Lightz-AIO | Refactor "--test" to be not dependent on file names
Currently, Semgrep provides a --test flag that allows users to quickly verify rules against specific test cases. For more details, refer to the official documentation: Testing Rules in Semgrep.
Lightz-AIO also supports this --test flag, mirroring Semgrep's functionality.
Proposed Enhancement: Advanced Test Flag
We propose the introduction of an "advanced test" flag in Lightz-AIO to enhance the testing capabilities. This new flag would enable a more intelligent testing approach by executing the following:
-
Comprehensive Rule Application: Instead of limiting the test to the rule corresponding to the test case filename, the system will scan the file using all available rules.
-
Vulnerability Verification: After detecting vulnerabilities, the system will iterate through each identified issue and verify that the rule ID corresponds to the one specified in the annotation comment above the sink in the source code.
This enhancement aims to improve the accuracy of vulnerability detection and ensure that the rules are correctly aligned with the detected issues.