Documentation
¶
Index ¶
- Constants
- Variables
- func CleanReportPath(path, tmpRoot, imageURI string) string
- func ExtractImageURI(files map[string]*malcontent.FileReport) string
- func ExtractTmpRoot(files map[string]*malcontent.FileReport) string
- func FormatReportKey(path, tmpRoot, imageURI string) string
- func Generate(ctx context.Context, path string, mrs *yarax.ScanResults, c malcontent.Config, ...) (*malcontent.FileReport, error)
- func HighestMatchRisk(mrs *yarax.ScanResults, kind *programkind.FileType, path string, expath string, ...) int
- func Load(data []byte) (malcontent.ScanResult, error)
- func TrimPrefixes(path string, prefixes []string) string
- func ValidateIgnoreRules(patterns []string) error
- type StringPool
Constants ¶
const ( INVALID int = iota - 1 HARMLESS LOW MEDIUM HIGH CRITICAL )
const ( LevelNONE = "NONE" LevelLOW = "LOW" LevelMEDIUM = "MEDIUM" LevelHIGH = "HIGH" LevelCRITICAL = "CRITICAL" )
String forms of the risk levels. Kept as package-level constants so callers (production and tests) can reference the same source of truth without repeating the literal.
const NAME string = "malcontent"
Variables ¶
var Levels = map[string]int{ "ignore": INVALID, "none": INVALID, "low": LOW, "notable": MEDIUM, "medium": MEDIUM, "suspicious": HIGH, "weird": HIGH, "high": HIGH, "crit": CRITICAL, "critical": CRITICAL, // contains filtered or unexported fields }
Map to handle RiskLevel -> RiskScore conversions.
var RiskLevels = map[int]string{ INVALID: LevelNONE, HARMLESS: LevelNONE, LOW: LevelLOW, MEDIUM: LevelMEDIUM, HIGH: LevelHIGH, CRITICAL: LevelCRITICAL, }
Map to handle RiskScore -> RiskLevel conversions.
Functions ¶
func CleanReportPath ¶ added in v1.19.0
CleanReportPath preserves existing image URIs in a path or removes the temporary directory root from a path.
func ExtractImageURI ¶ added in v1.19.0
func ExtractImageURI(files map[string]*malcontent.FileReport) string
ExtractImageURI extracts the image URI from paths in a report.
func ExtractTmpRoot ¶ added in v1.19.0
func ExtractTmpRoot(files map[string]*malcontent.FileReport) string
ExtractTmpRoot extracts the temporary directory root from paths in a report.
func FormatReportKey ¶ added in v1.19.0
FormatReportKey creates an appropriate key for a file from a loaded report.
func Generate ¶
func Generate(ctx context.Context, path string, mrs *yarax.ScanResults, c malcontent.Config, expath string, _ *clog.Logger, fc []byte, size int64, checksum string, kind *programkind.FileType, highestRisk int) (*malcontent.FileReport, error)
func HighestMatchRisk ¶ added in v1.10.0
func HighestMatchRisk(mrs *yarax.ScanResults, kind *programkind.FileType, path string, expath string, c malcontent.Config) int
HighestMatchRisk returns the highest risk score among the rules that actually apply to the scanned file. It mirrors Generate's scoping: rules excluded by a file's type or path globs (fileMatchesRule) are not counted, so the value used as the scan-mode skipMatch threshold cannot be inflated by a rule that Generate would drop. kind/path/expath/c match the arguments passed to Generate.
func Load ¶ added in v1.19.0
func Load(data []byte) (malcontent.ScanResult, error)
func TrimPrefixes ¶ added in v1.5.0
TrimPrefixes removes the specified prefix from a given path for the purposes of sample test data generation. This function will only be used via the refresh package.
func ValidateIgnoreRules ¶ added in v1.25.4
ValidateIgnoreRules checks that every non-empty pattern in patterns is a syntactically valid filepath.Match glob. It returns an error wrapping filepath.ErrBadPattern for the first malformed entry so the CLI can fail fast at startup rather than silently no-matching at scan time.
An empty or nil slice returns nil (the exclusion filter is a no-op). Whitespace-only entries are ignored, mirroring how the CLI splits comma-separated flag values that may contain accidental blank tokens.
Types ¶
type StringPool ¶ added in v1.8.0
type StringPool struct {
// contains filtered or unexported fields
}
StringPool holds data to handle string interning.
The count field is an approximate entry counter maintained via atomic increments; it may slightly overcount under concurrent stores of the same key but never undercounts a new-key store. The clearing field gates resets so that exactly one goroutine performs the Clear when the approximate count reaches the cap.
func NewStringPool ¶ added in v1.8.0
func NewStringPool() *StringPool
NewStringPool returns the process-wide string pool. Successive calls return the same instance so interning state is shared across every match processor for the lifetime of the process.
func (*StringPool) Intern ¶ added in v1.8.0
func (sp *StringPool) Intern(s string) string
Intern returns an interned version of the input string. An approximate atomic counter tracks distinct entries; when it reaches maxInternedStrings a single goroutine (selected via CAS) clears the map and resets the counter while other goroutines proceed without blocking. The count may drift slightly from the true map size under heavy concurrency, which is acceptable because the cap is a memory bound, not an exact invariant.
Source Files