Skip to content

Commit b14f781

Browse files
edimujedimuj
committed
fix: resolve clippy ci failures
1 parent 4dd36bc commit b14f781

6 files changed

Lines changed: 58 additions & 56 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,15 +15,15 @@ jobs:
1515
runs-on: ubuntu-latest
1616

1717
steps:
18-
- uses: actions/checkout@v4
18+
- uses: actions/checkout@v6
1919

2020
- name: Install Rust
2121
uses: dtolnay/rust-toolchain@stable
2222
with:
2323
components: rustfmt, clippy
2424

2525
- name: Cache cargo
26-
uses: actions/cache@v4
26+
uses: actions/cache@v5
2727
with:
2828
path: |
2929
~/.cargo/registry

‎.github/workflows/release.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ jobs:
3737
runs-on: ${{ matrix.os }}
3838

3939
steps:
40-
- uses: actions/checkout@v4
40+
- uses: actions/checkout@v6
4141

4242
- name: Install Rust
4343
uses: dtolnay/rust-toolchain@stable

‎.github/workflows/validate-rules.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,13 @@ jobs:
1919
runs-on: ubuntu-latest
2020

2121
steps:
22-
- uses: actions/checkout@v4
22+
- uses: actions/checkout@v6
2323

2424
- name: Install Rust
2525
uses: dtolnay/rust-toolchain@stable
2626

2727
- name: Cache cargo registry
28-
uses: actions/cache@v4
28+
uses: actions/cache@v5
2929
with:
3030
path: |
3131
~/.cargo/registry
@@ -100,7 +100,7 @@ jobs:
100100
runs-on: ubuntu-latest
101101

102102
steps:
103-
- uses: actions/checkout@v4
103+
- uses: actions/checkout@v6
104104

105105
- name: Check JSON formatting
106106
run: |

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,3 +35,5 @@ CLAUDE.md
3535
.private
3636
# Nightshift plan artifacts (keep out of version control)
3737
.nightshift-plan
38+
share
39+
.dev/

‎src/analyzers/ast/detectors/variable_aliasing.rs‎

Lines changed: 49 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -65,71 +65,71 @@ impl Detector for VariableAliasingDetector {
6565
};
6666

6767
match scope_tracker.resolve(callee_name) {
68-
ResolvedValue::DangerousFunction(func_name) => {
69-
if callee_name != func_name {
68+
ResolvedValue::DangerousFunction(func_name) if callee_name != func_name => {
69+
let snippet = node.utf8_text(source.as_bytes()).unwrap_or("").to_string();
70+
71+
let start_line = node.start_position().row + 1;
72+
let end_line = node.end_position().row + 1;
73+
74+
findings.push(
75+
Finding::new(
76+
self.rule_id(),
77+
self.title(),
78+
format!(
79+
"Variable '{}' is an alias for '{}'. Calling it executes arbitrary code. \
80+
This pattern is used to evade regex-based detection.",
81+
callee_name, func_name
82+
),
83+
self.rule.severity(),
84+
self.rule.category(),
85+
Location::new(path.to_path_buf(), start_line, end_line).with_columns(
86+
callee.start_position().column + 1,
87+
callee.end_position().column + 1,
88+
),
89+
snippet,
90+
)
91+
.with_remediation(&self.rule.remediation)
92+
.with_metadata("technique", "variable_aliasing")
93+
.with_metadata("alias", callee_name.to_string())
94+
.with_metadata("target_function", func_name)
95+
.with_metadata("ast_analyzed", "true"),
96+
);
97+
}
98+
ResolvedValue::ImportResult {
99+
module,
100+
export: Some(exp),
101+
} if self.lists.is_dangerous_module(&module) => {
102+
if self.lists.is_dangerous_export(&module, &exp) {
70103
let snippet = node.utf8_text(source.as_bytes()).unwrap_or("").to_string();
71104

72105
let start_line = node.start_position().row + 1;
73106
let end_line = node.end_position().row + 1;
74107

75108
findings.push(
76109
Finding::new(
77-
self.rule_id(),
78-
self.title(),
110+
"AST-SHELL-001",
111+
"Aliased shell execution function call",
79112
format!(
80-
"Variable '{}' is an alias for '{}'. Calling it executes arbitrary code. \
81-
This pattern is used to evade regex-based detection.",
82-
callee_name, func_name
113+
"Variable '{}' is an alias for '{}.{}'. Calling it executes shell commands.",
114+
callee_name, module, exp
115+
),
116+
Severity::High,
117+
FindingCategory::ShellExecution,
118+
Location::new(path.to_path_buf(), start_line, end_line).with_columns(
119+
callee.start_position().column + 1,
120+
callee.end_position().column + 1,
83121
),
84-
self.rule.severity(),
85-
self.rule.category(),
86-
Location::new(path.to_path_buf(), start_line, end_line)
87-
.with_columns(callee.start_position().column + 1, callee.end_position().column + 1),
88122
snippet,
89123
)
90-
.with_remediation(&self.rule.remediation)
91-
.with_metadata("technique", "variable_aliasing")
124+
.with_remediation("Review the shell command execution and ensure user input is properly sanitized.")
125+
.with_metadata("technique", "import_aliasing")
92126
.with_metadata("alias", callee_name.to_string())
93-
.with_metadata("target_function", func_name)
127+
.with_metadata("module", module)
128+
.with_metadata("export", exp)
94129
.with_metadata("ast_analyzed", "true"),
95130
);
96131
}
97132
}
98-
ResolvedValue::ImportResult { module, export } => {
99-
if self.lists.is_dangerous_module(&module) {
100-
if let Some(ref exp) = export {
101-
if self.lists.is_dangerous_export(&module, exp) {
102-
let snippet =
103-
node.utf8_text(source.as_bytes()).unwrap_or("").to_string();
104-
105-
let start_line = node.start_position().row + 1;
106-
let end_line = node.end_position().row + 1;
107-
108-
findings.push(
109-
Finding::new(
110-
"AST-SHELL-001",
111-
"Aliased shell execution function call",
112-
format!(
113-
"Variable '{}' is an alias for '{}.{}'. Calling it executes shell commands.",
114-
callee_name, module, exp
115-
),
116-
Severity::High,
117-
FindingCategory::ShellExecution,
118-
Location::new(path.to_path_buf(), start_line, end_line)
119-
.with_columns(callee.start_position().column + 1, callee.end_position().column + 1),
120-
snippet,
121-
)
122-
.with_remediation("Review the shell command execution and ensure user input is properly sanitized.")
123-
.with_metadata("technique", "import_aliasing")
124-
.with_metadata("alias", callee_name.to_string())
125-
.with_metadata("module", module)
126-
.with_metadata("export", exp.clone())
127-
.with_metadata("ast_analyzed", "true"),
128-
);
129-
}
130-
}
131-
}
132-
}
133133
_ => {}
134134
}
135135

‎src/decoders/mod.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -224,7 +224,7 @@ impl Decoder {
224224
// (reverse order preserves earlier offsets)
225225
let mut new_content = current_content.clone();
226226
let mut sorted = decoded.clone();
227-
sorted.sort_by(|a, b| b.offset.cmp(&a.offset));
227+
sorted.sort_by_key(|decoded| std::cmp::Reverse(decoded.offset));
228228
for d in &sorted {
229229
let end = d.offset + d.original.len();
230230
if end <= new_content.len() && new_content.get(d.offset..end) == Some(&d.original) {

0 commit comments

Comments
 (0)