Fix curl-unencrypted (#54)

* Fix curl-unencrypted * Apply suggestions from code review --------- Co-authored-by: Paweł Płatek <e2.8a.95@gmail.com>
trailofbits · Mar 11, 2024 · b5f7c2e · b5f7c2e
1 parent f927ddb
commit b5f7c2e
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 3 deletions.
diff --git a/generic/curl-unencrypted-url.sh b/generic/curl-unencrypted-url.sh
@@ -8,3 +8,9 @@ curl ftp://google.com > /dev/null
 
 # ok: curl-unencrypted-url
 curl https://google.com > /dev/null
+
+# ok: curl-unencrypted-url
+curl http://localhost > /dev/null
+
+# ok: curl-unencrypted-url
+curl http://127.0.0.1 > /dev/null
diff --git a/generic/curl-unencrypted-url.yaml b/generic/curl-unencrypted-url.yaml
@@ -13,6 +13,9 @@ rules:
       impact: HIGH
       references:
         - https://curl.se/docs/manpage.html
-    pattern-either:
-      - pattern: curl ... http://
-      - pattern: curl ... ftp://
+    patterns:
+      - pattern-either:
+          - pattern: curl ... http://
+          - pattern: curl ... ftp://
+      - pattern-not-inside: curl ... http://127.0.0.1
+      - pattern-not-inside: curl ... http://localhost