@fabriziosalmi/slopless 1.7.0 → 1.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fabriziosalmi/slopless",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "",
   "main": "dist/index.js",
   "bin": {

package/rules/VBC-004.yaml

@@ -6,8 +6,11 @@ tags:
   - security
 match:
   regex: >-
-    (?:"[^"\n]*|'[^'\n]*|`[^`\n]*)(?:\bSELECT\b[^\n]{0,80}?\bFROM\b|\bINSERT\s+INTO\b|\bUPDATE\b[^\n]{0,80}?\bSET\b|\bDELETE\b[^\n]{0,80}?\bFROM\b|\bWHERE\b|\bVALUES\s*\()[^\n]{0,120}?["'`]\s*\+|\+=?\s*["'`][^\n]{0,80}?\b(?:WHERE\s|VALUES\s*\(|SET\s+\w+\s*=|ORDER\s+BY|GROUP\s+BY|LIMIT\s+\d|AND\s+\w+\s*=|OR\s+\w+\s*=)
+    (?:"[^"\n]*|'[^'\n]*|`[^`\n]*)(?:\bSELECT\b[^\n]{0,80}?\bFROM\b|\bINSERT\s+INTO\b|\bUPDATE\b[^\n]{0,80}?\bSET\b|\bDELETE\b[^\n]{0,80}?\bFROM\b|\bWHERE\b|\bVALUES\s*\()[^\n]{0,120}?["'`]\s*\+|\+=?\s*["'`][^\n]{0,80}?\b(?:WHERE\s|VALUES\s*\(|SET\s+\w+\s*=(?!\s*(?:\?|\$\d+|:\w+|%[sd])\s*[\"'`])|ORDER\s+BY|GROUP\s+BY|LIMIT\s+\d|AND\s+\w+\s*=(?!\s*(?:\?|\$\d+|:\w+|%[sd])\s*[\"'`])|OR\s+\w+\s*=(?!\s*(?:\?|\$\d+|:\w+|%[sd])\s*[\"'`]))
   flags: i
+  # A fragment that closes on a placeholder injects nothing: `q += " AND p = ?"`
+  # beside `args = append(args, v)` is how a dynamic WHERE clause is built
+  # safely, and it is the shape every Go and Python query builder uses.
   scan: all
   file_types:
     - js
@@ -30,4 +33,7 @@ tests:
     - sql += " AND status = " + status;
   quiet:
     - db.query("SELECT * FROM users WHERE id = $1", [id]);
+    - 'q += ` AND project = ?`'
+    - sql += " AND id = $1"
+    - sql += " AND name = :name"
     - const label = 'Update ' + count + ' items';

package/rules/VBC-034.yaml

@@ -6,7 +6,11 @@ tags:
   - security
 match:
   regex: >-
-    (?<!new URL\([^)]{0,200})http://(?!localhost|127\.|0\.0\.0\.0|169\.254\.|\[::1\]|test\b|example\.(?:com|org)|www\.w3\.org|schemas?\.|json-schema\.org|purl\.org|ns\.adobe|www\.apache\.org)
+    (?<!new URL\([^)]{0,200})http://(?!localhost|127\.|0\.0\.0\.0|169\.254\.|\[::1\]|test\b|example\.(?:com|org)|www\.w3\.org|schemas?\.|json-schema\.org|purl\.org|ns\.adobe|www\.apache\.org)(?=[\w\[$\{])
+  # A scheme with no host after it is prose about the scheme, not an endpoint:
+  # a security standard writing "a single http:// subresource downgrades the
+  # page" is describing the hazard, and an error message saying "must use
+  # http:// or https://" is naming it.
   scan: strings
   file_types:
     - js
@@ -43,5 +47,8 @@ tests:
     - const dev = 'http://localhost:3000';
     - const dev2 = 'http://127.0.0.1:8000';
     - "refuse http://169.254.169.254 (cloud metadata) before connecting"
+    - '"A single http:// subresource downgrades the page"'
+    - "\"the {label} must use http:// or https://\""
+
     - const parsed = new URL(req.url, `http://${req.headers.host}`);
     - const svg = 'http://www.w3.org/2000/svg';

package/rules/VBC-059.yaml

@@ -8,6 +8,28 @@ match:
   ast_check:
     type: file-length-limit
     threshold: 500
+  # Code files. A long piece of documentation is not a module that wants
+  # splitting, and telling a README to become smaller modules is nonsense.
+  file_types:
+    - js
+    - ts
+    - tsx
+    - jsx
+    - py
+    - go
+    - rs
+    - java
+    - c
+    - cpp
+    - cs
+    - kt
+    - swift
+    - rb
+    - sh
+    - php
+    - css
+    - scss
+    - less
 message: >-
   File is too long ({count} lines). Consider splitting it into smaller modules. Max recommended:
   {threshold}.

package/rules/VBC-070.yaml

@@ -5,8 +5,20 @@ category: core
 tags:
   - security
 match:
+  # A literal has no injection point, and neither does a run of them joined with
+  # `+`: a tip string split over three lines for readability is still a constant.
   regex: >-
-    \.innerHTML\s*=(?!=)(?!\s*(['"])(?:(?!\1)[^\\])*\1\s*[;\n])
+    \.innerHTML\s*=(?!=)(?!\s*(?:(['"])(?:(?!\1)[^\\])*\1|\s|\+)+[;\n])
+  # The exclusion has to see the lines after the `=`, which line-by-line
+  # matching cannot.
+  multiline: true
+  exclude_test_code: true
+  exclude_files:
+    - '**/test/**'
+    - '**/tests/**'
+    - '**/__tests__/**'
+    - '**/*.test.*'
+    - '**/*.spec.*'
   file_types:
     - js
     - ts
@@ -21,4 +33,9 @@ tests:
     - el.textContent = text;
     - alert.innerHTML = '<i class="fa-check"></i> <span id="t"></span>';
     - el.innerHTML = "";
+    # A tip split over several lines for readability is still a constant.
+    - |
+      el.innerHTML =
+        "Tip: try <code>/status</code>, " +
+        "or <code>/help</code> for all commands.";
     - if (el.innerHTML === "") { init(); }

package/rules/VBC-928.yaml

@@ -9,6 +9,22 @@ match:
   regex: Lorem ipsum dolor sit amet
   flags: i
   scan: all
+  # A corpus that tests for placeholder text is full of placeholder text. This
+  # rule found `Lorem ipsum dolor sit amet.` inside the table of a Go test for a
+  # gate that detects exactly that.
+  exclude_test_code: true
+  exclude_files:
+    - '**/test/**'
+    - '**/tests/**'
+    - '**/__tests__/**'
+    - '**/testdata/**'
+    - '**/fixtures/**'
+    - '**/test_*.py'
+    - '**/*_test.py'
+    - '**/*_test.go'
+    - '**/*_test.rs'
+    - '**/*.test.*'
+    - '**/*.spec.*'
   file_types:
     - md
     - txt