DevSkim
DevSkim copied to clipboard
Rewrite Rules to use Named Group syntax
http://xregexp.com/syntax/
https://docs.microsoft.com/en-us/dotnet/api/system.text.regularexpressions.regex.getgroupnames?view=netcore-3.1
Problem
To fix #184 where rules are catching Base64 encoded objects.
We may want to check that something has a maximum length for example. If you check that with the current methods, all those characters will be highlighted instead of just the MD5
. You cannot do this with existing conditions because those check on the already matched data.
Proposed solution
Use named capture group syntax compatible with both the VSCode and .NET codebases.
(?<finding>CC_(MD2|MD4|MD5|SHA1)
for example will highlight CC_MD2
and capture it in a property of the matches named finding
[\\s\\(\\)\\.].{0,50}(?<finding>MD2|MD4|MD5|RIPEMD|RIPEMD(128|256|160|320)|(SHA0|SHA-0|SHA1|SHA-1).{0,50}[\\s\\(;\\.)
will highlight MD2
in CreateMD2Hash
but not in
let base64 = 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAADoAAAA6CAYAAADhu0ooAAAABmJLR0QAAAAAAAD5Q7t/AAAACXBIWXMAAC4jAAAuIwF4pT92AAAB7UlEQVRo3u3bMUoDYRAF4L2CRS4g5ATmCHuEeIKAF0hhn8o6nWVau9Q2OYBIBMFCNAgWgUCChSBYrEwRMIFNdmfevPmXbPEXW2R4X7M7OzvJiqLITuFkLfQUod/z+cX7YHD32u/fr6fTy+jQmjyVij51u+vHTqfYntVkchWJ1OSpXTQSa8mjKhqBteZRF2ViEXlMRRlYVB5zUU+sJc/+3Xin8OdodKMp6oG1IOXIo6cUuhyPry1QFNaKlCPP2VLo72Zz9pLnD5FYBFJ+/7NYnB+8GUViUUipU+nxEoH1RB5sGJhYb+TRFpCBZSArNfWeWBay8muaB5aJrPXijcJ+DIe30pgwkbUnDCis9dRFqkYp0VgNUj0zisJqkabhGBtrQZqngCysFQkZd3pjEUjYXNcLi0JCB9ho7HOv9yY1k5zUf81mOQoqTUWynySkxUNBpYNKEoroXT1nUMki0dikkUhs8kgUthFIBLYxSCu2UUgLtnFILZaKlBZRPv5ILfbcmIr837uyh+QhyAhsGJKNDUUyseFIFjYJJAO7cyEfT6OQaKzrDoMVicS67TCgkCjs/oQCUhyNtOZx2WHwQmrzuOwweCPr5nHZYWAhq+Zx2WFgI4/lcdlhiEKW5YHuMGyH03IikZY87Z8HWmhDzx81o_MD2_j+TSXwAAAABJRU5ErkJggg==';
Depends on #201