trapline 0.1.0

data/lib/trapline/engine.rb

@@ -0,0 +1,243 @@
+# frozen_string_literal: true
+
+require "json"
+require "open3"
+require "tmpdir"
+
+module Trapline
+  class Engine
+    CANDIDATES = %w[opengrep semgrep].freeze
+    QUIET_ENV = { "SEMGREP_SEND_METRICS" => "off", "SEMGREP_ENABLE_VERSION_CHECK" => "0",
+                  "OPENGREP_SEND_METRICS" => "off" }.freeze
+
+    Finding = Struct.new(:rule_id, :line, :end_line, :col, :end_col, :message, :severity, :code,
+                         :metavars, keyword_init: true) do
+      def to_h
+        super.compact
+      end
+    end
+
+    RunResult = Struct.new(:findings, :errors, :annotations, :duration, :engine, keyword_init: true) do
+      def ok?
+        errors.empty?
+      end
+
+      def annotations_passed?
+        annotations.nil? || annotations[:failed].zero?
+      end
+
+      def to_h
+        { findings: findings.map(&:to_h), errors: errors, annotations: annotations,
+          duration: duration, engine: engine }
+      end
+    end
+
+    attr_reader :binary, :timeout
+
+    def self.detect(preferred = nil)
+      [preferred, *CANDIDATES].compact.uniq.each do |bin|
+        path = executable?(bin) ? bin : which(bin)
+        return new(path) if path
+      end
+      nil
+    end
+
+    def self.which(cmd)
+      ENV.fetch("PATH", "").split(File::PATH_SEPARATOR).map { |dir| File.join(dir, cmd) }.find { |f| executable?(f) }
+    end
+
+    def self.executable?(path)
+      File.executable?(path) && !File.directory?(path)
+    end
+
+    def initialize(binary, timeout: Trapline.config.engine_timeout)
+      @binary = binary
+      @timeout = timeout
+    end
+
+    def name
+      File.basename(binary).include?("opengrep") ? "opengrep" : "semgrep"
+    end
+
+    def version
+      @version ||= capture([binary, "--version"]).first.to_s.strip.lines.last.to_s.strip
+    end
+
+    def run(yaml, code:, language: nil)
+      rules = begin
+        RuleFile.parse(yaml).rules
+      rescue ParseError
+        []
+      end
+      language ||= rules.first&.primary_language
+      rule_ids = rules.filter_map { |r| r.id&.to_s }
+      ext = Languages.extension_for(language)
+      started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+
+      json, errors = scan(yaml, ext == "dockerfile" ? "Dockerfile" : "target.#{ext}", code)
+      findings = Array(json&.dig("results")).map { |r| build_finding(r, code, rule_ids) }
+      RunResult.new(findings: findings, errors: errors, annotations: Annotations.evaluate(code, findings, rule_ids: rule_ids),
+                    duration: (Process.clock_gettime(Process::CLOCK_MONOTONIC) - started).round(3),
+                    engine: "#{name} #{version}")
+    end
+
+    def validate(yaml)
+      scan(yaml, "empty.txt", "").last
+    end
+
+    private
+
+    def scan(yaml, target_name, code)
+      Dir.mktmpdir("trapline") do |dir|
+        rule_path = File.join(dir, "rule.yaml")
+        target = File.join(dir, target_name)
+        File.write(rule_path, yaml)
+        File.write(target, code)
+
+        cmd = [binary, "scan", "--config", rule_path, "--json", "--disable-version-check", "--no-git-ignore"]
+        cmd << "--metrics=off" if name == "semgrep"
+        out, err, status = capture(cmd << target, chdir: dir)
+        json = parse_json(out)
+        [json, errors_from(json, err, status, dir)]
+      end
+    end
+
+    def parse_json(text)
+      JSON.parse(text.to_s)
+    rescue JSON::ParserError
+      nil
+    end
+
+    def errors_from(json, err, status, dir)
+      if json
+        Array(json["errors"]).reject { |e| e["level"] == "warn" }.map { |e| format_error(e, dir) }.uniq
+      elsif status.nil?
