xploitscan-shared-rules 1.7.3 → 1.7.4

package/dist/index.js

@@ -637,6 +637,12 @@ function isInlineSilenced(content, matchIndex, ruleId) {
   );
   return marker.test(matchLine) || marker.test(prevLine);
 }
+function filterSilenced(matches, content, ruleId) {
+  if (matches.length === 0) return matches;
+  const lines = content.split("\n");
+  const lineStartIndex = (line) => lines.slice(0, line - 1).reduce((acc, l) => acc + l.length + 1, 0);
+  return matches.filter((m) => !isInlineSilenced(content, lineStartIndex(m.line), ruleId));
+}
 function findMatches(content, pattern, rule, filePath, fixTemplate) {
   const matches = [];
   const lines = content.split("\n");
@@ -3920,10 +3926,10 @@ var sensitiveURLParams = {
         p,
         sensitiveURLParams,
         filePath,
-        () => "Never pass sensitive data in URL parameters. Use request headers (Authorization: Bearer ...) or POST body instead."
+        () => "Never pass sensitive data in URL parameters. Use request headers (Authorization: Bearer ...) or POST body instead. If this value is intentionally URL-safe (e.g. a one-time, server-verified reference like a Stripe checkout session_id), add an inline `// VC088-OK: <reason>` comment to silence."
       ));
     }
-    return matches;
+    return filterSilenced(matches, content, "VC088");
   }
 };
 var missingContentDisposition = {