#!/usr/bin/env bash
# CWE-407 scan — sbt (Scala Build Tool)
# Scala/Java build tool; uses Ivy for dep resolution and has its own DAG execution
# Strategy: Scala/Java membership patterns in graph/dep/task context
set -euo pipefail
echo "# scan=sbt host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"

cd /tmp && git clone --depth 1 https://github.com/sbt/sbt sbt 2>&1 | tail -1

# O(n) membership patterns — Scala and Java
SCALA_MEM='\.contains\s*\(|\.indexOf\s*\(|\.find\s*\(_\s*==|\.exists\s*\(_\s*==|\bcontains\b'

# Loop/traversal constructs
SCALA_LOOP='for\s*\(|\.foreach\s*\(|\.foldLeft\s*\(|\.map\s*\(|while\s*\(|\.flatMap\s*\('

for dir in \
  main/src/main/scala \
  compile/src/main/scala \
  tasks/src/main/scala \
  librarymanagement; do
  [ -d /tmp/sbt/$dir ] || continue
  echo "# roots: /tmp/sbt/$dir"
  find /tmp/sbt/$dir -name "*.scala" -o -name "*.java" 2>/dev/null | sort | while IFS= read -r f; do
    ml=$(grep -nE "$SCALA_MEM" "$f" 2>/dev/null | cut -d: -f1 || true)
    [ -z "$ml" ] && continue
    while IFS= read -r ln; do
      s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
      ctx=$(sed -n "${s},${e}p" "$f" 2>/dev/null || true)
      graph_hit=$(echo "$ctx" | grep -iE 'graph|depend|topo|visit|cycle|dag|sort|stack|order|reachab|ancestor|transit|scc|task' | head -1 | sed 's/^\s*//' || true)
      [ -z "$graph_hit" ] && continue
      loop_hit=$(echo "$ctx" | grep -iE "$SCALA_LOOP" | head -1 | sed 's/^\s*//' || true)
      [ -n "$loop_hit" ] && {
        mem_line=$(sed -n "${ln}p" "$f" | sed 's/^\s*//')
        echo "CANDIDATE\t${f}:${ln}\t${mem_line}  [loop: ${loop_hit}]"
      }
    done <<< "$ml"
  done
done
echo "# scan complete"