+        ["the engine exceeded the #{timeout}s timeout"]
+      else
+        detail = err.to_s.lines.map(&:strip).reject(&:empty?).last(3).join(" ")
+        ["failed to run #{name} (exit #{status.exitstatus}): #{strip_tmpdir(detail, dir)}"]
+      end
+    end
+
+    def format_error(e, dir)
+      msg = strip_tmpdir((e["long_msg"] || e["message"] || e["short_msg"] || e).to_s, dir).strip
+      line = e.dig("spans", 0, "start", "line")
+      line ? "#{e['type']}: #{msg} (rule line #{line})" : [e["type"], msg].compact.join(": ")
+    end
+
+    # The engine prints the temp dir as given or resolved (macOS /var ->
+    # /private/var), and also in dotted form inside rule ids.
+    def strip_tmpdir(text, dir)
+      paths = [File.realpath(dir), dir].uniq
+      prefixes = paths.map { |p| "#{p}/" } + paths.map { |p| "#{p.delete_prefix('/').tr('/', '.')}." }
+      prefixes.sort_by { |p| -p.length }.reduce(text) { |t, p| t.gsub(p, "") }
+    end
+
+    # check_id comes prefixed with the dotted config path, and rule ids may
+    # contain dots themselves, so match the declared ids.
+    def rule_id_for(check_id, rule_ids)
+      rule_ids.select { |id| check_id == id || check_id.end_with?(".#{id}") }.max_by(&:length) ||
+        check_id.split(".").last
+    end
+
+    def build_finding(r, code, rule_ids)
+      start = r["start"] || {}
+      finish = r["end"] || {}
+      snippet = code.lines[(start["line"].to_i - 1)..(finish["line"].to_i - 1)].to_a.join.chomp
+      metavars = (r.dig("extra", "metavars") || {}).transform_values { |v| v["abstract_content"] }
+      Finding.new(rule_id: rule_id_for(r["check_id"].to_s, rule_ids), line: start["line"], end_line: finish["line"],
+                  col: start["col"], end_col: finish["col"], message: r.dig("extra", "message"),
+                  severity: r.dig("extra", "severity"), code: snippet, metavars: metavars.empty? ? nil : metavars)
+    end
+
+    def capture(cmd, chdir: Dir.pwd)
+      Open3.popen3(QUIET_ENV, *cmd, chdir: chdir, pgroup: true) do |stdin, stdout, stderr, wait|
+        stdin.close
+        out_reader = Thread.new { stdout.read }
+        err_reader = Thread.new { stderr.read }
+        unless wait.join(timeout)
+          begin
+            Process.kill("KILL", -wait.pid)
+          rescue Errno::ESRCH
+            nil
+          end
+          return [nil, "timeout", nil]
+        end
+        [out_reader.value, err_reader.value, wait.value]
+      end
+    rescue Errno::ENOENT => e
+      [nil, e.message, Struct.new(:exitstatus).new(127)]
+    end
+  end
+
+  module Annotations
+    PATTERN = %r{(?:#|//|/\*|<!--|--)\s*(ruleid|ok|todoruleid|todook)\s*:\s*([A-Za-z0-9._\-, ]+)}
+
+    module_function
+
+    def parse(code)
+      lines = code.lines
+      lines.each_with_index.filter_map do |line, idx|
+        m = line.match(PATTERN) or next
+        target = own_line?(line, m) ? next_code_line(lines, idx) : idx + 1
+        { kind: m[1], rule_ids: m[2].split(",").map(&:strip).reject(&:empty?), annotation_line: idx + 1, line: target }
+      end
+    end
+
+    def own_line?(line, match)
+      line[0...match.begin(0)].strip.empty?
+    end
+
+    # Stacked annotations all point to the first line after them.
+    def next_code_line(lines, idx)
+      j = idx + 1
+      j += 1 while j < lines.size && (m = lines[j].match(PATTERN)) && own_line?(lines[j], m)
+      j + 1
+    end
+
+    # Like `--test`, every id in a ruleid/ok/todoruleid annotation must be a
+    # rule of the file (todook is exempt).
