rubysec / ruby-advisory-db

A database of vulnerable Ruby Gems
https://rubysec.com
Other
1.02k stars 219 forks source link

Add Rspec check to avoid embedded formatting, such as '\n"s #788

Closed jasnow closed 4 months ago

jasnow commented 4 months ago

Add Rspec check to avoid embedded formatting, such as '\n"s.

This issue will be used to track all the work associated with embedded formatting checking.

postmodern commented 4 months ago

Good idea, those double escaped/formatted descriptions are annoying. We might want to consider also flagging embedded images (![image](url)) and/or ### PoC sections. I keep seeing GitHub Advisories that read more like a Hacker1 report, where the author includes step-by-step screenshots for how they discovered/triggered an XSS vulnerability, which imho is overly verbose for ruby-advisory-db or bundler-audit.