troubadix 25.12.1__tar.gz → 25.12.3__tar.gz

{troubadix-25.12.1 → troubadix-25.12.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: troubadix
-Version: 25.12.1
+Version: 25.12.3
 Summary: A linting and QA check tool for NASL files
 License: GPL-3.0-or-later
 License-File: LICENSE

{troubadix-25.12.1 → troubadix-25.12.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "troubadix"
-version = "25.12.1"
+version = "25.12.3"
 description = "A linting and QA check tool for NASL files"
 authors = ["Greenbone <info@greenbone.net>"]
 license = "GPL-3.0-or-later"

{troubadix-25.12.1 → troubadix-25.12.3}/tests/plugins/test_grammar.py

@@ -321,13 +321,65 @@ class CheckNewlinesTestCase(PluginTestCase):
         self.assertIsInstance(results[0], LinterError)
         self.assertEqual(
             "VT/Include has the following grammar problem:\n"
-            "- Hit: may allows an\n"
+            "- Hit: may allows\n"
             '- Full line: script_tag(name:"impact", value:"Successful '
             "exploitation may allows an attacker to run arbitrary code on the "
             'affected IP cameras.");',
             results[0].message,
         )
 
+    def test_grammar11(self):
+        nasl_file = Path(__file__).parent / "test.nasl"
+        content = (
+            '  script_tag(name:"cvss_base", value:"4.0");\n'
+            '  script_tag(name:"impact", value:"Inadequate checks in '
+            "com_contact could allowed mail submission\n"
+            '  script_tag(name:"solution_type", value:"VendorFix");\n'
+        )
+
+        fake_context = self.create_file_plugin_context(
+            nasl_file=nasl_file, file_content=content
+        )
+        plugin = CheckGrammar(fake_context)
+
+        results = list(plugin.run())
+
+        self.assertEqual(len(results), 1)
+        self.assertIsInstance(results[0], LinterError)
+        self.assertEqual(
+            "VT/Include has the following grammar problem:\n"
+            "- Hit: could allowed\n"
+            '- Full line: script_tag(name:"impact", value:"Inadequate checks '
+            "in com_contact could allowed mail submission",
+            results[0].message,
+        )
+
+    def test_grammar12(self):
+        nasl_file = Path(__file__).parent / "test.nasl"
+        content = (
+            '  script_tag(name:"cvss_base", value:"4.0");\n'
+            '  script_tag(name:"impact", value:"This allow an attacker to gain '
+            "administrative access to the\n"
+            '  script_tag(name:"solution_type", value:"VendorFix");\n'
+        )
+
+        fake_context = self.create_file_plugin_context(
+            nasl_file=nasl_file, file_content=content
+        )
+        plugin = CheckGrammar(fake_context)
+
+        results = list(plugin.run())
+
+        self.assertEqual(len(results), 1)
+        self.assertIsInstance(results[0], LinterError)
+        self.assertEqual(
+            "VT/Include has the following grammar problem:\n"
+            "- Hit: This allow\n"
+            '- Full line: script_tag(name:"impact", value:"This allow an '
+            "attacker to gain administrative access to the",
+            results[0].message,
+        )
+
     def test_grammar_fp(self):
         nasl_file = Path(__file__).parent / "test.nasl"
         content = (
@@ -383,3 +435,21 @@ class CheckNewlinesTestCase(PluginTestCase):
         results = list(plugin.run())
 
         self.assertEqual(len(results), 0)
+
+    def test_grammar_fp3(self):
+        nasl_file = Path(__file__).parent / "test.nasl"
+        content = (
+            '  script_tag(name:"cvss_base", value:"4.0");\n'
+            '  script_tag(name:"insight", value:"*snip* connection string to '
+            'provide\nproperties that are not on this allow list.");\n'
+            '  script_tag(name:"solution_type", value:"VendorFix");\n'
+            '  script_tag(name:"solution", value:"meh");\n'
+        )
+        fake_context = self.create_file_plugin_context(
+            nasl_file=nasl_file, file_content=content
+        )
+        plugin = CheckGrammar(fake_context)
+
+        results = list(plugin.run())
+
+        self.assertEqual(len(results), 0)

{troubadix-25.12.1 → troubadix-25.12.3}/troubadix/__version__.py

@@ -2,4 +2,4 @@
 
 # THIS IS AN AUTOGENERATED FILE. DO NOT TOUCH!
 
-__version__ = "25.12.1"
+__version__ = "25.12.3"

{troubadix-25.12.1 → troubadix-25.12.3}/troubadix/codespell/codespell.additions

@@ -26,3 +26,4 @@ CSFR->CSRF
 XXS->XSS
 reverenced->referenced
 sever->server
+cooky->cookie, cookies,

{troubadix-25.12.1 → troubadix-25.12.3}/troubadix/codespell/codespell.exclude

@@ -1621,3 +1621,4 @@ xml += string( '<oval_system_characteristics xmlns="http://oval.mitre.org/XMLSch
   - XSS via a crafted WAN name on the General Setup screen (CVE-2019-16534)");
   "^[Xx]-[Aa]dobe-[Cc]ontent\s*:\s*AEM" );
   Zhongling Wen discovered that the h323 conntrack handler did not correctly
+check_urls = make_list( "/olt/Login.do", "/otm/logon.do" );

{troubadix-25.12.1 → troubadix-25.12.3}/troubadix/plugins/grammar.py

@@ -43,8 +43,13 @@ exceptions = [
     # From several Ubuntu LSCs like e.g.:
     # 2021/ubuntu/gb_ubuntu_USN_4711_1.nasl
     TextCheck("An attacker with access to at least one LUN in a multiple"),
-    # nb: The regex to catch "this files" might catch this wrongly...
-    PatternCheck(r"th(is|ese)\s+filesystem", re.IGNORECASE),
+    # nb:
+    # - The regex to catch e.g. "this files" or "This allow an attacker" might
+    #   catch this wrongly...
+    # - Cases like "this filesystem" vs. "these filesystems" are also handled /
+    #   excluded here
+    PatternCheck(r'this\s+(filesystem|allow\s+list)[\s.",]+', re.IGNORECASE),
+    PatternCheck(r'these\s+(filesystem|allow\s+list)s[\s.",]+', re.IGNORECASE),
     # Like seen in e.g. 2008/freebsd/freebsd_mod_php4-twig.nasl
     PatternCheck(r'(\s+|")[Aa]\s+multiple\s+of'),
     # WITH can be used like e.g. the following which is valid:
@@ -179,8 +184,16 @@ def get_grammer_pattern() -> re.Pattern:
         # server-site template injection -> server-side template injection
         r"cross[\s-]+side[\s-]+(request[\s-]+forgery|scripting)|"
         r"server[\s-]+site[\s-]+(request[\s-]+forgery|template)[\s-]+injection|"
-        # e.g. "Successful exploitation may allows an attacker to run arbitrary"
-        r"(could|may|will)\s+allows\s+an?\s+|"
+        # e.g.:
+        # Successful exploitation may allows an attacker to run arbitrary
+        # An error in INSTALL_JAR procedure might allows remote authenticated
+        r"(could|may|will|might|should|can)\s+allows\s+|"
+        # e.g.:
+        # - Inadequate checks in com_contact could allowed mail submission
+        r"(could|may|will|might|should|can)\s+allowed\s+|"
+        # e.g.:
+        # This allow an attacker to gain administrative access to the
+        r"This\s+allow\s+|"
         # nb: Next few could happen when copy'n'paste some text parts around
         # like e.g.:
         # is prone to a to a remote denial-of-service vulnerability