A-0770

🆓

Error

Never allow application pages within an HTML frame.

APEX_APPLICATIONS All APEX versions • Check and SQL-based Test

Rule Details

Severity Level: Blocker
Quality Area: Security
Fixing times: 1 mins

Quick Fix | Local-easy
Database Support: OracleDB (v7.3.4 +)

Reason

The property embedInFrames dictates whether a browser is allowed to display your application pages within an HTML frame, and if so, under what circumstances.

Applications that allow frame embedding are potentially at risk of "clickjacking" attacks. This is where an attacker uses multiple page layers to intercept clicks that were meant for buttons or links in the application, instead routing them to another page.

Option	Description
`deny`	The page is not allowed to be rendered within a frame, regardless of the site attempting to do so. This is the default.
`allow`	The page can be displayed in any frame, regardless of origin.
`allowSameOrigin`	The page can be displayed within a frame, but only if the frame is from the same origin as the page.

NOTE: This feature requires modern browsers that support the HTTP header response variable X-Frame-Options.

How to Fix

To set the value of Embed in Frames:

Edit your application's Shared Components.
In the Security region, click on Security Attributes.
In the Browser Security region, set the value of Embed in Frames to Deny or Allow from Same Origin.
Click Apply Changes.

Examples

Non-Compliant Example

app DEMO (
    security {
        embedInFrames: allow
    }
)

Compliant Solution - ★★★★☆

app demo (
    security {
        embedInFrames: allowSameOrigin
    }
)

Compliant Solution - ★★★★★

app demo (
    security {
        embedInFrames: deny
    }
)

This is the default value. The property will be removed after an export.

Tests

Test SQL query

select workspace || '.' || alias as identifier,
       'App ' || alias || ' in ' || workspace || ' allows insecure content in frames.' as message,
       null as migration
  from apex_applications
 where browser_frame = 'Allow'
   and workspace in (#ApexWorkspaces#)
 order by workspace, alias

Test results

Identifier	Message	Migration
WORKSPACE.DEMO	App DEMO in WORKSPACE is allows insecure content in frames.	-

Parameters

Use parameters to customize the rule to your needs.

Parameter	Description	Default Value
ApexWorkspaces	Comma-separated List of APEX workspaces owning APEX applications to check.	dblinter, dbl_gui

References

same as SERT-EMBED_IN_FRAMES
related to A05_2021-Security_Misconfiguration