Description

This PR changes the behaviour of constraints as follows:

Each constraint can take a pattern and other constraints.
A rewrite option can use metavariables inside a constraint pattern

Here's an example rule that defines nested constraints and a rewrite option with a metavariable inside a constraint pattern:

version: "1"
rules:
  - id: "test"
    language: hcl
    message: |
      test
    pattern: |
      resource "block" :[NAME] {        
        :[...X]
      }
    constraints:
      - target: X
        should: match
        pattern: |
          inner {
            :[...Z]
          }
        constraints:
          - target: Z
            should: match
            pattern: |
              test = :[HOO]
    rewrite_options:
      - |
        resource "block" :[NAME] {        
          test = :[HOO]
        }

Checklist

[x] I opened a draft PR or added the [WIP] to the title if my PR is not ready for review.
[x] I have reviewed the code by myself.
[x] I have commented my code, particularly in hard-to-understand areas.
[x] I have made corresponding changes to the documentation.
[x] I have added tests enough to show how your code behaves and that your code works as expected.

Additional Notes

N/A

flatt-security / shisho

Allow nested constraints & capturing inside constraints #100

Description

Checklist

Additional Notes