use schemars::JsonSchema;
use serde::{Deserialize, Serialize};
use std::path::{Path, PathBuf};
#[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
pub struct HardeningAnalysis {
pub root: PathBuf,
pub target: Option<PathBuf>,
pub files_scanned: usize,
pub findings: Vec<HardeningFinding>,
pub changes: Vec<HardeningFileChange>,
}
#[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
pub struct HardeningFinding {
pub id: String,
pub title: String,
pub description: String,
pub file: PathBuf,
pub line: usize,
pub strategy: HardeningStrategy,
pub patchable: bool,
}
#[derive(Debug, Clone, Serialize, Deserialize, JsonSchema, PartialEq, Eq)]
pub enum HardeningStrategy {
BorrowParameterTightening,
ErrorContextPropagation,
IteratorCloned,
MechanicalTier1Cleanup,
MustUsePublicReturn,
ResultUnwrapContext,
ProcessExecutionReview,
UnsafeReview,
EnvAccessReview,
FileIoReview,
HttpSurfaceReview,
}
#[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
pub struct HardeningFileChange {
pub file: PathBuf,
pub old_content: String,
pub new_content: String,
pub strategy: HardeningStrategy,
pub finding_ids: Vec<String>,
pub description: String,
}
#[derive(Debug, Clone, Copy)]
pub struct HardeningAnalyzeConfig<'a> {
pub target: Option<&'a Path>,
pub max_files: usize,
}
pub fn analyze_hardening(
root: &Path,
config: HardeningAnalyzeConfig<'_>,
) -> anyhow::Result<HardeningAnalysis> {
let files = collect_rust_files(root, config.target)?;
let mut findings = Vec::new();
let mut changes = Vec::new();
for file in files.iter().take(config.max_files) {
let content = std::fs::read_to_string(file)?;
let rel = relative_path(root, file);
let function_ranges = find_function_ranges(&content);
for (index, line) in content.lines().enumerate() {
let line_no = index + 1;
let pattern_line = line_without_comments_or_strings(line);
let trimmed = pattern_line.trim();
if trimmed.contains("Command::new(") || trimmed.contains("std::process::Command") {
findings.push(HardeningFinding {
id: format!("process-execution:{}:{line_no}", rel.display()),
title: "Process execution surface".to_string(),
description:
"External process execution should have explicit input validation or allowlisting."
.to_string(),
file: rel.clone(),
line: line_no,
strategy: HardeningStrategy::ProcessExecutionReview,
patchable: false,
});
}
if trimmed.contains("unsafe ") || trimmed == "unsafe" || trimmed.contains("unsafe{") {
findings.push(HardeningFinding {
id: format!("unsafe-rust:{}:{line_no}", rel.display()),
title: "Unsafe Rust requires review".to_string(),
description:
"Unsafe code should be isolated and documented before automated edits touch it."
.to_string(),
file: rel.clone(),
line: line_no,
strategy: HardeningStrategy::UnsafeReview,
patchable: false,
});
}
if trimmed.contains("std::env::var(") || trimmed.contains("env::var(") {
findings.push(HardeningFinding {
id: format!("env-access:{}:{line_no}", rel.display()),
title: "Environment variable access".to_string(),
description:
"Environment-derived configuration should return contextual errors at boundaries."
.to_string(),
file: rel.clone(),
line: line_no,
strategy: HardeningStrategy::EnvAccessReview,
patchable: false,
});
}
let filesystem_call = trimmed.contains("std::fs::read_to_string(")
|| trimmed.contains("fs::read_to_string(")
|| trimmed.contains("std::fs::write(")
|| trimmed.contains("fs::write(");
let has_visible_error_handling = trimmed.contains('?')
|| trimmed.contains(".unwrap(")
|| trimmed.contains(".expect(");
if filesystem_call && !has_visible_error_handling {
findings.push(HardeningFinding {
id: format!("file-io:{}:{line_no}", rel.display()),
title: "Filesystem boundary".to_string(),
description:
"Filesystem access should preserve contextual errors and validated paths."
