René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[javascript] CWE-614: CodeQL query to detect if cookies are sent without the flag secure being set","articleBody":"## CVE ID(s)\r\n\r\n*List the CVE ID(s) associated with this vulnerability. GitHub will automatically link CVE IDs to the [GitHub Advisory Database](https://github.com/advisories).*\r\n\r\n- There is no CVE for this.\r\n\r\n## Report\r\n\r\nFailing to set the secure flag on a cookie can cause it to be sent in clear text. This makes it easier for an attacker to intercept and read the cookie.\r\n\r\nQuery to detect if the `secure` flag is set to cookies is available in java query but it is not available in JavaScript query.\r\nThis query detects if cookies are sent without the flag secure being set or with the flag secure being set to false.\r\n\r\nLink to the merged PR: [PR github/codeql#3978](https://github.com/github/codeql/pull/3978)\r\n\r\n- [x] Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). *We would love to have you spread the word about the good work you are doing*\r\n\r\n## Result(s)\r\n\r\nThe query was able to detect the following issues (now fixed):\r\n|Issue | Fix|\r\n|------|------|\r\n|[ibm-dotcom-library/packages/utilities/src/utilities/ipcinfoCookie/ipcinfoCookie.js#L59](https://github.com/carbon-design-system/ibm-dotcom-library/blob/1adcd87c468aee159c4961f76f9d6084b7ce3956/packages/utilities/src/utilities/ipcinfoCookie/ipcinfoCookie.js#L59)|[ibm-dotcom-library/packages/utilities/src/utilities/ipcinfoCookie/ipcinfoCookie.js#L72](https://github.com/carbon-design-system/ibm-dotcom-library/blob/master/packages/utilities/src/utilities/ipcinfoCookie/ipcinfoCookie.js#L72)|\r\n|[urly/server/routes/login.js#L32](https://github.com/nedzadalibegovic/urly/blob/aa99fde1528907764acedae06574ca3d333f3fb8/server/routes/login.js#L32)|[urly/server/routes/login.js#L54](https://github.com/nedzadalibegovic/urly/blob/master/server/routes/login.js#L54)|\r\n","author":{"url":"https://github.com/dellalibera","@type":"Person","name":"dellalibera"},"datePublished":"2020-08-29T09:31:16.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":6},"url":"https://github.com/169/securitylab/issues/169"}