[{"_1":2,"_175":-5,"_176":-5},"loaderData",{"_3":4,"_13":14,"_20":21,"_164":165},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","routes/_layout.layers.$namespace.$reponame.$tag.(images).($imageUrlDigest)",{"_22":23,"_24":25,"_77":78,"_90":-7,"_91":-7,"_92":-7,"_93":-7,"_94":-5,"_95":-5,"_96":11,"_97":11,"_71":98,"_156":11,"_127":66,"_157":126,"_158":70,"_30":58,"_159":11,"_160":17,"_161":43,"_162":-5,"_163":11},"scanningType","none","tagData",{"_26":27,"_28":29,"_30":31,"_32":33,"_34":35,"_36":37,"_62":63,"_64":29,"_65":66,"_67":68,"_69":70,"_71":72,"_73":59,"_74":63,"_75":54,"_76":17},"content_type","image","creator",2520828,"digest","sha256:62de09da0756420037de64a1398530b1ed205d4b260deffe2e758fb3d93c1c95","full_size",7438917,"id",363552072,"images",[38,56],{"_39":40,"_30":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":43,"_51":-5,"_52":33,"_53":54,"_55":-5},"architecture","amd64","sha256:e32d409697538c11f1bf7d529cb8f64ddb25c78dc9ffa811cb18556dd9020c8f","features","","last_pulled","2026-09-16T07:06:35.880981612Z","last_pushed","2025-07-02T21:27:57.625345812Z","os","linux","os_features","os_version","size","status","active","variant",{"_39":57,"_30":58,"_42":43,"_44":59,"_46":60,"_48":49,"_50":43,"_51":-5,"_52":61,"_53":54,"_55":-5},"arm64","sha256:f6e004193c9d21a6134ff5b173a34d68b501d8848d30c7fbc278e5f862077281","2026-09-16T07:06:35.915369898Z","2025-07-02T21:28:07.81590571Z",6754381,"last_updated","2025-07-02T21:29:09.400057Z","last_updater","last_updater_username","simonkowallik","media_type","application/vnd.docker.distribution.manifest.list.v2+json","name","apiserver","repository",18806161,"tag_last_pulled","tag_last_pushed","tag_status","v2","tagImages",[79,86],{"_39":40,"_30":41,"_42":43,"_44":45,"_46":47,"_80":81,"_48":49,"_50":43,"_51":-5,"_52":33,"_53":54,"_55":-5},"layers",[82],{"_30":83,"_52":33,"_84":85},"sha256:81751ac1ec1ed5bbfdc4fe2240f87cb5516b7e6e473c5a5980cb068e54eb2bff","instruction","apko",{"_39":57,"_30":58,"_42":43,"_44":59,"_46":60,"_80":87,"_48":49,"_50":43,"_51":-5,"_52":61,"_53":54,"_55":-5},[88],{"_30":89,"_52":61,"_84":85},"sha256:839a0d369d86f09053c96accaba01e3d1165ccbf4e0cafc369deb644214b2c78","layerOrdinals","packageName","cveId","sbom","scoutSummary","staticSummary","isScoutPaymentRequired","canSeeVulnerabilities",{"_99":100,"_111":112,"_113":114,"_115":116,"_117":11,"_62":118,"_119":120,"_121":122,"_69":126,"_127":66,"_128":129,"_130":27,"_131":132,"_53":132,"_133":54,"_134":-5,"_135":136,"_137":138,"_139":11,"_140":66,"_141":142,"_147":11,"_148":149,"_153":66,"_154":155},"categories",[101,105,108],{"_69":102,"_103":104},"Networking","slug","networking",{"_69":106,"_103":107},"Languages & frameworks","languages-and-frameworks",{"_69":109,"_103":110},"Integration & delivery","integration-and-delivery","content_types",[27],"date_registered","2022-12-18T11:34:40.189437Z","description"," irulescan - security analyzer for iRules","is_private","2025-07-06T11:47:48.537917Z","last_modified","2025-07-02T22:11:07.224375Z","media_types",[123,68,124,125],"application/vnd.docker.container.image.v1+json","application/vnd.oci.image.config.v1+json","application/vnd.oci.image.index.v1+json","irulescan","namespace","pull_count",1748,"repository_type","star_count",1,"status_description","source","collaborator_count",0,"full_description","

\n\n $\"irulescan\"$ \n\n
