Documentation
¶
Overview ¶
Package checkdef parses declarative check metadata (ID, name, description, dependencies, ...) out of an embedded definition file, so a reusable check package can keep that metadata in YAML/TOML/JSON instead of hand-assembling it in Go. It's a separate package from the root harnessx module so the core engine keeps its zero-dependency guarantee — only importers that actually parse definition files pull in a YAML/TOML parser.
Index ¶
- func NewCheck(def CheckDef, run harnessx.CheckFunc, opts ...Option) harnessx.Check
- func NewResourceCheck(def CheckDef, run harnessx.ResourceCheckFunc, opts ...Option) harnessx.Check
- func NewVariantCheck(def CheckDef, run harnessx.VariantCheckFunc, opts ...Option) harnessx.Check
- func NewVariantResourceCheck(def CheckDef, run harnessx.VariantResourceCheckFunc, opts ...Option) harnessx.Check
- type CheckDef
- func (d CheckDef) DependsOnIDs() []harnessx.CheckID
- func (d CheckDef) WithCAPECID(id string) CheckDef
- func (d CheckDef) WithCVSSScore(score float64) CheckDef
- func (d CheckDef) WithCVSSVector(vector string) CheckDef
- func (d CheckDef) WithCWEID(id string) CheckDef
- func (d CheckDef) WithDependsOn(ids ...string) CheckDef
- func (d CheckDef) WithDescription(description string) CheckDef
- func (d CheckDef) WithExtra(extra map[string]any) CheckDef
- func (d CheckDef) WithLink(link string) CheckDef
- func (d CheckDef) WithName(name string) CheckDef
- func (d CheckDef) WithOWASP(owasp string) CheckDef
- func (d CheckDef) WithTags(tags ...string) CheckDef
- type Option
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewCheck ¶
NewCheck builds a ScopeGlobal harnessx.Check from a CheckDef's metadata plus a run function, so individual checks only need to supply what makes them different.
func NewResourceCheck ¶
NewResourceCheck builds a ScopePerResource harnessx.Check from a CheckDef's metadata plus a resource run function.
func NewVariantCheck ¶
NewVariantCheck builds a ScopeGlobal harnessx.Check whose run function is invoked once per entry in WithVariants — the same check definition probed with different attempt variants (see VariantMode).
func NewVariantResourceCheck ¶
func NewVariantResourceCheck(def CheckDef, run harnessx.VariantResourceCheckFunc, opts ...Option) harnessx.Check
NewVariantResourceCheck builds a ScopePerResource harnessx.Check whose resource run function is invoked once per entry in WithVariants, for each discovered resource.
Types ¶
type CheckDef ¶
type CheckDef struct {
ID string `yaml:"id" toml:"id" json:"id"`
Name string `yaml:"name" toml:"name" json:"name"`
Description string `yaml:"description" toml:"description" json:"description"`
Link string `yaml:"link" toml:"link" json:"link"`
Tags []string `yaml:"tags" toml:"tags" json:"tags"`
DependsOn []string `yaml:"depends_on" toml:"depends_on" json:"depends_on"`
CVSSVector string `yaml:"cvss_vector" toml:"cvss_vector" json:"cvss_vector"`
CVSSScore float64 `yaml:"cvss_score" toml:"cvss_score" json:"cvss_score"`
CWEID string `yaml:"cwe_id" toml:"cwe_id" json:"cwe_id"`
CAPECID string `yaml:"capec_id" toml:"capec_id" json:"capec_id"`
OWASP string `yaml:"owasp" toml:"owasp" json:"owasp"`
// Extra holds def-specific fields this package doesn't know about yet,
// nested under an "extra" key so it parses the same way across
// YAML/TOML/JSON (none of the three parsers support catch-all/inline
// remainder maps consistently).
Extra map[string]any `yaml:"extra" toml:"extra" json:"extra"`
}
CheckDef mirrors the descriptive fields of harnessx.Check (everything except behavior — Skip, Run, RunResource, Scope, Timeout, Concurrency).
func MustParseCheckDefJSON ¶
MustParseCheckDefJSON unmarshals a JSON-encoded check definition into a CheckDef. It panics (with pkg-prefixed context) on malformed input — check registries are typically built at init time from an embedded file, so a bad definition is a build-time bug, not something to recover from at runtime.
func MustParseCheckDefTOML ¶
MustParseCheckDefTOML unmarshals a TOML-encoded check definition into a CheckDef. It panics (with pkg-prefixed context) on malformed input — check registries are typically built at init time from an embedded file, so a bad definition is a build-time bug, not something to recover from at runtime.
func MustParseCheckDefYAML ¶
MustParseCheckDefYAML unmarshals a YAML-encoded check definition into a CheckDef. It panics (with pkg-prefixed context) on malformed input — check registries are typically built at init time from an embedded file, so a bad definition is a build-time bug, not something to recover from at runtime.
func (CheckDef) DependsOnIDs ¶
DependsOnIDs converts DependsOn to []harnessx.CheckID for direct use in Check.DependsOn.
func (CheckDef) WithCAPECID ¶ added in v0.4.0
WithCAPECID returns a copy of d with CAPECID set.
func (CheckDef) WithCVSSScore ¶ added in v0.4.0
WithCVSSScore returns a copy of d with CVSSScore set.
func (CheckDef) WithCVSSVector ¶ added in v0.4.0
WithCVSSVector returns a copy of d with CVSSVector set.
func (CheckDef) WithDependsOn ¶ added in v0.4.0
WithDependsOn returns a copy of d with DependsOn set.
func (CheckDef) WithDescription ¶ added in v0.4.0
WithDescription returns a copy of d with Description set.
func (CheckDef) WithLink ¶ added in v0.4.0
WithLink returns a copy of d with Link set, e.g. to point at a deployment-specific advisory page.
func (CheckDef) WithName ¶ added in v0.4.0
WithName returns a copy of d with Name set, e.g. to relabel a check loaded from a shared definition file.
type Option ¶
type Option func(*checkConfig)
Option configures the optional fields of a Check built by NewCheck or NewResourceCheck — everything on harnessx.Check that isn't already carried by CheckDef or the required Run/RunResource function.
func WithConcurrency ¶
WithConcurrency sets the check's per-resource Concurrency. Only meaningful on a NewResourceCheck.
func WithConditions ¶
WithConditions sets the check's Conditions (AND-evaluated).
func WithSkip ¶
func WithSkip(skip harnessx.SkipDecision) Option
WithSkip sets the check's SkipDecision.
func WithVariantMode ¶
func WithVariantMode(mode harnessx.VariantMode) Option
WithVariantMode sets how Variants are executed: VariantsSequential (default) or VariantsParallel.
func WithVariants ¶
WithVariants sets the check's Variants — same check definition, run once per variant (e.g. the different casings of a JWT "alg: none" attack).
Source Files