@fabriziosalmi/slopless 1.11.0 → 1.12.0

package/rules/VBC-927.yaml

@@ -12,6 +12,7 @@ match:
     - html
     - tsx
     - jsx
+    - astro
 message: >-
   Vague button label '{match}' detected at line {line}. Use action-oriented labels (e.g.,
   'Save Changes', 'Create Account').

package/rules/VBC-928.yaml

@@ -44,6 +44,7 @@ match:
     - kt
     - swift
     - rb
+    - astro
 message: >-
   Placeholder text 'Lorem ipsum' detected at line {line}. Replace with real content before
   committing.

package/rules/VBC-937.yaml

@@ -13,6 +13,7 @@ match:
     - ts
     - jsx
     - tsx
+    - astro
 message: >-
   Authentication token or role stored/read from browser storage at line {line}. Client-side
   auth logic is trivially bypassable. Validate identity server-side on every request. Never

package/rules/VBC-938.yaml

@@ -12,6 +12,7 @@ match:
     - js
     - ts
     - py
+    - astro
 message: >-
   Potential command injection at line {line}. Shell commands constructed with string interpolation
   or concatenation allow attackers to execute arbitrary commands. Use parameterized commands

package/rules/VBC-939.yaml

@@ -11,6 +11,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   File upload handler at line {line} may lack type/size restrictions. Without validating MIME
   type, file extension, and size, attackers can upload malicious executables or exhaust disk

package/rules/VBC-940.yaml

@@ -13,6 +13,7 @@ match:
     - js
     - ts
     - py
+    - astro
 supersedes:
   - VBC-007
 message: >-

package/rules/VBC-941.yaml

@@ -13,6 +13,7 @@ match:
     - ts
     - jsx
     - tsx
+    - astro
 supersedes:
   - VBC-070
 message: >-

package/rules/VBC-942.yaml

@@ -11,6 +11,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   Route handler at line {line} may be missing authentication middleware. AI-generated route
   handlers frequently omit auth guards. Ensure every non-public endpoint is protected with

package/rules/VBC-943.yaml

@@ -10,6 +10,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   Catch clause with ignored error variable at line {line}. Using '_' as the catch binding
   signals the exception is intentionally discarded. AI-generated code often silently suppresses

package/rules/VBC-944.yaml

@@ -6,8 +6,12 @@ tags:
   - security
   - ai-error
 match:
+  # The hazard is an interpolation that decides the scheme. A literal prefix
+  # settles it first: `mailto:${addr}` and `/blog/${slug}` cannot become
+  # `javascript:` whatever the value is, and that is how a template builds
+  # every ordinary link.
   regex: >-
-    href\s*=\s*\{[^}]*\+|href\s*=\s*[`'"][^`'"]*\$\{|href\s*=\s*\{\s*`[^`]*\$\{
+    href\s*=\s*\{[^}]*\+|href\s*=\s*[`'"]\s*\$\{|href\s*=\s*\{\s*[`'"]\s*\$\{
   scan: all
   file_types:
     - js
@@ -15,6 +19,7 @@ match:
     - jsx
     - tsx
     - html
+    - astro
 message: >-
   Dynamic href constructed with string interpolation at line {line}. If the value originates
   from user input or an untrusted source, this is a javascript: URL injection vector. Validate
@@ -23,4 +28,8 @@ tests:
   fire:
     - const link = `href="${untrusted}"`;
   quiet:
+    # A literal prefix settles the scheme before the value arrives.
+    - '<a href={`mailto:${contact.email}`}>write to us</a>'
+    - '<a href={`/blog/${slug}`}>read on</a>'
+    - '<a href={`https://example.org/u/${user}`}>profile</a>'
     - <a href="/static/page">page</a>

package/rules/VBC-945.yaml

@@ -18,6 +18,7 @@ match:
     - py
     - go
     - java
+    - astro
 supersedes:
   - VBC-907
   - VBC-150

package/rules/VBC-946.yaml

@@ -12,6 +12,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   Destructive async operation at line {line} with no verification of success. AI agents frequently
   execute irreversible actions (delete, drop, rm) based on assumed success without checking

package/rules/VBC-947.yaml

@@ -11,6 +11,7 @@ match:
   file_types:
     - js
     - ts
+    - astro
 message: >-
   Merging untrusted request body directly at line {line}. This pattern enables prototype pollution:
   an attacker can inject __proto__ or constructor.prototype to corrupt the application object