OptimumCredo.Check.Warning.HiddenIdInput (OptimumCredo v0.5.0)

View Source

Basics

This check is disabled by default.

Learn how to enable it via .credo.exs.

This check has a base priority of low and works with any version of Elixir.

Explanation

Do not rely on hidden *_id inputs for authorisation. Derive the owner from the session/socket and scope queries by it. Reported for <input type="hidden"> and <.input type="hidden"> whose name, id or field ends in _id. Partial heuristic; Sobelow and review cover the semantics. Opt-in, low priority.

Check-Specific Parameters

Use the following parameters to configure this check:

:allowed_fields

Hidden field names accepted as written.

This parameter defaults to [].

General Parameters

Like with all checks, general params can be applied.

Parameters can be configured via the .credo.exs config file.