Update nosql_find_injection.yaml to exclude sequelize's .findOne() fa…

…lse positives
ajinabraham · Mar 21, 2024 · 1321e11 · 1321e11
1 parent 40ff09e
commit 1321e11
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/njsscan/rules/semantic_grep/database/nosql_find_injection.yaml b/njsscan/rules/semantic_grep/database/nosql_find_injection.yaml
@@ -1,6 +1,16 @@
 rules:
 - id: node_nosqli_injection
   patterns:
+  - pattern-not-inside: |
+      $SEQUELIZE = require('sequelize')
+      ...
+      $SEQUELIZE(...)
+      ...
+  - pattern-not-inside: |
+      import $SEQUELIZE from 'sequelize'
+      ...
+      $SEQUELIZE(...)
+      ...
   - pattern-not-inside: |
       $SANITIZE = require('mongo-sanitize')
       ...