diff --git a/.perlcriticrc b/.perlcriticrc
index 722782a..61ab588 100644
--- a/.perlcriticrc
+++ b/.perlcriticrc
@@ -1,4 +1,4 @@
-severity = 4
+severity = 3
[-TestingAndDebugging::RequireUseStrict]
[-TestingAndDebugging::RequireUseWarnings]
\ No newline at end of file
diff --git a/README.md b/README.md
index b021325..aa91d53 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@
-
+
@@ -57,21 +57,22 @@ rules:
- id: '0001'
category: info
name: Debug module enabled
- message:
+ message: Debug modules can expose sensitive information and potentially create security vulnerabilities.
sample:
- Dumper
- id: '0002'
category: vuln
name: Code Injection
- message:
+ message: Occur when untrusted data is executed as code, allowing attackers to run arbitrary commands on the server.
sample:
- system
- eval
- exec
+ - qx
- id: '0003'
category: vuln
name: Path Traversal
- message:
+ message: Occur when user input is not properly sanitized, allowing attackers to access files and directories outside of the intended directory structure.
sample:
- open
```
@@ -89,7 +90,7 @@ on:
pull_request:
branches: [ "main" ]
schedule:
- - cron: '28 23 * * 1'
+ - cron: "28 23 * * 1"
jobs:
zarn:
@@ -114,7 +115,6 @@ jobs:
Your contributions and suggestions are heartily ♥ welcome. [See here the contribution guidelines.](/.github/CONTRIBUTING.md) Please, report bugs via [issues page](https://github.com/htrgouvea/zarn/issues) and for security issues, see here the [security policy.](/SECURITY.md) (✿ ◕‿◕) This project follows this [style guide: (https://github.com/htrgouvea/perl-style-guide)](https://github.com/htrgouvea/perl-style-guide).
-
---
### License
diff --git a/lib/Zarn/AST.pm b/lib/Zarn/AST.pm
index 573b35e..0de6c99 100644
--- a/lib/Zarn/AST.pm
+++ b/lib/Zarn/AST.pm
@@ -5,7 +5,7 @@ package Zarn::AST {
use PPI::Find;
use PPI::Document;
- our $VERSION = '0.01';
+ our $VERSION = '0.0.1';
sub new {
my ($self, $parameters) = @_;
@@ -45,7 +45,7 @@ package Zarn::AST {
$var_token -> parent -> isa("PPI::Token::Operator") ||
$var_token -> parent -> isa("PPI::Statement::Expression")
)) {
- my ($line, $rowchar) = @{$var_token -> location};
+ my ($line, $rowchar) = @{$token -> location};
push @results, {
category => $category,
diff --git a/lib/Zarn/Files.pm b/lib/Zarn/Files.pm
index 14e90f6..1c018c2 100644
--- a/lib/Zarn/Files.pm
+++ b/lib/Zarn/Files.pm
@@ -3,7 +3,7 @@ package Zarn::Files {
use warnings;
use File::Find::Rule;
- our $VERSION = '0.01';
+ our $VERSION = '0.0.1';
sub new {
my ($self, $source, $ignore) = @_;
diff --git a/lib/Zarn/Rules.pm b/lib/Zarn/Rules.pm
index d4afe25..04511d8 100644
--- a/lib/Zarn/Rules.pm
+++ b/lib/Zarn/Rules.pm
@@ -3,7 +3,7 @@ package Zarn::Rules {
use warnings;
use YAML::Tiny;
- our $VERSION = '0.01';
+ our $VERSION = '0.0.1';
sub new {
my ($self, $rules) = @_;
diff --git a/lib/Zarn/Sarif.pm b/lib/Zarn/Sarif.pm
index f529931..4b02ab2 100644
--- a/lib/Zarn/Sarif.pm
+++ b/lib/Zarn/Sarif.pm
@@ -2,7 +2,7 @@ package Zarn::Sarif {
use strict;
use warnings;
- our $VERSION = '0.01';
+ our $VERSION = '0.0.1';
sub new {
my ($self, @vulnerabilities) = @_;
diff --git a/zarn.pl b/zarn.pl
index 82cab74..9a97155 100755
--- a/zarn.pl
+++ b/zarn.pl
@@ -3,6 +3,7 @@
use 5.030;
use strict;
use warnings;
+use Carp;
use lib "./lib/";
use Getopt::Long;
use Zarn::AST;
@@ -25,18 +26,16 @@ sub main {
);
if (!$source) {
- print "
- \rZarn v0.0.9
- \rCore Commands
- \r==============
- \r\tCommand Description
- \r\t------- -----------
- \r\t-s, --source Configure a source directory to do static analysis
- \r\t-r, --rules Define YAML file with rules
- \r\t-i, --ignore Define a file or directory to ignore
- \r\t-srf, --sarif Define the SARIF output file
- \r\t-h, --help To see help menu of a module\n
- \r";
+ print "\nZarn v0.0.9"
+ . "\nCore Commands"
+ . "\n==============\n"
+ . "\tCommand Description\n"
+ . "\t------- -----------\n"
+ . "\t-s, --source Configure a source directory to do static analysis\n"
+ . "\t-r, --rules Define YAML file with rules\n"
+ . "\t-i, --ignore Define a file or directory to ignore\n"
+ . "\t-srf, --sarif Define the SARIF output file\n"
+ . "\t-h, --help To see help menu of a module\n\n";
exit 1;
}
@@ -68,7 +67,7 @@ sub main {
if ($sarif) {
my $sarif_data = Zarn::Sarif -> new (@results);
- open(my $output, '>', $sarif) or die "Cannot open file '$sarif': $!";
+ open(my $output, '>', $sarif) or croak "Cannot open file '$sarif': $!";
print $output encode_json($sarif_data);