Skip to content

Commit f91ccac

Browse files
fernandomatsuosantosfernandomatsuosantos
committed
Add intentionally vulnerable Rust code for CodeQL security testing
1 parent 2d2201b commit f91ccac

File tree

236 files changed

+12007
-23961
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

236 files changed

+12007
-23961
lines changed

‎monorepo/.codeql.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@
3232
"language": "javascript"
3333
},
3434
{
35-
"path": "./monorepo/project-rust-1"
35+
"path": "./monorepo/project-rust-2"
3636
}
3737
]
3838
}

monorepo/project-rust-1/tests/ambiguities/comparison_in_function.kalker renamed to monorepo/project-rust-1/.github/FUNDING.yml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1 @@
1-
f(a, b, c) = (a * b = c)
2-
f(2, 2, 4)
1+
github: [sharkdp, tavianator]

‎monorepo/project-rust-1/.github/ISSUE_TEMPLATE/bug_report.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: Bug Report
2+
description: Report a bug.
3+
title: "[BUG] "
4+
labels: bug
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: |
9+
Please check out the [troubleshooting section](https://github.com/sharkdp/fd#troubleshooting) first.
10+
- type: checkboxes
11+
attributes:
12+
label: Checks
13+
options:
14+
- label: I have read the troubleshooting section and still think this is a bug.
15+
required: true
16+
- type: textarea
17+
id: bug
18+
attributes:
19+
label: "Describe the bug you encountered:"
20+
validations:
21+
required: true
22+
- type: textarea
23+
id: expected
24+
attributes:
25+
label: "Describe what you expected to happen:"
26+
- type: input
27+
id: version
28+
attributes:
29+
label: "What version of `fd` are you using?"
30+
placeholder: "paste the output of `fd --version` here"
31+
validations:
32+
required: true
33+
- type: textarea
34+
id: os
35+
attributes:
36+
label: Which operating system / distribution are you on?
37+
placeholder: |
38+
Unix: paste the output of `uname -srm` and `lsb_release -a` here.
39+
Windows: please tell us your Windows version
40+
render: shell
41+
validations:
42+
required: true

‎monorepo/project-rust-1/.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
blank_issues_enabled: true

‎monorepo/project-rust-1/.github/ISSUE_TEMPLATE/feature_request.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
name: Feature Request
3+
about: Suggest an idea for this project.
4+
title: ''
5+
labels: feature-request
6+
assignees: ''
7+
8+
---

‎monorepo/project-rust-1/.github/ISSUE_TEMPLATE/question.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
name: Question
3+
about: Ask a question about 'fd'.
4+
title: ''
5+
labels: question
6+
assignees: ''
7+
8+
---
9+
10+
11+
12+
**What version of `fd` are you using?**
13+
[paste the output of `fd --version` here]

‎monorepo/project-rust-1/.github/dependabot.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "cargo"
4+
directory: "/"
5+
schedule:
6+
interval: "monthly"
7+
- package-ecosystem: "github-actions"
8+
directory: "/"
9+
schedule:
10+
interval: "daily"

