VBC-034: http-not-https

error

Category: security
Analysis: Regex (line by line)
File types: .js, .ts, .tsx, .py, .html, .astro
Scope: string and template literals only
Excluded paths: **/test/**, **/tests/**, **/__tests__/**, **/testdata/**, **/fixtures/**, **/test_*.py, **/*_test.py, **/test.py, **/conftest.py, **/*_test.go, **/*_bench.go, **/*.test.*, **/*.spec.*, **/bench/**, **/benchmark*, **/*corpus*, **/*payload*
Tags: security

What it reports

Insecure http:// link detected at line {line}. Use https:// instead.

Flagged

const api = 'http://api.example.com/v1';

Not flagged

const api = 'https://api.example.com/v1';

const dev = 'http://localhost:3000';

const dev2 = 'http://127.0.0.1:8000';

refuse http://169.254.169.254 (cloud metadata) before connecting

"A single http:// subresource downgrades the page"

"the {label} must use http:// or https://"

const parsed = new URL(req.url, `http://${req.headers.host}`);

const svg = 'http://www.w3.org/2000/svg';

Pattern

(?<!new URL\([^)]{0,200})http://(?!localhost|127\.|0\.0\.0\.0|169\.254\.|\[::1\]|test\b|example\.(?:com|org)|www\.w3\.org|schemas?\.|json-schema\.org|purl\.org|ns\.adobe|www\.apache\.org)(?=[\w\[$\{])