Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 3. Providers and rule conditions

The providers are the modular components in charge of analyzing a given language. Providers are able to analyze code by leveraging the Language Server Protocol (LSP). Through the LSP, all code analysis is abstracted away from the analysis engine and left to the specific LSP server to run the search query defined in the rule on the source code.

Additionally, MTA provides a built-in provider with abilities such as XML parsing, running regular expressions on files, and so on.

Currently, MTA supports the following providers:

  • Builtin
  • Java
  • Go
  • External providers (for Python, Dotnet and Node.js applications) initialized by the generic provider binary
Note

You can use the generic provider binary to create an external provider for any language that is compliant with LSP 3.17 specifications.

Using the provider capability in custom rules

In a rule, the when block is where the conditions for matching the rule are specified. Each provider offers a series of capabilities to do matching.. The search query in the rule condition can contain patterns, code locations, specific dependencies to be found, and so on, to evaluate the source code and dependencies. The provider sends the LSP server a request to check the search query against the application being analyzed. When the LSP server returns a match for the search in the source code, the analyzer triggers a violation.

The syntax for the when block is as follows: contains one condition, but that condition can have multiple conditions nested under it. 

when:
  <condition>
    <nested-condition>
Copy to Clipboard Toggle word wrap

3.1. Provider condition
Copy link

The analyzer engine enables multi-language source code analysis by using providers. The source code of a technology is analyzed by the provider.

The provider publishes what they can do with the source code in terms of capabilities.

The provider condition instructs the analyzer to use a specific provider and one of its capabilities. In general, it follows the <provider_name>.<capability> pattern. 

when:
  <provider_name>.<capability>
    <input_fields>
Copy to Clipboard Toggle word wrap

The analyzer currently supports the following provider conditions:

  • builtin
  • java
  • go
  • nodejs
  • python
  • dotnet
Important

Dotnet provider is a Developer Preview feature only. Developer Preview features are not supported by Red Hat in any way and are not functionally complete or production-ready. Do not use Developer Preview features for production or business-critical workloads. Developer Preview features provide early access to upcoming product features in advance of their possible inclusion in a Red Hat product offering, enabling customers to test functionality and provide feedback during the development process. These features might not have any documentation, are subject to change or removal at any time, and testing is limited. Red Hat might provide ways to submit feedback on Developer Preview features without an associated SLA.

Expand
Provider rule conditionsProvider name

Providers that are fully supported and included in the product

java

Providers that have rules already defined in the product

  • dotnet
  • java

Providers that require custom rulesets for analysis

  • go
  • python
  • nodejs

The following table summarizes all the providers and their capabilities:

Expand
Table 3.1. Summary of providers and their capabilities
Provider NameCapabilitiesDescription

java

referenced

Find references of a pattern with an optional code location for detailed searches. For example, 

when:
  java.referenced:
    <fields>
Copy to Clipboard Toggle word wrap

dependency

Check whether the application has a given dependency. For example, 

when:
  java.dependency:
    <fields>
Copy to Clipboard Toggle word wrap

builtin

xml

Search XML files using xpath queries.

json

Search JSON files using jsonpath queries. For example, 

when:
  builtin.json:
    <fields>
Copy to Clipboard Toggle word wrap

filecontent

Search content in regular files using regular expression patterns. For example, 

when:
  builtin.filecontent:
    <fields>
Copy to Clipboard Toggle word wrap

file

Find files with names matching a given pattern. For example, 

when:
  builtin.file:
    <fields>
Copy to Clipboard Toggle word wrap

hasTags

Check whether a tag is created for the application using a tagging rule. For example, 

when:
  builtin.hasTags:
    <fields>
Copy to Clipboard Toggle word wrap

go

referenced

Find references to a pattern. For example, 

when:
  go.referenced:
    <fields>
Copy to Clipboard Toggle word wrap

dependency

Check whether the application has a given dependency. For example, 

when:
  go.dependency:
    <fields>
Copy to Clipboard Toggle word wrap

Following the example in the previous table, you can create the first part of the condition that does not contain any of the condition fields.

Example

To create a java provider condition that uses the referenced capability: 

when:
  java.referenced:
    <fields>
Copy to Clipboard Toggle word wrap
Note

Depending on the provider and the capability, there will be different <fields> in the condition.

