Rule taxonomy (CWE / OWASP)
Each rule carries a static CWE (and where applicable OWASP) mapping in its
RuleMeta. Every emitted crates/zuit-core/src/finding.rs
ships cwe and owasp arrays alongside its references field. The CLI
--cwe / --owasp filters use these arrays for rule-pack selection (see
AGENTS.md and crates/zuit-cli/src/analyze.rs).
Mapping
- 31Total rules
- 24With CWE
- 11With OWASP
- 3Languages
| Rule ID | Name | CWE | OWASP | Languages |
|---|---|---|---|---|
| MAINT001-cyclomatic | Cyclomatic complexity | CWE-1121 | — | RsPyJS |
| MAINT002-cognitive | Cognitive complexity | CWE-1121 | — | RsPyJS |
| MAINT003-fn-length | Function length | CWE-1121 | — | RsPyJS |
| MAINT004-file-length | File length | CWE-1080 | — | RsPyJS |
| MAINT005-deep-nesting | Deeply nested control flow | CWE-1124 | — | RsPyJS |
| MAINT006-too-many-params | Too many parameters | CWE-1121 | — | RsPyJS |
| DOC001-public-api-undoc | Undocumented public API | CWE-1059 | — | RsPyJS |
| DOC002-todo-fixme | TODO/FIXME comment | CWE-546 | — | RsPyJS |
| DOC004-stale-doc | Stale doc comment | — | — | RsPyJS |
| SEC001-hardcoded-secret | Hardcoded secret | CWE-798 | A07:2021 | RsPyJS |
| SEC002-eval-sink | Dynamic eval sink | CWE-95, CWE-79 | A03:2021 | RsPyJS |
| SEC003-shell-injection | Shell injection | CWE-78 | A03:2021 | RsPyJS |
| SEC004-weak-crypto | Weak crypto primitive | CWE-327 | A02:2021 | RsPyJS |
| SEC005-insecure-deser | Insecure deserialization | CWE-502 | A08:2021 | RsPyJS |
| SEC006-sql-injection | SQL injection | CWE-89 | A03:2021 | RsPyJS |
| SEC007-path-traversal | Path traversal | CWE-22 | A01:2021 | RsPyJS |
| SEC008-csrf-missing | Missing CSRF protection | CWE-352 | A01:2021 | RsPyJS |
| SEC009-open-redirect | Open redirect | CWE-601 | A01:2021 | RsPyJS |
| SEC010-ssrf | Server-side request forgery | CWE-918 | A10:2021 | RsPyJS |
| SEC011-cors-permissive | Permissive CORS | CWE-942 | A05:2021 | RsPyJS |
| SEC101-rust-unsafe | Use of `unsafe` (Rust) | CWE-758 | — | RsPyJS |
| CPLX001-fan-out | High fan-out | — | — | RsPyJS |
| CPLX002-cyclic-deps | Cyclic module dependencies | — | — | RsPyJS |
| PKG001-install-script-present | Install script present | CWE-506 | — | RsPyJS |
| SOUND003-transmute-usage | `transmute` usage | CWE-704 | — | RsPyJS |
| TEST001-test-ratio | Low test-to-code ratio | — | — | RsPyJS |
| TEST002-no-asserts | Test without assertions | — | — | RsPyJS |
| TEST003-skipped | Skipped test | — | — | RsPyJS |
| TEST004-flaky-time | Time-based flakiness | CWE-362 | — | RsPyJS |
| TEST005-assert-count | Excessive assertions in test | — | — | RsPyJS |
| TEST006-shared-mutable-state | Shared mutable test state | CWE-820 | — | RsPyJS |
note
All other rule families (SOUND001-002,004-006, PKG002-005, HEALTH, CHAIN, PERF, ECO, CI) are operational/quality rules and do not carry CWE/OWASP tags.
Where these flow
- JSON output —
cwe/owasparrays per finding (omitted when empty). - SARIF 2.1.0 — emitted as result-level
taxareferences. - Terminal / Markdown — printed alongside the rule id when present.
zuit list analyzers— shown next to the rule's metadata.zuit analyze --owasp <CAT>/--cwe <ID>— post-analysis allowlist filters; case-insensitive, repeatable, intersect when combined.