How to match files without a file extension?

[JaneX8]

I have a few use cases where I want to match files that have no file extension for example in case a passwd file has ended up in a codebase. I made this Devskim rule that works if I supply a file extension but if the filename is passwd without extension.

[
    {
        "name": "Detect /etc/passwd-like syntax",
        "id": "etcpasswdsyntax",
        "description": "Detects files containing /etc/passwd-like syntax (username:password:UID:GID:comment:home:shell).",
        "recommendation": "Review the file for sensitive data. Ensure it is not exposed or hardcoded in the project.",
        "severity": "BestPractice",
        "confidence": "high",
        "tags": ["security", "sensitive-data", "linux", "passwd"],
        "patterns": [
            {
                "pattern": "^[a-zA-Z0-9_]+:[x*!]?:[0-9]+:[0-9]+:[a-zA-Z0-9_,:/ -]+:[/a-zA-Z0-9_ -]+:[/a-zA-Z0-9_ -]+$",
                "type": "regex",
                "modifiers": ["m"],
                "_comment": "Matches /etc/passwd line syntax: user:pass:UID:GID:comment:home:shell"
            }
        ]
    }
]

For example on this file:

root:x:0:0:root:/root:/bin/bash
steve:x:1000:1000:Steve:/home/steve:/bin/bash
nobody:*:65534:65534:Nobody:/nonexistent:/usr/sbin/nologin

[JaneX8]

Another example usecase for filename Caddyfile (a config file for Caddy proxy):

example.com {
    reverse_proxy /api/* https://backend.example.com {
        tls_insecure_skip_verify
    }
}

DevSkim rule:

[
    {
        "name": "Caddy: Insecure TLS Skip Verify Flag",
        "id": "caddy-insecure-tls",
        "description": "Detects the use of the insecure 'tls_insecure_skip_verify' flag in Caddy configurations.",
        "recommendation": "Avoid using 'tls_insecure_skip_verify' in Caddy. Instead, ensure proper TLS certificate validation is in place.",
        "severity": "BestPractice",
        "confidence": "high",
        "tags": ["caddy", "tls", "security", "misconfiguration"],
        "patterns": [
            {
                "pattern": "tls_insecure_skip_verify",
                "type": "regex",
                "modifiers": ["i"],
                "confidence": "high"
            }
        ]
    }
]

My rule works fine if I gave the Caddyfile any supported file extension.

[gfs]

Have you tried using the applies_to_file_regex field? This is intended for this kind of purpose where the normal applies_to logic (based on file extension) fails to capture the file set you wish a rule to apply to.
https://github.com/microsoft/ApplicationInspector/wiki/3.1.-Rule-Object-Schema#applies_to_file_regex

If so, does this not suit your purposes in some manner?

[JaneX8]

Reproduced on 1.0.70. Two files with the same root:x:0:0:root:/root:/bin/bash line + a rule whose pattern matches it:

passwd      → 0 hits
passwd.txt  → 1 hit

I think the problem might be:

DevSkim/DevSkim-DotNet/Microsoft.DevSkim.CLI/Commands/AnalyzeCommand.cs

Lines 396 to 400 in e226b96

	// Skip files written in unknown language
	if (string.IsNullOrEmpty(languageInfo.Name))
	{
	Interlocked.Increment(ref filesSkipped);
	}

I tried applies_to and applies_to_file_regex and omitting both, and wildcards and I cant get it to work on any unsupported file extension or on any file without file extension.

I do need this for scanning code in files like passwd / Dockerfile / Jenkinsfile / Caddyfile etc. Maybe a flag like --scan-unknown-languages or something could be helpful here. Or a change in the behavior of applies_to_file_regex where it doesn't firstly check for supported languages.

[JaneX8]

This causes the same issue as #746.