zift 0.2.2

Scan codebases for embedded authorization logic and generate Policy as Code (Rego/OPA today)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

[rule]
id = "java-cedar-eval"
languages = ["java"]
category = "custom"
confidence = "high"
description = "Cedar policy evaluation in Java (AuthorizationEngine.isAuthorized)"
externalized = true
query = """
(method_invocation
  object: (_) @receiver
  name: (identifier) @method_name
) @match
"""

[rule.predicates.method_name]
eq = "isAuthorized"

[rule.predicates.receiver]
match = "(?i)(authorizationengine|engine|authorizer|cedar|authz)"

[[rule.tests]]
input = """
import com.cedarpolicy.AuthorizationEngine;

class Handler {
    boolean decide(AuthorizationEngine engine, Request request) {
        return engine.isAuthorized(request).isAllowed();
    }
}
"""
expect_match = true

[[rule.tests]]
input = """
class Handler {
    void run(Service svc) {
        svc.process(input);
    }
}
"""
expect_match = false