agent-shield 1.0.2

Security scanner for AI agent extensions - offline-first, multi-framework, SARIF output
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

use std::collections::HashSet;

use crate::analysis::cross_file::SanitizerCategory;

pub(crate) fn sanitized_var_marker(var_name: &str, sanitizer_label: &str) -> String {
    format!("{var_name}::{sanitizer_label}")
}

pub(crate) fn sanitized_label_for_var(
    ident: &str,
    sanitized_vars: &HashSet<String>,
) -> Option<String> {
    for category in [
        SanitizerCategory::Path,
        SanitizerCategory::Network,
        SanitizerCategory::TypeCoercion,
    ] {
        let prefix = format!("{ident}::{}:", category.as_str());
        let mut matches: Vec<&str> = sanitized_vars
            .iter()
            .filter(|value| value.starts_with(&prefix))
            .map(|s| s.as_str())
            .collect();
        matches.sort();
        if let Some(marker) = matches.first() {
            return marker.split_once("::").map(|(_, label)| label.to_string());
        }
    }

    sanitized_vars.contains(ident).then(|| ident.to_string())
}