Update nosql_find_injection.yaml to exclude sequelize's .findOne() fa…

…lse positives (#115)
ajinabraham · Apr 5, 2024 · 370e904 · 370e904
1 parent e255017
commit 370e904
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/njsscan/rules/semantic_grep/database/nosql_find_injection.yaml b/njsscan/rules/semantic_grep/database/nosql_find_injection.yaml
@@ -1,6 +1,16 @@
 rules:
 - id: node_nosqli_injection
   patterns:
+  - pattern-not-inside: |
+      $SEQUELIZE = require('sequelize')
+      ...
+      $SEQUELIZE(...)
+      ...
+  - pattern-not-inside: |
+      import $SEQUELIZE from 'sequelize'
+      ...
+      $SEQUELIZE(...)
+      ...
   - pattern-not-inside: |
       $SANITIZE = require('mongo-sanitize')
       ...