Exclude hugo specific safe* keyword from squirrelly analysis

[heurtematte]

The squirrelly_template regex produces false positives on Hugo projects code-based.

The regex excludes keywords: safeURL/safeHTML/safeJS/ ... https://gohugo.io/functions/safe/

[ajinabraham]

Ain't safeHTML/safeJS also allow to pass unescaped variables to the template for Hugo?

[heurtematte]

This is a bit different in this context.

Hugo is a static site generator with no concept of dynamic user input.

While Squirrelly or any other templating framework allows the creation of forms.

[ajinabraham]

This is very much applicable to Hugo templates as well as suggested here: https://gohugo.io/about/security/#web-application-security

[heurtematte]

I can understand your point but as mentioned in the link: It may be worth adding that Hugo is a static site generator with no concept of dynamic user input.

So my question in this situation, do we trust the author of the code?

If yes, The PR is still relevant, or If you prefer maybe creating a dedicated rule for hugo with a different severity: e.g: warning
If no, clarify the message of this rule by not targeting a specific framework like squirrelly but as a general rule

WDYT?

[ajinabraham]

The intention of these rules is to catch accidental mistakes (Trust, but verify). It is a common to consider something as "safe" and end up passing untrusted user data which can be abused for code injection. In this specific case , it's alright to create a separate rule for Hugo with a WARNING severity while ignoring the same for Squirrelly templates.

[ajinabraham]

There is a problem with this regex, it will skip variable names with safeURL/.. in them.

https://regex101.com/r/a3QdmS/1

[heurtematte]

I have excluded all Hugo-related keywords from this rule and used those keywords in the specific Hugo rule. Otherwise I'll still have error on hugo SAFE keyword instead of the warning.

[ajinabraham]

I think you need to move the Hugo specific keywords after .*\| so that it ignores something like {{ foo | safeURL }} but still catch{{ safeURL | safe }} for this Squirrelly.js rule.

[heurtematte]

Good catch.

I propose a new way this regex could work.

WDYT of this: {{[\s\S]*?\|\s*\bsafe\b[\s\S]*?}}