module NoirPassiveScan

Defined in:

passive_scan/detect.cr
passive_scan/false_positive.cr
passive_scan/rules.cr

Class Method Summary

Class Method Detail

def self.detect(file_path : String, file_content : String, rules : Array(PassiveScan), logger : NoirLogger) : Array(PassiveScanResult) #

Pure detection: runs every supplied rule against file_content. Callers are responsible for pre-filtering by severity (see .filter_rules_by_severity). Returns an empty array (no allocation beyond the literal) when there are no rules to run, so callers can short-circuit on passive_scans.empty? before reading the file.


[View source]
def self.detect_with_severity(file_path : String, file_content : String, rules : Array(PassiveScan), logger : NoirLogger, min_severity : String) : Array(PassiveScanResult) #

Backwards-compatible entry point used by existing specs. Pre-filters the rule set by severity and dispatches to .detect.


[View source]
def self.filter_rules_by_severity(rules : Array(PassiveScan), min_severity : String) : Array(PassiveScan) #

Pre-filter the rule set against min_severity. Callers should run this once at scan-startup and pass the result into .detect per file, so the per-(file × rule) severity comparison is amortized down to a single pass over the rule set.


[View source]
def self.load_rules(path : String, logger : NoirLogger) : Array(PassiveScan) #

[View source]
def self.reject_duplicate_ids(rules : Array(PassiveScan), logger : NoirLogger) : Array(PassiveScan) #

Keep the first rule for each id and drop the rest.

A rule id is the finding's identity: it is what -f json reports, what SARIF uses as ruleId, and what a CI gate suppresses on. Two rules sharing an id therefore emitted two findings for the same line under the same id (SARIF then described both with whichever rule's metadata was seen first), and nothing said the rule set was inconsistent. This is also what deduplicates a repeated --passive-scan-path, which used to double every finding.


[View source]