Stream: wg-secure-code

Topic: clippy security lints


Shnatsel (Sep 01 2019 at 21:21, on Zulip):

I've considered starting a markdown file with anti-patterns found via Safety Dance in its repo, but then realized we'll be writing requests for Clippy lints anyway, so might as well skip right to that.
https://github.com/rust-lang/rust-clippy/issues/4483
https://github.com/rust-lang/rust-clippy/issues/4484
I'm just starting out, there's plenty more we can glean from the code that's been already fixed.

Tony Arcieri (Sep 01 2019 at 21:29, on Zulip):

sounds like a great idea

Shnatsel (Sep 01 2019 at 21:56, on Zulip):

https://github.com/rust-lang/rust-clippy/issues/4485

Shnatsel (Sep 06 2019 at 20:21, on Zulip):

Requested another lint: https://github.com/rust-lang/rust-clippy/issues/4515
Also I was surprised to find that Clippy already lints against transmuting references (suggests pointer casting instead) and then catches alignment issues with casts

Shnatsel (Sep 06 2019 at 20:49, on Zulip):

Aaaand discussion in one of those Clippy lints actually spawned an RFC: https://github.com/rust-lang/rfcs/pull/2756

Shnatsel (Sep 06 2019 at 20:49, on Zulip):

By Alkosh, I love Rust community

Tony Arcieri (Sep 07 2019 at 00:04, on Zulip):

wow, awesome

Shnatsel (Sep 07 2019 at 11:12, on Zulip):

More lint requests: https://github.com/rust-lang/rust-clippy/issues/4520
I suppose I could use some upvotes on this one: https://github.com/rust-lang/rust-clippy/issues/4515

Shnatsel (Sep 07 2019 at 11:13, on Zulip):

Oh hey, one requested lint is already implemented, just waiting on review: https://github.com/rust-lang/rust-clippy/pull/4511

Shnatsel (Oct 08 2019 at 18:13, on Zulip):

Clippy has just merged a lint to complain about unsound transmutes of owned collections: https://github.com/rust-lang/rust-clippy/issues/4515
At this point all lints we've requested that lead to UB in practice and not just in theory are implemented. We need to request some more!

Tony Arcieri (Oct 08 2019 at 18:21, on Zulip):

nice

RalfJ (Oct 09 2019 at 14:27, on Zulip):

that, or we need to start exploiting more UB in the compiler to move things from the "theory" to the "practice" side of this ;)

Last update: Nov 11 2019 at 22:00UTC