stm_app
stm_app copied to clipboard
Rust muncher limitations + sensitive info leakage
Limitations
The Rust Muncher should be a bit more detailed and accurate. The initial implementation cut a few corners.
-
for X in Y {...}
- make this a single construct in keywords as opposed to separatefor
andin
- Add documentation block comments as a separate trackable structure. We can only track block comments that don't show as docs.
///
and//!
are tracked as docs, but/** ... **/
is not. - Reliably parsing
use
is too hard because it can be nested and multiline. Skipped for now. - Cargo.toml regex picks up lines with
version
andedition
from [package] section because we can't look only in a certain part of the file. I couldn't construct a regex to exclude those two.
Potential sensitive data leakage
Local libs are included in the report. E.g. stackmuncher_lib = { version = "0.2", path = "../../stm_app/stackmuncher_lib" }
includes stackmuncher_lib
.
This probably affects other languages. The problem here is in the parent path. It should be logged as a separate issue.