Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite
2

Are there code scanners in the market that scan HTML 5 code?

Does anyone have a list of tags of specific CORS configurations that need/can be scanned?

share|improve this question
When I did a quick Google search on this topic, your question was #8 in the responses. So, I'm thinking 'no' - no static code analysis tools for HTML5 yet :) – schroeder Jan 24 '12 at 17:53

2 Answers

up vote 4 down vote accepted

I work for HP and I do know that our commercial security-focused static analysis tool, Fortify SCA, does support HTML5 security issues. Feel free to let me know more if you decide to go this route!

share|improve this answer
thx atdre, I know it might not be possible to answer my comment, but anyhow i give it a shot :D is it possible that you point me to what are the custom rules used by Fortify or what does Fortify scans for? – smiley Jan 25 '12 at 9:41
That's good to know - the version I used back in April didn't have this. How mature is it? – Rory Alsop♦ Jan 26 '12 at 15:29
up vote 3 down vote

There are no 'scanners' yet, but you might be able to enrich existing code scanners with new rules for the HTML5. OWASP HTML5 Security Cheatsheet is a good resource you might use to compile such rules, for example it lists insecure CORS headers configuration, but it also touches other HTML5 subjects like insecure WebSockets configuration. You can also add e.g. new XSS vectors using HTML5 features from http://html5sec.org/ - there's a text-only version of these payloads on GitHub.

share|improve this answer
thx this is very helpful – smiley Jan 25 '12 at 9:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.