.to_string(),
file: rel.clone(),
line: line_no,
strategy: HardeningStrategy::FileIoReview,
patchable: false,
});
}
if trimmed.contains("Router::new(")
|| trimmed.contains(".route(")
|| trimmed.contains("#[get(")
|| trimmed.contains("#[post(")
{
findings.push(HardeningFinding {
id: format!("http-surface:{}:{line_no}", rel.display()),
title: "HTTP or route surface".to_string(),
description:
"HTTP-facing surfaces should validate inputs and preserve typed errors."
.to_string(),
file: rel.clone(),
line: line_no,
strategy: HardeningStrategy::HttpSurfaceReview,
patchable: false,
});
}
}
if let Some(change) = build_tier1_mechanical_change(root, file, &content, &function_ranges)?
{
findings.extend(change.findings);
changes.push(change.change);
}
}
Ok(HardeningAnalysis {
root: root.to_path_buf(),
target: config.target.map(Path::to_path_buf),
files_scanned: files.len().min(config.max_files),
findings,
changes,
})
}
struct Tier1MechanicalChange {
change: HardeningFileChange,
findings: Vec<HardeningFinding>,
}
fn build_tier1_mechanical_change(
root: &Path,
file: &Path,
content: &str,
function_ranges: &[FunctionRange],
) -> anyhow::Result<Option<Tier1MechanicalChange>> {
let rel = relative_path(root, file);
let mut lines: Vec<String> = content.lines().map(ToString::to_string).collect();
let mut finding_ids = Vec::new();
let mut findings = Vec::new();
apply_result_context_recipe(
&rel,
&mut lines,
function_ranges,
&mut finding_ids,
&mut findings,
);
apply_error_context_recipe(
&rel,
&mut lines,
function_ranges,
&mut finding_ids,
&mut findings,
);
apply_borrow_parameter_recipe(
&rel,
&mut lines,
function_ranges,
&mut finding_ids,
&mut findings,
);
apply_borrowed_vec_literal_recipe(&rel, &mut lines, &mut finding_ids, &mut findings);
apply_iterator_cloned_recipe(&rel, &mut lines, &mut finding_ids, &mut findings);
apply_must_use_recipe(
&rel,
&mut lines,
function_ranges,
&mut finding_ids,
&mut findings,
);
if finding_ids.is_empty() {
return Ok(None);
}
let mut new_content = lines.join("\n");
if content.ends_with('\n') {
new_content.push('\n');
}
if findings.iter().any(|finding| {
matches!(
finding.strategy,
HardeningStrategy::ErrorContextPropagation | HardeningStrategy::ResultUnwrapContext
)
}) {
new_content = ensure_anyhow_context_import(&new_content);
}
if syn::parse_file(&new_content).is_err() {
return Ok(None);
}
Ok(Some(Tier1MechanicalChange {
change: HardeningFileChange {
file: rel,
old_content: content.to_string(),
new_content,
strategy: HardeningStrategy::MechanicalTier1Cleanup,
finding_ids,
description:
"Apply Tier 1 mechanical hardening recipes under compile and clippy validation."
