[testing][false negative] - mozApps.mgmt rule

[pwnetrationguru]

mozApps.mgmt rule misses the following dangerous cases:

     var stuffs = navigator.mozApps.mgmt;

     var stuffs = navigator.mozApps.mgmt.getAll()

[pauljt]

We need to add support for rules of the form: foo.bar

There is actually no template for this currently.

On 20 Mar 2014, at 5:00 am, Rob Fletcher notifications@github.com wrote:

mozApps.mgmt rule misses the following dangerous cases:

 var stuffs = navigator.mozApps.mgmt;
 var stuffs = navigator.mozApps.mgmt.getAll()

— Reply to this email directly or view it on GitHub.

[pauljt]

foo.bar rules are now supported in the new scanner. e.g

{ "name": "foo.bar", "type": "objmember", "parameters": "{'object_name':'foo','property_name':'bar'}", "testhit": "foo.bar", "testmiss": "foo.baz;baz.bar;", "desc": "A member expression with object of 'foo' and member named 'bar'", "threat": "example", "subthreat": "example" },