Validation and Security Analysis
WebZone provides tools for detecting common code quality problems and potentially unsafe patterns in HTML, CSS, and JavaScript. The tools are designed for development assistance and preliminary analysis.
HTML Validation
HTML validation is powered by HTMLHint.
Usage
- Select HTML Validation.
- Paste HTML markup.
- Click Validate.
- Review any issues found.
Validation Rules
| Rule | Purpose |
|---|---|
| Lowercase tags | Check HTML tag capitalization |
| Lowercase attributes | Check attribute capitalization |
| No duplicate attributes | Identify repeated attributes |
| Double-quoted values | Check attribute value formatting |
| Tag pairing | Detect selected mismatched or unclosed tags |
| Special character escaping | Identify improperly escaped characters |
| Unique IDs | Detect duplicate element identifiers |
| Nonempty source attributes | Check source attribute values |
Example
Input:
<DIV id="example">
<img src="">
</DIV>Depending on the configured HTMLHint rules, the validator may report uppercase tags or an empty source attribute.
Results
When problems are detected, WebZone reports information including:
- Issue severity or type
- Validation rule
- Line number
- Column number
- Description
When no configured rule is violated, the tool reports that no issues were found.
CSS Validation
CSS validation is powered by CSSTree.
Usage
- Select CSS Validation.
- Paste your CSS.
- Click Validate.
- Review the reported findings.
Checks
The validator examines:
- CSS parsing errors
- Unknown properties
- Invalid property values
Example
.example {
color: not-a-color;
invalid-property: test;
}The validator may report invalid property values and unrecognized properties.
Important Limitations
Validation depends on CSSTree's property and syntax definitions.
Custom properties, vendor extensions, and newly introduced CSS features may require manual review.
A clean result does not guarantee that CSS will render identically across browsers.
HTML Security Scanning
WebZone includes a pattern-based HTML security scanner.
Usage
- Select Security Scan.
- Choose HTML.
- Paste HTML source.
- Click Scan.
- Review the findings.
Detection Categories
| Category | Examples |
|---|---|
| Content Security Policy | Missing CSP, selected unsafe directives |
| External links | target="_blank" without appropriate relationship attributes |
| Inline JavaScript | Inline scripts and event handlers |
| Inline styles | Style attributes |
| Unsafe URL schemes | javascript: references |
| Mixed content | HTTP resources and form actions |
| Forms | Selected method and action issues |
| Script integrity | External scripts without SRI attributes |
| Iframes | Missing sandbox attributes |
| Referrer controls | Missing referrer policy attributes |
Example
<a href="https://example.com" target="_blank">
Visit site
</a>The scanner may recommend adding:
rel="noopener noreferrer"Content Security Policy Recommendations
The HTML scanner also generates a suggested Content Security Policy template.
This template should be reviewed and adapted to your application's legitimate resource requirements.
Important: A Content Security Policy is generally best configured and verified through HTTP response headers. Some directives, such as
frame-ancestors, are not supported through HTML meta-element CSP policies.
JavaScript Security Scanning
The JavaScript scanner identifies selected potentially dangerous coding patterns.
Usage
- Select Security Scan.
- Choose JavaScript.
- Paste JavaScript source.
- Click Scan.
- Review the findings.
Detection Categories
| Category | Example |
|---|---|
| Dynamic execution | eval() |
| Dynamic function construction | new Function() |
| String timers | String arguments to timers |
| DOM writing | document.write() |
| HTML injection sinks | innerHTML, outerHTML, insertAdjacentHTML |
| Navigation | Selected location assignments |
| Global exposure | Properties assigned to global objects |
| Cross-window messaging | postMessage() with wildcard origin |
| Insecure requests | HTTP fetch and XMLHttpRequest patterns |
| Cryptographic configuration | Selected PBKDF2 iteration patterns |
Example
const userInput = "2 + 2";
const result = eval(userInput);The scanner identifies the use of eval() as a potentially unsafe pattern.
An appropriate solution depends on why dynamic execution was used.
Severity Levels
Findings are labeled:
| Severity | Meaning |
|---|---|
| HIGH | Pattern prioritized for security review |
| MED | Potential concern requiring contextual assessment |
| LOW | Informational or lower-priority concern |
These labels are assigned by the scanner's rules. They are not measured exploitability scores.
Understanding Scan Results
A finding generally includes:
- Severity
- Rule identifier
- Location
- Explanation
- Suggested remediation
Limitations
The scanner uses heuristic pattern matching. It is not a complete static application security testing engine.
Consequently:
- Legitimate code may produce findings.
- Dangerous code may go undetected.
- Findings do not establish exploitability.
- A clean result does not establish security.
Use WebZone as a preliminary review tool alongside appropriate testing and professional security assessment.
Best Practices
Review findings individually, understand the context, and test proposed changes before deploying them.
Do not rely on a clean scan alone as proof that an application is secure.
Updated 10 days ago