mirror of
https://github.com/TecharoHQ/anubis.git
synced 2025-08-03 09:48:08 -04:00
d40e9056bc
* fix(lib): block XSS attacks via nonstandard URLs This could allow an attacker to craft an Anubis pass-challenge URL that forces a redirect to nonstandard URLs, such as the `javascript:` scheme which executes arbitrary JavaScript code in a browser context when the user clicks the "Try again" button. Release-status: cut Signed-off-by: Xe Iaso <me@xeiaso.net> * chore: spelling Signed-off-by: Xe Iaso <me@xeiaso.net> --------- Signed-off-by: Xe Iaso <me@xeiaso.net>
138 lines
3.9 KiB
Plaintext
138 lines
3.9 KiB
Plaintext
# See https://github.com/check-spelling/check-spelling/wiki/Configuration-Examples:-patterns
|
|
|
|
# Automatically suggested patterns
|
|
|
|
# hit-count: 198 file-count: 52
|
|
# https/http/file urls
|
|
(?:\b(?:https?|ftp|file)://)[-A-Za-z0-9+&@#/*%?=~_|!:,.;]+[-A-Za-z0-9+&@#/*%=~_|]
|
|
|
|
# hit-count: 22 file-count: 8
|
|
# GitHub actions
|
|
\buses:\s+[-\w.]+/[-\w./]+@[-\w.]+
|
|
|
|
# hit-count: 19 file-count: 5
|
|
# libraries
|
|
(?:\b|_)[Ll]ib(?:re(?=office)|era(?![lt])|)(?!ero|erty|rar(?:i(?:an|es)|y))(?=[a-z])
|
|
|
|
# hit-count: 17 file-count: 8
|
|
# version suffix <word>v#
|
|
(?:(?<=[A-Z]{2})V|(?<=[a-z]{2}|[A-Z]{2})v)\d+(?:\b|(?=[a-zA-Z_]))
|
|
|
|
# hit-count: 15 file-count: 7
|
|
# container images
|
|
image: [-\w./:@]+
|
|
|
|
# hit-count: 14 file-count: 9
|
|
# imports
|
|
^import\s+(?:(?:static|type)\s+|)(?:[\w.]|\{\s*\w*?(?:,\s*(?:\w*|\*))+\s*\})+
|
|
|
|
# hit-count: 11 file-count: 2
|
|
# hex digits including css/html color classes:
|
|
(?:[\\0][xX]|\\u|[uU]\+|#x?|%23|&H)[0-9_a-fA-FgGrR]*?[a-fA-FgGrR]{2,}[0-9_a-fA-FgGrR]*(?:[uUlL]{0,3}|[iu]\d+)\b
|
|
|
|
# hit-count: 8 file-count: 5
|
|
# node packages
|
|
(["'])@[^/'" ]+/[^/'" ]+\g{-1}
|
|
|
|
# hit-count: 5 file-count: 2
|
|
# css fonts
|
|
\bfont(?:-family|):[^;}]+
|
|
|
|
# hit-count: 4 file-count: 4
|
|
# set arguments
|
|
\b(?:bash|sh|set)(?:\s+[-+][abefimouxE]{1,2})*\s+[-+][abefimouxE]{3,}(?:\s+[-+][abefimouxE]+)*
|
|
|
|
# hit-count: 4 file-count: 2
|
|
# css url wrappings
|
|
\burl\([^)]+\)
|
|
|
|
# hit-count: 2 file-count: 2
|
|
# C network byte conversions
|
|
(?:\d|\bh)to(?!ken)(?=[a-z])|to(?=[adhiklpun]\()
|
|
|
|
# hit-count: 2 file-count: 1
|
|
# GitHub SHA refs
|
|
\[([0-9a-f]+)\]\(https://(?:www\.|)github.com/[-\w]+/[-\w]+/commit/\g{-1}[0-9a-f]*
|
|
|
|
# hit-count: 1 file-count: 1
|
|
# copyright
|
|
Copyright (?:\([Cc]\)|)(?:[-\d, ]|and)+(?: [A-Z][a-z]+ [A-Z][a-z]+,?)+
|
|
|
|
# hit-count: 1 file-count: 1
|
|
# IPv6
|
|
