mirror of
https://codeberg.org/VnPower/PixivFE
synced 2024-12-06 19:16:23 +01:00
iacore
93 lines
2.1 KiB
YAML
93 lines
2.1 KiB
YAML
# Usage: semgrep scan -f semgrep.yml
|
|
rules:
|
|
- id: rule-0
|
|
message: "http requests made without *fiber.Ctx"
|
|
languages: [go]
|
|
severity: WARNING
|
|
patterns:
|
|
- pattern-either:
|
|
- pattern: |
|
|
http.UnwrapWebAPIRequest(...)
|
|
- pattern: |
|
|
http.WebAPIRequest(...)
|
|
- pattern-not-inside: |
|
|
func $FUNC(c *fiber.Ctx, ...) $RET {
|
|
...
|
|
}
|
|
# note: the below two rules autofix have slight problems. where `http` is sometimes "net/http". need minor manual tweaking after --autofix.
|
|
- id: rule-1-0
|
|
message: "find http requests made to Pixiv"
|
|
languages: [go]
|
|
severity: INFO
|
|
patterns:
|
|
- pattern: |
|
|
http.UnwrapWebAPIRequest($A, $B)
|
|
fix: |
|
|
http.UnwrapWebAPIRequest(c.Context(), $A, $B)
|
|
- id: rule-1-1
|
|
message: "find http requests made to Pixiv"
|
|
languages: [go]
|
|
severity: INFO
|
|
patterns:
|
|
- pattern: |
|
|
http.WebAPIRequest($A, $B)
|
|
fix: |
|
|
http.WebAPIRequest(c.Context(), $A, $B)
|
|
- id: rule-2
|
|
message: "gjson.Get without gjson.Valid"
|
|
languages: [go]
|
|
severity: ERROR
|
|
patterns:
|
|
# - pattern-inside: |
|
|
# func $FUNC(...) $RET {
|
|
# ...
|
|
# }
|
|
- pattern: |
|
|
gjson.Get($X, ...)
|
|
- pattern-not-inside: |
|
|
if !gjson.Valid($X) {
|
|
$...DISCARD
|
|
}
|
|
...
|
|
- id: rule-3
|
|
message: "http request without context"
|
|
languages: [go]
|
|
severity: WARNING
|
|
# severity: INVENTORY
|
|
patterns:
|
|
- pattern-inside: |
|
|
$REQ, $ERR := http.NewRequest($...ARGV)
|
|
...
|
|
- pattern-not: |
|
|
$REQ, $ERR := http.NewRequest($...ARGV)
|
|
if $ERR != nil {
|
|
...
|
|
}
|
|
$REQ = $REQ.WithContext($CTX)
|
|
...
|
|
fix: |
|
|
$REQ, err := http.NewRequest($...ARGV)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
$REQ = $REQ.WithContext(c.Context())
|
|
- id: rule-4
|
|
message: "fmt.Sprint on string"
|
|
languages: [go]
|
|
severity: WARNING
|
|
pattern: |
|
|
fmt.Sprint(($S : string))
|
|
- id: rule-5
|
|
message: "unhandled error"
|
|
languages: [go]
|
|
severity: WARNING
|
|
pattern: |
|
|
(_ : error) = ...
|
|
- id: rule-6
|
|
message: "raw UserArtCategory string"
|
|
languages: [go]
|
|
severity: WARNING
|
|
pattern-either:
|
|
- pattern: |
|
|
($A : UserArtCategory) == "$B"
|