Skip to content

Add Python support for check_pattern regex matchers #4

@protonese3

Description

@protonese3

Description

Several regex matchers in check_pattern.rs only target JavaScript/TypeScript. Add Python-specific patterns for the same vulnerabilities.

Examples

  • Django raw SQL: cursor.execute(f"SELECT... or .extra(where=[f"...
  • Flask debug: app.run(debug=True)
  • Jinja2 without autoescape: Environment(autoescape=False)
  • Python SSRF: requests.get(user_input) without URL validation
  • Pickle deserialization: pickle.loads(user_data)

Files to edit

  • src/tools/knowledge/check_pattern.rs — add Python patterns to existing matchers or create new ones

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions