no-sensitive-indexeddb

No Sensitive Indexeddb

⚠️ Security IssueCopy Anchor Link

📋 DescriptionCopy Anchor Link

IndexedDB is accessible via JavaScript and can be stolen through XSS attacks. Sensitive data like passwords, tokens, and API keys should not be stored in client-side databases.

The rule reports a sensitive name written to IndexedDB, matched as whole words (plurals folded, so passwords matches password; tokenizer does not match token):

• the store name in db.createObjectStore(name);
• a field name in the record of store.add({ … }) / store.put({ … });
• the out-of-line record key in store.put(value, key) / store.add(value, key);
• with the idb wrapper, the store name and record of db.put(storeName, value, key) and the key in its third argument.

.add / .put count only when the receiver resolves to an objectStore() / createObjectStore() call (or an idb database) in the file: jobQueue.add({ password }) is a job queue, not IndexedDB.

The vocabulary is sensitiveTerms — by default every non-bearer secret word plus the bearer-credential words (token, jwt, session, …). Setting sensitiveTerms replaces the whole list, bearer words included; additionalPatterns is appended to whatever the list is.

❌ IncorrectCopy Anchor Link

// Creating object store for sensitive data
db.createObjectStore('passwords');
db.createObjectStore('secrets');
db.createObjectStore('apiKeys');

// Storing sensitive data
const store = db.transaction('vault', 'readwrite').objectStore('vault');
store.add({ password: userPassword });
store.put({ apiKey: key });
store.put(value, 'password'); // out-of-line key

✅ CorrectCopy Anchor Link

// Store non-sensitive data
db.createObjectStore('preferences');
db.createObjectStore('cachedData');

// Store user preferences
const prefs = db.transaction('prefs', 'readwrite').objectStore('prefs');
prefs.add({ theme: 'dark', language: 'en' });

// Not IndexedDB: an unrelated receiver
jobQueue.add({ password: tempPassword });

// A replaced vocabulary replaces everything
// { "sensitiveTerms": ["pin"] }
db.createObjectStore('accessToken'); // not reported under this config

🛠️ OptionsCopy Anchor Link

{
  "rules": {
    "browser-security/no-sensitive-indexeddb": [
      "error",
      {
        "allowInTests": true
      }
    ]
  }
}

Known False NegativesCopy Anchor Link

The following patterns are not detected due to static analysis limitations:

Dynamic Store NamesCopy Anchor Link

Why: Computed names not analyzed.

// ❌ NOT DETECTED - Dynamic name
const name = 'passwords';
db.createObjectStore(name);

Mitigation: Use static store names. Avoid sensitive naming.

Nested Sensitive DataCopy Anchor Link

Why: Deep object properties not traced.

// ❌ NOT DETECTED - Nested data
store.put({ user: { password: pwd } });

Mitigation: Never store sensitive data in IndexedDB.

Library WrappersCopy Anchor Link

Why: IndexedDB wrappers not recognized.

// ❌ NOT DETECTED - Dexie wrapper
db.secrets.add({ apiKey: key });

Mitigation: Apply rule to wrapper implementations.

📚 Related ResourcesCopy Anchor Link

• MDN: IndexedDB
• OWASP: HTML5 Security

Use this rule

npm install -D oxlint-plugin-browser-security

{  "jsPlugins": ["oxlint-plugin-browser-security"],  "rules": {    "browser-security/no-sensitive-indexeddb": "error"  }}

import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-browser-security'],    rules: {      'browser-security/no-sensitive-indexeddb': 'error',    },  },});