detect

package
v0.15.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Nov 4, 2026 License: MIT Imports: 31 Imported by: 0

Documentation

Overview

Package detect implements the project detection engine.

Index

Constants

View Source
const (
	// DefaultScanDepth bounds recursive detection unless the caller overrides it.
	DefaultScanDepth = 8
	// DefaultScanLimit bounds the filesystem entries visited by one detection run.
	DefaultScanLimit = 10000
	// DefaultLineCountTimeout bounds external line counters.
	DefaultLineCountTimeout = 2 * time.Second
)

Variables

This section is empty.

Functions

func FilterByChangedFiles added in v0.3.0

func FilterByChangedFiles(r *brief.Report, knowledgeBase *kb.KnowledgeBase, changedFiles []string) *brief.Report

FilterByChangedFiles takes a full report and returns a new report containing only detections relevant to the given set of changed files.

Types

type Engine

type Engine struct {
	KB                *kb.KnowledgeBase
	Root              string
	ScanDepth         int           // optional max directory depth for recursive detection (0 = unlimited)
	ScanLimit         int           // optional max filesystem entries per scan (0 = unlimited)
	LineCountTimeout  time.Duration // optional timeout for external line counters (0 = unlimited)
	IncludeSubmodules bool          // include initialized Git submodule contents
	SkipDirs          []string      // additional directories to skip during walks
	TrackedOnly       bool          // only consider files tracked by git
	// contains filtered or unexported fields
}

Engine runs detection against a project directory or filesystem.

func New

func New(knowledgeBase *kb.KnowledgeBase, root string) *Engine

New creates a detection engine for the given project root.

func NewFS added in v0.15.0

func NewFS(knowledgeBase *kb.KnowledgeBase, fsys fs.FS) *Engine

NewFS creates a detection engine rooted at "." in fsys. Reports use "." as their path and omit Git metadata, initialized submodules, and line counts. TrackedOnly is unavailable. ScanDepth, ScanLimit, and SkipDirs still apply.

func (*Engine) ExpandSubmoduleChanges added in v0.13.0

func (e *Engine) ExpandSubmoduleChanges(changedFiles []string) []string

ExpandSubmoduleChanges adds scanned files beneath changed submodule roots.

func (*Engine) Missing added in v0.4.0

func (e *Engine) Missing(r *brief.Report) *brief.MissingReport

Missing computes which recommended tool categories have no detected tools for the project's ecosystems. It requires Run() to have been called first so that detectedEcosystems is populated.

func (*Engine) Run

func (e *Engine) Run() (*brief.Report, error)

Run performs full detection and returns a Report.

func (*Engine) RunTools added in v0.15.0

func (e *Engine) RunTools(options ToolScanOptions) (*ToolScan, error)

RunTools detects tools affected by a project snapshot or its changed files.

func (*Engine) Sinks added in v0.5.0

func (e *Engine) Sinks(r *brief.Report) *brief.SinkReport

Sinks collects known dangerous functions from all detected tools. CWE is filled from the threat registry when the sink doesn't carry one.

func (*Engine) ThreatModel added in v0.5.0

func (e *Engine) ThreatModel(r *brief.Report) *brief.ThreatReport

ThreatModel resolves the threat surface implied by detected tools. Each tool's taxonomy tags are matched against the threat mappings in _threats.toml; matched threat IDs are unioned with any explicit [security].threats on the tool, then resolved against the registry.

type ToolRef added in v0.15.0

type ToolRef struct {
	Name     string
	Category string
}

ToolRef identifies a tool definition evaluated by a tool scan.

type ToolScan added in v0.15.0

type ToolScan struct {
	Tools   map[string][]brief.Detection
	Checked []ToolRef
	Stats   brief.Stats
}

ToolScan contains matches and every definition evaluated by a tool scan.

type ToolScanOptions added in v0.15.0

type ToolScanOptions struct {
	// Full evaluates every non-language definition.
	Full bool
	// ChangedFiles limits a partial scan to definitions affected by these paths.
	ChangedFiles []string
	// Languages supplies language names already detected by the caller.
	Languages []string
	// LanguagesChanged reevaluates definitions scoped to a language ecosystem.
	LanguagesChanged bool
}

ToolScanOptions scopes tool detection for an existing project snapshot.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL