Html support by yhoztak · Pull Request #9 · Corgea/Sighthound

yhoztak · 2026-01-21T17:29:44Z

Adding html, sql, config, properties support for detecting simple vulnerabilities.

corgea-staging · 2026-01-21T17:30:38Z

🐕 Corgea found the following new SCA issues in the codebase:

Package	CVE	Severity	Version	Fixed Version	Ecosystem	Summary
tar	CVE-2005-2541	HIGH	1.34+dfsg-1.2+deb12u1	N/A	docker	N/A
glibc	CVE-2019-1010022	CRITICAL	2.36-9+deb12u13	N/A	docker	N/A
zlib	CVE-2023-45853	CRITICAL	1:1.2.13.dfsg-1	1:1.3.dfsg-2	docker	N/A
dpkg	CVE-2025-6297	HIGH	1.21.22	1.22.21	docker	N/A
perl	CVE-2023-31486	HIGH	5.36.0-7+deb12u3	5.38.2-2	docker	N/A
pam	CVE-2025-8941	HIGH	1.5.2-6+deb12u2	N/A	docker	N/A
binutils	CVE-2025-11082	HIGH	2.44-3	N/A	docker	N/A
openssl	CVE-2025-9230	HIGH	3.5.1-1	3.5.1-1+deb13u1	docker	openssl - security update
libgcrypt20	CVE-2018-6829	HIGH	1.10.1-3	N/A	docker	N/A
libtasn1-6	CVE-2025-13151	HIGH	4.19.0-2+deb12u1	4.21.0-2	docker	N/A

Showing 10 out of 122 findings. See full results

Copilot

Pull request overview

This PR adds support for detecting vulnerabilities in HTML, SQL, configuration, and properties files by introducing new language parsers and security rules.

Changes:

Added support for four new file types: HTML, SQL, properties, and config files
Implemented pattern-based security scanning for these file types
Updated taint analysis to gracefully handle languages without taint rules

Reviewed changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/scanner/utils.rs	Added file extension mappings for SQL, properties, and config file types
src/scanner/modes.rs	Modified taint analysis to return empty results instead of error when no taint rules exist
src/scanner/core.rs	Added HTML-specific security indicators for XSS detection
src/rules.rs	Added rule loading logic for HTML, SQL, properties, and config languages
src/language.rs	Implemented new language support structs for SQL, properties, config, and updated HTML parsing
rules/sql/sql_security.ron	Created SQL security rules for injection detection
rules/properties/properties_security.ron	Created properties file security rules for secret detection
rules/html/html_security.ron	Created HTML security rules for XSS and other vulnerabilities
rules/config/config_security.ron	Created config file security rules for secret and misconfiguration detection
Dockerfile	Removed cross-compilation tools and simplified build configuration
Cargo.toml	Bumped version to 0.1.2 and added new language features

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

abronte · 2026-01-21T21:55:43Z

Overall, LGTM but I don't think sighthound should be detecting anything hardcoded credentials related.

Resolves conflicts introduced when PR #22 (engine modernization + review fixes) merged into the shared base branch. Conflicts resolved (both sides were our own changes, combined rather than chosen): - utils.rs is_git_ignored: kept PR #22's build-once RepoGitignore matcher (#15) and applied PR #23's path normalization on top (normalize_for_ignore_check before lookup); dropped the now-unused old per-path walk + is_within_git_repo. - core.rs compute_variable_source: combined PR #23's strip_inline_comment with PR #22's split_once('=') RHS fix. - core.rs trace_local_assignment_taint: kept PR #23's method-name fallback resolution, retargeted onto PR #22's callee_name rename (#12) and resolved_function_name. - core.rs (semantic, not textual): PR #23 code referencing the pre-rename line_num / the pre-visited trace_local_assignment_taint signature updated to PR #22's file_line (#9/#14) and visited-set parameter (#11). Verified: cargo build + cargo test green (49 unit + 21 strictness + 7 integration + 5 e2e + 1 doc-test).

0xjgv · 2026-07-13T19:58:50Z

+            patterns: Some([
+                "<!DOCTYPE*<!ENTITY",
+                "<!DOCTYPE*SYSTEM",
+                "<!ENTITY*SYSTEM",
+            ]),


These patterns use * as an inline wildcard, but the matcher treats it as an anchored glob over the entire file text. <!DOCTYPE*SYSTEM therefore does not match normal XML files, and the same issue affects several new SQL and HTML rules. Use plain substrings or regex: patterns instead.

