Create Rule Set

Rule Sets can be created from the Client or the Server. To create a Rule Set from the Client, select Project->Create Rule Set. To create a Rule Set from the Server, select Create Rule Set from your home screen.

New to version 4.5, Rule Sets can be inherited. That is, a Rule Set can be created as an extension of an existing Rule Set. The new Rule Set inherits all the rules of the parent Rule Set and can add new rules and/or override inherited rules. If the parent Rule Set is modified, the extended Rule Set inherits the modifications. This allows companies to centrally manage core Rule Sets and project teams can extend as needed. This type of Rule Set creation is only available on the server. To create an extended Rule Set, select the Rule Set you would like to extend, from either your My Rule Sets page or My Team Rule Sets page, and click the Extend button at the bottom of the Customize Rule Set page. Click here for more information on Rule Set Inheritance.

Rule Sets are language-specific. When created, they contain language-based default rules regarding Source File Extensions, Embedded Strings, Locale-Sensitive Methods, General Patterns, and Static File References. It is therefore very important to choose the correct language when creating a Rule Set to scan your code.

Note: Typically, you will create several Rule Sets to scan a Project, as large projects tend to involve multiple programming languages.

We currently support Rule Sets for the following languages: ActionScript, C#, C/C++, Delphi, HTML, Java, JavaScript, Objective-C, MXML, Perl, PHP, Qt, SQL, Swift2, XML, Visual Basic, and VBScript.

Some languages, such as C++, Visual Basic, SQL, and XML, have variants. Variants are flavors of a language. The difference between variants of a language is the default set of Locale-Sensitive Methods and the default Resource File Types for your Rule Set. C++ has ANSI UTF-8, ANSI UTF-16, Cross Platform UTF-8, Cross Platform UTF-16, Windows Generic, Windows MBCS, Windows Unicode, and QT variants. See here to help decide which C++ variant to use. Visual Basic has both Classic and VB.NET variants. SQL has MySQL, MS SQL, Oracle PL/SQL, and PostgreSQL variants. XML has an MXML variant.

If you need to scan code in a language not currently supported, you can choose a supported language that is close (look at string delineation and support for Locale-Sensitive Methods) and customize (add/remove rules) to make it work. Here are our suggestions for supporting Python, Ruby, and Managed C++:

• Python: Scan with a JavaScript Rule Set.
  Python supports single, double, and triple quoted strings. JavaScript detects both single and double-quoted strings (but not triple) and has Locale-Sensitive Methods which can be modified to accommodate the Python language methods. Make sure you modify Source File Extensions to scan for Python files.
• Ruby: Scan with a JavaScript Rule Set.
  Ruby supports single, double, and custom quoted strings. JavaScript detects both single and double-quoted strings (but not custom) and has Locale-Sensitive Methods which can be modified to accommodate the Ruby language methods. Note that while Ruby supports optional parentheses when calling methods, JavaScript requires parentheses. Make sure you modify Source File Extensions to scan for Ruby files.
• Managed C++: Scan with two Rule Sets: C++ Windows Unicode and C#.
  Managed C++ has .NET framework support. The C++ Windows Unicode Rule Set will search for standard C++ Locale-Sensitive Methods, along with Embedded Strings, General Patterns, and Static File References. The C# Rule Set (check only Locale-Sensitive Methods in the Scan Configuration) will search for .NET methods.

Note that TypeScript is a super-set of JavaScript, and can be scanned with a JavaScript rule set. Make sure you modify Source File Extensions to scan for TypeScript files only, unchecking the other file extensions. Keep all the JavaScript rules, since they also apply to TypeScript.