rules:
  - id: yams.cpp.result-value-without-guard
    languages: [cpp]
    severity: WARNING
    message: >-
      Result-like value accessed with .value(). Ensure this path is guarded by a success check; prefer
      explicit propagation or REQUIRE/CHECK only in tests.
    metadata:
      category: correctness
      cwe: "CWE-252"
      confidence: low
      precision: low
      yams_triage: result-handling
    patterns:
      - pattern: $R.value()
      - pattern-not-inside: |
          if ($R) {
            ...
          }
      - pattern-not-inside: |
          if (auto $R = ... ) {
            ...
          }
      - pattern-not-inside: |
          if (!$R) {
            ...
          }
          ...
      - pattern-not-inside: |
          if (!$R)
            return ...;
          ...
      - pattern-not-inside: |
          if (!$R)
            co_return ...;
          ...
      - pattern-not-inside: |
          if (!$R.has_value()) {
            ...
          }
          ...
      - pattern-not-inside: |
          if (!$R.has_value())
            return ...;
          ...
      - pattern-not-inside: |
          REQUIRE($R);
          ...
      - pattern-not-inside: |
          REQUIRE($R.has_value());
          ...
      - pattern-not-inside: |
          CHECK($R);
          ...
    paths:
      include:
        - /src/**/*.cpp
        - /include/**/*.h
        - /tools/opengrep/tests/**/*.cpp
        - tools/opengrep/tests/**/*.cpp
      exclude:
        - /tests/**
        - /third_party/**
        - /external/**
        - /build/**
        - /build*/**