From b7d555c2cad4bf20d21feb71163829d295edc5f1 Mon Sep 17 00:00:00 2001
From: geeknik <466878+geeknik@users.noreply.github.com>
Date: Wed, 9 Aug 2023 13:43:26 +0000
Subject: [PATCH] Update externally-connectable.yaml

Changes:

- Added negative matcher to check for non-example domains
- Extractor to get list of external domains
- Extract each external domain into separate variable

This makes the template more focused on validating that externally_connectable is limited to only necessary trusted domains.
---
 externally-connectable.yaml | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/externally-connectable.yaml b/externally-connectable.yaml
index 0d33693..73ac208 100644
--- a/externally-connectable.yaml
+++ b/externally-connectable.yaml
@@ -1,8 +1,8 @@
-id: externally-connectable
+id: externally-connectable  
 
 info:
-  name: Externally Connectable
-  description: Specify external extensions and web pages the extension can exchange information with using the "externally_connectable" field. Limit connections to trusted sources.
+  name: Validate Externally Connectable
+  description: The externally_connectable field should be limited to only necessary and trusted domains.  
   author: nullenc0de
   severity: medium
 
@@ -13,12 +13,22 @@ file:
     matchers:
       - type: regex
         regex:
-          - "\"externally_connectable\"\\s*:\\s*{"
+          - "\"externally_connectable\"\\s*:\\s*\\"
 
-    extractors:
       - type: regex
-        part: body
-        name: extracted_externally_connectable
         regex:
-          - "\"externally_connectable\"\\s*:\\s*\\{[\\s\\S]*?\\}"
+          - "https://[^\\s'\"]+\\.example\\.com"
+        negative: true
 
+    extractors:
+      - type: regex 
+        part: body
+        name: external_domains
+        regex:
+          - "\"externally_connectable\"\\s*:\\s*\\[([^\\]]+)\\]"
+  
+      - type: regex
+        part: external_domains
+        name: extracted_domain
+        regex:
+          - "'(https://[^']+')"