Documentation
¶
Overview ¶
Package testsupport holds the small helpers shared by test packages across the repo: the toolchain-presence skip (RequireTool) and the one-rule RuleSet builder (OneRuleSet).
It lives outside internal/rules on purpose: OneRuleSet must fill RuleSet.DefaultPropagators from the shipped `_default-propagators.yaml` fragment, which only internal/rules/loader can read — and loader imports rules, so the builder cannot live in rules without a cycle.
Index ¶
- func DefaultPropagators(t testing.TB) []string
- func OneRuleSet(t testing.TB, id, lang, cwe string, sources, sinks []string, opts ...RuleOpt) *rules.RuleSet
- func RequireNoFallbackIntrinsic(t testing.TB, prog *ir.Program, intrinsic, what string)
- func RequireTool(t testing.TB, name string)
- type RuleOpt
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DefaultPropagators ¶
DefaultPropagators returns the shipped `_default-propagators.yaml` list. A test that builds its own RuleSet must set RuleSet.DefaultPropagators from this to behave like a real scan: the defaults are loader-supplied data, so a bare RuleSet literal legitimately has none and taint dies at the first stdlib transform (fmt.Sprintf, strings.ToLower, ...).
func OneRuleSet ¶
func OneRuleSet(t testing.TB, id, lang, cwe string, sources, sinks []string, opts ...RuleOpt) *rules.RuleSet
OneRuleSet builds a single-rule RuleSet — the shape almost every engine and converter test wants — with RuleSet.DefaultPropagators always populated (see DefaultPropagators). Sink patterns may carry the usual "#idx" suffix.
func RequireNoFallbackIntrinsic ¶
RequireNoFallbackIntrinsic asserts that no instruction in prog lowered to a frontend's fallback intrinsic ("js.unsupported", "py.unsupported", …).
A fallback marks a construct the lowering does not model, and it is SILENT: the file still converts and the language still reports coverage=ok, so a dropped construct costs findings with nothing failing. Call this over a whole tree rather than a named file list — the constructs that trip it are the ones nobody thought to name.
func RequireTool ¶
RequireTool skips the test when the named executable (python3, ruby, java, rustc, ...) is not on PATH — the standard guard for converter tests whose frontend shells out to an external toolchain.
Types ¶
type RuleOpt ¶
RuleOpt adjusts the rule OneRuleSet builds.
func Propagators ¶
Propagators sets the rule's own propagator globs (on top of the set-wide defaults OneRuleSet always carries).
func Sinks ¶
Sinks replaces the sink list built from OneRuleSet's bare patterns — for a rule whose sinks need a dynamic `when:` guard (e.g. `not hostFixed()`).
func Validators ¶
Validators sets the rule's guard/barrier validator globs.
Source Files