-
Notifications
You must be signed in to change notification settings - Fork 31
Closed
Labels
good first issueGood for newcomersGood for newcomershelp wantedExtra attention is neededExtra attention is needed
Description
My idea of this task is to implement a new warning responsible of detecting shady links in Literals. I have been inspired by one of the detection of guarddog from DataDog.
They use the following RegEx:
(http[s]?:\/\/.*\.(link|xyz|tk|ml|ga|cf|gq|pw|top|club|mw|bd|ke|am|sbs|date|quest|cd|bid|cd|ws|icu|cam|uno|email|stream))
This RegEx allow to detect an URL like that:
https://foobar.xyz
The idea is to create a new probe or to update isLiteral probe to add that new warning. The probe will execute on every ESTree Literal.
const maliciousUrl = "https://foobar.xyz";
Maybe we need to conduct additional research on the subject (maybe there is some study we may want to read to improve the detection?).
tony-go and Kawacrepe
Metadata
Metadata
Assignees
Labels
good first issueGood for newcomersGood for newcomershelp wantedExtra attention is neededExtra attention is needed