Menu

Sentinel-IR 0.2.1: When "eval" Hides Behind an Alias
📰

Sentinel-IR 0.2.1: When "eval" Hides Behind an Alias

DEV Community: opensource·jackymenCZ (jackymenCZ)·10 days ago
#g6ffDU7x
#devtoopensource#devto#dev#sentinel#gitlab
Reading 0:00
15s threshold

Sentinel-IR 0.2.1

https://www.npmjs.com/package/sentinel-ir/v/0.2.1

Thanks for support..

Release: "Sentinel-IR-MCP v0.2.2 on GitLab" ( https://gitlab.com/jakubrojicek11/sentinel-ir-mcp/-/tree/v0.2.2?ref_type=tags )

Package: " [email protected] on npm" ( https://www.npmjs.com/package/sentinel-ir-mcp/v/0.2.2 )

A focused improvement in AST-based analysis, six regression tests, and a closer look at two tricky JavaScript control-flow paths.

The first 30 seconds

What happens when dangerous code execution does not look like "eval()"?

Sometimes JavaScript stores "eval" in another variable and calls that variable later. A static analyzer that only looks for direct calls can miss the connection.

In Sentinel-IR 0.2.1, I focused on two situations where this can happen: "switch" fallthrough and "try/catch" control flow.

The update adds six regression tests. The goal is simple: detect the dangerous path when it is real, but avoid raising an alarm when the control flow makes that path impossible.

No magic.…

Continue reading — create a free account

Join HashtagPLUS to read full articles, follow hashtags, vote, and join the conversation.