thuban 0.4.2 → 0.4.5

package/dist/packages/crucible/rules/open-redirect.json

@@ -1,196 +1,196 @@
-[
-  {
-    "id": "REDIR001",
-    "pattern": "redirect_to\\s+params\\[|redirect_to\\s+\\w+\\s*\\|\\||http\\.Redirect\\s*\\([^)]*r\\.Header|Response\\.Redirect\\s*\\(\\s*\\w*[Uu]rl",
-    "flags": "i",
-    "category": "open_redirect",
-    "description": "Open redirect (various frameworks)",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "medium"
-  },
-  {
-    "id": "REDIR002",
-    "pattern": "http\\.Redirect\\s*\\([^,]+,\\s*[^,]+,\\s*(?:returnURL|redirectTo|returnUrl|returnTo|referer|destination)",
-    "flags": "i",
-    "category": "open_redirect",
-    "description": "Go open redirect: http.Redirect with user-controlled variable (returnURL etc.)",
-    "language": [
-      "go"
-    ],
-    "severity": "medium"
-  },
-  {
-    "id": "REDIR003",
-    "pattern": "r\\.URL\\.Query\\(\\)\\.Get\\s*\\(\\s*[\"']return",
-    "flags": "i",
-    "category": "open_redirect",
-    "description": "Go open redirect: r.URL.Query() used as redirect target",
-    "language": [
-      "go"
-    ],
-    "severity": "medium"
-  },
-  {
-    "id": "REDIR004",
-    "pattern": "Redirect\\s*\\(\\s*(?:\\w*[Uu]rl|returnUrl)\\b",
-    "flags": "",
-    "category": "open_redirect",
-    "description": "Open redirect",
-    "language": [
-      "js",
-      "ts",
-      "python",
-      "java",
-      "go",
-      "csharp",
-      "php",
-      "ruby",
-      "rust",
-      "kotlin"
-    ],
-    "severity": "medium"
-  },
-  {
-    "id": "REDIR005",
-    "pattern": "context\\.Response\\.Redirect\\s*\\(\\s*(?:next|url|returnUrl|redirect)",
-    "flags": "i",
-    "category": "open_redirect",
-    "description": "C# open redirect",
-    "language": [
-      "csharp"
-    ],
-    "severity": "medium"
-  },
-  {
-    "id": "REDIR006",
-    "pattern": "return Redirect\\s*\\(\\s*(?:returnUrl|destination|state|next)\\s*\\)",
-    "flags": "i",
-    "category": "open_redirect",
-    "description": "C# open redirect",
-    "language": [
-      "csharp"
-    ],
-    "severity": "medium"
-  },
-  {
-    "id": "REDIR007",
-    "pattern": "redirect_to\\s+params\\[:\\w+\\]",
-    "flags": "i",
-    "category": "open_redirect",
-    "description": "Ruby open redirect",
-    "language": [
-      "ruby"
-    ],
-    "severity": "medium"
-  },
-  {
-    "id": "REDIR008",
-    "pattern": "redirect_to\\s+(?:next_url|callback|destination|target)",
-    "flags": "i",
-    "category": "open_redirect",
-    "description": "Ruby open redirect",
-    "language": [
-      "ruby"
-    ],
-    "severity": "medium"
-  },
-  {
-    "id": "REDIR009",
-    "pattern": "header\\s*\\(\\s*[\"']Location:[\"']\\s*\\.\\s*\\$(?:_GET|_POST|url|next|redirect)",
-    "flags": "i",
-    "category": "open_redirect",
-    "description": "PHP open redirect: header Location",
-    "language": [
-      "php"
-    ],
-    "severity": "medium"
-  },
-  {
-    "id": "REDIR010",
-    "pattern": "header\\s*\\(\\s*[\"']Location:[\"']\\s*\\.\\s*\\$",
-    "flags": "i",
-    "category": "open_redirect",
-    "description": "PHP open redirect: header Location",
-    "language": [
-      "php"
-    ],
-    "severity": "medium"
-  },
-  {
-    "id": "REDIR011",
-    "pattern": "header\\s*\\(\\s*['\"]Location:\\s*['\"]\\s*\\.\\s*\\$(?:url|next|redirect|return_to|target|to)\\b",
-    "flags": "i",
-    "category": "open_redirect",
-    "description": "PHP open redirect: header('Location') with user-controlled variable",
-    "language": [
-      "php"
-    ],
-    "severity": "medium"
-  },
-  {
-    "id": "REDIR012",
-    "pattern": "header\\s*\\(\\s*['\"]Location:\\s*['\"]\\s*\\.\\s*\\$(?:_GET|_POST|_REQUEST)",
-    "flags": "i",
-    "category": "open_redirect",
-    "description": "PHP open redirect: header('Location') with user-controlled variable",
-    "language": [
-      "php"
-    ],
-    "severity": "medium"
-  },
-  {
-    "id": "REDIR013",
-    "pattern": "header\\s*\\(\\s*\"Location:\\s*\\$(?:url|next|redirect|target|return)",
-    "flags": "i",
-    "category": "open_redirect",
-    "description": "PHP open redirect: header('Location') with user-controlled variable",
-    "language": [
-      "php"
-    ],
-    "severity": "medium"
-  },
-  {
-    "id": "REDIR014",
-    "pattern": "header\\s*\\(\\s*\"Location:\\s*\"\\.\\s*\\$\\w",
-    "flags": "i",
-    "category": "open_redirect",
-    "description": "PHP open redirect: header('Location') with user-controlled variable",
-    "language": [
-      "php"
-    ],
-    "severity": "medium"
-  },
-  {
-    "id": "REDIR015",
-    "pattern": "http\\.Redirect\\s*\\(\\s*w\\s*,\\s*r\\s*,\\s*(?:returnURL|returnUrl|destination|state|next|returnTo|referer)",
-    "flags": "i",
-    "category": "open_redirect",
-    "description": "Go open redirect",
-    "language": [
-      "go"
-    ],
-    "severity": "medium"
-  },
-  {
-    "id": "REDIR016",
-    "pattern": "http\\.Redirect\\s*\\(\\s*w\\s*,\\s*r\\s*,\\s*(?:string\\()?\\s*(?:returnURL|returnUrl|destination|state|next|returnTo|referer)",
