Skip to content

Commit

Permalink
Add string values
Browse files Browse the repository at this point in the history
  • Loading branch information
@cfabianski
cfabianski committed Nov 6, 2024
1 parent 9092b05 commit bd5275b
Show file tree
Hide file tree
Showing 6 changed files with 64 additions and 48 deletions.
2 changes: 1 addition & 1 deletion pkg/report/output/output.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ func GetData(
}

// add dataflow to data
if err = GetDataflow(data, report, config, config.Report.Report != flag.ReportDataFlow); err != nil {
if err = GetDataflow(data, report, config, true); err != nil {
return data, err
}

Expand Down
1 change: 1 addition & 0 deletions pkg/scanner/detectors/customrule/customrule.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,7 @@ func (detector *Detector) DetectAt(
Pattern: pattern.Pattern,
Datatypes: match.DatatypeDetections(),
Variables: match.Variables(),
Value: match.Value(),
})
}

Expand Down
48 changes: 27 additions & 21 deletions pkg/scanner/detectors/customrule/filters/filters.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -29,10 +29,11 @@ func NewResult(matches ...Match) *Result {
type Match struct {
variables variableshape.Values
datatypeDetections []*detectortypes.Detection
value *string
}

func NewMatch(variables variableshape.Values, datatypeDetections []*detectortypes.Detection) Match {
return Match{variables: variables, datatypeDetections: datatypeDetections}
func NewMatch(variables variableshape.Values, valueStr *string, datatypeDetections []*detectortypes.Detection) Match {
return Match{variables: variables, value: valueStr, datatypeDetections: datatypeDetections}
}

func (result *Result) Matches() []Match {
Expand All @@ -43,6 +44,10 @@ func (match *Match) Variables() variableshape.Values {
return match.variables
}

func (match *Match) Value() *string {
return match.value
}

func (match *Match) DatatypeDetections() []*detectortypes.Detection {
return match.datatypeDetections
}
Expand Down Expand Up @@ -78,7 +83,7 @@ func (filter *Not) Evaluate(
log.Trace().Msgf("filters.Not: %t", result)
}

return boolResult(patternVariables, result), nil
return boolResult(patternVariables, result, nil), nil
}

type Either struct {
Expand Down Expand Up @@ -125,7 +130,7 @@ func (filter *All) Evaluate(

if len(filter.Children) == 0 {
log.Trace().Msg("filters.All: true (no children)")
return boolResult(patternVariables, true), nil
return boolResult(patternVariables, true, nil), nil
}

for i, child := range filter.Children {
Expand Down Expand Up @@ -164,6 +169,7 @@ func (filter *All) joinMatches(matches, childMatches []Match) []Match {
if variables, variablesMatch := match.variables.Merge(childMatch.variables); variablesMatch {
result = append(result, NewMatch(
variables,
nil,
// FIXME: this seems like it will create unnecessary duplicates
append(match.datatypeDetections, childMatch.datatypeDetections...),
))
Expand All @@ -182,7 +188,7 @@ func (filter *FilenameRegex) Evaluate(
detectorContext detectortypes.Context,
patternVariables variableshape.Values,
) (*Result, error) {
return boolResult(patternVariables, filter.Regex.MatchString(detectorContext.Filename())), nil
return boolResult(patternVariables, filter.Regex.MatchString(detectorContext.Filename()), nil), nil
}

type ImportedVariable struct {
Expand Down Expand Up @@ -218,7 +224,7 @@ func (filter *Rule) Evaluate(

if filter.IsDatatypeRule {
log.Trace().Msg("filters.Rule: match (datatype)")
return NewResult(NewMatch(patternVariables, detections)), nil
return NewResult(NewMatch(patternVariables, nil, detections)), nil
}

if log.Trace().Enabled() {
Expand Down Expand Up @@ -271,7 +277,7 @@ func (filter *Rule) Evaluate(
for _, detectionMatch := range subResult.matches {
if variables, variablesMatch := filter.importVariables(patternVariables, detectionMatch.variables); variablesMatch {
matched = true
matches = append(matches, NewMatch(variables, detectionMatch.datatypeDetections))
matches = append(matches, NewMatch(variables, nil, detectionMatch.datatypeDetections))
}
}