\n security analyzer for iRules\n

\n\n---\n\n

\n\n $\"test\"$ \n\n\n $\"container$ \n\n\n $\"releases\"$ \n\n

\n\n`irulescan` is a tool to scan iRules for unexpected/unsafe expressions that may have undesirable effects like double substitution and additional issues.\n\n`irulescan` would not exist without [tclscan](https://github.com/aidanhs/tclscan).\n\nIt is available as a docker/container image as well as a Github Action [`irulescan-action`](https://github.com/marketplace/actions/irules-security-scan).\n\n## Usage\n\nIt is easiest to use irulescan as a container to scan your iRules, available via [docker hub](https://hub.docker.com/r/simonkowallik/irulescan) as well as [ghcr.io](https://github.com/simonkowallik/irulescan/pkgs/container/irulescan).\n\nThe container will recursively scan files in the `/scandir` directory within the container and return results in JSON format.\nOnly files with the (case insensitive) file extensions `.tcl`, `.irul` and `.irule` will be scanned unless overwritten by environment variable `IRULESCAN_FILE_EXTENSIONS`.\n\n### Command line\n\nScanning all iRules in a directory recursively (`$PWD/tests/basic`):\n\n```shell\ndocker run --rm -v \"$PWD/tests/basic:/scandir\" simonkowallik/irulescan\n```\n\n```json\n[\n {\n \"filepath\": \"dangerous.tcl\",\n \"warning\": [\n \"Unquoted expr at `1` in `expr 1 + $one`\",\n \"Unquoted expr at `+` in `expr 1 + $one`\"\n ],\n \"dangerous\": [\"Dangerous unquoted expr at `$one` in `expr 1 + $one`\"]\n },\n {\n \"filepath\": \"ok.tcl\",\n \"warning\": [],\n \"dangerous\": []\n },\n {\n \"filepath\": \"warning.tcl\",\n \"warning\": [\n \"Unquoted expr at `1` in `expr 1 + 1`\",\n \"Unquoted expr at `+` in `expr 1 + 1`\",\n \"Unquoted expr at `1` in `expr 1 + 1`\"\n ],\n \"dangerous\": []\n }\n]\n```\n\nIf you plan to use irulescan frequently, consider adding a shell function to wrap the container execution and add it in your shell, eg. in your `.bashrc` or similar.\n\n```shell\nirulescan(){ docker run --rm -iv \"$PWD:$PWD\" -w \"$PWD\" simonkowallik/irulescan:latest \"${@:--help}\"; }\n# invoke ephemeral (--rm) container interactively (-i)\n# bind mount (-v) PWD to the same path and use it as workdir (-w)\n# pass any parameters, if none/empty, pass \"help\" (\"${@:--help}\")\n```\n\n> [!NOTE]\n> For brevity and readability the below examples use `jq` and `yq` to format the json output.\n\n```bash\nirulescan check --exclude-empty-findings ./tests/basic/ | yq -pjson -oyaml\n```\n\n```yaml\n- filepath: tests/basic/dangerous.tcl\n warning:\n - message: unsafe expression, use braces `{ .. }`\n issue_location: \"1\"\n context: expr 1 + $one\n line: 2\n - message: unsafe expression, use braces `{ .. }`\n issue_location: +\n context: expr 1 + $one\n line: 2\n dangerous:\n - message: dangerous unsafe expression, use braces `{ .. }`\n issue_location: $one\n context: expr 1 + $one\n line: 2\n- filepath: tests/basic/warning.tcl\n warning:\n - message: unsafe expression, use braces `{ .. }`\n issue_location: \"1\"\n context: expr 1 + 1\n line: 1\n - message: unsafe expression, use braces `{ .. }`\n issue_location: +\n context: expr 1 + 1\n line: 1\n - message: unsafe expression, use braces `{ .. }`\n issue_location: \"1\"\n context: expr 1 + 1\n line: 1\n dangerous: []\n```\n\n>[!NOTE]\n> Please note the differences in `\"filepath\"` between the two invocation methods.\n> This is important to consider when comparing a new scan to existing results.\n> `--exclude-empty-findings` removes the entry for the file `\"ok.tcl\"` as it has no findings.\n> `cd tests/basic; irulescan check . | jq` would have provided the same results as the docker command from the previous example.\n\nWhen specifying a file explicitly, irulescan will try to scan the file regardless of the file extension.\n\n```bash\nirulescan check --no-warn tests/basic/dangerous.tcl\n```\n\n```json\n[{\"filepath\":\"tests/basic/dangerous.tcl\",\"warning\":[],\"dangerous\":[{\"message\":\"dangerous unsafe expression, use braces `{ .. }`\",\"issue_location\":\"$one\",\"context\":\"expr 1 + $one\",\"line\":2}]}]\n```\n\n```bash\nirulescan --help\n```\n\n```bash\nirulescan is a tool to scan iRules for unexpected/unsafe expressions that may have undesirable effects like double substitution.\nhome: https://github.com/simonkowallik/irulescan\n\nUsage: irulescan \n\nCommands:\n check Scan all iRules in a directory (recursively) or the specified file or - for stdin\n checkref Scan all iRules in reference file (JSON) and compare to reference\n parsestr Parse given string or stdin\n mcpserver Run MCP server (HTTP stream transport)\n apiserver Run HTTP API server (OpenAPI v3)\n help Print this message or the help of the given subcommand(s)\n\nOptions:\n -h, --help\n Print help (see a summary with '-h')\n\n -V, --version\n Print version\n```\n\n### API Server\n\nThe irulescan container tag `:apiserver` provides a simple OpenAPI server (previously Swagger) for scanning iRule code or multiple files.\n\nStart the API server:\n\n```shell\ndocker run -t --rm -p 8000:8000 simonkowallik/irulescan:apiserver\n```\n\nScanning a single file / iRule code:\n\n```shell\ncurl -s http://localhost:8000/scan/ \\\n --data-binary '@tests/basic/dangerous.tcl' | yq -pjson -oyaml\n```\n\n```yaml\nwarning:\n - message: unsafe expression, use braces `{ .. }`\n issue_location: \"1\"\n context: expr 1 + $one\n line: 2\n - message: unsafe expression, use braces `{ .. }`\n issue_location: +\n context: expr 1 + $one\n line: 2\ndangerous:\n - message: dangerous unsafe expression, use braces `{ .. }`\n issue_location: $one\n context: expr 1 + $one\n line: 2\n```\n\nScanning multiple files:\n\n```shell\ncurl -s http://localhost:8000/scanfiles/ \\\n -F 'file=@tests/basic/warning.tcl' \\\n -F 'file=@tests/basic/ok.tcl' \\\n | yq -pjson -oyaml\n```\n\n```yaml\n- filepath: warning.tcl\n warning:\n - message: unsafe expression, use braces `{ .. }`\n issue_location: \"1\"\n context: expr 1 + 1\n line: 1\n - message: unsafe expression, use braces `{ .. }`\n issue_location: +\n context: expr 1 + 1\n line: 1\n - message: unsafe expression, use braces `{ .. }`\n issue_location: \"1\"\n context: expr 1 + 1\n line: 1\n dangerous: []\n- filepath: ok.tcl\n warning: []\n dangerous: []\n```\n\nHere is a demo of the apiserver UI:\n\n

\n\n $\"simonkowallik/irulescan:apiserver\"$ \n\n

\n\n### MCP Server\n\nStart the MCP server:\n\n```bash\ndocker run -t --rm -p 8000:8000 simonkowallik/irulescan:mcpserver\n```\n\nWith VSCode and Copilot, follow [Use MCP servers in VS Code (Preview)](https://code.visualstudio.com/docs/copilot/chat/mcp-servers#_enable-mcp-support-in-vs-code).\n\nThe below is a - per workspace - config example:\n\n```bash\nmkdir .vscode\ncat <<'EOF' > .vscode/mcp.json\n{\n \"servers\": {\n \"irulescan\": {\n \"url\": \"http://localhost:8000\"\n }\n }\n}\nEOF\n```\n\nHere is a demo of the mcpserver using VSCode:\n\n

