@fabriziosalmi/slopless 1.12.0 → 1.12.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/engine/api.js +2 -2
- package/dist/index.js +41 -41
- package/package.json +1 -1
- package/rules/VBC-004.yaml +6 -1
- package/rules/VBC-944.yaml +8 -1
package/package.json
CHANGED
package/rules/VBC-004.yaml
CHANGED
|
@@ -6,11 +6,14 @@ tags:
|
|
|
6
6
|
- security
|
|
7
7
|
match:
|
|
8
8
|
regex: >-
|
|
9
|
-
(?:"[^"\n]*|'[^'\n]*|`[^`\n]*)(?:\bSELECT\b[^\n]{0,80}?\bFROM\b|\bINSERT\s+INTO\b|\bUPDATE\b[^\n]{0,80}?\bSET\b|\bDELETE\b[^\n]{0,80}?\bFROM\b|\bWHERE\b|\bVALUES\s*\()[^\n]{0,120}?["'`]\s*\+|\+=?\s*["'`][^\n]{0,80}?\b(?:WHERE\s|VALUES\s*\(|SET\s+\w+\s*=(?!\s*(?:\?|\$\d+|:\w+|%[sd])\s*[\"'`])|ORDER\s+BY|GROUP\s+BY|LIMIT\s+\d|AND\s+\w+\s*=(?!\s*(?:\?|\$\d+|:\w+|%[sd])\s*[\"'`])|OR\s+\w+\s*=(?!\s*(?:\?|\$\d+|:\w+|%[sd])\s*[\"'`]))
|
|
9
|
+
(?:"[^"\n]*|'[^'\n]*|`[^`\n]*)(?:\bSELECT\b[^\n]{0,80}?\bFROM\b|\bINSERT\s+INTO\b|\bUPDATE\b[^\n]{0,80}?\bSET\b|\bDELETE\b[^\n]{0,80}?\bFROM\b|\bWHERE\b|\bVALUES\s*\()[^\n]{0,120}?["'`]\s*\+|\+=?\s*(?=[^\n]*["'`]\s*\+)["'`][^\n]{0,80}?\b(?:WHERE\s|VALUES\s*\(|SET\s+\w+\s*=(?!\s*(?:\?|\$\d+|:\w+|%[sd])\s*[\"'`])|ORDER\s+BY|GROUP\s+BY|LIMIT\s+\d|AND\s+\w+\s*=(?!\s*(?:\?|\$\d+|:\w+|%[sd])\s*[\"'`])|OR\s+\w+\s*=(?!\s*(?:\?|\$\d+|:\w+|%[sd])\s*[\"'`]))
|
|
10
10
|
flags: i
|
|
11
11
|
# A fragment that closes on a placeholder injects nothing: `q += " AND p = ?"`
|
|
12
12
|
# beside `args = append(args, v)` is how a dynamic WHERE clause is built
|
|
13
13
|
# safely, and it is the shape every Go and Python query builder uses.
|
|
14
|
+
# Appending a literal concatenates nothing: `q += " ORDER BY id DESC;"` adds
|
|
15
|
+
# a clause the code already decided. The branch now asks that a value actually
|
|
16
|
+
# arrive, which is the thing the rule is about.
|
|
14
17
|
scan: all
|
|
15
18
|
file_types:
|
|
16
19
|
- js
|
|
@@ -33,6 +36,8 @@ tests:
|
|
|
33
36
|
- db.query("SELECT * FROM users WHERE id = " + id);
|
|
34
37
|
- sql += " AND status = " + status;
|
|
35
38
|
quiet:
|
|
39
|
+
- 'q += " ORDER BY acquired DESC;"'
|
|
40
|
+
- 'q += " LIMIT 10;"'
|
|
36
41
|
- db.query("SELECT * FROM users WHERE id = $1", [id]);
|
|
37
42
|
- 'q += ` AND project = ?`'
|
|
38
43
|
- sql += " AND id = $1"
|
package/rules/VBC-944.yaml
CHANGED
|
@@ -10,8 +10,12 @@ match:
|
|
|
10
10
|
# settles it first: `mailto:${addr}` and `/blog/${slug}` cannot become
|
|
11
11
|
# `javascript:` whatever the value is, and that is how a template builds
|
|
12
12
|
# every ordinary link.
|
|
13
|
+
#
|
|
14
|
+
# import.meta.env.X is replaced by the bundler before the page ever runs, so
|
|
15
|
+
# it is a literal by the time a request exists. Vite and Astro spell every
|
|
16
|
+
# base path that way.
|
|
13
17
|
regex: >-
|
|
14
|
-
href\s*=\s*\{[^}]*\+|href\s*=\s*[`'"]\s*\$\{|href\s*=\s*\{\s*[`'"]\s*\$\{
|
|
18
|
+
href\s*=\s*\{[^}]*\+|href\s*=\s*[`'"]\s*\$\{(?!\s*import\.meta\.env\.)|href\s*=\s*\{\s*[`'"]\s*\$\{(?!\s*import\.meta\.env\.)
|
|
15
19
|
scan: all
|
|
16
20
|
file_types:
|
|
17
21
|
- js
|
|
@@ -32,4 +36,7 @@ tests:
|
|
|
32
36
|
- '<a href={`mailto:${contact.email}`}>write to us</a>'
|
|
33
37
|
- '<a href={`/blog/${slug}`}>read on</a>'
|
|
34
38
|
- '<a href={`https://example.org/u/${user}`}>profile</a>'
|
|
39
|
+
# Replaced by the bundler before a request exists.
|
|
40
|
+
- '<link href={`${import.meta.env.BASE_URL}favicon.svg`} />'
|
|
41
|
+
- '<a href={`${import.meta.env.BASE_URL}docs/${slug}`}>docs</a>'
|
|
35
42
|
- <a href="/static/page">page</a>
|