The following table summarizes available providers, their capabilities and all of their fields:

Expand
Table 3.2. Summary of providers, their capabilities, and their fields
ProviderCapabilityFieldsRequiredDescription

java

referenced

pattern

Yes

Regular expression pattern. For example, 

when:
  java.referenced:
    location: PACKAGE
    pattern: org.jboss.*
Copy to Clipboard Toggle word wrap

location

No

Source code location. See Java locations. For example, 

when:
  java.referenced:
    pattern: org.kubernetes*
    location: IMPORT
Copy to Clipboard Toggle word wrap

annotated

No

Additional query to inspect annotations. See Annotation inspection. For example, 

when:
  java.referenced:
    location: ANNOTATION
    pattern: javax.ejb.Singleton
Copy to Clipboard Toggle word wrap

dependency

name

Yes

Name of the dependency. For example, 

when:
  java.dependency:
    name: junit.junit
Copy to Clipboard Toggle word wrap

nameregex

No

Regular expression pattern to match the name.

upperbound

No

Match versions lower than or equal to. For example, 

when:
  java.dependency:
    name: junit.junit
    upperbound: 4.12.2
Copy to Clipboard Toggle word wrap

lowerbound

No

Match versions greater than or equal to. For example, 

when:
  java.dependency:
    name: junit.junit
    upperbound: 4.12.2
    lowerbound: 4.4.0
Copy to Clipboard Toggle word wrap

builtin

xml

xpath

Yes

Xpath query 

when:
  builtin.xml:
    xpath: "//dependencies/dependency"
Copy to Clipboard Toggle word wrap

namespaces

No

A map to scope down query to namespaces. 

when:
  builtin.xml:
    filepaths:
     - beans.xml
    namespaces:
        b: http://xmlns.jcp.org/xml/ns/javaee
    xpath: /b:beans
Copy to Clipboard Toggle word wrap

filepaths

No

Optional list of files to scope down search. 

when:
    or:
    - builtin.xml:
        xpath: "//dependencies/dependency"
        filepaths: "{{poms.filepaths}}"
      from: poms
    - builtin.file:
        pattern: pom.xml
      as: poms
      ignore: true
Copy to Clipboard Toggle word wrap

json

xpath

Yes

Xpath query For example, 

when:
    and:
    - builtin.json:
        xpath: //inclusionTestNode
Copy to Clipboard Toggle word wrap

filepaths

No

Optional list of files to scope down search. For example, 

when:
    and:
    - builtin.json:
        xpath: //inclusionTestNode
        filepaths: "{{incTest.filepaths}}"
Copy to Clipboard Toggle word wrap

filecontent

pattern

Yes

Regular expression pattern to match in content. For example, 

when:
  builtin.filecontent:
    pattern: "import.*React"
Copy to Clipboard Toggle word wrap

filePattern

No

Only search in files with names matching this pattern. For example, 

when:
  builtin.filecontent:
    pattern: "import.*React"
    filePattern: "\\.tsx$"
Copy to Clipboard Toggle word wrap

file

pattern

Yes

Find files with names matching this pattern. For example, 

when:
    builtin.file:
      pattern: "*.go"
Copy to Clipboard Toggle word wrap

hasTags

  

This is an inline list of string tags. See Tag action For example, 

when:
  or:
   - builtin.hasTags:
     - Golang
     - Kubernetes
Copy to Clipboard Toggle word wrap

go

referenced

pattern

Yes

Regular expression pattern. For example, 

when:
  go.referenced:
    pattern: "v1beta1.CustomResourceDefinition"
Copy to Clipboard Toggle word wrap

dependency

name

Yes

Name of the dependency. For example, 

when:
  - go.dependency:
      name: sigs.k8s.io/structured-merge-diff/v4
Copy to Clipboard Toggle word wrap

nameregex

No

Regular expression pattern to match the name.

upperbound

No

Match versions lower than or equal to. For example, 

when:
  - go.dependency:
      name: sigs.k8s.io/structured-merge-diff/v4
      upperbound: v4.2.2
Copy to Clipboard Toggle word wrap

lowerbound

No

Match versions greater than or equal to. For example, 

when:
  - go.dependency:
      name: sigs.k8s.io/structured-merge-diff/v4
      lowerbound: v4.2.0
Copy to Clipboard Toggle word wrap

dotnet

referenced

pattern

Yes

Regular expression to match a reference in the source code. For example, HttpNotFound.

namespace

Yes

Specify the namespace within which the search query must be run. For example, System.Web.Mvc.

