Packages
sobelow
0.12.0
0.14.1
0.14.0
0.13.0
0.12.2
0.12.1
0.12.0
0.11.1
0.11.0
0.10.6
0.10.5
0.10.4
0.10.3
0.10.2
0.10.1
0.10.0
0.9.3
0.9.2
0.9.1
0.9.0
0.8.0
0.7.8
0.7.7
0.7.6
0.7.5
0.7.4
0.7.3
0.7.2
0.7.1
0.7.0
0.6.9
0.6.8
0.6.7
0.6.6
0.6.5
0.6.4
0.6.3
0.6.2
0.6.1
0.6.0
0.5.4
0.5.3
0.5.2
0.5.1
0.5.0
0.4.9
0.4.8
0.4.7
0.4.6
0.4.5
0.4.4
0.4.3
0.4.2
0.4.1
0.4.0
0.3.12
0.3.11
0.3.10
0.3.9
0.3.8
0.3.7
0.3.6
0.3.5
0.3.4
0.3.3
0.3.2
0.3.1
0.3.0
0.2.8
0.2.7
0.2.6
0.2.5
0.2.4
0.2.3
Security-focused static analysis for Elixir & the Phoenix framework
Current section
Files
Jump to
Current section
Files
lib/sobelow/finding.ex
defmodule Sobelow.Finding do
defstruct [
:type,
:confidence,
:filename,
:vuln_line_no,
:vuln_col_no,
:vuln_variable,
:vuln_source,
:fun_name,
:fun_line_no,
:fun_source,
:fingerprint
]
alias Sobelow.Utils
def init(type, filename, confidence \\ nil) do
%Sobelow.Finding{
type: type,
filename: filename,
confidence: confidence
}
end
def multi_from_def(%Sobelow.Finding{} = finding, fun, {vulns, params, {fun_name, fun_line_no}}) do
finding = %{finding | fun_name: fun_name, fun_line_no: fun_line_no, fun_source: fun}
Enum.map(vulns, fn {vuln, var} ->
%{
finding
| vuln_variable: var,
vuln_source: vuln,
vuln_line_no: Sobelow.Parse.get_fun_line(vuln),
vuln_col_no: Sobelow.Parse.get_fun_column(vuln),
confidence: Sobelow.Print.get_sev(params, var, finding.confidence)
}
|> normalize()
end)
end
def fetch_fingerprint(%Sobelow.Finding{} = finding) do
%{finding | fingerprint: fingerprint(finding)}
end
def fingerprint(%Sobelow.Finding{} = finding) do
filename =
Utils.get_root()
|> Utils.normalize_path()
|> (&String.replace_prefix(finding.filename, &1, "")).()
|> Utils.normalize_path()
[finding.type, finding.vuln_source, filename, finding.vuln_line_no]
|> :erlang.term_to_binary()
|> :erlang.md5()
|> Base.encode16()
end
defp normalize(%Sobelow.Finding{vuln_variable: vars} = finding) when is_list(vars) do
var = if length(vars) > 1, do: Enum.join(vars, " and "), else: hd(vars)
%{finding | vuln_variable: var} |> normalize()
end
defp normalize(%Sobelow.Finding{fun_source: fun} = finding) when is_list(fun) do
%{finding | fun_source: List.first(fun)} |> normalize()
end
defp normalize(finding), do: finding
defmacro __using__(_) do
quote do
alias Sobelow.Finding
alias Sobelow.Parse
alias Sobelow.Print
alias Sobelow.Utils
def details() do
@moduledoc
end
def id() do
"SBLW" <> String.pad_leading("#{@uid}", 3, "0")
end
def rule() do
[name, description] = String.split(@finding_type, ":", parts: 2)
description = String.trim(description)
rule_details =
details()
|> String.split("\n\n")
|> Enum.map(fn para -> String.replace(para, "\n", " ") end)
|> Enum.join("\n\n")
%{
id: id(),
name: name,
shortDescription: %{text: description},
fullDescription: %{text: description},
help: %{
text: rule_details,
markdown: rule_details
}
}
end
defoverridable details: 0
end
end
end
defmodule Sobelow.FindingType do
defmacro __using__(_) do
quote do
def finding_modules() do
@submodules
end
def details() do
Enum.map(@submodules, fn sub ->
apply(sub, :details, [])
end)
end
def rules() do
Enum.map(@submodules, fn sub ->
apply(sub, :rule, [])
end)
end
defoverridable details: 0
end
end
end