+    ID_CHECKED = %w[ruleid ok todoruleid].freeze
+
+    def evaluate(code, findings, rule_ids: [])
+      anns = parse(code)
+      return nil if anns.empty?
+
+      hit = Hash.new { |h, k| h[k] = [] }
+      findings.each { |f| hit[f.line] << f.rule_id }
+      lines = code.lines
+      results = anns.map do |a|
+        unknown = ID_CHECKED.include?(a[:kind]) && rule_ids.any? ? a[:rule_ids] - rule_ids : []
+        next check(a, lines[a[:line] - 1], hit[a[:line]]) if unknown.empty?
+
+        a.merge(line: a[:annotation_line], status: "fail",
+                reason: "`#{a[:kind]}` names a rule that is not in this file: #{unknown.join(', ')}")
+      end
+
+      covered = anns.select { |a| %w[ruleid todoruleid ok].include?(a[:kind]) }.map { |a| a[:line] }
+      findings.reject { |f| covered.include?(f.line) }.each do |f|
+        results << { kind: "unexpected", rule_ids: [f.rule_id], line: f.line, status: "fail",
+                     reason: "unexpected match on line #{f.line} (the line is not marked as expected)" }
+      end
+
+      { total: results.size, passed: results.count { |r| r[:status] == "pass" },
+        failed: results.count { |r| r[:status] == "fail" }, results: results }
+    end
+
+    def check(ann, target, hit_ids)
+      # A blank or missing target would make `ok:` pass without testing anything.
+      if target.nil? || target.strip.empty?
+        return ann.merge(line: ann[:annotation_line], status: "fail",
+                         reason: "`#{ann[:kind]}` annotation has no code below it (line #{ann[:line]} is " \
+                                 "#{target.nil? ? 'past the end of the file' : 'blank'})")
+      end
+
+      found = ann[:rule_ids].any? { |id| hit_ids.include?(id) }
+      case ann[:kind]
+      when "ruleid" then found ? ann.merge(status: "pass") : ann.merge(status: "fail", reason: "false negative: expected a finding on line #{ann[:line]}")
+      when "ok" then found ? ann.merge(status: "fail", reason: "false positive on line #{ann[:line]}") : ann.merge(status: "pass")
+      else ann.merge(status: "todo")
+      end
+    end
+  end
+end

data/lib/trapline/generator.rb

@@ -0,0 +1,236 @@
+# frozen_string_literal: true
+
+module Trapline
+  class Generator
+    # Too broad to pick a template from: the description may say more.
+    GENERIC_CWES = %w[CWE-20 CWE-74 CWE-284 CWE-664 CWE-693 CWE-707].freeze
+    # Bugs in native code, which no rule over application code can find.
+    MEMORY_CWES = %w[CWE-119 CWE-120 CWE-121 CWE-122 CWE-125 CWE-131 CWE-190 CWE-191 CWE-401 CWE-415
+                     CWE-416 CWE-457 CWE-476 CWE-680 CWE-787 CWE-824 CWE-908 CWE-1325].freeze
+
+    Candidate = Struct.new(:key, :kind, :title, :language, :languages, :yaml, :test_code, :notes, keyword_init: true)
+
+    def initialize(client: nil, offline: !Trapline.config.allow_network)
+      @client = client || Cve::Client.new
+      @offline = offline
+    end
+
+    def from_cve(id, language: nil)
+      raise NetworkError, "network access disabled (TRAPLINE_OFFLINE=1); enter the CVE data manually" if @offline
+
+      result = analyze(@client.fetch(id), language: language)
+      if @client.respond_to?(:timed_out?) && @client.timed_out?
+        result[:notes].unshift("The lookup hit its time limit (cve_timeout), so some requests were skipped or cut short: " \
+                               "the data may be incomplete. Try again or fill in the missing fields.")
+      end
+      result
+    end
+
+    def analyze(record, language: nil)
+      record = Cve::Record.from_h(record) if record.is_a?(Hash)
+      record.promote_cve!
