demo
734f73afb5
ASP.NET Core (.NET 8), intentionally outdated NuGet packages (Newtonsoft.Json 12.0.2, Microsoft.Data.SqlClient 2.0.0) for SCA demo. CWE-89, CWE-327, CWE-798, CWE-22, CWE-330 in LegacyReports.cs.
14 lines
419 B
YAML
14 lines
419 B
YAML
rules:
|
|
- id: no-eval
|
|
patterns:
|
|
- pattern: eval(...)
|
|
message: "eval() is banned — code injection risk (CWE-95)"
|
|
severity: ERROR
|
|
languages: [javascript, python]
|
|
- id: no-process-start
|
|
patterns:
|
|
- pattern: System.Diagnostics.Process.Start(...)
|
|
message: "Process.Start() with dynamic input is banned — command injection risk (CWE-78)"
|
|
severity: ERROR
|
|
languages: [csharp]
|