|
9 | 9 | alternative: "git stash" |
10 | 10 | alternative_info: "Saves your changes to the stash so you can recover them later with 'git stash pop'." |
11 | 11 | - from: git |
12 | | - test: git\s{1,}rm\s{1,}(\*|\.) |
| 12 | + test: git\s{1,}rm\s{1,}(?:-\S+\s+)*(\*|\.)(\s|$) |
13 | 13 | description: "This command going to delete all files." |
14 | 14 | id: git:delete_all |
15 | 15 | severity: High |
16 | 16 | - from: git |
17 | | - test: git\s{1,}clean\s{1,}(?:-[a-zA-Z]*f[a-zA-Z]*d[a-zA-Z]*|-[a-zA-Z]*d[a-zA-Z]*f[a-zA-Z]*|(?:-\S+\s+)*-f(?:\s+-\S+)*\s+-d|(?:-\S+\s+)*-d(?:\s+-\S+)*\s+-f) |
| 17 | + test: git\s{1,}clean\s{1,}(?:-[a-zA-Z]*f[a-zA-Z]*d[a-zA-Z]*|-[a-zA-Z]*d[a-zA-Z]*f[a-zA-Z]*|(?:-\S+\s+)*-f(?:\s+-\S+)*\s+-d|(?:-\S+\s+)*-d(?:\s+-\S+)*\s+-f|--force\s+(?:-\S+\s+)*-d|(?:-\S+\s+)*-d(?:\s+-\S+)*\s+--force) |
18 | 18 | description: "This command will remove all untracked files and directories." |
19 | 19 | id: git:clean_force |
20 | 20 | severity: High |
|
33 | 33 | filters: |
34 | 34 | - type: NotContains |
35 | 35 | value: "--force-with-lease" |
| 36 | + - type: NotContains |
| 37 | + value: "--force-if-includes" |
36 | 38 | alternative: "git push --force-with-lease" |
37 | 39 | alternative_info: "Checks that your local ref is up-to-date before force pushing, preventing accidental overwrites of others' work." |
38 | 40 | - from: git |
|
43 | 45 | alternative: "git branch -d <branch>" |
44 | 46 | alternative_info: "Uses safe delete (-d) which refuses to delete a branch with unmerged changes." |
45 | 47 | - from: git |
46 | | - test: git\s{1,}checkout\s{1,}(-f|--force) |
| 48 | + test: git\s{1,}checkout\s{1,}.*(-f\b|--force) |
47 | 49 | description: "This command will force checkout and discard local changes." |
48 | 50 | id: git:force_checkout |
49 | 51 | severity: High |
|
64 | 66 | alternative: "git stash" |
65 | 67 | alternative_info: "Saves your changes to the stash so you can recover them later with 'git stash pop'." |
66 | 68 | - from: git |
67 | | - test: git\s{1,}rebase\s{1,}-i |
| 69 | + test: git\s{1,}rebase\s{1,}(-i\b|--interactive) |
68 | 70 | description: "This command will start an interactive rebase which can modify commit history." |
69 | 71 | id: git:interactive_rebase |
70 | 72 | severity: Medium |
|
76 | 78 | alternative: "git-filter-repo" |
77 | 79 | alternative_info: "A faster, safer, and officially recommended alternative to filter-branch." |
78 | 80 | - from: git |
79 | | - test: git\s{1,}gc\s{1,}--prune=now |
| 81 | + test: git\s{1,}gc\s{1,}.*--prune=now |
80 | 82 | description: "This command will permanently delete unreachable objects." |
81 | 83 | id: git:gc_prune |
82 | 84 | severity: High |
83 | 85 | - from: git |
84 | | - test: git\s{1,}update-ref\s{1,}-d |
| 86 | + test: git\s{1,}update-ref\s{1,}(-d\b|--delete) |
85 | 87 | description: "This command will delete a Git reference." |
86 | 88 | id: git:delete_ref |
87 | 89 | severity: High |
|
125 | 127 | description: "This command will apply or remove stashed changes." |
126 | 128 | id: git-strict:stash_pop_drop |
127 | 129 | severity: Low |
| 130 | +- from: git |
| 131 | + test: git\s{1,}stash\s{1,}clear(\s|$) |
| 132 | + description: "This command will permanently delete all stash entries with no way to recover them." |
| 133 | + id: git:stash_clear |
| 134 | + severity: High |
| 135 | + alternative: "git stash list" |
| 136 | + alternative_info: "Review your stashes before clearing them. Use 'git stash drop stash@{N}' to remove individual entries." |
128 | 137 | - from: git |
129 | 138 | test: git\s{1,}submodule\s{1,}(update|deinit) |
130 | 139 | description: "This command will update or deinitialize Git submodules." |
131 | 140 | id: git-strict:submodule_update |
132 | 141 | severity: Low |
133 | 142 | - from: git |
134 | | - test: git\s{1,}tag\s{1,}-a |
| 143 | + test: git\s{1,}tag\s{1,}(-a\b|--annotate) |
135 | 144 | description: "This command will create an annotated tag." |
136 | 145 | id: git-strict:create_tag |
137 | 146 | severity: Low |
|
141 | 150 | id: git:push_mirror |
142 | 151 | severity: Critical |
143 | 152 | - from: git |
144 | | - test: git\s{1,}push\s{1,}\S+\s{1,}--delete\s|git\s{1,}push\s{1,}\S+\s{1,}:\S |
| 153 | + test: git\s{1,}push\s{1,}(\S+\s{1,}--delete\s|--delete\s{1,}\S+\s|\S+\s{1,}:\S) |
145 | 154 | description: "This command will delete a remote branch." |
146 | 155 | id: git:push_delete_branch |
147 | 156 | severity: High |
148 | 157 | - from: git |
149 | | - test: git\s{1,}reflog\s{1,}expire\s{1,}--expire=now |
| 158 | + test: git\s{1,}reflog\s{1,}expire\s{1,}.*--expire=now |
150 | 159 | description: "Expiring all reflog entries destroys the last recovery mechanism for lost commits." |
151 | 160 | id: git:reflog_expire |
152 | 161 | severity: Critical |
0 commit comments