prosody
21a1b9fb08a1
.semgrep.yml
Software / code / prosody
File
.semgrep.yml @ 11632:21a1b9fb08a1
mod_admin_adhoc: Delete "Get User Password" command
This doesn't really make sense today. It doesn't even work with
mod_auth_internal_hashed, which should be the default. And even with a
supporting authentication module, why would we just hand out the
password? One use case may be to recover a forgotten password. While not
yet included with Prosody, there are better ways to handle forgotten
passwords, usually by resetting them to a new password.
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Sun, 27 Jun 2021 21:51:21 +0200 |
| parent | 11289:c6965f3c321c |
| child | 12717:898e99f49d80 |
line wrap: on
line source
rules: - id: log-variable-fmtstring patterns: - pattern: log("...", $A) - pattern-not: log("...", "...") message: Variable passed as format string to logging languages: [lua] severity: ERROR - id: module-log-variable-fmtstring patterns: - pattern: module:log("...", $A) - pattern-not: module:log("...", "...") message: Variable passed as format string to logging languages: [lua] severity: ERROR - id: module-getopt-string-default patterns: - pattern: module:get_option_string("...", $A) - pattern-not: module:get_option_string("...", "...") - pattern-not: module:get_option_string("...", host) - pattern-not: module:get_option_string("...", module.host) message: Non-string default from :get_option_string severity: ERROR languages: [lua]
