slopguard-rules 0.1.9

Builtin rule definitions for slopguard
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

id: no-format-path
language: rust
severity: error
category: security
message: "format!() to build a file path. Use Path::join() and validate the input."
note: "Path traversal via ../ if input is not validated. Validate the identifier (UUID, alphanum) before building the path."
rule:
  kind: macro_invocation
  all:
    - has:
        field: macro
        regex: '^format$'
    - has:
        kind: token_tree
        has:
          kind: string_literal
          regex: '(/tmp/|/var/|/etc/|\.pdf|\.json|\.csv|\.txt|\.log|\.toml|\.yaml|\.yml)\{|\{[^}]*(path|file|dir|name|id)[^}]*\}\.(pdf|json|csv|txt|log)'
ignores:
  - "**/tests/**"
  - "**/*_tests/**"
  - "**/*_test/**"
  - "**/test_*"
  - "**/*_test.rs"
  - "**/fixtures/**"
skip_test_code: true
tests:
  should_match:
    - 'let p = format!("/tmp/{}.json", user_id);'
    - 'let p = format!("{file_name}.pdf");'
  should_not_match:
    - 'let msg = format!("hello {}", name);'
    - 'let p = base_dir.join(format!("{}.json", id));'