search

visma-prodsec / confused

Tool to check for dependency confusion vulnerabilities in multiple package management systems
MIT License
701 stars 93 forks source link

Add guessLang() with the new 'auto' lang #2

Closed jpedro closed 3 years ago

joohoi commented 3 years ago

Thanks for the PR, I think however that less "magic" there is to it, the better. This can also prove somewhat problematic if there's an expection of auto detection, while for example pip requirements.txt can in reality be called with whatever name the developer wishes.

At the current state, I'd rather leave it off, unfortunately.

nmbro commented 3 years ago

also - web projects might use multiple package managers already; I'm also in favor of less magic.

jpedro commented 3 years ago

I agree with the less magic the better and was thinking the same about multiple languages in the same repo (like client npm packages and any backend tech).