Feature Request: please add a check for alasql JavaScript vulnerability and/or integrate Snyk

The alasql javascript library <0.7.0 contains a arbitrary code injection vulnerability with a validated Proof of Concept.

An example header string to regex against is: //! AlaSQL v0.4.5 | © 2014-2016 Andrey Gershun & Mathias Rangel Wulff | License: MIT !function(e,t){"function"==typeof define&&define.amd?define([],t):"object"==typeof exports?module.exports=t():e.alasql=t()}

Snyk has a good description and the proof of concept available on their website: https://security.snyk.io/vuln/SNYK-JS-ALASQL-1082932

and a list of all the vulnerable versions: https://snyk.io/vuln/npm:alasql

They seem to be friendly to open-source projects so it might be possible to even integrate the entire Snyk javascript vulnerability database into ZAP to improve JavaScript library checks without having to code each one individually. https://snyk.io/blog/snyk-code-now-available-free-sast/

[globeone]

Started the upstream process here: https://github.com/RetireJS/retire.js/issues/380

[kingthorin]

Specifically it’d be a PR against: https://github.com/RetireJS/retire.js/blob/master/repository/jsrepository.json details for that file are here: https://github.com/RetireJS/retire.js/tree/master/repository#jsrepositoryjson