Thanks to visit codestin.com
Credit goes to github.com

Skip to content

♻️ Code Refactoring #600

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
hahwul merged 9 commits into from
Dec 6, 2024
Merged

♻️ Code Refactoring #600

hahwul merged 9 commits into from
Dec 6, 2024

Conversation

@hahwul
Copy link
Owner

@hahwul hahwul commented Dec 4, 2024

Signed-off-by: HAHWUL [email protected]

@hahwul
Refactor scanning package: optimize type checks, enhance rate limiter…
3cd9ade 
…, and streamline static analysis

Signed-off-by: HAHWUL <[email protected]>
@hahwul hahwul added this to the NextVersion milestone Dec 4, 2024
github-advanced-security[bot]
github-advanced-security bot found potential problems Dec 4, 2024
View reviewed changes
pkg/scanning/grep.go
"dalfox-esii": "<esii-dalfox>",
"dalfox-rsa-key": "-----BEGIN RSA PRIVATE KEY-----|-----END RSA PRIVATE KEY-----",
"dalfox-priv-key": "-----BEGIN PRIVATE KEY-----|-----END PRIVATE KEY-----",
"dalfox-aws-s3": "s3\\.amazonaws.com[/]+|[a-zA-Z0-9_-]*\\.s3\\.amazonaws.com",

Check failure

Code scanning / CodeQL

Incomplete regular expression for hostnames

This regular expression has an unescaped dot before 'com', so it might match more hosts than expected when [the regular expression is used](1).

Copilot Autofix

AI about 1 year ago

To fix the problem, we need to escape the dot before 'com' in the regular expression on line 39. This will ensure that the dot is treated as a literal character rather than a wildcard, preventing unintended matches. The best way to fix this is to use a raw string literal to avoid having to escape backslashes.

Suggested changeset 1
pkg/scanning/grep.go

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/pkg/scanning/grep.go b/pkg/scanning/grep.go
--- a/pkg/scanning/grep.go
+++ b/pkg/scanning/grep.go
@@ -38,3 +38,3 @@
 	"dalfox-priv-key":              "-----BEGIN PRIVATE KEY-----|-----END PRIVATE KEY-----",
-	"dalfox-aws-s3":                "s3\\.amazonaws.com[/]+|[a-zA-Z0-9_-]*\\.s3\\.amazonaws.com",
+	"dalfox-aws-s3":                `s3\.amazonaws\.com[/]+|[a-zA-Z0-9_-]*\.s3\.amazonaws\.com`,
 	"dalfox-aws-appsync-graphql":   "da2-[a-z0-9]{26}",
EOF
@@ -38,3 +38,3 @@
"dalfox-priv-key": "-----BEGIN PRIVATE KEY-----|-----END PRIVATE KEY-----",
"dalfox-aws-s3": "s3\\.amazonaws.com[/]+|[a-zA-Z0-9_-]*\\.s3\\.amazonaws.com",
"dalfox-aws-s3": `s3\.amazonaws\.com[/]+|[a-zA-Z0-9_-]*\.s3\.amazonaws\.com`,
"dalfox-aws-appsync-graphql": "da2-[a-z0-9]{26}",
Copilot is powered by AI and may make mistakes. Always verify output.
pkg/scanning/grep.go
"dalfox-priv-key": "-----BEGIN PRIVATE KEY-----|-----END PRIVATE KEY-----",
"dalfox-aws-s3": "s3\\.amazonaws.com[/]+|[a-zA-Z0-9_-]*\\.s3\\.amazonaws.com",
"dalfox-aws-appsync-graphql": "da2-[a-z0-9]{26}",
"dalfox-slack-webhook1": "https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}",

Check failure

Code scanning / CodeQL

Missing regular expression anchor

When this is used as a regular expression on a URL, it may match anywhere, and arbitrary hosts may come before or after it.

Copilot Autofix

AI about 1 year ago

To fix the problem, we need to add anchors to the regular expression to ensure it matches the entire URL string and not just any part of it. Specifically, we should add the ^ anchor at the beginning and the $ anchor at the end of the regular expression.

