noInsecureCookie: confirm whether a Suitelet may set Set-Cookie

Open
  • Is something wrong?
#39 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
68/100
Issue type
Documentation
Clarity
Clearly specified
Activity status
Active
Tech stack
typescript
Domain
tooling

Research direction

Read the Oracle SuiteScript 2.1 N/https and ServerResponse.setHeader documentation, including the blocked response headers list; if possible, verify behavior in a real account. Then report whether a Suitelet can set Set-Cookie and cite the evidence. If it can, update src/rules/noInsecureCookie.ts, docs/rule-priority.md, and the opt-in reason in scripts/rule-sources.ts; if it cannot, explain which documentation establishes that.

Written by the indexing model from the issue text.

Description

documentation good first issue help wanted

Question

noInsecureCookie (src/rules/noInsecureCookie.ts) is opt-in and in no preset. Oracle's OWASP agent skill says Suitelet cookies "must include security attributes", which assumes a Suitelet can set a Set-Cookie response header at all. We have not confirmed that.

What to do

Check Oracle's documentation (the SuiteScript 2.1 N/https and ServerResponse.setHeader pages, and the list of blocked response headers) and, if possible, a real account. Then report one of:

  • A Suitelet can set Set-Cookie: the rule's premise holds. Move it toward all per docs/rule-priority.md and update the source comment and the README opt-in reason (scripts/rule-sources.ts).
  • It cannot (the header is blocked or ignored): the rule is moot. Say so here with the page that shows it, and we will drop or reshape it (see noBlockedResponseHeader).

Where

  • Rule: src/rules/noInsecureCookie.ts
  • Why it is opt-in: ADR 0005
  • Source ranking: docs/rule-priority.md (read Oracle sources in full and quote them in the rule comment)
Dominant language
TypeScript
Stars
1
Forks
0
Avg merge
2h 8m
Merged PRs (30d)
64

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from nemchik/biome-plugin-suitescript

All issues in nemchik/biome-plugin-suitescript

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.