repotoire 0.7.0

Graph-powered code analysis CLI. 110 detectors for security, architecture, bus factor, and code quality.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123

use crate::detectors::base::Detector;
use crate::models::{deterministic_finding_id, Finding, Severity};
use anyhow::Result;
use std::path::PathBuf;
use tracing::info;

use super::{is_test_context, SAFETY_COMMENT, UNSAFE_BLOCK};

pub struct UnsafeWithoutSafetyCommentDetector {
    #[allow(dead_code)] // Part of detector pattern, used for file scanning
    repository_path: PathBuf,
    max_findings: usize,
}

impl UnsafeWithoutSafetyCommentDetector {
    pub fn new(repository_path: impl Into<PathBuf>) -> Self {
        Self {
            repository_path: repository_path.into(),
            max_findings: 50,
        }
    }
}

impl Detector for UnsafeWithoutSafetyCommentDetector {
    fn name(&self) -> &'static str {
        "rust-unsafe-without-safety-comment"
    }

    fn description(&self) -> &'static str {
        "Detects unsafe blocks without SAFETY comments"
    }

    fn requires_graph(&self) -> bool {
        false
    }

    fn file_extensions(&self) -> &'static [&'static str] {
        &["rs"]
    }

    fn detect(
        &self,
        ctx: &crate::detectors::analysis_context::AnalysisContext,
    ) -> Result<Vec<Finding>> {
        let files = &ctx.as_file_provider();
        let mut findings = vec![];

        for path in files.files_with_extension("rs") {
            if findings.len() >= self.max_findings {
                break;
            }

            let Some(content) = files.content(path) else {
                continue;
            };
            let lines: Vec<&str> = content.lines().collect();

            for (i, line) in lines.iter().enumerate() {
                let prev_line = if i > 0 { Some(lines[i - 1]) } else { None };
                if crate::detectors::is_line_suppressed(line, prev_line) {
                    continue;
                }

                if !UNSAFE_BLOCK.is_match(line) {
                    continue;
                }

                // Skip string literals
                let trimmed = line.trim();
                if trimmed.starts_with('"')
                    || trimmed.starts_with("r#\"")
                    || trimmed.starts_with("r\"")
                    || trimmed.starts_with('\'')
                    || trimmed.ends_with("\\n\\")
                    || trimmed.ends_with("\\")
                {
                    continue;
                }
                if is_test_context(line, &content, i) {
                    continue;
                }

                let has_safety = (i.saturating_sub(3)..i)
                    .any(|j| lines.get(j).is_some_and(|l| SAFETY_COMMENT.is_match(l)));
                let has_inline_safety = SAFETY_COMMENT.is_match(line);

                if !has_safety && !has_inline_safety {
                    let file_str = path.to_string_lossy();
                    let line_num = (i + 1) as u32;

                    findings.push(Finding {
                        id: deterministic_finding_id("UnsafeWithoutSafetyCommentDetector", &file_str, line_num, "unsafe without SAFETY comment"),
                        detector: "UnsafeWithoutSafetyCommentDetector".to_string(),
                        severity: Severity::High,
                        title: "unsafe block without SAFETY comment".to_string(),
                        description: "Unsafe blocks should document why they're safe. Add a `// SAFETY:` comment.".to_string(),
                        affected_files: vec![path.to_path_buf()],
                        line_start: Some(line_num),
                        line_end: Some(line_num),
                        suggested_fix: Some("Add a SAFETY comment:\n```rust\n// SAFETY: [explain invariants]\nunsafe { ... }\n```".to_string()),
                        estimated_effort: Some("15 minutes".to_string()),
                        category: Some("safety".to_string()),
                        cwe_id: Some("CWE-119".to_string()),
                        why_it_matters: Some("Unsafe code bypasses Rust's safety guarantees. SAFETY comments are essential for code review.".to_string()),
                        ..Default::default()
                    });
                }
            }
        }

        info!(
            "UnsafeWithoutSafetyCommentDetector found {} findings",
            findings.len()
        );
        Ok(findings)
    }
}

impl super::super::RegisteredDetector for UnsafeWithoutSafetyCommentDetector {
    fn create(init: &super::super::DetectorInit) -> std::sync::Arc<dyn Detector> {
        std::sync::Arc::new(Self::new(init.repo_path))
    }
}