Widen check_report_local_paths to the shapes a real-output scan found it missing - #119
Merged
Merged
Conversation
… it missing A scan of report output found 122 cells across four ALEAPP modules publishing the tool's staging path while this check reported clean. Three gaps, each pinned by a test that fails on the previous checker and passes now: - unique_files(context) was not a taint source, so a loop over it was untainted. - or, and, and conditional expressions dropped the taint. Tuple unpacking in for and assignment, +=, := and subscript stores were not propagated either. - Taint stopped at a function boundary. A module-level helper that returns a staged path, or records carrying one, is now a source for its callers, tracked by tuple position so a record's other fields stay untainted. Precision kept in step: a database row unpacked from a record whose path position is unknown is tracked but never reported, a comprehension is judged by its element, replace(x.data_folder, ...) counts as a reduction, a slice of a path is a piece of it, and a name-hinted list that never reaches the report is not a row list. Zero findings on every core's merged tree; all previously caught shapes still caught. Byte identical with the other four cores. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Widens
check_report_local_paths.pyto the shapes a scan of real report output found it missing: 122 cells across four ALEAPP modules were publishing the tool's staging path while the check reported clean.unique_files(context)is now a taint source.or,and, conditional expressions, tuple unpacking,+=,:=and subscript stores propagate the taint.Precision is kept in step so correct code stays silent: a database row unpacked from a record is not a path, a comprehension is judged by its element,
replace(x.data_folder, ...)is a reduction, a slice is a piece, and a name-hinted list that never reaches the report is not a row list. Zero findings on this core's merged tree; every previously caught shape still caught; fourteen new pinned tests, nine of which fail on the previous checker. Byte identical with the other four cores.🤖 Generated with Claude Code