Merge pull request #243 from caido-community/link-manipulation-check

Author: bebiksior

.cursor/rules/tests.mdc

@@ -0,0 +1,31 @@
+---
+alwaysApply: true
+---
+
+## Testing Guidelines
+
+Write tests that focus on actual behavior, not implementation details. Test both positive and negative cases with realistic mock data. Use descriptive test names that clearly describe the scenario and expected behavior.
+
+## Critical: Don't Fix Tests to Pass Invalid Behavior
+
+The most common mistake is adjusting tests to pass when the check itself has bugs.
+
+When a test fails:
+1. First, determine if it's a test issue or check issue
+2. If the check behavior is wrong, fix the check, not the test
+3. Only adjust the test if the test expectations were incorrect
+
+It's a CHECK issue when:
+- The check produces false positives (finds vulnerabilities that don't exist)
+- The check produces false negatives (misses real vulnerabilities)
+- The check runs when it shouldn't (wrong conditions)
+- The check doesn't run when it should
+- The findings have incorrect severity or descriptions
+
+It's a TEST issue when:
+- Test expectations don't match the intended check behavior
+- Mock data doesn't properly represent the scenario
+- Test setup is incorrect or incomplete
+- Test assertions are checking the wrong things
+
+Always verify that the check's actual behavior matches what it should do according to the vulnerability it's designed to detect.

packages/backend/src/checks/index.ts

@@ -19,6 +19,7 @@ import exposedEnvScan from "./exposed-env";
 import gitConfigScan from "./git-config";
 import hashDisclosureScan from "./hash-disclosure";
 import jsonHtmlResponseScan from "./json-html-response";
+import linkManipulationScan from "./link-manipulation";
 import missingContentTypeScan from "./missing-content-type";
 import openRedirectScan from "./open-redirect";
 import pathTraversalScan from "./path-traversal";
@@ -59,6 +60,7 @@ export const Checks = {
   GIT_CONFIG: "git-config",
   HASH_DISCLOSURE: "hash-disclosure",
   JSON_HTML_RESPONSE: "json-html-response",
+  LINK_MANIPULATION: "link-manipulation",
   MISSING_CONTENT_TYPE: "missing-content-type",
   OPEN_REDIRECT: "open-redirect",
   PATH_TRAVERSAL: "path-traversal",
@@ -100,6 +102,7 @@ export const checks = [
   gitConfigScan,
   hashDisclosureScan,
   jsonHtmlResponseScan,
+  linkManipulationScan,
   missingContentTypeScan,
   openRedirectScan,
   pathTraversalScan,