|
31 | 31 | * also the old syntax.
|
32 | 32 | *
|
33 | 33 | * TODO:
|
34 |
| - * - extract |
35 | 34 | * - secrets
|
36 | 35 | * - steps (but not join)
|
37 | 36 | * - new metavariable types
|
@@ -66,35 +65,43 @@ type rule = {
|
66 | 65 | message: string;
|
67 | 66 | severity: severity;
|
68 | 67 |
|
69 |
| - (* TODO: selector vs analyzer *) |
| 68 | + (* later: selector vs analyzer of Martin *) |
70 | 69 | languages: language list;
|
71 | 70 |
|
72 | 71 | (* CHECK: exactly one of those fields must be set *)
|
73 | 72 | ?match_ <json name="match">: formula option;
|
74 | 73 | ?taint: taint option;
|
75 |
| - ?extract: extract option; |
76 |
| - (* TODO: steps, secrets *) |
77 |
| - (* TODO? product: product; *) |
| 74 | + (* TODO: steps:, secrets: *) |
78 | 75 |
|
79 |
| - (* can work with match/taint/..., maybe not extract *) |
| 76 | + (* work with match: (and in theory also with taint: ) *) |
80 | 77 | ?project_depends_on <json name="r2c-internal-project-depends-on">:
|
81 | 78 | project_depends_on option;
|
| 79 | + (* work with match: (and in theory also with taint: ) |
| 80 | + * |
| 81 | + * alt: message:/severity: could be made optional when extract: is set, |
| 82 | + * but it's annoying to change those types just for extract. Moreover, |
| 83 | + * users can easily put severity: INFO and a fake message:, |
| 84 | + * and at least they can easily test the matching part of the rule |
| 85 | + * by removing the extract and run it like a regular rule. |
| 86 | + *) |
| 87 | + ?extract: extract option; |
82 | 88 |
|
83 |
| - (* alt: later: could be replaced by a pattern-filename: *) |
| 89 | + (* alt: later: could be replaced by a 'filename:' in formula *) |
84 | 90 | ?paths: paths option;
|
85 | 91 |
|
86 | 92 | ?fix: string option;
|
87 | 93 | ?fix_regex: fix_regex option;
|
88 | 94 |
|
89 |
| - (* TODO? impose more constraints on metadata? standard fields? *) |
90 |
| - ?metadata: raw_json option; |
| 95 | + (* later: equivalences: ... *) |
91 | 96 | ?options: rule_options option;
|
92 | 97 |
|
93 |
| - ?version: version option; |
| 98 | + (* TODO? impose more constraints on metadata? standard fields? |
| 99 | + * TODO? add also a product: product; ? |
| 100 | + *) |
| 101 | + ?metadata: raw_json option; |
| 102 | + |
94 | 103 | ?min_version: version option;
|
95 | 104 | ?max_version: version option;
|
96 |
| - |
97 |
| - (* later: equivalences: ... *) |
98 | 105 | }
|
99 | 106 |
|
100 | 107 | (* Rule_ID.t, "^[a-zA-Z0-9._-]*$" *)
|
@@ -284,7 +291,7 @@ type formula = {
|
284 | 291 |
|
285 | 292 | (* later: we should remove with a better range logic *)
|
286 | 293 | ?inside: formula option;
|
287 |
| - (* NEW: since 1.49 *) |
| 294 | + (* NEW: since 1.49. alt: in condition instead as in 'where: - also: ...' *) |
288 | 295 | ?anywhere: formula option;
|
289 | 296 | (* TODO? ?taint: taint *)
|
290 | 297 |
|
@@ -498,11 +505,34 @@ type namespace = [
|
498 | 505 | type semver_range = string
|
499 | 506 |
|
500 | 507 | (*****************************************************************************)
|
501 |
| -(* TODO: Extract mode *) |
| 508 | +(* Extract *) |
502 | 509 | (*****************************************************************************)
|
503 | 510 |
|
504 |
| -type extract = raw_json |
| 511 | +type extract = { |
| 512 | + metavariable: mvar; |
| 513 | + ?dest_language <json name="dest-language">: language option; |
| 514 | + ?dest_rules <json name="dest-rules">: dest_rules option; |
| 515 | + (* map-reduce! *) |
| 516 | + ?reduce: extract_reduce option; |
| 517 | + ?transform: extract_transform option; |
| 518 | +} |
| 519 | + |
| 520 | +type dest_rules = { |
| 521 | + (* CHECK: at least one of those options is set *) |
| 522 | + ?exclude_ <json name="exclude">: rule_id list option; |
| 523 | + ?include_ <json name="include">: rule_id list option; |
| 524 | +} |
505 | 525 |
|
| 526 | +type extract_reduce = [ |
| 527 | + | Concat <json name="concat"> |
| 528 | + | Separate <json name="separate"> |
| 529 | +] |
| 530 | + |
| 531 | +type extract_transform = [ |
| 532 | + | NoTransform <json name="no_transform"> |
| 533 | + | UnquoteString <json name="unquote_string"> |
| 534 | + | ConcatJsonStringArray <json name="concat_json_string_array"> |
| 535 | +] |
506 | 536 | (*****************************************************************************)
|
507 | 537 | (* TODO: Secrets *)
|
508 | 538 | (*****************************************************************************)
|
|
0 commit comments