Skip to contents

Find security-relevant patterns in a parsed script

Source: R/find_patterns.R
find_patterns.Rd

Finds patterns – syntactic constructs of interest (e.g., system(), eval(parse()), an outbound HTTP call).

Usage

find_patterns(tree, pattern_rules, file_context)

Arguments

tree

The xml_document parse tree for one script (from parse_code()).

pattern_rules

Data frame of pattern rules (rules$patterns from load_rules()), with columns name, xpath, message, and attck.

file_context

Package-root-relative path of the script, carried through for joining to the file-contexts table.

Value

A list with two data frames:

patterns

Data frame with columns rule (the matching rule's name), file_context, line_number, column_number, message, attck. Carries a "nodes" attribute holding the matched nodes aligned to the rows. The phase columns are not set here; audit_package() attaches them from the code context each pattern is assigned.

errors

Data frame with columns step, file_context, rule, message.

Details

Each rule's XPath is evaluated with .xml_find_all_safe(), so an invalid one – including one libxml2 reports only as a warning – is recorded in errors and the scan moves on.

The "nodes" attribute holds the matched XML nodes aligned row-for-row, so determine_code_contexts() can test containment by node identity without re-running the pattern XPaths.