tests: create unit tests for rules of horusec-engine

Question

tests: create unit tests for rules of horusec-engine

Opened this issue 3 years ago · 6 comments

Answer 1 · 2021-10-29T04:40:59.000Z

Looking into rules_test.go, I think we could improve csharp rules, so we can analyze if the command injection and xpath injection isn't sanityzing the input, so we should not release a false-positive.

Answer 2 · 2021-10-29T11:55:56.000Z

Looking into rules_test.go, I think we could improve csharp rules, so we can analyze if the command injection and xpath injection isn't sanityzing the input, so we should not release a false-positive.

Hello @filipemelo.

Any improvements to the rules are very welcome!

Currently, we only have a regex engine, so somethings can be hard to check some things with it.
It's already in our plans we have a semantic analysis to improve the engine's assertiveness.

Thank you for your interest in contributing and any questions we are at your disposal.

Answer 3 · 2021-10-29T17:01:30.000Z

Looking into rules_test.go, I think we could improve csharp rules, so we can analyze if the command injection and xpath injection isn't sanityzing the input, so we should not release a false-positive.

Hello @filipemelo.

Any improvements to the rules are very welcome!

Currently, we only have a regex engine, so somethings can be hard to check some things with it. It's already in our plans we have a semantic analysis to improve the engine's assertiveness.

Thank you for your interest in contributing and any questions we are at your disposal.

How can I help in samantic analysis? Are any issue to this?
Can I write code for all csharp rules or should I let some easy tasks for hacktoberfest event?

Answer 4 · 2021-10-29T17:58:51.000Z

Looking into rules_test.go, I think we could improve csharp rules, so we can analyze if the command injection and xpath injection isn't sanityzing the input, so we should not release a false-positive.

Hello @filipemelo.
Any improvements to the rules are very welcome!
Currently, we only have a regex engine, so somethings can be hard to check some things with it. It's already in our plans we have a semantic analysis to improve the engine's assertiveness.
Thank you for your interest in contributing and any questions we are at your disposal.

How can I help in samantic analysis? Are any issue to this?

Can I write code for all csharp rules or should I let some easy tasks for hacktoberfest event?

Hi again @filipemelo.

We do not have any open issue, we are at a very early stage and studying the best way to do it in our scenario.
In case you want to know more about what we did until now, you can check this branch and also this commit which contains a explanation of what we are thinking.
About writing all csharp rules, it will be much more than welcome. We still have a lot of other rules to test, so you don't have to worry about that.

Finally, thank you again for your contribution, it is very important to us.

Answer 5 · 2021-10-30T03:19:18.000Z

About HS-CSHARP-3 - SCS0007 - XML eXternal Entity Injection (XXE).#SCS007
This only happens to version prior to 4.5.2 .Net Framework, wich is each time less used. (release 4.5.2 - 2014-05-05)
Should we implement this and release false positive for beyond this version?

Answer 6 · 2021-11-03T12:01:53.000Z

About HS-CSHARP-3 - SCS0007 - XML eXternal Entity Injection (XXE).#SCS007 This only happens to version prior to 4.5.2 .Net Framework, wich is each time less used. (release 4.5.2 - 2014-05-05) Should we implement this and release false positive for beyond this version?

@filipemelo.

As we still don't have any way to verify the version, I believe it would be worth reducing the confidence and add the vulnerable versions in the description.