diff --git a/rules/001_project_settings/001_0009_strict_mode_with_react_client.js b/rules/001_project_settings/001_0009_strict_mode_with_react_client.js new file mode 100644 index 0000000..ef83947 --- /dev/null +++ b/rules/001_project_settings/001_0009_strict_mode_with_react_client.js @@ -0,0 +1,75 @@ +const metadata = { + scope: "package", + title: "Ensure strict mode is enabled when using the React client", + description: + "When React is enabled in Project Settings, StrictMode must also be enabled in Project Security for security and stability", + authors: ["Jurre Tanja "], + custom: { + category: "Security", + rulename: "StrictModeWithReactClient", + severity: "HIGH", + rulenumber: "001_0009", + remediation: "Enable Strict mode in the Security settings", + input: ".*\\$ProjectSettings\\.yaml", + }, +}; + +function rule(input = {}) { + const errors = []; + + try { + // Navigate into Settings array to find UseOptimizedClient + let useOptimizedClient = undefined; + + if (input.Settings && Array.isArray(input.Settings)) { + // Find the Forms$WebUIProjectSettingsPart section + const webUISettings = input.Settings.find( + (s) => s.$Type === "Forms$WebUIProjectSettingsPart", + ); + if (webUISettings) { + useOptimizedClient = webUISettings.UseOptimizedClient; + } + } + + // Check if UseOptimizedClient is enabled + if (useOptimizedClient === true || useOptimizedClient === "Yes") { + // Read the ProjectSecurity.yaml file to check StrictMode + try { + const securityContent = mxlint.io.readfile( + "Security$ProjectSecurity.yaml", + ); + + if (securityContent) { + // Parse the YAML string to find StrictMode value + const strictModeMatch = + securityContent.match(/^StrictMode:\s*(.+)$/m); + let strictModeValue = null; + + if (strictModeMatch) { + const value = strictModeMatch[1].trim(); + strictModeValue = value === "true" || value === true; + } + + // Check if StrictMode is enabled + if (strictModeValue !== true) { + errors.push(`[${metadata.custom.severity}, ${metadata.custom.category}, ${metadata.custom.rulenumber}] StrictMode must be enabled in Project Security when UseOptimizedClient is enabled in Project Settings. Current + StrictMode value: ${strictModeValue}`); + } + } + } catch (securityError) { + errors.push( + `[${metadata.custom.severity}, ${metadata.custom.category}, ${metadata.custom.rulenumber}] Failed to read Security$ProjectSecurity.yaml: ${securityError.message}`, + ); + } + } + } catch (e) { + errors.push( + `[${metadata.custom.severity}, ${metadata.custom.category}, ${metadata.custom.rulenumber}] Error checking strict mode configuration: ${e.message}`, + ); + } + + return { + allow: errors.length === 0, + errors, + }; +} diff --git a/rules/001_project_settings/001_0009_strict_mode_with_react_client_test.yaml b/rules/001_project_settings/001_0009_strict_mode_with_react_client_test.yaml new file mode 100644 index 0000000..3219eb3 --- /dev/null +++ b/rules/001_project_settings/001_0009_strict_mode_with_react_client_test.yaml @@ -0,0 +1,28 @@ +TestCases: + - name: allow when UseOptimizedClient is false + allow: true + input: + UseOptimizedClient: false + files: + "Security$ProjectSecurity.yaml": + StrictMode: false + - name: allow when both UseOptimizedClient and StrictMode are true + allow: true + input: + UseOptimizedClient: true + files: + "Security$ProjectSecurity.yaml": + StrictMode: true + - name: do not allow UseOptimizedClient true but StrictMode false + allow: false + input: + UseOptimizedClient: true + files: + "Security$ProjectSecurity.yaml": + StrictMode: false + - name: do not allow UseOptimizedClient true but StrictMode missing + allow: false + input: + UseOptimizedClient: true + files: + "Security$ProjectSecurity.yaml": {} diff --git a/rules/002_domain_model/002_0008_avoid_read_write_default_access_rule.rego b/rules/002_domain_model/002_0008_avoid_read_write_default_access_rule.rego index 17e2f39..f9e078e 100644 --- a/rules/002_domain_model/002_0008_avoid_read_write_default_access_rule.rego +++ b/rules/002_domain_model/002_0008_avoid_read_write_default_access_rule.rego @@ -3,7 +3,7 @@ # title: Avoid using default read write access # description: This can lead to wrong set access rights # authors: -# - Jurre Tanja +# - Jurre Tanja # - Bart Zantingh # related_resources: # - https://docs.mendix.com/refguide/access-rules/