Version 1.0 (#44)

* return feature to remove blank lines and comments * add samples to perform tests * pushing some tools to help during debug tasks * skip false positives - draft function * improve taint analysis function * drafting new rules * update sarif output with new variables
htrgouvea · Apr 4, 2024 · bf20599 · bf20599
1 parent 8f61ffa
commit bf20599
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 2 deletions.
diff --git a/lib/Zarn/Sarif.pm b/lib/Zarn/Sarif.pm
@@ -37,8 +37,8 @@ package Zarn::Sarif {
                             uri => $info -> {file}
                         },
                         region => {
-                            startLine => $info -> {line},
-                            startColumn  => $info -> {rowchar}
+                            startLine => $info -> {line_sink},
+                            startColumn  => $info -> {rowchar_sink}
                         }
                     }
                 }]

diff --git a/rules/prototype.yml b/rules/prototype.yml
@@ -0,0 +1,8 @@
+---
+rules:
+  - id: '0001'
+    category: vuln
+    name: Cross Site Scripting (XSS)
+    message: Occur when untrusted data is rendered as HTML without proper escaping, allowing attackers to execute malicious scripts in the context of the victim's browser.
+    sample:
+      - render