  • Update the regular expression for Slack webhook URLs to include ^ at the beginning and $ at the end.
  • This change should be made in the builtinPatterns map where the regular expression is defined.
Suggested changeset 1
pkg/scanning/grep.go

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/pkg/scanning/grep.go b/pkg/scanning/grep.go
--- a/pkg/scanning/grep.go
+++ b/pkg/scanning/grep.go
@@ -40,3 +40,3 @@
 	"dalfox-aws-appsync-graphql":   "da2-[a-z0-9]{26}",
-	"dalfox-slack-webhook1":        "https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}",
+	"dalfox-slack-webhook1":        "^https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}$",
 	"dalfox-slack-webhook2":        "https://hooks.slack.com/services/T[a-zA-Z0-9_]{8,10}/B[a-zA-Z0-9_]{8,10}/[a-zA-Z0-9_]{24}",
EOF
@@ -40,3 +40,3 @@
"dalfox-aws-appsync-graphql": "da2-[a-z0-9]{26}",
"dalfox-slack-webhook1": "https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}",
"dalfox-slack-webhook1": "^https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}$",
"dalfox-slack-webhook2": "https://hooks.slack.com/services/T[a-zA-Z0-9_]{8,10}/B[a-zA-Z0-9_]{8,10}/[a-zA-Z0-9_]{24}",
Copilot is powered by AI and may make mistakes. Always verify output.
pkg/scanning/grep.go
"dalfox-priv-key": "-----BEGIN PRIVATE KEY-----|-----END PRIVATE KEY-----",
"dalfox-aws-s3": "s3\\.amazonaws.com[/]+|[a-zA-Z0-9_-]*\\.s3\\.amazonaws.com",
"dalfox-aws-appsync-graphql": "da2-[a-z0-9]{26}",
"dalfox-slack-webhook1": "https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}",

Check failure

Code scanning / CodeQL

Incomplete regular expression for hostnames

This regular expression has an unescaped dot before 'slack.com', so it might match more hosts than expected when [the regular expression is used](1).

Copilot Autofix

AI about 1 year ago

Copilot could not generate an autofix suggestion

Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.

pkg/scanning/grep.go
"dalfox-aws-s3": "s3\\.amazonaws.com[/]+|[a-zA-Z0-9_-]*\\.s3\\.amazonaws.com",
"dalfox-aws-appsync-graphql": "da2-[a-z0-9]{26}",
"dalfox-slack-webhook1": "https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}",
"dalfox-slack-webhook2": "https://hooks.slack.com/services/T[a-zA-Z0-9_]{8,10}/B[a-zA-Z0-9_]{8,10}/[a-zA-Z0-9_]{24}",

Check failure

Code scanning / CodeQL

Missing regular expression anchor

When this is used as a regular expression on a URL, it may match anywhere, and arbitrary hosts may come before or after it.

Copilot Autofix

AI about 1 year ago

To fix the problem, we need to add anchors to the regular expression to ensure it matches the entire URL string and not just any part of it. Specifically, we should add the ^ anchor at the beginning and the $ anchor at the end of the regular expression.

  • Modify the regular expression for the Slack webhook URL to include ^ at the beginning and $ at the end.
  • This change should be made in the builtinPatterns map where the regular expression is defined.
Suggested changeset 1
pkg/scanning/grep.go

