VBC-034: http-not-https

error

Category: security
Analysis: Regex (line by line)
File types: .js, .ts, .tsx, .py, .html, .astro
Scope: string and template literals only
Excluded paths: **/test/**, **/tests/**, **/__tests__/**, **/testdata/**, **/fixtures/**, **/test_*.py, **/*_test.py, **/test.py, **/conftest.py, **/*_test.go, **/*_bench.go, **/*.test.*, **/*.spec.*, **/bench/**, **/benchmark*, **/*corpus*, **/*payload*
Tags: security

What it reports

Insecure http:// link detected at line {line}. Use https:// instead.

Flagged

const api = 'http://api.example.com/v1';

const api = 'http://203.0.113.9/v1';

const probe = 'http://172.32.0.1/v1';

fetch(`http://${target}/api`)

const docs = 'http://docs.example.net/schemata/x';

Not flagged

const api = 'https://api.example.com/v1';

const dev = 'http://localhost:3000';

const dev2 = 'http://127.0.0.1:8000';

refuse http://169.254.169.254 (cloud metadata) before connecting

"A single http:// subresource downgrades the page"

"the {label} must use http:// or https://"

const parsed = new URL(req.url, `http://${req.headers.host}`);

const svg = 'http://www.w3.org/2000/svg';

const llm = 'http://192.168.1.50:1234/v1';

const db = "http://10.0.0.5/health";

const host = 'http://host.docker.internal:4318/v1/traces';

print(f"Serving at http://{host}:{port}")

console.log(`listening on http://${host}:${port}`)

'xmlns': 'http://www.sitemaps.org/schemas/sitemap/0.9'

'itunes': 'http://www.itunes.com/dtds/podcast-1.0.dtd'

Pattern

(?<!new URL\([^)]{0,200})http://(?!localhost|127\.|0\.0\.0\.0|169\.254\.|\[::1\]|test\b|example\.(?:com|org)|www\.w3\.org|schemas?\.|json-schema\.org|purl\.org|ns\.adobe|www\.apache\.org|10\.|192\.168\.|172\.(?:1[6-9]|2[0-9]|3[01])\.|[\w.-]+\.(?:local|internal|localhost|lan)\b|(?:\$?\{[^}\n]{0,80}\}|\$\w+|%s|%\(\w+\)s):[\d{$]|[^\s'"`)]{0,120}/(?:schemas?|dtds?|xmlns?)\b)(?=[\w\[$\{])