\b(?:[0-9a-fA-F]{0,4}:){3,7}[0-9a-fA-F]{0,4}\b
|
|
|
|
# hit-count: 1 file-count: 1
|
|
# Docker images
|
|
^\s*(?i)FROM\s+\S+:\S+(?:\s+AS\s+\S+|)
|
|
|
|
# hit-count: 1 file-count: 1
|
|
# perl run
|
|
perl(?:\s+-[a-zA-Z]\w*)+
|
|
|
|
# hit-count: 1 file-count: 1
|
|
# go install
|
|
go install(?:\s+[a-z]+\.[-@\w/.]+)+
|
|
|
|
# hit-count: 1 file-count: 1
|
|
# in check-spelling@v0.0.22+, printf markers aren't automatically consumed
|
|
# printf markers
|
|
(?<!\\)\\[nrt](?=[a-z]{2,})
|
|
|
|
# hit-count: 1 file-count: 1
|
|
# tar arguments
|
|
\b(?:\\n|)g?tar(?:\.exe|)(?:(?:\s+--[-a-zA-Z]+|\s+-[a-zA-Z]+|\s[ABGJMOPRSUWZacdfh-pr-xz]+\b)(?:=[^ ]*|))+
|
|
|
|
# Questionably acceptable forms of `in to`
|
|
# Personally, I prefer `log into`, but people object
|
|
# https://www.tprteaching.com/log-into-log-in-to-login/
|
|
\b(?:(?:[Ll]og(?:g(?=[a-z])|)|[Ss]ign)(?:ed|ing)?) in to\b
|
|
|
|
# to opt in
|
|
\bto opt in\b
|
|
|
|
# pass(ed|ing) in
|
|
\bpass(?:ed|ing) in\b
|
|
|
|
# acceptable duplicates
|
|
# ls directory listings
|
|
[-bcdlpsw](?:[-r][-w][-SsTtx]){3}[\.+*]?\s+\d+\s+\S+\s+\S+\s+[.\d]+(?:[KMGT]|)\s+
|
|
# mount
|
|
\bmount\s+-t\s+(\w+)\s+\g{-1}\b
|
|
# C types and repeated CSS values
|
|
\s(auto|buffalo|center|div|inherit|long|LONG|none|normal|solid|thin|transparent|very)(?: \g{-1})+\s
|
|
# C enum and struct
|
|
\b(?:enum|struct)\s+(\w+)\s+\g{-1}\b
|
|
# go templates
|
|
\s(\w+)\s+\g{-1}\s+\`(?:graphql|inject|json|yaml):
|
|
# doxygen / javadoc / .net
|
|
(?:[\\@](?:brief|defgroup|groupname|link|t?param|return|retval)|(?:public|private|\[Parameter(?:\(.+\)|)\])(?:\s+(?:static|override|readonly|required|virtual))*)(?:\s+\{\w+\}|)\s+(\w+)\s+\g{-1}\s
|
|
|
|
# macOS file path
|
|
(?:Contents\W+|(?!iOS)/)MacOS\b
|
|
|
|
# Python package registry has incorrect spelling for macOS / Mac OS X
|
|
"Operating System :: MacOS :: MacOS X"
|
|
|
|
# "company" in Germany
|
|
\bGmbH\b
|
|
|
|
# IntelliJ
|
|
\bIntelliJ\b
|
|
|
|
# Commit message -- Signed-off-by and friends
|
|
^\s*(?:(?:Based-on-patch|Co-authored|Helped|Mentored|Reported|Reviewed|Signed-off)-by|Thanks-to): (?:[^<]*<[^>]*>|[^<]*)\s*$
|
|
|
|
# Autogenerated revert commit message
|
|
^This reverts commit [0-9a-f]{40}\.$
|
|
|
|
# ignore long runs of a single character:
|
|
\b([A-Za-z])\g{-1}{3,}\b
|
|
|
|
# hit-count: 1 file-count: 1
|
|
# microsoft
|
|
\b(?:https?://|)(?:(?:(?:blogs|download\.visualstudio|docs|msdn2?|research)\.|)microsoft|blogs\.msdn)\.co(?:m|\.\w\w)/[-_a-zA-Z0-9()=./%]*
|
|
|
|
# hit-count: 1 file-count: 1
|
|
# data url
|
|
\bdata:[-a-zA-Z=;:/0-9+]*,\S* |