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/pkg/scanning/grep.go b/pkg/scanning/grep.go
--- a/pkg/scanning/grep.go
+++ b/pkg/scanning/grep.go
@@ -41,3 +41,3 @@
 	"dalfox-slack-webhook1":        "https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}",
-	"dalfox-slack-webhook2":        "https://hooks.slack.com/services/T[a-zA-Z0-9_]{8,10}/B[a-zA-Z0-9_]{8,10}/[a-zA-Z0-9_]{24}",
+	"dalfox-slack-webhook2":        "^https://hooks.slack.com/services/T[a-zA-Z0-9_]{8,10}/B[a-zA-Z0-9_]{8,10}/[a-zA-Z0-9_]{24}$",
 	"dalfox-slack-token":           "(xox[p|b|o|a]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32})",
EOF
@@ -41,3 +41,3 @@
"dalfox-slack-webhook1": "https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}",
"dalfox-slack-webhook2": "https://hooks.slack.com/services/T[a-zA-Z0-9_]{8,10}/B[a-zA-Z0-9_]{8,10}/[a-zA-Z0-9_]{24}",
"dalfox-slack-webhook2": "^https://hooks.slack.com/services/T[a-zA-Z0-9_]{8,10}/B[a-zA-Z0-9_]{8,10}/[a-zA-Z0-9_]{24}$",
"dalfox-slack-token": "(xox[p|b|o|a]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32})",
Copilot is powered by AI and may make mistakes. Always verify output.
pkg/scanning/grep.go
"dalfox-aws-s3": "s3\\.amazonaws.com[/]+|[a-zA-Z0-9_-]*\\.s3\\.amazonaws.com",
"dalfox-aws-appsync-graphql": "da2-[a-z0-9]{26}",
"dalfox-slack-webhook1": "https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}",
"dalfox-slack-webhook2": "https://hooks.slack.com/services/T[a-zA-Z0-9_]{8,10}/B[a-zA-Z0-9_]{8,10}/[a-zA-Z0-9_]{24}",

Check failure

Code scanning / CodeQL

Incomplete regular expression for hostnames

This regular expression has an unescaped dot before 'slack.com', so it might match more hosts than expected when [the regular expression is used](1).

Copilot Autofix

AI about 1 year ago

To fix the problem, we need to escape the dot in the regular expression to ensure that it matches only the literal dot character and not any character. This can be done by replacing the dot with \\. in the regular expression string. Additionally, using raw string literals can make the regular expression more readable and avoid the need to escape backslashes.

The specific change required is to update the regular expression for the Slack webhook URL in the builtinPatterns map to escape the dot before slack.com.

Suggested changeset 1
pkg/scanning/grep.go

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/pkg/scanning/grep.go b/pkg/scanning/grep.go
--- a/pkg/scanning/grep.go
+++ b/pkg/scanning/grep.go
@@ -41,3 +41,3 @@
 	"dalfox-slack-webhook1":        "https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}",
-	"dalfox-slack-webhook2":        "https://hooks.slack.com/services/T[a-zA-Z0-9_]{8,10}/B[a-zA-Z0-9_]{8,10}/[a-zA-Z0-9_]{24}",
+	"dalfox-slack-webhook2":        `https://hooks\\.slack\\.com/services/T[a-zA-Z0-9_]{8,10}/B[a-zA-Z0-9_]{8,10}/[a-zA-Z0-9_]{24}`,
 	"dalfox-slack-token":           "(xox[p|b|o|a]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32})",
EOF
@@ -41,3 +41,3 @@
"dalfox-slack-webhook1": "https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}",
"dalfox-slack-webhook2": "https://hooks.slack.com/services/T[a-zA-Z0-9_]{8,10}/B[a-zA-Z0-9_]{8,10}/[a-zA-Z0-9_]{24}",
"dalfox-slack-webhook2": `https://hooks\\.slack\\.com/services/T[a-zA-Z0-9_]{8,10}/B[a-zA-Z0-9_]{8,10}/[a-zA-Z0-9_]{24}`,
"dalfox-slack-token": "(xox[p|b|o|a]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32})",
Copilot is powered by AI and may make mistakes. Always verify output.
pkg/scanning/waf.go
{Name: "Profense Web Application Firewall (Armorlogic)", Body: "", Header: "PLBSID=|Profense"},
{Name: "AppWall (Radware)", Body: "Unauthorized Activity Has Been Detected", Header: "X-SL-CompState"},
{Name: "Reblaze Web Application Firewall (Reblaze)", Body: "", Header: "rbzid=|Reblaze Secure Web Gateway"},
{Name: "ASP.NET RequestValidationMode (Microsoft)", Body: "ASP.NET has detected data in the request that is potentially dangerous|Request Validation has detected a potentially dangerous client input value|HttpRequestValidationException", Header: ""},

Check failure

Code scanning / CodeQL

Incomplete regular expression for hostnames

This regular expression has an unescaped dot before 'NET', so it might match more hosts than expected when [the regular expression is used](1).

Copilot Autofix

AI about 1 year ago

To fix the problem, we need to escape the dot in the regular expression to ensure it matches the literal character rather than any character. This can be done by replacing the dot with \.. Additionally, we can use raw string literals to avoid having to escape backslashes, making the regular expression more readable.

Suggested changeset 1
pkg/scanning/waf.go

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/pkg/scanning/waf.go b/pkg/scanning/waf.go
--- a/pkg/scanning/waf.go
+++ b/pkg/scanning/waf.go
@@ -57,3 +57,3 @@
 	{Name: "Reblaze Web Application Firewall (Reblaze)", Body: "", Header: "rbzid=|Reblaze Secure Web Gateway"},
-	{Name: "ASP.NET RequestValidationMode (Microsoft)", Body: "ASP.NET has detected data in the request that is potentially dangerous|Request Validation has detected a potentially dangerous client input value|HttpRequestValidationException", Header: ""},
+	{Name: "ASP.NET RequestValidationMode (Microsoft)", Body: `ASP\.NET has detected data in the request that is potentially dangerous|Request Validation has detected a potentially dangerous client input value|HttpRequestValidationException`, Header: ""},
 	{Name: "Safe3 Web Application Firewall", Body: "", Header: "Safe3"},
EOF
@@ -57,3 +57,3 @@
{Name: "Reblaze Web Application Firewall (Reblaze)", Body: "", Header: "rbzid=|Reblaze Secure Web Gateway"},
{Name: "ASP.NET RequestValidationMode (Microsoft)", Body: "ASP.NET has detected data in the request that is potentially dangerous|Request Validation has detected a potentially dangerous client input value|HttpRequestValidationException", Header: ""},
{Name: "ASP.NET RequestValidationMode (Microsoft)", Body: `ASP\.NET has detected data in the request that is potentially dangerous|Request Validation has detected a potentially dangerous client input value|HttpRequestValidationException`, Header: ""},
{Name: "Safe3 Web Application Firewall", Body: "", Header: "Safe3"},
Copilot is powered by AI and may make mistakes. Always verify output.
pkg/scanning/waf.go
{Name: "ASP.NET RequestValidationMode (Microsoft)", Body: "ASP.NET has detected data in the request that is potentially dangerous|Request Validation has detected a potentially dangerous client input value|HttpRequestValidationException", Header: ""},
{Name: "Safe3 Web Application Firewall", Body: "", Header: "Safe3"},
{Name: "Safedog Web Application Firewall (Safedog)", Body: "", Header: "WAF/2.0|safedog"},
{Name: "SecureIIS Web Server Security (BeyondTrust)", Body: "SecureIIS.*?Web Server Protection|http://www.eeye.com/SecureIIS/|?subject=[^>]*SecureIIS Error", Header: ""},

Check failure

Code scanning / CodeQL

Incomplete regular expression for hostnames

This regular expression has an unescaped dot before 'eeye.com', so it might match more hosts than expected when [the regular expression is used](1).

Copilot Autofix

AI about 1 year ago

To fix the problem, we need to escape the dot in the regular expression to ensure that it matches only a literal dot and not any character. This can be done by replacing the dot with \\. in the regular expression string. This change should be made in the patterns array where the regular expression is defined.

Suggested changeset 1
pkg/scanning/waf.go

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/pkg/scanning/waf.go b/pkg/scanning/waf.go
--- a/pkg/scanning/waf.go
+++ b/pkg/scanning/waf.go
@@ -60,3 +60,3 @@
 	{Name: "Safedog Web Application Firewall (Safedog)", Body: "", Header: "WAF/2.0|safedog"},
-	{Name: "SecureIIS Web Server Security (BeyondTrust)", Body: "SecureIIS.*?Web Server Protection|http://www.eeye.com/SecureIIS/|?subject=[^>]*SecureIIS Error", Header: ""},
+	{Name: "SecureIIS Web Server Security (BeyondTrust)", Body: "SecureIIS.*?Web Server Protection|http://www\\.eeye\\.com/SecureIIS/|?subject=[^>]*SecureIIS Error", Header: ""},
 	{Name: "SEnginx (Neusoft Corporation)", Body: "SENGINX-ROBOT-MITIGATION", Header: ""},
EOF
@@ -60,3 +60,3 @@
{Name: "Safedog Web Application Firewall (Safedog)", Body: "", Header: "WAF/2.0|safedog"},
{Name: "SecureIIS Web Server Security (BeyondTrust)", Body: "SecureIIS.*?Web Server Protection|http://www.eeye.com/SecureIIS/|?subject=[^>]*SecureIIS Error", Header: ""},
{Name: "SecureIIS Web Server Security (BeyondTrust)", Body: "SecureIIS.*?Web Server Protection|http://www\\.eeye\\.com/SecureIIS/|?subject=[^>]*SecureIIS Error", Header: ""},
{Name: "SEnginx (Neusoft Corporation)", Body: "SENGINX-ROBOT-MITIGATION", Header: ""},
Copilot is powered by AI and may make mistakes. Always verify output.
pkg/scanning/waf.go
{Name: "SonicWALL (Dell)", Body: "This request is blocked by the SonicWALL|#shd|#nsa_banner|Web Site Blocked.*?nsa_banner", Header: "SonicWALL"},
{Name: "UTM Web Protection (Sophos)", Body: "Powered by UTM Web Protection", Header: ""},
{Name: "Stingray Application Firewall (Riverbed / Brocade)", Body: "", Header: "X-Mapping-"},
{Name: "CloudProxy WebSite Firewall (Sucuri)", Body: "Access Denied.*?Sucuri Website Firewall|Sucuri WebSite Firewall.*?Access Denied|Questions?.*[email protected]", Header: "Sucuri/Cloudproxy|X-Sucuri"},

Check failure

Code scanning / CodeQL

Incomplete regular expression for hostnames

This regular expression has an unescaped dot before 'net', so it might match more hosts than expected when [the regular expression is used](1).

Copilot Autofix

AI about 1 year ago

To fix the problem, we need to escape the dot (.) in the regular expression to ensure it matches only the literal dot character and not any character. This will make the pattern more precise and prevent unintended matches. Specifically, we need to update the regular expression in the Body field of the WAFPattern for "CloudProxy WebSite Firewall (Sucuri)" on line 67.

Suggested changeset 1
pkg/scanning/waf.go

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/pkg/scanning/waf.go b/pkg/scanning/waf.go
--- a/pkg/scanning/waf.go
+++ b/pkg/scanning/waf.go
@@ -66,3 +66,3 @@
 	{Name: "Stingray Application Firewall (Riverbed / Brocade)", Body: "", Header: "X-Mapping-"},
-	{Name: "CloudProxy WebSite Firewall (Sucuri)", Body: "Access Denied.*?Sucuri Website Firewall|Sucuri WebSite Firewall.*?Access Denied|Questions?.*[email protected]", Header: "Sucuri/Cloudproxy|X-Sucuri"},
+	{Name: "CloudProxy WebSite Firewall (Sucuri)", Body: "Access Denied.*?Sucuri Website Firewall|Sucuri WebSite Firewall.*?Access Denied|Questions?.*?cloudproxy@sucuri\\.net", Header: "Sucuri/Cloudproxy|X-Sucuri"},
 	{Name: "Tencent Cloud Web Application Firewall (Tencent Cloud Computing)", Body: "waf.tencent-cloud.com", Header: ""},
EOF
@@ -66,3 +66,3 @@
{Name: "Stingray Application Firewall (Riverbed / Brocade)", Body: "", Header: "X-Mapping-"},
{Name: "CloudProxy WebSite Firewall (Sucuri)", Body: "Access Denied.*?Sucuri Website Firewall|Sucuri WebSite Firewall.*?Access Denied|Questions?.*[email protected]", Header: "Sucuri/Cloudproxy|X-Sucuri"},
{Name: "CloudProxy WebSite Firewall (Sucuri)", Body: "Access Denied.*?Sucuri Website Firewall|Sucuri WebSite Firewall.*?Access Denied|Questions?.*?cloudproxy@sucuri\\.net", Header: "Sucuri/Cloudproxy|X-Sucuri"},
{Name: "Tencent Cloud Web Application Firewall (Tencent Cloud Computing)", Body: "waf.tencent-cloud.com", Header: ""},
Copilot is powered by AI and may make mistakes. Always verify output.
pkg/scanning/waf.go
{Name: "UTM Web Protection (Sophos)", Body: "Powered by UTM Web Protection", Header: ""},
{Name: "Stingray Application Firewall (Riverbed / Brocade)", Body: "", Header: "X-Mapping-"},
{Name: "CloudProxy WebSite Firewall (Sucuri)", Body: "Access Denied.*?Sucuri Website Firewall|Sucuri WebSite Firewall.*?Access Denied|Questions?.*[email protected]", Header: "Sucuri/Cloudproxy|X-Sucuri"},
{Name: "Tencent Cloud Web Application Firewall (Tencent Cloud Computing)", Body: "waf.tencent-cloud.com", Header: ""},