Expand All @@ -288,7 +294,7 @@ func (filter *Rule) Evaluate(
}

if hasPatternVariableMatch {
matches = append(matches, NewMatch(patternVariables, datatypeDetections))
matches = append(matches, NewMatch(patternVariables, nil, datatypeDetections))
}

return NewResult(matches...), nil
Expand Down Expand Up @@ -329,7 +335,7 @@ func (filter *Values) Evaluate(
patternVariables variableshape.Values,
) (*Result, error) {
node := patternVariables.Node(filter.Variable)
return boolResult(patternVariables, slices.Contains(filter.Values, node.Content())), nil
return boolResult(patternVariables, slices.Contains(filter.Values, node.Content()), nil), nil
}

type Regex struct {
Expand All @@ -354,7 +360,7 @@ func (filter *Regex) Evaluate(
)
}

return boolResult(patternVariables, result), nil
return boolResult(patternVariables, result, nil), nil
}

type StringLengthLessThan struct {
Expand All @@ -372,7 +378,7 @@ func (filter *StringLengthLessThan) Evaluate(
return nil, err
}

return boolResult(patternVariables, len(value) < filter.Value), nil
return boolResult(patternVariables, len(value) < filter.Value, nil), nil
}

type StringRegex struct {
Expand Down Expand Up @@ -409,7 +415,7 @@ func (filter *StringRegex) Evaluate(
)
}

return boolResult(patternVariables, result), nil
return boolResult(patternVariables, result, &value), nil
}

type EntropyGreaterThan struct {
Expand Down Expand Up @@ -448,7 +454,7 @@ func (filter *EntropyGreaterThan) Evaluate(
)
}

return boolResult(patternVariables, result), nil
return boolResult(patternVariables, result, nil), nil
}

type IntegerLessThan struct {
Expand All @@ -466,7 +472,7 @@ func (filter *IntegerLessThan) Evaluate(
return nil, err
}

return boolResult(patternVariables, value < filter.Value), nil
return boolResult(patternVariables, value < filter.Value, nil), nil
}

type IntegerLessThanOrEqual struct {
Expand All @@ -484,7 +490,7 @@ func (filter *IntegerLessThanOrEqual) Evaluate(
return nil, err
}

return boolResult(patternVariables, value <= filter.Value), nil
return boolResult(patternVariables, value <= filter.Value, nil), nil
}

type IntegerGreaterThan struct {
Expand All @@ -502,7 +508,7 @@ func (filter *IntegerGreaterThan) Evaluate(
return nil, err
}

return boolResult(patternVariables, value > filter.Value), nil
return boolResult(patternVariables, value > filter.Value, nil), nil
}

type IntegerGreaterThanOrEqual struct {
Expand All @@ -520,7 +526,7 @@ func (filter *IntegerGreaterThanOrEqual) Evaluate(
return nil, err
}

return boolResult(patternVariables, value >= filter.Value), nil
return boolResult(patternVariables, value >= filter.Value, nil), nil
}

type Unknown struct{}
Expand Down Expand Up @@ -553,13 +559,13 @@ func parseInteger(node *tree.Node) (int, bool, error) {
return value, true, nil
}

func boolResult(patternVariables variableshape.Values, value bool) *Result {
return NewResult(boolMatches(patternVariables, value)...)
func boolResult(patternVariables variableshape.Values, value bool, valueStr *string) *Result {
return NewResult(boolMatches(patternVariables, value, valueStr)...)
}

func boolMatches(patternVariables variableshape.Values, value bool) []Match {
func boolMatches(patternVariables variableshape.Values, value bool, valueStr *string) []Match {
if value {
return []Match{NewMatch(patternVariables, nil)}
return []Match{NewMatch(patternVariables, valueStr, nil)}
} else {
return nil
}
Expand Down
50 changes: 26 additions & 24 deletions pkg/scanner/detectors/customrule/filters/filters_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ var _ = Describe("Not", func() {
When("the child filter has a match", func() {
BeforeEach(func(ctx SpecContext) {
filter = &filters.Not{
Child: &MockFilter{result: filters.NewResult(filters.NewMatch(nil, nil))},
Child: &MockFilter{result: filters.NewResult(filters.NewMatch(nil, nil, nil))},
}
})

Expand All @@ -87,7 +87,7 @@ var _ = Describe("Not", func() {

It("returns a result with a match using the pattern variables", func(ctx SpecContext) {
Expect(filter.Evaluate(defaultDetectorContext, patternVariables)).To(Equal(
filters.NewResult(filters.NewMatch(patternVariables, nil)),
filters.NewResult(filters.NewMatch(patternVariables, nil, nil)),
))
})
})
Expand All @@ -110,9 +110,9 @@ var _ = Describe("Either", func() {
patternVariables := []*tree.Node{{ID: 42}}

