Rules¶
Rule packs live in the Python package under ts_sast/rules/devskim/rules/ and are passed to DevSkim on every scan, together with the language and comment definitions next to them. DevSkim's own default rules stay active; those without a language restriction (cleartext http:// URLs, weak hash algorithms and others) apply to VB6 as well. Where a ts-sast rule covers the same ground it declares an overrides entry so that a finding is reported once.
Every rule carries must-match and must-not-match samples. devskim verify checks them, and the CI runs that check on every push:
devskim verify -r src/ts_sast/rules/devskim/rules \
--languages src/ts_sast/rules/devskim/languages.json \
--comments src/ts_sast/rules/devskim/comments.json
Visual Basic 6 (vb6-security.json)¶
| Id | Severity | What it looks for |
|---|---|---|
| TSVB6001 | important | SQL statements assembled by string concatenation (Execute, Recordset.Open, CommandText) |
| TSVB6002 | important | Shell with a command line that is not a fixed literal |
| TSVB6003 | important | WScript.Shell, Shell.Application, ShellExecute process execution |
| TSVB6004 | important | Microsoft Script Control Eval / ExecuteStatement / AddCode with runtime script text |
| TSVB6005 | critical | Hard-coded passwords, keys and tokens in constants and connection strings |
| TSVB6006 | moderate | Persist Security Info=True in connection strings |
| TSVB6007 | important | MD2/MD4/MD5, RC2/RC4, DES CryptoAPI constants and XOR "encryption" |
| TSVB6008 | moderate | SHA-1 (CALG_SHA1) |
| TSVB6009 | important | Rnd() near token, password, salt, session or key handling |
| TSVB6010 | moderate | SendKeys keystroke injection |
| TSVB6011 | moderate | On Error Resume Next |
| TSVB6012 | moderate | Kill, FileCopy, RmDir, MkDir, ChDir, Open ... For ... with a dynamic path |
| TSVB6013 | critical | ServerXMLHTTP / WinHttpRequest configured to ignore TLS certificate errors |
| TSVB6014 | important | MSXML resolveExternals = True or ProhibitDTD = False (XXE) |
| TSVB6015 | moderate | Winsock control (raw, unencrypted sockets) |
| TSVB6016 | moderate | Internet Transfer Control (MSINET) and OpenURL with a dynamic URL |
| TSVB6017 | moderate | CopyMemory / RtlMoveMemory, VarPtr / StrPtr / ObjPtr usage |
| TSVB6018 | important | Secrets written to or read from the registry via SaveSetting / GetSetting / RegSetValueEx |
| TSVB6019 | manual review | Untrusted input sources: Command$, Environ$, InputBox |
| TSVB6020 | moderate | LoadLibrary with a bare DLL name (search order hijacking) |
| TSVB6021 | moderate | References to out-of-support components (MSXML 2/⅘, DAO 3.5, CAPICOM, VB5 runtime, Common Controls 5.0) |
| TSVB6022 | best practice | Err.Description shown to the user in a MsgBox |
Rule ids are stable; treat them as the key when triaging findings. Declare statements themselves are not reported for TSVB6003, TSVB6017, TSVB6018 and TSVB6020, only the call sites are.
Writing rules¶
Copy an existing rule, give it a new TSVB6nnn id (or a new prefix for a new language), add at least one must-match and one must-not-match sample and run devskim verify. Patterns are .NET regular expressions; VB6 is case-insensitive, so every VB6 pattern carries the i modifier. Keep scopes at ["code"] so that commented-out code does not produce findings.
Two DevSkim details shape the files:
- Severities are spelled
critical,important,moderate,BestPracticeandManualReview; the hyphenated forms are rejected. - When a rule carries
conditions, DevSkim 1.0.90 only reports the matches of the first pattern that hits in a file. Rules with conditions therefore use a single pattern with alternation instead of several patterns.
Rules you keep outside the package go into a directory of your own and are added with --rules <DIR>.