News for hackers. Stuff that matters.

A comment on Finding potential software vulnerabilities from Git commit messages.

Re:Finding potential software vulnerabilities from Git commi... by nograpes on Sunday November 03, 2019 @06:55PM (#21437659)
In case anyone else was curious, the regular expression used is:

vulnpatterns = re.compile("(?i)(denial of service |\bXX E\b|remote code execution|\bopen redirect|OSVDB|\bvuln|\bCVE\b |\bXSS\b|\bReDoS\b|\bNVD\b|malicious|x−frame−options|attack|cross site |exploit|malicious|directory traversal |\bRCE\b|\bdos\b|\bXSRF \b|\bXSS\b|clickjack|session.fixation|hijack|\badvisory|\binsecure |security |\bcross−origin\b|unauthori[z|s]ed |infinite loop)")

[ Parent | on HN ]
Re:Finding potential software vulnerabilities from Git commi... by saagarjha on Sunday November 03, 2019 @08:38PM (#21438241)
This seems to be tuned towards web applications; I'd add things like "overflow", "corruption", and "disclose".
[ Parent | on HN ]
Re:Finding potential software vulnerabilities from Git commi... by adulau on Monday November 04, 2019 @05:50AM (#21440455)
Indeed, good point. I'll add a set of regular expressions for bugs related to overflow, double-free or alike. Don't hesitate to make a pull-request or open an issue if you see anything missing.
[ Parent | on HN ]