| name | netsuite-owasp-secure-coding |
| description | Platform-agnostic OWASP secure coding practices with JavaScript/Node.js patterns and NetSuite SuiteScript examples. Covers Open Worldwide Application Security Project (OWASP) Top 10 (2021), output encoding, injection prevention, CSP headers, file security, API hardening, AI agent security, DRY security patterns, and 48+ security pitfalls with GOOD/BAD code templates. |
| license | The Universal Permissive License (UPL), Version 1.0 |
| metadata | {"author":"Oracle NetSuite","version":"1.0"} |
OWASP Secure Coding Practices
1. Description
This skill provides implementation-depth OWASP secure coding coverage for JavaScript
and SuiteScript 2.1 development. It is the primary security reference for writing,
reviewing, and auditing code.
What This Skill Covers:
- Complete OWASP Top 10 (2021) mapping with code-level mitigation patterns
- 48 cataloged security pitfalls (OSCP-001 through OSCP-048) with BAD/GOOD code examples
- Platform-agnostic JavaScript security patterns applicable beyond NetSuite
- SuiteScript-specific security patterns for RESTlets, Suitelets, Client Scripts, and more
- Output encoding for five HTML contexts (body, attribute, JavaScript, URL, CSS)
- CSP header construction and deployment
- File upload/download validation pipelines
- API and RESTlet hardening patterns
- AI agent security considerations for tool-assisted development
- DRY security architecture: shared validation modules, centralized encoding, single-source configs
- A mandatory security review checklist for every code review
Relationship to Existing Security Content:
If available, the netsuite-sdf-leading-practices skill contains two security-related principles from
the SAFE Guide:
- Principle 5 (
05-security-privacy.md) -- Owns NetSuite-specific security topics:
roles and permissions, token-based authentication (TBA), N/crypto module usage, PCI-DSS awareness,
credential storage via script parameters, and SuiteCloud platform security features.
- Principle 11 (
11-security-best-practices.md) -- Owns OWASP awareness-level
guidance: the core security principles list, a high-level OWASP Top 10 overview,
basic input sanitization patterns, and parameterized query awareness.
This skill (netsuite-owasp-secure-coding) provides everything below the awareness
level: full implementation depth, exhaustive code patterns, all 48 pitfalls, context-specific
encoding, CSP templates, file security, API hardening, client-side defenses, logging safety,
and AI agent threat mitigation. It references Principles 5 and 11 where appropriate rather
than duplicating their NetSuite-specific content.
2. How to Use
Invocation
Use this skill whenever you need a security review, threat analysis, or implementation
guidance for SuiteScript or JavaScript security concerns.
If your client supports explicit skill activation by name, activate
netsuite-owasp-secure-coding and request the topic you need.
Auto-Activation Triggers
This skill auto-activates when the agent detects security-relevant context in the
conversation. See Section 3 for the complete trigger list.
Reference Files
All deep-dive content is in the local references/ directory. The skill loads the
appropriate reference files based on the detected security topic. You can also request a
specific reference directly:
Review this RESTlet for security issues.
Load the injection prevention reference.
Load the CSP header templates appendix.
3. When to Use
Keyword Triggers
The skill activates when any of the following keywords or phrases appear in the
conversation or code context:
Injection and Input:
injection, sanitize, sanitise, validate input, SQL concatenation,
string concatenation query, parameterized, prepared statement, user input
XSS and Output:
XSS, cross-site scripting, encode, output encoding, innerHTML,
textContent, dangerouslySetInnerHTML, template literal injection
Authentication and Session:
auth, authentication, session, CSRF, token, TBA, OAuth,
credential, password, login, logout, session fixation
Headers and Browser:
CSP, Content-Security-Policy, CORS, X-Frame-Options, HSTS,
security header, postMessage, clickjacking
Cryptography:
crypto, hash, encrypt, decrypt, MD5, SHA-1, SHA-256,
Math.random, nonce, HMAC, AES, secret key
File Operations:
file upload, file download, path traversal, MIME type, magic bytes,
zip bomb, filename sanitization
API and Network:
RESTlet, Suitelet, API security, rate limit, SSRF, webhook,
schema validation, request validation
General Security:
security, vulnerability, OWASP, pentest, hardening, exploit,
attack surface, threat model, security review, security audit
AI and Agent:
prompt injection, AI security, agent security, tool poisoning,
AI output validation, data exfiltration
Code Context Triggers
The skill also activates when the agent detects these code patterns:
- Writing or reviewing RESTlet scripts (
@NScriptType Restlet)
- Writing or reviewing Suitelets that generate HTML (
response.write, INLINEHTML)
- Client scripts with DOM manipulation (
innerHTML, document.write, eval)
- SuiteQL queries being constructed (
query.runSuiteQL, query.runSuiteQLPaged, N/query)
- File operations (
N/file, file.create, file.load)
- External HTTP calls (
N/https, https.post, https.get)
- Cryptographic operations (
N/crypto, createHash, createCipher)
- Any code review or security audit request
4. Companion Reference Map
This skill is self-contained. To avoid content duplication, this map distinguishes what
this skill owns from optional companion references that may exist in a broader NetSuite
guidance set.
| Source | Owns | Relationship to This Skill |
|---|
netsuite-owasp-secure-coding (This skill) | Full OWASP Top 10 implementation depth, all 48 OSCP pitfalls, five-context output encoding, CSP header construction, file upload/download validation pipeline, API/RESTlet hardening, client-side defenses (postMessage, DOM XSS, CSRF), logging safety, AI agent security, DRY security module patterns | Primary and authoritative source for implementation guidance in this package |
05-security-privacy.md (netsuite-sdf-leading-practices, optional companion reference) | NS roles and permissions, TBA authentication patterns, N/crypto module overview, PCI-DSS awareness, credential storage via Script Parameters, SuiteCloud platform security features | Supplemental background only; not required for this skill |
11-security-best-practices.md (netsuite-sdf-leading-practices, optional companion reference) | OWASP awareness list, core security principles, basic sanitize pattern, basic parameterized query mention, defense-in-depth overview | Supplemental background only; not required for this skill |
Cross-Reference Rules:
- Use this skill as the authoritative source for code-level implementation guidance.
- If optional companion references are available, use them only for adjacent background
such as role setup, token rotation, or high-level principles.
- Do not assume companion references are installed; answer from this skill's local
content first.
5. OWASP Top 10 (2021) Quick Map
Each OWASP Top 10 category is mapped to the reference files in this skill that
provide detailed coverage.
| Category | ID | Reference Files | Key Topics |
|---|
| Broken Access Control | A01:2021 | 04-access-control.md | RBAC, IDOR, privilege escalation, runasrole, deployment audience |
| Cryptographic Failures | A02:2021 | 06-cryptography-data-protection.md | SHA-256+, AES-256, key management, PII masking, CSPRNG |
| Injection | A03:2021 | 01-injection-prevention.md, 03-xss-output-encoding.md | SuiteQL params, LDAP escape, CRLF, XSS, DOM sinks |
| Insecure Design | A04:2021 | (Covered across multiple) | Threat modeling, defense in depth, least privilege |
| Security Misconfiguration | A05:2021 | 05-security-misconfiguration.md | Error messages, debug mode, headers, default creds, SDF manifest |
| Vulnerable Components | A06:2021 | 05-security-misconfiguration.md | Dependency audit, feature minimization, unused endpoints |
| Authentication Failures | A07:2021 | 02-authentication-session.md | Credential storage, TBA security, session fixation, cookie attrs |
| Software and Data Integrity Failures | A08:2021 | 06-cryptography-data-protection.md | HMAC verification, webhook signatures, data-at-rest encryption |
| Security Logging and Monitoring Failures | A09:2021 | 10-logging-monitoring.md | What to log, what not to log, log injection, audit trails |
| SSRF | A10:2021 | 08-api-restlet-security.md | URL allowlists, protocol validation, internal network protection |
Appendices Providing Additional Depth:
| Appendix | File | Covers |
|---|
| AI Agent Security | references/appendices/appendix-ai-agent-security.md | Prompt injection, tool poisoning, over-permissioned agents |
| CSP Header Templates | references/appendices/appendix-csp-header-templates.md | Ready-to-use CSP strings, nonce-based templates, NS-specific |
| Security Checklist | references/appendices/appendix-security-checklist.md | Phase-organized verification items with severity indicators |
| SuiteScript Security Patterns | references/appendices/appendix-suitescript-security-patterns.md | Copy-paste boilerplate for RESTlets, Suitelets, UE scripts |
6. DRY Principles for Security
Repeating security logic across scripts is a maintenance hazard and a source of
inconsistency. Apply these DRY principles to your security code.