‎monorepo/project-rust-1/.github/workflows/CICD.yml‎

Lines changed: 266 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,266 @@
1+
name: CICD
2+
3+
env:
4+
CICD_INTERMEDIATES_DIR: "_cicd-intermediates"
5+
MSRV_FEATURES: "--all-features"
6+
7+
on:
8+
workflow_dispatch:
9+
pull_request:
10+
push:
11+
branches:
12+
- master
13+
tags:
14+
- '*'
15+
16+
jobs:
17+
crate_metadata:
18+
name: Extract crate metadata
19+
runs-on: ubuntu-latest
20+
steps:
21+
- uses: actions/checkout@v4
22+
- name: Extract crate information
23+
id: crate_metadata
24+
run: |
25+
echo "name=fd" | tee -a $GITHUB_OUTPUT
26+
cargo metadata --no-deps --format-version 1 | jq -r '"version=" + .packages[0].version' | tee -a $GITHUB_OUTPUT
27+
cargo metadata --no-deps --format-version 1 | jq -r '"maintainer=" + .packages[0].authors[0]' | tee -a $GITHUB_OUTPUT
28+
cargo metadata --no-deps --format-version 1 | jq -r '"homepage=" + .packages[0].homepage' | tee -a $GITHUB_OUTPUT
29+
cargo metadata --no-deps --format-version 1 | jq -r '"msrv=" + .packages[0].rust_version' | tee -a $GITHUB_OUTPUT
30+
outputs:
31+
name: ${{ steps.crate_metadata.outputs.name }}
32+
version: ${{ steps.crate_metadata.outputs.version }}
33+
maintainer: ${{ steps.crate_metadata.outputs.maintainer }}
34+
homepage: ${{ steps.crate_metadata.outputs.homepage }}
35+
msrv: ${{ steps.crate_metadata.outputs.msrv }}
36+
37+
ensure_cargo_fmt:
38+
name: Ensure 'cargo fmt' has been run
39+
runs-on: ubuntu-22.04
40+
steps:
41+
- uses: dtolnay/rust-toolchain@stable
42+
with:
43+
components: rustfmt
44+
- uses: actions/checkout@v4
45+
- run: cargo fmt -- --check
46+
47+
lint_check:
48+
name: Ensure 'cargo clippy' has no warnings
49+
runs-on: ubuntu-latest
50+
steps:
51+
- uses: dtolnay/rust-toolchain@stable
52+
with:
53+
components: clippy
54+
- uses: actions/checkout@v4
55+
- run: cargo clippy --all-targets --all-features -- -Dwarnings
56+
57+
min_version:
58+
name: Minimum supported rust version
59+
runs-on: ubuntu-22.04
60+
needs: crate_metadata
61+
steps:
62+
- name: Checkout source code
63+
uses: actions/checkout@v4
64+
65+
- name: Install rust toolchain (v${{ needs.crate_metadata.outputs.msrv }})
66+
uses: dtolnay/rust-toolchain@master
67+
with:
68+
toolchain: ${{ needs.crate_metadata.outputs.msrv }}
69+
components: clippy
70+
- name: Run clippy (on minimum supported rust version to prevent warnings we can't fix)
71+
run: cargo clippy --locked --all-targets ${{ env.MSRV_FEATURES }}
72+
- name: Run tests
73+
run: cargo test --locked ${{ env.MSRV_FEATURES }}
74+
75+
build:
76+
name: ${{ matrix.job.target }} (${{ matrix.job.os }})
77+
runs-on: ${{ matrix.job.os }}
78+
needs: crate_metadata
79+
strategy:
80+
fail-fast: false
81+
matrix:
82+
job:
83+
- { target: aarch64-unknown-linux-gnu , os: ubuntu-22.04, use-cross: true }
84+
- { target: aarch64-unknown-linux-musl , os: ubuntu-22.04, use-cross: true }
85+
- { target: arm-unknown-linux-gnueabihf , os: ubuntu-22.04, use-cross: true }
86+
- { target: arm-unknown-linux-musleabihf, os: ubuntu-22.04, use-cross: true }
87+
- { target: i686-pc-windows-msvc , os: windows-2022 }
88+
- { target: i686-unknown-linux-gnu , os: ubuntu-22.04, use-cross: true }
89+
