Documentation
¶
Overview ¶
Package starx holds the Starlark builtins shared by every script engine in Interseptor (passive checks, active checks, and any future engine). Centralising them here means a check author sees one consistent "standard library" and we don't re-implement — and re-test — the same helpers in two packages.
Everything here is sandbox-safe by construction: pure functions over their arguments, no file/network/clock access, no side effects. The only state is a regex compile cache (read-mostly sync.Map) so re_search doesn't recompile a pattern on every call inside a loop.
Index ¶
- Constants
- func AESECBDecrypt(key, ciphertext []byte) ([]byte, error)
- func AESECBDecryptBuiltin(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, ...) (starlark.Value, error)
- func AESECBEncrypt(key, plaintext []byte) ([]byte, error)
- func AESECBEncryptBuiltin(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, ...) (starlark.Value, error)
- func B64DecodeBuiltin(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, ...) (starlark.Value, error)
- func B64EncodeBuiltin(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, ...) (starlark.Value, error)
- func FindingBuiltin(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, ...) (starlark.Value, error)
- func HMACBuiltin(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, ...) (starlark.Value, error)
- func HashBuiltin(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, ...) (starlark.Value, error)
- func JSONDecodeBuiltin(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, ...) (starlark.Value, error)
- func JSONEncodeBuiltin(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, ...) (starlark.Value, error)
- func Predeclared() starlark.StringDict
- func ReSearchBuiltin(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, ...) (starlark.Value, error)
- func ScriptError(label string, err error) error
- func URLDecodeBuiltin(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, ...) (starlark.Value, error)
- func URLEncodeBuiltin(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, ...) (starlark.Value, error)
- type Metadata
Constants ¶
const ReMaxText = 256 << 10
Variables ¶
This section is empty.
Functions ¶
func AESECBDecrypt ¶ added in v1.5.3
AESECBDecrypt decrypts AES-ECB and strips PKCS7 padding.
func AESECBDecryptBuiltin ¶ added in v1.5.3
func AESECBDecryptBuiltin(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error)
AESECBDecryptBuiltin: aes_ecb_decrypt(key, ciphertext) → plaintext string. ciphertext may be raw bytes (as Starlark string) or standard base64.
func AESECBEncrypt ¶ added in v1.5.3
AESECBEncrypt pads with PKCS7 and encrypts with AES-ECB.
func AESECBEncryptBuiltin ¶ added in v1.5.3
func AESECBEncryptBuiltin(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error)
AESECBEncryptBuiltin: aes_ecb_encrypt(key, plaintext) → base64 ciphertext. key may be raw string bytes (len 16/24/32) or hex of that length.
func B64DecodeBuiltin ¶
func B64EncodeBuiltin ¶
func FindingBuiltin ¶
func FindingBuiltin(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error)
rest are optional and default to "".
func HMACBuiltin ¶
func HMACBuiltin(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error)
HMACBuiltin: hmac(algo, key, message) → lowercase hex digest.
func HashBuiltin ¶
func HashBuiltin(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error)
HashBuiltin: hash(algo, text) → lowercase hex digest.
func JSONDecodeBuiltin ¶
func JSONDecodeBuiltin(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error)
JSONDecodeBuiltin parses a JSON document into a Starlark value (dict/list/string/int/float/bool/None). Numbers are kept as exact integers when integral, floats otherwise.
func JSONEncodeBuiltin ¶
func JSONEncodeBuiltin(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error)
JSONEncodeBuiltin serializes a Starlark value to a compact JSON string.
func Predeclared ¶
func Predeclared() starlark.StringDict
Predeclared returns the builtins every Interseptor script can call. Engines merge this into their own predeclared dict (active scripts additionally bind `probe` at run time).
func ReSearchBuiltin ¶
func ReSearchBuiltin(_ *starlark.Thread, b *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error)
ReSearchBuiltin returns the first regex match as a string, or None.
func ScriptError ¶
ScriptError formats a script error so the source position is included when the Starlark interpreter knows it. EvalError.Error() returns only the message line; its Backtrace() carries the file:line:col that makes an authoring typo debuggable.
func URLDecodeBuiltin ¶
Types ¶
type Metadata ¶
type Metadata struct {
Name string `json:"name,omitempty"`
Description string `json:"description,omitempty"`
Severity string `json:"severity,omitempty"`
Author string `json:"author,omitempty"`
Version string `json:"version,omitempty"`
Homepage string `json:"homepage,omitempty"`
License string `json:"license,omitempty"`
Extra map[string]string `json:"extra,omitempty"`
}
Metadata is the structured front-matter parsed from a check's leading `# key: value` comment block. It carries provenance (author, version, homepage) so a rule-pack installer can pin versions and show what a check does without reading its source. Unknown keys are kept in Extra for forward compatibility.
func ParseMetadata ¶
ParseMetadata reads a leading run of `#`-comment lines from src and collects any `# key: value` pairs. Parsing stops at the first non-comment line, so a check's in-code comments after the front-matter are left alone.
Source Files