engineering/java-topology
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

wave9 survey: 7 clean-scan additions (ghostpdl, helix, alacritty, wezterm, kakoune, poppler, libheif)

Browse source 
10 image/PDF/DB/editor targets scanned. Honor roll cumulative: 41 projects.
ghostpdl genuine clean (0 HIGH+ on 273M of code). Rust bitflags ecosystem
dominates terminal/editor false positives (.contains(Flag::X) compiles to
bitwise AND). tikv M1 cluster resolves to HashSet FPs and bounded raft
replication (3-5 peers). No flagship CWE-407 this pass.
This commit is contained in:
russell@unturf.com 2026-04-25 13:39:14 -04:00
parent 0010067761
commit 9f22ca077b
No known key found for this signature in database
1 changed files with 79 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

79
whitepaper/outreach/wave9-image-pdf-db-editors-survey.md Normal file
View file

@ -0,0 +1,79 @@
# Wave 9 — Image/PDF, Distributed DB, Terminals + Editors
**Survey date:** 2026-04-25
**Tool:** unmoad (9 active MOAD detectors, HIGH+ severity filter)
**Scope:** 10 projects across PDF/PostScript (ghostpdl, poppler), image processing (libvips, libheif), distributed key-value (tikv), terminal multiplexers + emulators (tmux, alacritty, wezterm), and modal editors (helix, kakoune).
---
## Summary
Wave 9 totals 663 HIGH+ findings across 10 projects. **Seven new clean-scan honor roll entries.** Honor roll cumulative: **41 projects** across waves 3-9.
**No flagship CWE-407 patches ship this pass.** The strongest M1 surface (tikv 115 hits) resolves to scanner false positives on `HashSet.contains`, `Range.contains`, and bounded raft-replication (3-5 peers) patterns. The Rust bitflags ecosystem dominates terminal/editor false positives — `bitflags::bitflags!` macro generates `.contains(Flag::X)` that compiles to a single `&` AND, not a linear scan.
## Clean-scan honor roll — 7 new entries
| Project | Lang | Role | Notes |
|---------|------|------|-------|
| **ghostpdl** | C | Ghostscript PostScript/PDF interpreter | Zero HIGH+ across 273M of code. The Postscript/PDF interpreter that built the entire pre-press industry. Genuine clean scan. |
| **helix** | Rust | Modal editor (Vim-inspired) | 76 findings dominated by `KeyModifiers::contains(KeyModifiers::SHIFT)` — `KeyModifiers` is `bitflags::bitflags!` macro, `.contains` compiles to bitwise AND. False positives. |
| **alacritty** | Rust | GPU-accelerated terminal | 52 findings, same `Flags::contains` bitflag pattern as helix. `cell.flags.contains(Flags::WRAPLINE)` is a bitwise AND, not a search. |
| **wezterm** | Rust | GPU-accelerated terminal multiplexer | 137 findings, same bitflag pattern. `top_and_bottom_margins.contains(&self.cursor.y)` is `Range.contains`, also O(1). |
| **kakoune** | C++ | Modal editor (selection-based) | 28 findings, all `std::find_if` on text iterators bounded by line length, not algorithmic. Tight C++ codebase. |
| **poppler** | C++ | PDF rendering library | 17 findings, all bounded: 1 `strcmp` on fixed `stamp_types[]` icon array, 1 `std::find_if` on text fragment list. |
| **libheif** | C++ | HEIF/HEIC image format | 13 findings, all in `scripts/cpplint.py` (Google's vendored C++ linter), `examples/`, `extra/getopt_long.c` (vendored), or `brands.cc` with bounded HEIF-spec brand list. |
Honor roll now stands at **41 projects** validated zero-real-finding under MOAD scanning.
## Per-target findings
| Project | Lang | Total | M1 | M3 | M4 | M5 | M6 | M7 | M9 | M11 | Triage |
|---------|------|------:|---:|---:|---:|---:|---:|---:|---:|----:|--------|
| **ghostpdl** | C | 0 | - | - | - | - | - | - | - | - | **clean** — zero HIGH+ on 273M of source |
| tikv | Rust | 236 | 115 | - | 4 | - | - | 111 | - | 6 | `index_lookup_executor.rs:1032` `rows.contains` is `HashSet<usize>`, NOT Vec — scanner FP. `peer.rs:1585` raft peer scan bounded by replication factor (3-5). |
