Comments (1)
GriffinMB
commented on May 7, 2024
Hey, great question!
Although the initial intention was to check all dependencies for vulnerabilities, a couple of years ago I narrowed the scope to only core Phoenix libraries - ie Phoenix itself, Plug, etc. A combination of mix hex.audit and MixAudit are probably the ideal ways to track dependency concerns, while Sobelow is more strictly static analysis focused.
The docs should definitely be updated to indicate that MixAudit is more full-featured for vulnerability tracking. Would love a PR, otherwise I'll think about the language and make the change myself.
from sobelow.
Related Issues (20)
- Traversal.FileModule Issue. HOT 1
- Macro.to_string/2 deprecation warning HOT 3
- Please match hex version code with github? HOT 1
- Support detecting for Wildcard check_origin Vulnerability
- Create robust testing suite against other popular Elixir repos
- Suggestion for installation instructions HOT 1
- Add production runtime config to the missing HTTPS check HOT 3
- LiveView Support
- castore vsn requirement HOT 3
- CAStore error when running as standalone script HOT 7
- DevEx: consider defaulting to [FILE_PATH]:[LINE_NUMBER] format for default vulnerability output HOT 2
- Too much info in --details / -d output HOT 2
- Creating Performance Testing Suite
- Misc.BinToTerm with [:safe] option HOT 2
- (Protocol.UndefinedError) error HOT 8
- Source code with range traversal crashes sobelow HOT 6
- .sobelow-skips not picked up when running in (gitlab) CI. HOT 7
- Update and fix warnings for new Elixir version
- Misses vector if function contains bang operator (!) HOT 1
- Better granularity of SQL injection HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from sobelow.