fix(scanner): Make per-language enabled_rules allowlists take effect

CHANGELOG.md

@@ -9,6 +9,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ## [Unreleased]
 
 ### Upgrade notes
+- **`<language>_enabled_rules` now takes effect.** If you set it in a workflow,
+  on the command line or in the Socket Basics dashboard, scans for that language
+  now run only the listed rules, where they previously ran every bundled rule,
+  so expect fewer SAST findings. Clear the list or set
+  `all_rules_enabled: 'true'` to keep running every rule. The step log warns
+  about listed IDs that match no rule. See the Fixed entry below.
 - **Socket Tier 1 needs outbound access to `api.socket.dev` and
   `storage.googleapis.com`.** Socket npm CLI 1.9.0 and later download the
   Coana reachability engine from Socket instead of npm, with no npm fallback.
@@ -44,6 +50,27 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ### Fixed
 - TruffleHog 3.99.8 is built on Go 1.27.3, clearing the CVE-2026-111943
   finding noted in 3.4.1.
+- `<language>_enabled_rules` now narrows the SAST scan. OpenGrep prefixes the
+  ID of every rule it loads from a rules file with the file's directories, so
+  the `--exclude-rule` flags built from bare rule IDs never matched and every
+  bundled rule ran. The scanner now passes OpenGrep a copy of the rules file
+  that holds only the enabled rules, written next to the original so findings
+  keep the same fingerprint as an unfiltered scan. Enabled IDs that match no
+  rule are logged as a warning; if none match, every rule for that language
+  runs (#135). C and C++ share one rules file, as do C# and .NET; when both
+  languages in a pair are enabled and either has an empty list, every rule in
+  the shared file runs.
+- **Behavior change:** the `<language>_enabled_rules` defaults are now empty in
+  both `action.yml` and `connectors.yaml`, so every bundled rule for an enabled
+  language runs. That is what scans already did, because the filter above never
+  applied, so default scan results do not change. The previous Action defaults
+  had drifted from the CLI defaults and named seven rule IDs that no longer
+  exist; with the filter working, they would have cut JavaScript scans from 59
+  rules to 6. To narrow a scan, set `<language>_enabled_rules` explicitly.
+- An all-languages SAST scan no longer loads `erlang.yml` or
+  `objective-c.yml`. OpenGrep supports neither language and reported an
+  `UnknownLanguageError` for each file.
+- Temporary files written for custom SAST rules are removed after the scan.
 
