Defeating AppScan false positives in JavaScript

defeat-appscan-heuristics.js

// AppScan may flag up a call like this as "Insecure Use of Document.Write"
// because it isn't intelligent enough to know that this a call to a totally
// unrelated method also named `write`
const diffBuffer = PNG.sync.write(diffPng)

// Replace with:
// eslint-disable-next-line no-useless-call
const diffBuffer = PNG.sync.write.call(PNG.sync, diffPng)

///////////////////////////////

// AppScan raises "Authentication.Credentials.Unprotected" when it sees
// the key "password" in a JavaScript object
const obj = {
  user: 'user1',
  password: '********' // literal asterisks, we do not return the real password
}

// Simply quoting the string defeats this
const obj = {
  user: 'user1',

  // eslint-disable-next-line quote-props
  'password': '********'
}

We had a requirement to start running HCL AppScan against all of our JavaScript code. It raised hundreds of false positive flags. However, AppScan provides no mechanism to individually exclude those flags in the source code itself. Instead, I found a variety of techniques to modify the code to equivalent code which AppScan is too unintelligent to flag.

Note that these changes may cause ESLint to complain, because it is intelligent. Luckily, ESLint is also smart enough to provide an exclusion mechanism.