Are there code scanners in the market that scan HTML 5 code?

Does anyone have a list of tags of specific CORS configurations that need/can be scanned?

  • When I did a quick Google search on this topic, your question was #8 in the responses. So, I'm thinking 'no' - no static code analysis tools for HTML5 yet :) – schroeder Jan 24 '12 at 17:53

I work for HP and I do know that our commercial security-focused static analysis tool, Fortify SCA, does support HTML5 security issues. Feel free to let me know more if you decide to go this route!

  • thx atdre, I know it might not be possible to answer my comment, but anyhow i give it a shot :D is it possible that you point me to what are the custom rules used by Fortify or what does Fortify scans for? – smiley Jan 25 '12 at 9:41
  • That's good to know - the version I used back in April didn't have this. How mature is it? – Rory Alsop Jan 26 '12 at 15:29

There are no 'scanners' yet, but you might be able to enrich existing code scanners with new rules for the HTML5. OWASP HTML5 Security Cheatsheet is a good resource you might use to compile such rules, for example it lists insecure CORS headers configuration, but it also touches other HTML5 subjects like insecure WebSockets configuration. You can also add e.g. new XSS vectors using HTML5 features from http://html5sec.org/ - there's a text-only version of these payloads on GitHub.

  • thx this is very helpful – smiley Jan 25 '12 at 9:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.