chore(deps): update dependency sobelow to ~> 0.16.0 #7
Loading…
Reference in a new issue
No description provided.
Delete branch "renovate/sobelow-0.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
~> 0.15.0→~> 0.16.0Release Notes
sobelow/sobelow (sobelow)
v0.16.0Compare Source
XSS.Rawno longer reports calls to a benign localrawhelper with the matchingarity, including defaults, guards, pipes, captures, and inline HEEx. Local
definitions stay within their module; qualified Phoenix calls and
implicitly imported template helpers retain detection. Helpers returning
dynamic
{:safe, value}output or wrapping anotherrawcall retaintheir caller's original findings, locations, and fingerprints. (#44)
XSS.SendRespnow recognizesput_resp_header(conn, "content-type", type)on the response connection, including piped, aliased, nested, and assigned
calls. HTML, SVG, malformed, and unknown types still report; other XML
and PDF document types retain low-confidence findings. Discarded, later,
unrelated, locally shadowed, or ambiguously imported setters cannot
suppress findings. Known unrelated response headers retain the connection's
content type, and MIME parameters do not change its classification. (#45)
XSS.Rawnow respects explicit imports of unrelatedrawhelpers. Unknownraw macros and delegates retain detection. Older inline lexical contexts
without local-signature metadata remain supported.
options, and unwritable output files now fail with actionable errors.
skip state. Malformed sources and templates are skipped with a warning in
non-strict mode, and unreadable files are skipped with a warning.
on a literal keyword list no longer abort scans. Unknown socket options
produce low-confidence findings.
XSS.SendRespnow follows the connection passed to each response and itscontent type before that sink. Later or discarded setters cannot suppress
an earlier finding, and rebindings in branches, patterns, callbacks,
generators, and call arguments cannot borrow another connection's content
type. Unchanged bindings, pins, guards, and explicit setters retain their
existing handling.
and each endpoint, including ordered overrides and nested keyword merges.
One endpoint cannot satisfy another's settings. Dynamic and conditional
settings produce low-confidence findings. Empty CSP policies are reported.
and runtime configuration, including
socket/2andwebsocket: true.Explicit socket overrides retain precedence, and
disabled WebSockets remain excluded. Defaults are isolated to each endpoint
module. Origin allowlists and
:connare recognized; an enabled CSRF checklowers confidence when origin checks are disabled.
scope or introduce findings from literal markup. The
phx-no-curly-interpolationdirective is recognized as an attribute name;the same text inside another attribute's value cannot suppress findings.
Inline columns account for sigil prefixes and heredoc indentation.
useandimportdeclarations now apply only to their ownmodule. Named captures and inline HEEx retain lexical aliases and import
selections, including renamed aliases and imported arity restrictions.
the checked dependency, preventing false advisories for package aliases.
Missing or nonliteral versions no longer abort scans.
--root. SARIF locationsare relative to the scan root, or use file URIs for external files. Reserved
filename characters, including
#,?,%, and:, are percent-encoded.JSON filenames and skip fingerprints are unchanged.
Vuln.CookieRCErule name now matches its existing result type andrule ID. Unknown finding types receive a null rule ID instead of raising.
Config.CSRFRouteis now listed inmix help sobelow.trusted CA store is available, and tolerate malformed responses, cache,
filesystem, and network failures. OTP 24 skips the notification because
it has no built-in CA-store API.
githuboutput format for GitHub Actions workflow annotations,with confidence levels and repository-relative finding locations.
~Hsigils,including body and attribute expressions, legacy EEx, qualified and piped
Phoenix.HTML.rawcalls, nested sigils, and Elixir comments. Controllerrenders are correlated with embedded
*_htmltemplates. Braceinterpolation is disabled in script/style bodies and regions marked with
phx-no-curly-interpolation. Invalid expressions warn and are skipped, orexit 2 under
--strict.inheritance, function-local imports, and
only/exceptarity selections.Confidence grading follows direct local aliases before a sink. Calls
retain their original ASTs, and implicit Phoenix controller imports retain
their historical detection.
Vuln.*dependency advisories can now read literalHex versions from
mix.lockwhendeps/is unavailable, without evaluatingproject code.
--include-mix-tasksand--include-scriptsto opt into additionalsource paths, and
--summaryto print file counts on stderr. SARIF nowincludes invocation warnings and uses the published OASIS schema URL.
