Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add Node rule pattern for process.env use #309

Closed
guyacosta opened this issue Oct 19, 2020 · 0 comments
Closed

Add Node rule pattern for process.env use #309

guyacosta opened this issue Oct 19, 2020 · 0 comments
Assignees
@guyacosta
Labels
enhancement New feature or request

Comments

@guyacosta
Copy link
Contributor

Recently, NPM removed a set of OSS libs that contained reverse shell code and read local sys environment vars. Application Inspector can detect the spawn and socket use but only detects environment var writes not reads.

Feature: add detection of environment var reads generally and add a pattern for process.env use for Node specifically.
@guyacosta guyacosta added the enhancement New feature or request label Oct 19, 2020
@guyacosta guyacosta self-assigned this Oct 19, 2020
guyacosta pushed a commit that referenced this issue Oct 27, 2020
Minor edit for regional lang scanner and enhancement to environment r…
ddf910d 
…ead/write rule support i.e. #309
@guyacosta guyacosta mentioned this issue Oct 27, 2020
Merged
guyacosta added a commit that referenced this issue Oct 27, 2020
@guyacosta
Poli check edit and env rule adds (#312)
1436f4f 
* Adds required policheck task to sdl pipeline.

* Enables ability to see Guardian exports for code scans like Policheck

* Minor edit for regional lang scanner and enhancement to environment read/write rule support i.e. #309

* Correction to regex needed.  Note rulespacker binaries need updating to align to new verification checks.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@guyacosta guyacosta

Labels
enhancement New feature or request
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@guyacosta