microsoft / microsoft/DevSkim

JSONschema support for custom DevSkim rules

Open
#666 8 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
C#
Stars
1k
Forks
131
Avg merge
1m
Merged PRs (30d)
1

Description

Is your feature request related to a problem? Please describe.
Yes, the documentation is really lacking and I'm having a very hard time getting things to work. A JSONSchema for custom rules would not only help validate the formatting it would be the ultimate documentation and test (that could be embedded even) and really help feedback for custom rule development.

Describe the solution you'd like
A complete JSONSchema description for the Custom Rule format for DevSkim.

Describe alternatives you've considered
XST.

Additional context

Here is a start, very incomplete but I still wouldn't know how to use all advanced features of DevSkim (such as ymlpath):

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "Generated schema for Root",
  "type": "array",
  "items": {
    "type": "object",
    "properties": {
      "name": {
        "type": "string"
      },
      "id": {
        "type": "string"
      },
      "description": {
        "type": "string"
      },
      "recommendation": {
        "type": "string"
      },
      "applies_to": {
        "type": "array",
        "items": {
          "type": "string"
        }
      },
      "tags": {
        "type": "array",
        "items": {
          "type": "string"
        }
      },
      "confidence": {
        "type": "string"
      },
      "severity": {
        "type": "string"
      },
      "rule_info": {
        "type": "string"
      },
      "patterns": {
        "type": "array",
        "items": {
          "type": "object",
          "properties": {
            "pattern": {
              "type": "string"
            },
            "type": {
              "type": "string"
            },
            "scopes": {
              "type": "array",
              "items": {
                "type": "string"
              }
            }
          },
          "required": [
            "pattern",
            "type",
            "scopes"
          ]
        }
      },
      "fix_its": {
        "type": "array",
        "items": {
          "type": "object",
          "properties": {
            "name": {
              "type": "string"
            },
            "type": {
              "type": "string"
            },
            "replacement": {
              "type": "string"
            },
            "pattern": {
              "type": "object",
              "properties": {
                "pattern": {
                  "type": "string"
                },
                "type": {
                  "type": "string"
                },
                "scopes": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  }
                }
              },
              "required": [
                "pattern",
                "type",
                "scopes"
              ]
            }
          },
          "required": [
            "name",
            "type",
            "replacement",
            "pattern"
          ]
        }
      },
      "must-match": {
        "type": "array",
        "items": {
          "type": "string"
        }
      },
      "must-not-match": {
        "type": "array",
        "items": {
          "type": "string"
        }
      }
    },
    "required": [
      "name",
      "id",
      "description",
      "recommendation",
      "applies_to",
      "tags",
      "confidence",
      "severity",
      "rule_info",
      "patterns",
      "fix_its",
      "must-match",
      "must-not-match"
    ]
  }
}

Also helpful:

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating DevSkim's custom rule format and existing rule definitions, then compare their fields and advanced features with the proposed schema. The work is done when the schema covers the complete custom-rule format, including features such as ymlpath, and can validate representative custom rules.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, json
Domain
documentation, security, tooling
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.