False positives for literal assignments

[dpnishant]

Hi, Not sure if this is a known issue, in the screenshot below the literal assignments in eval or innerHTML (line no. 9 and line no. 10 respectively) should not be flagged, as these are not dynamic inputs, let alone user controlled.

Please close the ticket and provide the ticket number where this has been discussed earlier.

Thanks Nishant

[pauljt]

Hey Nishant - yeh as I said, its basically just grep at the moment ;) In first iteration was doing something slightly smarter (flagging if an only if right hand side contains identifiers) but this needs to be implemented again.

The initial focus for scanjs though was to be a code review aid, not to be an automated scanner (though I would like to get there eventually) I would very much welcome any contributions in this direction! :)

[pauljt]

Fixed. You can now specify rules like foo.innerHTML= $_unsafe and this will only return true if their is at least on identifier on the right hand side.

To be honest it feels like a bit of a dirty hack, since $_unsafe only works for assignment expressions. But I am open to suggestions.