russell@unturf.com
db29a08762
B&W print-friendly diagrams + tinkerpop-0001 + wave-3 proof sections. Squash of 94 local commits onto remote master.
94 lines
2.8 KiB
Bash
94 lines
2.8 KiB
Bash
#!/usr/bin/env bash
|
|
# Submit CWE-407 scan to all 43 unsandbox language sandboxes in parallel.
|
|
# Results land in tools/scan-results/<lang>.txt
|
|
#
|
|
# Usage: bash tools/run-unsandbox-scan.sh [lang...]
|
|
# No args = all 43 languages
|
|
# With args = only those languages (e.g. bash ... haskell ocaml ruby)
|
|
set -euo pipefail
|
|
|
|
UN=~/git/un-inception/build/un
|
|
SCAN_SCRIPT="$(cd "$(dirname "$0")" && pwd)/unsandbox-scan.sh"
|
|
RESULTS_DIR="$(cd "$(dirname "$0")" && pwd)/scan-results"
|
|
mkdir -p "$RESULTS_DIR"
|
|
|
|
export UNSANDBOX_PUBLIC_KEY=unsb-pk-russ-test-isth-best
|
|
export UNSANDBOX_SECRET_KEY=unsb-sk-rk46c-3zvpg-zjf6z-hjrge
|
|
|
|
ALL_LANGS=(
|
|
python javascript typescript ruby perl php lua bash
|
|
r elixir erlang tcl scheme powershell clojure commonlisp
|
|
crystal groovy deno awk raku c cpp go rust java kotlin
|
|
cobol fortran d zig nim v objc dart julia haskell ocaml
|
|
fsharp csharp dotnet prolog forth
|
|
)
|
|
|
|
LANGS=("${@:-${ALL_LANGS[@]}}")
|
|
|
|
echo "Submitting scan to ${#LANGS[@]} sandboxes..."
|
|
echo ""
|
|
|
|
run_scan() {
|
|
local lang="$1"
|
|
local out="$RESULTS_DIR/${lang}.txt"
|
|
local tmpscript="/tmp/cwe407-scan-${lang}.sh"
|
|
|
|
# Inject language name and write self-contained script
|
|
{ echo "#!/usr/bin/env bash"
|
|
echo "LANG=${lang}"
|
|
tail -n +2 "$SCAN_SCRIPT"
|
|
} > "$tmpscript"
|
|
chmod +x "$tmpscript"
|
|
|
|
printf " [%-12s] submitting...\n" "$lang"
|
|
local exit_code=0
|
|
"$UN" "$tmpscript" > "$out" 2>&1 || exit_code=$?
|
|
if [ $exit_code -eq 0 ] || grep -q "^CANDIDATE\|^# scan complete" "$out" 2>/dev/null; then
|
|
local hits
|
|
hits=$(grep -c "^CANDIDATE" "$out" 2>/dev/null || true)
|
|
hits=${hits:-0}
|
|
printf " [%-12s] done — %s candidates\n" "$lang" "$hits"
|
|
else
|
|
printf " [%-12s] ERROR: $(tail -1 "$out")\n" "$lang"
|
|
fi
|
|
rm -f "$tmpscript"
|
|
}
|
|
|
|
export -f run_scan
|
|
export UN SCAN_SCRIPT RESULTS_DIR
|
|
|
|
# Run with concurrency limit — default 2 for tier 5, override with CONCURRENCY env var
|
|
MAX=${CONCURRENCY:-2}
|
|
pids=()
|
|
for lang in "${LANGS[@]}"; do
|
|
run_scan "$lang" &
|
|
pids+=($!)
|
|
if (( ${#pids[@]} >= MAX )); then
|
|
wait "${pids[0]}"
|
|
pids=("${pids[@]:1}")
|
|
fi
|
|
sleep 1 # stagger submissions to avoid burst rejection
|
|
done
|
|
wait
|
|
|
|
echo ""
|
|
echo "=== RESULTS SUMMARY ==="
|
|
echo ""
|
|
total_candidates=0
|
|
for lang in "${LANGS[@]}"; do
|
|
out="$RESULTS_DIR/${lang}.txt"
|
|
if [ -f "$out" ]; then
|
|
hits=$(grep -c "^CANDIDATE" "$out" 2>/dev/null || echo 0)
|
|
roots=$(grep "^# roots:" "$out" | sed 's/# roots://' | tr ' ' '\n' | grep -v '^$' | wc -l || echo 0)
|
|
if [ "$hits" -gt 0 ]; then
|
|
printf " %-14s %2d candidates (roots: %d)\n" "$lang" "$hits" "$roots"
|
|
grep "^CANDIDATE" "$out" | head -3 | sed 's/^/ /'
|
|
else
|
|
printf " %-14s CLEAN (roots: %d)\n" "$lang" "$roots"
|
|
fi
|
|
total_candidates=$(( total_candidates + hits ))
|
|
fi
|
|
done
|
|
echo ""
|
|
echo "Total candidates: $total_candidates"
|
|
echo "Results in: $RESULTS_DIR/"
|