Rule Set Inheritance

New to version 4.5, Rule Sets can be inherited. That is, a Rule Set can be created as an extension of an existing Rule Set. The new Rule Set inherits all the rules of the parent Rule Set and can add new rules and/or override inherited rules. If the parent Rule Set is modified, the extended Rule Set inherits the modifications.

This allows companies to centrally manage core Rule Sets and project teams can extend as needed. This type of Rule Set creation is only available on the server. To create an extended Rule Set, select the Rule Set you would like to extend, from either your My Rule Sets page or My Team Rule Sets page, and click the Extend button at the bottom of the Customize Rule Set page.

There are a few things to note about Rule Set Inheritance:

• You can extend Rule Sets owned by team members, whether or not those Rule Sets are shared. Let's say a team member owns a Rule Set that you want to use when scanning your code. If the Rule Set is shared, it is already available to use. If the Rule Set is not shared, then you can copy it to create your own Rule Set, or extend it to create your own Rule Set; either way you can now scan with your version of the Rule Set. The difference between copy and extend is that when you extend, any changes made to the parent Rule Set will be reflected in your Rule Set. If the owner of the original Rule Set adds new detections and filters, your extended Rule Set will see these new detections and filters, whereas a copied Rule Set will not.
  
• You cannot modify or delete an inherited rule; you can only override it. The rule will remain unchanged in the parent Rule Set.
• If a Rule Set is extended by another Rule Set, the parent Rule Set cannot be deleted. The Delete button will not appear for this Rule Set on the Customize Rule Set page.
• You can only Add Defaults to base Rule Sets (a Rule Set that doesn't extend another Rule Set).
• When an extended Rule Set is exported, two Rule Sets are written to the Repository File: the extended Rule Set, with only new and overridden rules, and a flattened Rule Set, which has all the rules up the parenting chain. When the Repository File is imported, if the parent of the extended Rule Set exists, then the extended Rule Set is imported (the one with only new and overridden rules), referencing the found parent. If the parent Rule Set does not exist, then the flattened Rule Set is imported, containing all the rules and with no parent reference.

A Detailed Example of Inheritance

In order to see the properties of inheritance, follow this example.

• Create a rule set for the java language called inh_example.
• Extend it to create inh_example_2.
• Extend your inh_example_2 rule set to create inh_example_3.
• Copy your inh_example_3 rule set and name the copied rule set inh_example_3_copy.

By editing the configurations of these rule sets, the effect of inheritance can be shown.

For example, when making any changes to the inh_example rule set, the changes will propagate down to all of its children.

Create a new General Pattern as displayed in the screenshot below. The effect on the child rule sets can be seen.

A change to the inh_example_2 rule set will affect the child inh_example_3 rule set, as well as the inh_example_3_copy rule set. However, it will not affect the inh_example rule set.

Create a new General Pattern as displayed in the screenshot below. The effect on the child rule sets can be seen.

The inh_example_3 and inh_example_3_copy rule sets are not extended by any more rule sets, therefore, changes made to them are local, they will not affect any other rule set. Note that these rule sets are determined by the edits to both inh_example and inh_example_2.

Create a new General Pattern in inh_example_3 as displayed in the screenshot below.

Here, the effect of all 3 new patterns can be seen in inh_example_3.

The patterns are inherited from their respective parent rule set. MyDateFormat is inherited from inh_example, and MyDateFormat2 is inherited from inh_example_2. MyDateFormat3 is not displayed as inherited since it was created locally for use by this rule set alone (and its children, if it had any).