Skip to content

feat(core): add event cast narrowing detector - #859

Open
anidroid1184 wants to merge 9 commits into
Centurylong:mainfrom
anidroid1184:feat/add-static-analysis-for-integer-detector
Open

feat(core): add event cast narrowing detector#859
anidroid1184 wants to merge 9 commits into
Centurylong:mainfrom
anidroid1184:feat/add-static-analysis-for-integer-detector

Conversation

@anidroid1184

Copy link
Copy Markdown

Summary of the change

Adds a static-analysis detector (event_data_cast) that flags narrowing integer casts inside env.events().publish() call payloads. When a wider integer (e.g. i128, i64) is cast to a narrower type (e.g. u32) or changes signedness (i64 as u64) inside event emission, indexers receive truncated data silently.

The detector scans function bodies, tracks parameter types through the visitor, and recurses into tuples, method calls, and binary expressions within event payloads to catch lossy casts.

Fixes / Closes

Closes #804

Motivation and context

Event data is consumed off-chain by indexers and monitoring tools. A narrowing cast at the point of emission permanently loses information with no compiler warning — indexers see a truncated value and have no way to recover the original. This detector surfaces those casts during static analysis so developers can emit the full-width value or explicitly document the truncation.

Dependencies

  • None (self-contained rule + insta snapshot)

Type of change

  • New feature (non-breaking change which adds functionality)

How Has This Been Tested?

Unit tests — 6 tests in event_data_cast.rs covering:

  • Narrowing cast detection (i128 as u32)
  • Widening casts ignored (u32 as u64)
  • Casts outside event context ignored
  • Multiple casts in one event payload
  • Signedness change detection (i64 as u64)
  • No-cast event payloads pass clean

Golden snapshotinsta snapshot via detector_snapshots.rs with a dedicated fixture exercising 4 violations across 3 functions and 3 safe patterns.

Command:

cargo test -p sanctifier-core -- event_data_cast

Checklist:

  • My code follows the style guidelines of this project
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
  • Any dependent changes have been merged and published in downstream modules

@github-actions github-actions Bot added rust Pull requests that update rust code area: core-engine sanctifier-core static analysis engine area: testing Tests, benchmarks, fuzzing size/m labels Jul 24, 2026
@Gbangbolaoluwagbemiga

Copy link
Copy Markdown
Contributor

@anidroid1184 , ci pipeline fails, pull from upstream and resolve pipeline failures

@anidroid1184

Copy link
Copy Markdown
Author

@Gbangbolaoluwagbemiga sure

@Gbangbolaoluwagbemiga

Copy link
Copy Markdown
Contributor

Please pull from upstream @anidroid1184 and resolve conflicts, also ensure all ci passes

@anidroid1184

Copy link
Copy Markdown
Author

@Gbangbolaoluwagbemiga sure
The next commit won't have errors with the workflows

@Gbangbolaoluwagbemiga

Copy link
Copy Markdown
Contributor

But this still has conflict and the ci fails, please fix before i merge it @anidroid1184 ...Looking forward to the fix

@anidroid1184

Copy link
Copy Markdown
Author

@Gbangbolaoluwagbemiga sorry for be late. I'm still working on the ci pipeline. But still on my local enviroment. Can I send the new PR tomorrow?

@Gbangbolaoluwagbemiga

Copy link
Copy Markdown
Contributor

Yes please, looking forward to that @anidroid1184....well done

@anidroid1184
anidroid1184 marked this pull request as draft July 27, 2026 03:07
@anidroid1184
anidroid1184 marked this pull request as ready for review July 27, 2026 21:20
@github-actions github-actions Bot added area: docs Documentation and guides size/l and removed size/m labels Jul 27, 2026
@Gbangbolaoluwagbemiga

Copy link
Copy Markdown
Contributor

@anidroid1184, ci still fails on this

@anidroid1184

Copy link
Copy Markdown
Author

@Gbangbolaoluwagbemiga I'm sorry, I'll review again today, before end to campaign

Juan Sebastian Valencia Londono and others added 2 commits July 29, 2026 20:54
The merge with upstream/main accidentally dropped the module declaration
and registry.register call for EventDataCastRule, causing CI to fail on
the no_orphan_detector_pages test. Also add the missing golden snapshot
test function that had an unreferenced snapshot file.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: core-engine sanctifier-core static analysis engine area: docs Documentation and guides area: testing Tests, benchmarks, fuzzing rust Pull requests that update rust code size/l

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Detector: Integer info-loss in event data casts

2 participants