demo
2049754b67
Node/Express, intentionally outdated deps (express 4.16.0, lodash 4.17.15, axios 0.21.1) for SCA demo. CWE-79, CWE-327, CWE-798, CWE-330 in legacy/tracking.js.
14 lines
410 B
YAML
14 lines
410 B
YAML
rules:
|
|
- id: no-eval
|
|
patterns:
|
|
- pattern: eval(...)
|
|
message: "eval() is banned — remote code execution risk (CWE-95)"
|
|
severity: ERROR
|
|
languages: [javascript]
|
|
- id: no-child-process-exec
|
|
patterns:
|
|
- pattern: require('child_process').exec(...)
|
|
message: "child_process.exec() is banned — command injection risk (CWE-78)"
|
|
severity: ERROR
|
|
languages: [javascript]
|