// RuleIsManaged returns whether the provided rule is managed by this tool,
// based on the tags set on the rule.
514777
func RuleIsManaged(r *bzl.Rule) bool {
	var automanaged bool
	for _, tag := range r.AttrStrings("tags") {
		if tag == automanagedTag {
			automanaged = true
			break
		}
	}
	return automanaged
}
147106
func (mod *Module) RuleSet(name Var) RuleSet {
	rs := NewRuleSet()
	for _, rule := range mod.Rules {
		if rule.Head.Name.Equal(name) {
			rs.Add(rule)
		}
	}
	return rs
}
1228926
func (f *ComponentFlag) Allowed() sets.String {
	return sets.NewString(f.allowed.List()...)
}
1141686
func acceptedHTMLTag(tagName string) bool {
	for _, tag := range acceptedHTMLTags {
		if tag == tagName {
			return true
		}
	}
	return false
}
1055900
func (rulesMap accessRules) isAuthorized(reqs []*requestedAccess) bool {
	for _, req := range reqs {
		// Check rules for resource type and also check wildcard variations
		// see: https://github.com/openshift/origin-web-common/blob/v3.10.0/src/services/authorizationService.js#L156
		res := req.resource
		allRes := &qualifiedResource{res.apiGroup, rulesReviewWildcard}
		allGroup := &qualifiedResource{rulesReviewWildcard, res.resourceType}

		// Check if all requested actions are permitted
		for _, verb := range req.verbs {
			if !containsVerb(rulesMap, res, verb) &&
				!containsVerb(rulesMap, allResAllGroup, verb) &&
				!containsVerb(rulesMap, allRes, verb) &&
				!containsVerb(rulesMap, allGroup, verb) {
				return false
			}
		}
	}
	return true
}
242346
func tagIgnoredInspector(t *inspector.ResourceGroupTag) bool {
	filter := []string{"^aws:"}
	for _, v := range filter {
		log.Printf("[DEBUG] Matching %v with %v\n", v, *t.Key)
		r, _ := regexp.MatchString(v, *t.Key)
		if r {
			log.Printf("[DEBUG] Found AWS specific tag %s (val: %s), ignoring.\n", *t.Key, *t.Value)
			return true
		}
	}
	return false
}
546098
func (inliner *Inliner) collectElementsAndRules() {
	for _, stylesheet := range inliner.stylesheets {
		for _, rule := range stylesheet.Rules {
			if rule.Kind == css.QualifiedRule {
				// Let's go!
				inliner.handleQualifiedRule(rule)
			} else {
				// Keep it 'as is'
				inliner.rawRules = append(inliner.rawRules, rule)
			}
		}
	}
}
1145772
func checkRules(rules []services.Rule, kind string, verbs []string) bool {
	for _, rule := range rules {
		if rule.HasResource(kind) || rule.HasResource(services.Wildcard) {
			for _, verb := range verbs {
				if rule.HasVerb(verb) || rule.HasVerb(services.Wildcard) {
					return true
				}
			}
		}
	}
	return false
}
786323
func (rs *Ruleset) AddSingular(suffix, replacement string) {
	rs.AddSingularExact(suffix, replacement, false)
}
868096
func findRule(chain *fakeChain, rule string) int {
	for i, candidate := range chain.rules {
		if rule == candidate {
			return i
		}
	}
	return -1
}
754370
func (v ValidateExtension) Rules() []ValidateRule {
	if v.FieldRules == nil {
		return nil
	}
	if v.rules == nil {
		v.rules = flattenRules("", reflect.ValueOf(v.FieldRules))
	}
	return v.rules
}
665758
func (r *Ruler) compare(f *Rule, actual interface{}) bool {
	ruleDebug("beginning comparison")
	expected := f.Value
	switch f.Comparator {
	case "eq":
		return actual == expected

	case "neq":
		return actual != expected

	case "gt":
		return r.inequality(gt, actual, expected)

	case "gte":
		return r.inequality(gte, actual, expected)

	case "lt":
		return r.inequality(lt, actual, expected)

	case "lte":
		return r.inequality(lte, actual, expected)

	case "exists":
		// not sure this makes complete sense
		return actual != nil

	case "nexists":
		return actual == nil

	case "regex":
		fallthrough
	case "contains":
		fallthrough
	case "matches":
		return r.regexp(actual, expected)

	case "ncontains":
		return !r.regexp(actual, expected)
	default:
		//should probably return an error or something
		//but this is good for now
		//if comparator is not implemented, return false
		ruleDebug("unknown comparator %s", f.Comparator)
		return false
	}
}
142887
func ValidateRule(obj *Rule) error {
	collections.ruleMutex.Lock()
	defer collections.ruleMutex.Unlock()

	// Validate key is correct
	keyStr := obj.TenantName + ":" + obj.PolicyName + ":" + obj.RuleID
	if obj.Key != keyStr {
		log.Errorf("Expecting Rule Key: %s. Got: %s", keyStr, obj.Key)
		return errors.New("Invalid Key")
	}

