xploitscan-shared-rules 1.11.1 → 1.12.0

package/dist/index.cjs

@@ -1482,6 +1482,41 @@ var sqlInjection = {
         matches.push(m);
       }
     }
+    if (/\.\s*(?:query|execute|raw|queryRawUnsafe|executeRawUnsafe|\$queryRawUnsafe|\$executeRawUnsafe)\s*\(/.test(content)) {
+      const ctx = tryParse(content, filePath);
+      if (ctx) {
+        const { parsed, taint } = ctx;
+        const SQL_SINKS = /* @__PURE__ */ new Set([
+          "query",
+          "execute",
+          "raw",
+          "queryRawUnsafe",
+          "executeRawUnsafe",
+          "$queryRawUnsafe",
+          "$executeRawUnsafe"
+        ]);
+        visitCalls(
+          parsed,
+          (callee) => callee.type === "MemberExpression" && callee.property.type === "Identifier" && SQL_SINKS.has(callee.property.name),
+          (call, line) => {
+            const first = call.arguments[0];
+            if (!first || first.type === "SpreadElement") return;
+            if (first.type === "StringLiteral" || first.type === "TemplateLiteral") return;
+            if (!taint.isTainted(first)) return;
+            if (matches.some((m) => m.line === line)) return;
+            matches.push(
+              astMatch(
+                content,
+                filePath,
+                line,
+                sqlInjection,
+                "Use parameterized queries instead of building SQL from user input in a variable. Example: db.query('SELECT * FROM users WHERE login = ?', [req.body.login])"
+              )
+            );
+          }
+        );
+      }
+    }
     return matches;
   }
 };
@@ -2726,12 +2761,12 @@ var ssrfVulnerability = {
       filePath,
       () => "Validate URLs against an allowlist before fetching. Block internal IPs: 127.0.0.1, 10.x, 172.16-31.x, 192.168.x, 169.254.169.254 (cloud metadata). Use: const url = new URL(input); if (!ALLOWED_HOSTS.includes(url.hostname)) throw new Error('Blocked');"
     ));
-    if (!/\b(?:fetch|axios|got|request|http\.get|https\.get)\b/.test(content)) return matches;
+    if (!/\b(?:fetch|axios|got|request|needle|superagent|undici|http\.get|https\.get)\b/.test(content)) return matches;
     const ctx = tryParse(content, filePath);
     if (!ctx) return matches;
     const { parsed, taint } = ctx;
-    const FETCH_CALLEES = /* @__PURE__ */ new Set(["fetch", "axios", "got", "request"]);
-    const FETCH_METHODS = /* @__PURE__ */ new Set(["get", "post", "put", "patch", "delete", "request"]);
+    const FETCH_CALLEES = /* @__PURE__ */ new Set(["fetch", "axios", "got", "request", "needle", "superagent", "undici"]);
+    const FETCH_METHODS = /* @__PURE__ */ new Set(["get", "post", "put", "patch", "delete", "request", "head"]);
     visitCalls(
       parsed,
       (callee) => {
@@ -2740,7 +2775,7 @@ var ssrfVulnerability = {
           if (!FETCH_METHODS.has(callee.property.name)) return false;
           const obj = callee.object;
           if (obj.type === "Identifier") {
-            return obj.name === "axios" || obj.name === "got" || obj.name === "http" || obj.name === "https";
+            return obj.name === "axios" || obj.name === "got" || obj.name === "http" || obj.name === "https" || obj.name === "needle" || obj.name === "superagent" || obj.name === "undici";
           }
         }
         return false;