-
Notifications
You must be signed in to change notification settings - Fork 23
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
False positive caused by one character matches in LDAP regex #47
Comments
It is a tough call. The regex is already pretty specific, so making changes could create a false negative situation. It seems like the issues you have reported so far (this and #45) have come on .js files. Maybe we should really be looking at a way to specify the types of files (either MIME type or extension) that should be scanned, or lowering the confidence of results when they appear on what should be a static file. |
That's a great idea, methods What do you think? Should I implement this and submit a pull request, or do you prefer to tackle it? |
I'd prefer to see the confidence rating bumped down by one (e.g. Firm -> Tentative) rather than having the rule be completely skipped. As you say, sometimes these files are generated dynamically, and that could throw errors. It will be a while before I have time to do this so by all means send a pull request! |
I just had the same thought ~15 minutes after posting my reply. :) |
The LDAP regex looks like this
However, we've found minified JS code that happened to use
o
andc
right next to each other in a variable declaration, thus they were delimited by commas.What would be a good fix? Would removing
o
andc
(but leaving the five others) really harm LDAP exception detection that much?The text was updated successfully, but these errors were encountered: