njsscan

What's Changed

• Update timing_attack_node.yaml by @sebasrevuelta in https://github.com/ajinabraham/njsscan/pull/113
• bump version + lint qa by @ajinabraham in https://github.com/ajinabraham/njsscan/pull/117
• Update nosql_find_injection.yaml to exclude sequelize's .findOne() false positives by @bleow in https://github.com/ajinabraham/njsscan/pull/115

New Contributors

• @sebasrevuelta made their first contribution in https://github.com/ajinabraham/njsscan/pull/113
• @bleow made their first contribution in https://github.com/ajinabraham/njsscan/pull/115

Full Changelog: https://github.com/ajinabraham/njsscan/compare/0.3.6...0.3.7

• Huge Performance Improvement from libsast bump

Bump semgrep + libsast

• Code QA
• SARIF to display CWE on Github Advanced Security dashboard

• libasat update
• Fixes #68

• libasat and semgrep update including bug fixes
• support M1 Mac ARM
• drop support for Python 3.6
• test fixes

• Major libsast upgrade
• Standard mapping support from libsast
• Publish latest docker images from master and release

• Performance Improvements
• Major semgrep upgrade
• SQLi rule bug fix
• Rules QA

• Support ES6 syntax for NoSQL find injection rule (@CharlyJazz)
• Added Severity Filter (@ansidorov)
• Remove Duplicated Rule
• Refactor Tests

• Support njsscan-ignore for templates
• deprecate ignore:

• semgrep update
• CWE Typo Fix
• libsast pattern matcher to support ignore findings.

• Rules QA
• License Change: LGPL2.1 -> LGPL3.0+
• Semgrep bump

• Bump Semgrep version to 0.47
• Rule QA
• Support HTML output format

• Bump Semgrep version to 0.45
• Update Max Scan file size from 25 to 5 MB.
• Added New Sequelize Rules from Semgrep, contributed by @0xdbe

 sequelize_tls
 sequelize_tls_cert_validation
 sequelize_weak_tls

• Removing a leading statement ellipsis trims time on a test corpus from
  32.7 to 24.2 seconds.
• Bump libsast, skip files > 25MB for pattern matcher and choice matcher.

• New Rule Express hbs Local File Read
• Rule QA
• New config --config to support .njsscan file from a custom location
• Replaced expires rule and maxAge rule

Semgrep version update

• libsast pinned to a particular version

• Semgrep version bump
• New Rules - Knex SQLI, AES no IV
• Tabular CL output
• Rule QA

• Added SARIF Support
• Semgrep version bump
• Rule QA