@fabriziosalmi/slopless 1.13.0 → 1.14.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fabriziosalmi/slopless",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "description": "",
   "main": "dist/index.js",
   "bin": {

package/rules/VBC-949.yaml

@@ -0,0 +1,29 @@
+id: VBC-949
+name: committed-private-key
+severity: error
+category: security
+tags:
+  - security
+  - secrets
+  - git
+match:
+  # Asked over the tracked files on every run, not only over staged ones: every
+  # other git check reads what is about to be committed, which is right for
+  # "you are adding a .env" and wrong for a key that was committed two years ago
+  # and is still in the tree.
+  #
+  # A .p12, .pfx, .jks or .keystore holds nothing else, so the extension settles
+  # it. A .pem or .key does not — half of them are certificates, which are
+  # public and exist to be handed out — so those are read, and only the ones
+  # carrying a PRIVATE KEY header are reported.
+  #
+  # Matching that header in any file was measured and thrown away: across 24,876
+  # files it fired 85 times, and 83 were test fixtures, code that writes the
+  # header, documentation about keys, and three YARA rules whose job is to find
+  # private keys. The signal is the file, not the string.
+  git_check: private_key
+message: >-
+  A private key is committed here. Rotate it: it is in the history, and deleting the file
+  does not take it out of there. Certificates are not reported; they are public.
+tests:
+  external: 'git-checker.test.ts: needs a file list and a PEM header'

package/rules/VBC-950.yaml

@@ -0,0 +1,41 @@
+id: VBC-950
+name: window-open-without-noopener
+severity: error
+category: security
+tags:
+  - security
+match:
+  # `target="_blank"` on an anchor has implied `noopener` in every browser since
+  # 2021. `window.open` never has: the page it opens gets `window.opener` and
+  # can navigate this one somewhere else while the user is looking away.
+  #
+  # Two shapes are not that. Opening a blank window returns a handle the code is
+  # about to use — `const win = window.open('', '_blank'); win.document.write(…)`
+  # — and `noopener` makes that handle null, so an empty first argument, an
+  # explicit about:blank, and no argument at all are all left alone.
+  regex: >-
+    window\.open\(\s*(?!\))(?!['"`]\s*['"`])(?!['"`]about:blank)(?![^\n]*noopener)
+  scan: code
+  file_types:
+    - js
+    - ts
+    - tsx
+    - jsx
+    - astro
+message: >-
+  window.open() at line {line} without 'noopener'. The page it opens gets a handle on this
+  one and can navigate it. Pass 'noopener' in the third argument, or keep the handle
+  deliberately if the code needs it.
+tests:
+  fire:
+    - window.open(url, '_blank');
+    - window.open(`${base}/issues/new`, '_blank')
+    - onClick={() => window.open(previewUrl, '_blank')}
+  quiet:
+    - window.open(url, '_blank', 'noopener');
+    - window.open(target, "_blank", "noopener,noreferrer");
+    # A blank window is opened for its handle, which noopener would take away.
+    - const win = window.open('', '_blank');
+    - const win = window.open("about:blank");
+    - const win = window.open();
+    - popup.close();