something as innocent as amount.brand by the defender enables the attacker to reenter at that moment
this made me wonder about tools to help review for such things... which reminded me of refactoring tools that would let us query for obj.prop. I don't suppose these tools know much about whether obj is attacker-controlled. I suppose that needs more flow-control-analysis a la #35 .
From recent discussion:
this made me wonder about tools to help review for such things... which reminded me of refactoring tools that would let us query for
obj.prop. I don't suppose these tools know much about whetherobjis attacker-controlled. I suppose that needs more flow-control-analysis a la #35 .tab dump: fast codemod refactor - Google Search: https://www.google.com/search?q=fast+codemod+refactor&ei=AIBSYdnjI-2E9PwPoKKCyAM&oq=fast+codemod+refactor&gs_lcp=Cgdnd3Mtd2l6EAMyBQghEKABOgUIABCRAjoRCC4QgAQQsQMQgwEQxwEQ0QM6BQgAEIAEOggIABCABBCxAzoLCAAQgAQQsQMQgwE6DgguEIAEELEDEMcBEKMCOgsILhCABBDHARCjAjoECAAQQzoICAAQgAQQyQM6BQgAEJIDOgUILhCABDoICC4QgAQQsQM6CwgAEIAEELEDEMkDOgcIABCABBAKOgYIABAWEB46BQghEKsCOgcIIRAKEKABSgQIQRgAUNzWAlit7gJgsPACaABwAngAgAGPAYgBkhCSAQQxNS42mAEAoAEBwAEB&sclient=gws-wiz&ved=0ahUKEwjZ46PN0aDzAhVtAp0JHSCRADkQ4dUDCA8&uact=5 Refactoring With Codemods and jscodeshift | Toptal: https://www.toptal.com/javascript/write-code-to-rewrite-your-code facebookincubator/fastmod: A fast partial replacement for the codemod tool: https://github.com/facebookincubator/fastmod rajasegar/awesome-codemods: Awesome list of codemods for various languages, libraries and frameworks: https://github.com/rajasegar/awesome-codemods James Doyle | Fastmod Codemod For Refactoring: https://ohdoylerules.com/tricks/fastmod-codemod-for-refactoring/ facebook/jscodeshift: A JavaScript codemod toolkit.: https://github.com/facebook/jscodeshift benjamn/recast: JavaScript syntax tree transformer, nondestructive pretty-printer, and automatic source map generator: https://github.com/benjamn/recast