use super::*;
pub(crate) const METADATA_RULES: &[RuleDefinition] = &[
rule_definition!(
"modernisation.public-field",
"Public struct field",
Pillar::Modernisation,
RuleKind::Rust,
Severity::Advisory,
Confidence::High,
None,
"Flags public struct fields that expose representation.",
),
rule_definition!(
"metrics.halstead-volume",
"Halstead-style volume",
Pillar::Complexity,
RuleKind::Rust,
Severity::Advisory,
Confidence::Medium,
METRICS_HALSTEAD_VOLUME_THRESHOLD,
"Flags functions whose deterministic token volume exceeds the configured threshold.",
),
rule_definition!(
"metrics.maintainability-pressure",
"Maintainability pressure",
Pillar::Complexity,
RuleKind::Rust,
Severity::Advisory,
Confidence::Medium,
METRICS_MAINTAINABILITY_PRESSURE_THRESHOLD,
"Flags functions whose maintainability pressure score falls below the configured minimum.",
),
];
const NAMING_GENERIC_FUNCTION_OPTIONS: &[OptionDefinition] = &[OptionDefinition {
name: "extraGenericNames",
description: "Additional generic function names rejected by naming.generic-function.",
value_kind: OptionValueKind::StringArray,
}];
const NAMING_BOOLEAN_PREFIX_OPTIONS: &[OptionDefinition] = &[OptionDefinition {
name: "predicatePrefixes",
description: "Additional predicate prefixes accepted by naming.boolean-prefix.",
value_kind: OptionValueKind::StringArray,
}];
const NAMING_PLACEHOLDER_OPTIONS: &[OptionDefinition] = &[OptionDefinition {
name: "extraPlaceholders",
description: "Additional placeholder identifiers rejected by naming.placeholder-identifier.",
value_kind: OptionValueKind::StringArray,
}];
pub(crate) const NAMING_RULES: &[RuleDefinition] = &[
RuleDefinition {
id: "naming.generic-function",
name: "Generic function name",
pillar: Pillar::Naming,
tier: "v0.1",
kind: RuleKind::Rust,
default_severity: Severity::Advisory,
confidence: Confidence::High,
threshold: None,
options: NAMING_GENERIC_FUNCTION_OPTIONS,
default_enabled: true,
description: "Flags function names that are too generic to explain intent.",
},
RuleDefinition {
id: "naming.boolean-prefix",
name: "Boolean predicate prefix",
pillar: Pillar::Naming,
tier: "v0.1",
kind: RuleKind::Rust,
default_severity: Severity::Advisory,
confidence: Confidence::High,
threshold: None,
options: NAMING_BOOLEAN_PREFIX_OPTIONS,
default_enabled: true,
description: "Flags bool-returning functions whose names do not read like predicates.",
},
RuleDefinition {
id: "naming.placeholder-identifier",
name: "Placeholder identifier",
pillar: Pillar::Naming,
tier: "v0.1",
kind: RuleKind::Rust,
default_severity: Severity::Advisory,
confidence: Confidence::Medium,
threshold: None,
options: NAMING_PLACEHOLDER_OPTIONS,
default_enabled: true,
description: "Flags placeholder identifiers such as foo, bar, baz, and qux.",
},
rule_definition!(
"naming.short-variable",
"Short variable name",
Pillar::Naming,
RuleKind::Rust,
Severity::Advisory,
Confidence::Medium,
None,
"Flags very short local variable names outside accepted abbreviations.",
),
rule_definition!(
"naming.identifier-shadow",
"Identifier shadow",
Pillar::Naming,
RuleKind::Rust,
Severity::Advisory,
Confidence::High,
None,
"Flags `let X = X(...)` bindings that shadow a same-file free function.",
),
];
pub(crate) const PERFORMANCE_AND_SECURITY_RULES: &[RuleDefinition] = &[
rule_definition!(
"ci.github-event-shell-interpolation",
"GitHub event shell interpolation",
Pillar::Security,
RuleKind::Text,
Severity::Warning,
Confidence::High,
None,
"Flags GitHub event values interpolated directly into workflow shell steps.",
),
rule_definition!(
