From e99baa5ef5a2e5b05e68e1b8eac513df22ec5163 Mon Sep 17 00:00:00 2001
From: geeknik <466878+geeknik@users.noreply.github.com>
Date: Wed, 9 Aug 2023 14:30:07 +0000
Subject: [PATCH] Update wildcard-in-manifest.yaml

Changes:

- Added negative matcher to check for overbroad wildcards
- Extracted wildcard matches for further analysis
- Extract each wildcard match into separate variable
---
 wildcard-in-manifest.yaml | 27 +++++++++++++--------------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/wildcard-in-manifest.yaml b/wildcard-in-manifest.yaml
index 09788f7..9a55eda 100644
--- a/wildcard-in-manifest.yaml
+++ b/wildcard-in-manifest.yaml
@@ -1,8 +1,8 @@
 id: wildcards-in-manifest
 
 info:
-  name: Wildcards in Manifest
-  description: Check for wildcards in the manifest file, which could lead to overexposure of permissions and security risks.
+  name: Validate Wildcards in Manifest 
+  description: Wildcards should be restricted only to required paths to prevent overprivilege.
   author: nullenc0de
   severity: low
 
@@ -13,22 +13,21 @@ file:
     matchers:
       - type: regex
         regex:
-          - "\\*\\/\\/\\*"
-          - "\\*:\\/\\/*"
-          - "\\\"\\*\\/"
-          - "\\/\\*\\\""
-          - "\\*:\\/\\/\\*\\/*"
-          - "\\*\\/\\*\\/*"
+          - '"matches":\\s*\\["'   
+
+      - type: regex
+        regex: 
+          - '\\*\\/everything\\/\\*'
+        negative: true
 
     extractors:
       - type: regex
         part: body
         name: wildcard_matches
         regex:
-          - "\\*\\/\\/\\*"
-          - "\\*:\\/\\/*"
-          - "\\\"\\*\\/"
-          - "\\/\\*\\\""
-          - "\\*:\\/\\/\\*\\/*"
-          - "\\*\\/\\*\\/*"
+          - '"matches":\\s*\\[(.+?)\\]'
 
+      - type: regex
+        part: wildcard_matches
+        name: match
+        regex: '\\s+"(.+?)"'