6.1 Centralized Validation Module
Create a single validation module that all scripts import. When a validation rule
changes, it changes in one place.
define(['N/error'], (error) => {
const requirePositiveInt = (val, fieldName) => {
const n = parseInt(val, 10);
if (isNaN(n) || n < 1) {
throw error.create({
name: 'INVALID_INPUT',
message: `${fieldName} must be a positive integer.`,
notifyOff: true
});
}
return n;
};
const requireEnum = (val, allowed, fieldName) => {
if (!allowed.includes(val)) {
throw error.create({
name: 'INVALID_INPUT',
message: `${fieldName} must be one of: ${allowed.join(', ')}`,
notifyOff: true
});
}
return val;
};
const requireAlphanumeric = (val, fieldName, maxLength) => {
maxLength = maxLength || 200;
if (typeof val !== 'string' || val.length === 0 || val.length > maxLength) {
throw error.create({
name: 'INVALID_INPUT',
message: `${fieldName} must be a non-empty string up to ${maxLength} characters.`,
notifyOff: true
});
}
if (!/^[a-zA-Z0-9_-]+$/.test(val)) {
throw error.create({
name: 'INVALID_INPUT',
message: `${fieldName} contains disallowed characters. Only alphanumeric, hyphens, and underscores are permitted.`,
notifyOff: true
});
}
return val;
};
const sanitizeHtml = (val) => {
if (val == null) return '';
return String(val)
.replace(/&/g, '&')
.replace(/</g, '<')
.replace(/>/g, '>')
.replace(/"/g, '"')
.replace(/'/g, ''');
};
const sanitizeForLog = (val) => {
return String(val)
.replace(/[\r\n]/g, ' ')
.replace(/[\x00-\x1F]/g, '')
.substring(0, 500);
};
return {
requirePositiveInt,
requireEnum,
requireAlphanumeric,
sanitizeHtml,
sanitizeForLog
};
});
6.2 Shared Encoding Module
See example 13 in 03-xss-output-encoding.md for the full five-context encoding module.
Import it everywhere that output is rendered:
define(['./lib/encoding', './lib/SecurityValidation'], (enc, validate) => {
});
6.3 Single Source of Truth for Security Configuration
Store security-relevant configuration in a single place per project:
define([], () => {
return Object.freeze({
ALLOWED_ROLES: Object.freeze({
ADMIN: [3],
FINANCE: [3, 1032, 1045],
READ_ONLY: [3, 1032, 1045, 1060]
}),
FILE_UPLOAD: Object.freeze({
ALLOWED_EXTENSIONS: ['.pdf', '.csv', '.xlsx', '.png', '.jpg', '.jpeg'],
MAX_SIZE_BYTES: 10 * 1024 * 1024,
UPLOAD_FOLDER_PARAM: 'custscript_upload_folder_id'
}),
RATE_LIMIT: Object.freeze({
MAX_REQUESTS: 100,
WINDOW_SECONDS: 3600
}),
CSP_DIRECTIVES: Object.freeze([
"default-src 'self'",
"script-src 'self' https://*.netsuite.com",
"style-src 'self' 'unsafe-inline' https://*.netsuite.com",
"img-src 'self' data: https://*.netsuite.com",
"frame-ancestors 'self' https://*.netsuite.com",
"form-action 'self'",
"base-uri 'self'"
])
});
});
7. Security Pitfalls (OSCP-001 through OSCP-048)
This is the core catalog. Each pitfall has a unique ID, title, category, severity,
problem description, BAD code example, GOOD code example, and a reference to the
detailed reference file.
ID prefix: OSCP- (OWASP Secure Coding Practice) to keep pitfall identifiers stable
and unique within this skill.
Severity Levels:
- Critical -- Exploitable immediately; can lead to full data breach or RCE
- High -- Significant risk requiring prompt remediation
- Medium -- Moderate risk; should be fixed within the current development cycle
- Low -- Minor risk; address as part of ongoing improvement
Injection Prevention (OSCP-001 to OSCP-005)
OSCP-001: SQL Injection via String Concatenation in SuiteQL
Category: Injection Prevention
Severity: Critical
Reference: references/01-injection-prevention.md Section 1
Problem: Building SuiteQL queries by concatenating user input allows an attacker
to manipulate the query structure, extract unauthorized data, or modify records.
define(['N/query'], (query) => {
const onRequest = (context) => {
const name = context.request.parameters.customerName;
const sql = "SELECT id, companyname FROM customer WHERE companyname = '" + name + "'";
const results = query.runSuiteQL({ query: sql });
context.response.write(JSON.stringify(results.asMappedResults()));
};
return { onRequest };
});
define(['N/query'], (query) => {
const onRequest = (context) => {
const name = context.request.parameters.customerName;
const sql = "SELECT id, companyname FROM customer WHERE companyname = ?";
const results = query.runSuiteQL({ query: sql, params: [name] });
context.response.write(JSON.stringify(results.asMappedResults()));
};
return { onRequest };
});
Use ? placeholders plus params for query.runSuiteQL,
query.runSuiteQLPaged, and their promise variants. Paged SuiteQL queries must
still bind values through params; do not concatenate user-controlled values
into the query string.
OSCP-002: Command Injection via Unsanitized Shell Arguments
Category: Injection Prevention
Severity: Critical
Reference: references/01-injection-prevention.md Section 2
Problem: Passing user input to shell commands via child_process.exec() allows
an attacker to inject shell metacharacters and execute arbitrary commands. Relevant
in SDF build scripts, CI/CD pipelines, and custom Node.js tooling.
const { exec } = require('child_process');
function runDeploy(projectName) {
exec(`sdfcli deploy -project ${projectName}`, (err, stdout) => {
console.log(stdout);
});
}
const { execFile } = require('child_process');
function runDeploy(projectName) {
if (!/^[a-zA-Z0-9_-]+$/.test(projectName)) {
throw new Error('Invalid project name. Only alphanumeric, hyphens, and underscores allowed.');
}
execFile('sdfcli', ['deploy', '-project', projectName], (err, stdout) => {
if (err) {
console.error('Deploy failed:', err.message);
return;
}
console.log(stdout);
});
}
OSCP-003: Header Injection via Unvalidated HTTP Headers (CRLF)
Category: Injection Prevention
Severity: High
Reference: references/01-injection-prevention.md Section 3
Problem: If user input is placed into HTTP response headers without stripping
carriage return and line feed characters, an attacker can inject arbitrary headers
or split the HTTP response.
