activescript

Documentation

Overview

Package activescript runs user-authored ACTIVE scanner checks written in Starlark — the active twin of internal/checkscript. A custom active check defines:

def check(point, baseline, probe):
    r = probe("'")              # send a payload at this injection point
    if re_search("(?i)SQL syntax", r.body):
        return [finding("High", "SQL injection (custom)", evidence=r.body[:80])]
    return []

`probe(payload)` sends one mutated request through the engine's sender (so it's recorded, session-auth applied, and counts against the run's request budget). Starlark is sandboxed: no files, sockets, clock, or imports — only the builtins we hand it (finding, re_search). Execution is step-bounded to stop runaway loops.

Index

• func Delete(dir, id string) error
• func Exists(dir, id string) bool
• func Read(dir, id string) (string, error)
• func Save(dir, id, src string) error
• func ToActiveChecks(checks []*Check) []activescan.Check
• func ValidID(id string) bool
• type Check
  • func Compile(id, src string) (*Check, error)
  • func LoadDir(dir string) ([]*Check, map[string]error)
  • func (c *Check) Run(p activescan.Point, baseline activescan.Response, probe activescan.Prober) (hit *activescan.Hit)
• type Source
  • func List(dir string) []Source

Functions

func Delete

func Delete(dir, id string) error

Delete removes an active check.

func Exists

func Exists(dir, id string) bool

Exists reports whether <id>.star exists in dir.

func Read

func Read(dir, id string) (string, error)

Read returns one active check's source.

func Save

func Save(dir, id, src string) error

Save validates that src compiles, then writes it as <id>.star (creating dir).

func ToActiveChecks

func ToActiveChecks(checks []*Check) []activescan.Check

ToActiveChecks wraps compiled user checks as activescan.Check entries. When the file id matches a built-in probe id, the check replaces that built-in (same disable toggle). Otherwise ids are prefixed with custom-active:.

func ValidID

func ValidID(id string) bool

ValidID reports whether id is a safe active-check identifier.

Types

type Check

type Check struct {
	ID string
	// contains filtered or unexported fields
}

Check is a compiled user-authored active check. Run matches activescan.Check.Run so a Check can be used directly as an activescan.Check (wrapped with its ID).

func Compile

func Compile(id, src string) (*Check, error)

Compile parses and compiles an active check, requiring a callable check(point, baseline, probe).

func LoadDir

func LoadDir(dir string) ([]*Check, map[string]error)

LoadDir compiles every `*.star` active check in dir (sorted). Returns the compiled checks plus a filename→error map for any that failed to compile.

func (*Check) Run

func (c *Check) Run(p activescan.Point, baseline activescan.Response, probe activescan.Prober) (hit *activescan.Hit)

Run executes the check against one injection point. probe sends payloads through the engine (budget/cancellation honoured by the caller's Prober). A check that returns multiple findings reports the highest-severity one as the Hit (carrying its own title/severity/detail/fix so each finding is self-describing).

type Source

type Source struct {
	ID     string `json:"id"`
	Source string `json:"source"`
	Error  string `json:"error,omitempty"`
}

Source is a stored active check: id, raw source, compile error (if any).

func List

func List(dir string) []Source

List returns every `*.star` active check in dir (sorted), each with its source and a compile error if it currently fails to compile. A missing dir yields nil.