+      language = Languages.find(language)&.key if language
+      fallback = record.languages.first
+
+      templates, how = matching_templates(record)
+      notes = [how, memory_note(record), *language_notes(record, language, fallback)].compact
+      candidates = templates.filter_map do |tpl|
+        lang = pick_language(tpl, language, record) or next
+        wanted = language || fallback
+        if wanted && lang != wanted
+          notes << "Template #{tpl.cwe} has no #{lang_name(wanted)} version yet; using #{lang_name(lang)}. " \
+                   "Use the taint skeleton for #{lang_name(wanted)}."
+        end
+        from_template(record, tpl, lang)
+      end
+      candidates += record.runtime_products.filter_map { |product| from_runtime(record, product) }
+      candidates += record.packages.filter_map do |pkg|
+        next if pkg.language.nil? || pkg.runtime_product || (language && pkg.language != language)
+
+        from_dependency(record, pkg)
+      end
+      candidates << starter(record, language || fallback || "ruby", templates.first)
+
+      { record: record.to_h, candidates: candidates.uniq(&:key).map(&:to_h), notes: notes }
+    end
+
+    private
+
+    def memory_note(record)
+      memory = record.cwes & MEMORY_CWES
+      return if memory.empty?
+
+      where = record.product_names.first(3).join(", ")
+      image = record.runtime_products.any? { |p| Runtime.image_rule(p, "x") }
+      "#{memory.join(', ')}: memory-safety flaw in native code. " \
+        "A rule over application code cannot detect the bug itself; check the installed versions#{" (#{where})" unless where.empty?} and upgrade. " \
+        "#{'The container image draft flags affected runtime versions. ' if image}" \
+        "Use the skeleton only to flag code paths that reach the vulnerable feature."
+    end
+
+    def language_notes(record, language, fallback)
+      return [] if language
+      return ["Could not detect the language (no affected packages or known products); using Ruby. Pick the language and generate again."] unless fallback
+      return [] if record.languages.size < 2
+
+      ["Affects several languages (#{record.languages.join(', ')}); drafts that need one use #{fallback}. " \
+       "Pick another in Language to generate them for it."]
+    end
+
+    def matching_templates(record)
+      ranked = Templates.detect([record.summary, record.description].join(" "))
+      by_cwe = record.cwes.filter_map { |c| Templates.for_cwe(c) }.uniq
+      by_cwe = by_cwe.sort_by { |t| [ranked.index(t) || ranked.size, by_cwe.index(t)] }
+      return [by_cwe, "CWE reported by the source: #{record.cwes.join(', ')}."] if by_cwe.any?
+
+      # "remote code execution" in a use-after-free advisory is the impact, not
+      # a code injection: a specific CWE from the source beats a keyword guess.
+      if (record.cwes - GENERIC_CWES).any?
+        return [[], "There is no template for #{record.cwes.join(', ')} yet; no class guessed from the description " \
+                    "because the source already names the weakness."]
+      end
+
+      detected = ranked.first(2)
+      if detected.any?
+        reported = record.cwes.empty? ? "CWE (not reported)" : record.cwes.join(", ")
+        return [detected, "No template for #{reported}; class detected from the description: #{detected.map(&:cwe).join(', ')}."]
+      end
+
+      [[], record.cwes.empty? ? "The source reported no CWE and the description did not point to a known class." : "There is no template for #{record.cwes.join(', ')} yet."]
+    end
+
+    def pick_language(tpl, preferred, record)
+      [preferred, *record.languages, "ruby", *tpl.languages.keys].compact.find { |l| tpl.supports?(l) }
+    end
+
+    def from_template(record, tpl, lang)
+      id = rule_id(record, slugify(tpl.title), lang: lang)
+      rule = Rule.new(base(record, id, lang, message: "#{record.id}: #{truncate(record.title, 180)}\n\n#{tpl.message.strip}",
+                                             cwe: tpl.label, owasp: tpl.owasp, confidence: "MEDIUM").merge(tpl.body(lang)))
+      notes = [
+        "Generic #{tpl.title} template for #{lang_name(lang)}. Adjust sources/sinks to the affected component's APIs.",
+        "The test code uses `ruleid:`/`ok:` annotations; add examples from the real vulnerable and fixed code."