When("there are child filter matches", func() {
match1 := filters.NewMatch([]*tree.Node{{ID: 1}}, nil)
match2 := filters.NewMatch([]*tree.Node{{ID: 2}}, nil)
match3 := filters.NewMatch([]*tree.Node{{ID: 3}}, nil)
match1 := filters.NewMatch([]*tree.Node{{ID: 1}}, nil, nil)
match2 := filters.NewMatch([]*tree.Node{{ID: 2}}, nil, nil)
match3 := filters.NewMatch([]*tree.Node{{ID: 3}}, nil, nil)

BeforeEach(func(ctx SpecContext) {
filter = &filters.Either{
Expand Down Expand Up @@ -193,12 +193,12 @@ var _ = Describe("All", func() {
nodes = parseNodes(ctx, []string{"n1", "n2", "n3", "n4", "n5", "n6", "n7", "n8"})
patternVariables = []*tree.Node{nodes[0], nil, nil, nil}

match1 = filters.NewMatch([]*tree.Node{nodes[0], nil, nil, nil}, []*detectortypes.Detection{datatype1})
match2 = filters.NewMatch([]*tree.Node{nil, nodes[2], nodes[4], nil}, []*detectortypes.Detection{datatype2})
match3 = filters.NewMatch([]*tree.Node{nil, nodes[3], nodes[5], nil}, []*detectortypes.Detection{datatype3})
match4 = filters.NewMatch([]*tree.Node{nodes[0], nodes[3], nil, nodes[6]}, []*detectortypes.Detection{datatype4})
match5 = filters.NewMatch([]*tree.Node{nodes[0], nodes[3], nil, nodes[7]}, []*detectortypes.Detection{datatype5})
discordantMatch = filters.NewMatch([]*tree.Node{nodes[1], nil, nil, nil}, []*detectortypes.Detection{discordantDatatype})
match1 = filters.NewMatch([]*tree.Node{nodes[0], nil, nil, nil}, nil, []*detectortypes.Detection{datatype1})
match2 = filters.NewMatch([]*tree.Node{nil, nodes[2], nodes[4], nil}, nil, []*detectortypes.Detection{datatype2})
match3 = filters.NewMatch([]*tree.Node{nil, nodes[3], nodes[5], nil}, nil, []*detectortypes.Detection{datatype3})
match4 = filters.NewMatch([]*tree.Node{nodes[0], nodes[3], nil, nodes[6]}, nil, []*detectortypes.Detection{datatype4})
match5 = filters.NewMatch([]*tree.Node{nodes[0], nodes[3], nil, nodes[7]}, nil, []*detectortypes.Detection{datatype5})
discordantMatch = filters.NewMatch([]*tree.Node{nodes[1], nil, nil, nil}, nil, []*detectortypes.Detection{discordantDatatype})
})

When("there is a single child filter with matches", func() {
Expand Down Expand Up @@ -238,10 +238,12 @@ var _ = Describe("All", func() {
Expect(result.Matches()).To(ContainElements(
filters.NewMatch(
[]*tree.Node{nodes[0], nodes[3], nodes[5], nodes[6]},
nil,
[]*detectortypes.Detection{datatype1, datatype3, datatype4},
),
filters.NewMatch(
[]*tree.Node{nodes[0], nodes[3], nodes[5], nodes[7]},
nil,
[]*detectortypes.Detection{datatype1, datatype3, datatype5},
),
))
Expand Down Expand Up @@ -289,7 +291,7 @@ var _ = Describe("All", func() {

It("returns a result with a single match using the pattern variables", func(ctx SpecContext) {
Expect(filter.Evaluate(defaultDetectorContext, patternVariables)).To(Equal(
filters.NewResult(filters.NewMatch(patternVariables, nil)),
filters.NewResult(filters.NewMatch(patternVariables, nil, nil)),
))
})
})
Expand All @@ -306,7 +308,7 @@ var _ = Describe("FilenameRegex", func() {

It("returns a result with a match using the pattern variables", func(ctx SpecContext) {
Expect(filter.Evaluate(defaultDetectorContext, patternVariables)).To(Equal(
filters.NewResult(filters.NewMatch(patternVariables, nil)),
filters.NewResult(filters.NewMatch(patternVariables, nil, nil)),
))
})
})
Expand Down Expand Up @@ -341,7 +343,7 @@ var _ = Describe("Values", func() {

It("returns a result with a match using the pattern variables", func(ctx SpecContext) {
Expect(filter.Evaluate(defaultDetectorContext, patternVariables)).To(Equal(
filters.NewResult(filters.NewMatch(patternVariables, nil)),
filters.NewResult(filters.NewMatch(patternVariables, nil, nil)),
))
})
})
Expand Down Expand Up @@ -373,7 +375,7 @@ var _ = Describe("Regex", func() {

It("returns a result with a match using the pattern variables", func(ctx SpecContext) {
Expect(filter.Evaluate(defaultDetectorContext, patternVariables)).To(Equal(
filters.NewResult(filters.NewMatch(patternVariables, nil)),
filters.NewResult(filters.NewMatch(patternVariables, nil, nil)),
))
})
})
Expand Down Expand Up @@ -407,7 +409,7 @@ var _ = Describe("StringLengthLessThan", func() {

It("returns a result with a match using the pattern variables", func(ctx SpecContext) {
Expect(filter.Evaluate(detectorContext, patternVariables)).To(Equal(
filters.NewResult(filters.NewMatch(patternVariables, nil)),
filters.NewResult(filters.NewMatch(patternVariables, nil, nil)),
))
})
})
Expand Down Expand Up @@ -452,7 +454,7 @@ var _ = Describe("StringRegex", func() {

It("returns a result with a match using the pattern variables", func(ctx SpecContext) {
Expect(filter.Evaluate(detectorContext, patternVariables)).To(Equal(
filters.NewResult(filters.NewMatch(patternVariables, nil)),
filters.NewResult(filters.NewMatch(patternVariables, nil, nil)),
))
})
})
Expand Down Expand Up @@ -498,7 +500,7 @@ var _ = Describe("EntropyGreaterThan", func() {

It("returns a result with a match using the pattern variables", func(ctx SpecContext) {
Expect(filter.Evaluate(detectorContext, patternVariables)).To(Equal(
filters.NewResult(filters.NewMatch(patternVariables, nil)),
filters.NewResult(filters.NewMatch(patternVariables, nil, nil)),
))
})
})
Expand Down Expand Up @@ -541,7 +543,7 @@ var _ = Describe("IntegerLessThan", func() {

It("returns a result with a match using the pattern variables", func(ctx SpecContext) {
Expect(filter.Evaluate(defaultDetectorContext, patternVariables)).To(Equal(
filters.NewResult(filters.NewMatch(patternVariables, nil)),
filters.NewResult(filters.NewMatch(patternVariables, nil, nil)),
))
})
})
Expand Down Expand Up @@ -584,7 +586,7 @@ var _ = Describe("IntegerLessThanOrEqual", func() {

It("returns a result with a match using the pattern variables", func(ctx SpecContext) {
Expect(filter.Evaluate(defaultDetectorContext, patternVariables)).To(Equal(
filters.NewResult(filters.NewMatch(patternVariables, nil)),
filters.NewResult(filters.NewMatch(patternVariables, nil, nil)),
))
})

Expand All @@ -596,7 +598,7 @@ var _ = Describe("IntegerLessThanOrEqual", func() {

It("returns a result with a match using the pattern variables", func(ctx SpecContext) {
Expect(filter.Evaluate(defaultDetectorContext, patternVariables)).To(Equal(
filters.NewResult(filters.NewMatch(patternVariables, nil)),
filters.NewResult(filters.NewMatch(patternVariables, nil, nil)),
))
})
})
Expand Down Expand Up @@ -639,7 +641,7 @@ var _ = Describe("IntegerGreaterThan", func() {

It("returns a result with a match using the pattern variables", func(ctx SpecContext) {
Expect(filter.Evaluate(defaultDetectorContext, patternVariables)).To(Equal(
filters.NewResult(filters.NewMatch(patternVariables, nil)),
filters.NewResult(filters.NewMatch(patternVariables, nil, nil)),
))
})
})
Expand Down Expand Up @@ -682,7 +684,7 @@ var _ = Describe("IntegerGreaterThanOrEqual", func() {

It("returns a result with a match using the pattern variables", func(ctx SpecContext) {
Expect(filter.Evaluate(defaultDetectorContext, patternVariables)).To(Equal(
filters.NewResult(filters.NewMatch(patternVariables, nil)),
filters.NewResult(filters.NewMatch(patternVariables, nil, nil)),
))
})
})
Expand All @@ -694,7 +696,7 @@ var _ = Describe("IntegerGreaterThanOrEqual", func() {

It("returns a result with a match using the pattern variables", func(ctx SpecContext) {
Expect(filter.Evaluate(defaultDetectorContext, patternVariables)).To(Equal(
filters.NewResult(filters.NewMatch(patternVariables, nil)),
filters.NewResult(filters.NewMatch(patternVariables, nil, nil)),
))
})
})
Expand Down
1 change: 1 addition & 0 deletions pkg/scanner/detectors/customrule/types/types.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,4 +9,5 @@ type Data struct {
Pattern string
Datatypes []*detectortypes.Detection
Variables variableshape.Values
Value *string
}
Loading

0 comments on commit bd5275b

Please sign in to comment.