3.2. Builtin provider
Copy link

The builtin is an internal provider that can analyze various files and internal metadata generated by the engine. This provider has the following capabilities:

  • file
  • filecontent
  • xml
  • json
  • hasTags

file

By using the file capability, the provider searches for files in the source code that match a given pattern. 

when:
  builtin.file:
    pattern: "<regular_expression_to_match_filenames>"
Copy to Clipboard Toggle word wrap

filecontent

By using the filecontent capability, the provider searches for content that matches a given pattern. 

when:
  builtin.filecontent:
    filePattern: "<regular_expression_to_match_filenames_to_scope_search>"
    pattern: "<regular_expression_to_match_content_in_the_matching_files>"
Copy to Clipboard Toggle word wrap

xml

The xml capability enables the provider to query XPath expressions on a list of provided XML files. This capability takes 2 input parameters, xpath and filepaths. 

when:
  builtin.xml:
    xpath: "<xpath_expressions>"
    filepaths:
      - "/src/file1.xml"
      - "/src/file2.xml"
    namespaces:
        var: http://www.springframework.org/schema/beans
        xpath: //*/var:bean/@class[matches(self::node(), 'org.apache.camel.util.toolbox.XsltAggregationStrategy')]
Copy to Clipboard Toggle word wrap

where:

xpath
must be a valid XPath expression.
filepaths
is a list of files to apply the XPath query to.
namespaces
define namespaces and assign them to variables. You can use the variable in the xpath.

json

By using the json capability, the provider queries XPath expressions on a list of provided JSON files. Currently, json only takes XPath as input and performs the search on all JSON files in the codebase. 

when:
  builtin.json:
    xpath: "<xpath_expressions>"
Copy to Clipboard Toggle word wrap

where:

xpath
must be a valid XPath expression.

hasTags

By using the hasTags capability, the provider queries application tags. It queries the internal data structure to check whether the application has the given tags. 

when:
  # when more than one tag is given, a logical AND is implied
  hasTags:
    - "tag1"
    - "tag2"
Copy to Clipboard Toggle word wrap

where:

hasTags
When more than one tag is given, a logical AND is implied.

3.3. Java provider
Copy link

The java provider analyzes Java source code.

This provider has the following capabilities:

  • referenced
  • dependency

referenced

By using the referenced capability, the provider finds references in the source code. This capability takes three input parameters: pattern, location, and annotated. 

when:
  java.referenced:
    pattern: "<pattern>"
    location: "<location>"
    annotated: "<annotated>"
Copy to Clipboard Toggle word wrap

where:

pattern
A regular expression pattern to match.
location
Specifies the exact location where the pattern needs to be matched, for example, IMPORT.
annotated
Checks for specific annotations and their elements, such as name and value, in the Java code using a query. For example, the following query matches the Bean (url = “http://www.example.com”) annotation in the method. 
 annotated:
      pattern: org.framework.Bean
      elements:
      - name: url
        value: "http://www.example.com"
Copy to Clipboard Toggle word wrap

See Java condition and capabilities for a detailed explanation on java.referenced capabilities.

dependency

The Java provider has dependency capability. The dependency capability enables the provider to generate a list of dependencies for a given application. You can use a dependency condition to query this list and check whether a certain dependency, with a version range, exists for the application. The dependency can be internal or external/open source. For example, to check if a Java application has a certain dependency, you create a java.dependency condition: 

when:
  java.dependency:
    name: junit.junit
    upperbound: 4.12.2
    lowerbound: 4.4.0
Copy to Clipboard Toggle word wrap

You can use the dependency capability to check if a Java application has Fabric8 Kubernetes client of version 5.0.100 or lower: 

- java.dependency:
    name: io.fabric8.kubernetes-client
    lowerbound: 5.0.100
Copy to Clipboard Toggle word wrap
Note

When you use the java provider for an analysis, the analysis results have lower precision for projects that cannot be built. For example, when MTA is unable to build a Maven project, it falls back to parsing the pom file to get the list of dependencies.

3.4. Go provider
Copy link

The go provider analyzes Go source code. This provider’s capabilities are referenced and dependency.

referenced

By using the referenced capability, the provider finds references in the source code. 

when:
  go.referenced: "<regex_to_find_reference>"
Copy to Clipboard Toggle word wrap

dependency

By using the dependency capability, the provider finds dependencies for a Go application. 

when:
  go.dependency:
    name: "<dependency_name>"
    upperbound: "<version_string>"
    lowerbound: "<version_string>"
Copy to Clipboard Toggle word wrap

where:

name
Name of the dependency to search for.
upperbound
Upper bound on the version of the dependency.
lowerbound
Lower bound on the version of the dependency.

3.5. Dotnet provider
Copy link

The dotnet provider is an external provider used to analyze .NET and C# source code. Currently, the provider supports the referenced capability.

referenced

By using the referenced capability, the provider finds references in the source code. 

when:
  dotnet.referenced:
    pattern: "<pattern>"
    namespace: "<namespace>"
Copy to Clipboard Toggle word wrap

where:

pattern
A regular expression pattern to match the desired reference. For example, HttpNotFound.
namespace
Specifies the namespace to search within. For example, System.Web.Mvc.
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top