troubadix 25.12.0__tar.gz → 25.12.2__tar.gz

{troubadix-25.12.0 → troubadix-25.12.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: troubadix
-Version: 25.12.0
+Version: 25.12.2
 Summary: A linting and QA check tool for NASL files
 License: GPL-3.0-or-later
 License-File: LICENSE

{troubadix-25.12.0 → troubadix-25.12.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "troubadix"
-version = "25.12.0"
+version = "25.12.2"
 description = "A linting and QA check tool for NASL files"
 authors = ["Greenbone <info@greenbone.net>"]
 license = "GPL-3.0-or-later"

{troubadix-25.12.0 → troubadix-25.12.2}/tests/plugins/test_grammar.py

@@ -300,6 +300,34 @@ class CheckNewlinesTestCase(PluginTestCase):
             results[0].message,
         )
 
+    def test_grammar10(self):
+        nasl_file = Path(__file__).parent / "test.nasl"
+        content = (
+            '  script_tag(name:"cvss_base", value:"4.0");\n'
+            '  script_tag(name:"impact", value:"Successful exploitation may '
+            "allows an attacker to run arbitrary code on the affected IP "
+            'cameras.");\n'
+            '  script_tag(name:"solution_type", value:"VendorFix");\n'
+        )
+
+        fake_context = self.create_file_plugin_context(
+            nasl_file=nasl_file, file_content=content
+        )
+        plugin = CheckGrammar(fake_context)
+
+        results = list(plugin.run())
+
+        self.assertEqual(len(results), 1)
+        self.assertIsInstance(results[0], LinterError)
+        self.assertEqual(
+            "VT/Include has the following grammar problem:\n"
+            "- Hit: may allows\n"
+            '- Full line: script_tag(name:"impact", value:"Successful '
+            "exploitation may allows an attacker to run arbitrary code on the "
+            'affected IP cameras.");',
+            results[0].message,
+        )
+
     def test_grammar_fp(self):
         nasl_file = Path(__file__).parent / "test.nasl"
         content = (

{troubadix-25.12.0 → troubadix-25.12.2}/troubadix/__version__.py

@@ -2,4 +2,4 @@
 
 # THIS IS AN AUTOGENERATED FILE. DO NOT TOUCH!
 
-__version__ = "25.12.0"
+__version__ = "25.12.2"

{troubadix-25.12.0 → troubadix-25.12.2}/troubadix/codespell/codespell.additions

@@ -26,3 +26,4 @@ CSFR->CSRF
 XXS->XSS
 reverenced->referenced
 sever->server
+cooky->cookie, cookies,

{troubadix-25.12.0 → troubadix-25.12.2}/troubadix/codespell/codespell.exclude

@@ -1621,3 +1621,4 @@ xml += string( '<oval_system_characteristics xmlns="http://oval.mitre.org/XMLSch
   - XSS via a crafted WAN name on the General Setup screen (CVE-2019-16534)");
   "^[Xx]-[Aa]dobe-[Cc]ontent\s*:\s*AEM" );
   Zhongling Wen discovered that the h323 conntrack handler did not correctly
+check_urls = make_list( "/olt/Login.do", "/otm/logon.do" );

{troubadix-25.12.0 → troubadix-25.12.2}/troubadix/plugins/grammar.py

@@ -179,6 +179,10 @@ def get_grammer_pattern() -> re.Pattern:
         # server-site template injection -> server-side template injection
         r"cross[\s-]+side[\s-]+(request[\s-]+forgery|scripting)|"
         r"server[\s-]+site[\s-]+(request[\s-]+forgery|template)[\s-]+injection|"
+        # e.g.:
+        # Successful exploitation may allows an attacker to run arbitrary
+        # An error in INSTALL_JAR procedure might allows remote authenticated
+        r"(could|may|will|might|should|can)\s+allows\s+|"
         # nb: Next few could happen when copy'n'paste some text parts around
         # like e.g.:
         # is prone to a to a remote denial-of-service vulnerability