bonsai-ninja-security 0.3.1

Security rulepack loader, matcher, and source/sink/sanitizer wrapper for bonsai-ninja.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96

//! `bonsai_security` — rulepack-driven security wrapper around
//! `bonsai_inspect`.
//!
//! The crate implements the spec in `docs/security-spec.mdx`:
//!
//! * YAML rulepack loader, one per supported language.
//! * Rule → `inspect`-flag compiler (no second query language).
//! * Source / sink / sanitizer matchers over browse facts.
//! * Finding builder with stable `S:` ids + taint / edge / flow
//!   drill-down ids.
//! * Dependency inventory from rule metadata + workspace imports.
//! * Render adapters for grouped / compact / graph / train JSON.
//!
//! The `bonsai-ninja` CLI security commands are a thin front for the types and
//! functions re-exported here.

// External API is the re-exports below. Tests under `tests/`
// legitimately use `bonsai_security::loader::LanguagePack` and
// `bonsai_security::rule::TrustClass`, so those two stay `pub`. The
// remaining submodules are internal — consumers go through the
// re-exports.
pub(crate) mod analysis;
mod bundled;
pub(crate) mod compile;
pub(crate) mod deps;
pub(crate) mod deps_analysis;
pub(crate) mod finding;
pub mod flow_evidence;
pub mod loader;
pub(crate) mod matcher;
pub(crate) mod pkg;
pub(crate) mod report;
pub mod rule;
pub(crate) mod sanitizer_credit;

pub use analysis::{
    dependency_inventory, filter_rules_to_workspace_languages, inventory_rule_ids, pack_audit,
    pack_inventory, pack_tree, pack_tree_for_rules, rule_family, rule_yaml_block, run_sink_analysis,
    run_sink_analysis_with_phase_progress, run_sink_analysis_with_progress, run_source_analysis,
    run_source_analysis_with_phase_progress, run_source_analysis_with_progress, run_taint_analysis,
    run_taint_analysis_with_phase_progress, run_taint_analysis_with_progress, sanitizer_inventory,
    sanitizer_inventory_with_progress, security_match_rows, seed_idg_service_for_rulepack, select_pack_rules,
    select_rules, sink_inventory, sink_inventory_with_progress, source_inventory,
    source_inventory_with_progress, source_rule_matches_filters, taint_transfers_from_rulepack,
    tree_file_rel, validate_pack, workspace_languages, AnalysisProgress, CombinedFindingWithChain,
    CombinedSourceAnalysisCandidate, DependencyInventoryOptions, FindingWithChain, PackAuditCount,
    PackAuditFamilyCount, PackAuditLanguage, PackAuditReport, PackInventoryOptions, PackRuleRow,
    PackTreeFile, PackTreeLanguage, PackTreeReport, PackTreeRule, PackValidationIssue, PackValidationReport,
    RulepackTaintTransfers, SecurityInventoryOptions, SecurityMatchRow, SinkAnalysisCandidate,
    SinkAnalysisFlow, SinkAnalysisOptions, SinkAnalysisReport, SourceAnalysisCandidate,
    SourceAnalysisOptions, SourceAnalysisReport, TaintAnalysisOptions, TaintAnalysisReport,
};
pub use bundled::bundled_rulepack_root;
pub use compile::{compile_rule_to_inspect_args, CompiledRule};
pub use deps::{build_inventory, DependencyInventory, DependencyRow};
pub use deps_analysis::{
    dependency_analysis, dependency_analysis_with_matches, DependencyAnalysisCandidate,
    DependencyAnalysisOptions, DependencyAnalysisReport, DependencyInventoryMatches, DependencyUsageSite,
};
pub use finding::{
    compute_finding_id, AlternateTaintFlow, Finding, FindingMatch, FindingStatus, TaintFlowRef,
    TaintPropagationArg, TaintPropagationStep, TaintedArgInfo,
};
pub use flow_evidence::{build_flow_bodies, FlowBodyCache, FlowFunctionBody, FlowRole, FlowSourceLine};
pub use loader::{
    load_rulepack, load_workspace_local_rules, parse_severity, rulepack_semantic_files, LanguageRuleMetadata,
    LoadError, PackageMatchSemantics, PackageTailBindingSemantics, Rulepack, RulepackMetadata,
    SecurityProfileMetadata,
};
pub use matcher::{
    drain_runtime_disabled_rules, infer_entry_point_sources, match_rule_against_facts,
    match_rules_against_facts, match_rules_against_facts_with_progress, InterTaintView, RuleMatch,
    RuntimeDisabledRule, MATCHER_POLICY_FINGERPRINT,
};
pub use report::{
    render_deps_text, render_graph_json, render_grouped_text, render_sarif_json, render_train_json,
    SecurityReport,
};
pub use rule::{
    AnalysisSemantics, ArgTaintedSpec, CharacterConstraintProviderSemantics, CharacterConstraintSemantics,
    CompilerGuardSemantics, ConfiguredArgumentFactoryGuardSemantics,
    ConfiguredArgumentReceiverGuardSemantics, ConfiguredCallArgumentGuardSemantics,
    ConfiguredFactoryAggregateArgumentSemantics, ConstraintKind, ContextFlowRole, ContextFlowSemantics,
    DynamicKeyDenylistGuardSemantics, FlowClass, GuardProfile, GuardedPredicateRequirement,
    LifecycleBindingTarget, LifecycleTransitionSemantics, MatchKind, MatchOrigin, MatchSpec, MustAliasSpec,
    NoSqlFilterSemantics, ParameterizedQuerySemantics, PathConsumerContainmentGuardSemantics,
    PathContainmentGuardSemantics, PayloadType, PostSinkPolicy, ReceiverCallbackConfigurationGuardSemantics,
    ReceiverConfigurationGuardSemantics, ReceiverFactoryArgumentFieldsSpec, ReceiverFactoryGuardSemantics,
    RelativePathContainmentGuardSemantics, RequiredAggregateFieldSemantics, RequiredCallArgumentSemantics,
    RequiredNamedArgumentSemantics, RequiredReceiverCallSemantics, RequiresStateSpec, Rule,
    RuleBindingOrigin, RuleConstraint, RuleKind, RuleTarget, RuntimeTypeSpec,
    SameOriginPathConstraintSemantics, SanitizerAttachmentPolicy, SanitizerGuardSemantics, Severity,
    TrustClass, UrlAddressParserSemantics, UrlComponentSemantics, UrlDnsGuardSemantics,
    UrlGuardRootSemantics, UrlHostAllowlistSemantics, UrlNetworkGuardSemantics,
    UrlReconstructionGuardSemantics, UrlRedirectGuardSemantics, UrlSchemeGuardSemantics,
};