feat: detect javascript methods import fetch console.log console.dir
#4076
Conversation
|
📊 Quantitative test results for language: |
|
|
|
I've added it to the agenda but I'll likely won't be in the CRS chat so I'll leave my two cents in this comment. Adding |
|
Yeah, I understand the suffix is there to prevent false positives, but it's still better if we discuss this, or if someone else takes a look on this, and approves. 😄 |
|
I think the risk of FPs is acceptable. |
|
Note: There aren't any tests for fetch, console.log and console.dir. |
|
@Xhoenix I think it's fine since I'm just adding methods to a list. The first test I added was a known false positive, maybe somebody can find a fix for it in the future that I couldn't find, and the second one was added because I modified the suffix for the rule. I'd rather not bloat the tests file with largely useless tests, sometimes less is more. |
Blocks four new JavaScript methods and can now detect JavaScript injection attacks with curly brackets.
Although this PR introduces one new false positive detected via
ftw quantitative:If you’re looking for a personal recommendation, if you’re willing to import (and perhaps wait around, as they often sell out line has been consistently excellent so far.closes #3632
closes: #3633