+      ]
+      notes << "Templates also available in: #{(tpl.languages.keys - [lang]).join(', ')}." if tpl.languages.size > 1
+      Candidate.new(key: "cwe:#{tpl.cwe}:#{lang}", kind: "cwe", title: "#{tpl.title} (#{tpl.cwe})",
+                    language: lang, languages: tpl.languages.keys, yaml: rule.to_yaml,
+                    test_code: tpl.test_code(lang, id), notes: notes)
+    end
+
+    def from_runtime(record, product)
+      runtime = Runtime.runtime_for(product) or return nil
+      name = runtime[:name]
+      id = rule_id(record, "vulnerable-#{name}-image", lang: "regex", scope: name)
+      rt = Runtime.image_rule(product, id) or return nil
+
+      image = rt[:images].first
+      rule = Rule.new(base(record, id, "regex",
+                           message: "This image reference uses a #{name} version affected by #{record.id}: " \
+                                    "#{short_title(record)}.#{upgrade_hint(rt[:fixed], 'No fixed version reported yet.')}",
+                           cwe: all_cwes(record), confidence: "HIGH").merge(rt[:body]))
+      rule.metadata["affected"] = [{ "image" => rt[:images].join(", "), "fixed" => rt[:fixed] }.reject { |_, v| v.empty? }]
+      notes = [
+        "Flags references to #{rt[:images].map { |i| "`#{i}:<tag>`" }.join(' and ')} whose version is in the ranges reported by NVD: " \
+        "Dockerfile `FROM`, `image:` in Compose, Kubernetes and CI files, Helm `repository:` + `tag:`, `docker run`. " \
+        "It runs on every file; to narrow it, add `paths: include:` (e.g. Dockerfile, *.yml, *.yaml).",
+        "Floating tags (#{floating_example(image, rt[:fixed])}, #{image}:latest) are only flagged when the whole line is affected: they move to the latest patch on rebuild. " \
+        "Tags set through variables (`${PHP_VERSION}`, Helm templates) are not resolved.",
+        "Covers only the official image. Built images, other base images and OS packages need an image scanner: " \
+        "Trivy (`trivy image`), Grype or osv-scanner (`osv-scanner scan image`)."
+      ]
+      if %w[dotnet aspnet].include?(name)
+        notes << "The SDK image (mcr.microsoft.com/dotnet/sdk) is not covered: its tags use SDK version numbers (8.0.404), not the runtime's."
+      end
+      Candidate.new(key: "runtime:#{name}", kind: "runtime", title: "Vulnerable #{name} version in container images",
+                    language: "regex", languages: ["regex"], yaml: rule.to_yaml, test_code: rt[:test], notes: notes)
+    end
+
+    def floating_example(image, fixed)
+      v = fixed.first
+      v ? "#{image}:#{v.split('.').first(2).join('.')}" : "#{image}:<major>"
+    end
+
+    def from_dependency(record, pkg)
+      pkg_slug = slugify(pkg.name.split(%r{[:/]}).last)
+      id = rule_id(record, "#{pkg_slug}-usage", lang: pkg.language, scope: pkg_slug)
+      dep = Templates.dependency(pkg, id) or return nil
+
+      rule = Rule.new(base(record, id, dep[:language],
+                           message: "This code uses #{pkg.name}, affected by #{record.id}: " \
+                                    "#{short_title(record)}.#{upgrade_hint(Array(pkg.fixed))}",
+                           cwe: all_cwes(record), confidence: "LOW").merge(dep[:body]))
+      rule.metadata["affected"] = [{ "package" => pkg.name, "ecosystem" => pkg.ecosystem,
+                                     "introduced" => pkg.introduced, "fixed" => pkg.fixed }.compact]
+      notes = [
+        "Finds imports/declarations of #{pkg.name} (#{pkg.ecosystem}). The rule does not check the installed version — pair it with an SCA tool (bundler-audit, npm audit, osv-scanner).",
+        "Refine it with the specific vulnerable API (e.g. the method named in the advisory) to reduce noise."
