annotation
Noir::TaggerFor
Overview
Marks a Tagger (or FrameworkTagger) subclass as one entry in the
tagger registry.
@[Noir::TaggerFor(key: "hunt", name: "HuntParam Tagger",
desc: "Identifies common parameters vulnerable to certain vulnerability classes",
order: 10)]
class HuntParamTagger < TaggerNoirTaggers reads the registry off the annotated classes, so this line
is the only place a tagger's -T key, its noir list taggers name and
description, and the class that runs it are written down. Before it those
facts lived in two hand-maintained hash literals; a new tagger file that
nobody added to them compiled, shipped, and silently never ran.
key stays explicit rather than derived from the class name: four of the
43 do not follow from it (hunt from HuntParamTagger, oauth from
OAuthTagger, fastapi_auth from FastAPIAuthTagger,
fastendpoints_auth from FastEndpointsAuthTagger). It is also the
tagger's name at runtime — Tagger#initialize reads it back off the
class, so the two can no longer disagree.
order fixes the sequence plain taggers run in, which is user-visible:
they run sequentially, Endpoint#add_tag appends, and nothing sorts tags
before output. Values are spaced by 10 so a tagger can be slotted between
two others without renumbering. Framework taggers run under a WaitGroup,
so for them it only orders noir list taggers.
The Tagger and FrameworkTagger base classes carry no annotation and
stay out of the registry — which is also why they can remain instantiable
for the specs that exercise their default perform.