Highlights

• We now support Algolia, Airbrake, Bugsnag, Open Telemetry, New Relic, and Segment on JavaScript
• We now support ClickHouse, and Google Analytics on Ruby
• We increased our OWASP Top 10 coverage on both Ruby and JavaScript
• Project is renamed from Curio to Bearer
• We removed DSR (our own stuff) to use standard CWE instead.

Changelog

• f858b18 chore(deps): bump github.com/aws/aws-sdk-go from 1.44.181 to 1.44.199 (#558)
• af614f5 chore(deps): bump github.com/aws/aws-sdk-go from 1.44.199 to 1.44.204 (#614)
• 6b557e4 chore(deps): bump github.com/open-policy-agent/opa from 0.48.0 to 0.49.0 (#559)
• eb34366 chore(deps): bump golang.org/x/mod from 0.7.0 to 0.8.0 (#561)
• 2a74803 chore(deps): bump golang.org/x/net from 0.2.0 to 0.7.0 in /battle_tests/quickstart (#612)
• b04fdd4 chore(deps): bump golang.org/x/net from 0.6.0 to 0.7.0 (#613)
• d7a80d0 chore(deps): bump golang.org/x/oauth2 from 0.4.0 to 0.5.0 (#560)
• e88963b chore(deps): bump google.golang.org/api from 0.109.0 to 0.110.0 (#615)
• acee9e2 chore(rename): codebase packages (#625)
• 87dedd6 chore(rename): curio to bearer banner (#609)
• 0561a77 chore(rename): vars, urls and arguments (#628)
• 528dd0b chore: redo rules tests (#603)
• 457310c chore: remove dataflow tests (#589)
• bcee4fe chore: update rule descriptions (#638)
• 5f64daa ci(battletest): fix json marshaling (#555)
• 7454623 ci(battletest): run summary output in all cases (#585)
• 3e63dc2 ci(goreleaser): update deprecated argument (#610)
• e226b87 docs(fix): Update remediation messages for js/ruby rules (#556)
• 64173bc docs(fix): resolve incomplete sitemap bug (#571)
• f774f10 docs(rename): Update doc site branding/colours (#635)
• 10388d2 docs(rename): change name curio to bearer (#611)
• c50c2cf docs(rename): let people know doc may be outdated (#616)
• b98110a docs(rename): update site logo (#631)
• 198eb3a docs(rule): rename rules (#627)
• 1c050d4 feat(JS rules): add CWE 548 for JS express (#617)
• c7ce0f9 feat(JS rules): add CWE 601 for express (Open Redirect) (#641)
• 9878f93 feat(JS rules): add check for no-entity flag in libXML calls (#619)
• 65c1f69 feat(JS rules): add express rule against server side request forgery (#636)
• 57f5d02 feat(JS rules): add express rule around unsafe deserialization (#630)
• 15b5b30 feat(JS rules): add express rule for insecure reference resolution (#634)
• c286ad0 feat(JS rules): add express rule for sql injection (#648)
• 7ef4369 feat(JS rules): add rule for express cross-site scripting (#643)
• 1725cf5 feat(JS rules): express.js path traversal (#645)
• 0625cae feat(JS rules): extend CWE-611 for express (#640)
• f1d5475 feat(js rules): add Algolia (#574)
• e4cb525 feat(js rules): add airbrake rule (#598)
• e03bab8 feat(js rules): add bugsnag rule (#593)
• 4f9b217 feat(js rules): add open telemetry rule (#597)
• 782ff6e feat(js rules): add rule for new relic (#578)
• 24a9cba feat(js rules): add segment rule (#582)
• 495232e feat(ruby rules): add ClickHouse (#568)
• 566ac52 feat(ruby rules): add google analytics (#564)
• eaaed72 feat(ruby rules): add ruby google dataflow rule (#553)
• 7e28dbe feat(summary): condense rule list and show CWE (#647)
• 45eadee feat: add "not" and regex filters (#575)
• 31a30e5 feat: add CWE ids to newer JS rules (#602)
• bed26f3 feat: add datadog browser rule (#581)
• 9e4f531 feat: add datadog(hot-shots) rule (#576)
• 53e7fe4 feat: add elasticsearch (#580)
• c9b815d feat: add google analytics rule (#566)
• b947c2c feat: add honeybadger js rule (#596)
• e71b235 feat: add javascript react google analytics rule (#567)
• bb06b74 feat: add javascript rule for google tag manager (#554)
• 02c751a feat: add jwt weak encryption (#652)
• fa8c122 feat: add rails open redirect rule (#649)
• ecebb04 feat: add rollbar (#595)
• 82092fa feat: insecure http password and weak encryption (#632)
• e4fc9ba feat: javascript http insecure rule (#551)
• e23dbcc feat: jwt hardcoded secret (#650)
• cf86bff feat: log when loading rules (#599)
• efb1037 feat: optimise compilation time (#618)
• e7ddfd7 feat: ruby BigQuery rule (#563)
• bef4292 feat: ruby CWE-502 deserialization of user input (#583)
• 3214c9a feat: ruby rule for CWE-94 eval using user input (#587)
• d49bf1b feat: ruby rule for ftp using user input (#626)
• f9ce066 feat: ruby rule for path using user input (#624)
• cd0eb22 feat: ruby rule for session key using user input (#590)
• af8a13f feat: ruby rule for user input in http url (#646)
• a8041cd feat: rules e2e (#621)
• 9309dbc fix: fix algolia JS client patterns (#586)
• a93c1c4 fix: fix algolia integration test (#579)
• 0e26e2d fix: fix severity and remove DSW for JS insecure XML ref rule (#623)
• 9c79e95 fix: flow and nested detections (#572)
• 4e941b9 fix: ruby file generation (#565)