Preprocessing before matching in custom rules?

Open
#671 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Stale
Tech stack
json
Domain
security, tooling

Research direction

Start with the linked jq issue comment and the jq discussion, then trace how DevSkim custom rules perform matching and whether preprocessing is currently supported. Done means establishing whether either placeholder-based processing direction can be supported for the shown JQ/JSON example and documenting the resulting behavior or limitation.

Written by the indexing model from the issue text.

Description

question

I have a very specific use case where I would like to use custom DevSkim rules on.

I described the situation here: https://github.com/jqlang/jq/issues/566#issuecomment-2525047098 which I moved into a discussion here: https://github.com/jqlang/jq/discussions/3218.

For DevSkim purposes this for now can be considered a 'custom and unsupported language', JQ. JQ in itself is not valid JSON but in my use-case a large part of it is JSON. To avoid writing very complicated regular expressions on a complicated file structure only, if I enclosed it in placeholders like in below example.

{
  "name": "Example",
  "data": [
    # __JQ_START__
    .input | map({ key: .key, value: .value })
    # __JQ_END__
  ]
}

Is there a way in DevSkim to first use regex to remove everything in between the placeholders, including the placeholders itself, and then use JSONpath on the remainder, which is now fully JSON?

Or visa versa remove everything outside the placeholders including the placeholders, and do another regex on the remainder (JQ only)?

Dominant language
C#
Stars
1k
Forks
132
Avg merge
1m
Merged PRs (30d)
1

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from microsoft/DevSkim

All issues in microsoft/DevSkim

Similar issues

More C# issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.