GitHub e phatlalalitse tlatsetso ea mokhoa oa ho ithuta oa mochini oa liteko ts'ebeletso ea eona ea ho hlahloba Khoutu ho tseba mefuta e tloaelehileng ea bofokoli ka khoutu. Boemong ba tlhahlobo, ts'ebetso e ncha hajoale e fumaneha feela bakeng sa polokelo e nang le khoutu ho JavaScript le TypeScript. Hoa hlokomeloa hore tšebeliso ea mochine oa ho ithuta mochine o entse hore ho khonehe ho atolosa haholo mefuta e mengata ea mathata a khetholloang, ha ho hlahlojoa hore na tsamaiso ha e sa lekanyetsoa ho hlahloba li-templates tse tloaelehileng 'me ha e tlameletsoe ho mekhoa e tsebahalang. Har'a mathata a khetholloang ke tsamaiso e ncha, ho boleloa liphoso tse lebisang ho cross-site scripting (XSS), ho khopama ha litsela tsa lifaele (mohlala, ka pontšo ea "/.."), ho nkeloa sebaka ke SQL le lipotso tsa NoSQL.
Ts'ebeletso ea scanning ea Khoutu e u lumella ho bona bofokoli qalong ea nts'etsopele ka ho lekola ts'ebetso e 'ngoe le e' ngoe ea "git push" bakeng sa mathata a ka bang teng. Sephetho se khomaretsoe ka ho toba ho kopo ea ho hula. Pejana, cheke e ne e etsoa ho sebelisoa enjene ea CodeQL, e hlahlobang litempele ka mehlala e tloaelehileng ea khoutu e tlokotsing (CodeQL e u lumella ho etsa template ea khoutu e tlokotsing ho tseba boteng ba ts'oaetso e ts'oanang ho khoutu ea merero e meng). Enjene e ncha, e sebelisang ho ithuta ka mochini, e ka tsebahatsa bofokoli bo neng bo sa tsejoe pele hobane ha e amane le litempele tsa khoutu tse hlalosang bofokoli bo itseng. Litsenyehelo tsa tšobotsi ena ke ho eketseha ha palo ea batho ba fosahetseng ho bapisoa le licheke tse thehiloeng ho CodeQL.
Source: opennet.ru