{"action":"created","issue":{"url":"https://api.github.com/repos/fictional-tribble/Microsoft--vscode/issues/3","repository_url":"https://api.github.com/repos/fictional-tribble/Microsoft--vscode","labels_url":"https://api.github.com/repos/fictional-tribble/Microsoft--vscode/issues/3/labels{/name}","comments_url":"https://api.github.com/repos/fictional-tribble/Microsoft--vscode/issues/3/comments","events_url":"https://api.github.com/repos/fictional-tribble/Microsoft--vscode/issues/3/events","html_url":"https://github.com/fictional-tribble/Microsoft--vscode/pull/3","id":348179548,"node_id":"MDExOlB1bGxSZXF1ZXN0MjA2NTg4NjY5","number":3,"title":"Create test.js","user":{"login":"pxlpnk","id":164718,"node_id":"MDQ6VXNlcjE2NDcxOA==","avatar_url":"https://avatars3.githubusercontent.com/u/164718?v=4","gravatar_id":"","url":"https://api.github.com/users/pxlpnk","html_url":"https://github.com/pxlpnk","followers_url":"https://api.github.com/users/pxlpnk/followers","following_url":"https://api.github.com/users/pxlpnk/following{/other_user}","gists_url":"https://api.github.com/users/pxlpnk/gists{/gist_id}","starred_url":"https://api.github.com/users/pxlpnk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pxlpnk/subscriptions","organizations_url":"https://api.github.com/users/pxlpnk/orgs","repos_url":"https://api.github.com/users/pxlpnk/repos","events_url":"https://api.github.com/users/pxlpnk/events{/privacy}","received_events_url":"https://api.github.com/users/pxlpnk/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-08-07T06:07:11Z","updated_at":"2018-08-07T06:08:37Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/fictional-tribble/Microsoft--vscode/pulls/3","html_url":"https://github.com/fictional-tribble/Microsoft--vscode/pull/3","diff_url":"https://github.com/fictional-tribble/Microsoft--vscode/pull/3.diff","patch_url":"https://github.com/fictional-tribble/Microsoft--vscode/pull/3.patch"},"body":""},"comment":{"url":"https://api.github.com/repos/fictional-tribble/Microsoft--vscode/issues/comments/410944180","html_url":"https://github.com/fictional-tribble/Microsoft--vscode/pull/3#issuecomment-410944180","issue_url":"https://api.github.com/repos/fictional-tribble/Microsoft--vscode/issues/3","id":410944180,"node_id":"MDEyOklzc3VlQ29tbWVudDQxMDk0NDE4MA==","user":{"login":"guardrails[bot]","id":32328362,"node_id":"MDM6Qm90MzIzMjgzNjI=","avatar_url":"https://avatars2.githubusercontent.com/in/5512?v=4","gravatar_id":"","url":"https://api.github.com/users/guardrails%5Bbot%5D","html_url":"https://github.com/apps/guardrails","followers_url":"https://api.github.com/users/guardrails%5Bbot%5D/followers","following_url":"https://api.github.com/users/guardrails%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/guardrails%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/guardrails%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guardrails%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/guardrails%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/guardrails%5Bbot%5D/repos","events_url":"https://api.github.com/users/guardrails%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/guardrails%5Bbot%5D/received_events","type":"Bot","site_admin":false},"created_at":"2018-08-07T06:08:37Z","updated_at":"2018-08-07T06:08:37Z","author_association":"CONTRIBUTOR","body":"\n\n  # GuardRails Report\n\n  ## Issues in your ...\n\n  ### ... Source Code\n\n  \n<details>\n    <summary>Insecure Use of Buffer (1)</summary>\n\n   - [/build/gulpfile.editor.js:197](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/build/gulpfile.editor.js#L197)\n\nMore info on [Insecure Use of Buffer](http://docs.guardrails.io/vulnerabilities/js/insecure_use_of_buffer.html).\n\n**How to fix this:**\n\n<details>\n<summary>Option A: Replace new Buffer() secure Buffer APIs</summary>\n\n1. Go through the issues that GuardRails identified in the PR.\n2. Replace `new Buffer()` with secure alternatives to achieve the same outcome. For example, use `Buffer.from()` or `Buffer.alloc()`. Two examples example are shown below:\n\n~~~javascript\n//Instead of this:\nnew Buffer(req.body.foo, 'utf8');\nnew Buffer(req.body.length);\n\n// Use this:\nBuffer.from(req.body.foo, 'utf8');\nBuffer.alloc(req.body.length);\n~~~\n\n3. Test it and ensure the functionality works as expected\n4. Ship it 🚢 and relax 🌴\n</details>\n\n<details>\n<summary>Option B: Use Safe-Buffer</summary>\n\n1.  Install [Safe-Buffer](https://www.npmjs.com/package/safe-buffer).\n\n~~~bash\nnpm install --save safe-buffer\n~~~\n\n2. Add the following line to the top of your Node.js modules.\n\n~~~javascript\nvar Buffer = require('safe-buffer').Buffer\n~~~\n\n3. Test it and ensure your app is still working as expected.