 ## [3.4.1] - 2026-10-21
 

action.yml

@@ -177,9 +177,9 @@ inputs:
     required: false
     default: ""
   c_enabled_rules:
-    description: "Comma-separated list of C SAST rules to enable (default: high-confidence rules)"
+    description: "Comma-separated IDs of the C SAST rules to run (default: empty, which runs every bundled C rule)"
     required: false
-    default: "c-buffer-overflow,c-format-string-vulnerability,c-command-injection,c-sql-injection,c-use-after-free,c-hardcoded-secrets,c-weak-crypto,c-ssl-issues"
+    default: ""
   c_sast_enabled:
     description: "Enable C SAST scanning"
     required: false
@@ -197,9 +197,9 @@ inputs:
     required: false
     default: ""
   cpp_enabled_rules:
-    description: "Comma-separated list of C++ SAST rules to enable (default: high-confidence rules)"
+    description: "Comma-separated IDs of the C++ SAST rules to run (default: empty, which runs every bundled C++ rule)"
     required: false
-    default: "c-buffer-overflow,c-format-string-vulnerability,c-command-injection,c-sql-injection,c-use-after-free,c-hardcoded-secrets,c-weak-crypto,c-ssl-issues,cpp-unsafe-cast,cpp-memory-management"
+    default: ""
   cpp_sast_enabled:
     description: "Enable C++ SAST scanning"
     required: false
@@ -209,9 +209,9 @@ inputs:
     required: false
     default: ""
   csharp_enabled_rules:
-    description: "Comma-separated list of C# SAST rules to enable (default: high-confidence rules)"
+    description: "Comma-separated IDs of the C# SAST rules to run (default: empty, which runs every bundled C# rule)"
     required: false
-    default: "dotnet-sql-injection,dotnet-command-injection,dotnet-code-injection,dotnet-unsafe-deserialization,dotnet-ldap-injection,dotnet-hardcoded-credentials,dotnet-ssl-bypass,dotnet-xxe-vulnerability,dotnet-xpath-injection"
+    default: ""
   csharp_sast_enabled:
     description: "Enable C# SAST scanning"
     required: false
@@ -229,9 +229,9 @@ inputs:
     required: false
     default: ""
   dotnet_enabled_rules:
-    description: "Comma-separated list of .NET SAST rules to enable (default: high-confidence rules)"
+    description: "Comma-separated IDs of the .NET SAST rules to run (default: empty, which runs every bundled .NET rule)"
     required: false
-    default: "dotnet-sql-injection,dotnet-command-injection,dotnet-code-injection,dotnet-unsafe-deserialization,dotnet-ldap-injection,dotnet-hardcoded-credentials,dotnet-ssl-bypass,dotnet-xxe-vulnerability,dotnet-xpath-injection"
+    default: ""
   dotnet_sast_enabled:
     description: "Enable .NET SAST scanning"
     required: false
@@ -241,9 +241,9 @@ inputs:
     required: false
     default: ""
   elixir_enabled_rules:
-    description: "Comma-separated list of Elixir SAST rules to enable (default: high-confidence rules)"
+    description: "Comma-separated IDs of the Elixir SAST rules to run (default: empty, which runs every bundled Elixir rule)"
     required: false
-    default: "elixir-code-injection,elixir-sql-injection,elixir-command-injection,elixir-unsafe-deserialization,elixir-hardcoded-secrets,elixir-phoenix-ecto-injection"
+    default: ""
   elixir_sast_enabled:
     description: "Enable Elixir SAST scanning"
     required: false
@@ -257,9 +257,9 @@ inputs:
     required: false
     default: ""
   go_enabled_rules:
-    description: "Comma-separated list of Go SAST rules to enable (default: high-confidence rules)"
+    description: "Comma-separated IDs of the Go SAST rules to run (default: empty, which runs every bundled Go rule)"
     required: false
-    default: "go-hardcoded-credentials,go-bind-all-interfaces,go-unsafe-usage,go-ssh-insecure-ignore-host-key,go-profiling-endpoint-exposed,go-decompression-bomb,go-sql-format-string"
+    default: ""
   go_sast_enabled:
     description: "Enable Go SAST scanning"
     required: false
@@ -273,9 +273,9 @@ inputs:
     required: false
     default: ""
   java_enabled_rules:
-    description: "Comma-separated list of Java SAST rules to enable (default: high-confidence rules)"
+    description: "Comma-separated IDs of the Java SAST rules to run (default: empty, which runs every bundled Java rule)"
     required: false
-    default: "java-sql-injection,java-unsafe-deserialization,java-command-injection,java-ldap-injection,java-hardcoded-credentials,java-weak-crypto-md5,java-weak-crypto-sha1,java-xxe-vulnerability,java-ssl-bypass,java-weak-ssl-version,java-jndi-injection,java-el-injection"
+    default: ""
   java_sast_enabled:
     description: "Enable Java SAST scanning"
     required: false
@@ -285,9 +285,9 @@ inputs:
     required: false
     default: ""
   javascript_enabled_rules:
-    description: "Comma-separated list of JavaScript/TypeScript SAST rules to enable (default: high-confidence rules)"
+    description: "Comma-separated IDs of the JavaScript/TypeScript SAST rules to run (default: empty, which runs every bundled JavaScript/TypeScript rule)"
     required: false
-    default: "js-eval-usage,js-sql-injection,js-command-injection,js-prototype-pollution,js-xss-innerhtml,js-path-traversal,js-tls-reject-unauthorized-false,js-weak-crypto-md5"
+    default: ""
   javascript_sast_enabled:
     description: "Enable JavaScript/TypeScript SAST scanning"
     required: false
@@ -317,9 +317,9 @@ inputs:
     required: false
     default: ""
   kotlin_enabled_rules:
-    description: "Comma-separated list of Kotlin SAST rules to enable (default: high-confidence rules)"
+    description: "Comma-separated IDs of the Kotlin SAST rules to run (default: empty, which runs every bundled Kotlin rule)"
     required: false
-    default: "kotlin-sql-injection,kotlin-command-injection,kotlin-code-injection,kotlin-unsafe-deserialization,kotlin-hardcoded-secrets,kotlin-ssl-bypass,kotlin-xxe-vulnerability,kotlin-ldap-injection"
+    default: ""
   kotlin_sast_enabled:
     description: "Enable Kotlin SAST scanning"
     required: false
@@ -357,9 +357,9 @@ inputs:
     required: false
     default: ""
   php_enabled_rules:
-    description: "Comma-separated list of PHP SAST rules to enable (default: high-confidence rules)"
+    description: "Comma-separated IDs of the PHP SAST rules to run (default: empty, which runs every bundled PHP rule)"
     required: false
-    default: "php-code-injection,php-sql-injection,php-command-injection,php-unsafe-deserialization,php-ldap-injection,php-file-inclusion,php-xxe-vulnerability,php-hardcoded-secrets,php-path-traversal"
+    default: ""
   php_sast_enabled:
     description: "Enable PHP SAST scanning"
     required: false
@@ -373,9 +373,9 @@ inputs:
     required: false
     default: ""
   python_enabled_rules:
-    description: "Comma-separated list of Python SAST rules to enable (default: high-confidence rules)"
+    description: "Comma-separated IDs of the Python SAST rules to run (default: empty, which runs every bundled Python rule)"
     required: false
-    default: "python-exec-used,python-bad-file-permissions,python-hardcoded-password-string,python-eval-usage,python-request-without-cert-validation,python-ssl-bad-version,python-subprocess-shell-true,python-start-process-with-shell,python-sql-injection-format,python-flask-debug-true,python-jinja2-autoescape-false"
+    default: ""
   python_sast_enabled:
     description: "Enable Python SAST scanning"
     required: false
@@ -385,9 +385,9 @@ inputs:
     required: false
     default: ""
   ruby_enabled_rules:
-    description: "Comma-separated list of Ruby SAST rules to enable (default: high-confidence rules)"
+    description: "Comma-separated IDs of the Ruby SAST rules to run (default: empty, which runs every bundled Ruby rule)"
     required: false
-    default: "ruby-eval-injection,ruby-command-injection,ruby-sql-injection,ruby-unsafe-deserialization,ruby-hardcoded-secrets,ruby-ssl-verification-bypass,ruby-rails-find-by-sql-injection,ruby-rails-unsafe-constantize,ruby-xxe-vulnerability"
+    default: ""
   ruby_sast_enabled:
     description: "Enable Ruby SAST scanning"
     required: false
@@ -397,9 +397,9 @@ inputs:
     required: false
     default: ""
   rust_enabled_rules:
-    description: "Comma-separated list of Rust SAST rules to enable (default: high-confidence rules)"
+    description: "Comma-separated IDs of the Rust SAST rules to run (default: empty, which runs every bundled Rust rule)"
     required: false
-    default: "rust-command-injection,rust-unsafe-deserialization,rust-sql-injection,rust-hardcoded-secrets,rust-insecure-tls,rust-buffer-overflow-potential"
+    default: ""
   rust_sast_enabled:
     description: "Enable Rust SAST scanning"
     required: false
@@ -409,9 +409,9 @@ inputs:
     required: false
     default: ""
   scala_enabled_rules:
-    description: "Comma-separated list of Scala SAST rules to enable (default: high-confidence rules)"
+    description: "Comma-separated IDs of the Scala SAST rules to run (default: empty, which runs every bundled Scala rule)"
     required: false
-    default: "scala-sql-injection,scala-code-injection,scala-command-injection,scala-unsafe-deserialization,scala-hardcoded-secrets,scala-ssl-bypass,scala-slick-sql-injection"
+    default: ""
   scala_sast_enabled:
     description: "Enable Scala SAST scanning"
     required: false
@@ -445,9 +445,9 @@ inputs:
     required: false
     default: ""
   swift_enabled_rules:
-    description: "Comma-separated list of Swift SAST rules to enable (default: high-confidence rules)"
+    description: "Comma-separated IDs of the Swift SAST rules to run (default: empty, which runs every bundled Swift rule)"
     required: false
-    default: "swift-sql-injection,swift-command-injection,swift-unsafe-deserialization,swift-hardcoded-secrets,swift-ssl-bypass,swift-insecure-urlsession,swift-certificate-pinning-bypass"
+    default: ""
   swift_sast_enabled:
     description: "Enable Swift SAST scanning"
     required: false

docs/github-action.md

@@ -511,7 +511,8 @@ Dockerfiles.
 The exceptions:
 
 - A blank `<language>_enabled_rules` or `<language>_disabled_rules` field is
-  skipped, so the workflow's value or the action's default list applies.
+  skipped, so the workflow's value applies. If the workflow sets none, every
+  bundled rule for the language runs.
 - A blank notification field (Slack, Jira, Microsoft Teams, generic webhook,
   Microsoft Sentinel, Sumo Logic) falls back to the workflow's value, and so does
   a blank GitHub token. A filled-in dashboard field still wins.
@@ -556,17 +557,11 @@ directly as a step:
 ```
 
 Only the flags you pass take precedence. Every other setting still comes from
-the dashboard. Running the image directly differs from the action in two ways:
-
-- The action's default rule lists (`<language>_enabled_rules` in
-  [`action.yml`](../action.yml)) don't apply. Where the dashboard's rule-list
-  fields are blank, SAST uses the image's own defaults from
-  [`connectors.yaml`](../socket_basics/connectors.yaml), which include more rules
-  for some languages.
-- The step isn't tied to an action version, so update the image tag yourself
-  when you upgrade. To pin by digest, append `@sha256:<digest>` to the image.
-  `docker buildx imagetools inspect ghcr.io/socketdev/socket-basics:3.4.1`
-  prints the digest.
+the dashboard. Running the image directly differs from the action in one way:
+the step isn't tied to an action version, so update the image tag yourself
+when you upgrade. To pin by digest, append `@sha256:<digest>` to the image.
+`docker buildx imagetools inspect ghcr.io/socketdev/socket-basics:3.4.1`
+prints the digest.
 
 See the [Parameters Reference](parameters.md) for every CLI flag.
 
@@ -929,7 +924,7 @@ jobs:
           all_rules_enabled: 'true'
 
           # Optional: enable specific bundled or custom rule IDs.
-          javascript_enabled_rules: 'eval-usage,prototype-pollution'
+          javascript_enabled_rules: 'js-code-injection-eval,js-prototype-pollution'
 
           # Ignore one or more SAST rules globally or for exact repo-relative files
           sast_ignore_overrides: 'js-sql-injection:index.js'
@@ -942,7 +937,9 @@ Important behavior:
   `use_custom_sast_rules`, `custom_sast_rule_path` and `sast_ignore_overrides`
   have no dashboard field and come from the workflow. See
   [Dashboard Settings and Workflow Inputs](#dashboard-settings-and-workflow-inputs).
-- `<language>_enabled_rules` is an allowlist and can suppress custom rule IDs.
+- `<language>_enabled_rules` is an allowlist: only the listed rule IDs run, and it
+  can suppress custom rule IDs. When it is empty (the default), every rule runs.
+  IDs that match no rule are ignored with a warning in the step log.
 - `all_rules_enabled: 'true'` disables allowlist filtering for enabled languages.
 
 `sast_ignore_overrides` supports:
@@ -1000,7 +997,7 @@ Every input has a CLI flag and environment-variable equivalent; the
 - `opengrep_notification_method` — Route SAST findings to one notifier (e.g. `console`, `slack`)
 
 **Rule Configuration (per language):**
-- `<language>_enabled_rules` — Comma-separated rules to enable
+- `<language>_enabled_rules` — Comma-separated rule IDs to run (default: empty, which runs every bundled rule)
 - `<language>_disabled_rules` — Comma-separated rules to disable
 - `use_custom_sast_rules` — Enable custom SAST rule discovery from repo files
 - `custom_sast_rule_path` — Relative path to custom SAST rule directory

docs/parameters.md

@@ -82,7 +82,7 @@ GitHub Action input is delivered to the container as the environment variable
 | `--use-custom-sast-rules` | `use_custom_sast_rules` | `INPUT_USE_CUSTOM_SAST_RULES` | `use_custom_sast_rules` | Use custom SAST rules instead of bundled rules (falls back to bundled rules for languages without custom rules) |
 | `--custom-sast-rule-path` | `custom_sast_rule_path` | `INPUT_CUSTOM_SAST_RULE_PATH` | `custom_sast_rule_path` | Relative path to custom SAST rules directory (relative to workspace if set, otherwise cwd) |
 | `--sast-ignore-overrides` | `sast_ignore_overrides` | `INPUT_SAST_IGNORE_OVERRIDES` | `sast_ignore_overrides` | Comma-separated list of SAST ignore overrides in rule_id or rule_id:path format |
-| `--<lang>-enabled-rules` | `<lang>_enabled_rules` | `INPUT_<LANG>_ENABLED_RULES` | `<lang>_enabled_rules` | Comma-separated allowlist of rules for one language (defaults to the high-confidence set). |
+| `--<lang>-enabled-rules` | `<lang>_enabled_rules` | `INPUT_<LANG>_ENABLED_RULES` | `<lang>_enabled_rules` | Comma-separated allowlist of rule IDs for one language. Empty (the default) runs every bundled rule for the language. |
 | `--<lang>-disabled-rules` | `<lang>_disabled_rules` | `INPUT_<LANG>_DISABLED_RULES` | `<lang>_disabled_rules` | Comma-separated rules to disable for one language. |
 
 `<lang>` is one of: `c`, `cpp`, `csharp`, `dotnet`, `elixir`, `go`, `java`, `javascript`, `kotlin`, `php`, `python`, `ruby`, `rust`, `scala`, `swift`.
@@ -500,20 +500,24 @@ line carrying one does not pass it through.
 
 ### Language-Specific Rule Configuration
 
-For each language, you can enable or disable specific rules:
+For each language, you can enable or disable specific rules. By default every
+bundled rule for an enabled language runs. An enabled-rules list narrows the scan
+to exactly those rule IDs; IDs that match no bundled rule are ignored with a
+warning in the log. Rule IDs are the `id` values in
+[`socket_basics/rules/`](../socket_basics/rules/).
 
 **Pattern:** `--<language>-enabled-rules` or `--<language>-disabled-rules`
 
 **Examples:**
 ```bash
 # Enable specific Python rules
-socket-basics --python --python-enabled-rules "sql-injection,xss-detection"
+socket-basics --python --python-enabled-rules "python-sql-injection,python-command-injection"
 
 # Disable specific JavaScript rules
-socket-basics --javascript --javascript-disabled-rules "console-log,debugger-statement"
+socket-basics --javascript --javascript-disabled-rules "js-debugger-statement,js-parseint-missing-radix"
 
 # Enable specific Go rules
-socket-basics --go --go-enabled-rules "error-handling,sql-injection"
+socket-basics --go --go-enabled-rules "go-sql-format-string,go-hardcoded-credentials"
 ```
 
 **Available for:**