Documentation
¶
Overview ¶
Package detect implements the project detection engine.
Index ¶
- Constants
- func FilterByChangedFiles(r *brief.Report, knowledgeBase *kb.KnowledgeBase, changedFiles []string) *brief.Report
- type Engine
- func (e *Engine) ExpandSubmoduleChanges(changedFiles []string) []string
- func (e *Engine) Missing(r *brief.Report) *brief.MissingReport
- func (e *Engine) Run() (*brief.Report, error)
- func (e *Engine) RunTools(options ToolScanOptions) (*ToolScan, error)
- func (e *Engine) Sinks(r *brief.Report) *brief.SinkReport
- func (e *Engine) ThreatModel(r *brief.Report) *brief.ThreatReport
- type ToolRef
- type ToolScan
- type ToolScanOptions
Constants ¶
const ( // DefaultScanDepth bounds recursive detection unless the caller overrides it. DefaultScanDepth = 8 // DefaultScanLimit bounds the filesystem entries visited by one detection run. DefaultScanLimit = 10000 // DefaultLineCountTimeout bounds external line counters. DefaultLineCountTimeout = 2 * time.Second )
Variables ¶
This section is empty.
Functions ¶
func FilterByChangedFiles ¶ added in v0.3.0
func FilterByChangedFiles(r *brief.Report, knowledgeBase *kb.KnowledgeBase, changedFiles []string) *brief.Report
FilterByChangedFiles takes a full report and returns a new report containing only detections relevant to the given set of changed files.
Types ¶
type Engine ¶
type Engine struct {
KB *kb.KnowledgeBase
Root string
ScanDepth int // optional max directory depth for recursive detection (0 = unlimited)
ScanLimit int // optional max filesystem entries per scan (0 = unlimited)
LineCountTimeout time.Duration // optional timeout for external line counters (0 = unlimited)
IncludeSubmodules bool // include initialized Git submodule contents
SkipDirs []string // additional directories to skip during walks
TrackedOnly bool // only consider files tracked by git
// contains filtered or unexported fields
}
Engine runs detection against a project directory or filesystem.
func New ¶
func New(knowledgeBase *kb.KnowledgeBase, root string) *Engine
New creates a detection engine for the given project root.
func NewFS ¶ added in v0.15.0
func NewFS(knowledgeBase *kb.KnowledgeBase, fsys fs.FS) *Engine
NewFS creates a detection engine rooted at "." in fsys. Reports use "." as their path and omit Git metadata, initialized submodules, and line counts. TrackedOnly is unavailable. ScanDepth, ScanLimit, and SkipDirs still apply.
func (*Engine) ExpandSubmoduleChanges ¶ added in v0.13.0
ExpandSubmoduleChanges adds scanned files beneath changed submodule roots.
func (*Engine) Missing ¶ added in v0.4.0
func (e *Engine) Missing(r *brief.Report) *brief.MissingReport
Missing computes which recommended tool categories have no detected tools for the project's ecosystems. It requires Run() to have been called first so that detectedEcosystems is populated.
func (*Engine) RunTools ¶ added in v0.15.0
func (e *Engine) RunTools(options ToolScanOptions) (*ToolScan, error)
RunTools detects tools affected by a project snapshot or its changed files.
func (*Engine) Sinks ¶ added in v0.5.0
func (e *Engine) Sinks(r *brief.Report) *brief.SinkReport
Sinks collects known dangerous functions from all detected tools. CWE is filled from the threat registry when the sink doesn't carry one.
func (*Engine) ThreatModel ¶ added in v0.5.0
func (e *Engine) ThreatModel(r *brief.Report) *brief.ThreatReport
ThreatModel resolves the threat surface implied by detected tools. Each tool's taxonomy tags are matched against the threat mappings in _threats.toml; matched threat IDs are unioned with any explicit [security].threats on the tool, then resolved against the registry.
type ToolScan ¶ added in v0.15.0
ToolScan contains matches and every definition evaluated by a tool scan.
type ToolScanOptions ¶ added in v0.15.0
type ToolScanOptions struct {
// Full evaluates every non-language definition.
Full bool
// ChangedFiles limits a partial scan to definitions affected by these paths.
ChangedFiles []string
// Languages supplies language names already detected by the caller.
Languages []string
// LanguagesChanged reevaluates definitions scoped to a language ecosystem.
LanguagesChanged bool
}
ToolScanOptions scopes tool detection for an existing project snapshot.