@codacy/tools-opengrep-1 0.18.0 → 0.19.0

package/README.md

@@ -119,6 +119,37 @@ curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh |
 
 ## Notes for maintainers
 
+- **Preset mappings (`src/pattern-mappings.json`)**: prefixes are the upstream rule paths
+  (`Semgrep_<lang>.<framework>.…`), which already name the framework, so this mapping is
+  prefix-only — Opengrep's tags are topical (`security`, `audit`) and would over-match. 22 keys
+  were added, taking ~91 default-on patterns out of repos that lack the framework: Pyramid (16),
+  PyCryptodome (12), Kubernetes/Helm (14, via `yaml.kubernetes.` + `codacy.k8s.`; the `kubernetes` signal matches
+  loose manifests under `k8s/`/`kubernetes/`/`manifests/`, not just `kustomization.yaml`, or the
+  most common layout would have lost all 14), GitHub Actions
+  (5), AWS CDK (5), Jinja2 (2), and the smaller Boto3/Twilio/Android/Sequelize/Doctrine families.
+  The YAML-language families matter most: before this they fired in any repo containing a single
+  `.yaml` file.
+
+  The `*.aws-lambda.` packs (34 default-on across Python, JavaScript, Ruby and Go) are claimed
+  by **seven** keys — `serverless-framework`, `cloudformation`, `aws-cdk`, `boto3`, `aws-sdk`,
+  `aws-sdk-go` and `lang:Terraform`. Handler code carries no manifest of its own; the only
+  evidence is how it is deployed or which SDK it calls, and any one of the seven is enough.
+  Terraform earns a key because deploying a Lambda with `aws_lambda_function` leaves no other
+  trace, and the SDK telltales had to learn npm's v2 `aws-sdk`, Go's v1 `aws-sdk-go` and PyPI's
+  `botocore`/`aws-lambda-powertools` — Lambda runtimes preinstall boto3, so it is often absent
+  from `requirements.txt` entirely.
+
+  `Semgrep_python.jinja2.` is claimed by `jinja2` **and** `flask`: Flask hard-depends on Jinja2,
+  so gating on a direct `jinja2` declaration alone dropped both Error-severity autoescape rules
+  from most real Flask repos.
+
+  Deliberately still universal, guarded by a test so it stays that way:
+  `*.lang.*` (the generic per-language packs), `csharp.dotnet.` (the platform, not a library),
+  `terraform.*` (already gated by the `Terraform` language), `problem-based-packs.*`
+  (cross-language), and `apex.` / `generic.visualforce.` — Apex and VisualForce are
+  Salesforce-only _languages_, so the language gate already scopes them and keying them on
+  `salesforce` would only add a way to miss them in a Salesforce repo with no `sfdx-project.json`.
+
 - **Tool ID is `Semgrep`** for legacy compatibility with the Codacy platform. The `displayName` is set to `Opengrep` for CLI display. Never change the tool ID without coordinating with the Codacy platform team.
 - **Config materialization**: When Codacy patterns are specified, the adapter loads `src/rules.yaml`, filters to enabled rules, and writes a filtered config to `.codacy/generated/opengrep-rules.yaml`.
 - **check_id prefix stripping**: Opengrep prepends a path-based namespace to check_ids derived from the config file path relative to cwd. The adapter computes and strips this prefix (e.g. `codacy.generated.`) plus any `tmp.` legacy prefix.

