Documentation
¶
Overview ¶
Package filter classifies Renovate autodiscoverFilter values and reports whether they can be bypassed by an attacker-controlled repository path.
It ports the pattern-matching semantics of Renovate's matchRegexOrGlobList / isRegexMatch helpers so that verdicts match what the actual bot would do.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Finding ¶
type Finding struct {
// RuleID identifies the check: "V1"–"V4" for exploitable, "N2"–"N4" for broken/review, "INFO" for informational.
RuleID string
// Verdict is the security classification.
Verdict Verdict
// Pattern is the offending pattern, empty for list-level findings.
Pattern string
// Evidence contains adversarial inputs that passed the filter (probe findings only).
Evidence []string
// Message is a human-readable explanation.
Message string
}
Finding is a single classifier result for one pattern or the filter list as a whole.
type PatternKind ¶
type PatternKind int
PatternKind describes how a single pattern was classified.
const ( // KindGlob is a plain glob pattern compiled with gobwas/glob. KindGlob PatternKind = iota // KindRegex is a well-formed regex delimited by /…/ or /…/i. KindRegex // KindMalformedRegexFallback looks like a regex (leading/trailing /) but // its body fails RE2 compilation. Renovate silently degrades to glob here. KindMalformedRegexFallback )
type Verdict ¶
type Verdict int
Verdict classifies the security impact of a finding.
const ( // Safe means the filter appears structurally sound. Safe Verdict = iota // Vulnerable means an attacker-controlled path can bypass the filter. Vulnerable // Broken means the filter is syntactically wrong and silently does nothing. Broken // NeedsReview means the pattern is ambiguous (e.g., RE2 vs JS divergence). NeedsReview )
Source Files
Click to show internal directories.
Click to hide internal directories.