Skip to content

Beta Release v0.35

Choose a tag to compare

@coffeeandsecurity coffeeandsecurity released this 16 Mar 23:49
· 22 commits to main since this release

New Platforms (5): bash, powershell, dockerfile, terraform, kubernetes - each with a full XML rule file covering platform-specific security issues.

New Framework Rules (25+):

  • Python: SQLAlchemy
  • PHP: Yii
  • Java: Struts, MyBatis
  • JavaScript: Electron
  • Go: GORM, Gorilla Mux
  • .NET: Blazor, ASP.NET Core Identity
  • Kotlin: Exposed
  • Android: Room, Retrofit
  • iOS: Alamofire, Core Data
  • Flutter: Dio, Hive
  • React Native: Expo
  • Terraform: AWS, Azure, GCP provider-specific rules

Recon Updates (-recon option):

  • MANIFEST_RULES extended with Docker, Terraform, Kubernetes, Helm
  • technology.json - new Infrastructure category (Docker, Terraform, Kubernetes, Helm); extended Shell/PowerShell entries
  • frameworks.json - added SQLAlchemy, Electron, MyBatis, GORM, Gorilla, Blazor, Identity, Exposed, Dio, Hive, Room, Retrofit, Alamofire, Core Data, Expo

RDL Accuracy Improvements (across 15+ files):

  • Fixed backwards logic: cookie security flags (JS), storage encryption (Terraform), session secret + CSRF (Ruby)
  • Removed false secure patterns from weak crypto and weak random regexes (JS)
  • Narrowed overly broad regexes: malloc, loop handling (C), hardcoded secrets export (C), No USER directive (Dockerfile), kubernetes resource limits
  • Added missing IF conditions: PHP file inclusion/operations, Kotlin untrusted input rules
  • Fixed RDL false negatives: SQLAlchemy %-formatting patterns, Yii orWhere/interpolation patterns
  • Simplified fragile negative-lookahead regexes: Dio BaseOptions, Exposed transaction, kubernetes containers