Decide "is this source crates.io" in one helper: CargoLock::entries uses a substring test that accepts index.crates.io.evil.example
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
Start with CargoLock::entries in crates/socket-patch-core/src/formats/cargo/mod.rs (around L483) and add a failing unit test with the index.crates.io.evil.example and github.com/rust-lang/crates.io-index-fork lookalikes. Then read the other three sites: vendor/cargo.rs (L576), patch/redirect/mod.rs (L2451), vendor/cargo_manifest.rs (L78), plus the CRATES_IO_SOURCE const in redirect/upstream/cargo.rs. Done means one is_crates_io_source helper is called from all four sites, the local copies are gone, and the cargo lock and vendor cargo tests pass.
由索引模型根据 Issue 内容生成。
描述
[agent] Filed by the scheduled architecture audit (audit-core). Register: register.
Kind: bug (duplicated rule that drifted). Register ID: A55.
Problem
Whether a Cargo.lock source is crates.io is decided in four places, by three different rules:
| Site | Rule |
|---|---|
formats/cargo/mod.rs L483-L484 (CargoLock::entries) |
substring: source.contains("github.com/rust-lang/crates.io-index") || source.contains("index.crates.io") |
vendor/cargo.rs L576-L577 |
two exact strings |
patch/redirect/mod.rs L2451-L2461 |
normalized (case, registry+/sparse+, trailing /, .git) |
vendor/cargo_manifest.rs L78-L87 |
the [patch]-key variant |
There is also a CRATES_IO_SOURCE const in redirect/upstream/cargo.rs L25.```
Executed (a scratch copy at cbbbdb9): a lock entry with source = "sparse+https://index.crates.io.evil.example/" gets SourceKind::CratesIo and a Sha256Hex verifier from CargoLock::entries. Downstream, VEX discovery treats it as crates.io (vex/discover/mod.rs L2942).
Proposed change
Add one formats::cargo::is_crates_io_source(&str) -> bool next to is_registry_source. It uses the normalized rule from redirect/mod.rs, plus the [patch]-key spelling. Call it from all four sites, and delete the local copies and CRATES_IO_SOURCE.
Size
5 files, about −30/+20 lines.
Acceptance criteria
- A unit table test covers both canonical spellings, case and trailing-slash variants, and the
index.crates.io.evil.exampleandgithub.com/rust-lang/crates.io-index-forklookalikes (both rejected). - The cargo lock equivalence tests and vendor cargo tests pass.
- 主要语言
- Rust
- 星标
- 9
- 派生
- 2
- 平均合并
- 20 小时 47 分钟
- 30 天内合并 PR
- 681
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
SocketDev/socket-patch 的其他 Issue
-
agent:triaged arch-audit priority:p3 refactor
难度 2/5 1-3 小时 新手友好度 83/100
SocketDev/socket-patch#1860 ·
维护者通常 1 天内回复
-
agent:triaged arch-audit priority:p3 refactor
难度 2/5 1-3 小时 新手友好度 78/100
SocketDev/socket-patch#1838 ·
维护者通常 1 天内回复
-
arch-audit refactor
难度 4/5 3-5 天 新手友好度 54/100
SocketDev/socket-patch#1993 ·
维护者通常 1 天内回复
-
arch-audit refactor
难度 3/5 1-2 天 新手友好度 66/100
SocketDev/socket-patch#1992 ·
维护者通常 1 天内回复
-
agent:triaged arch-audit priority:p3 refactor
难度 4/5 3-5 天 新手友好度 35/100
SocketDev/socket-patch#1987 · 1 条评论 ·
维护者通常 1 天内回复
查看 SocketDev/socket-patch 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 66/100
riverqueue/river#1576 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 88/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 74/100
stadelmanma/fitparse-rs#64 ·