feat: add doctype caster security rule

rules/security.py

@@ -1,6 +1,31 @@
+from frappe.model import Document
+from frappe import requires_permission
+
 def function_name(input):
 	# ruleid: frappe-codeinjection-eval
 	eval(input)
 
 # ok: frappe-codeinjection-eval
 eval("1 + 1")
+
+# ruleid: require-permission-decorator-on-conversion-methods-into
+class MyDocument(Document):
+	def _into_sales_invoice(self, so):
+		pass
+
+# ok: require-permission-decorator-on-conversion-methods-into
+class MyDocument(Document):
+    @requires_permission("Sales Invice", "create")
+	def _into_sales_invoice(self, so):
+		pass
+
+# ruleid: require-permission-decorator-on-conversion-methods-from
+class MyDocument(Document):
+	def _from_sales_invoice(self, so):
+		pass
+
+# ok: require-permission-decorator-on-conversion-methods-from
+class MyDocument(Document):
+    @requires_permission("Sales Invice", "read")
+	def _from_sales_invoice(self, so):
+		pass

rules/security.yml

@@ -8,3 +8,49 @@ rules:
     dynamic content. Avoid it or use safe_eval().
   languages: [python]
   severity: ERROR
+
+- id: require-permission-decorator-on-conversion-methods-from
+  pattern-either:
+    - pattern: |
+        class $CLASS(...):
+          ...
+          def _from_$METHOD(...):
+            ...
+  pattern-not:
+    - pattern: |
+        @requires_permission(...)
+        def _from_$METHOD(...):
+          ...
+    - pattern: |
+        @frappe.requires_permission(...)
+        def _from_$METHOD(...):
+          ...
+  message: "Conversion method '_from_$METOD' of class '$CLASS' must have at least one @frappe.requires_permission(...) decorator"
+  languages: [python]
+  severity: ERROR
+  paths:
+      include:
+        - "*/**/doctype/*"
+
+- id: require-permission-decorator-on-conversion-methods-into
+  pattern-either:
+    - pattern: |
+        class $CLASS(...):
+          ...
+          def _into_$METHOD(...):
+            ...
+  pattern-not:
+    - pattern: |
+        @requires_permission(...)
+        def _into_$METHOD(...):
+          ...
+    - pattern: |
+        @frappe.requires_permission(...)
+        def _into_$METHOD(...):
+          ...
+  message: "Conversion method '_into_$METOD' of class '$CLASS' must have at least one @frappe.requires_permission(...) decorator"
+  languages: [python]
+  severity: ERROR
+  paths:
+      include:
+        - "*/**/doctype/*"