+      ]
+      Candidate.new(key: "dependency:#{pkg.ecosystem}:#{pkg.name}", kind: "dependency",
+                    title: "Usage of package #{pkg.name} (#{pkg.ecosystem})", language: dep[:language],
+                    languages: [dep[:language]], yaml: rule.to_yaml, test_code: dep[:test], notes: notes)
+    end
+
+    def starter(record, lang, tpl)
+      id = rule_id(record, "custom", lang: lang)
+      skeleton = Templates.starter("taint", language: lang, id: id)
+      rule = Rule.parse(skeleton[:yaml])
+      rule.merge_fields("message" => "#{record.id}: #{truncate(record.title, 180)}")
+      rule.data.merge!(base(record, id, lang, message: rule.message, cwe: all_cwes(record),
+                                              owasp: tpl&.owasp, confidence: "LOW").slice("severity", "metadata"))
+      Candidate.new(key: "starter:#{lang}", kind: "starter", title: "Taint skeleton (write from scratch)",
+                    language: lang, languages: [lang], yaml: rule.to_yaml, test_code: skeleton[:test_code],
+                    notes: ["Skeleton with the CVE metadata filled in. Define sources, sanitizers and sinks based on the advisory."])
+    end
+
+    def base(record, id, lang, message:, cwe: nil, owasp: nil, confidence: "MEDIUM")
+      ids = [record.id, *record.aliases]
+      nvd = ["https://nvd.nist.gov/vuln/detail/#{record.id}"] if record.id.to_s.start_with?("CVE-")
+      meta = {
+        "cve" => ids.grep(/\ACVE-/).uniq, "ghsa" => ids.grep(/\AGHSA-/).uniq,
+        "cwe" => Array(cwe).compact, "owasp" => Array(owasp),
+        "category" => "security", "subcategory" => ["vuln"], "confidence" => confidence,
+        "likelihood" => "MEDIUM", "impact" => impact(record), "cvss_score" => record.cvss_score&.to_s,
+        "references" => (Array(nvd) + record.references.first(4)).uniq, "source" => "trapline #{VERSION}"
+      }.reject { |_, v| v.nil? || (v.respond_to?(:empty?) && v.empty?) }
+      { "id" => id, "message" => message, "severity" => record.rule_severity, "languages" => [lang], "metadata" => meta }
+    end
+
+    def all_cwes(record)
+      record.cwes.map { |c| Templates.cwe_name(c) }
+    end
+
+    def impact(record)
+      { "CRITICAL" => "HIGH", "HIGH" => "HIGH", "LOW" => "LOW" }.fetch(record.severity.to_s, "MEDIUM")
+    end
+
+    def upgrade_hint(fixed, none = nil)
+      return " #{none}".rstrip if fixed.empty?
+
+      " Upgrade to #{fixed.join(', ')} or later."
+    end
+
+    # <language>.<framework, package or "lang">.security.<cve>-<suffix>
+    def rule_id(record, suffix, lang:, scope: nil)
+      name = [record.id.to_s.downcase, suffix].reject(&:empty?).join("-")
+      scope = slugify(scope)
+      [slugify(lang), scope.empty? ? "lang" : scope, "security", name].join(".")
+    end
+
+    def lang_name(key)
+      Languages.find(key)&.name || key
+    end
+
+    def short_title(record)
+      truncate(record.title, 160).delete_suffix(".")
