Merge pull request #216 from DolphFlynn/polyfill_regex

Tighten regex for polyfill JS import and only check within response b…
PortSwigger · Jul 9, 2024 · 6d3e145 · 6d3e145
2 parents 918d658 + c8daf01
commit 6d3e145
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/other/Javascript/malicious_polyfill_cdn.bcheck b/other/Javascript/malicious_polyfill_cdn.bcheck
@@ -6,7 +6,7 @@ metadata:
     tags: "passive","javascript"
 
 given response then
-    if {latest.response} matches "<script.*?src=\"(https?:)?//(cdn.)?polyfill.io/v[0-9]/polyfill\.min\.js.*?\".*?>" then
+    if {latest.response.body} matches "<script.*?src=\"(https?:)?//(cdn\.)?polyfill\.io/v[0-9]/polyfill\.min\.js.*?\".*?>" then
         report issue:
             severity: high
             confidence: firm