Description
Several regex matchers in check_pattern.rs only target JavaScript/TypeScript. Add Python-specific patterns for the same vulnerabilities.
Examples
- Django raw SQL:
cursor.execute(f"SELECT... or .extra(where=[f"...
- Flask debug:
app.run(debug=True)
- Jinja2 without autoescape:
Environment(autoescape=False)
- Python SSRF:
requests.get(user_input) without URL validation
- Pickle deserialization:
pickle.loads(user_data)
Files to edit
src/tools/knowledge/check_pattern.rs — add Python patterns to existing matchers or create new ones
Description
Several regex matchers in
check_pattern.rsonly target JavaScript/TypeScript. Add Python-specific patterns for the same vulnerabilities.Examples
cursor.execute(f"SELECT...or.extra(where=[f"...app.run(debug=True)Environment(autoescape=False)requests.get(user_input)without URL validationpickle.loads(user_data)Files to edit
src/tools/knowledge/check_pattern.rs— add Python patterns to existing matchers or create new ones