65 lines
2.8 KiB
Bash
Executable File
65 lines
2.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd -P)
|
|
cd "$ROOT"
|
|
mapfile -d '' -t TRACKED < <(git ls-files -z --cached --others --exclude-standard -- ':!docs/superpowers/**' ':!foundry.lock' ':!package-lock.json' ':!web/package-lock.json')
|
|
|
|
secret_names='PRIVATE''_KEY|MNEM''ONIC'
|
|
assignment_pattern="(^|[^[:alnum:]_])(${secret_names})[[:space:]]*="
|
|
pem_pattern='-----BEGIN .*PRI''VATE KEY-----'
|
|
unfinished_pattern='(^|[^[:alnum:]_])(TO''DO|T''BD|FIX''ME)([^[:alnum:]_]|$)'
|
|
filler_pattern='lorem[[:space:]]+ip''sum|fill''er[[:space:]]+text'
|
|
unsafe_pattern='unsafe''Allow|unsafe''SkipStorageCheck|unsafe''SkipAllChecks|oz-upgrades-unsafe-allow'
|
|
allowed_annotation=' /// @custom:oz-upgrades-unsafe-allow constructor'
|
|
fixture_name='ANVIL_''TEST_PHRASE'
|
|
allowed_fixture_path='script/lib/DemoScript.sol'
|
|
allowed_fixture_line=' string internal constant ANVIL_''TEST_PHRASE = "test test test test test test test test test test test junk";'
|
|
fixture_count=0
|
|
violations=0
|
|
|
|
report_matches() {
|
|
local path=$1 pattern=$2 label=$3 line number=0
|
|
while IFS= read -r line || [[ -n "$line" ]]; do
|
|
number=$((number + 1))
|
|
if [[ "$line" =~ $pattern ]]; then
|
|
printf 'forbidden %s: %s:%d:%s\n' "$label" "$path" "$number" "$line" >&2
|
|
violations=$((violations + 1))
|
|
fi
|
|
done <"$path"
|
|
}
|
|
|
|
for path in "${TRACKED[@]}"; do
|
|
[[ "$path" == lib/* || ! -f "$path" ]] && continue
|
|
report_matches "$path" "$assignment_pattern" 'secret assignment'
|
|
report_matches "$path" "$pem_pattern" 'PEM private key'
|
|
report_matches "$path" "$unfinished_pattern" 'unfinished marker'
|
|
report_matches "$path" "$filler_pattern" 'filler content'
|
|
while IFS= read -r line || [[ -n "$line" ]]; do
|
|
if [[ "$line" == *"$fixture_name"*'='* ]]; then
|
|
if [[ "$path" == "$allowed_fixture_path" && "$line" == "$allowed_fixture_line" ]]; then
|
|
fixture_count=$((fixture_count + 1))
|
|
else
|
|
printf 'forbidden local phrase assignment outside exact fixture: %s:%s\n' "$path" "$line" >&2
|
|
violations=$((violations + 1))
|
|
fi
|
|
fi
|
|
done <"$path"
|
|
if [[ "$path" == src/* || "$path" == test/* || "$path" == script/* ]]; then
|
|
while IFS= read -r line || [[ -n "$line" ]]; do
|
|
if [[ "$line" =~ $unsafe_pattern && "$path:$line" != "src/BankV1.sol:$allowed_annotation" ]]; then
|
|
printf 'forbidden unsafe upgrade bypass: %s:%s\n' "$path" "$line" >&2
|
|
violations=$((violations + 1))
|
|
fi
|
|
done <"$path"
|
|
fi
|
|
done
|
|
|
|
if ((fixture_count != 1)); then
|
|
printf 'expected exactly one local phrase fixture assignment, found %d\n' "$fixture_count" >&2
|
|
violations=$((violations + 1))
|
|
fi
|
|
|
|
((violations == 0)) || { printf 'Project scan failed with %d violation(s).\n' "$violations" >&2; exit 1; }
|
|
printf 'Project scan passed across %d tracked paths.\n' "${#TRACKED[@]}"
|