package/dist/index.js

@@ -29983,76 +29983,76 @@ var patterns_default = [
 
 // src/pattern-mappings.json
 var pattern_mappings_default = {
-  Django: {
+  django: {
     prefixes: ["Semgrep_python.django."]
   },
-  Flask: {
-    prefixes: ["Semgrep_python.flask."]
+  flask: {
+    prefixes: ["Semgrep_python.flask.", "Semgrep_python.jinja2."]
   },
-  FastAPI: {
+  fastapi: {
     prefixes: ["Semgrep_python.fastapi."]
   },
-  SQLAlchemy: {
+  sqlalchemy: {
     prefixes: ["Semgrep_python.sqlalchemy."]
   },
-  Express: {
+  express: {
     prefixes: ["Semgrep_javascript.express."]
   },
-  React: {
+  react: {
     prefixes: ["Semgrep_javascript.react.", "Semgrep_typescript.react."]
   },
-  Angular: {
+  angular: {
     prefixes: ["Semgrep_javascript.angular.", "Semgrep_typescript.angular."]
   },
-  "Vue.js": {
+  vue: {
     prefixes: ["Semgrep_javascript.vue."]
   },
-  NestJS: {
+  nestjs: {
     prefixes: ["Semgrep_typescript.nestjs."]
   },
-  jQuery: {
+  jquery: {
     prefixes: ["Semgrep_javascript.jquery."]
   },
-  Playwright: {
+  playwright: {
     prefixes: ["Semgrep_javascript.playwright."]
   },
-  "Ruby on Rails": {
+  "ruby-on-rails": {
     prefixes: ["Semgrep_ruby.rails."]
   },
-  "Play Framework": {
+  "play-framework": {
     prefixes: ["Semgrep_scala.play.", "Semgrep_scala_ssrf_rule-Play"]
   },
-  Slick: {
+  slick: {
     prefixes: ["Semgrep_scala.slick."]
   },
   "jwt-scala": {
     prefixes: ["Semgrep_scala.jwt-scala.", "Semgrep_scala.scala-jwt."]
   },
-  "Spring Boot": {
+  "spring-boot": {
     prefixes: ["Semgrep_java.spring."]
   },
-  "Spring Framework": {
+  "spring-framework": {
     prefixes: ["Semgrep_java.spring."]
   },
-  Laravel: {
+  laravel: {
     prefixes: ["Semgrep_php.laravel."]
   },
-  WordPress: {
+  wordpress: {
     prefixes: ["Semgrep_php.wordpress-plugins."]
   },
-  "Gorilla Mux": {
+  "gorilla-mux": {
     prefixes: ["Semgrep_go.gorilla."]
   },
-  GORM: {
+  "go-gorm": {
     prefixes: ["Semgrep_go.gorm."]
   },
-  gRPC: {
+  grpc: {
     prefixes: ["Semgrep_go.grpc."]
   },
-  MongoDB: {
+  mongodb: {
     prefixes: ["Semgrep_java.mongodb.", "Semgrep_python.pymongo."]
   },
-  Mongoose: {
+  mongoose: {
     prefixes: ["Semgrep_python.pymongo."]
   },
   i18next: {
@@ -30080,7 +30080,7 @@ var pattern_mappings_default = {
       "Semgrep_codacy.python.i18n."
     ]
   },
-  Lingui: {
+  lingui: {
     prefixes: [
       "Semgrep_codacy.cpp.i18n.",
       "Semgrep_codacy.java.i18n.",
@@ -30096,13 +30096,116 @@ var pattern_mappings_default = {
       "Semgrep_codacy.python.i18n."
     ]
   },
-  "Flask-Babel": {
+  "flask-babel": {
     prefixes: [
       "Semgrep_codacy.cpp.i18n.",
       "Semgrep_codacy.java.i18n.",
       "Semgrep_codacy.js.i18n.",
       "Semgrep_codacy.python.i18n."
     ]
+  },
+  pyramid: {
+    prefixes: ["Semgrep_python.pyramid."]
+  },
+  pycryptodome: {
+    prefixes: ["Semgrep_python.pycryptodome."]
+  },
+  jinja2: {
+    prefixes: ["Semgrep_python.jinja2."]
+  },
+  boto3: {
+    prefixes: [
+      "Semgrep_python.boto3.",
+      "Semgrep_python.aws-lambda.",
+      "Semgrep_javascript.aws-lambda.",
+      "Semgrep_ruby.aws-lambda.",
+      "Semgrep_go.aws-lambda."
+    ]
+  },
+  twilio: {
+    prefixes: ["Semgrep_python.twilio."]
+  },
+  requests: {
+    prefixes: ["Semgrep_python.requests."]
+  },
+  "android-sdk": {
+    prefixes: ["Semgrep_java.android."]
+  },
+  sequelize: {
+    prefixes: ["Semgrep_javascript.sequelize."]
+  },
+  puppeteer: {
+    prefixes: ["Semgrep_javascript.puppeteer."]
+  },
+  electron: {
+    prefixes: ["Semgrep_rules_lgpl_javascript_electronjs_"]
+  },
+  symfony: {
+    prefixes: ["Semgrep_php.symfony."]
+  },
+  "doctrine-orm": {
+    prefixes: ["Semgrep_php.doctrine."]
+  },
+  "doctrine-dbal": {
+    prefixes: ["Semgrep_php.doctrine."]
+  },
+  kubernetes: {
+    prefixes: ["Semgrep_yaml.kubernetes.", "Semgrep_codacy.k8s."]
+  },
+  helm: {
+    prefixes: ["Semgrep_yaml.kubernetes.", "Semgrep_codacy.k8s."]
+  },
+  "github-actions": {
+    prefixes: ["Semgrep_yaml.github-actions."]
+  },
+  "aws-cdk": {
+    prefixes: [
+      "Semgrep_typescript.aws-cdk.",
+      "Semgrep_python.aws-lambda.",
+      "Semgrep_javascript.aws-lambda.",
+      "Semgrep_ruby.aws-lambda.",
+      "Semgrep_go.aws-lambda."
+    ]
+  },
+  "aws-sdk": {
+    prefixes: [
+      "Semgrep_python.aws-lambda.",
+      "Semgrep_javascript.aws-lambda.",
+      "Semgrep_ruby.aws-lambda.",
+      "Semgrep_go.aws-lambda."
+    ]
+  },
+  "aws-sdk-go": {
+    prefixes: [
+      "Semgrep_python.aws-lambda.",
+      "Semgrep_javascript.aws-lambda.",
+      "Semgrep_ruby.aws-lambda.",
+      "Semgrep_go.aws-lambda."
+    ]
+  },
+  "serverless-framework": {
+    prefixes: [
+      "Semgrep_python.aws-lambda.",
+      "Semgrep_javascript.aws-lambda.",
+      "Semgrep_ruby.aws-lambda.",
+      "Semgrep_go.aws-lambda."
+    ]
+  },
+  cloudformation: {
+    prefixes: [
+      "Semgrep_python.aws-lambda.",
+      "Semgrep_javascript.aws-lambda.",
+      "Semgrep_ruby.aws-lambda.",
+      "Semgrep_go.aws-lambda."
+    ]
+  },
+  "lang:Terraform": {
+    prefixes: [
+      "Semgrep_python.aws-lambda.",
+      "Semgrep_javascript.aws-lambda.",
+      "Semgrep_ruby.aws-lambda.",
+      "Semgrep_go.aws-lambda."
+    ]
   }
 };
 