.sobelow-confsaves and sorted skip rewrites are now atomic, preserve Unixpermissions, and follow symlinks. Unreadable existing skip files are
preserved and produce an actionable error.
--legacy-skipsretains theexisting append behavior.
confidence analysis; incremental HEEx delimiter parsing; combined
file/module metadata extraction; bounded, ordered file preparation; and
smaller lexical contexts with compatible lookup paths on older OTP.
once per batch. Quiet output and exit status use confidence counts, and
repeated reports reuse sorted results. Scan settings, enabled checks,
paths, skip lookups, and relevant template snapshots are reused, with
per-worker cache counters to avoid contention. Source, AST, lockfile, and
dependency-version caches are released when the scan finishes or fails.
Existing public finding-log results and output formats are preserved.
boundaries, configuration uncertainty, atomic writes, source edge cases,
and scan/lexical context restoration. Added failing regressions and safe
controls for Copilot and adversarial review findings.
and both historical skip formats. Exact fingerprint assertions run on the
captured parser family; output/rule contracts and generated skip round
trips run across the supported matrix. Independent release column captures
qualify older parsers, and highlighting follows each runtime's printer.
arity pairs on
SobelowandSobelow.Parse, including traversal callbacksand default arities.
complete finding and output comparisons, reduction counts, and separate
sampled VM memory. Methodology, measurements, and limits are documented in
bench/README.md; the benchmark entry point isbench/scan.exs.runtime. Coverage excludes only the test harness, documentation-only legacy
module, and developer diff helper. Fixtures are ignored by test discovery.
prevent order-dependent failures on older Elixir versions. Version-check
cache, response, and TLS-option tests make no network requests.
combination, including exit codes; strict Credo runs on every entry.
into focused internal modules. Shared AST helpers now live in source,
metadata, calls, variables, and template modules, with the existing
SobelowandSobelow.Parseentry points preserved.handling, and shortened stale comments. Updated contributor and usage
guidance to document the new module boundaries and scan options.
Upgrade notes
inline templates, lexical resolution, response rebindings, and configuration
fixes can reveal previously missed sinks. Corrected lockfile package matching
can remove false dependency advisories.
project roots, scan options, and output permissions if an invocation previously
exited successfully without scanning or writing its report.
ASTs, existing finding locations, and current/legacy fingerprint calculations
are preserved. SARIF artifact paths are corrected as described above. The
minimum supported Elixir version remains
~> 1.12.v0.15.0Compare Source
Config.Secretsno longer crashes the scan when a secret is written asanything other than a plain double-quoted string. Heredoc values and values
containing escaped quotes previously raised a
MatchErrorand aborted theentire run. These secrets are now reported, using the line of the enclosing
configcall.Sobelow previously printed "This does not appear to be a Phoenix application"
and exited 0 — a CI gate could pass having scanned nothing.
--strictnow reports syntax errors instead of raising. It has been brokensince Elixir 1.13 changed the error shape returned by
Code.string_to_quoted/2. Errors are now reported asfile:line:column:.--strict) rather than aborting the scan with anEEx.SyntaxError. Theerror now names the offending template instead of
nofile..sobelow-confnow produces an actionable message instead of araw
MatchErrorstacktrace. This mattered more since v0.14.1 began readingthe file automatically.
.sobelow-confis now read asno options rather than aborting the scan. Such a file parses to an empty
block instead of a keyword list, so it originally crashed with a
FunctionClauseErrorand then, once that was fixed, exited 1 with aconfiguration error. Since the file is read automatically, a stray
touch .sobelow-confor a truncated write was enough to break every scanin a project. Contents that cannot be interpreted are still an error.
--save-confignow storesignore_filesrelative to the project root.Absolute paths were previously baked into
.sobelow-conf, breaking thecommitted file on every other machine and in CI.
Config.Secretsnow reports the line of the secret itself when aconfigcall spans multiple lines. The line search compared a tuple against an
integer, so it never worked as intended.
~/.sobelowno longer fails a scan.conn.${atom_to_string(field)}..sobelow-confkeys are now genuinely sorted alphabetically..sobelow-confcan no longer stop Sobelow from scanning.--save-configwrote
versioninto every file it generated, somix sobelow --version --save-configproduced a committed file that madeevery later run print the version and exit 0 — a CI gate reading that
as a clean scan.
version,details,all-details,save-config, anddiffchoose what Sobelow does rather than configure a scan, and are nowaccepted on the command line only. One in the file is ignored, with a
warning when it would have changed anything.
versionis no longerwritten to the file in the first place.
