Skip to content

Add Go and Java support for check_pattern #5

@protonese3

Description

@protonese3

Description

The code pattern scanner currently supports JavaScript, TypeScript, Python, and SQL. Add regex matchers for Go and Java vulnerabilities.

Go patterns to add

  • SQL injection: fmt.Sprintf("SELECT...%s", userInput)
  • Command injection: exec.Command("sh", "-c", userInput)
  • Path traversal: filepath.Join(dir, userInput) without sanitization
  • SSRF: http.Get(userURL) without validation

Java patterns to add

  • SQL injection: statement.executeQuery("SELECT..." + input)
  • Deserialization: ObjectInputStream with untrusted data
  • XXE: DocumentBuilderFactory without disabling external entities
  • Path traversal: new File(basePath + userInput)

Files to edit

  • src/tools/knowledge/check_pattern.rs

Metadata

Metadata

Assignees

No one assigned

    Labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions