chore(deps): update dependency sobelow to ~> 0.15.0 #4
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/sobelow-0.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
~> 0.14.0→~> 0.15.0Release Notes
sobelow/sobelow (sobelow)
v0.15.0Compare Source
Config.Secretsno longer crashes the scan when a secret is written asanything other than a plain double-quoted string. Heredoc values and values
containing escaped quotes previously raised a
MatchErrorand aborted theentire run. These secrets are now reported, using the line of the enclosing
configcall.Sobelow previously printed "This does not appear to be a Phoenix application"
and exited 0 — a CI gate could pass having scanned nothing.
--strictnow reports syntax errors instead of raising. It has been brokensince Elixir 1.13 changed the error shape returned by
Code.string_to_quoted/2. Errors are now reported asfile:line:column:.--strict) rather than aborting the scan with anEEx.SyntaxError. Theerror now names the offending template instead of
nofile..sobelow-confnow produces an actionable message instead of araw
MatchErrorstacktrace. This mattered more since v0.14.1 began readingthe file automatically.
.sobelow-confis now read asno options rather than aborting the scan. Such a file parses to an empty
block instead of a keyword list, so it originally crashed with a
FunctionClauseErrorand then, once that was fixed, exited 1 with aconfiguration error. Since the file is read automatically, a stray
touch .sobelow-confor a truncated write was enough to break every scanin a project. Contents that cannot be interpreted are still an error.
--save-confignow storesignore_filesrelative to the project root.Absolute paths were previously baked into
.sobelow-conf, breaking thecommitted file on every other machine and in CI.
Config.Secretsnow reports the line of the secret itself when aconfigcall spans multiple lines. The line search compared a tuple against an
integer, so it never worked as intended.
~/.sobelowno longer fails a scan.conn.${atom_to_string(field)}..sobelow-confkeys are now genuinely sorted alphabetically..sobelow-confcan no longer stop Sobelow from scanning.--save-configwrote
versioninto every file it generated, somix sobelow --version --save-configproduced a committed file that madeevery later run print the version and exit 0 — a CI gate reading that
as a clean scan.
version,details,all-details,save-config, anddiffchoose what Sobelow does rather than configure a scan, and are nowaccepted on the command line only. One in the file is ignored, with a
warning when it would have changed anything.
versionis no longerwritten to the file in the first place.
# sobelow_skipcomments are no longer thrown away over whitespace. Thepattern demanded exactly one space after the
#and exactly one beforethe list, so
# sobelow_skip["XSS.Raw"],# sobelow_skip ["XSS.Raw"],and
# sobelow_skip [ "XSS.Raw" ]were all ignored — silently, andindistinguishably from a skip that had simply not applied. Spacing around
the marker, inside the list, and around commas is now irrelevant.
SQL.Queryno longer reports a project's ownquery/1as SQL injection.An unqualified
query/query!call was matched regardless of what itreferred to, so every call to a local function that happened to carry one
of those very ordinary names produced a finding. The unqualified form is
now only considered in a file that has
import Ecto.Adapters.SQLoruse Ecto.Repo— the two ways the bare name can actually reach Ecto.Qualified calls, such as
Repo.query/1andEcto.Adapters.SQL.query/3,are unaffected.
--no-router, for scanning a project that has no Phoenix router.Sobelow warned that it could not find one and offered no way to silence it,
which was noise for plain Elixir libraries. It is shorthand for
--router :none, which can also be set in.sobelow-confasrouter: :none. The router-dependent checks are skipped either way..sobelow-skipsis now written in sorted order, so regenerating it afterfixing or adding a finding produces a small diff instead of reshuffling the
file. Entries sort by type, file, and line number — numerically, so line 10
follows line 9 rather than line 1. The whole file is sorted, not just the
newly added entries, so the ordering holds however many times it is
regenerated. Comments and pre-v0.14 bare-fingerprint lines are preserved.
Pass
--legacy-skipsfor the previous append-only behaviour, which neverrewrites lines it did not add.
# sobelow_skipcomments now work on Phoenix router pipelines, not justfunctions. This makes
Config.CSRF,Config.Headers, andConfig.CSPsuppressible per pipeline instead of only via
--mark-skip-all, so an APIpipeline that legitimately has no
:protect_from_forgerycan be annotatedin place. Listing the parent
Configmodule skips every Config check onthat pipeline. As with function-level skips, this only takes effect under
--skip.# sobelow_skipcomment that cannot be read now warns on stderr, namingthe file and line, instead of being dropped without a word. Single quotes
and a list broken across several comment lines are still not accepted, but
they now say so rather than leaving you to wonder why the finding came
back.
--privatenow skips the version check entirely rather than still writingthe cache file. It makes no network requests and touches no files outside
the scanned project.
SOBELOW_HOMEis now documented, and is treated as the directory holdingthe version-check cache.
usage-rules.md, following theusage_rulesconvention, so projectsusing AI coding assistants can pull Sobelow's guidance into their agent's
context with
mix usage_rules.sync. It is shipped in the Hex package.AGENTS.mddocumenting the checker-module contract for contributors.Sobelow.ScanCase) that runs full scansagainst fixture applications under
test/fixtures/apps, plus regressioncoverage for every bug above. Line coverage went from 29% to 67%.
.sobelow-confprecedence,--exitand
--thresholdmapping, and thejson/sarif/quiet/txtrenderers.# sobelow_skipcomments, andunit coverage for how skips associate with pipelines in the AST.
Sobelow.ScanCase.temp_fixture_file/3now restores a committed fixture'soriginal contents instead of deleting the file, so a test can vary a
checked-in fixture without destroying it.
:preferred_cli_envproject key withdef cli.credoto~> 1.7.19; 1.7.12 crashed on Elixir 1.20.in the SARIF renderer.
Upgrade notes
Config.Secretsline numbers may change forconfigcalls that spanmultiple lines, and for files where the same secret value appears more than
once. Finding fingerprints include the line number, so any affected
.sobelow-skipsentries will stop matching and those findings will resurface.Re-run
mix sobelow --mark-skip-allif you rely on a committed skip file.escaped-quote secret exists in your config, you will see new findings where the
scan previously failed outright.
SOBELOW_HOMEsemantics changed from "path to the cache file" to "directoryholding the cache file". The previous behaviour raised a
MatchErrorfor thenatural usage, so this is unlikely to affect anyone.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.
⚠️ Artifact update problem
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below:
File name: mix.lock