"config.security-blind-ignore",
"Security-blind path ignore",
Pillar::Security,
RuleKind::Text,
Severity::Advisory,
Confidence::High,
None,
"Flags paths.ignore entries that can hide security-relevant files from analysis.",
),
rule_definition!(
"performance.clone-in-loop",
"Clone in loop",
Pillar::Waste,
RuleKind::Rust,
Severity::Advisory,
Confidence::Medium,
None,
"Flags clone calls inside loop bodies as allocation hot spot candidates.",
),
rule_definition!(
"performance.format-in-loop",
"Format in loop",
Pillar::Waste,
RuleKind::Rust,
Severity::Advisory,
Confidence::Medium,
None,
"Flags format! calls inside loop bodies as allocation hot spot candidates.",
),
rule_definition!(
"performance.regex-in-loop",
"Regex construction in loop",
Pillar::Waste,
RuleKind::Rust,
Severity::Warning,
Confidence::High,
None,
"Flags Regex::new calls inside loop bodies.",
),
rule_definition!(
"security.process-command",
"Process command execution",
Pillar::Security,
RuleKind::Rust,
Severity::Warning,
Confidence::High,
None,
"Flags process command construction for manual argument validation.",
),
rule_definition!(
"security.insecure-rng-for-secrets",
"Insecure RNG for secret material",
Pillar::Security,
RuleKind::Rust,
Severity::Warning,
Confidence::Medium,
None,
"Flags non-cryptographic rand calls inside secret-like generation functions.",
),
rule_definition!(
"security.sql-dynamic-query",
"Dynamic SQL query argument",
Pillar::Security,
RuleKind::Rust,
Severity::Warning,
Confidence::High,
None,
"Flags direct dynamic SQL query arguments such as query(format!(...)).",
),
rule_definition!(
"security.tls-verification-disabled",
"TLS verification disabled",
Pillar::Security,
RuleKind::Rust,
Severity::Warning,
Confidence::High,
None,
"Flags explicit TLS certificate or hostname verification bypasses.",
),
rule_definition!(
"security.unsafe-block",
"Unsafe block",
Pillar::Security,
RuleKind::Rust,
Severity::Warning,
Confidence::High,
None,
"Flags unsafe blocks without a nearby SAFETY rationale.",
),
rule_definition!(
"security.weak-crypto",
"Weak cryptographic primitive",
Pillar::Security,
RuleKind::Rust,
Severity::Warning,
Confidence::Medium,
None,
"Flags explicit weak cryptographic primitive imports or constructors for review.",
),
];
pub(crate) const SENSITIVE_DATA_RULES: &[RuleDefinition] = &[
rule_definition!(
"sensitive-data.api-key-pattern",
"API key pattern",
Pillar::SensitiveData,
RuleKind::Text,
Severity::Error,
Confidence::High,
None,
"Flags common API key patterns.",
),
rule_definition!(
"sensitive-data.aws-access-key",
"AWS access key",
Pillar::SensitiveData,
RuleKind::Text,
Severity::Error,
Confidence::High,
None,
"Flags AWS access key patterns.",
),
rule_definition!(
"sensitive-data.database-url-password",
"Database URL password",
Pillar::SensitiveData,
RuleKind::Text,
Severity::Error,
Confidence::High,
None,
"Flags database URLs that appear to include passwords.",
),
rule_definition!(
"sensitive-data.hardcoded-env-value",
"Hardcoded environment-style secret",
Pillar::SensitiveData,
RuleKind::Text,
Severity::Error,
Confidence::High,
None,
"Flags secret-like KEY=value literals committed in source or config.",
),
rule_definition!(
"sensitive-data.high-entropy-string",
"High entropy string",
Pillar::SensitiveData,
RuleKind::Text,
Severity::Error,
Confidence::Medium,
None,
"Flags long string literals that look like generated secrets.",
),
rule_definition!(
"sensitive-data.jwt-token",
"JWT token",
Pillar::SensitiveData,
RuleKind::Text,
Severity::Error,
Confidence::High,
None,
"Flags JWT-looking token strings.",