Check failure

Code scanning / CodeQL

Missing regular expression anchor

When this is used as a regular expression on a URL, it may match anywhere, and arbitrary hosts may come before or after it.

Copilot Autofix

AI about 1 year ago

To fix the problem, we need to add anchors to the regular expression to ensure it matches the expected part of the input string. Specifically, we should add ^ at the beginning and $ at the end of the pattern to ensure it matches the entire string.

  • Update the regular expression for the "Tencent Cloud Web Application Firewall" pattern to include anchors.
  • Modify the Body field of the WAFPattern struct for the "Tencent Cloud Web Application Firewall" entry to use the anchored pattern.
Suggested changeset 1
pkg/scanning/waf.go

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/pkg/scanning/waf.go b/pkg/scanning/waf.go
--- a/pkg/scanning/waf.go
+++ b/pkg/scanning/waf.go
@@ -67,3 +67,3 @@
 	{Name: "CloudProxy WebSite Firewall (Sucuri)", Body: "Access Denied.*?Sucuri Website Firewall|Sucuri WebSite Firewall.*?Access Denied|Questions?.*[email protected]", Header: "Sucuri/Cloudproxy|X-Sucuri"},
-	{Name: "Tencent Cloud Web Application Firewall (Tencent Cloud Computing)", Body: "waf.tencent-cloud.com", Header: ""},
+	{Name: "Tencent Cloud Web Application Firewall (Tencent Cloud Computing)", Body: "^waf.tencent-cloud.com$", Header: ""},
 	{Name: "Teros/Citrix Application Firewall Enterprise (Teros/Citrix Systems)", Body: "", Header: "st8(id|_wat|_wlf)"},
EOF
@@ -67,3 +67,3 @@
{Name: "CloudProxy WebSite Firewall (Sucuri)", Body: "Access Denied.*?Sucuri Website Firewall|Sucuri WebSite Firewall.*?Access Denied|Questions?.*[email protected]", Header: "Sucuri/Cloudproxy|X-Sucuri"},
{Name: "Tencent Cloud Web Application Firewall (Tencent Cloud Computing)", Body: "waf.tencent-cloud.com", Header: ""},
{Name: "Tencent Cloud Web Application Firewall (Tencent Cloud Computing)", Body: "^waf.tencent-cloud.com$", Header: ""},
{Name: "Teros/Citrix Application Firewall Enterprise (Teros/Citrix Systems)", Body: "", Header: "st8(id|_wat|_wlf)"},
Copilot is powered by AI and may make mistakes. Always verify output.
pkg/scanning/waf.go
{Name: "UTM Web Protection (Sophos)", Body: "Powered by UTM Web Protection", Header: ""},
{Name: "Stingray Application Firewall (Riverbed / Brocade)", Body: "", Header: "X-Mapping-"},
{Name: "CloudProxy WebSite Firewall (Sucuri)", Body: "Access Denied.*?Sucuri Website Firewall|Sucuri WebSite Firewall.*?Access Denied|Questions?.*[email protected]", Header: "Sucuri/Cloudproxy|X-Sucuri"},
{Name: "Tencent Cloud Web Application Firewall (Tencent Cloud Computing)", Body: "waf.tencent-cloud.com", Header: ""},

Check failure

Code scanning / CodeQL

Incomplete regular expression for hostnames

This regular expression has an unescaped dot before 'tencent-cloud.com', so it might match more hosts than expected when [the regular expression is used](1).

