mirror of
https://github.com/AgentSeal/codeburn.git
synced 2026-08-22 15:05:16 +00:00
c71f2cd667
The prototype-pollution rule has never fired. Its `paths.include` named the pre-workspace layout (`/src/providers/*.ts`, `/src/parser.ts`) while the job scans `packages/cli/src/...`, so the rule selected no files and the step was green unconditionally. Verified before and after: with the old rule and the old scan targets a planted bracket-assign under packages/cli/src/providers/ reports 0 findings; with this change the same violation is reported at the right file and line, and the real tree scans 184 files clean. Also brings packages/core/src/providers/** into scope. Provider decoding moved there in the extraction, so that is where records from untrusted session logs are now turned into maps — precisely what the rule exists to guard. Two guard-rails so the step cannot silently go vacuous again: - The step now fails when the scan selected no files. semgrep's --json `paths.scanned` reflects what the rule actually selected, not the raw scan targets (verified: with the include paths broken but the targets intact, scanned drops to 0 while the step still exits 0). A low-water mark was considered and rejected as brittle: the provider count is a moving target by design and CI installs semgrep unpinned, so a magic number would need constant bumping and would decay back into vacuity. - The CLI providers glob is now recursive (`**/*.ts`) like core's. The directory is flat today, but a future nested provider directory would be scanned by CI and then silently excluded by the rule; a planted violation under providers/nested/ is now reported. The narrow whitelist is deliberate and unchanged in spirit: unrelated maps elsewhere in the tree stay out of scope. |
||
|---|---|---|
| .. | ||
| workflows | ||
| FUNDING.yml | ||
| PULL_REQUEST_TEMPLATE.md | ||