73 lines
2.3 KiB
YAML
73 lines
2.3 KiB
YAML
rules:
|
|
- id: yams.cpp.raw-yams-getenv
|
|
languages: [cpp]
|
|
severity: WARNING
|
|
message: >-
|
|
Direct YAMS_* environment lookup outside tests. Repo policy prefers typed config/resolvers for
|
|
tuning surfaces; keep env overlays test-only or document why runtime env is required.
|
|
metadata:
|
|
category: maintainability
|
|
confidence: medium
|
|
precision: medium
|
|
yams_triage: config-surface
|
|
patterns:
|
|
- pattern-either:
|
|
- pattern: std::getenv($NAME)
|
|
- pattern: getenv($NAME)
|
|
- metavariable-regex:
|
|
metavariable: $NAME
|
|
regex: '"YAMS_.*"'
|
|
# Existing centralized compatibility/debug wrappers are allowed via path
|
|
# exclusions below. New runtime tuning surfaces should still flow through
|
|
# typed config/resolvers.
|
|
paths:
|
|
include:
|
|
- /src/**/*.cpp
|
|
- /src/**/*.h
|
|
- /include/**/*.h
|
|
- /tools/opengrep/tests/**/*.cpp
|
|
- tools/opengrep/tests/**/*.cpp
|
|
exclude:
|
|
- /tests/**
|
|
- /third_party/**
|
|
- /external/**
|
|
- /build/**
|
|
- /build*/**
|
|
- /include/yams/cli/daemon_helpers.h
|
|
- /include/yams/common/test_utils.h
|
|
- /include/yams/daemon/components/TuneAdvisor.h
|
|
|
|
- id: yams.cpp.vector-data-reinterpret-struct
|
|
languages: [cpp]
|
|
severity: INFO
|
|
message: >-
|
|
reinterpret_cast over vector/span data. In binary codecs, prefer memcpy/readPod/writePod helpers
|
|
and explicit bounds checks to avoid alignment, aliasing, and truncation hazards.
|
|
metadata:
|
|
category: correctness
|
|
cwe: "CWE-704"
|
|
confidence: low
|
|
precision: low
|
|
yams_triage: binary-codec
|
|
patterns:
|
|
- pattern-either:
|
|
- pattern: reinterpret_cast<$T*>($V.data())
|
|
- pattern: reinterpret_cast<const $T*>($V.data())
|
|
# Ignore byte/character view casts used for stream/plugin APIs. The audit
|
|
# target is struct/typed reinterpretation over container storage.
|
|
- metavariable-regex:
|
|
metavariable: $T
|
|
regex: '^(?!.*(?:char|byte|Byte|uint8_t|std::byte)).*$'
|
|
paths:
|
|
include:
|
|
- /src/**/*.cpp
|
|
- /include/**/*.h
|
|
- /tools/opengrep/tests/**/*.cpp
|
|
- tools/opengrep/tests/**/*.cpp
|
|
exclude:
|
|
- /tests/**
|
|
- /third_party/**
|
|
- /external/**
|
|
- /build/**
|
|
- /build*/**
|
|
|