.to_string(),
},
findings,
}))
}
fn apply_result_context_recipe(
rel: &Path,
lines: &mut [String],
function_ranges: &[FunctionRange],
finding_ids: &mut Vec<String>,
findings: &mut Vec<HardeningFinding>,
) {
for range in function_ranges {
if !range.returns_anyhow_result {
continue;
}
for line_index in range.start_line.saturating_sub(1)..range.end_line.min(lines.len()) {
let original = lines[line_index].clone();
if original.trim_start().starts_with("//") {
continue;
}
let mut rewritten = original.clone();
if rewritten.contains(".unwrap()") {
rewritten = rewritten.replace(
".unwrap()",
&format!(".context(\"{} failed instead of panicking\")?", range.name),
);
}
rewritten = replace_expect_calls(&rewritten);
if rewritten != original {
lines[line_index] = rewritten;
let line = line_index + 1;
let id = format!("unwrap-in-result:{}:{line}", rel.display());
finding_ids.push(id.clone());
findings.push(HardeningFinding {
id,
title: "Panic-prone unwrap in anyhow Result function".to_string(),
description: "Replace unwrap/expect with anyhow Context and ? so failure is reported instead of panicking.".to_string(),
file: rel.to_path_buf(),
line,
strategy: HardeningStrategy::ResultUnwrapContext,
patchable: true,
});
}
}
}
}
fn apply_error_context_recipe(
rel: &Path,
lines: &mut [String],
function_ranges: &[FunctionRange],
finding_ids: &mut Vec<String>,
findings: &mut Vec<HardeningFinding>,
) {
for range in function_ranges {
if !range.returns_anyhow_result {
continue;
}
for line_index in range.start_line.saturating_sub(1)..range.end_line.min(lines.len()) {
let original = lines[line_index].clone();
if original.trim_start().starts_with("//")
|| original.contains(".context(")
|| original.contains(".with_context(")
{
continue;
}
let pattern_line = line_without_comments_or_strings(&original);
let Some(boundary) = boundary_call_kind(&pattern_line) else {
continue;
};
if !pattern_line.contains('?') {
continue;
}
let Some(rewritten) = add_context_before_question_mark(
&original,
&format!("{} failed at {boundary} boundary", range.name),
) else {
continue;
};
if rewritten == original {
continue;
}
lines[line_index] = rewritten;
let line = line_index + 1;
let id = format!("error-context-propagation:{}:{line}", rel.display());
finding_ids.push(id.clone());
findings.push(HardeningFinding {
id,
title: "Propagate boundary errors with context".to_string(),
description: "Add anyhow Context to fallible boundary calls that already use ? so failures explain where they came from.".to_string(),
file: rel.to_path_buf(),
line,
strategy: HardeningStrategy::ErrorContextPropagation,
patchable: true,
});
}
}
}
fn boundary_call_kind(line: &str) -> Option<&'static str> {
if line.contains("std::fs::")
|| line.contains("fs::read")
|| line.contains("fs::write")
|| line.contains("File::open(")
{
Some("filesystem")
} else if line.contains("std::env::var(") || line.contains("env::var(") {
Some("environment")
} else {
None
}
}
fn add_context_before_question_mark(line: &str, message: &str) -> Option<String> {
let question = line.find('?')?;
let (before, after) = line.split_at(question);
Some(format!(
"{}.context(\"{}\"){}",
before,
escape_string(message),
after
))
}
fn apply_borrow_parameter_recipe(
rel: &Path,
lines: &mut [String],
function_ranges: &[FunctionRange],
finding_ids: &mut Vec<String>,
findings: &mut Vec<HardeningFinding>,
) {
for range in function_ranges {
if range.is_public {
continue;
}
let start = range.signature_start_line.saturating_sub(1);
let end = range.signature_end_line.min(lines.len());
let mut changed = false;
for line in &mut lines[start..end] {
let original = line.clone();
let tightened = tighten_borrow_parameters(&original);
if tightened != original {
*line = tightened;
changed = true;
}
}
if changed {
let id = format!(
"borrow-parameter-tightening:{}:{}",
rel.display(),
range.signature_start_line
);
finding_ids.push(id.clone());
findings.push(HardeningFinding {
id,
title: "Tighten private borrowed parameter type".to_string(),
description: "Prefer &str and slices over borrowed owned containers in private functions when compile gates prove the change.".to_string(),
file: rel.to_path_buf(),
