codyze
codyze copied to clipboard
Introduce Length Type Keyword
This adds the new Length()
Type to use in Coko queries.
This enables rules to verify the length of an argument, e.g. how many bytes a salt parameter can assume.
One issue with the implementation if that when the length can not be determined (length == -1), false positives may be produced. The current evaluator structure makes it hard to propagate an open
result from the length check to the Finding.
(Refer to #886)
Additionally, this PR includes an optimization for Ranges given as arguments for Only and Never evaluators: By only verifying that every possible value lies within the upper and lower bounds of the range we do not have to iterate over every value in the range. This is especially noticeable when specifying a huge range of allowed parameter values.
Tasks:
- [x] implement
Length
keyword - [x] write unit tests for the new keyword
- [ ] ~~restructure Evaluator to enable propagation of false positive knowledge~~