Repository navigation
Beta Release v0.35
·
22 commits
to main
since this release
New Platforms (5): bash, powershell, dockerfile, terraform, kubernetes - each with a full XML rule file covering platform-specific security issues.
New Framework Rules (25+):
- Python: SQLAlchemy
- PHP: Yii
- Java: Struts, MyBatis
- JavaScript: Electron
- Go: GORM, Gorilla Mux
- .NET: Blazor, ASP.NET Core Identity
- Kotlin: Exposed
- Android: Room, Retrofit
- iOS: Alamofire, Core Data
- Flutter: Dio, Hive
- React Native: Expo
- Terraform: AWS, Azure, GCP provider-specific rules
Recon Updates (-recon option):
- MANIFEST_RULES extended with Docker, Terraform, Kubernetes, Helm
- technology.json - new Infrastructure category (Docker, Terraform, Kubernetes, Helm); extended Shell/PowerShell entries
- frameworks.json - added SQLAlchemy, Electron, MyBatis, GORM, Gorilla, Blazor, Identity, Exposed, Dio, Hive, Room, Retrofit, Alamofire, Core Data, Expo
RDL Accuracy Improvements (across 15+ files):
- Fixed backwards logic: cookie security flags (JS), storage encryption (Terraform), session secret + CSRF (Ruby)
- Removed false secure patterns from weak crypto and weak random regexes (JS)
- Narrowed overly broad regexes: malloc, loop handling (C), hardcoded secrets export (C), No USER directive (Dockerfile), kubernetes resource limits
- Added missing IF conditions: PHP file inclusion/operations, Kotlin untrusted input rules
- Fixed RDL false negatives: SQLAlchemy %-formatting patterns, Yii orWhere/interpolation patterns
- Simplified fragile negative-lookahead regexes: Dio BaseOptions, Exposed transaction, kubernetes containers