Copilot Autofix

AI about 1 year ago

To fix the problem, we need to escape the dots in the regular expression "waf.tencent-cloud.com" to ensure that they match literal dots rather than any character. This can be done by replacing each dot with \\.. Additionally, we can use raw string literals to avoid having to escape backslashes, making the regular expression more readable.

Suggested changeset 1
pkg/scanning/waf.go

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/pkg/scanning/waf.go b/pkg/scanning/waf.go
--- a/pkg/scanning/waf.go
+++ b/pkg/scanning/waf.go
@@ -67,3 +67,3 @@
 	{Name: "CloudProxy WebSite Firewall (Sucuri)", Body: "Access Denied.*?Sucuri Website Firewall|Sucuri WebSite Firewall.*?Access Denied|Questions?.*[email protected]", Header: "Sucuri/Cloudproxy|X-Sucuri"},
-	{Name: "Tencent Cloud Web Application Firewall (Tencent Cloud Computing)", Body: "waf.tencent-cloud.com", Header: ""},
+	{Name: "Tencent Cloud Web Application Firewall (Tencent Cloud Computing)", Body: `waf\.tencent-cloud\.com`, Header: ""},
 	{Name: "Teros/Citrix Application Firewall Enterprise (Teros/Citrix Systems)", Body: "", Header: "st8(id|_wat|_wlf)"},
EOF
@@ -67,3 +67,3 @@
{Name: "CloudProxy WebSite Firewall (Sucuri)", Body: "Access Denied.*?Sucuri Website Firewall|Sucuri WebSite Firewall.*?Access Denied|Questions?.*[email protected]", Header: "Sucuri/Cloudproxy|X-Sucuri"},
{Name: "Tencent Cloud Web Application Firewall (Tencent Cloud Computing)", Body: "waf.tencent-cloud.com", Header: ""},
{Name: "Tencent Cloud Web Application Firewall (Tencent Cloud Computing)", Body: `waf\.tencent-cloud\.com`, Header: ""},
{Name: "Teros/Citrix Application Firewall Enterprise (Teros/Citrix Systems)", Body: "", Header: "st8(id|_wat|_wlf)"},
Copilot is powered by AI and may make mistakes. Always verify output.
@hahwul hahwul changed the title Refactor scanning package: optimize type checks, enhance rate limiter, and streamline static analysis ♻️ Code Refactoring Dec 4, 2024
hahwul added 8 commits December 4, 2024 23:59
@hahwul
Refactor verification functions: improve readability and simplify log…
dd6f561 
…ic for reflection checks

Signed-off-by: HAHWUL <[email protected]>
@hahwul
Refactor CheckInspectionParam: optimize parameter checks using maps f…
b2d88a8 
…or improved performance

Signed-off-by: HAHWUL <[email protected]>
@hahwul
Refactor SetPayloadValue: streamline payload processing and enhance c…
45a40d0 
…larity with switch-case structure

Signed-off-by: HAHWUL <[email protected]>
@hahwul
Refactor GenerateBulkPayload: streamline payload creation and enhance…
f80f0be 
… alert replacement logic

Signed-off-by: HAHWUL <[email protected]>
@hahwul
Refactor command handlers: extract logic into separate functions for …
dd40974 
…improved readability and maintainability

Signed-off-by: HAHWUL <[email protected]>
@hahwul
Refactor report generation: extract rendering logic into separate fun…
10fe782 
…ctions for improved clarity and maintainability

Signed-off-by: HAHWUL <[email protected]>
@hahwul
Refactor scan handling: extract URL cleaning and improve scan retriev…
c7838d7 
…al logic for better clarity and maintainability; add unit tests for new functionality

Signed-off-by: HAHWUL <[email protected]>
@hahwul
Add unit tests for server handlers and utility functions to improve t…
f114da4 
…est coverage and reliability

Signed-off-by: HAHWUL <[email protected]>
@hahwul hahwul marked this pull request as ready for review December 6, 2024 14:13
@hahwul hahwul merged commit 3311bb9 into main Dec 6, 2024
@hahwul hahwul deleted the code-refactoring branch December 6, 2024 14:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

v2.10.0

Development

Successfully merging this pull request may close these issues.

1 participant

@hahwul