securesauce / precli

Precaution CLI - command line static application security testing tool
https://precli.readthedocs.io/
Other
14 stars 3 forks source link

Error when invalid rule ID or category name given for enable/disable #536

Open ericwb opened 1 month ago

ericwb commented 1 month ago

Describe the bug The enable and disable argument of the CLI allows someone to filter what rules are enabled.

To Reproduce

precli --enable=JAV001-JAV999 tests/unit/rules/java/stdlib/javax_servlet_http/examples/CookieSecureFalse.java

Expected behavior In this example, JAV999 doesn't exist. The CLI really should vet the parameters given.

Version

precli 0.5.12.dev4
Copyright 2024 Secure Sauce LLC
License BUSL-1.1: Business Source License 1.1 <https://spdx.org/licenses/BUSL-1.1.html>
  Python 3.12.4 (main, Jun 25 2024, 11:01:48) [Clang 15.0.0 (clang-1500.3.9.4)]

Additional context n/a

ericwb commented 1 month ago

Can load all the rule ID names up front in the CLI main

    all_rules = [
        rule.name 
        for lang in ("go", "java", "python") 
        for rule in metadata.entry_points(group=f"precli.rules.{lang}")
    ]

However, a category name can also be given as the argument, therefore, we need to load the rule to discover all the valid category options.

ericwb commented 1 month ago

It may be equally useful to be able to specify a wide range without having to know the number of the largest indexed rule ID. Helps to future proof code and CLI usage in a way.