line: range.signature_start_line,
strategy: HardeningStrategy::BorrowParameterTightening,
patchable: true,
});
}
}
}
fn apply_must_use_recipe(
rel: &Path,
lines: &mut Vec<String>,
function_ranges: &[FunctionRange],
finding_ids: &mut Vec<String>,
findings: &mut Vec<HardeningFinding>,
) {
let mut inserted = 0usize;
for range in function_ranges {
if !range.is_public || !range.returns_value || range.returns_common_must_use {
continue;
}
if has_nearby_must_use(lines, range.signature_start_line + inserted) {
continue;
}
let insert_at = range.signature_start_line.saturating_sub(1) + inserted;
let indent: String = lines
.get(insert_at)
.map(|line| line.chars().take_while(|ch| ch.is_whitespace()).collect())
.unwrap_or_default();
lines.insert(insert_at, format!("{indent}#[must_use]"));
inserted += 1;
let id = format!(
"must-use-public-return:{}:{}",
rel.display(),
range.signature_start_line
);
finding_ids.push(id.clone());
findings.push(HardeningFinding {
id,
title: "Public return value should be marked must_use".to_string(),
description: "Add #[must_use] to public value-returning functions so ignored results are visible to callers.".to_string(),
file: rel.to_path_buf(),
line: range.signature_start_line,
strategy: HardeningStrategy::MustUsePublicReturn,
patchable: true,
});
}
}
fn apply_iterator_cloned_recipe(
rel: &Path,
lines: &mut [String],
finding_ids: &mut Vec<String>,
findings: &mut Vec<HardeningFinding>,
) {
for (line_index, line) in lines.iter_mut().enumerate() {
if line.trim_start().starts_with("//") {
continue;
}
let original = line.clone();
let rewritten = replace_map_clone_calls(&original);
if rewritten == original {
continue;
}
*line = rewritten;
let line_no = line_index + 1;
let id = format!("iterator-cloned:{}:{line_no}", rel.display());
finding_ids.push(id.clone());
findings.push(HardeningFinding {
id,
title: "Simplify iterator clone collection".to_string(),
description: "Replace clone-mapping collection with a simpler form when compile gates prove the iterator item type.".to_string(),
file: rel.to_path_buf(),
line: line_no,
strategy: HardeningStrategy::IteratorCloned,
patchable: true,
});
}
}
fn apply_borrowed_vec_literal_recipe(
rel: &Path,
lines: &mut [String],
finding_ids: &mut Vec<String>,
findings: &mut Vec<HardeningFinding>,
) {
for (line_index, line) in lines.iter_mut().enumerate() {
if line.trim_start().starts_with("//") || !line.contains("&vec![") {
continue;
}
*line = line.replace("&vec![", "&[");
let line_no = line_index + 1;
let id = format!("borrowed-vec-literal:{}:{line_no}", rel.display());
finding_ids.push(id.clone());
findings.push(HardeningFinding {
id,
title: "Use a borrowed slice literal".to_string(),
description: "Replace &vec![..] with a borrowed slice literal when validation proves the callsite.".to_string(),
file: rel.to_path_buf(),
line: line_no,
strategy: HardeningStrategy::BorrowParameterTightening,
patchable: true,
});
}
}
fn replace_map_clone_calls(line: &str) -> String {
let mut output = String::new();
let mut rest = line;
while let Some(start) = rest.find(".map(|") {
let (before, after_start) = rest.split_at(start);
output.push_str(before);
let Some((variable, after_variable)) = after_start[".map(|".len()..].split_once('|') else {
output.push_str(after_start);
return output;
};
let variable = variable.trim();
if variable.is_empty()
|| !variable
.chars()
.all(|ch| ch.is_ascii_alphanumeric() || ch == '_')
{
output.push_str(after_start);
return output;
}
let expected = format!(" {}.clone())", variable);
let trimmed_expected = format!("{}.clone())", variable);
if let Some(next) = after_variable.strip_prefix(&expected) {
rest = push_clone_replacement(&mut output, next);
} else if let Some(next) = after_variable.strip_prefix(&trimmed_expected) {
rest = push_clone_replacement(&mut output, next);
} else {
output.push_str(".map(|");
rest = &after_start[".map(|".len()..];
}
}
output.push_str(rest);
output
}
fn push_clone_replacement<'a>(output: &mut String, next: &'a str) -> &'a str {
if next.starts_with(".collect()") && output.ends_with(".iter()") {
output.truncate(output.len() - ".iter()".len());
output.push_str(".to_vec()");
&next[".collect()".len()..]