- { target: i686-unknown-linux-musl , os: ubuntu-22.04, use-cross: true }
90+
- { target: x86_64-apple-darwin , os: macos-13 }
91+
- { target: aarch64-apple-darwin , os: macos-14 }
92+
- { target: x86_64-pc-windows-gnu , os: windows-2022 }
93+
- { target: x86_64-pc-windows-msvc , os: windows-2022 }
94+
- { target: aarch64-pc-windows-msvc , os: windows-11-arm }
95+
- { target: x86_64-unknown-linux-gnu , os: ubuntu-22.04, use-cross: true }
96+
- { target: x86_64-unknown-linux-musl , os: ubuntu-22.04, use-cross: true }
97+
env:
98+
BUILD_CMD: cargo
99+
steps:
100+
- name: Checkout source code
101+
uses: actions/checkout@v4
102+
103+
- name: Install prerequisites
104+
shell: bash
105+
run: |
106+
case ${{ matrix.job.target }} in
107+
arm-unknown-linux-*) sudo apt-get -y update ; sudo apt-get -y install gcc-arm-linux-gnueabihf ;;
108+
aarch64-unknown-linux-gnu) sudo apt-get -y update ; sudo apt-get -y install gcc-aarch64-linux-gnu ;;
109+
esac
110+
111+
- name: Install Rust toolchain
112+
uses: dtolnay/rust-toolchain@stable
113+
with:
114+
targets: ${{ matrix.job.target }}
115+
# On windows, for now build with 1.77.2, so that it works on windows 7.
116+
# When we update the MSRV again, we'll need to revisit this, and probably drop support for Win7
117+
toolchain: "${{ contains(matrix.job.target, 'windows-') && '1.77.2' || 'stable' }}"
118+
119+
- name: Install cross
120+
if: matrix.job.use-cross
121+
uses: taiki-e/install-action@v2
122+
with:
123+
tool: cross
124+
125+
- name: Overwrite build command env variable
126+
if: matrix.job.use-cross
127+
shell: bash
128+
run: echo "BUILD_CMD=cross" >> $GITHUB_ENV
129+
130+
- name: Show version information (Rust, cargo, GCC)
131+
shell: bash
132+
run: |
133+
gcc --version || true
134+
rustup -V
135+
rustup toolchain list
136+
rustup default
137+
cargo -V
138+
rustc -V
139+
140+
- name: Build
141+
shell: bash
142+
run: $BUILD_CMD build --locked --release --target=${{ matrix.job.target }}
143+
144+
- name: Set binary name & path
145+
id: bin
146+
shell: bash
147+
run: |
148+
# Figure out suffix of binary
149+
EXE_suffix=""
150+
case ${{ matrix.job.target }} in
151+
*-pc-windows-*) EXE_suffix=".exe" ;;
152+
esac;
153+
154+
# Setup paths
155+
BIN_NAME="${{ needs.crate_metadata.outputs.name }}${EXE_suffix}"
156+
BIN_PATH="target/${{ matrix.job.target }}/release/${BIN_NAME}"
157+
158+
# Let subsequent steps know where to find the binary
159+
echo "BIN_PATH=${BIN_PATH}" >> $GITHUB_OUTPUT
160+
echo "BIN_NAME=${BIN_NAME}" >> $GITHUB_OUTPUT
161+
162+
- name: Set testing options
163+
id: test-options
164+
shell: bash
165+
run: |
166+
# test only library unit tests and binary for arm-type targets
167+
unset CARGO_TEST_OPTIONS
168+
unset CARGO_TEST_OPTIONS ; case ${{ matrix.job.target }} in arm-* | aarch64-*) CARGO_TEST_OPTIONS="--bin ${{ needs.crate_metadata.outputs.name }}" ;; esac;
169+
echo "CARGO_TEST_OPTIONS=${CARGO_TEST_OPTIONS}" >> $GITHUB_OUTPUT
170+
171+
- name: Run tests
172+
shell: bash
173+
run: $BUILD_CMD test --locked --target=${{ matrix.job.target }} ${{ steps.test-options.outputs.CARGO_TEST_OPTIONS}}
174+
175+
- name: Generate completions
176+
id: completions
177+
shell: bash
178+