\n4. Ship it 🚢 and relax 🌴\n</details>\n\n---\n\n</details>\n\n<details>\n    <summary>Insecure Regular Expressions (26)</summary>\n\n   - [/build/gulpfile.editor.js:333](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/build/gulpfile.editor.js#L333)\n   - [/build/lib/bundle.js:166](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/build/lib/bundle.js#L166)\n   - [/build/lib/bundle.js:185](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/build/lib/bundle.js#L185)\n   - [/build/lib/i18n.js:314](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/build/lib/i18n.js#L314)\n   - [/build/monaco/api.js:264](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/build/monaco/api.js#L264)\n   - [/build/monaco/api.js:289](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/build/monaco/api.js#L289)\n   - [/build/monaco/api.js:346](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/build/monaco/api.js#L346)\n   - [/build/monaco/api.js:352](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/build/monaco/api.js#L352)\n   - [/build/npm/update-localization-extension.js:20](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/build/npm/update-localization-extension.js#L20)\n   - [/src/main.js:118](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/src/main.js#L118)\n   - [/src/vs/base/common/marked/marked.js:18](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/src/vs/base/common/marked/marked.js#L18)\n   - [/src/vs/base/common/marked/marked.js:20](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/src/vs/base/common/marked/marked.js#L20)\n   - [/src/vs/base/common/marked/marked.js:21](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/src/vs/base/common/marked/marked.js#L21)\n   - [/src/vs/base/common/marked/marked.js:23](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/src/vs/base/common/marked/marked.js#L23)\n   - [/src/vs/base/common/marked/marked.js:35](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/src/vs/base/common/marked/marked.js#L35)\n   - [/src/vs/base/common/marked/marked.js:38](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/src/vs/base/common/marked/marked.js#L38)\n   - [/src/vs/base/common/marked/marked.js:43](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/src/vs/base/common/marked/marked.js#L43)\n   - [/src/vs/base/common/marked/marked.js:50](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/src/vs/base/common/marked/marked.js#L50)\n   - [/src/vs/base/common/marked/marked.js:96](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/src/vs/base/common/marked/marked.js#L96)\n   - [/src/vs/base/common/marked/marked.js:112](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/src/vs/base/common/marked/marked.js#L112)\n   - [/src/vs/base/common/marked/marked.js:113](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/src/vs/base/common/marked/marked.js#L113)\n   - [/src/vs/base/common/marked/marked.js:131](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/src/vs/base/common/marked/marked.js#L131)\n   - [/src/vs/base/common/marked/marked.js:435](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/src/vs/base/common/marked/marked.js#L435)\n   - [/src/vs/base/common/marked/marked.js:521](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/src/vs/base/common/marked/marked.js#L521)\n   - [/src/vs/base/common/marked/marked.js:535](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/src/vs/base/common/marked/marked.js#L535)\n   - [/src/vs/base/common/marked/marked.js:589](https://github.com/fictional-tribble/Microsoft--vscode/tree/pxlpnk-patch-1/src/vs/base/common/marked/marked.js#L589)\n\nMore info on [Insecure Regular Expressions](http://docs.guardrails.io/vulnerabilities/js/insecure_regular_expressions.html).\n\n**How to fix this:**\n\n<details>\n<summary>Use Safe-Regex</summary>\n\n1.  Install [Safe-Regex](https://github.com/substack/safe-regex) as a dev dependency.\n\n~~~bash\nnpm install --save-dev safe-regex\n~~~\n\n2. Create a file named `safe.js` with the following content.\n\n~~~javascript\nvar safe = require('safe-regex');\nvar regex = process.argv.slice(2).join(' ');\nconsole.log(safe(regex));\n~~~\n\n3. Go through each of the issues that are listed above above.\n4. Identify any '*' or '+' operators that are close to each other.\n5. Remove them and test the new regex with the `safe.js` script until it returns `true`.\n\n~~~bash\n$ node safe.js '(x+x+)+y'\nfalse\n$ node safe.js '(x+x+)y'\ntrue\n~~~\n\n6. Test it and ensure the regex is still working as expected.\n7. Ship it 🚢 and relax 🌴\n</details>\n\n---\n\n</details>\n\n\n  \n</details>\n\n\n\n---\n\n\n\n> Your [GuardRails](https://www.guardrails.io) bot :owl:\n\n\n  <details>\n  <summary>Stats</summary>\n\n  | Type           | Issues       |\n  | -------------- | ------------ |\n  | Engine Type    | javascript |\n  | Engine Version | 1.11.0 |\n  | Execution time | 17 seconds |\n  | Report ID      | 2e0b2fc8-d211-480c-a84a-1fd8c50ad16a |\n\n  </details>\n\n\n\n\n\n\n"}}
{"actor":{"display_login":"guardrails"}}