define([], () => {
const onRequest = (context) => {
const redirectUrl = context.request.parameters.redirect;
context.response.setHeader({ name: 'Location', value: redirectUrl });
context.response.setStatus(302);
};
return { onRequest };
});
define(['N/redirect'], (redirect) => {
const ALLOWED_URLS = [
'/app/site/hosting/scriptlet.nl?script=123&deploy=1',
'/app/site/hosting/scriptlet.nl?script=456&deploy=1'
];
const sanitizeHeaderValue = (value) => {
return String(value).replace(/[\r\n\x00]/g, '');
};
const onRequest = (context) => {
const redirectUrl = sanitizeHeaderValue(context.request.parameters.redirect);
if (!ALLOWED_URLS.includes(redirectUrl)) {
context.response.write('Invalid redirect destination.');
return;
}
redirect.redirect({ url: redirectUrl });
};
return { onRequest };
});
OSCP-004: LDAP Injection in Directory Queries
Category: Injection Prevention
Severity: High
Reference: references/01-injection-prevention.md Section 4
Problem: When NetSuite integrations query external LDAP/Active Directory services,
user input in LDAP filter strings can alter the query logic, exposing unauthorized
directory entries.
define(['N/https'], (https) => {
const lookupUser = (username) => {
const filter = `(&(uid=${username})(objectClass=person))`;
https.post({
url: 'https://ldap-proxy.internal/search',
body: JSON.stringify({ filter: filter }),
headers: { 'Content-Type': 'application/json' }
});
};
});
define(['N/https'], (https) => {
const escapeLdapFilter = (input) => {
return String(input)
.replace(/\\/g, '\\5c')
.replace(/\*/g, '\\2a')
.replace(/\(/g, '\\28')
.replace(/\)/g, '\\29')
.replace(/\x00/g, '\\00');
};
const lookupUser = (username) => {
const safeUsername = escapeLdapFilter(username);
const filter = `(&(uid=${safeUsername})(objectClass=person))`;
https.post({
url: 'https://ldap-proxy.internal/search',
body: JSON.stringify({ filter: filter }),
headers: { 'Content-Type': 'application/json' }
});
};
});
OSCP-005: Log Injection via Unsanitized Log Entries
Category: Injection Prevention
Severity: Medium
Reference: references/10-logging-monitoring.md Section 4
Problem: If user input containing newline characters is written to logs, an attacker
can forge log entries, inject misleading audit trails, or exploit log analysis tools.
define(['N/log'], (log) => {
const onRequest = (context) => {
const searchTerm = context.request.parameters.q;
log.audit('Search', 'User searched for: ' + searchTerm);
};
});
define(['N/log'], (log) => {
const safeLogValue = (val) => {
return String(val)
.replace(/[\r\n]/g, ' ')
.replace(/[\x00-\x1F]/g, '')
.substring(0, 500);
};
const onRequest = (context) => {
const searchTerm = context.request.parameters.q;
log.audit('Search', 'User searched for: ' + safeLogValue(searchTerm));
};
});
Authentication and Session (OSCP-006 to OSCP-009)
OSCP-006: Hardcoded Credentials in Source Code
Category: Authentication and Session
Severity: Critical
Reference: references/02-authentication-session.md Section 1
Problem: API keys, passwords, and tokens embedded in source code are exposed to
every developer with repository access, persisted in version control history, and
visible in deployment artifacts.
See Principle 5 (05-security-privacy.md) for NetSuite-specific credential storage
via Script Parameters and the Credentials module.
define(['N/https'], (https) => {
const execute = () => {
const API_KEY = 'sk-prod-a8f3k29d5e7b1c4f6';
https.post({
url: 'https://api.vendor.com/data',
headers: { 'Authorization': `Bearer ${API_KEY}` },
body: '{}'
});
};
});
define(['N/https', 'N/runtime', 'N/error'], (https, runtime, error) => {
const execute = () => {
const script = runtime.getCurrentScript();
const apiKey = script.getParameter({ name: 'custscript_vendor_api_key' });
if (!apiKey) {
throw error.create({
name: 'MISSING_CONFIG',
message: 'API key not configured in script deployment parameters.'
});
}
https.post({
url: 'https://api.vendor.com/data',
headers: { 'Authorization': `Bearer ${apiKey}` },
body: '{}'
});
};
return { execute };
});
OSCP-007: Session Fixation via Client-Supplied Session IDs
Category: Authentication and Session
Severity: High
Reference: references/02-authentication-session.md Section 3
Problem: Accepting session identifiers from URL parameters or client-controlled
sources allows an attacker to fix a session ID, then trick a victim into
authenticating with that known session.
define(['N/cache'], (cache) => {
const onRequest = (context) => {
const sessionId = context.request.parameters.sessionId;
const sessionCache = cache.getCache({ name: 'SESSIONS' });
let data = sessionCache.get({ key: sessionId });
if (!data) {
sessionCache.put({ key: sessionId, value: '{}', ttl: 1800 });
}
};
});
define(['N/cache', 'N/crypto/random', 'N/runtime'], (cache, random, runtime) => {
const generateSessionId = () => random.generateUUID();
const onRequest = (context) => {
const sessionCache = cache.getCache({ name: 'SESSIONS' });
const newSessionId = generateSessionId();
const currentUser = runtime.getCurrentUser();
sessionCache.put({
key: newSessionId,
value: JSON.stringify({ userId: currentUser.id, role: currentUser.role }),
ttl: 1800
});
context.response.write(`<input type="hidden" name="sid" value="${newSessionId}">`);
};
return { onRequest };
});
OSCP-008: Missing Cookie Security Attributes
Category: Authentication and Session
Severity: High
Reference: references/02-authentication-session.md Section 5
Problem: Cookies set without HttpOnly, Secure, and SameSite attributes are
vulnerable to theft via XSS, interception over HTTP, and cross-site request
forgery.
define([], () => {
const onRequest = (context) => {
context.response.setHeader({
name: 'Set-Cookie',
value: 'sessionToken=abc123'
});
};
});
define([], () => {
const onRequest = (context) => {
context.response.setHeader({
name: 'Set-Cookie',
value: [
'sessionToken=abc123',
'HttpOnly',
'Secure',
'SameSite=Strict',
'Path=/',
'Max-Age=1800'
].join('; ')
});
};
});
OSCP-009: No Session Timeout or Excessive Session Duration
Category: Authentication and Session
Severity: Medium
Reference: references/02-authentication-session.md Section 4
Problem: Sessions with no expiration or excessively long lifetimes remain valid
indefinitely, increasing the window for session hijacking.
define(['N/cache'], (cache) => {
const sessionCache = cache.getCache({ name: 'SESSIONS' });
const createSession = (userId) => {
sessionCache.put({ key: userId, value: '{}', ttl: 0 });
};
});
define(['N/cache', 'N/log'], (cache, log) => {
const SESSION_TTL = 1800;
const MAX_ABSOLUTE_MS = 8 * 60 * 60 * 1000;
const sessionCache = cache.getCache({ name: 'SESSIONS' });
const validateSession = (sessionId, currentUserId) => {
const raw = sessionCache.get({ key: sessionId });
if (!raw) return { valid: false, reason: 'expired' };
const session = JSON.parse(raw);
if (session.userId !== currentUserId) return { valid: false, reason: 'mismatch' };
const created = new Date(session.created).getTime();
if (Date.now() - created > MAX_ABSOLUTE_MS) {
sessionCache.remove({ key: sessionId });
return { valid: false, reason: 'absolute_timeout' };
}
session.lastActivity = new Date().toISOString();
sessionCache.put({ key: sessionId, value: JSON.stringify(session), ttl: SESSION_TTL });
return { valid: true };
};
});
XSS and Output Encoding (OSCP-010 to OSCP-015)
OSCP-010: Reflected XSS via Unsanitized URL Parameters in Suitelets
Category: XSS and Output Encoding
Severity: High
Reference: references/03-xss-output-encoding.md Section 1
Problem: URL parameters reflected directly into HTML responses execute attacker-
controlled scripts in the victim's browser, enabling session hijacking, credential
theft, and defacement.
