slopguard-rules 0.1.4

Builtin rule definitions for slopguard
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

id: no-eval
language: typescript
severity: error
category: security
message: "eval() is a code injection vector. Use a safer alternative."
note: "eval() executes arbitrary code and is banned by most security policies (OWASP)."
rule:
  pattern: eval($$$)
ignores:
  - "**/fixtures/**"
tests:
  should_match:
    - 'eval("alert(1)");'
    - 'eval(userInput);'
  should_not_match:
    - 'JSON.parse(data);'
    - 'new Function("return 1")();'