fix/audit-findings #5
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "fix/audit-findings"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The Rust impl index keyed types by leaf name, so `a::Config` and `b::Config` shared one `(Config, load)` entry and the inherent method won: `use crate:🅱️:Config; c.load()` produced a `declared-receiver-type` edge to `a::Config::load`. The index now records which files declare each type name and the file of every impl. When several files declare a name, a call resolves only among impls of the type the calling file means (its own declaration, then a `use` binding, then the only declaration); with no such binding the call is left external as `ambiguous` instead of guessed. Unique names behave as before. Test: rust_methods::same_named_types_in_different_modules_resolve_through_use_bindings fails before this change (edge to src/a.rs).Every preprocessor branch was indexed as live. In yams, InternalEventBus.h guards spdlog with `#if __has_include(<spdlog/spdlog.h>) ... #else namespace spdlog { stubs }`, so 1,243 spdlog::warn/info/error call sites resolved to the fallback stubs, which became the 4th and 5th highest fan-in nodes. Brick does not evaluate conditions, so only the first branch is treated as live: declarations and prototypes inside `#elif`/`#else` stay in the graph (marked `source.preprocessor-branch: alternative`) but are not definitions, declarations or classes for call resolution. Branches are tracked textually from the directive lines, because conditions like `__has_include(<x>)` leave tree-sitter-cpp with an error-recovered tree that has no `preproc_else` node to find. Include-guard (`#ifndef`) code is a first branch and still resolves. Test: cpp_xtu::preprocessor_alternative_branches_are_not_call_targets fails before this change (spdlog::info resolves into the #elif stub).`brick check` read `metrics` from the model JSON and gated on them, so setting `cycle_count` to 0 and `score` to 100 in the file turned a failing `--max-cycles 0` gate into "passed" without changing the graph. check now recomputes the metrics from the loaded nodes and edges and gates on those; if the stored copy differs, that is itself a failure ("stored metrics do not match the graph"). Honest models recompute to identical values, so existing gates are unchanged. Test: diff_cli::check_recomputes_metrics_instead_of_trusting_the_file fails before this change (the tampered model passes).The Fold report importer was schema-less and trusted self-description: - `{"hello":1}` imported 0 findings with no diagnostic, like a clean run; - findings without a file location were dropped silently; - any JSON declaring backend "source" and confidence "proved"/"latent" got the Symbolic lane, whoever produced it; - SARIF `file://` URIs (and %-escapes) never matched a scanned file. Now a report must be a SARIF log (`runs`) or a Fold findings report (`findings`), otherwise the import fails with "not a Fold report". The Symbolic lane requires the producer to be Fold (`tool.name`, or every SARIF run's `tool.driver.name`, equal to "fold", which is what Fold writes); other producers' findings are imported in the Imported lane with a diagnostic. An unsupported `output_version` and findings dropped for lack of a location are diagnosed. `file://[localhost]` URIs lose their scheme and are percent-decoded before path matching. Existing tests that model Fold reports now carry Fold's real envelope. Tests (fold::tests) failing before this change: rejects_a_file_that_is_not_a_fold_report, symbolic_lane_requires_a_fold_producer_not_a_self_declared_label, sarif_file_uris_match_and_unlocated_findings_are_diagnosed...after a symlinked directory 4b2c873445