Update nosql_find_injection to support ES6 syntax (ajinabraham#65)

* Update nosql_find_injection to support ES6 syntax There is a lot of backend software running in ES6 syntax. And this syntax is "import X from "Y" replacing the old const X = require("Y") Co-authored-by: Ajin Abraham <[email protected]>
bountyx1 · Jun 16, 2021 · 8dac712 · 8dac712
1 parent c6ea106
commit 8dac712
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/njsscan/rules/semantic_grep/database/nosql_find_injection.yaml b/njsscan/rules/semantic_grep/database/nosql_find_injection.yaml
@@ -6,6 +6,11 @@ rules:
       ...
       $SANITIZE(...)
       ...
+  - pattern-not-inside: |
+      import $SANITIZE from 'mongo-sanitize'
+      ...
+      $SANITIZE(...)
+      ...
   - pattern-either:
     - pattern: |
         $OBJ.findOne({$KEY : <... $REQ.$FOO.$BAR ...> }, ...)
@@ -65,4 +70,4 @@ rules:
   severity: ERROR
   metadata:
     owasp: 'A1: Injection'
-    cwe: 'CWE-943: Improper Neutralization of Special Elements in Data Query Logic'
+    cwe: 'CWE-943: Improper Neutralization of Special Elements in Data Query Logic'