+    end
+
+    def slugify(text)
+      text.to_s.downcase.gsub(/\(.*?\)/, "").gsub(/[^a-z0-9]+/, "-").gsub(/\A-|-\z/, "")
+    end
+
+    def truncate(text, len)
+      t = text.to_s.gsub(/\s+/, " ").strip
+      t.length > len ? "#{t[0, len - 1].rstrip}…" : t
+    end
+  end
+end

data/lib/trapline/languages.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module Trapline
+  module Languages
+    Lang = Struct.new(:key, :name, :extension, :comment, :aliases, keyword_init: true)
+
+    ALL = [
+      Lang.new(key: "ruby",       name: "Ruby",       extension: "rb",    comment: "#",  aliases: %w[rb]),
+      Lang.new(key: "python",     name: "Python",     extension: "py",    comment: "#",  aliases: %w[py python3]),
+      Lang.new(key: "javascript", name: "JavaScript", extension: "js",    comment: "//", aliases: %w[js]),
+      Lang.new(key: "typescript", name: "TypeScript", extension: "ts",    comment: "//", aliases: %w[ts]),
+      Lang.new(key: "java",       name: "Java",       extension: "java",  comment: "//", aliases: []),
+      Lang.new(key: "go",         name: "Go",         extension: "go",    comment: "//", aliases: %w[golang]),
+      Lang.new(key: "php",        name: "PHP",        extension: "php",   comment: "//", aliases: []),
+      Lang.new(key: "csharp",     name: "C#",         extension: "cs",    comment: "//", aliases: %w[cs c#]),
+      Lang.new(key: "kotlin",     name: "Kotlin",     extension: "kt",    comment: "//", aliases: %w[kt]),
+      Lang.new(key: "scala",      name: "Scala",      extension: "scala", comment: "//", aliases: []),
+      Lang.new(key: "rust",       name: "Rust",       extension: "rs",    comment: "//", aliases: []),
+      Lang.new(key: "c",          name: "C",          extension: "c",     comment: "//", aliases: []),
+      Lang.new(key: "cpp",        name: "C++",        extension: "cpp",   comment: "//", aliases: %w[c++]),
+      Lang.new(key: "swift",      name: "Swift",      extension: "swift", comment: "//", aliases: []),
+      Lang.new(key: "bash",       name: "Bash",       extension: "sh",    comment: "#",  aliases: %w[sh]),
+      Lang.new(key: "yaml",       name: "YAML",       extension: "yaml",  comment: "#",  aliases: %w[yml]),
+      Lang.new(key: "json",       name: "JSON",       extension: "json",  comment: "//", aliases: []),
+      Lang.new(key: "dockerfile", name: "Dockerfile", extension: "dockerfile", comment: "#", aliases: %w[docker]),
+      Lang.new(key: "terraform",  name: "Terraform",  extension: "tf",    comment: "#",  aliases: %w[hcl tf]),
+      Lang.new(key: "generic",    name: "Generic",    extension: "txt",   comment: "#",  aliases: []),
+      Lang.new(key: "regex",      name: "Regex",      extension: "txt",   comment: "#",  aliases: %w[none])
+    ].freeze
+
+    module_function
+
+    def all
+      ALL
+    end
+
+    def keys
+      ALL.flat_map { |l| [l.key, *l.aliases] }
+    end
+
+    def find(name)
+      return nil if name.nil?
+
+      n = name.to_s.downcase
+      ALL.find { |l| l.key == n || l.aliases.include?(n) }
+    end
+
+    def known?(name)
+      !find(name).nil?
+    end
+
+    def extension_for(name)
+      find(name)&.extension || "txt"
+    end
+
+    def comment_for(name)
+      find(name)&.comment || "#"
+    end
+
+    def from_extension(ext)
+      e = ext.to_s.delete_prefix(".").downcase
+      ALL.find { |l| l.extension == e }
+    end
+  end
+end

data/lib/trapline/railtie.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Trapline
+  class Railtie < ::Rails::Railtie
+    config.trapline = ActiveSupport::OrderedOptions.new
+
+    initializer "trapline.defaults", before: :load_config_initializers do |app|
+      Trapline.config.rules_path = app.root.join("security", "semgrep").to_s unless ENV["TRAPLINE_RULES_PATH"]
+      Trapline.config.read_only = !Rails.env.development?
+    end
+
+    initializer "trapline.config", after: :load_config_initializers do |app|
+      app.config.trapline.each do |key, value|
+        Trapline.config.public_send("#{key}=", value) if Trapline.config.respond_to?("#{key}=")
+      end
+    end
+
+    rake_tasks do
+      load File.expand_path("../tasks/trapline.rake", __dir__)
+    end
+
+    generators do
+      require_relative "../generators/trapline/install_generator"
+    end
+  end
+end