package/dist/metadata.js

@@ -26,76 +26,76 @@ module.exports = __toCommonJS(metadata_exports);
 
 // src/pattern-mappings.json
 var pattern_mappings_default = {
-  Django: {
+  django: {
     prefixes: ["Semgrep_python.django."]
   },
-  Flask: {
-    prefixes: ["Semgrep_python.flask."]
+  flask: {
+    prefixes: ["Semgrep_python.flask.", "Semgrep_python.jinja2."]
   },
-  FastAPI: {
+  fastapi: {
     prefixes: ["Semgrep_python.fastapi."]
   },
-  SQLAlchemy: {
+  sqlalchemy: {
     prefixes: ["Semgrep_python.sqlalchemy."]
   },
-  Express: {
+  express: {
     prefixes: ["Semgrep_javascript.express."]
   },
-  React: {
+  react: {
     prefixes: ["Semgrep_javascript.react.", "Semgrep_typescript.react."]
   },
-  Angular: {
+  angular: {
     prefixes: ["Semgrep_javascript.angular.", "Semgrep_typescript.angular."]
   },
-  "Vue.js": {
+  vue: {
     prefixes: ["Semgrep_javascript.vue."]
   },
-  NestJS: {
+  nestjs: {
     prefixes: ["Semgrep_typescript.nestjs."]
   },
-  jQuery: {
+  jquery: {
     prefixes: ["Semgrep_javascript.jquery."]
   },
-  Playwright: {
+  playwright: {
     prefixes: ["Semgrep_javascript.playwright."]
   },
-  "Ruby on Rails": {
+  "ruby-on-rails": {
     prefixes: ["Semgrep_ruby.rails."]
   },
-  "Play Framework": {
+  "play-framework": {
     prefixes: ["Semgrep_scala.play.", "Semgrep_scala_ssrf_rule-Play"]
   },
-  Slick: {
+  slick: {
     prefixes: ["Semgrep_scala.slick."]
   },
   "jwt-scala": {
     prefixes: ["Semgrep_scala.jwt-scala.", "Semgrep_scala.scala-jwt."]
   },
-  "Spring Boot": {
+  "spring-boot": {
     prefixes: ["Semgrep_java.spring."]
   },
-  "Spring Framework": {
+  "spring-framework": {
     prefixes: ["Semgrep_java.spring."]
   },
-  Laravel: {
+  laravel: {
     prefixes: ["Semgrep_php.laravel."]
   },
-  WordPress: {
+  wordpress: {
     prefixes: ["Semgrep_php.wordpress-plugins."]
   },
-  "Gorilla Mux": {
+  "gorilla-mux": {
     prefixes: ["Semgrep_go.gorilla."]
   },
-  GORM: {
+  "go-gorm": {
     prefixes: ["Semgrep_go.gorm."]
   },
-  gRPC: {
+  grpc: {
     prefixes: ["Semgrep_go.grpc."]
   },
-  MongoDB: {
+  mongodb: {
     prefixes: ["Semgrep_java.mongodb.", "Semgrep_python.pymongo."]
   },
-  Mongoose: {
+  mongoose: {
     prefixes: ["Semgrep_python.pymongo."]
   },
   i18next: {
@@ -123,7 +123,7 @@ var pattern_mappings_default = {
       "Semgrep_codacy.python.i18n."
     ]
   },
-  Lingui: {
+  lingui: {
     prefixes: [
       "Semgrep_codacy.cpp.i18n.",
       "Semgrep_codacy.java.i18n.",
@@ -139,13 +139,116 @@ var pattern_mappings_default = {
       "Semgrep_codacy.python.i18n."
     ]
   },
-  "Flask-Babel": {
+  "flask-babel": {
     prefixes: [
       "Semgrep_codacy.cpp.i18n.",
       "Semgrep_codacy.java.i18n.",
       "Semgrep_codacy.js.i18n.",
       "Semgrep_codacy.python.i18n."
     ]
+  },
+  pyramid: {
+    prefixes: ["Semgrep_python.pyramid."]
+  },
