Validate rules against JSON Schema rule specifications
Adds JSON Schema validation of rules against the official Semgrep rule specification, as well as a custom specification that we can add our own validation and checks to.
Properties
-
rules
- Type:
array
- path: #https://gitlab.com/gitlab-org/security-products/sast-rules/-/raw/main/.yamllint/properties/rules
- Item Count: ≤ 1
- Items
- Type:
object
- path: #https://gitlab.com/gitlab-org/security-products/sast-rules/-/raw/main/.yamllint/properties/rules/items
-
Properties
-
id
required
-
- Rule ID to attach to findings
- Type:
string
- path: #https://gitlab.com/gitlab-org/security-products/sast-rules/-/raw/main/.yamllint/properties/rules/items/properties/id
- The value must match this pattern:
^(c|csharp|go|java|javascript|python|scala)_[a-zA-Z0-9_.-]+$
-
-
languages
required
-
- Languages the rule is intended for
- Type:
array
- path: #https://gitlab.com/gitlab-org/security-products/sast-rules/-/raw/main/.yamllint/properties/rules/items/properties/languages
- Item Count: ≤ 2
- Items
- Type:
string
- path: #https://gitlab.com/gitlab-org/security-products/sast-rules/-/raw/main/.yamllint/properties/rules/items/properties/languages/items
- The value is restricted to the following:
- "c"
- "csharp"
- "go"
- "java"
- "javascript"
- "python"
- "typescript"
- "scala"
-
-
message
required
-
- A detailed description of the issue with examples and recommended mitigations
- path: #https://gitlab.com/gitlab-org/security-products/sast-rules/-/raw/main/.yamllint/properties/rules/items/properties/message
-
-
metadata
required
-
- Related identifiers and short description
- Type:
object
- path: #https://gitlab.com/gitlab-org/security-products/sast-rules/-/raw/main/.yamllint/properties/rules/items/properties/metadata
-
Properties
-
shortDescription
required
- Type:
string
- path: #https://gitlab.com/gitlab-org/security-products/sast-rules/-/raw/main/.yamllint/properties/rules/items/properties/metadata/properties/shortDescription
- Length: between 16 and 128
- Type:
-
cwe
required
-
- A relevant Common Weakness Enumeration ID for the issue (https://cwe.mitre.org/)
- Type:
string
- path: #https://gitlab.com/gitlab-org/security-products/sast-rules/-/raw/main/.yamllint/properties/rules/items/properties/metadata/properties/cwe
- The value must match this pattern:
^CWE-\d{1,4}$
-
-
owasp
-
- A relevant OWASP TOP 10 category from 2017 or 2021.
2021: https://owasp.org/Top10/ 2017: https://owasp.org/www-project-top-ten/2017/Top_10.html - Type:
string
- path: #https://gitlab.com/gitlab-org/security-products/sast-rules/-/raw/main/.yamllint/properties/rules/items/properties/metadata/properties/owasp
- The value is restricted to the following:
- "A01:2021-Broken Access Control"
- "A02:2021-Cryptographic Failures"
- "A03:2021-Injection"
- "A04:2021-Insecure Design"
- "A05:2021-Security Misconfiguration"
- "A06:2021-Vulnerable and Outdated Components"
- "A07:2021-Identification and Authentication Failures"
- "A08:2021-Software and Data Integrity Failures"
- "A09:2021-Security Logging and Monitoring Failures"
- "A10:2017-Insufficient Logging & Monitoring"
- "A10:2021-Server-Side Request Forgery"
- "A1:2017-Injection"
- "A2:2017-Broken Authentication"
- "A3:2017-Sensitive Data Exposure"
- "A4:2017-XML External Entities (XXE)"
- "A5:2017-Broken Access Control"
- "A6:2017-Security Misconfiguration"
- "A7:2017-Cross-Site Scripting (XSS)"
- "A8:2017-Insecure Deserialization"
- "A9:2017-Using Components with Known Vulnerabilities"
-
-
shortDescription
-
-
id
- Type:
Generated with json-schema-md-doc
Edited by Michael Henriksen