pi-lens 3.8.73 → 4.0.0

package/rules/tree-sitter-queries/plsql-disabled/forallsave-exceptions.yml

@@ -1,51 +0,0 @@
-# FORALL Save Exceptions
-# Detects FORALL statements without SAVE EXCEPTIONS
-id: forallsave-exceptions
-name: FORALL Should Use SAVE EXCEPTIONS Clause
-severity: error
-category: reliability
-defect_class: correctness
-inline_tier: blocking
-language: plsql
-
-message: "FORALL statement should use the SAVE EXCEPTIONS clause"
-
-description: |
-  FORALL without SAVE EXCEPTIONS stops on first error, 
-  losing information about which rows failed. Use SAVE EXCEPTIONS
-  to continue and get error details for all failed rows.
-
-  ✅ FIX: Add SAVE EXCEPTIONS clause
-
-  ```sql
-  FORALL i IN 1..collection.COUNT SAVE EXCEPTIONS
-      INSERT INTO table VALUES collection(i);  -- GOOD
-  ```
-
-query: |
-  (forall_statement
-    (forall) @FORALL
-    (bulk_operation) @OP)
-
-metavars:
-  - FORALL
-  - OP
-
-post_filter: missing_save_exceptions
-
-tags:
-  - reliability
-  - plsql
-  - error-handling
-
-examples:
-  bad: |
-    FORALL i IN 1..employees.COUNT
-        INSERT INTO emp VALUES employees(i);  -- BAD - no SAVE EXCEPTIONS
-
-  good: |
-    FORALL i IN 1..employees.COUNT SAVE EXCEPTIONS
-        INSERT INTO emp VALUES employees(i);  -- GOOD
-
-has_fix: true
-fix_action: add_save_exceptions

package/rules/tree-sitter-queries/plsql-disabled/nchar-nvarchar2-bytes.yml

@@ -1,54 +0,0 @@
-# NCHAR NVARCHAR2 Byte Size
-# Detects NCHAR/NVARCHAR2 with size in bytes
-id: nchar-nvarchar2-bytes
-name: NCHAR and NVARCHAR2 Size Should Not Be Specified in Bytes
-severity: error
-category: reliability
-defect_class: correctness
-inline_tier: blocking
-language: plsql
-
-message: "NCHAR/NVARCHAR2 size should be in characters, not bytes"
-
-description: |
-  NCHAR and NVARCHAR2 store Unicode characters. Specifying size
-  in bytes is confusing and may cause data truncation. Use character
-  semantics with CHAR keyword.
-
-  ✅ FIX: Use CHAR keyword for character semantics
-
-  ```sql
-  name NCHAR(10 CHAR)  -- GOOD - characters
-  ```
-
-query: |
-  (variable_declaration
-    (nchar_type) @TYPE
-    (size_specification) @SIZE)
-  (variable_declaration
-    (nvarchar2_type) @TYPE
-    (size_specification) @SIZE)
-
-metavars:
-  - TYPE
-  - SIZE
-
-post_filter: size_in_bytes_not_char
-
-tags:
-  - reliability
-  - plsql
-  - unicode
-  - data-integrity
-
-examples:
-  bad: |
-    name NCHAR(10 BYTE);     -- BAD - bytes
-    text NVARCHAR2(100);     -- BAD - defaults to bytes
-
-  good: |
-    name NCHAR(10 CHAR);     -- GOOD - characters
-    text NVARCHAR2(100 CHAR); -- GOOD - explicit
-
-has_fix: true
-fix_action: add_char_keyword

package/rules/tree-sitter-queries/plsql-disabled/not-null-initialization.yml

@@ -1,59 +0,0 @@
-# NOT NULL Initialization
-# Detects NOT NULL variables without initialization
-id: not-null-initialization
-name: NOT NULL Variables Should Be Initialized
-severity: error
-category: reliability
-defect_class: correctness
-inline_tier: blocking
-language: plsql
-
-message: "NOT NULL variable should be initialized"
-
-description: |
-  Declaring a NOT NULL variable without initialization causes
-  a runtime error when trying to use it. Initialize at declaration
-  or in the BEGIN block.
-
-  ✅ FIX: Initialize the variable
-
-  ```sql
-  DECLARE
-      v_count NUMBER NOT NULL := 0;  -- GOOD - initialized
-  BEGIN
-      -- use v_count
-  END;
-  ```
-
-query: |
-  (variable_declaration
-    (not_null) @NOTNULL
-    (assignment)? @INIT)
-
-metavars:
-  - NOTNULL
-  - INIT
-
-post_filter: not_null_without_init
-
-tags:
-  - reliability
-  - plsql
-  - runtime-error
-
-examples:
-  bad: |
-    DECLARE
-        v_count NUMBER NOT NULL;  -- BAD - not initialized
-    BEGIN
-        DBMS_OUTPUT.PUT_LINE(v_count);
-    END;
-
-  good: |
-    DECLARE
-        v_count NUMBER NOT NULL := 0;  -- GOOD
-    BEGIN
-        DBMS_OUTPUT.PUT_LINE(v_count);
-    END;
-
-has_fix: false

package/rules/tree-sitter-queries/plsql-disabled/raise-application-error-codes.yml

@@ -1,50 +0,0 @@
-# RAISE_APPLICATION_ERROR Codes
-# Detects RAISE_APPLICATION_ERROR with invalid error codes
-id: raise-application-error-codes
-name: RAISE_APPLICATION_ERROR Should Use Valid Error Codes
-severity: error
-category: reliability
-defect_class: correctness
-inline_tier: blocking
-language: plsql
-
-message: "RAISE_APPLICATION_ERROR should only be used with error codes from -20000 to -20999"
-
-description: |
-  RAISE_APPLICATION_ERROR should use codes in the -20000 to -20999
-  range (user-defined errors). Other codes may conflict with Oracle
-  reserved error codes.
-
-  ✅ FIX: Use a code in the -20000..-20999 range
-
-  ```sql
-  RAISE_APPLICATION_ERROR(-20001, 'Custom error');  -- GOOD
-  ```
-
-query: |
-  (raise_statement
-    (raise_application_error) @RAISE
-    (argument_list
-      (numeric_literal) @CODE))
-
-metavars:
-  - RAISE
-  - CODE
-
-post_filter: invalid_error_code_range
-
-tags:
-  - reliability
-  - plsql
-  - error-handling
-
-examples:
-  bad: |
-    RAISE_APPLICATION_ERROR(-1, 'Error');  -- BAD - invalid code
-    RAISE_APPLICATION_ERROR(-30000, 'Error');  -- BAD - out of range
-
-  good: |
-    RAISE_APPLICATION_ERROR(-20001, 'Custom error');  -- GOOD
-    RAISE_APPLICATION_ERROR(-20999, 'Another error');  -- GOOD
-
-has_fix: false

package/rules/tree-sitter-queries/typescript-disabled/ts-path-traversal.yml

@@ -1,71 +0,0 @@
-# TypeScript Path Traversal
-# Detects fs and path API calls with potentially user-controlled paths.
-id: ts-path-traversal
-name: Path Traversal Risk
-severity: error
-category: security
-defect_class: injection
-inline_tier: blocking
-language: typescript
-
-message: "Potential path traversal sink — avoid filesystem I/O with untrusted input"
-
-description: |
-  File-system APIs (`fs.readFile`, `fs.writeFile`, `path.join`, etc.) are
-  vulnerable when path arguments include untrusted input. An attacker can
-  inject `../` sequences to access files outside the intended directory.
-
-  ✅ FIX: validate and sanitize paths; use allowlists or chroot jails.
-
-query: |
-  (call_expression
-    function: (member_expression
-      object: (identifier) @MOD
-      property: (property_identifier) @FN)
-    arguments: (arguments
-      [(identifier) (member_expression) (template_string) (call_expression) (binary_expression)] @PATH)
-    (#eq? @MOD "fs"))
-  (call_expression
-    function: (member_expression
-      object: (identifier) @MOD
-      property: (property_identifier) @FN)
-    arguments: (arguments
-      [(identifier) (member_expression) (template_string) (call_expression) (binary_expression)] @PATH)
-    (#eq? @MOD "path")
-    (#match? @FN "^(join|resolve)$"))
-  (call_expression
-    function: (member_expression
-      object: (member_expression
-        object: (identifier) @MOD
-        property: (property_identifier) @PROMISES)
-      property: (property_identifier) @FN)
-    arguments: (arguments
-      [(identifier) (member_expression) (template_string) (call_expression) (binary_expression)] @PATH)
-    (#eq? @MOD "fs")
-    (#eq? @PROMISES "promises"))
-
-metavars:
-  - MOD
-  - PROMISES
-  - FN
-  - PATH
-
-post_filter: ts_path_traversal_sink
-
-has_fix: false
-
-tags:
-  - typescript
-  - security
-  - path-traversal
-  - cwe-22
-  - owasp-a01
-
-examples:
-  bad: |
-    fs.readFile(req.query.path);   // BAD — user controls path
-    path.join(baseDir, userFile);  // BAD — user controls segment
-
-  good: |
-    fs.readFile("./safe.txt");     // OK — literal path
-    path.join(baseDir, "static");  // OK — literal segment