-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathmodels.rs
More file actions
164 lines (149 loc) · 4.25 KB
/
models.rs
File metadata and controls
164 lines (149 loc) · 4.25 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
//! # `lsec`
//!
//! Laravel Security Audit CLI for scanning Laravel applications for
//! common security issues, insecure patterns, and risky configuration.
//!
//! (c) 2026 Afaan Bilal <https://afaan.dev>
//!
use std::path::PathBuf;
use serde::Serialize;
use crate::config::Config;
#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Serialize)]
#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
pub enum Severity {
Critical,
High,
Medium,
Low,
Info,
}
impl Severity {
pub fn as_str(&self) -> &'static str {
match self {
Severity::Critical => "CRITICAL",
Severity::High => "HIGH",
Severity::Medium => "MEDIUM",
Severity::Low => "LOW",
Severity::Info => "INFO",
}
}
pub fn parse_soft(value: &str) -> Option<Self> {
match value.trim().to_ascii_lowercase().as_str() {
"critical" => Some(Severity::Critical),
"high" => Some(Severity::High),
"medium" => Some(Severity::Medium),
"low" => Some(Severity::Low),
"info" => Some(Severity::Info),
_ => None,
}
}
}
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize)]
#[serde(rename_all = "snake_case")]
pub enum Category {
Env,
Auth,
Injection,
Http,
Storage,
Deps,
Secrets,
Logging,
}
impl Category {
pub fn parse(value: &str) -> Result<Self, String> {
match value.trim().to_ascii_lowercase().as_str() {
"env" => Ok(Self::Env),
"auth" => Ok(Self::Auth),
"injection" => Ok(Self::Injection),
"http" => Ok(Self::Http),
"storage" => Ok(Self::Storage),
"deps" => Ok(Self::Deps),
"secrets" => Ok(Self::Secrets),
"logging" => Ok(Self::Logging),
other => Err(format!("unknown rule category: {other}")),
}
}
pub fn as_str(&self) -> &'static str {
match self {
Category::Env => "env",
Category::Auth => "auth",
Category::Injection => "injection",
Category::Http => "http",
Category::Storage => "storage",
Category::Deps => "deps",
Category::Secrets => "secrets",
Category::Logging => "logging",
}
}
}
#[derive(Debug, Clone, Serialize)]
pub struct Finding {
pub rule_id: &'static str,
pub title: String,
pub message: String,
pub remediation: &'static str,
pub confidence: f32,
pub severity: Severity,
pub category: Category,
pub file: Option<String>,
pub line: Option<usize>,
pub snippet: Option<String>,
}
impl Finding {
pub fn fingerprint(&self) -> String {
format!(
"{}|{}|{}|{}",
self.rule_id,
self.file.as_deref().unwrap_or("-"),
self.line
.map(|line| line.to_string())
.as_deref()
.unwrap_or("-"),
self.title
)
}
}
#[derive(Debug, Clone, Copy)]
pub struct RuleMeta {
pub id: &'static str,
pub title: &'static str,
pub category: Category,
pub default_severity: Severity,
}
#[derive(Debug, Clone)]
pub struct ScanContext {
pub root: PathBuf,
pub config: Config,
pub only: Vec<Category>,
pub skip: Vec<Category>,
pub only_rule_ids: Vec<String>,
pub skip_rule_ids: Vec<String>,
pub min_confidence: Option<f32>,
pub ci: bool,
}
impl ScanContext {
pub fn category_enabled(&self, category: Category) -> bool {
if self.skip.contains(&category) {
return false;
}
self.only.is_empty() || self.only.contains(&category)
}
pub fn rule_enabled(&self, rule_id: &str, category: Category) -> bool {
if !self.category_enabled(category) {
return false;
}
if self.skip_rule_ids.iter().any(|id| id == rule_id) {
return false;
}
self.only_rule_ids.is_empty() || self.only_rule_ids.iter().any(|id| id == rule_id)
}
pub fn confidence_enabled(&self, rule_id: &str, confidence: f32) -> bool {
let threshold = self
.config
.rule_min_confidence(rule_id)
.or(self.min_confidence)
.unwrap_or(0.0);
confidence >= threshold
}
}