| **wezterm** | Rust | 137 | 73 | - | 2 | - | - | 62 | - | - | bitflags FPs across `Modifiers::contains`, `Flags::contains`, `AuthMethods::contains` |
| **helix** | Rust | 76 | 40 | - | - | - | - | 35 | - | 1 | bitflags FPs across `KeyModifiers::contains`, `key_modifiers.contains` |
| libvips | C | 56 | 36 | 8 | 4 | - | - | 8 | - | - | `header.c` field-name lookup is bounded by image-format property count (typically 10-50). `package.c` plugin-table lookup is config-time. |
| **alacritty** | Rust | 52 | 23 | - | 1 | - | - | 28 | - | - | bitflags FPs (`cell.flags.contains(Flags::WRAPLINE)`, `KeyboardModes`, `Range.contains`) |
| tmux | C | 48 | 42 | - | - | - | - | 6 | - | - | All M1 are option-table/cmd-table strcmp scans with fixed compile-time table sizes. |
| **kakoune** | C++ | 28 | 12 | - | - | - | - | 16 | - | - | `std::find_if` on text iterator bounded by line length |
| **poppler** | C++ | 17 | 2 | - | 4 | - | 4 | 7 | - | - | 1 stamp_types strcmp + 1 text-fragment find_if. `M6 weak-hash` are MD5 in `Decrypt.cc` — PDF spec uses MD5 for legacy encryption (RFC-mandated). |
| **libheif** | C++ | 13 | 11 | - | - | - | - | 1 | - | 1 | cpplint vendored / examples / getopt_long vendored |
## Investigations that did not patch-ship
### tikv `index_lookup_executor.rs:1032` — false positive on HashSet
```rust
self.results[result_index]
.logical_rows
.retain(|&physical_row| rows.contains(&physical_row));
```
Looked like a real CWE-407 — outer `retain` over `logical_rows`, inner `rows.contains`. Inspected `left_rows: Vec<Option<HashSet<usize>>>` declaration at line 724 — `rows` is already `HashSet<usize>`, so `.contains` is O(1). NOT a defect; scanner does not yet model Rust HashSet vs Vec at the call site.
### libvips `header.c` field-name lookup
`vips_image_get_typeof` and friends scan a `GSList` of `VipsField` by name. Per-image typical N is 10-50 fields, called once per metadata access. Real but bounded constant.
### Bitflags macro pattern (helix, alacritty, wezterm)
The Rust `bitflags::bitflags!` macro generates a struct with a `.contains(other: Self) -> bool` method that compiles to `(self.bits & other.bits) == other.bits` — a single bitwise AND. The scanner's `vec-contains-in-loop` rule fires on the literal call shape but the underlying operation is O(1). **Detector enhancement candidate:** add type-context awareness for `bitflags::bitflags!` macro-generated types.
## Triage backlog
1. **Scanner enhancement: Rust HashSet/HashMap awareness** in M1 detector to suppress `Vec.contains` FPs at types like `HashSet<T>`, `BTreeSet<T>`, `RoaringTreemap`.
2. **Scanner enhancement: Rust bitflags awareness** — recognize `bitflags::bitflags!` macro-generated types and suppress `.contains(FlagX)` as bitwise AND, not linear scan. This single rule would suppress ~250 of Wave 9's 663 findings.
3. **tikv M7 cluster (111 hits)** — Flatland defect surface in distributed query execution. Worth a focused pass once we have benchmark scaffolding for distributed TiKV scenarios.
4. **libvips header.c** — re-scan if a real production case surfaces with images carrying 100+ fields (some scientific imaging workflows).
## Method
Same as Waves 3-8: shallow clone, `unmoad -s high -f json`, filter test/vendor/UI/macro-generated noise, manual triage of strongest source-only candidates per project. Seven projects added to clean-scan honor roll. No new UNDF IDs assigned (no patches shipped).
## References
- `unmoad` detection engine: `git.unturf.com/engineering/unmoad.com`
- Earlier surveys: `/test-harness-survey/`, `/wave4-linter-ci-survey/`, `/wave5-cicd-iac-survey/`, `/wave6-docgen-webfw-tui-survey/`, `/docs-pipeline-survey/`, `/wave7-mail-dns-storage-vpn-rtos-survey/`, `/wave8-observability-streaming-survey/`
- Clean-scan honor roll cumulative: 41 projects across waves 3-9