Update sink skip list for probable sink

pooranoayaw · Feb 15, 2023 · 7c5a368 · 7c5a368
1 parent 858b3f7
commit 7c5a368
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 2 deletions.
diff --git a/config/sinkSkipList/python.yaml b/config/sinkSkipList/python.yaml
@@ -4,8 +4,8 @@ sinkSkipList:
     patterns:
       - "(dict|list|str|tuple|int)\\.__.*"
       - "(django.*\\.py).*"
-      - "\\/[.]py.*"
-      - "(?i)(builtins|operator|ast|json|html2text|yaml|re|copy|argparse|datetime|time|decimal|collections|asyncio|subprocess|pytest|logging|traceback|sys|os|oss2|unittest|base64|dateutil|importlib|socket|urllib3|urllib|io|uuid|gzip|math|bson|random)\\.py.*"
+      - "\\/.*[.]py.*"
+      - "(?i)(builtins|operator|ast|jwt|hashlib|six|glob|json|html2text|yaml|re|copy|argparse|datetime|time|decimal|collections|asyncio|subprocess|pytest|logging|traceback|sys|os|oss2|unittest|base64|dateutil|importlib|socket|urllib3|urllib|io|uuid|gzip|math|bson|random|xmltodict|shutil|tempfile)\\.py.*"
 
   - id: SinkSkipList.BuiltInLib
     name: Skip built in language libraries

diff --git a/rules/sinks/third_parties/sdk/microsoft/python.yaml b/rules/sinks/third_parties/sdk/microsoft/python.yaml
@@ -11,6 +11,14 @@ sinks:
     patterns:
       - "(?i)(k4a|msal_extensions|msgraph_core|dapr|onedrivesdk|applicationinsights|asposecellscloud|adal|msoffcrypto_tool|office365.).*"
     tags:
+
+  - id: ThirdParties.SDK.Microsoft.Authentication
+    name: Microsoft Authentication
+    domains:
+      - "authentication.microsoft.com"
+    patterns:
+      - "(?i)(msal.*(ConfidentialClientApplication|PublicClientApplication)).*"
+    tags:
 
   - id: ThirdParties.SDK.Microsoft.Azure
     name: Microsoft Azure

diff --git a/rules/sinks/third_parties/sdk/slack/python.yaml b/rules/sinks/third_parties/sdk/slack/python.yaml
@@ -11,4 +11,5 @@ sinks:
     patterns:
       - "(?i)(slack_discovery_sdk|slack_sdk|slackclient|slackeventsapi|airflow.*providers.*slack|slack_webhook).*"
       - "(?i)((slack_sdk|django_slack).*message|slack[_]webhook.*post)"
+      - "(?i).*slack_hook.*"
     tags: