Skip to content

fix(scanner): close fs::write(dir.join ruleset bypass - #377

Open
samkay-ops wants to merge 2 commits into
Vero-protocol:mainfrom
samkay-ops:main
Open

fix(scanner): close fs::write(dir.join ruleset bypass#377
samkay-ops wants to merge 2 commits into
Vero-protocol:mainfrom
samkay-ops:main

Conversation

@samkay-ops

@samkay-ops samkay-ops commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

Summary

Fixes #344 — a substring check skipped any line containing fs::write(dir.join, so e.g. unsafe { ... } // fs::write(dir.join produced no finding.

Changes

  • Remove the line-level skip in scan_file
  • Exclude tests / test / __tests__ path segments in rust_source_files instead
  • Regression test: unsafe + magic substring still yields UNSAFE_BLOCK
  • Test: files under tests/ are not scanned

Acceptance criteria

  • Line with unsafe and fs::write(dir.join reports UNSAFE_BLOCK
  • Self-scan does not rely on the old line hack; test fixtures skipped by path

Closes #344

@samkay-ops
samkay-ops requested a review from N-thnI as a code owner August 25, 2026 20:26
@N-thnI

N-thnI commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

This branch now conflicts with main. Could you rebase onto the latest main and resolve the conflicts? Happy to merge once it's clean.

@N-i-xx

N-i-xx commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

One workflow note for future PRs: this one is raised from samkay-ops:main rather than a topic branch. Could you branch off main for each piece of work (e.g. git checkout -b fix/issue-NNN-short-description) and open the PR from that branch?

Working on your fork's main is what makes these conflict — once upstream main moves, your main has diverged and can't cleanly take the update, which is exactly what's happened here. A topic branch per issue keeps each PR independent and rebaseable, and keeps your fork's main clean to sync from upstream.

Your other PRs (#365, and the dashboard ones) already do this — just worth making it the default. Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@N-thnI N-thnI N-thnI approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Remove the fs::write(dir.join line-skip hack that lets any line evade every scanner rule

3 participants

@samkay-ops @N-thnI @N-i-xx