rules

Documentation

Index

• type Rule
• type RuleSet
  • func LoadRules(dir string) (*RuleSet, error)
  • func LoadRulesFile(path string) (*RuleSet, error)
  • func (rs *RuleSet) Match(ecosystem, pkg, version string) []Rule
  • func (rs *RuleSet) ToFindings(matches []Rule, name, version, ecosystem, lockFile string) []cve.Finding

Types

type Rule

type Rule struct {
	ID          string
	Description string
	Severity    string   // CRITICAL, HIGH, MEDIUM, LOW
	Ecosystem   string   // npm, PyPI, Go, Maven, etc.
	Package     string   // regex pattern for package name
	Version     string   // version constraint: "<2.0.0", ">=1.0,<1.5", "*"
	Functions   []string // vulnerable function names
	Tags        []string // organizational tags
}

Rule defines a custom vulnerability detection rule.

type RuleSet

type RuleSet struct {
	Rules []Rule
}

RuleSet holds a collection of rules loaded from YAML files.

func LoadRules

func LoadRules(dir string) (*RuleSet, error)

LoadRules loads all .yaml/.yml files from a rules directory.

func LoadRulesFile

func LoadRulesFile(path string) (*RuleSet, error)

LoadRulesFile loads rules from a single YAML file using a simple line-by-line parser.

func (*RuleSet) Match

func (rs *RuleSet) Match(ecosystem, pkg, version string) []Rule

Match checks if a package matches any rule and returns the matching rules.

func (*RuleSet) ToFindings

func (rs *RuleSet) ToFindings(matches []Rule, name, version, ecosystem, lockFile string) []cve.Finding

ToFindings converts matched rules to cve.Finding entries.