	// Validate each field

	actionMatch := regexp.MustCompile("^(allow|deny)$")
	if actionMatch.MatchString(obj.Action) == false {
		return errors.New("action string invalid format")
	}

	directionMatch := regexp.MustCompile("^(in|out)$")
	if directionMatch.MatchString(obj.Direction) == false {
		return errors.New("direction string invalid format")
	}

	if len(obj.FromEndpointGroup) > 64 {
		return errors.New("fromEndpointGroup string too long")
	}

	fromEndpointGroupMatch := regexp.MustCompile("^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\\-]*[a-zA-Z0-9])\\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\\-]*[A-Za-z0-9])?$")
	if fromEndpointGroupMatch.MatchString(obj.FromEndpointGroup) == false {
		return errors.New("fromEndpointGroup string invalid format")
	}

	fromIpAddressMatch := regexp.MustCompile("^(((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(\\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3})(\\-(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9]))?(/(3[0-1]|2[0-9]|1[0-9]|[1-9]))?)?$")
	if fromIpAddressMatch.MatchString(obj.FromIpAddress) == false {
		return errors.New("fromIpAddress string invalid format")
	}

	if len(obj.FromNetwork) > 64 {
		return errors.New("fromNetwork string too long")
	}

	fromNetworkMatch := regexp.MustCompile("^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\\-]*[a-zA-Z0-9])\\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\\-]*[A-Za-z0-9])?$")
	if fromNetworkMatch.MatchString(obj.FromNetwork) == false {
		return errors.New("fromNetwork string invalid format")
	}

	if len(obj.PolicyName) > 64 {
		return errors.New("policyName string too long")
	}

	policyNameMatch := regexp.MustCompile("^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\\-]*[a-zA-Z0-9])\\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\\-]*[A-Za-z0-9])$")
	if policyNameMatch.MatchString(obj.PolicyName) == false {
		return errors.New("policyName string invalid format")
	}

	if obj.Port > 65535 {
		return errors.New("port Value Out of bound")
	}

	if obj.Priority == 0 {
		obj.Priority = 1
	}

	if obj.Priority < 1 {
		return errors.New("priority Value Out of bound")
	}

	if obj.Priority > 100 {
		return errors.New("priority Value Out of bound")
	}

	protocolMatch := regexp.MustCompile("^(tcp|udp|icmp||[0-9]{1,3}?)$")
	if protocolMatch.MatchString(obj.Protocol) == false {
		return errors.New("protocol string invalid format")
	}

	if len(obj.RuleID) > 64 {
		return errors.New("ruleId string too long")
	}

	ruleIdMatch := regexp.MustCompile("^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\\-]*[a-zA-Z0-9])\\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\\-]*[A-Za-z0-9])$")
	if ruleIdMatch.MatchString(obj.RuleID) == false {
		return errors.New("ruleId string invalid format")
	}

	if len(obj.TenantName) > 64 {
		return errors.New("tenantName string too long")
	}

	tenantNameMatch := regexp.MustCompile("^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\\-]*[a-zA-Z0-9])\\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\\-]*[A-Za-z0-9])$")
	if tenantNameMatch.MatchString(obj.TenantName) == false {
		return errors.New("tenantName string invalid format")
	}

	if len(obj.ToEndpointGroup) > 64 {
		return errors.New("toEndpointGroup string too long")
	}

	toEndpointGroupMatch := regexp.MustCompile("^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\\-]*[a-zA-Z0-9])\\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\\-]*[A-Za-z0-9])?$")
	if toEndpointGroupMatch.MatchString(obj.ToEndpointGroup) == false {
		return errors.New("toEndpointGroup string invalid format")
	}

	toIpAddressMatch := regexp.MustCompile("^(((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(\\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3})(\\-(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9]))?(/(3[0-1]|2[0-9]|1[0-9]|[1-9]))?)?$")
	if toIpAddressMatch.MatchString(obj.ToIpAddress) == false {
		return errors.New("toIpAddress string invalid format")
	}

	if len(obj.ToNetwork) > 64 {
		return errors.New("toNetwork string too long")
	}

	toNetworkMatch := regexp.MustCompile("^(([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\\-]*[a-zA-Z0-9])\\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\\-]*[A-Za-z0-9])?$")
	if toNetworkMatch.MatchString(obj.ToNetwork) == false {
		return errors.New("toNetwork string invalid format")
	}

	return nil
}
311992
func (model Model) GetFilteredPolicy(sec string, ptype string, fieldIndex int, fieldValues ...string) [][]string {
	res := [][]string{}

	for _, rule := range model[sec][ptype].Policy {
		matched := true
		for i, fieldValue := range fieldValues {
			if fieldValue != "" && rule[fieldIndex+i] != fieldValue {
				matched = false
				break
			}
		}

		if matched {
			res = append(res, rule)
		}
	}

	return res
}
413249
func tagIgnoredKMS(t *kms.Tag) bool {
	filter := []string{"^aws:"}
	for _, v := range filter {
		log.Printf("[DEBUG] Matching %v with %v\n", v, *t.TagKey)
		r, _ := regexp.MatchString(v, *t.TagKey)
		if r {
			log.Printf("[DEBUG] Found AWS specific tag %s (val: %s), ignoring.\n", *t.TagKey, *t.TagValue)
			return true
		}
	}
	return false
}
771398
func (policy Policy) IsAllowed(args Args) bool {
	// Check all deny statements. If any one statement denies, return false.
	for _, statement := range policy.Statements {
		if statement.Effect == Deny {
			if !statement.IsAllowed(args) {
				return false
			}
		}
	}

	// For owner, its allowed by default.
	if args.IsOwner {
		return true
	}

	// Check all allow statements. If any one statement allows, return true.
	for _, statement := range policy.Statements {
		if statement.Effect == Allow {
			if statement.IsAllowed(args) {
				return true
			}
		}
	}

	return false
}
989330
func (rs RuleSet) Contains(rule *Rule) bool {
	for i := range rs {
		if rs[i].Equal(rule) {
			return true
		}
	}
	return false
}