Add example microflow policy

Author: xiwenc

docs/mendix-best-practices/Microflows/31-String-empty-check-not-completed.markdown

@@ -0,0 +1,36 @@
+# METADATA
+# scope: package
+# title: Empty String check not complete
+# description: Technically, there is a difference between empty and "". Make sure to check them both.
+# authors:
+# - Xiwen Cheng <[email protected]>
+# custom:
+#  category: Error
+#  rulename: EmptyStringCheckNotComplete
+#  severity: MEDIUM
+#  rulenumber: 005_0001
+#  remediation: Always check a string for empty based on != empty and != "". The first one equals database NULL value, the latter one indicates a truncated string.
+#  input: "*/**/*$Microflow.yaml"
+package app.mendix.microflows.empty_string_check_not_complete
+import rego.v1
+annotation := rego.metadata.chain()[1].annotations
+
+default allow := false
+allow if count(errors) == 0
+
+errors contains error if {
+    [p, v] := walk(input)
+    last := array.slice(p, count(p) - 1, count(p))[0]
+    last ==  "Expression"
+    contains(replace(v, " ", ""), "!=''")
+    not contains(replace(v, " ", ""), "!=empty")
+    error := sprintf("[%v, %v, %v] Expression in Microflow '%v' has incomplete empty string check '%v'",
+        [
+            annotation.custom.severity,
+            annotation.custom.category,
+            annotation.custom.rulenumber,
+            input.Name,
+            v,
+        ]
+    )
+}

policies/005_microflows/005_0001_empty_string_check_not_complete.rego

@@ -0,0 +1,47 @@
+package app.mendix.microflows.empty_string_check_not_complete
+import rego.v1
+
+
+# Test data
+microflow_good = {
+	"$Type": "Microflow$Page",
+	"Name": "mf1",
+	"ObjectCollection": {
+		"$Type": "Microflows$MicroflowObjectCollection",
+		"Objects": [
+			{
+				"$Type": "Microflows$ExclusiveSplit",
+				"SplitCondition": {
+					"$Type": "Microflows$ExpressionSplitCondition",
+					"Expression": "$Variable != empty and $Variable != ''",
+				},
+			},
+		],
+	},
+}
+
+microflow_bad = {
+	"$Type": "Microflow$Page",
+	"Name": "mf1",
+	"ObjectCollection": {
+		"$Type": "Microflows$MicroflowObjectCollection",
+		"Objects": [
+			{
+				"$Type": "Microflows$ExclusiveSplit",
+				"SplitCondition": {
+					"$Type": "Microflows$ExpressionSplitCondition",
+					"Expression": "$Variable != ''",
+				},
+			},
+		],
+	},
+}
+
+# Test cases
+test_simple if {
+	allow with input as microflow_good
+}
+
+test_simple_negative if {
+	not allow with input as microflow_bad
+}