0xjgv · 2026-07-13T19:58:50Z

+            unless: Some([
+                "http://localhost",
+                "http://127.0.0.1",
+                "http://www.w3.org",
+                "http://schemas.",
+                "xmlns:*=\"http://",
+            ]),


UnifiedRule has no unless field, so serde drops these exclusions and nothing evaluates them. xml-insecure-001 will flag benign namespace URLs despite this block; the same applies to the new HTML and config exclusions. Add matcher support before relying on unless, or remove these clauses.

Co-authored-by: Cursor <cursoragent@cursor.com>

…usions, tuned rules, and production strictness tests.

juangaitanv · 2026-08-06T16:58:40Z

 mod django_security;
 mod false_positive_regressions;
 mod language_coverage;
+mod markup_config_languages;


strictness_tests cannot compile because markup_config_languages has no module. Could we add the intended test module or remove the declaration?

juangaitanv · 2026-08-06T16:58:40Z

+        "sql" | "ddl" | "dml" => Some("sql"),
+
+        "xml" | "xsd" | "xsl" | "xslt" | "wsdl" | "svg" | "pom" => Some("xml"),
+
+        "properties" | "props" => Some("properties"),
+
+        "conf" | "cfg" | "ini" | "env" | "config" | "json" | "yaml" | "yml" | "toml" => {
+            Some("config")


the routed extensions do not satisfy the loaded rules' file_types; could we align routing, rule packs, and file_types so they receive the advertised coverage?

juangaitanv · 2026-08-06T16:58:40Z

+                || !crate::rules::rule_matches_pattern_scoped(
+                    rule,
+                    &line.searchable,
+                    &line.searchable,
+                )


a matching unless value elsewhere on the line suppresses later positive matches; should we evaluate exclusions per match or local context?

juangaitanv · 2026-08-06T16:58:40Z

+                "href=\"javascript:",
+                "href='javascript:",
+                "href=javascript:",
+            ]),


these patterns miss case and whitespace variants and can match names like data-href; could we use boundary-aware, case-insensitive attribute matching?

juangaitanv · 2026-08-06T16:58:40Z

+                "\"debug\": true",
+                "'debug': true",
+                "debug: true",
+                "\"DEBUG\": true",
+                "DEBUG: true",
+            ]),


these patterns miss compact JSON and TOML = syntax; could we allow whitespace variation and both : and = separators?

juangaitanv · 2026-08-06T16:58:40Z

+            "config" => {
+                trimmed.starts_with('#') || trimmed.starts_with(';') || trimmed.starts_with("//")
+            }


inline YAML and TOML comments remain searchable and can produce findings; could we strip inline comments while preserving markers in quoted values?

yhoztak requested review from abronte and Copilot January 21, 2026 17:29

Copilot AI reviewed Jan 21, 2026

View reviewed changes

Comment thread src/language.rs Outdated

Comment thread src/language.rs Outdated

Comment thread src/language.rs Outdated

Comment thread src/rules.rs Outdated

abronte reviewed Jan 21, 2026

View reviewed changes

Comment thread rules/config/config_security.ron Outdated

juangaitanv requested a review from abronte July 10, 2026 07:36

yhoztak requested a review from juangaitanv July 13, 2026 17:49

0xjgv reviewed Jul 13, 2026

View reviewed changes

juangaitanv removed their request for review July 13, 2026 20:34

yhoztak and others added 8 commits July 24, 2026 19:25

HTML, SQL, properties, config support

8273c43

Adding new rules

300a8c1

build fix

00b990d

separate xml for more specific rule

a9a98b8

fix build

fb7a44d

Remove hardcoded credentials from rules

fb98078

update for SQL to ignore commented lines, and build fix

ef5ffe1

Co-authored-by: Cursor <cursoragent@cursor.com>

Addressed PR comments

4c8637b

yhoztak force-pushed the html_support branch from 143fdc8 to 4c8637b Compare July 26, 2026 22:33

yhoztak requested a review from juangaitanv July 26, 2026 22:33

Harden HTML and text scanning with parser-free semantics, scoped excl…

f73718d

…usions, tuned rules, and production strictness tests.

juangaitanv reviewed Aug 6, 2026

View reviewed changes

Uh oh!

Conversation

yhoztak commented Jan 21, 2026

Uh oh!

corgea-staging Bot commented Jan 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

abronte commented Jan 21, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants