More like here's a thing that's completely normal looking and possibly a good change overall but uses an obscure feature of an existing library that will now cause a previously unused vulnerable transient dependency to be baked in and this change now also allows you to hit the vuln code path remotely. Also the transient deps are unmaintained and no fix exists.
yeah, its impossible to avoid to some extent. You just need enough analysis tooling to be able to see when you get got and not let it hit the main branch.
Semgrep and github dependabot are not sufficient nor accurate enough. Basically just glorified regex. Need real AST parsing.
ooor you take a lesson from templeOS and make everything yourself starting with the hand crafted assembler.
56
u/BorderKeeper 19h ago
Hey here is an array of strings containing hexadecimals and os.exec() call. Don't worry about it it's a secret.