\n\n $\"simonkowallik/irulescan:apiserver\"$ \n\n

\n\n## Additional resources\n\nFor safer authoring the VS Code iRules Extension is highly recommended:\n\n- [F5 Networks iRules by bitwisecook](https://marketplace.visualstudio.com/items?itemName=bitwisecook.iRule) [on github](https://github.com/bitwisecook/vscode-iRule)\n\n- [Avoiding Common iRules Security Pitfalls on F5 DevCentral](https://community.f5.com/t5/technical-articles/avoiding-common-irules-security-pitfalls/ta-p/306623)\n\n- [iRules Style Guide on F5 DevCentral](https://community.f5.com/t5/technical-articles/irules-style-guide/ta-p/305921)\n\n## Advanced topics\n\n### Using irulescan in CI\n\nThe container uses `irulescan` as the entry point with the default CMD set to `check .` which will scan `/scandir` recursively.\n\nWhen using a CI system with custom mount points (eg. `/custom/path`), this can be easily supported by passing a new CMD like below. Note that, like outlined above, this will change the prefix of `\"filepath\"` for each iRule file.\n\n```shell\ndocker run --rm \\\n -v \"$PWD/tests/tcl/:/custom/path\" \\\n simonkowallik/irulescan check /custom/path\n```\n\nAlso have a look at [GitHub Action: irulescan-action](https://github.com/simonkowallik/irulescan-action), which can be used when using GitHub.\n\nAlternatives are using the API Server (see below) or invoke the irulescan container as outlined above. Consider creating a scan result file to compare against known findings and known iRules. Any change in findings could then be used to fail the CI run.\n\n### Check results against a reference (previous scan result)\n\nThe `checkref` command can be used to check each file listed in that reference file. The reference file is just a saved scan. See examples below.\n\n```bash\nirulescan/ $ cd ./tests/basic\n```\n\nUsing a previous scan result (`irulescan.json`) and passing it to `checkref` via STDIN. If the check is successful, the exist code will be 0.\n\n```bash\n$ cat irulescan.json | irulescan checkref -\nOK\n\n$ echo $?\n0\n```\n\nRe-checking `irulescan_nowarn.json` with no additional options.\n\n```bash\n$ irulescan checkref irulescan_nowarn.json\nFailed reference check!\nExtra in scan_results: .[1].warning.[0].({\"message\":\"unsafe expression, use braces `{ .. }`\",\"issue_location\":\"+\",\"context\":\"expr 1 + 1\",\"line\":1})\nExtra in scan_results: .[1].warning.[1].({\"message\":\"unsafe expression, use braces `{ .. }`\",\"issue_location\":\"1\",\"context\":\"expr 1 + 1\",\"line\":1})\nExtra in scan_results: .[1].warning.[2].({\"message\":\"unsafe expression, use braces `{ .. }`\",\"issue_location\":\"1\",\"context\":\"expr 1 + 1\",\"line\":1})\nExtra in scan_results: .[2].warning.[0].({\"message\":\"unsafe expression, use braces `{ .. }`\",\"issue_location\":\"+\",\"context\":\"expr 1 + $one\",\"line\":2})\nExtra in scan_results: .[2].warning.[1].({\"message\":\"unsafe expression, use braces `{ .. }`\",\"issue_location\":\"1\",\"context\":\"expr 1 + $one\",\"line\":2})\n\n$ echo $?\n1\n```\n\nThe above example produces a failed check as the scan results produce additional findings. The exit code is 1.