - Top 10 2017 Category A3 - Sensitive Data
  Exposure 
   CWE - CWE-615 - Information Exposure Through Comments