Risk audit

Plugs and Libraries
1

Risk Audit

Description

The Enhanced Risk Audit f for SilverBullet analyzes scripts for potentially dangerous constructs and API calls.
It provides a risk audit report that includes a trust score for each code block, a summary of findings, and a list of rules used to analyze scripts.

Commands

  • Security: Scan Current Page: Runs the scanner on the current page and generates a risk audit report.
  • Security: Scan All Children Pages: Scans all child pages of the current page and generates a risk audit report for each page.

Reports

audit1
audit2

Code

In my library,
https://github.com/malys/silverbullet-libraries/blob/main/src/RiskAudit.md

2 Likes
2

Rules and static analysis must be improved, but it seems correct.

3

Massive improvements:

  • revert scoring
  • add more dangerous pattern
5
  • add some screencasts
6

I love the idea of auditing and appreciate you sharing your work. I will be taking a closer look at it in the near future.

7

Feel free to contribute and to propose new checking rules.

1 Like
8

Might it eventually be used as an optional default filter before/after SB imports a library?

This makes SB both powerful (lots of APIs) and secure (with API restrictions on calls).

9

yes a hook before to install imported script