File

.semgrep.yml @ 13745:994ea8d54b72 13.0

core.configmanager: Pass name and line number in context Delays the string interpolation until the warning is logged, which may slightly lower memory usage. Allows retrieving the filename and line number easily.
author Kim Alvefur <zash@zash.se>
date Sat, 22 Feb 2025 00:04:51 +0100
parent 13700:9b7687b47da9
line wrap: on
line source

rules:
- id: log-variable-fmtstring
  patterns:
    - pattern: log("...", $A)
    - pattern-not: log("...", "...")
  message: Variable passed as format string to logging
  languages: [lua]
  severity: ERROR
- id: module-log-variable-fmtstring
  patterns:
    - pattern: module:log("...", $A)
    - pattern-not: module:log("...", "...")
  message: Variable passed as format string to logging
  languages: [lua]
  severity: ERROR
- id: module-getopt-string-default
  patterns:
    - pattern: module:get_option_string("...", $A)
    - pattern-not: module:get_option_string("...", "...")
    - pattern-not: module:get_option_string("...", host)
    - pattern-not: module:get_option_string("...", module.host)
  message: Non-string default from :get_option_string
  severity: ERROR
  languages: [lua]
- id: stanza-empty-text-constructor
  patterns:
    - pattern: $A:text()
  message: Use :get_text() to read text, or pass a value here to add text
  severity: WARNING
  languages: [lua]
- id: require-unprefixed-module
  patterns:
    - pattern: require("$X")
    - metavariable-regex:
        metavariable: $X
        regex: '^(core|net|util)\.'
  message: Prefix required module path with 'prosody.'
  severity: ERROR
  languages: [lua]