id: prettier-ignore-disclosure

info:
  name: Prettier - Ignore File Disclosure
  author: ritikchaddha
  severity: info
  description: |
    The .prettierignore file is publicly accessible, potentially revealing project structure, sensitive file paths, and internal directory organization.
  reference:
    - https://prettier.io/docs/en/ignore.html
  metadata:
    verified: true
    max-request: 2
    vendor: prettier
    product: prettier
    shodan-query: http.html:".prettierignore"
    fofa-query: body=".prettierignore" || body="prettier"
  tags: prettier,config,exposure,disclosure

http:
  - method: GET
    path:
      - "{{BaseURL}}/.prettierignore"
      - "{{BaseURL}}/.prettierrc"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "len(body) > 50"
          - "contains(content_type, 'application/octet-stream')"
        condition: and

      - type: word
        part: response
        words:
          - "MongoDB over HTTP on the native"
          - "application/javascript"
          - "application/x-javascript"
          - "application/json"
          - "application/xml"
          - "text/xml"
          - "<html"
          - "<!doctype"
          - "<script"
          - "<meta"
          - "image/"
          - "Response xmlns"
        negative: true
# digest: 4a0a00473045022100f27aa82c722f53c0e0a310d4c8092345441200d84f244eb4414c16b74c38b6da02207d2f7e71643bad61095e92449a3f2271dd96768361918e3db734752e2060cee5:922c64590222798bb761d5b6d8e72950