#!/usr/bin/env bash
# CWE-407 scan — GNU Octave (graph toolbox, sparse, dep resolver)
set -euo pipefail
echo "# scan=gnu-octave host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
cd /tmp && git clone --depth 1 https://github.com/gnu-octave/octave octave 2>&1 | tail -1

GRAPH_KW="topolog|cycle|dfs\b|scc\b|strongly.connected|reachab|tarjan|graph|shortest.path|spanning"
C_MEM='std::find[(]|\.count[(].*==|find.*begin.*end|linear_search|vector.*find|std::list.*find'
M_MEM='ismember\b|find(.*==.*)\b|any(.*==.*)\b'

# C++ sources
for dir in liboctave/util liboctave/array scripts/graph; do
  [ -d /tmp/octave/$dir ] || continue
  echo "# roots: /tmp/octave/$dir"
  find /tmp/octave/$dir -name "*.cc" -o -name "*.h" 2>/dev/null | sort | while IFS= read -r f; do
    gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
    [ -z "$gl" ] && continue
    while IFS= read -r ln; do
      s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
      hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$C_MEM" | head -1 | sed 's/^\s*//' || true)
      [ -n "$hit" ] && echo "CANDIDATE	${f}:${ln}	${hit}"
    done <<< "$gl"
  done
done

# .m scripts
for dir in scripts scripts/graph; do
  [ -d /tmp/octave/$dir ] || continue
  find /tmp/octave/$dir -name "*.m" 2>/dev/null | sort | while IFS= read -r f; do
    gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
    [ -z "$gl" ] && continue
    while IFS= read -r ln; do
      s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
      hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$M_MEM" | head -1 | sed 's/^\s*//' || true)
      [ -n "$hit" ] && echo "CANDIDATE	${f}:${ln}	${hit}"
    done <<< "$gl"
  done
done
echo "# scan complete"