Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Are there code scanners in the market that scan HTML 5 code?

Does anyone have a list of tags of specific CORS configurations that need/can be scanned?

share|improve this question
When I did a quick Google search on this topic, your question was #8 in the responses. So, I'm thinking 'no' - no static code analysis tools for HTML5 yet :) – schroeder Jan 24 '12 at 17:53
up vote 4 down vote accepted

I work for HP and I do know that our commercial security-focused static analysis tool, Fortify SCA, does support HTML5 security issues. Feel free to let me know more if you decide to go this route!

share|improve this answer
thx atdre, I know it might not be possible to answer my comment, but anyhow i give it a shot :D is it possible that you point me to what are the custom rules used by Fortify or what does Fortify scans for? – smiley Jan 25 '12 at 9:41
That's good to know - the version I used back in April didn't have this. How mature is it? – Rory Alsop Jan 26 '12 at 15:29

There are no 'scanners' yet, but you might be able to enrich existing code scanners with new rules for the HTML5. OWASP HTML5 Security Cheatsheet is a good resource you might use to compile such rules, for example it lists insecure CORS headers configuration, but it also touches other HTML5 subjects like insecure WebSockets configuration. You can also add e.g. new XSS vectors using HTML5 features from - there's a text-only version of these payloads on GitHub.

share|improve this answer
thx this is very helpful – smiley Jan 25 '12 at 9:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.