pmat 3.15.0

PMAT - Zero-config AI context generation and code quality toolkit (CLI, MCP, HTTP)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

#![cfg_attr(coverage_nightly, coverage(off))]
//! Security rules for Makefile linting
//!
//! Implements high-priority security rules following TDD:
//! - ShellInjectionRule: Detect potential shell injection vulnerabilities
//! - SensitiveDataRule: Detect hardcoded secrets and credentials
//! - UnsafeCommandRule: Detect unsafe command usage
//! - PrivilegeEscalationRule: Detect potential privilege escalation

use super::{MakefileRule, Severity, Violation};
use crate::services::makefile_linter::ast::{MakefileAst, NodeData};
use regex::Regex;
use std::sync::OnceLock;

/// Detects potential shell injection vulnerabilities
#[derive(Debug, Default)]
pub struct ShellInjectionRule;

/// Detects hardcoded secrets and credentials
#[derive(Debug, Default)]
pub struct SensitiveDataRule;

/// Detects unsafe command usage
#[derive(Debug, Default)]
pub struct UnsafeCommandRule;

/// Detects potential privilege escalation
#[derive(Debug, Default)]
pub struct PrivilegeEscalationRule;

// --- Rule implementations ---
include!("security_rules.rs");

// --- Helper functions ---
include!("security_helpers.rs");

// --- Tests ---
#[cfg_attr(coverage_nightly, coverage(off))]
#[cfg(test)]
mod tests {
    use super::*;
    use crate::services::makefile_linter::parser::MakefileParser;

    include!("security_tests.rs");
}