codyze icon indicating copy to clipboard operation
codyze copied to clipboard

Introduce Length Type Keyword

Open CodingDepot opened this issue 8 months ago • 3 comments

This adds the new Length() Type to use in Coko queries. This enables rules to verify the length of an argument, e.g. how many bytes a salt parameter can assume. One issue with the implementation if that when the length can not be determined (length == -1), false positives may be produced. The current evaluator structure makes it hard to propagate an open result from the length check to the Finding. (Refer to #886)

Additionally, this PR includes an optimization for Ranges given as arguments for Only and Never evaluators: By only verifying that every possible value lies within the upper and lower bounds of the range we do not have to iterate over every value in the range. This is especially noticeable when specifying a huge range of allowed parameter values.

Tasks:

  • [x] implement Length keyword
  • [x] write unit tests for the new keyword
  • [ ] ~~restructure Evaluator to enable propagation of false positive knowledge~~

CodingDepot avatar Jun 17 '24 10:06 CodingDepot