# sobelow_skipcomments are no longer thrown away over whitespace. Thepattern demanded exactly one space after the
#and exactly one beforethe list, so
# sobelow_skip["XSS.Raw"],# sobelow_skip ["XSS.Raw"],and
# sobelow_skip [ "XSS.Raw" ]were all ignored — silently, andindistinguishably from a skip that had simply not applied. Spacing around
the marker, inside the list, and around commas is now irrelevant.
SQL.Queryno longer reports a project's ownquery/1as SQL injection.An unqualified
query/query!call was matched regardless of what itreferred to, so every call to a local function that happened to carry one
of those very ordinary names produced a finding. The unqualified form is
now only considered in a file that has
import Ecto.Adapters.SQLoruse Ecto.Repo— the two ways the bare name can actually reach Ecto.Qualified calls, such as
Repo.query/1andEcto.Adapters.SQL.query/3,are unaffected.
--no-router, for scanning a project that has no Phoenix router.Sobelow warned that it could not find one and offered no way to silence it,
which was noise for plain Elixir libraries. It is shorthand for
--router :none, which can also be set in.sobelow-confasrouter: :none. The router-dependent checks are skipped either way..sobelow-skipsis now written in sorted order, so regenerating it afterfixing or adding a finding produces a small diff instead of reshuffling the
file. Entries sort by type, file, and line number — numerically, so line 10
follows line 9 rather than line 1. The whole file is sorted, not just the
newly added entries, so the ordering holds however many times it is
regenerated. Comments and pre-v0.14 bare-fingerprint lines are preserved.
Pass
--legacy-skipsfor the previous append-only behaviour, which neverrewrites lines it did not add.
# sobelow_skipcomments now work on Phoenix router pipelines, not justfunctions. This makes
Config.CSRF,Config.Headers, andConfig.CSPsuppressible per pipeline instead of only via
--mark-skip-all, so an APIpipeline that legitimately has no
:protect_from_forgerycan be annotatedin place. Listing the parent
Configmodule skips every Config check onthat pipeline. As with function-level skips, this only takes effect under
--skip.# sobelow_skipcomment that cannot be read now warns on stderr, namingthe file and line, instead of being dropped without a word. Single quotes
and a list broken across several comment lines are still not accepted, but
they now say so rather than leaving you to wonder why the finding came
back.
--privatenow skips the version check entirely rather than still writingthe cache file. It makes no network requests and touches no files outside
the scanned project.
SOBELOW_HOMEis now documented, and is treated as the directory holdingthe version-check cache.
usage-rules.md, following theusage_rulesconvention, so projectsusing AI coding assistants can pull Sobelow's guidance into their agent's
context with
mix usage_rules.sync. It is shipped in the Hex package.AGENTS.mddocumenting the checker-module contract for contributors.Sobelow.ScanCase) that runs full scansagainst fixture applications under
test/fixtures/apps, plus regressioncoverage for every bug above. Line coverage went from 29% to 67%.
.sobelow-confprecedence,--exitand
--thresholdmapping, and thejson/sarif/quiet/txtrenderers.# sobelow_skipcomments, andunit coverage for how skips associate with pipelines in the AST.
Sobelow.ScanCase.temp_fixture_file/3now restores a committed fixture'soriginal contents instead of deleting the file, so a test can vary a
checked-in fixture without destroying it.
:preferred_cli_envproject key withdef cli.credoto~> 1.7.19; 1.7.12 crashed on Elixir 1.20.in the SARIF renderer.
Upgrade notes
Config.Secretsline numbers may change forconfigcalls that spanmultiple lines, and for files where the same secret value appears more than
once. Finding fingerprints include the line number, so any affected
.sobelow-skipsentries will stop matching and those findings will resurface.Re-run
mix sobelow --mark-skip-allif you rely on a committed skip file.escaped-quote secret exists in your config, you will see new findings where the
scan previously failed outright.
SOBELOW_HOMEsemantics changed from "path to the cache file" to "directoryholding the cache file". The previous behaviour raised a
MatchErrorfor thenatural usage, so this is unlikely to affect anyone.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.
⚠️ Artifact update problem
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below:
File name: mix.lock