\n\nThe previous scan result `irulescan_nowarn.json` does not contain any warnings, using the `--no-warn` option the check succeeds.\n\n```bash\n$ irulescan checkref --no-warn irulescan_nowarn.json\nOK\n\n$ echo $?\n0\n```\n\n### CLI exit codes\n\nWhen using the `irulescan check` command:\n\n- Always exits with code `0` no matter what findings are produced\n- Errors lead to a non-zero exit code > 1 (eg. a crash)\n\nWhen using the `irulescan checkref` command:\n\n- Exits with code `0` when the reference scan matches the current results\n- Exits with code `1` when the reference scan does NOT match the current results\n- Errors lead to a non-zero exit code > 1 (eg. a crash)\n\n### Environment Variables\n\nirulescan supports several environment variables to customize its behavior across different usage modes (command line, API server, and MCP server).\n\n#### Command Line and Container\n\nFor command line and container usage, you can use `IRULESCAN_FILE_EXTENSIONS` to specify which file extensions to scan. The default value is `.tcl,.irul,.irule`. File extensions are always case insensitive. File extensions should be comma-separated without spaces. This is particularly useful when working with custom file naming conventions or when you want to scan files with non-standard extensions.\n\n```bash\nexport IRULESCAN_FILE_EXTENSIONS=\".f5rule,.f5irule,.txt\"\nirulescan check ./my-rules/\n\n# Use container with custom file extensions\ndocker run --rm -v \"$PWD:/scandir\" -e IRULESCAN_FILE_EXTENSIONS=\".f5rule,.custom\" simonkowallik/irulescan\n```\n\n#### API Server and MCP Server\n\nFor API server and MCP server modes, you can configure the listen address and logging level using `IRULESCAN_LISTEN` and `IRULESCAN_LOG` respectively.\n\nThe `IRULESCAN_LISTEN` variable defaults to `0.0.0.0:8000` and controls the address and port the server binds to. The environment variable has the highest priority and will overwrite the default listen address as well as any listen address specified as a command line option to either mcpserver or apiserver.\n\nThe `IRULESCAN_LOG` variable defaults to info and accepts standard log levels: `trace`, `debug`, `info`, `warn`, and `error`, where `trace` provides the most verbose output.\n","has_starred","hub_user","immutable_tags_settings",{"_143":11,"_144":145},"enabled","rules",[146],".*","is_automated","permissions",{"_150":17,"_151":11,"_152":11},"read","write","admin","user","storage_size",504110968,"isOrg","reponame","tag","canDeleteTags","isHubSbxKitsEnabled","currentTab","tagAttestations","displaySecurityMetadata","routes/_layout.layers.$namespace.$reponame.$tag.(images).($imageUrlDigest)._index",{"_22":23,"_92":-7,"_90":-7,"_91":-7,"_24":166,"_30":58,"_170":171,"_174":11},{"_26":27,"_28":29,"_30":31,"_32":33,"_34":35,"_36":167,"_62":63,"_64":29,"_65":66,"_67":68,"_69":70,"_71":72,"_73":59,"_74":63,"_75":54,"_76":17},[168,169],{"_39":40,"_30":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":43,"_51":-5,"_52":33,"_53":54,"_55":-5},{"_39":57,"_30":58,"_42":43,"_44":59,"_46":60,"_48":49,"_50":43,"_51":-5,"_52":61,"_53":54,"_55":-5},"imageWithLayers",{"_39":57,"_30":58,"_42":43,"_44":59,"_46":60,"_80":172,"_48":49,"_50":43,"_51":-5,"_52":61,"_53":54,"_55":-5},[173],{"_30":89,"_52":61,"_84":85},"hasPermissionToViewRepoSettings","actionData","errors"]