+  pycryptodome: {
+    prefixes: ["Semgrep_python.pycryptodome."]
+  },
+  jinja2: {
+    prefixes: ["Semgrep_python.jinja2."]
+  },
+  boto3: {
+    prefixes: [
+      "Semgrep_python.boto3.",
+      "Semgrep_python.aws-lambda.",
+      "Semgrep_javascript.aws-lambda.",
+      "Semgrep_ruby.aws-lambda.",
+      "Semgrep_go.aws-lambda."
+    ]
+  },
+  twilio: {
+    prefixes: ["Semgrep_python.twilio."]
+  },
+  requests: {
+    prefixes: ["Semgrep_python.requests."]
+  },
+  "android-sdk": {
+    prefixes: ["Semgrep_java.android."]
+  },
+  sequelize: {
+    prefixes: ["Semgrep_javascript.sequelize."]
+  },
+  puppeteer: {
+    prefixes: ["Semgrep_javascript.puppeteer."]
+  },
+  electron: {
+    prefixes: ["Semgrep_rules_lgpl_javascript_electronjs_"]
+  },
+  symfony: {
+    prefixes: ["Semgrep_php.symfony."]
+  },
+  "doctrine-orm": {
+    prefixes: ["Semgrep_php.doctrine."]
+  },
+  "doctrine-dbal": {
+    prefixes: ["Semgrep_php.doctrine."]
+  },
+  kubernetes: {
+    prefixes: ["Semgrep_yaml.kubernetes.", "Semgrep_codacy.k8s."]
+  },
+  helm: {
+    prefixes: ["Semgrep_yaml.kubernetes.", "Semgrep_codacy.k8s."]
+  },
+  "github-actions": {
+    prefixes: ["Semgrep_yaml.github-actions."]
+  },
+  "aws-cdk": {
+    prefixes: [
+      "Semgrep_typescript.aws-cdk.",
+      "Semgrep_python.aws-lambda.",
+      "Semgrep_javascript.aws-lambda.",
+      "Semgrep_ruby.aws-lambda.",
+      "Semgrep_go.aws-lambda."
+    ]
+  },
+  "aws-sdk": {
+    prefixes: [
+      "Semgrep_python.aws-lambda.",
+      "Semgrep_javascript.aws-lambda.",
+      "Semgrep_ruby.aws-lambda.",
+      "Semgrep_go.aws-lambda."
+    ]
+  },
+  "aws-sdk-go": {
+    prefixes: [
+      "Semgrep_python.aws-lambda.",
+      "Semgrep_javascript.aws-lambda.",
+      "Semgrep_ruby.aws-lambda.",
+      "Semgrep_go.aws-lambda."
+    ]
+  },
+  "serverless-framework": {
+    prefixes: [
+      "Semgrep_python.aws-lambda.",
+      "Semgrep_javascript.aws-lambda.",
+      "Semgrep_ruby.aws-lambda.",
+      "Semgrep_go.aws-lambda."
+    ]
+  },
+  cloudformation: {
+    prefixes: [
+      "Semgrep_python.aws-lambda.",
+      "Semgrep_javascript.aws-lambda.",
+      "Semgrep_ruby.aws-lambda.",
+      "Semgrep_go.aws-lambda."
+    ]
+  },
+  "lang:Terraform": {
+    prefixes: [
+      "Semgrep_python.aws-lambda.",
+      "Semgrep_javascript.aws-lambda.",
+      "Semgrep_ruby.aws-lambda.",
+      "Semgrep_go.aws-lambda."
+    ]
   }
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codacy/tools-opengrep-1",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "Opengrep adapter — CLI-mode multi-language SAST scanner",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -10,7 +10,7 @@
   ],
   "dependencies": {
     "yaml": "^2.6.0",
-    "@codacy/tooling": "0.18.0"
+    "@codacy/tooling": "0.19.0"
   },
   "license": "MIT",
   "author": "Codacy <support@codacy.com> (https://www.codacy.com)",