rules

package
v1.3.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 4, 2026 License: MIT Imports: 31 Imported by: 0

Documentation

Overview

Package rules provides the central registry of all active Argus analyzers.

Index

Constants

This section is empty.

Variables

View Source 
var AllAnalyzers = []*analysis.Analyzer{
	a01_sql_concat.Analyzer,
	a02_unclosed_rows.Analyzer,
	a03_context.Analyzer,
	a04_orderby.Analyzer,
	a05_audit_immutability.Analyzer,
	a06_runtime_ddl.Analyzer,
	a07_error_leak.Analyzer,
	a08_tx_io.Analyzer,
	a09_advisory_lock.Analyzer,
	a10_isolation_level.Analyzer,
	a11_destructive_migration.Analyzer,
	a12_timeout_config.Analyzer,
	a13_missing_down_migration.Analyzer,
	a14_select_star.Analyzer,
	a15_ddl_grant.Analyzer,
	a16_max_conns.Analyzer,
	a17_nplusone.Analyzer,
	a18_rows_err.Analyzer,
	a19_unbounded_limit.Analyzer,
	a20_param_limit.Analyzer,
	a21_row_lock.Analyzer,
	a22_serializable_retry.Analyzer,
	a23_tx_timeout.Analyzer,
	a24_tenant_leak.Analyzer,
	a25_expensive_cpu.Analyzer,
	a26_like_sanitize.Analyzer,
	a27_concurrent_index.Analyzer,
	a28_constraint_lock.Analyzer,
	a29_unindexed_fk.Analyzer,
	a30_timestamptz.Analyzer,
}

AllAnalyzers returns all currently registered and active analyzers.

Functions

This section is empty.

Types

This section is empty.

