spotify-time-machine/semgrep.yml at main · jjsizemore/spotify-time-machine · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
rules:
  - id: 'typescript-react-security'
    patterns:
      - pattern: 'dangerouslySetInnerHTML'
    message: 'Avoid dangerouslySetInnerHTML for security'
    languages: [typescript, javascript]
    severity: WARNING

  - id: 'typescript-node-security'
    patterns:
      - pattern: 'eval(...)'
      - pattern: 'new Function(...)'
    message: 'Avoid eval and Function constructor for security'
    languages: [typescript, javascript]
    severity: ERROR

  - id: 'typescript-sql-injection'
    patterns:
      - pattern: '$QUERY = "... " + $VAR + " ..."'
      - pattern: '$QUERY = `... ${$VAR} ...`'
    message: 'Potential SQL injection vulnerability'
    languages: [typescript, javascript]
    severity: ERROR

  - id: 'typescript-unsafe-type-assertion'
    patterns:
      - pattern: '$VAR as any'
    message: 'Avoid unsafe type assertions'
    languages: [typescript]
    severity: WARNING

  - id: 'typescript-console-log'
    patterns:
      - pattern: 'console.log(...)'
    message: 'Remove console.log statements in production code'
    languages: [typescript, javascript]
    severity: INFO