Version 1.0

lib/Zarn/AST.pm

@@ -5,7 +5,7 @@
     use PPI::Find;
     use PPI::Document;
 
-    our $VERSION = '0.0.2';
+    our $VERSION = '0.0.4';
 
     sub new {
         my ($self, $parameters) = @_;
@@ -36,12 +36,25 @@
                         # this is a draft source-to-sink function
                         if (defined $next_element && ref $next_element && $next_element -> content() =~ /[\$\@\%](\w+)/xms) {
                             # perform taint analyis
-                            my $var_token = $document -> find_first (
-                                sub { $_[1] -> isa("PPI::Token::Symbol") and $_[1] -> content eq "\$$1" }
+                            my $var_token = $document -> find_first (                                
+                                sub { 
+                                    $_[1] -> isa("PPI::Token::Symbol") and 
+                                    ($_[1] ->content eq "\$$1" or $_[1] -> content eq "\@$1" or $_[1] -> content eq "\%$1")
+                                }
                             );
 
                             if ($var_token && $var_token -> can("parent")) {
+                                my @childrens = $var_token -> parent -> children;
+
+                                if (grep { # verifyng if the variable is a fixed string or a number
+                                    $_ -> isa("PPI::Token::Quote::Double") ||
+                                    $_ -> isa("PPI::Token::Quote::Single") ||
+                                    $_ -> isa("PPI::Token::Number")
+                                } @childrens) {
+                                    next;
+                                }
+
                                 if ((
                                     $var_token -> parent -> isa("PPI::Token::Operator") ||
                                     $var_token -> parent -> isa("PPI::Statement::Expression")
                                 )) {

lib/Zarn/Sarif.pm

@@ -37,8 +37,8 @@ package Zarn::Sarif {
                             uri => $info -> {file}
                         },
                         region => {
-                            startLine => $info -> {line},
-                            startColumn  => $info -> {rowchar}
+                            startLine => $info -> {line_sink},
+                            startColumn  => $info -> {rowchar_sink}
                         }
                     }
                 }]

rules/prototype.yml

@@ -0,0 +1,8 @@
+---
+rules:
+  - id: '0001'
+    category: vuln
+    name: Cross Site Scripting (XSS)
+    message: Occur when untrusted data is rendered as HTML without proper escaping, allowing attackers to execute malicious scripts in the context of the victim's browser.
+    sample:
+      - render

samples/code-injection.pl

@@ -0,0 +1,13 @@
+#!/usr/bin/perl
+
+use 5.018;
+use strict;
+use warnings;
+
+sub main {
+    my $name = $ARGV[0];
+
+    system ("echo Hello World! $name");
+}
+
+exit main();

samples/false-positive.pl

@@ -0,0 +1,13 @@
+#!/usr/bin/perl
+
+use 5.018;
+use strict;
+use warnings;
+
+sub main {
+    my $name = "Zarn";
+
+    system ("echo Hello World! $name");
+}
+
+exit main();

tools/graph.pl

@@ -0,0 +1,21 @@
+#!/usr/bin/env perl
+
+use 5.018;
+use strict;
+use warnings;
+use Devel::Graph;
+
+sub main {
+    my $file = $ARGV[0];
+
+    if ($file) {
+        my $grapher = Devel::Graph -> new();
+        my $decompose   = $grapher -> decompose ($file);
+
+        print $decompose -> as_ascii();
+    }
+
+    return 0;
+}
+
+exit main();

tools/view-ast.pl

@@ -0,0 +1,18 @@
+#!/usr/bin/env perl
+
+use 5.030;
+use strict;
+use warnings;
+use PPI;
+use Data::Dumper;
+
+sub main {
+    my $file = $ARGV[0];
+
+    if ($file) {
+        my $document = PPI::Document -> new($file);
+        print Dumper($document);
+    }
+}
+
+main();