ruleset

Documentation

Overview

Package ruleset provides code for the analyzer to use to load external scanner configurations. These rulesets are loaded from .gitlab/{sast}-ruleset.toml.

Index

• Constants
• func DisabledIdentifiers(rulesetPath string, analyzer string) (map[string]bool, error)
• type Config
  • func Load(rulesetPath string, analyzer string) (*Config, error)
• type ConfigFileNotFoundError
  • func (e *ConfigFileNotFoundError) Error() string
• type ConfigNotFoundError
  • func (e *ConfigNotFoundError) Error() string
• type Identifier
• type InvalidConfig
  • func (e *InvalidConfig) Error() string
• type NotEnabledError
  • func (e *NotEnabledError) Error() string
• type PassThrough
• type PassThroughType
• type Ruleset

Constants

const (
	// EnvVarGitlabFeatures lists Gitlab features available
	EnvVarGitlabFeatures = "GITLAB_FEATURES"
	// GitlabFeatureCustomRulesetsSAST indicates that sast custom rulesets are enabled
	GitlabFeatureCustomRulesetsSAST = "sast_custom_rulesets"
	// PathSAST is the default path to custom sast rules
	PathSAST = ".gitlab/sast-ruleset.toml"
	// PathSecretDetection is the default path to custom secret detection rulesets
	PathSecretDetection = ".gitlab/secret-detection-ruleset.toml"
	// PassThroughFile should be used when the ruleset passthrough is a file.
	PassThroughFile PassThroughType = "file"
	// PassThroughRaw should be used when the ruleset passthrough is defined inline.
	PassThroughRaw PassThroughType = "raw"
)

Functions

func DisabledIdentifiers

func DisabledIdentifiers(rulesetPath string, analyzer string) (map[string]bool, error)

DisabledIdentifiers uses the config pre-loaded by the analyzer then constructs a list of identifiers that will be ignored when reporting vulnerabilities

Types

type Config

type Config struct {
	PassThrough []PassThrough
	Ruleset     []Ruleset
	Path        string
}

Config is used for overriding default scanner configurations for the analyzers.

func Load

func Load(rulesetPath string, analyzer string) (*Config, error)

Load accepts a rulesetPath and analyzer. Rulesetpath must point to a valid {sast}-ruleset.toml file. A single analyzer rule will be returned if one is found.

type ConfigFileNotFoundError

type ConfigFileNotFoundError struct {
	RulesetPath string
}

ConfigFileNotFoundError indicates the config file was not found

func (*ConfigFileNotFoundError) Error

func (e *ConfigFileNotFoundError) Error() string

Error formats and returns a ConfigFileNotFoundError

type ConfigNotFoundError

type ConfigNotFoundError struct {
	Analyzer    string
	RulesetPath string
}

ConfigNotFoundError indicates custom rule config is not found

func (*ConfigNotFoundError) Error

func (e *ConfigNotFoundError) Error() string

Error formats and returns a ConfigNotFoundError

type Identifier

type Identifier struct {
	Type  string
	Value string
}

Identifier is a vulnerability id. Identifier.Value is used to filter or override vulnerability information in the final report.

type InvalidConfig

type InvalidConfig struct {
	RulesetPath string
	Err         error
}

InvalidConfig indicates an invalid toml file

func (*InvalidConfig) Error

func (e *InvalidConfig) Error() string

Error formats and returns an InvalidConfig

type NotEnabledError

type NotEnabledError struct{}

NotEnabledError indicates custom rulesets have not been enabled

func (*NotEnabledError) Error

func (e *NotEnabledError) Error() string

Error formats and returns a NotEnabledError

type PassThrough

type PassThrough struct {
	Type   PassThroughType
	Target string
	Value  string
}

PassThrough is a struct that analyzers use to load external scanner configurations. Users can define in a project's ruleset file a PassThroughType (file, raw) and a value. Depending on the type, the value will either be a scanner specific file configuration or an inline configuration.

type PassThroughType

type PassThroughType string

PassThroughType determines how the analyzer loads the ruleset which can either be via a file or defined inline.

type Ruleset

type Ruleset struct {
	Identifier Identifier
	Disable    bool
}

Ruleset is used for disabling rules