module

NoirPassiveScan

Class methods

detect(file_path : String, file_content : String, rules : Array(PassiveScan), logger : NoirLogger) : Array(PassiveScanResult)

Pure detection: runs every supplied rule against file_content. Callers are responsible for pre-filtering by severity (see filter_rules_by_severity). Returns an empty array (no allocation beyond the literal) when there are no rules to run, so callers can short-circuit on passive_scans.empty? before reading the file.

Source
detect_with_severity(file_path : String, file_content : String, rules : Array(PassiveScan), logger : NoirLogger, min_severity : String) : Array(PassiveScanResult)

Backwards-compatible entry point used by existing specs. Pre-filters the rule set by severity and dispatches to detect.

Source
filter_rules_by_severity(rules : Array(PassiveScan), min_severity : String) : Array(PassiveScan)

Pre-filter the rule set against min_severity. Callers should run this once at scan-startup and pass the result into detect per file, so the per-(file × rule) severity comparison is amortized down to a single pass over the rule set.

Source
load_rules(path : String, logger : NoirLogger) : Array(PassiveScan)
Source
reject_duplicate_ids(rules : Array(PassiveScan), logger : NoirLogger) : Array(PassiveScan)

Keep the first rule for each id and drop the rest.

A rule id is the finding's identity: it is what -f json reports, what SARIF uses as ruleId, and what a CI gate suppresses on. Two rules sharing an id therefore emitted two findings for the same line under the same id (SARIF then described both with whichever rule's metadata was seen first), and nothing said the rule set was inconsistent. This is also what deduplicates a repeated --passive-scan-path, which used to double every finding.

Source

Nested types