define([], () => {
const onRequest = (context) => {
const name = context.request.parameters.name;
context.response.write(`<html><body><h1>Hello, ${name}!</h1></body></html>`);
};
return { onRequest };
});
define([], () => {
const escapeHtml = (str) => {
if (str == null) return '';
return String(str)
.replace(/&/g, '&')
.replace(/</g, '<')
.replace(/>/g, '>')
.replace(/"/g, '"')
.replace(/'/g, ''');
};
const onRequest = (context) => {
const name = context.request.parameters.name;
context.response.write(`<html><body><h1>Hello, ${escapeHtml(name)}!</h1></body></html>`);
};
return { onRequest };
});
For Suitelet HTML, also consider N/render TemplateRenderer with an inline FTL
template and <#ftl output_format="HTML" auto_esc=true> when TemplateRenderer is
available and the code is replacing string-built response.write() output or
INLINEHTML.defaultValue. N/xml.escape can be referenced for simple XML/HTML
markup escaping, but do not treat it as a universal XSS encoder for JavaScript,
URL, CSS, DOM sink, or trusted-HTML contexts.
OSCP-011: Stored XSS via Unencoded Database Values
Category: XSS and Output Encoding
Severity: High
Reference: references/03-xss-output-encoding.md Section 2
Problem: Data saved to NetSuite records by one user may contain malicious HTML.
When another user's browser renders this data without encoding, the script executes.
define(['N/record'], (record) => {
const onRequest = (context) => {
const rec = record.load({ type: 'customrecord_feedback', id: 1 });
const feedback = rec.getValue({ fieldId: 'custrecord_feedback_text' });
context.response.write(`<div>${feedback}</div>`);
};
});
define(['N/record'], (record) => {
const escapeHtml = (str) => {
if (str == null) return '';
return String(str)
.replace(/&/g, '&')
.replace(/</g, '<')
.replace(/>/g, '>')
.replace(/"/g, '"')
.replace(/'/g, ''');
};
const onRequest = (context) => {
const rec = record.load({ type: 'customrecord_feedback', id: 1 });
const feedback = rec.getValue({ fieldId: 'custrecord_feedback_text' });
context.response.write(`<div>${escapeHtml(feedback)}</div>`);
};
});
OSCP-012: DOM XSS via innerHTML
Category: XSS and Output Encoding
Severity: High
Reference: references/03-xss-output-encoding.md Section 3
Problem: Assigning untrusted data to innerHTML causes the browser to parse and
execute any embedded HTML or script content. This is the most common DOM-based XSS
vector.
define([], () => {
const pageInit = () => {
const msg = new URLSearchParams(window.location.search).get('msg');
document.getElementById('notification').innerHTML = msg;
};
return { pageInit };
});
define([], () => {
const pageInit = () => {
const msg = new URLSearchParams(window.location.search).get('msg');
document.getElementById('notification').textContent = msg;
};
return { pageInit };
});
OSCP-013: Missing Context-Specific Output Encoding
Category: XSS and Output Encoding
Severity: High
Reference: references/03-xss-output-encoding.md Section 4
Problem: Using HTML entity encoding in a JavaScript string context, or URL encoding
in an HTML body context, provides no protection. Each output context requires its own
encoding strategy.
define([], () => {
const onRequest = (context) => {
const username = context.request.parameters.user;
const htmlSafe = username.replace(/</g, '<');
context.response.write(`<script>var user = '${htmlSafe}';</script>`);
};
});
define([], () => {
const escapeHtml = (str) => {
if (str == null) return '';
return String(str)
.replace(/&/g, '&').replace(/</g, '<')
.replace(/>/g, '>').replace(/"/g, '"').replace(/'/g, ''');
};
const onRequest = (context) => {
const username = context.request.parameters.user;
const safeJs = JSON.stringify(username);
context.response.write(`<script>var user = ${safeJs};</script>`);
context.response.write(`<div id="data" data-user="${escapeHtml(username)}"></div>`);
context.response.write(`<script>var user = document.getElementById('data').getAttribute('data-user');</script>`);
};
});
OSCP-014: JavaScript Injection via Template Literals
Category: XSS and Output Encoding
Severity: High
Reference: references/01-injection-prevention.md Section 5
Problem: Template literals (backtick strings) make string interpolation convenient
but do not provide any automatic encoding. Interpolating user input into HTML templates
creates injection points identical to string concatenation.
define([], () => {
const onRequest = (context) => {
const custName = context.request.parameters.name;
const html = `<html><body><h1>Report for ${custName}</h1></body></html>`;
context.response.write(html);
};
});
define([], () => {
const escapeHtml = (str) => {
if (str == null) return '';
return String(str)
.replace(/&/g, '&').replace(/</g, '<')
.replace(/>/g, '>').replace(/"/g, '"').replace(/'/g, ''');
};
const onRequest = (context) => {
const custName = context.request.parameters.name;
const html = `<html><body><h1>Report for ${escapeHtml(custName)}</h1></body></html>`;
context.response.write(html);
};
});
OSCP-015: CSS Injection via Style Attributes
Category: XSS and Output Encoding
Severity: Medium
Reference: references/03-xss-output-encoding.md Section 4
Problem: User-controlled values placed into CSS contexts can exfiltrate data via
url() expressions, apply deceptive styling, or in older browsers execute scripts
via expression().
define([], () => {
const onRequest = (context) => {
const color = context.request.parameters.color;
context.response.write(`<div style="color: ${color}">Text</div>`);
};
});
define([], () => {
const ALLOWED_COLORS = ['red', 'blue', 'green', 'black', 'gray', 'white'];
const onRequest = (context) => {
const color = context.request.parameters.color;
const safeColor = ALLOWED_COLORS.includes(color) ? color : 'black';
context.response.write(`<div style="color: ${safeColor}">Text</div>`);
};
});
Access Control (OSCP-016 to OSCP-020)
OSCP-016: Missing Authorization Checks (IDOR)
Category: Access Control
Severity: Critical
Reference: references/04-access-control.md Section 2
Problem: When a RESTlet or Suitelet accepts a record ID from the request and loads
that record without verifying the caller is authorized for it, any authenticated user
can access any record by guessing or enumerating IDs.
define(['N/record'], (record) => {
const get = (requestParams) => {
const order = record.load({ type: 'salesorder', id: requestParams.orderId });
return { total: order.getValue({ fieldId: 'total' }) };
};
return { get };
});
define(['N/record', 'N/runtime', 'N/log'], (record, runtime, log) => {
const GLOBAL_ROLES = [3, 15];
const get = (requestParams) => {
const currentUser = runtime.getCurrentUser();
const orderId = parseInt(requestParams.orderId, 10);
if (!orderId || orderId <= 0) return { error: 'Invalid order ID.' };
const order = record.load({ type: 'salesorder', id: orderId });
const owner = order.getValue({ fieldId: 'entity' });
if (String(owner) !== String(currentUser.id) && !GLOBAL_ROLES.includes(currentUser.role)) {
log.audit('IDOR Attempt', { user: currentUser.id, orderId: orderId, owner: owner });
return { error: 'Access denied.' };
}
return { total: order.getValue({ fieldId: 'total' }) };
};
return { get };
});
OSCP-017: Privilege Escalation via Execute-as-Admin Deployment
Category: Access Control
Severity: Critical
Reference: references/04-access-control.md Section 4
Problem: Setting runasrole to ADMINISTRATOR on a script deployment means every
user who accesses the script operates with full system privileges, bypassing all
permission checks.
