Skip to content

Conversation

@ikretz
Copy link
Contributor

@ikretz ikretz commented Oct 1, 2024

This PR makes some improvements to the code-execution and shady-links rules:

  • Adding a detection for subprocess.check_call() in code-execution
  • Making the https?:// prefix optional in shady-links links
  • Ignoring 169.254.0.0/16 and [fd00:ec2::254], which are cloud provider link-local IP ranges or addresses

@ikretz ikretz changed the title [SECRES-2215] Improve code execution and shady links rules [SECRES-2215] [SECRES-2450] Improve code execution and shady links rules Oct 1, 2024
@ikretz ikretz changed the title [SECRES-2215] [SECRES-2450] Improve code execution and shady links rules Improve code execution and shady links rules Oct 2, 2024
@ikretz ikretz marked this pull request as ready for review October 2, 2024 14:13
Copy link
Contributor

@christophetd christophetd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, would be good if @sobregosodd wanted to have a quick look as well

Copy link
Contributor

@sobregosodd sobregosodd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We discussed this one, LGTM!

@ikretz ikretz merged commit 40fd394 into main Oct 4, 2024
10 checks passed
@ikretz ikretz deleted the ikretz/code-execution-enhancement branch October 4, 2024 13:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants