.semgrep.yml
author Kim Alvefur <zash@zash.se>
Mon, 04 Apr 2022 18:44:57 +0200
branch0.12
changeset 12454 7efd4bcaa95c
parent 11293 c6965f3c321c
child 12721 898e99f49d80
permissions -rw-r--r--
core.modulemanager: Fix global flag on per-host instances of shared modules (fix #1736) This flag is something of a shortcut for `module.host == "*"` and should always be equal to that. Its absence on the proxy object made the property of the global module instance visible, causing problems such as with URL reporting in mod_http

rules:
- id: log-variable-fmtstring
  patterns:
    - pattern: log("...", $A)
    - pattern-not: log("...", "...")
  message: Variable passed as format string to logging
  languages: [lua]
  severity: ERROR
- id: module-log-variable-fmtstring
  patterns:
    - pattern: module:log("...", $A)
    - pattern-not: module:log("...", "...")
  message: Variable passed as format string to logging
  languages: [lua]
  severity: ERROR
- id: module-getopt-string-default
  patterns:
    - pattern: module:get_option_string("...", $A)
    - pattern-not: module:get_option_string("...", "...")
    - pattern-not: module:get_option_string("...", host)
    - pattern-not: module:get_option_string("...", module.host)
  message: Non-string default from :get_option_string
  severity: ERROR
  languages: [lua]