Source Files

View all Source files

Directories

Path Synopsis
Package a01_sql_concat prohibits dynamic SQL concatenation and string formatting in favor of compile-time string constants with parameterized placeholders ($1, $2, ...).
 Package a01_sql_concat prohibits dynamic SQL concatenation and string formatting in favor of compile-time string constants with parameterized placeholders ($1, $2, ...).
Package a02_unclosed_rows enforces that every pgx.Rows produced by Query() is safely closed via defer rows.Close() or consumed by an auto-closing helper.
 Package a02_unclosed_rows enforces that every pgx.Rows produced by Query() is safely closed via defer rows.Close() or consumed by an auto-closing helper.
Package a03_context detects database operations executed with raw unbounded contexts such as context.Background() or context.TODO(), enforcing request deadlines or timeouts.
 Package a03_context detects database operations executed with raw unbounded contexts such as context.Background() or context.TODO(), enforcing request deadlines or timeouts.
Package a04_orderby detects unsafe dynamic ORDER BY clauses and enforces that sort columns and directions originate from closed-set allowlist maps or switch-case branches.
 Package a04_orderby detects unsafe dynamic ORDER BY clauses and enforces that sort columns and directions originate from closed-set allowlist maps or switch-case branches.
Package a05_audit_immutability enforces that audit log tables remain append-only by forbidding UPDATE, DELETE, TRUNCATE, MERGE, and DROP operations.
 Package a05_audit_immutability enforces that audit log tables remain append-only by forbidding UPDATE, DELETE, TRUNCATE, MERGE, and DROP operations.
Package a06_runtime_ddl prohibits executing DDL statements in Go application runtime code.
 Package a06_runtime_ddl prohibits executing DDL statements in Go application runtime code.
Package a07_error_leak prohibits exposing raw database driver errors, pgconn.PgError fields (Detail, Hint, Where), or raw err.Error() strings into API responses.
 Package a07_error_leak prohibits exposing raw database driver errors, pgconn.PgError fields (Detail, Hint, Where), or raw err.Error() strings into API responses.
Package a08_tx_io enforces that open database transactions do not enclose blocking external I/O operations (HTTP, network, disk, sleep, command execution).
 Package a08_tx_io enforces that open database transactions do not enclose blocking external I/O operations (HTTP, network, disk, sleep, command execution).
Package a09_advisory_lock ensures safe PostgreSQL advisory lock usage by prohibiting session-level locks on connection pools and forbidding hardcoded integer magic numbers.
 Package a09_advisory_lock ensures safe PostgreSQL advisory lock usage by prohibiting session-level locks on connection pools and forbidding hardcoded integer magic numbers.
Package a10_isolation_level enforces that transactions modifying critical tables (saldo, kuota, nomor_urut, rekening) do not rely on default ReadCommitted isolation.
 Package a10_isolation_level enforces that transactions modifying critical tables (saldo, kuota, nomor_urut, rekening) do not rely on default ReadCommitted isolation.
Package a11_destructive_migration enforces that .up.sql schema migrations do not execute destructive DDL operations that break zero-downtime rolling deployments.
 Package a11_destructive_migration enforces that .up.sql schema migrations do not execute destructive DDL operations that break zero-downtime rolling deployments.
Package a12_timeout_config enforces explicit server-side and client-side timeout configurations (statement_timeout, lock_timeout, idle_in_transaction, MaxConnIdleTime, MaxConnLifetime) on pgxpool initialization.
 Package a12_timeout_config enforces explicit server-side and client-side timeout configurations (statement_timeout, lock_timeout, idle_in_transaction, MaxConnIdleTime, MaxConnLifetime) on pgxpool initialization.
Package a13_missing_down_migration ensures every .up.sql migration has a valid, non-empty corresponding .down.sql rollback migration.
 Package a13_missing_down_migration ensures every .up.sql migration has a valid, non-empty corresponding .down.sql rollback migration.
Package a14_select_star detects and forbids wildcard column selection (SELECT * and alias.*) in application database queries to prevent TOAST table bloat, buffer cache pollution, and PII leaks (CWE-200).
 Package a14_select_star detects and forbids wildcard column selection (SELECT * and alias.*) in application database queries to prevent TOAST table bloat, buffer cache pollution, and PII leaks (CWE-200).
Package a15_ddl_grant forbids granting DDL permissions or table ownership to runtime application roles in migration scripts.
 Package a15_ddl_grant forbids granting DDL permissions or table ownership to runtime application roles in migration scripts.
Package a16_max_conns enforces explicit, bounded MaxConns configuration on pgxpool to prevent Linux kernel process thrashing, memory exhaustion, and connection starvation.
 Package a16_max_conns enforces explicit, bounded MaxConns configuration on pgxpool to prevent Linux kernel process thrashing, memory exhaustion, and connection starvation.
Package a17_nplusone detects and eliminates N+1 database query patterns inside loops in favor of set-based (ANY($1)) or batch operations.
 Package a17_nplusone detects and eliminates N+1 database query patterns inside loops in favor of set-based (ANY($1)) or batch operations.
Package a18_rows_err enforces mandatory rows.Err() checks immediately after database cursor loops (for rows.Next()) to prevent silent dataset truncation.
 Package a18_rows_err enforces mandatory rows.Err() checks immediately after database cursor loops (for rows.Next()) to prevent silent dataset truncation.
Package a19_unbounded_limit detects and flags queries without LIMIT clauses on high-cardinality tables to prevent buffer cache pollution and Go runtime OOM crashes (CWE-400).
 Package a19_unbounded_limit detects and flags queries without LIMIT clauses on high-cardinality tables to prevent buffer cache pollution and Go runtime OOM crashes (CWE-400).
Package a20_param_limit enforces PostgreSQL 65,535 wire protocol parameter bounds on dynamic multi-row and IN clause statements, promoting pgx.CopyFrom and ANY($1).
 Package a20_param_limit enforces PostgreSQL 65,535 wire protocol parameter bounds on dynamic multi-row and IN clause statements, promoting pgx.CopyFrom and ANY($1).
Package a21_row_lock enforces non-blocking directives (SKIP LOCKED / NOWAIT) on multi-row and task queue row locks to prevent lock convoys and serialization bottlenecks.
 Package a21_row_lock enforces non-blocking directives (SKIP LOCKED / NOWAIT) on multi-row and task queue row locks to prevent lock convoys and serialization bottlenecks.
Package a22_serializable_retry enforces automatic retry loops on Serializable and RepeatableRead transactions to prevent unhandled 500 serialization abort errors (SQLSTATE 40001, 40P01).
 Package a22_serializable_retry enforces automatic retry loops on Serializable and RepeatableRead transactions to prevent unhandled 500 serialization abort errors (SQLSTATE 40001, 40P01).
Package a23_tx_timeout enforces explicit transaction_timeout GUC parameter on pgxpool configuration for PostgreSQL 17/18+ targets to prevent XID horizon freezing and dead tuple bloat.
 Package a23_tx_timeout enforces explicit transaction_timeout GUC parameter on pgxpool configuration for PostgreSQL 17/18+ targets to prevent XID horizon freezing and dead tuple bloat.
Package a24_tenant_leak enforces explicit tenant isolation predicates (WHERE tenant_id = $1) or verified RLS session context on multi-tenant tables to prevent cross-tenant data leaks (CWE-284, BOLA).
 Package a24_tenant_leak enforces explicit tenant isolation predicates (WHERE tenant_id = $1) or verified RLS session context on multi-tenant tables to prevent cross-tenant data leaks (CWE-284, BOLA).
Package a25_expensive_cpu enforces that active database transactions do not enclose CPU-expensive operations (password hashing, key derivation, asymmetric keygen, subprocess exec) to prevent connection pool exhaustion and lock duration inflation (CWE-400, CWE-662).
 Package a25_expensive_cpu enforces that active database transactions do not enclose CPU-expensive operations (password hashing, key derivation, asymmetric keygen, subprocess exec) to prevent connection pool exhaustion and lock duration inflation (CWE-400, CWE-662).
Package a26_like_sanitize enforces wildcard sanitization on user input bound to SQL LIKE/ILIKE clauses.
 Package a26_like_sanitize enforces wildcard sanitization on user input bound to SQL LIKE/ILIKE clauses.
Package a27_concurrent_index enforces that creating indexes on existing tables in migration scripts must use the CREATE INDEX CONCURRENTLY syntax.
 Package a27_concurrent_index enforces that creating indexes on existing tables in migration scripts must use the CREATE INDEX CONCURRENTLY syntax.
Package a28_constraint_lock enforces 2-phase zero-downtime constraint additions (NOT VALID followed by VALIDATE CONSTRAINT) on existing tables in migrations.
 Package a28_constraint_lock enforces 2-phase zero-downtime constraint additions (NOT VALID followed by VALIDATE CONSTRAINT) on existing tables in migrations.
Package a29_unindexed_fk enforces that foreign key columns on child tables have supporting B-tree indexes where the FK column is the leading column.
 Package a29_unindexed_fk enforces that foreign key columns on child tables have supporting B-tree indexes where the FK column is the leading column.
Package a30_timestamptz scans table definitions and alter commands for bare TIMESTAMP columns.
 Package a30_timestamptz scans table definitions and alter commands for bare TIMESTAMP columns.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.