<scriptdeployment scriptid="customdeploy_data_export">
<status>RELEASED</status>
<runasrole>ADMINISTRATOR</runasrole>
<allroles>T</allroles>
</scriptdeployment>
<scriptdeployment scriptid="customdeploy_data_export">
<status>RELEASED</status>
<runasrole>customrole_data_export</runasrole>
<allroles>F</allroles>
<roles>
<role>customrole_sales_manager</role>
<role>customrole_finance</role>
</roles>
</scriptdeployment>
OSCP-018: Overly Permissive Deployment Audience (allroles=T)
Category: Access Control
Severity: Medium
Reference: references/04-access-control.md Section 8
Problem: Setting allroles to T on a script deployment grants access to every
role in the system, including low-privilege roles that should never reach the script.
<scriptdeployment scriptid="customdeploy_salary_report">
<status>RELEASED</status>
<allroles>T</allroles>
</scriptdeployment>
<scriptdeployment scriptid="customdeploy_salary_report">
<status>RELEASED</status>
<allroles>F</allroles>
<roles>
<role>customrole_hr_manager</role>
<role>customrole_payroll</role>
</roles>
</scriptdeployment>
OSCP-019: Missing Function-Level Authorization on POST Handlers
Category: Access Control
Severity: High
Reference: references/04-access-control.md Section 3
Problem: Checking authorization only on the GET (form display) request but not
on the POST (form submission) request allows attackers to craft direct POST requests
that bypass the authorization check.
define(['N/record', 'N/runtime'], (record, runtime) => {
const onRequest = (context) => {
if (context.request.method === 'GET') {
if (runtime.getCurrentUser().role !== 3) {
context.response.write('Access denied.');
return;
}
}
if (context.request.method === 'POST') {
record.submitFields({
type: 'customrecord_config', id: 1,
values: { custrecord_setting: context.request.parameters.value }
});
}
};
return { onRequest };
});
define(['N/record', 'N/runtime', 'N/log'], (record, runtime, log) => {
const ADMIN_ROLES = [3];
const assertAdmin = (context) => {
const user = runtime.getCurrentUser();
if (!ADMIN_ROLES.includes(user.role)) {
log.audit('Auth Failure', { user: user.id, role: user.role, method: context.request.method });
context.response.setHeader({ name: 'Content-Type', value: 'application/json; charset=utf-8' });
context.response.write(JSON.stringify({ error: 'Insufficient privileges.' }));
return false;
}
return true;
};
const onRequest = (context) => {
if (!assertAdmin(context)) return;
if (context.request.method === 'GET') { }
if (context.request.method === 'POST') {
record.submitFields({
type: 'customrecord_config', id: 1,
values: { custrecord_setting: context.request.parameters.value }
});
}
};
return { onRequest };
});
OSCP-020: Horizontal Privilege Escalation (Missing Entity Filter)
Category: Access Control
Severity: High
Reference: references/04-access-control.md Section 5
Problem: A search or query that returns all records without filtering by the
current user's entity allows one user to see another user's data at the same
privilege level.
define(['N/search'], (search) => {
const onRequest = (context) => {
const results = search.create({
type: 'invoice',
filters: [['mainline', 'is', 'T']],
columns: ['tranid', 'total', 'entity']
}).run().getRange({ start: 0, end: 100 });
context.response.write(JSON.stringify(results));
};
});
define(['N/search', 'N/runtime'], (search, runtime) => {
const onRequest = (context) => {
const userId = runtime.getCurrentUser().id;
const results = search.create({
type: 'invoice',
filters: [
['mainline', 'is', 'T'],
'AND',
['entity', 'is', userId]
],
columns: ['tranid', 'total', 'duedate']
}).run().getRange({ start: 0, end: 100 });
context.response.write(JSON.stringify(results));
};
});
Security Misconfiguration (OSCP-021 to OSCP-024)
OSCP-021: Verbose Error Messages Exposing Internals
Category: Security Misconfiguration
Severity: Medium
Reference: references/05-security-misconfiguration.md Section 1
Problem: Returning stack traces, internal IDs, script file paths, or record
structure details in error responses gives attackers a map of the system.
define(['N/record'], (record) => {
const onRequest = (context) => {
try {
record.load({ type: 'salesorder', id: context.request.parameters.id });
} catch (e) {
context.response.write(JSON.stringify({
error: e.message, stack: e.stack, name: e.name, code: e.code
}));
}
};
});
define(['N/record', 'N/log'], (record, log) => {
const onRequest = (context) => {
try {
record.load({ type: 'salesorder', id: context.request.parameters.id });
} catch (e) {
const ref = 'ERR-' + Date.now().toString(36).toUpperCase();
log.error({ title: `Error [${ref}]`, details: { msg: e.message, stack: e.stack } });
context.response.setHeader({ name: 'Content-Type', value: 'application/json; charset=utf-8' });
context.response.write(JSON.stringify({
error: 'An unexpected error occurred.',
reference: ref
}));
}
};
});
OSCP-022: Debug Logging Enabled in Production
Category: Security Misconfiguration
Severity: Medium
Reference: references/05-security-misconfiguration.md Section 2
Problem: DEBUG-level logging in production captures all log.debug() calls, which
may contain sensitive data (payloads, tokens, PII). Execution logs are accessible to
users with script access.
<scriptdeployment scriptid="customdeploy_payment">
<status>RELEASED</status>
<loglevel>DEBUG</loglevel>
</scriptdeployment>
<scriptdeployment scriptid="customdeploy_payment">
<status>RELEASED</status>
<loglevel>AUDIT</loglevel>
</scriptdeployment>
OSCP-023: Test/Debug Endpoints Left in Production
Category: Security Misconfiguration
Severity: Critical
Reference: references/05-security-misconfiguration.md Section 6
Problem: Development endpoints such as arbitrary SuiteQL execution, environment
dump, or test email triggers left in released code provide direct exploitation paths.
define(['N/query'], (query) => {
const onRequest = (context) => {
if (context.request.parameters.action === 'run_query') {
const sql = context.request.parameters.sql;
const results = query.runSuiteQL({ query: sql });
context.response.write(JSON.stringify(results.asMappedResults()));
}
};
});
define(['N/log'], (log) => {
const VALID_ACTIONS = ['view', 'list', 'export'];
const onRequest = (context) => {
const action = context.request.parameters.action;
if (!VALID_ACTIONS.includes(action)) {
context.response.setHeader({ name: 'Content-Type', value: 'application/json; charset=utf-8' });
context.response.write(JSON.stringify({ error: 'Invalid action.' }));
return;
}
};
});
OSCP-024: Default/Fallback Credentials in Code
Category: Security Misconfiguration
Severity: Critical
Reference: references/05-security-misconfiguration.md Section 5
Problem: Code that falls back to a hardcoded credential when the Script Parameter
is empty means the real secret is permanently embedded in version control.
