cargo-allow 0.1.10

Source-tree exception ledger and policy scanner for Rust repositories.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111

use super::check_failed_for_outcomes;
use allow_core::{
    AllowConfig, Finding, FindingKind, LaneConfig, LaneEnforcementMode, MatchOutcome, MatchStatus,
};
use allow_match::CheckMode;
use std::collections::BTreeMap;
use std::path::PathBuf;

#[test]
fn shadow_lane_does_not_fail_no_new_on_new_findings() {
    let mut lanes = BTreeMap::new();
    lanes.insert(
        "unsafe".to_string(),
        LaneConfig {
            mode: LaneEnforcementMode::Shadow,
        },
    );
    let cfg = AllowConfig {
        lanes,
        ..AllowConfig::empty()
    };
    let findings = vec![unsafe_finding()];
    let outcomes = vec![MatchOutcome {
        status: MatchStatus::New,
        allow_id: None,
        finding_index: Some(0),
        message: "unreceipted unsafe".to_string(),
        score: 0,
    }];

    assert!(!check_failed_for_outcomes(
        &outcomes,
        &findings,
        &cfg,
        CheckMode::NoNew
    ));
}

#[test]
fn blocking_lane_still_fails_no_new_on_new_findings() {
    let cfg = AllowConfig::empty();
    let findings = vec![panic_finding()];
    let outcomes = vec![MatchOutcome {
        status: MatchStatus::New,
        allow_id: None,
        finding_index: Some(0),
        message: "unreceipted panic".to_string(),
        score: 0,
    }];

    assert!(check_failed_for_outcomes(
        &outcomes,
        &findings,
        &cfg,
        CheckMode::NoNew
    ));
}

#[test]
fn unresolved_outcome_does_not_inherit_policy_exception_shadow_lane() {
    let mut lanes = BTreeMap::new();
    lanes.insert(
        "policy_exception".to_string(),
        LaneConfig {
            mode: LaneEnforcementMode::Shadow,
        },
    );
    let cfg = AllowConfig {
        lanes,
        ..AllowConfig::empty()
    };
    let findings = vec![panic_finding()];
    let outcomes = vec![MatchOutcome {
        status: MatchStatus::New,
        allow_id: Some("allow-deleted".to_string()),
        finding_index: Some(99),
        message: "unreceipted panic with stale outcome links".to_string(),
        score: 0,
    }];

    assert!(check_failed_for_outcomes(
        &outcomes,
        &findings,
        &cfg,
        CheckMode::NoNew
    ));
}

fn panic_finding() -> Finding {
    Finding {
        kind: FindingKind::Panic,
        family: Some("unwrap".to_string()),
        path: PathBuf::from("src/lib.rs"),
        span: None,
        identity: allow_core::StructuralIdentity::new("rust", "method_call"),
        message: "unwrap".to_string(),
        ledger: None,
    }
}

fn unsafe_finding() -> Finding {
    Finding {
        kind: FindingKind::Unsafe,
        family: Some("unsafe_block".to_string()),
        path: PathBuf::from("src/lib.rs"),
        span: None,
        identity: allow_core::StructuralIdentity::new("rust", "unsafe_block"),
        message: "unsafe".to_string(),
        ledger: None,
    }
}