Validate rules against JSON Schema rule specifications

Adds JSON Schema validation of rules against the official Semgrep rule specification, as well as a custom specification that we can add our own validation and checks to.

---

Properties

• rules
  • Type: array
  • path: #https://gitlab.com/gitlab-org/security-products/sast-rules/-/raw/main/.yamllint/properties/rules
  • Item Count: ≤ 1
    • Items
    • Type: object
    • path: #https://gitlab.com/gitlab-org/security-products/sast-rules/-/raw/main/.yamllint/properties/rules/items
    • Properties
      • id required

        • Rule ID

        • Rule ID to attach to findings
        • Type: string
        • path: #https://gitlab.com/gitlab-org/security-products/sast-rules/-/raw/main/.yamllint/properties/rules/items/properties/id
        • The value must match this pattern: ^(c|csharp|go|java|javascript|python|scala)_[a-zA-Z0-9_.-]+$
      • languages required

        • Rule Languages

        • Languages the rule is intended for
        • Type: array
        • path: #https://gitlab.com/gitlab-org/security-products/sast-rules/-/raw/main/.yamllint/properties/rules/items/properties/languages
        • Item Count: ≤ 2
          • Items
          • Type: string
          • path: #https://gitlab.com/gitlab-org/security-products/sast-rules/-/raw/main/.yamllint/properties/rules/items/properties/languages/items
          • The value is restricted to the following:
            1. "c"
            2. "csharp"
            3. "go"
            4. "java"
            5. "javascript"
            6. "python"
            7. "typescript"
            8. "scala"
      • message required

        • Rule Message

        • A detailed description of the issue with examples and recommended mitigations
        • path: #https://gitlab.com/gitlab-org/security-products/sast-rules/-/raw/main/.yamllint/properties/rules/items/properties/message
      • metadata required

        • Rule Metadata

        • Related identifiers and short description
        • Type: object
        • path: #https://gitlab.com/gitlab-org/security-products/sast-rules/-/raw/main/.yamllint/properties/rules/items/properties/metadata
        • Properties
          • shortDescription required
            • Type: string
            • path: #https://gitlab.com/gitlab-org/security-products/sast-rules/-/raw/main/.yamllint/properties/rules/items/properties/metadata/properties/shortDescription
            • Length: between 16 and 128
          • cwe required

            • CWE ID

            • A relevant Common Weakness Enumeration ID for the issue (https://cwe.mitre.org/)
            • Type: string
            • path: #https://gitlab.com/gitlab-org/security-products/sast-rules/-/raw/main/.yamllint/properties/rules/items/properties/metadata/properties/cwe
            • The value must match this pattern: ^CWE-\d{1,4}$
          • owasp

            • OWASP Top 10 Category

            • A relevant OWASP TOP 10 category from 2017 or 2021.
              2021: https://owasp.org/Top10/ 2017: https://owasp.org/www-project-top-ten/2017/Top_10.html
            • Type: string
            • path: #https://gitlab.com/gitlab-org/security-products/sast-rules/-/raw/main/.yamllint/properties/rules/items/properties/metadata/properties/owasp
            • The value is restricted to the following:
              1. "A01:2021-Broken Access Control"
              2. "A02:2021-Cryptographic Failures"
              3. "A03:2021-Injection"
              4. "A04:2021-Insecure Design"
              5. "A05:2021-Security Misconfiguration"
              6. "A06:2021-Vulnerable and Outdated Components"
              7. "A07:2021-Identification and Authentication Failures"
              8. "A08:2021-Software and Data Integrity Failures"
              9. "A09:2021-Security Logging and Monitoring Failures"
              10. "A10:2017-Insufficient Logging & Monitoring"
              11. "A10:2021-Server-Side Request Forgery"
              12. "A1:2017-Injection"
              13. "A2:2017-Broken Authentication"
              14. "A3:2017-Sensitive Data Exposure"
              15. "A4:2017-XML External Entities (XXE)"
              16. "A5:2017-Broken Access Control"
              17. "A6:2017-Security Misconfiguration"
              18. "A7:2017-Cross-Site Scripting (XSS)"
              19. "A8:2017-Insecure Deserialization"
              20. "A9:2017-Using Components with Known Vulnerabilities"

Generated with json-schema-md-doc