@fabriziosalmi/slopless 1.4.2 → 1.4.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fabriziosalmi/slopless",
-  "version": "1.4.2",
+  "version": "1.4.4",
   "description": "",
   "main": "dist/index.js",
   "bin": {

package/rules/VBC-010.yaml

@@ -6,7 +6,7 @@ tags:
   - accessibility
   - html
 match:
-  regex: <div[^>]*\s(onclick|onClick)=
+  regex: <div[^>]*\s(onclick|onClick)=(?!\{?\s*\(?\s*(?:e|ev|evt|event|_e)\s*\)?\s*=>\s*\{?\s*(?:e|ev|evt|event|_e)\.(?:stopPropagation|preventDefault)\(\)\s*\}?\s*\})
   file_types:
     - html
     - js
@@ -22,3 +22,5 @@ tests:
     - <div onClick={handleClick}>Save</div>
   quiet:
     - <button onClick={handleClick}>Save</button>
+    - <div className="row" onClick={(e) => e.stopPropagation()}>
+    - <div onClick={e => e.preventDefault()}>

package/rules/VBC-034.yaml

@@ -6,7 +6,7 @@ tags:
   - security
 match:
   regex: >-
-    http://(?!localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\]|test\b|example\.(?:com|org)|www\.w3\.org|schemas?\.|json-schema\.org|purl\.org|ns\.adobe|www\.apache\.org)
+    http://(?!localhost|127\.|0\.0\.0\.0|169\.254\.|\[::1\]|test\b|example\.(?:com|org)|www\.w3\.org|schemas?\.|json-schema\.org|purl\.org|ns\.adobe|www\.apache\.org)
   scan: strings
   file_types:
     - js
@@ -38,4 +38,6 @@ tests:
   quiet:
     - const api = 'https://api.example.com/v1';
     - const dev = 'http://localhost:3000';
+    - const dev2 = 'http://127.0.0.1:8000';
+    - "refuse http://169.254.169.254 (cloud metadata) before connecting"
     - const svg = 'http://www.w3.org/2000/svg';

package/rules/VBC-070.yaml

@@ -5,7 +5,8 @@ category: core
 tags:
   - security
 match:
-  regex: \.innerHTML\s*=(?!=)
+  regex: >-
+    \.innerHTML\s*=(?!=)(?!\s*(['"])(?:(?!\1)[^\\])*\1\s*[;\n])
   file_types:
     - js
     - ts
@@ -14,6 +15,10 @@ message: >-
 tests:
   fire:
     - el.innerHTML = markup;
+    - el.innerHTML = "<b>" + name + "</b>";
+    - el.innerHTML = `<b>${name}</b>`;
   quiet:
     - el.textContent = text;
+    - alert.innerHTML = '<i class="fa-check"></i> <span id="t"></span>';
+    - el.innerHTML = "";
     - if (el.innerHTML === "") { init(); }

package/rules/VBC-077.yaml

@@ -18,6 +18,13 @@ tests:
         this.cache.set(id, 1);
         return id;
       }
+    - |
+      class E {
+        getLevel() {
+          if (!this.buf) { this.hits = this.hits + 1; }
+          return this.buf;
+        }
+      }
   quiet:
     - |
       function getUser(id) {
@@ -27,6 +34,22 @@ tests:
       function getOffset(node) {
         return node.dataset.offset;
       }
+    - |
+      class E {
+        getMasterLevel() {
+          if (!this.buf || this.buf.length !== this.analyser.fftSize) {
+            this.buf = new Float32Array(this.analyser.fftSize);
+          }
+          return rms(this.buf);
+        }
+      }
+    - |
+      class R {
+        async fetchFromRemote(url) {
+          this.fetched = true;
+          return fetch(url);
+        }
+      }
     - |
       function getAll() {
         const out = [];