russell@unturf.com
db29a08762
B&W print-friendly diagrams + tinkerpop-0001 + wave-3 proof sections. Squash of 94 local commits onto remote master.
25 lines
1.3 KiB
Bash
Executable file
25 lines
1.3 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# CWE-407 scan — Bazel build system (dependency graph, SkyFrame, action graph)
|
|
set -euo pipefail
|
|
echo "# scan=bazel host=$(hostname) date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
|
cd /tmp && git clone --depth 1 https://github.com/bazelbuild/bazel bazel 2>&1 | tail -1
|
|
|
|
GRAPH_KW="topolog|cycle|dfs\b|scc\b|strongly.connected|reachab|dependency|tarjan|postorder|graph"
|
|
JAVA_MEM='ArrayList.*contains|List.*contains|\.indexOf[(]|LinkedList.*contains|new ArrayList.*visited|new ArrayList.*stack|ImmutableList.*contains'
|
|
|
|
for dir in src/main/java/com/google/devtools/build/lib/graph \
|
|
src/main/java/com/google/devtools/build/lib/skyframe \
|
|
src/main/java/com/google/devtools/build/lib/packages; do
|
|
[ -d /tmp/bazel/$dir ] || continue
|
|
echo "# roots: /tmp/bazel/$dir"
|
|
find /tmp/bazel/$dir -name "*.java" 2>/dev/null | sort | while IFS= read -r f; do
|
|
gl=$(grep -inE "$GRAPH_KW" "$f" 2>/dev/null | cut -d: -f1 | head -5 || true)
|
|
[ -z "$gl" ] && continue
|
|
while IFS= read -r ln; do
|
|
s=$(( ln > 20 ? ln - 20 : 1 )); e=$(( ln + 20 ))
|
|
hit=$(sed -n "${s},${e}p" "$f" 2>/dev/null | grep -iE "$JAVA_MEM" | head -1 | sed 's/^\s*//' || true)
|
|
[ -n "$hit" ] && echo "CANDIDATE ${f}:${ln} ${hit}"
|
|
done <<< "$gl"
|
|
done
|
|
done
|
|
echo "# scan complete"
|