run: make completions
179+
180+
- name: Create tarball
181+
id: package
182+
shell: bash
183+
run: |
184+
PKG_suffix=".tar.gz" ; case ${{ matrix.job.target }} in *-pc-windows-*) PKG_suffix=".zip" ;; esac;
185+
PKG_BASENAME=${{ needs.crate_metadata.outputs.name }}-v${{ needs.crate_metadata.outputs.version }}-${{ matrix.job.target }}
186+
PKG_NAME=${PKG_BASENAME}${PKG_suffix}
187+
echo "PKG_NAME=${PKG_NAME}" >> $GITHUB_OUTPUT
188+
189+
PKG_STAGING="${{ env.CICD_INTERMEDIATES_DIR }}/package"
190+
ARCHIVE_DIR="${PKG_STAGING}/${PKG_BASENAME}/"
191+
mkdir -p "${ARCHIVE_DIR}"
192+
193+
# Binary
194+
cp "${{ steps.bin.outputs.BIN_PATH }}" "$ARCHIVE_DIR"
195+
196+
# README, LICENSE and CHANGELOG files
197+
cp "README.md" "LICENSE-MIT" "LICENSE-APACHE" "CHANGELOG.md" "$ARCHIVE_DIR"
198+
199+
# Man page
200+
cp 'doc/${{ needs.crate_metadata.outputs.name }}.1' "$ARCHIVE_DIR"
201+
202+
# Autocompletion files
203+
cp -r autocomplete "${ARCHIVE_DIR}"
204+
205+
# base compressed package
206+
pushd "${PKG_STAGING}/" >/dev/null
207+
case ${{ matrix.job.target }} in
208+
*-pc-windows-*) 7z -y a "${PKG_NAME}" "${PKG_BASENAME}"/* | tail -2 ;;
209+
*) tar czf "${PKG_NAME}" "${PKG_BASENAME}"/* ;;
210+
esac;
211+
popd >/dev/null
212+
213+
# Let subsequent steps know where to find the compressed package
214+
echo "PKG_PATH=${PKG_STAGING}/${PKG_NAME}" >> $GITHUB_OUTPUT
215+
216+
- name: Create Debian package
217+
id: debian-package
218+
shell: bash
219+
if: startsWith(matrix.job.os, 'ubuntu')
220+
run: bash scripts/create-deb.sh
221+
env:
222+
TARGET: ${{ matrix.job.target }}
223+
DPKG_VERSION: ${{ needs.crate_metadata.version }}
224+
BIN_PATH: ${{ steps.bin.outputs.BIN_PATH }}
225+
226+
- name: "Artifact upload: tarball"
227+
uses: actions/upload-artifact@master
228+
with:
229+
name: ${{ steps.package.outputs.PKG_NAME }}
230+
path: ${{ steps.package.outputs.PKG_PATH }}
231+
232+
- name: "Artifact upload: Debian package"
233+
uses: actions/upload-artifact@master
234+
if: steps.debian-package.outputs.DPKG_NAME
235+
with:
236+
name: ${{ steps.debian-package.outputs.DPKG_NAME }}
237+
path: ${{ steps.debian-package.outputs.DPKG_PATH }}
238+
239+
- name: Check for release
240+
id: is-release
241+
shell: bash
242+
run: |
243+
unset IS_RELEASE ; if [[ $GITHUB_REF =~ ^refs/tags/v[0-9].* ]]; then IS_RELEASE='true' ; fi
244+
echo "IS_RELEASE=${IS_RELEASE}" >> $GITHUB_OUTPUT
245+
246+
- name: Publish archives and packages
247+
uses: softprops/action-gh-release@v2
248+
if: steps.is-release.outputs.IS_RELEASE
249+
with:
250+
files: |
251+
${{ steps.package.outputs.PKG_PATH }}
252+
${{ steps.debian-package.outputs.DPKG_PATH }}
253+
env:
254+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
255+
256+
winget:
257+
name: Publish to Winget
258+
runs-on: ubuntu-latest
259+
needs: build
260+
if: startsWith(github.ref, 'refs/tags/v')
261+
steps:
262+
- uses: vedantmgoyal2009/winget-releaser@v2
263+
with:
264+
identifier: sharkdp.fd
265+
installers-regex: '-pc-windows-msvc\.zip$'
266+
token: ${{ secrets.WINGET_TOKEN }}

‎monorepo/project-rust-1/.github/workflows/build.yml‎

Lines changed: 0 additions & 34 deletions
This file was deleted.

0 commit comments

Comments
 (0)