diff --git a/functions.py b/functions.py index 51b256f..3ba5b15 100644 --- a/functions.py +++ b/functions.py @@ -99,11 +99,12 @@ def check_declaration(content, vuln, path): declaration = regex_declaration.findall(content) if len(declaration)>0: - # TODO: Check constant then return True if constant because it's false positive + # Check constant then return True if constant because it's false positive declaration_text = "$"+vuln[1:] +declaration[0][0]+"="+declaration[0][1] line_declaration = find_line_declaration(declaration_text, content) - regex_constant = re.compile("\$"+vuln[1:]+"([\t ]*)=[\t ]*([\"\'][a-zA-Z0-9]*?[\"\']);") + regex_constant = re.compile("\$"+vuln[1:]+"([\t ]*)=[\t ]*([\"\'(]*?[a-zA-Z0-9{}_]*?[\"\')]*?);") false_positive = regex_constant.match(declaration_text) + if false_positive: return (True, "","") return (False, declaration_text,line_declaration) diff --git a/index.py b/index.py index 27db1a7..dbf351b 100644 --- a/index.py +++ b/index.py @@ -6,7 +6,9 @@ # Educational purpose only ! # TODO afficher toutes les modifications de la variable - +# TODO checker recursivement les vulns dans la déclaration d'une var # BUG color var['something'] +# TODO serialize detection import sys import argparse