troubadix 25.3.5__tar.gz → 25.4.0__tar.gz

{troubadix-25.3.5 → troubadix-25.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: troubadix
-Version: 25.3.5
+Version: 25.4.0
 Summary: A linting and QA check tool for NASL files
 License: GPL-3.0-or-later
 Author: Greenbone

{troubadix-25.3.5 → troubadix-25.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "troubadix"
-version = "25.3.5"
+version = "25.4.0"
 description = "A linting and QA check tool for NASL files"
 authors = ["Greenbone <info@greenbone.net>"]
 license = "GPL-3.0-or-later"

{troubadix-25.3.5 → troubadix-25.4.0}/tests/plugins/test_grammar.py

@@ -208,6 +208,58 @@ class CheckNewlinesTestCase(PluginTestCase):
             results[0].message,
         )
 
+    def test_grammar7(self):
+        nasl_file = Path(__file__).parent / "test.nasl"
+        content = (
+            '  script_tag(name:"cvss_base", value:"4.0");\n'
+            '  script_tag(name:"summary", value:"Foo Bar is prone to a to a '
+            'remote denial-of-service vulnerability.");\n'
+            '  script_tag(name:"solution_type", value:"VendorFix");\n'
+            '  script_tag(name:"solution", value:"meh");\n'
+        )
+
+        fake_context = self.create_file_plugin_context(
+            nasl_file=nasl_file, file_content=content
+        )
+        plugin = CheckGrammar(fake_context)
+
+        results = list(plugin.run())
+
+        self.assertEqual(len(results), 1)
+        self.assertIsInstance(results[0], LinterError)
+        self.assertEqual(
+            "VT/Include has the following grammar problem:   "
+            'script_tag(name:"summary", value:"Foo Bar is prone to a to a '
+            'remote denial-of-service vulnerability.");',
+            results[0].message,
+        )
+
+    def test_grammar8(self):
+        nasl_file = Path(__file__).parent / "test.nasl"
+        content = (
+            '  script_tag(name:"cvss_base", value:"4.0");\n'
+            '  script_tag(name:"insight", value:"- CVE-2022-31702: Command '
+            'injection in the in the vRNI REST API.");\n'
+            '  script_tag(name:"solution_type", value:"VendorFix");\n'
+            '  script_tag(name:"solution", value:"meh");\n'
+        )
+
+        fake_context = self.create_file_plugin_context(
+            nasl_file=nasl_file, file_content=content
+        )
+        plugin = CheckGrammar(fake_context)
+
+        results = list(plugin.run())
+
+        self.assertEqual(len(results), 1)
+        self.assertIsInstance(results[0], LinterError)
+        self.assertEqual(
+            "VT/Include has the following grammar problem:   "
+            'script_tag(name:"insight", value:"- CVE-2022-31702: Command '
+            'injection in the in the vRNI REST API.");',
+            results[0].message,
+        )
+
     def test_grammar_fp(self):
         nasl_file = Path(__file__).parent / "test.nasl"
         content = (

{troubadix-25.3.5 → troubadix-25.4.0}/troubadix/__version__.py

@@ -2,4 +2,4 @@
 
 # THIS IS AN AUTOGENERATED FILE. DO NOT TOUCH!
 
-__version__ = "25.3.5"
+__version__ = "25.4.0"

{troubadix-25.3.5 → troubadix-25.4.0}/troubadix/codespell/codespell.additions

@@ -22,3 +22,5 @@ entreprise->enterprise
 entreprises->enterprises
 iit->it
 itt->it
+CSFR->CSRF
+XXS->XSS

{troubadix-25.3.5 → troubadix-25.4.0}/troubadix/codespell/codespell.exclude

@@ -815,6 +815,8 @@ ofproto/bond: fix interal flow leak of tcp-balance bond
   of user-supplied input processed by Steam In-Home Streaming (IHS) Discovery
   of Wiesemann & Theis GmbH W&T OPC Server for Windows.");
 Ohter bug fixes:
+"olt",
+"olt/pages",
       # on e.g. newer releases of the NAM appliance we're even getting an 403/forbidden
 opc_req_header = raw_string("HEL",   # Message Type (Hello)
 opening a specially crafted CAF audio file, an attacker could execute

{troubadix-25.3.5 → troubadix-25.4.0}/troubadix/plugins/grammar.py

@@ -174,6 +174,11 @@ def get_grammer_pattern() -> re.Pattern:
         # server-site template injection -> server-side template injection
         r"cross[\s-]+side[\s-]+(request[\s-]+forgery|scripting)|"
         r"server[\s-]+site[\s-]+(request[\s-]+forgery|template)[\s-]+injection|"
+        # nb: Next two could happen when copy'n'paste some text parts around
+        # like e.g.:
+        # is prone to a to a remote denial-of-service vulnerability
+        # CVE-2022-31702: Command injection in the in the vRNI REST API
+        r"in the in the|to an? to a|"
         # e.g. "is prone to a security bypass vulnerabilities"
         r"is\s+prone\s+to\s+an?\s+[^\s]+\s+([^\s]+\s+)?vulnerabilities" r").*",
         re.IGNORECASE,