Does SonarQube Cloud OSS plan include full taint analysis for CWE-79 (Cross-site Scripting)?

SonarQube Server / Community Build
1

On the OSS plan, I scanned a React app with a known DOM-based XSS pattern:

const authorNameElement = document.querySelector(‘.author-name’);
errorElement.innerHTML = `Author: ${authorNameElement.textContent}`;

SonarQube Cloud reported 6 vulnerabilities on the project but did not flag the .textContent → .innerHTML chain. CodeQL flags this via js/xss-through-dom. My custom Semgrep rule flags it too.

Two questions:

  1. Is taint analysis (rule javascript:S5247 and related) active for public projects on the OSS plan?
  2. If yes, why doesn’t this specific DOM-XSS chain trigger? Is .textContent not modeled as a taint source in the default JS profile?
2

Hello @kiran_tsp ,

Welcome to the Community!

I can confirm that javascript:S5247 is indeed available on OSS plan:

image
image1155×438 31.6 KB

I’ve flagged your specific question about the rule for further analysis by the relevant team.

Cheers,

Stevan

4

Helloo,

The actual taint analysis rules for DOM XSS are tssecurity:S5696 and jssecurity:S5696. IIRC these rules are available on the OSS plan, but on the condition that the project is public (IIRC).

Thanks for your feedback ! I’m going to investigate that. It is possible we didn’t deem querySelector trustworthy enough to be a source of tainted data 100% of the time, back when we modelized it in the engine.

Cheers!

Loris