Skip to content

Choose a tag to compare

@elicpeter elicpeter released this 03 May 02:06
· 33 commits to master since this release

Three themes: new data-exfiltration rule, FP reduction tuned against real OSS repos, and recall improvements driven by 9 new real-CVE fixtures.

New: data-exfiltration rule

  • Separate from SSRF. Fires when sensitive sources (cookie, header, env, file, db, caught exception) reach outbound HTTP body / headers / json across all 10 languages.
  • Plain user-input echoed upstream is suppressed at emission.
  • Sinks: fetch, XHR.send, requests.post, HttpClient.send, OkHttp, RestTemplate, WebClient, http.Post, reqwest/ureq/surf/hyper, Net::HTTP.post, RestClient, libcurl POSTFIELDS.
  • Three suppression knobs: sanitizer convention, trusted-destination allowlist, detector toggle.

False-positive reductions (validated against real OSS repos)

  • C++ reinterpret_cast: suppress on byte-pointer / void* / uintptr_t / sockaddr targets. ~70% over-fire reduction on serialization, IPC, socket code.
  • PHP md5/sha1: suppress in non-crypto contexts (cache keys, ETags, dedup IDs). Tuned against phpmyadmin and nextcloud.
  • Path traversal: canonicalize-and-rooted shapes (File.expand_path + start_with?, os.path.realpath + startswith, path.resolve + startsWith) clear FILE_IO. Branch-narrowing flips lock under negation.
  • Go field-LHS resource acquires (b.cpuprof = os.Create(...)) treated as ownership transfer to enclosing struct. Production trigger: prometheus tsdb profiler.
  • Rust missing_ownership_check: caller-scope-entity exemption for organization/project/team/workspace/tenant; non-web Rust crates gated by Cargo.toml + per-file framework import probe; Flask test-decorator denylist (mock.patch). Reduced FP flood
    across Sentry / Saleor / Discourse / Mastodon / zed-shaped repos.
  • JS/TS empty-string fallback secret no longer fires on process.env.X || "".

Recall (9 new real-CVE fixtures, 21 → 29 total)

  • CVE-2023-22621 (Strapi / lodash _.template SSTI → RCE)
  • CVE-2026-25544 (Payload CMS Drizzle SQLi via helper-validator)
  • CVE-2021-21288 (CarrierWave SSRF via OpenURI.open_uri)
  • CVE-2023-38337 (rswag path traversal)
  • CVE-2022-1471 (SnakeYAML deserialization)
  • CVE-2022-42889 (Apache Commons Text RCE)
  • and 3 more.
  • Cross-function helper-validation propagation (validated_params_to_return) recognizes regex-allowlist guards on params reaching return value.
  • Ruby OpenURI.open_uri + chained-call wrapper classification.
  • Lodash _.template gated CODE_EXEC sink.

Other

  • Action download warning bumped to v0.6.0.

Full changelog: CHANGELOG.md