} else {
output.push_str(".cloned()");
next
}
}
fn tighten_borrow_parameters(line: &str) -> String {
replace_borrowed_vec(&line.replace("&String", "&str"))
}
fn replace_borrowed_vec(line: &str) -> String {
let mut output = String::new();
let mut index = 0usize;
while let Some(relative_start) = line[index..].find("&Vec<") {
let start = index + relative_start;
output.push_str(&line[index..start]);
let generic_start = start + "&Vec<".len();
let Some(generic_end) = matching_angle_end(line, generic_start) else {
output.push_str(&line[start..]);
return output;
};
output.push_str("&[");
output.push_str(&line[generic_start..generic_end]);
output.push(']');
index = generic_end + 1;
}
output.push_str(&line[index..]);
output
}
fn matching_angle_end(value: &str, start: usize) -> Option<usize> {
let mut depth = 1isize;
for (offset, ch) in value[start..].char_indices() {
match ch {
'<' => depth += 1,
'>' => {
depth -= 1;
if depth == 0 {
return Some(start + offset);
}
}
_ => {}
}
}
None
}
fn has_nearby_must_use(lines: &[String], signature_line: usize) -> bool {
let signature_index = signature_line.saturating_sub(1);
let start = signature_index.saturating_sub(4);
lines[start..signature_index.min(lines.len())]
.iter()
.any(|line| line.contains("must_use"))
}
fn replace_expect_calls(line: &str) -> String {
let mut output = String::new();
let mut rest = line;
while let Some(start) = rest.find(".expect(\"") {
let (before, after_start) = rest.split_at(start);
output.push_str(before);
let msg_start = ".expect(\"".len();
let after_msg_start = &after_start[msg_start..];
if let Some(end) = after_msg_start.find("\")") {
let message = &after_msg_start[..end];
output.push_str(&format!(".context(\"{}\")?", escape_string(message)));
rest = &after_msg_start[end + 2..];
} else {
output.push_str(after_start);
rest = "";
}
}
output.push_str(rest);
output
}
fn escape_string(value: &str) -> String {
value.replace('\\', "\\\\").replace('"', "\\\"")
}
fn line_without_comments_or_strings(line: &str) -> String {
let mut output = String::with_capacity(line.len());
let mut chars = line.chars().peekable();
let mut in_string = false;
let mut escaped = false;
while let Some(ch) = chars.next() {
if !in_string && ch == '/' && chars.peek() == Some(&'/') {
break;
}
if ch == '"' && !escaped {
in_string = !in_string;
output.push(' ');
continue;
}
if in_string {
escaped = ch == '\\' && !escaped;
output.push(' ');
continue;
}
escaped = false;
output.push(ch);
}
output
}
fn ensure_anyhow_context_import(content: &str) -> String {
if content.contains("anyhow::Context") || content.contains("Context,") {
return content.to_string();
}
let mut lines: Vec<&str> = content.lines().collect();
let insert_at = lines
.iter()
.position(|line| !line.starts_with("#![") && !line.trim().is_empty())
.unwrap_or(0);
lines.insert(insert_at, "use anyhow::Context;");
let mut result = lines.join("\n");
if content.ends_with('\n') {
result.push('\n');
}
result
}
#[derive(Debug)]
struct FunctionRange {
name: String,
start_line: usize,
end_line: usize,
signature_start_line: usize,
signature_end_line: usize,
is_public: bool,
returns_anyhow_result: bool,
returns_value: bool,
returns_common_must_use: bool,
}
fn find_function_ranges(content: &str) -> Vec<FunctionRange> {
let lines: Vec<&str> = content.lines().collect();
let has_anyhow_result_alias =
content.contains("use anyhow::Result") || content.contains("use anyhow::{Result");
let mut ranges = Vec::new();
let mut index = 0;
while index < lines.len() {
let line = lines[index];
if !line.contains("fn ") {
index += 1;
continue;
}
let mut signature = line.to_string();
let start_line = index + 1;
let mut open_line = index;
while !signature.contains('{') && open_line + 1 < lines.len() {
open_line += 1;
signature.push(' ');
signature.push_str(lines[open_line]);
}
if !signature.contains('{') {
index += 1;
continue;
}
let Some(name) = function_name(&signature) else {
index += 1;
continue;
};
let mut depth = 0isize;
let mut end_line = open_line + 1;
for (body_index, body_line) in lines.iter().enumerate().skip(open_line) {
depth += body_line.matches('{').count() as isize;
depth -= body_line.matches('}').count() as isize;
end_line = body_index + 1;
if depth == 0 {
break;
}
}
let return_text = signature
.split_once("->")
.map(|(_, rest)| rest.split('{').next().unwrap_or_default().trim())
.unwrap_or_default();
let returns_anyhow_result = return_text.starts_with("anyhow::Result")
|| (has_anyhow_result_alias && return_text.starts_with("Result<"));
let returns_value = !return_text.is_empty() && return_text != "()";
let returns_common_must_use = return_text.starts_with("Result<")
|| return_text.starts_with("anyhow::Result")
|| return_text.starts_with("Option<")
|| signature.contains("async fn ");
ranges.push(FunctionRange {
name,
start_line,
end_line,
signature_start_line: start_line,
signature_end_line: open_line + 1,
is_public: signature.trim_start().starts_with("pub "),
returns_anyhow_result,
returns_value,
returns_common_must_use,
});
index = end_line;
}
ranges
}
fn function_name(signature: &str) -> Option<String> {
let rest = signature.split_once("fn ")?.1;
let name = rest
.split(|c: char| !(c.is_alphanumeric() || c == '_'))
.next()?;
if name.is_empty() {
None
} else {
Some(name.to_string())
}
}
fn collect_rust_files(root: &Path, target: Option<&Path>) -> anyhow::Result<Vec<PathBuf>> {
let scan_root = target
.map(|path| {
if path.is_absolute() {
path.to_path_buf()
} else {
root.join(path)
}
})
.unwrap_or_else(|| root.to_path_buf());
if !scan_root.starts_with(root) {
anyhow::bail!("hardening target is outside root: {}", scan_root.display());
}
if scan_root.is_file() {
return Ok(if scan_root.extension().is_some_and(|ext| ext == "rs") {
vec![scan_root]
} else {
Vec::new()
});
}
let mut files = Vec::new();
for result in ignore::WalkBuilder::new(scan_root)
.hidden(false)
.filter_entry(|entry| {
let name = entry.file_name().to_string_lossy();
!matches!(
name.as_ref(),
"target" | ".git" | ".worktrees" | ".mdx-rust"
)
})
.build()
{
let entry = result?;
let path = entry.path();
if path.is_file() && path.extension().is_some_and(|ext| ext == "rs") {
files.push(path.to_path_buf());
}
}
files.sort();
Ok(files)
}
fn relative_path(root: &Path, path: &Path) -> PathBuf {
path.strip_prefix(root).unwrap_or(path).to_path_buf()
}
#[cfg(test)]
mod tests {
use super::*;
use tempfile::tempdir;
#[test]
fn hardening_rewrites_unwrap_in_anyhow_result_function() {
let dir = tempdir().unwrap();
let src = dir.path().join("src");
std::fs::create_dir_all(&src).unwrap();
std::fs::write(
src.join("lib.rs"),
r#"pub fn load() -> anyhow::Result<String> {
let value = std::fs::read_to_string("config.toml").unwrap();
Ok(value)
}
"#,
)
.unwrap();
let analysis = analyze_hardening(
dir.path(),
HardeningAnalyzeConfig {
target: None,
max_files: 10,
},
)
.unwrap();
assert_eq!(analysis.changes.len(), 1);
let change = &analysis.changes[0];
assert!(change.new_content.contains("use anyhow::Context;"));
assert!(change
.new_content
.contains(".context(\"load failed instead of panicking\")?"));
assert!(syn::parse_file(&change.new_content).is_ok());
}
#[test]
fn hardening_adds_context_to_question_mark_boundaries() {
let dir = tempdir().unwrap();
let src = dir.path().join("src");
std::fs::create_dir_all(&src).unwrap();
std::fs::write(
src.join("lib.rs"),
r#"pub fn load(path: &str) -> anyhow::Result<String> {
let value = std::fs::read_to_string(path)?;
Ok(value)
}