),
rule_definition!(
"sensitive-data.private-key",
"Private key block",
Pillar::SensitiveData,
RuleKind::Text,
Severity::Error,
Confidence::High,
None,
"Flags private key block markers.",
),
rule_definition!(
"sensitive-data.url-embedded-credentials",
"URL embedded credentials",
Pillar::SensitiveData,
RuleKind::Text,
Severity::Error,
Confidence::High,
None,
"Flags HTTP(S) URLs that include embedded username and password credentials.",
),
];
pub(crate) const SIZE_RULES: &[RuleDefinition] = &[
rule_definition!(
"size.file-length",
"File length",
Pillar::Size,
RuleKind::Text,
Severity::Warning,
Confidence::High,
FILE_LENGTH_THRESHOLD,
"Flags files over the configured line-count threshold.",
),
rule_definition!(
"size.function-length",
"Function length",
Pillar::Size,
RuleKind::Rust,
Severity::Warning,
Confidence::High,
FUNCTION_LENGTH_THRESHOLD,
"Flags functions over the configured line-count threshold.",
),
rule_definition!(
"size.parameter-count",
"Parameter count",
Pillar::Size,
RuleKind::Rust,
Severity::Warning,
Confidence::High,
PARAMETER_COUNT_THRESHOLD,
"Flags functions with too many parameters.",
),
];
pub(crate) const TEST_QUALITY_RULES: &[RuleDefinition] = &[
rule_definition!(
"test-quality.conditional-logic",
"Conditional logic in test",
Pillar::TestQuality,
RuleKind::Rust,
Severity::Advisory,
Confidence::High,
None,
"Flags tests that contain conditional logic.",
),
rule_definition!(
"test-quality.ignored-without-reason",
"Ignored test without reason",
Pillar::TestQuality,
RuleKind::Rust,
Severity::Advisory,
Confidence::High,
None,
"Flags ignored tests that do not explain why they are skipped.",
),
rule_definition!(
"test-quality.long-test",
"Long test",
Pillar::TestQuality,
RuleKind::Rust,
Severity::Advisory,
Confidence::High,
TEST_LONG_THRESHOLD,
"Flags long test functions that are harder to scan and maintain.",
),
rule_definition!(
"test-quality.loop-in-test",
"Loop in test",
Pillar::TestQuality,
RuleKind::Rust,
Severity::Advisory,
Confidence::High,
None,
"Flags tests that contain loop logic.",
),
rule_definition!(
"test-quality.no-assertions",
"No assertions in test",
Pillar::TestQuality,
RuleKind::Rust,
Severity::Warning,
Confidence::High,
None,
"Flags tests that do not appear to assert behavior.",
),
rule_definition!(
"test-quality.sleep-in-test",
"Sleep in test",
Pillar::TestQuality,
RuleKind::Rust,
Severity::Advisory,
Confidence::High,
None,
"Flags tests that sleep instead of synchronizing on behavior.",
),
rule_definition!(
"test-quality.trivial-assertion",
"Trivial assertion",
Pillar::TestQuality,
RuleKind::Rust,
Severity::Warning,
Confidence::High,
None,
"Flags assertions that prove literals or constants instead of behavior.",
),
rule_definition!(
"test-quality.unwrap-in-test",
"Unwrap in test",
Pillar::TestQuality,
RuleKind::Rust,
Severity::Advisory,
Confidence::High,
None,
"Flags unwrap calls in tests.",
),
];
pub(crate) const WASTE_RULES: &[RuleDefinition] = &[
rule_definition!(
"waste.unnecessary-clone-candidate",
"Unnecessary clone candidate",
Pillar::Waste,
RuleKind::Rust,
Severity::Advisory,
Confidence::High,
None,
"Flags clone calls that may be avoidable.",
),
rule_definition!(
"waste.unreachable-code",
"Unreachable code",
Pillar::Waste,
RuleKind::Rust,
Severity::Warning,
Confidence::High,
None,
"Flags statements after terminating statements.",
),
rule_definition!(
"waste.unwrap-expect",
"Unwrap or expect",
Pillar::Waste,
RuleKind::Rust,
Severity::Advisory,
Confidence::High,
None,
"Flags unwrap and expect calls outside test attributes.",
),
];