@fabriziosalmi/slopless 1.4.4 → 1.4.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +12 -0
- package/dist/engine/api.js +107 -107
- package/dist/index.d.ts +1 -0
- package/dist/index.js +178 -176
- package/package.json +3 -2
- package/rules/VBC-034.yaml +2 -1
- package/rules/VBC-913.yaml +20 -0
package/README.md
CHANGED
|
@@ -101,6 +101,18 @@ npx @fabriziosalmi/slopless --format sarif > gl-sast-report.json
|
|
|
101
101
|
npx @fabriziosalmi/slopless "src/**/*.ts" "docs/**/*.md"
|
|
102
102
|
```
|
|
103
103
|
|
|
104
|
+
## Silencing one line
|
|
105
|
+
|
|
106
|
+
```js
|
|
107
|
+
// slopless-disable-next-line VBC-001 -- a fake PAT; this test asserts it is redacted
|
|
108
|
+
const TOKEN = 'ghp_A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8';
|
|
109
|
+
```
|
|
110
|
+
|
|
111
|
+
Also `// slopless-disable-line VBC-001` at the end of the line it applies to. The
|
|
112
|
+
directive is read from the raw line, so `#`, `/* */` and `<!-- -->` work too, and
|
|
113
|
+
it covers every checker tier. Full rules in
|
|
114
|
+
[docs/configuration.md](docs/configuration.md).
|
|
115
|
+
|
|
104
116
|
## Rule Taxonomy
|
|
105
117
|
|
|
106
118
|
- **Core/Security**: Detection of exposed credentials, `eval()` usage, `innerHTML` assignments, SQL built by concatenation, command injection, prototype pollution, insecure file permissions (`chmod 777`), and hardcoded paths.
|