-    "flags": "i",
-    "category": "open_redirect",
-    "description": "Go: timing attack via != comparison of tokens; open redirect via decoded state",
-    "language": [
-      "go"
-    ],
-    "severity": "medium"
-  }
-]
+[
+  {
+    "id": "REDIR001",
+    "pattern": "redirect_to\\s+params\\[|redirect_to\\s+\\w+\\s*\\|\\||http\\.Redirect\\s*\\([^)]*r\\.Header|Response\\.Redirect\\s*\\(\\s*\\w*[Uu]rl",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "Open redirect (various frameworks)",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR002",
+    "pattern": "http\\.Redirect\\s*\\([^,]+,\\s*[^,]+,\\s*(?:returnURL|redirectTo|returnUrl|returnTo|referer|destination)",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "Go open redirect: http.Redirect with user-controlled variable (returnURL etc.)",
+    "language": [
+      "go"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR003",
+    "pattern": "r\\.URL\\.Query\\(\\)\\.Get\\s*\\(\\s*[\"']return",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "Go open redirect: r.URL.Query() used as redirect target",
+    "language": [
+      "go"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR004",
+    "pattern": "Redirect\\s*\\(\\s*(?:\\w*[Uu]rl|returnUrl)\\b",
+    "flags": "",
+    "category": "open_redirect",
+    "description": "Open redirect",
+    "language": [
+      "js",
+      "ts",
+      "python",
+      "java",
+      "go",
+      "csharp",
+      "php",
+      "ruby",
+      "rust",
+      "kotlin"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR005",
+    "pattern": "context\\.Response\\.Redirect\\s*\\(\\s*(?:next|url|returnUrl|redirect)",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "C# open redirect",
+    "language": [
+      "csharp"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR006",
+    "pattern": "return Redirect\\s*\\(\\s*(?:returnUrl|destination|state|next)\\s*\\)",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "C# open redirect",
+    "language": [
+      "csharp"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR007",
+    "pattern": "redirect_to\\s+params\\[:\\w+\\]",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "Ruby open redirect",
+    "language": [
+      "ruby"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR008",
+    "pattern": "redirect_to\\s+(?:next_url|callback|destination|target)",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "Ruby open redirect",
+    "language": [
+      "ruby"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR009",
+    "pattern": "header\\s*\\(\\s*[\"']Location:[\"']\\s*\\.\\s*\\$(?:_GET|_POST|url|next|redirect)",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "PHP open redirect: header Location",
+    "language": [
+      "php"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR010",
+    "pattern": "header\\s*\\(\\s*[\"']Location:[\"']\\s*\\.\\s*\\$",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "PHP open redirect: header Location",
+    "language": [
+      "php"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR011",
+    "pattern": "header\\s*\\(\\s*['\"]Location:\\s*['\"]\\s*\\.\\s*\\$(?:url|next|redirect|return_to|target|to)\\b",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "PHP open redirect: header('Location') with user-controlled variable",
+    "language": [
+      "php"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR012",
+    "pattern": "header\\s*\\(\\s*['\"]Location:\\s*['\"]\\s*\\.\\s*\\$(?:_GET|_POST|_REQUEST)",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "PHP open redirect: header('Location') with user-controlled variable",
+    "language": [
+      "php"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR013",
+    "pattern": "header\\s*\\(\\s*\"Location:\\s*\\$(?:url|next|redirect|target|return)",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "PHP open redirect: header('Location') with user-controlled variable",
+    "language": [
+      "php"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR014",
+    "pattern": "header\\s*\\(\\s*\"Location:\\s*\"\\.\\s*\\$\\w",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "PHP open redirect: header('Location') with user-controlled variable",
+    "language": [
+      "php"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR015",
+    "pattern": "http\\.Redirect\\s*\\(\\s*w\\s*,\\s*r\\s*,\\s*(?:returnURL|returnUrl|destination|state|next|returnTo|referer)",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "Go open redirect",
+    "language": [
+      "go"
+    ],
+    "severity": "medium"
+  },
+  {
+    "id": "REDIR016",
+    "pattern": "http\\.Redirect\\s*\\(\\s*w\\s*,\\s*r\\s*,\\s*(?:string\\()?\\s*(?:returnURL|returnUrl|destination|state|next|returnTo|referer)",
+    "flags": "i",
+    "category": "open_redirect",
+    "description": "Go: timing attack via != comparison of tokens; open redirect via decoded state",
+    "language": [
+      "go"
+    ],
+    "severity": "medium"
+  }
+]