define(['N/https', 'N/runtime'], (https, runtime) => {
const execute = () => {
const apiKey = runtime.getCurrentScript().getParameter({ name: 'custscript_api_key' });
const effectiveKey = apiKey || 'sk-default-dev-key-abc123';
https.post({ url: 'https://api.vendor.com/data', headers: { 'Authorization': `Bearer ${effectiveKey}` }, body: '{}' });
};
});
define(['N/https', 'N/runtime', 'N/error'], (https, runtime, error) => {
const execute = () => {
const apiKey = runtime.getCurrentScript().getParameter({ name: 'custscript_api_key' });
if (!apiKey) {
throw error.create({ name: 'MISSING_CONFIG', message: 'custscript_api_key not set.' });
}
https.post({ url: 'https://api.vendor.com/data', headers: { 'Authorization': `Bearer ${apiKey}` }, body: '{}' });
};
});
Cryptography and Data Protection (OSCP-025 to OSCP-028)
OSCP-025: Using Math.random() for Security Tokens
Category: Cryptography and Data Protection
Severity: High
Reference: references/06-cryptography-data-protection.md Section 9
Problem: Math.random() uses a PRNG that is not cryptographically secure. Tokens
generated with it can be predicted by an attacker who observes a few outputs.
function generateToken() {
return Math.random().toString(36).substring(2);
}
define(['N/crypto/random'], (random) => {
const generateSecureToken = () => random.generateUUID().replace(/-/g, '');
return { generateSecureToken };
});
OSCP-026: Weak Hashing Algorithms (MD5/SHA-1)
Category: Cryptography and Data Protection
Severity: High
Reference: references/06-cryptography-data-protection.md Section 2
Problem: MD5 and SHA-1 are cryptographically broken. Collision attacks are practical,
and rainbow tables make password cracking trivial.
define(['N/crypto', 'N/encode'], (crypto, encode) => {
const hashData = (data) => {
const h = crypto.createHash({ algorithm: crypto.HashAlg.MD5 });
h.update({ input: data });
return h.digest({ outputEncoding: encode.Encoding.HEX });
};
});
define(['N/crypto', 'N/encode'], (crypto, encode) => {
const hashData = (data) => {
const h = crypto.createHash({ algorithm: crypto.HashAlg.SHA256 });
h.update({ input: data, inputEncoding: encode.Encoding.UTF_8 });
return h.digest({ outputEncoding: encode.Encoding.HEX });
};
});
OSCP-027: Hardcoded Encryption Keys
Category: Cryptography and Data Protection
Severity: Critical
Reference: references/06-cryptography-data-protection.md Section 5
Problem: Encryption keys embedded in source code provide no protection. Anyone
with repository access can decrypt the data.
See Principle 5 for NS-specific key management via Script Parameters and the
Credentials module.
define(['N/crypto'], (crypto) => {
const encrypt = (plaintext) => {
const key = 'SuperSecretKey2024!';
const cipher = crypto.createCipher({ algorithm: crypto.EncryptionAlg.AES, key: key });
cipher.update({ input: plaintext });
return cipher.final({ outputEncoding: 'hex' });
};
});
define(['N/crypto', 'N/encode', 'N/runtime', 'N/error'], (crypto, encode, runtime, error) => {
const encrypt = (plaintext) => {
const keyGuid = runtime.getCurrentScript().getParameter({ name: 'custscript_enc_key_guid' });
if (!keyGuid) {
throw error.create({ name: 'MISSING_KEY', message: 'Encryption key GUID not configured.' });
}
const secretKey = crypto.createSecretKey({ guid: keyGuid, encoding: encode.Encoding.UTF_8 });
const cipher = crypto.createCipher({
algorithm: crypto.EncryptionAlg.AES,
key: secretKey,
padding: crypto.Padding.PKCS5Padding
});
cipher.update({ input: plaintext, inputEncoding: encode.Encoding.UTF_8 });
return cipher.final({ outputEncoding: encode.Encoding.HEX }).toString();
};
});
OSCP-028: Storing Sensitive Data in Plain Text
Category: Cryptography and Data Protection
Severity: High
Reference: references/06-cryptography-data-protection.md Section 6
Problem: PII, tax IDs, credit card fragments, or health data stored unencrypted
in custom records are exposed to anyone with record-level read access.
define(['N/record'], (record) => {
const storeTaxId = (custId, taxId) => {
record.submitFields({
type: 'customer', id: custId,
values: { custentity_tax_id: taxId }
});
};
});
define(['N/record', './lib/SecurityCrypto'], (record, secureCrypto) => {
const storeTaxId = (custId, taxId) => {
const encrypted = secureCrypto.encrypt(taxId);
const masked = '***-**-' + taxId.slice(-4);
record.submitFields({
type: 'customer', id: custId,
values: {
custentity_encrypted_tax_id: encrypted,
custentity_masked_tax_id: masked
}
});
};
});
File Upload and Download (OSCP-029 to OSCP-032)
OSCP-029: Path Traversal in File Downloads
Category: File Upload and Download
Severity: Critical
Reference: references/07-file-upload-download.md Section 4
Problem: If a file path or name accepted from the request contains ../ sequences,
an attacker can escape the intended directory and access arbitrary files.
define(['N/file'], (file) => {
const onRequest = (context) => {
const fileName = context.request.parameters.file;
const filePath = '/SuiteScripts/uploads/' + fileName;
const fileObj = file.load({ id: filePath });
context.response.write(fileObj.getContents());
};
});
define(['N/file', 'N/error'], (file, error) => {
const sanitizePath = (filepath) => {
let safe = String(filepath).replace(/\0/g, '').replace(/\\/g, '/');
if (safe.includes('../') || safe.includes('..\\') || safe.startsWith('/')) {
throw error.create({ name: 'PATH_TRAVERSAL', message: 'Invalid file path.' });
}
return safe.split('/').pop();
};
const onRequest = (context) => {
const fileName = sanitizePath(context.request.parameters.file);
const fileObj = file.load({ id: '/SuiteScripts/uploads/' + fileName });
context.response.setHeader({ name: 'Content-Disposition', value: `attachment; filename="${fileName}"` });
context.response.setHeader({ name: 'X-Content-Type-Options', value: 'nosniff' });
context.response.write(fileObj.getContents());
};
});
OSCP-030: Unrestricted File Type Upload
Category: File Upload and Download
Severity: High
Reference: references/07-file-upload-download.md Section 1
Problem: Accepting any file type on upload allows attackers to upload executable
files, HTML files containing XSS payloads, or server-side scripts.
define(['N/file'], (file) => {
const onRequest = (context) => {
const uploaded = context.request.files.upload;
uploaded.folder = 123;
uploaded.save();
};
});
define(['N/file', 'N/error'], (file, error) => {
const ALLOWED = ['.pdf', '.csv', '.xlsx', '.png', '.jpg', '.jpeg'];
const onRequest = (context) => {
const uploaded = context.request.files.upload;
const ext = uploaded.name.slice(uploaded.name.lastIndexOf('.')).toLowerCase();
if (!ALLOWED.includes(ext)) {
throw error.create({
name: 'INVALID_FILE_TYPE',
message: `File type ${ext} is not permitted. Allowed: ${ALLOWED.join(', ')}`
});
}
uploaded.folder = 123;
uploaded.isOnline = false;
uploaded.save();
};
});
OSCP-031: Missing File Size Validation
Category: File Upload and Download
Severity: Medium
Reference: references/07-file-upload-download.md Section 3
Problem: Accepting files of arbitrary size can exhaust server resources and cause
denial of service.
define(['N/file'], (file) => {
const upload = (fileObj) => {
fileObj.folder = 123;
fileObj.save();
};
});
define(['N/file', 'N/error'], (file, error) => {
const MAX_SIZE = 10 * 1024 * 1024;
const upload = (fileObj) => {
if (fileObj.size > MAX_SIZE) {
throw error.create({
name: 'FILE_TOO_LARGE',
message: `File exceeds ${MAX_SIZE / (1024 * 1024)} MB limit.`
});
}
fileObj.folder = 123;
fileObj.isOnline = false;
fileObj.save();
};
});
OSCP-032: Missing MIME Type and Magic Byte Validation
Category: File Upload and Download
Severity: Medium
Reference: references/07-file-upload-download.md Sections 2 and 6
Problem: Validating only the file extension is insufficient. An attacker can rename
a malicious file with an allowed extension. Cross-referencing the MIME type and file
magic bytes provides defense in depth.
