Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

✨ New Probe: Memory safety #4499

Open
wants to merge 16 commits into
base: main
Choose a base branch
from

Conversation

balteravishay
Copy link
Contributor

What kind of change does this PR introduce?

This PR provides the foundation for addressing issue #3736 by adding a new probe that checks if the code uses non memory safe practices for the repository languages.
The goal is to automate the detection of as many of the practices that the memory safety SIG provides under the Best Practices - Memory-Safe By Default Languages and the Best Practices - Non Memory-Safe By Default Languages guides.

What is the current behavior?

Today scorecard does not detect memory safe practices in it's core features or in any of the probes.

What is the new behavior (if this is a feature change)?**

Probe detects the following:

  • for golang it detects if the code imports the unsafe package and points to the locations where it is used.

  • for c# it detects if the projects allow for unsafe blocks which is a requirement for any project that would use any form of .Net unsafe code, pointer types, and function pointers

  • Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

This code change addresses issue #3736 but does not close it (to be discussed)

Special notes for your reviewer

This code change and the implementation of it were discussed in scorecard community calls with @spencerschrock

Does this PR introduce a user-facing change?

For user-facing changes, please add a concise, human-readable release note to
the release-note

(In particular, describe what changes users might need to make in their
application as a result of this pull request.)

Added independent probe that checks for ecosystem specific non-memory safety practices in the codebase and flags them.

balteravishay and others added 11 commits January 22, 2025 19:08
Signed-off-by: balteravishay <avishay.balter@gmail.com>
The intention was always to sort, but the wrong sort function was used.
This led to an unsorted list, which was dependent on map iteration
order, leading to flaky unit tests. This was reproducible with go test
when passing a large --count option.

Signed-off-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: balteravishay <avishay.balter@gmail.com>
Signed-off-by: balteravishay <avishay.balter@gmail.com>
Signed-off-by: balteravishay <avishay.balter@gmail.com>
Since upgrading to v1.9.1 we've had performance issues in the weekly
analysis, which may be related to one of the Maven features here.

Signed-off-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: balteravishay <avishay.balter@gmail.com>
…sf#4467)

Signed-off-by: balteravishay <avishay.balter@gmail.com>
Signed-off-by: balteravishay <avishay.balter@gmail.com>
Signed-off-by: balteravishay <avishay.balter@gmail.com>
Signed-off-by: balteravishay <avishay.balter@gmail.com>
Signed-off-by: balteravishay <avishay.balter@gmail.com>
Signed-off-by: balteravishay <avishay.balter@gmail.com>
Signed-off-by: balteravishay <avishay.balter@gmail.com>
Copy link

codecov bot commented Jan 22, 2025

Codecov Report

Attention: Patch coverage is 79.28571% with 29 lines in your changes missing coverage. Please review.

Project coverage is 68.58%. Comparing base (353ed60) to head (7e27479).
Report is 104 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4499      +/-   ##
==========================================
+ Coverage   66.80%   68.58%   +1.77%     
==========================================
  Files         230      247      +17     
  Lines       16602    18583    +1981     
==========================================
+ Hits        11091    12745    +1654     
- Misses       4808     5003     +195     
- Partials      703      835     +132     

Signed-off-by: balteravishay <avishay.balter@gmail.com>
@balteravishay balteravishay marked this pull request as ready for review January 22, 2025 22:13
@balteravishay balteravishay requested a review from a team as a code owner January 22, 2025 22:13
@balteravishay balteravishay requested review from justaugustus and raghavkaul and removed request for a team January 22, 2025 22:13
Signed-off-by: balteravishay <avishay.balter@gmail.com>
Signed-off-by: balteravishay <avishay.balter@gmail.com>
@balteravishay
Copy link
Contributor Author

here are some repos to test the code:

go run main.go --repo github.com/microsoft/midi --probes memorysafe --format probe (.net unsafe code)
go run main.go --repo github.com/microsoft/winget-cli --probes memorysafe --format probe (.net safe code)
go run main.go --repo github.com/pkujhd/goloader --probes memorysafe --format probe (go unsafe code)
go run main.go --repo github.com/ossf/scorecard --probes memorysafe --format probe (go safe code)

Signed-off-by: balteravishay <avishay.balter@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: No status
Development

Successfully merging this pull request may close these issues.

2 participants