Decide "is this source crates.io" in one helper: CargoLock::entries uses a substring test that accepts index.crates.io.evil.example
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
研究方向
Start with CargoLock::entries in crates/socket-patch-core/src/formats/cargo/mod.rs (around L483) and add a failing unit test with the index.crates.io.evil.example and github.com/rust-lang/crates.io-index-fork lookalikes. Then read the other three sites: vendor/cargo.rs (L576), patch/redirect/mod.rs (L2451), vendor/cargo_manifest.rs (L78), plus the CRATES_IO_SOURCE const in redirect/upstream/cargo.rs. Done means one is_crates_io_source helper is called from all four sites, the local copies are gone, and the cargo lock and vendor cargo tests pass.
由索引模型根據 Issue 內容生成。
描述
[agent] Filed by the scheduled architecture audit (audit-core). Register: register.
Kind: bug (duplicated rule that drifted). Register ID: A55.
Problem
Whether a Cargo.lock source is crates.io is decided in four places, by three different rules:
| Site | Rule |
|---|---|
formats/cargo/mod.rs L483-L484 (CargoLock::entries) |
substring: source.contains("github.com/rust-lang/crates.io-index") || source.contains("index.crates.io") |
vendor/cargo.rs L576-L577 |
two exact strings |
patch/redirect/mod.rs L2451-L2461 |
normalized (case, registry+/sparse+, trailing /, .git) |
vendor/cargo_manifest.rs L78-L87 |
the [patch]-key variant |
There is also a CRATES_IO_SOURCE const in redirect/upstream/cargo.rs L25.```
Executed (a scratch copy at cbbbdb9): a lock entry with source = "sparse+https://index.crates.io.evil.example/" gets SourceKind::CratesIo and a Sha256Hex verifier from CargoLock::entries. Downstream, VEX discovery treats it as crates.io (vex/discover/mod.rs L2942).
Proposed change
Add one formats::cargo::is_crates_io_source(&str) -> bool next to is_registry_source. It uses the normalized rule from redirect/mod.rs, plus the [patch]-key spelling. Call it from all four sites, and delete the local copies and CRATES_IO_SOURCE.
Size
5 files, about −30/+20 lines.
Acceptance criteria
- A unit table test covers both canonical spellings, case and trailing-slash variants, and the
index.crates.io.evil.exampleandgithub.com/rust-lang/crates.io-index-forklookalikes (both rejected). - The cargo lock equivalence tests and vendor cargo tests pass.
- 主要語言
- Rust
- 星號
- 9
- 分支
- 2
- 平均合併
- 20 小時 47 分鐘
- 30 天內合併 PR
- 681
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 沒有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
SocketDev/socket-patch 的其他 Issue
-
agent:triaged arch-audit priority:p3 refactor
難度 2/5 1-3 小時 新手友好度 83/100
SocketDev/socket-patch#1860 ·
維護者通常 1 天內回覆
-
agent:triaged arch-audit priority:p3 refactor
難度 2/5 1-3 小時 新手友好度 78/100
SocketDev/socket-patch#1838 ·
維護者通常 1 天內回覆
-
arch-audit refactor
難度 4/5 3-5 天 新手友好度 54/100
SocketDev/socket-patch#1993 ·
維護者通常 1 天內回覆
-
arch-audit refactor
難度 3/5 1-2 天 新手友好度 66/100
SocketDev/socket-patch#1992 ·
維護者通常 1 天內回覆
-
agent:triaged arch-audit priority:p3 refactor
難度 4/5 3-5 天 新手友好度 35/100
SocketDev/socket-patch#1987 · 1 則留言 ·
維護者通常 1 天內回覆
查看 SocketDev/socket-patch 的全部 Issue
相似的 Issue
-
難度 1/5 1 小時以內 新手友好度 82/100
saltnpepper97/halley#271 ·
維護者通常 1 天內回覆
-
Remove the unused gh-aw agentic workflow setup可能已有人在做 @AviAvni 今天認領。 未關閉
難度 2/5 1-3 小時 新手友好度 76/100
維護者通常 3 天內回覆
-
bug stdlib
難度 2/5 1-3 小時 新手友好度 72/100
維護者通常 1 天內回覆
-
enhancement good first issue
難度 1/5 1-3 小時 新手友好度 83/100
Sh1n1230/PunctuationToggle#308 ·
維護者通常 1 天內回覆
-
Perl - Readme Drift可能已有人在做 @Omnideth 今天認領。 未關閉
難度 2/5 1-3 小時 新手友好度 76/100
CommunityToolkit/Aspire#2375 ·
維護者通常 2 天內回覆