search

DataDog / guarddog

:snake: :mag: GuardDog is a CLI tool to Identify malicious PyPI and npm packages
https://securitylabs.datadoghq.com/articles/guarddog-identify-malicious-pypi-packages/
Apache License 2.0
591 stars 43 forks source link

Document limitations of taint tracking #34

Open enelli opened 2 years ago

enelli commented 2 years ago

Deep Semgrep is needed to propagate values through function calls. An example of this is found in the exfiltrate-sensitive-data tests (ctx). It can also be seen here: https://semgrep.dev/s/enelli:exfiltrate-sensitive-data. The first case is not detected, but the second case that has only one function is caught.

christophetd commented 1 year ago

Renaming/labeling as this is not a bug but a documented limitation of the free version of Semgrep.