Testing Rules

Use xgrep test to validate rules against annotated test files:

xgrep test rules/

Test files use comment annotations to mark expected matches:

# ruleid: my-rule
eval(user_input)

# ok: my-rule
safe_function(data)

# todoruleid: my-rule
not_yet_supported()

• ruleid: <id> — the next line must match the rule.
• ok: <id> — the next line must not match (a false-positive guard).
• todoruleid: <id> — a known gap the rule does not yet catch.