const isValid = (name) => name.endsWith('.png');
define(['N/file', 'N/encode', 'N/error'], (file, encode, error) => {
const MAGIC = { '.png': '89504E47', '.jpg': 'FFD8FF', '.pdf': '25504446' };
const validateFile = (fileObj) => {
const ext = fileObj.name.slice(fileObj.name.lastIndexOf('.')).toLowerCase();
const expected = MAGIC[ext];
if (!expected) return;
const headerHex = encode.convert({
string: fileObj.getContents().substring(0, 8),
inputEncoding: encode.Encoding.BASE_64,
outputEncoding: encode.Encoding.HEX
});
if (!headerHex.toUpperCase().startsWith(expected)) {
throw error.create({
name: 'INVALID_CONTENT',
message: `File content does not match ${ext} format.`
});
}
};
});
API and RESTlet Security (OSCP-033 to OSCP-036)
OSCP-033: Missing Rate Limiting on RESTlets
Category: API and RESTlet Security
Severity: Medium
Reference: references/08-api-restlet-security.md Section 3
Problem: Without rate limiting, an attacker can flood a RESTlet with requests to
exhaust governance units, overload the system, or brute-force data.
define([], () => {
const post = (requestBody) => {
return processRequest(requestBody);
};
return { post };
});
define(['N/cache', 'N/runtime', 'N/error'], (cache, runtime, error) => {
const LIMIT = 100;
const WINDOW = 3600;
const rateLimitCache = cache.getCache({ name: 'rate_limit', scope: cache.Scope.PUBLIC });
const checkRateLimit = () => {
const key = String(runtime.getCurrentUser().id);
const count = parseInt(rateLimitCache.get({ key: key }) || '0', 10);
if (count >= LIMIT) {
throw error.create({ name: 'RATE_LIMIT', message: 'Too many requests.' });
}
rateLimitCache.put({ key: key, value: String(count + 1), ttl: WINDOW });
};
const post = (requestBody) => {
checkRateLimit();
return processRequest(requestBody);
};
return { post };
});
OSCP-034: Missing Request Schema Validation
Category: API and RESTlet Security
Severity: Medium
Reference: references/08-api-restlet-security.md Section 2
Problem: Accepting and processing request bodies without validating required fields,
types, and lengths allows injection of unexpected data, type confusion, and
mass-assignment attacks.
define(['N/record'], (record) => {
const post = (requestBody) => {
record.submitFields({
type: 'customer', id: requestBody.id,
values: requestBody
});
};
return { post };
});
define(['N/record', 'N/error'], (record, error) => {
const SCHEMA = {
id: { type: 'number', required: true },
companyname: { type: 'string', required: true, maxLength: 200 },
email: { type: 'string', required: false, maxLength: 254 }
};
const validate = (body, schema) => {
const errors = [];
Object.keys(schema).forEach((field) => {
const rule = schema[field];
const val = body[field];
if (rule.required && (val === undefined || val === null || val === '')) {
errors.push(`${field} is required`);
}
if (val != null && rule.type === 'string' && typeof val !== 'string') {
errors.push(`${field} must be a string`);
}
if (val != null && rule.type === 'number' && typeof val !== 'number') {
errors.push(`${field} must be a number`);
}
if (val != null && rule.maxLength && String(val).length > rule.maxLength) {
errors.push(`${field} exceeds max length ${rule.maxLength}`);
}
});
if (errors.length) throw error.create({ name: 'VALIDATION_ERROR', message: errors.join('; ') });
};
const post = (requestBody) => {
validate(requestBody, SCHEMA);
record.submitFields({
type: 'customer', id: requestBody.id,
values: { companyname: requestBody.companyname, email: requestBody.email }
});
return { success: true };
};
return { post };
});
OSCP-035: Wildcard CORS Origin
Category: API and RESTlet Security
Severity: High
Reference: references/08-api-restlet-security.md Section 4
Problem: Setting Access-Control-Allow-Origin: * allows any website to make
cross-origin requests to the RESTlet, enabling data theft from authenticated sessions.
response.setHeader({ name: 'Access-Control-Allow-Origin', value: '*' });
const ALLOWED_ORIGINS = ['https://app.mycompany.com', 'https://portal.mycompany.com'];
const setCORS = (request, response) => {
const origin = request.headers['Origin'] || '';
if (ALLOWED_ORIGINS.includes(origin)) {
response.setHeader({ name: 'Access-Control-Allow-Origin', value: origin });
}
response.setHeader({ name: 'Access-Control-Allow-Methods', value: 'GET, POST, PUT, DELETE' });
response.setHeader({ name: 'Access-Control-Allow-Headers', value: 'Content-Type, Authorization' });
response.setHeader({ name: 'Access-Control-Max-Age', value: '3600' });
};
OSCP-036: SSRF via User-Controlled URLs
Category: API and RESTlet Security
Severity: High
Reference: references/08-api-restlet-security.md Section 9
Problem: If a script makes HTTP requests to URLs provided by the user without
validation, an attacker can probe internal network services, read cloud metadata
endpoints, or access restricted resources.
define(['N/https'], (https) => {
const post = (requestBody) => {
const response = https.get({ url: requestBody.webhookUrl });
return { status: response.code };
};
return { post };
});
define(['N/https', 'N/error'], (https, error) => {
const ALLOWED_HOSTS = ['hooks.slack.com', 'webhook.mypartner.com'];
const validateUrl = (url) => {
const parsed = new URL(url);
if (parsed.protocol !== 'https:') {
throw error.create({ name: 'INVALID_URL', message: 'Only HTTPS allowed.' });
}
if (!ALLOWED_HOSTS.includes(parsed.hostname)) {
throw error.create({ name: 'INVALID_URL', message: 'Host not in allowlist.' });
}
return parsed.href;
};
const post = (requestBody) => {
const safeUrl = validateUrl(requestBody.webhookUrl);
const response = https.get({ url: safeUrl });
return { status: response.code };
};
return { post };
});
Client-Side Security (OSCP-037 to OSCP-041)
OSCP-037: Missing CSP Headers on Suitelets
Category: Client-Side Security
Severity: Medium
Reference: references/09-client-side-security.md Section 1, references/appendices/appendix-csp-header-templates.md
Problem: Without Content-Security-Policy headers, any injected script executes in
the user's browser. CSP acts as a second line of defense when encoding is missed.
define([], () => {
const onRequest = (context) => {
context.response.write('<html><body>My App</body></html>');
};
});
define([], () => {
const onRequest = (context) => {
context.response.setHeader({
name: 'Content-Security-Policy',
value: [
"default-src 'self'",
"script-src 'self' https://*.netsuite.com",
"style-src 'self' 'unsafe-inline' https://*.netsuite.com",
"img-src 'self' data: https://*.netsuite.com",
"frame-ancestors 'self'",
"form-action 'self'",
"base-uri 'self'"
].join('; ')
});
context.response.setHeader({ name: 'X-Content-Type-Options', value: 'nosniff' });
context.response.setHeader({ name: 'X-Frame-Options', value: 'SAMEORIGIN' });
context.response.write('<html><body>My App</body></html>');
};
});
OSCP-038: Wildcard postMessage Origins
Category: Client-Side Security
Severity: High
Reference: references/09-client-side-security.md Section 5
Problem: Sending or receiving postMessage without checking the origin allows
any website to send malicious messages to the script or receive data from it.
