Crate shapash 

Shapash — A deterministic, auditable forward-chaining rule engine

Shapash orchestrates rules; HEL (external crate) evaluates expressions.

Rule File Format

Rules are defined in TOML .rule files with the following structure:

[[rule]]
id = "dangerous-taint-flow"
description = "Dangerous taint flow from network to unsafe sink"
condition = "TaintFlow.sink == \"strcpy\""  # Inline HEL expression
score = 75
justification = "strcpy is unsafe with untrusted input"

[[rule]]
id = "complex-check"
description = "Complex security check"
condition_file = "conditions/nx-check.hel"  # External HEL file
score = 85
justification = "NX bit should be enabled"

Structs

BinaryInfo

Binary metadata fact

FactSetResolver

Adapter that implements HelResolver over a HashSet<Fact>

FunctionCall

Function call observation

HeuristicEngine

Forward-chaining rule engine with pluggable scoring

HeuristicReport

Report generated after rule evaluation

HeuristicRule

A heuristic rule with metadata and condition expression

ImportInfo

Import/symbol fact

MemoryOperation

Memory operation observation

RuleEvaluationTrace

Trace of a single rule evaluation

SectionInfo

Section information fact

SecurityFlags

Security flags fact

SimpleSumClampScorer

Simple sum-and-clamp scorer (default OSS implementation)

SymQueryRequest

Symbolic execution query request

SymQueryResult

Symbolic execution query result

TaintFlow

Taint flow analysis result

TriggeredRuleInfo

Information about a triggered rule

Enums

ConfidenceLevel

Error

Fact

A fact in the rule evaluation system

RuleEvaluationResult

Result of evaluating a single rule

Value

Runtime value type for HEL evaluation

Traits

HelResolver

Resolver interface for host integration

ScoringModel

Pluggable scoring model trait

Type Aliases

Result