Repository navigation
feat(rules): test-code awareness for the built-in rules (#663) - #666
Merged
Merged
Conversation
Whole test files and Rust #[cfg(test)] modules / #[test] functions (also a diff hunk inside mod tests) are exempt from the noisy rules; secret scanners keep only their high-confidence patterns there. bug-println is skipped in program entry points. rules_engine.include_tests turns it off. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Signed-off-by: ajianaz <ajianaz@users.noreply.github.com>
…ection in test blocks) An unclosed #[cfg(test)] region in a whole file is dropped instead of exempting the rest of the file, single-line raw strings no longer confuse brace matching, and inline test blocks keep every security pattern except the generic hardcoded-secret one. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Signed-off-by: ajianaz <ajianaz@users.noreply.github.com>
… strings Block comments are skipped when counting braces, and a test region is dropped when an item starts at or left of its own indentation or its closing brace does not balance the count, so a parser differential cannot exempt production code. Column-0 text that is not a Rust item (TOML fixtures in raw strings) does not abandon a region. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Signed-off-by: ajianaz <ajianaz@users.noreply.github.com>
… cannot exempt code
#[cfg(test)] fn helper() {} decorated the next line instead of its own
item, and an attribute inside a block comment counted as one. Comment
state is now tracked on every line so it cannot go stale.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Signed-off-by: ajianaz <ajianaz@users.noreply.github.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #663.
What
New
engine::test_contextsays which lines are test code: whole test files by path (*_test.*,*.test.ts,spec/,__tests__/,fixtures/, ...), Rust#[cfg(test)]modules and#[test]functions (brace matching that ignores braces in strings, chars and comments), and, in a diff, a hunk whose header ismod tests.ScanFilecarries it (in_test), so every scanner sees the same answer.bug-unwrap,bug-expect,bug-println,qual-clone,qual-error-ignore,sec-hardcoded-url,sec-hardcoded-secretskip test code.security_scanner/secrets_scannerrun only the high-confidence secret list on inline test blocks (same as they already did for test files), so a real AWS key in a test is still reported.bug-printlnis also skipped inmain.rs,src/bin/,examples/,benches/.rules_engine.include_tests: trueturns the new exemptions off. Detection is conservative: when it cannot tell, the line stays scanned. Custom rules andbug-todoare not exempt.deterministic::runnow builds theScanFiles once and calls the_inscanners.Why
Issue #663. Tests produced most of the noise and the remaining false Critical/Major findings on real code.
Testing
cargo fmt --check,cargo clippy --all-targets --features tree-sitter -- -D warnings,cargo test --features tree-sitter(1245 passed; 17 new: brace matching incl. strings/chars/comments, attribute stacks, numbering gaps, hunk headers, rule exemptions,include_tests, high-confidence secret still found in a test block).utekeanduteke-cloud, cap off,include_tests: true(old behavior) vs default:Known limits
bug-printlnin a CLI crate'scommands/modules is still reported (the rule layer does not know the crate type); silence withignore.rules.#[cfg(test)]block or amod testsheader; otherwise the line is scanned.