Custom rules

Create and execute custom pattern-based rules against your source code.

AppScan 360° includes the option to execute custom pattern based rules against your source code.

Creating a custom rule

To specify custom rules, create a file named appscan-rules.json. Following the format specified in appscan-rules.schema.json, each custom rule must include:
  • A description of the rule.
  • The vulnerability type to report.
  • The severity to report when a match is found (Critical, High, Medium, Low, or Info).
  • A regular expression to match against.
  • The programming language or languages to which each rule applies. Or specify All to apply the rule to all languages.

Including the custom rule in the IRX

Once custom rules are defined in appscan-rule.json, you can include them in a single scan, or apply them to all scans for an organization.

To include custom rules in a single scan using the command line interface:
  • Place appscan-rules.json in the directory from which you run appscan prepare.
To include custom rules in all the scans for an organization:

Sample appscan-rules.json

{
	"rules": [
		{
			"description": "No unsafe code blocks allowed",
			"vulnerability": "Native_Unsafe",
			"severity": "High",
			"pattern": "\\bunsafe\\s*\\{[\\s\\S]*?\\}",
			"languages": ["Rust"]
		},
		{
			"description": "Do not use force_capture",
			"vulnerability": "ErrorHandling_RevealDetails_StackTrace",
			"severity": "Medium",
			"pattern": "\\bforce_capture\\s*\\(\\s*\\)",
			"languages": ["Rust"]
		}
	]
}