inkz

0xPolygon/auto-claim-service
0xPolygon/chain-indexer-framework
0xPolygon/heimdall-v2
0xPolygon/lxly
0xPolygon/proof-generation-api
0xPolygon/static
Aiven
Aiven-Open
Automattic/WP-Job-Manager
Automattic/jetpack

inkz

rules:
- id: allowed-unsecure-commands
  languages:
  - yaml
  severity: WARNING
  message: smth found
  patterns:
  - pattern-either:
    - patterns:
      - pattern-inside: "{on: ...}"

inkz

import express from 'express'
import mongoose from 'mongoose'
const app = express()
const port = 3000

// const { BlogPost } = require('./models')
import {BlogPost} from './models'

async function main() {

inkz

/*
 * Copyright (c) 2014-2022 Bjoern Kimminich & the OWASP Juice Shop contributors.
 * SPDX-License-Identifier: MIT
 */

import {
  Model,
  InferAttributes,
  InferCreationAttributes,
  DataTypes,

inkz

rules:
- id: lambda-tainted-func-go
  languages: [go]
  severity: WARNING
  message: >-
    Tainted func found
  mode: taint
  pattern-sources:
  - patterns:
    - pattern-either:

inkz

rules:
- id: java-spring-sink-source
  mode: taint
  pattern-sinks:
    - pattern: |
        $SINK(...)
  pattern-sources:
    - patterns:
      - pattern: $VAR
      - pattern-either:

inkz

rules:
  - id: rails-sink-source
    mode: taint
    pattern-sources:
      - pattern: params[$X]
    pattern-sinks:
      - pattern: $WHATEVER(...)
    message: |
      sink for RoR found
    languages:

inkz

rules:
- id: expressjs-source-sink-research
  mode: taint
  languages:
  - js
  - typescript
  message: >-
    Found a sink for Express.js app
  severity: WARNING
  pattern-sinks:

inkz

rules:
  - id: symfony-permissive-cors
    languages:
      - php
    message: Access-Control-Allow-Origin response header is set to "*". This will
      disable CORS Same Origin Policy restrictions.
    metadata:
      category: security
      cwe: "CWE-346: Origin Validation Error"
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]

inkz

rules:
- id: doctrine-dbal-dangerous-query
  languages:
  - php
  message: Detected string concatenation with a non-literal variable in a Doctrine DBAL query method. This could lead to SQL
    injection if the variable is user-controlled and not properly sanitized. In order to prevent SQL injection, used parameterized
    queries or prepared statements instead.
  metadata:
    category: security
    cwe: "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"