"#,
)
.unwrap();
let analysis = analyze_hardening(
dir.path(),
HardeningAnalyzeConfig {
target: None,
max_files: 10,
},
)
.unwrap();
assert_eq!(analysis.changes.len(), 1);
let change = &analysis.changes[0];
assert!(change.new_content.contains("use anyhow::Context;"));
assert!(change
.new_content
.contains(".context(\"load failed at filesystem boundary\")?"));
assert!(change
.finding_ids
.iter()
.any(|id| id.contains("error-context-propagation")));
assert!(syn::parse_file(&change.new_content).is_ok());
}
#[test]
fn hardening_does_not_rewrite_plain_result_without_anyhow_alias() {
let dir = tempdir().unwrap();
let src = dir.path().join("src");
std::fs::create_dir_all(&src).unwrap();
std::fs::write(
src.join("lib.rs"),
r#"pub fn load() -> Result<String, std::io::Error> {
let value = std::fs::read_to_string("config.toml").unwrap();
Ok(value)
}
"#,
)
.unwrap();
let analysis = analyze_hardening(
dir.path(),
HardeningAnalyzeConfig {
target: None,
max_files: 10,
},
)
.unwrap();
assert!(analysis.changes.is_empty());
}
#[test]
fn hardening_tightens_private_borrowed_owned_parameters() {
let dir = tempdir().unwrap();
let src = dir.path().join("src");
std::fs::create_dir_all(&src).unwrap();
std::fs::write(
src.join("lib.rs"),
r#"fn score(name: &String, values: &Vec<u8>) -> usize {
name.len() + values.len()
}
"#,
)
.unwrap();
let analysis = analyze_hardening(
dir.path(),
HardeningAnalyzeConfig {
target: None,
max_files: 10,
},
)
.unwrap();
assert_eq!(analysis.changes.len(), 1);
let change = &analysis.changes[0];
assert!(change
.new_content
.contains("fn score(name: &str, values: &[u8])"));
assert!(change
.finding_ids
.iter()
.any(|id| id.contains("borrow-parameter-tightening")));
assert!(syn::parse_file(&change.new_content).is_ok());
}
#[test]
fn hardening_marks_public_value_returns_must_use() {
let dir = tempdir().unwrap();
let src = dir.path().join("src");
std::fs::create_dir_all(&src).unwrap();
std::fs::write(
src.join("lib.rs"),
r#"pub fn total(values: &[u8]) -> usize {
values.iter().map(|value| *value as usize).sum()
}
"#,
)
.unwrap();
let analysis = analyze_hardening(
dir.path(),
HardeningAnalyzeConfig {
target: None,
max_files: 10,
},
)
.unwrap();
assert_eq!(analysis.changes.len(), 1);
let change = &analysis.changes[0];
assert!(change.new_content.contains("#[must_use]\npub fn total"));
assert!(change
.finding_ids
.iter()
.any(|id| id.contains("must-use-public-return")));
assert!(syn::parse_file(&change.new_content).is_ok());
}
#[test]
fn hardening_replaces_map_clone_collect_with_to_vec() {
let dir = tempdir().unwrap();
let src = dir.path().join("src");
std::fs::create_dir_all(&src).unwrap();
std::fs::write(
src.join("lib.rs"),
r#"pub fn copy_values(values: &[String]) -> Vec<String> {
values.iter().map(|value| value.clone()).collect()
}
"#,
)
.unwrap();
let analysis = analyze_hardening(
dir.path(),
HardeningAnalyzeConfig {
target: None,
max_files: 10,
},
)
.unwrap();
assert_eq!(analysis.changes.len(), 1);
let change = &analysis.changes[0];
assert!(change.new_content.contains("values.to_vec()"));
assert!(change
.finding_ids
.iter()
.any(|id| id.contains("iterator-cloned")));
assert!(syn::parse_file(&change.new_content).is_ok());
}
#[test]
fn hardening_does_not_flag_patterns_inside_strings_or_comments() {
let dir = tempdir().unwrap();
let src = dir.path().join("src");
std::fs::create_dir_all(&src).unwrap();
std::fs::write(
src.join("lib.rs"),
r#"fn describe() -> &'static str {
// Command::new("ignored")
"unsafe std::process::Command env::var("
}
"#,
)
.unwrap();
let analysis = analyze_hardening(
dir.path(),
HardeningAnalyzeConfig {
target: None,
max_files: 10,
},
)
.unwrap();
assert!(analysis.findings.is_empty(), "{:?}", analysis.findings);
}
}