microsoft / microsoft/DevSkim

Preprocessing before matching in custom rules?

Open
#671 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

question
Dominant language
C#
Stars
1k
Forks
131
Avg merge
1m
Merged PRs (30d)
1

Description

I have a very specific use case where I would like to use custom DevSkim rules on.

I described the situation here: https://github.com/jqlang/jq/issues/566#issuecomment-2525047098 which I moved into a discussion here: https://github.com/jqlang/jq/discussions/3218.

For DevSkim purposes this for now can be considered a 'custom and unsupported language', JQ. JQ in itself is not valid JSON but in my use-case a large part of it is JSON. To avoid writing very complicated regular expressions on a complicated file structure only, if I enclosed it in placeholders like in below example.

{
  "name": "Example",
  "data": [
    # __JQ_START__
    .input | map({ key: .key, value: .value })
    # __JQ_END__
  ]
}

Is there a way in DevSkim to first use regex to remove everything in between the placeholders, including the placeholders itself, and then use JSONpath on the remainder, which is now fully JSON?

Or visa versa remove everything outside the placeholders including the placeholders, and do another regex on the remainder (JQ only)?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked jq issue comment and the jq discussion, then trace how DevSkim custom rules perform matching and whether preprocessing is currently supported. Done means establishing whether either placeholder-based processing direction can be supported for the shown JQ/JSON example and documenting the resulting behavior or limitation.

Written by the indexing model from the issue text.

Assessment

Tech stack
json
Domain
security, tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.