Skip to content

Conversation

@DawMatt
Copy link

@DawMatt DawMatt commented Feb 23, 2024

This is to resolve issue #73 .

Changing the rules to use URN style naming (similar to Stoplight's OWASP ruleset) makes it simpler to extend this ruleset without naming clashes from other rules.

Section numbers (but not subsection numbers) have been used as part of the naming scheme, to balance maintainability with understanding what the rules are trying to achieve.

Copy link

@fluffy-dutchman fluffy-dutchman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this is a YAML file, have you checked to make sure that this key name (rule-name) changes are not breaking conventions for key-names? If you wanted a key with multiple ":" in it like the URN you suggested, I believe you will have to wrap each key in quotes like: "json:api:1:sect4:content-type". Also, if "1" is the version of the JSON:API specification the rule is for I'd suggest using 1.0 or 1.1 depending on which specification version it applies to.

@DawMatt
Copy link
Author

DawMatt commented Feb 23, 2024

@tnederveld , I've checked the spec ( https://yaml.org/spec/1.1/ ) and it includes a number of unquoted URN examples. It also states that colons and other significant characters are acceptable within scalars as long as they aren't followed by a space (or other whitespace).

The ruleset also works fine in testing. Both via npm test, and in the wild (I've already extended this).

I'll make the 1 -> 1.0 change as requested. Is this sufficient, or do you also want quoting of keys event though it is not required by the specification? My preference is to leave them unquoted but that is mainly due to aesthetics.

@DawMatt
Copy link
Author

DawMatt commented Feb 23, 2024

@tnederveld , all rule names have been changed to include a version naming element of 1.0

@DawMatt
Copy link
Author

DawMatt commented Mar 1, 2024

@tnederveld , was this OK, or did you need additional changes to be made?

@jmlue42 jmlue42 self-assigned this Mar 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants