Documentation
¶
Overview ¶
Package loader reads Godzilla taint rules from YAML files (user-supplied or built-in) into rules.RuleSet values.
Fragments (`extend:`) ¶
To avoid copy-pasting the same source/propagator lists into every rulepack, a `_`-prefixed YAML file (e.g. rulepacks/_go-common.yaml) is a FRAGMENT: a partial rule (a mapping of pattern-list fields such as sources/propagators/ request_object_sources), not a rulepack. A rule pulls a fragment in with a top-level `extend: $_go-common.yaml` (or a list, `extend: [$_a.yaml, $_b.yaml]`); the loader appends each fragment's list fields ahead of the rule's own (deduped) before the rule is validated or compiled. A rule keeps its own scalar fields (id/severity/cwe/message) and adds its own sinks and any extra sources/propagators. Builtin fragments are always available; a user rules directory may add its own (or override a builtin of the same name).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Builtin ¶
Builtin loads Godzilla's embedded, shipped-in-the-binary rule set (the top-level rulepacks/*.yaml), expanding `$<fragment>` references against the embedded `_`-prefixed fragment files.
func LoadDefault ¶
LoadDefault returns Godzilla's built-in rules merged with the user-supplied rule file — or rulepack directory — at userPath, if any (userPath == "" means "no user rules"). User rules are appended after built-ins, so they take effect alongside (not instead of) the defaults.
Types ¶
This section is empty.
Source Files