window.addEventListener('message', (e) => {
processData(e.data);
});
targetWindow.postMessage(sensitiveData, '*');
const TRUSTED_ORIGIN = 'https://1234567.app.netsuite.com';
window.addEventListener('message', (e) => {
if (e.origin !== TRUSTED_ORIGIN) return;
processData(e.data);
});
targetWindow.postMessage(data, TRUSTED_ORIGIN);
OSCP-039: Missing CSRF Tokens on State-Changing Forms
Category: Client-Side Security
Severity: High
Reference: references/09-client-side-security.md Section 3
Problem: Without CSRF tokens, an attacker's website can submit a form to the
Suitelet, performing actions on behalf of the victim's authenticated session.
define([], () => {
const onRequest = (context) => {
if (context.request.method === 'GET') {
context.response.write('<form method="POST"><input name="action" value="delete"><button>Submit</button></form>');
}
if (context.request.method === 'POST') {
performAction(context.request.parameters.action);
}
};
});
define(['N/cache', 'N/crypto/random', 'N/runtime', 'N/error'], (cache, random, runtime, error) => {
const csrfCache = cache.getCache({ name: 'csrf_tokens', scope: cache.Scope.PRIVATE });
const generateCsrfToken = () => {
const token = random.generateUUID().replace(/-/g, '');
csrfCache.put({ key: token, value: 'valid', ttl: 1800 });
return token;
};
const validateCsrfToken = (token) => {
if (!token || csrfCache.get({ key: token }) !== 'valid') {
throw error.create({ name: 'CSRF_INVALID', message: 'Invalid or expired CSRF token.' });
}
csrfCache.remove({ key: token });
};
const escapeHtml = (s) => String(s).replace(/&/g,'&').replace(/</g,'<')
.replace(/>/g,'>').replace(/"/g,'"').replace(/'/g,''');
const onRequest = (context) => {
if (context.request.method === 'GET') {
const token = generateCsrfToken();
context.response.write(`<form method="POST">
<input type="hidden" name="csrf_token" value="${escapeHtml(token)}">
<input name="action" value="delete">
<button>Submit</button>
</form>`);
}
if (context.request.method === 'POST') {
validateCsrfToken(context.request.parameters.csrf_token);
performAction(context.request.parameters.action);
}
};
return { onRequest };
});
OSCP-040: Using eval(), new Function(), or setTimeout(string)
Category: Client-Side Security
Severity: Critical
Reference: references/03-xss-output-encoding.md Section 3
Problem: eval(), new Function(), and string-form setTimeout/setInterval
execute arbitrary code. If any user input reaches these sinks, the attacker achieves
full JavaScript execution in the victim's browser.
define([], () => {
const pageInit = () => {
const action = new URLSearchParams(window.location.search).get('action');
eval(action);
};
return { pageInit };
});
define([], () => {
const actions = {
refresh: () => window.location.reload(),
scrollTop: () => window.scrollTo(0, 0),
togglePanel: () => {
const p = document.getElementById('panel');
p.style.display = p.style.display === 'none' ? 'block' : 'none';
}
};
const pageInit = () => {
const action = new URLSearchParams(window.location.search).get('action');
if (action && actions[action]) {
actions[action]();
}
};
return { pageInit };
});
OSCP-041: Sensitive Data in Local Storage
Category: Client-Side Security
Severity: Medium
Reference: references/09-client-side-security.md Section 8
Problem: localStorage and sessionStorage are accessible to any JavaScript
running on the same origin. If an XSS vulnerability exists, stored tokens, PII, or
session data can be exfiltrated.
localStorage.setItem('authToken', 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...');
localStorage.setItem('userSSN', '123-45-6789');
sessionStorage.setItem('uiPreference', 'dark-mode');
Logging and Monitoring (OSCP-042 to OSCP-044)
OSCP-042: Missing Audit Trail Logging
Category: Logging and Monitoring
Severity: Medium
Reference: references/10-logging-monitoring.md Sections 1 and 5
Problem: Security-relevant events (authentication, authorization failures,
data modifications, configuration changes) that are not logged leave no evidence
for incident response or forensic analysis.
define(['N/record'], (record) => {
const deleteCustomer = (custId) => {
record.delete({ type: 'customer', id: custId });
};
});
define(['N/record', 'N/runtime', 'N/log'], (record, runtime, log) => {
const deleteCustomer = (custId) => {
const user = runtime.getCurrentUser();
log.audit('DATA_DELETE', JSON.stringify({
action: 'DELETE',
recordType: 'customer',
recordId: custId,
userId: user.id,
role: user.role,
timestamp: new Date().toISOString()
}));
record.delete({ type: 'customer', id: custId });
};
});
OSCP-043: Logging Sensitive Data (PII, Credentials)
Category: Logging and Monitoring
Severity: Critical
Reference: references/10-logging-monitoring.md Section 2
Problem: Passwords, API keys, tokens, SSNs, credit card numbers, and other sensitive
data written to logs are exposed to anyone with execution log access and may violate
PCI-DSS, HIPAA, or GDPR.
define(['N/log', 'N/runtime'], (log, runtime) => {
const execute = () => {
const apiKey = runtime.getCurrentScript().getParameter({ name: 'custscript_api_key' });
log.debug('API Key', apiKey);
log.debug('Customer', JSON.stringify({ name: 'Doe', ssn: '123-45-6789' }));
};
});
define(['N/log', 'N/runtime'], (log, runtime) => {
const SENSITIVE = ['ssn', 'password', 'apikey', 'token', 'secret', 'creditcard'];
const redact = (obj) => {
const safe = {};
for (const [key, value] of Object.entries(obj)) {
if (SENSITIVE.some((s) => key.toLowerCase().includes(s))) {
safe[key] = '[REDACTED]';
} else {
safe[key] = value;
}
}
return safe;
};
const execute = () => {
const apiKey = runtime.getCurrentScript().getParameter({ name: 'custscript_api_key' });
log.audit('Integration', { hasApiKey: !!apiKey });
log.audit('Customer', JSON.stringify(redact({ name: 'Doe', ssn: '123-45-6789' })));
};
});
OSCP-044: Insufficient Monitoring (No Alerting on Suspicious Patterns)
Category: Logging and Monitoring
Severity: Medium
Reference: references/10-logging-monitoring.md Sections 7 and 8
Problem: Logging events without monitoring or alerting means breaches go undetected.
Repeated authentication failures, sudden spikes in API calls, or access to restricted
records should trigger alerts.
define(['N/log'], (log) => {
const onAuthFailure = (userId) => {
log.audit('Auth Failure', `User ${userId} failed login.`);
};
});
define(['N/log', 'N/cache', 'N/email', 'N/runtime'], (log, cache, email, runtime) => {
const ALERT_THRESHOLD = 5;
const failureCache = cache.getCache({ name: 'auth_failures', scope: cache.Scope.PUBLIC });
const onAuthFailure = (userId) => {
const key = 'fail_' + userId;
const count = parseInt(failureCache.get({ key: key }) || '0', 10) + 1;
failureCache.put({ key: key, value: String(count), ttl: 900 });
log.audit('AUTH_FAILURE', JSON.stringify({
userId: userId,
failureCount: count,
timestamp: new Date().toISOString()
}));
if (count >= ALERT_THRESHOLD) {
log.audit('SECURITY_ALERT', `Repeated auth failures for user ${userId}: ${count} in 15 min.`);
email.send({
author: runtime.getCurrentUser().id,
recipients: ['security-team@company.com'],
