[tbb-commits] [Git][tpo/applications/tor-browser-spec][main] 2 commits: Bug 40050: FF103 Audit

[richard (@richard)]

richard pushed to branch main at The Tor Project / Applications / tor-browser-spec


Commits:
b98cb466 by Richard Pospesel at 2023-08-28T20:28:54+00:00
Bug 40050: FF103 Audit

- - - - -
210910a0 by Richard Pospesel at 2023-08-28T20:28:54+00:00
Tweaks to code_audit.sh to also show the report if one exists

- - - - -


2 changed files:

- + audits/FF103_AUDIT
- audits/code_audit.sh


Changes:

=====================================
audits/FF103_AUDIT
=====================================
@@ -0,0 +1,78 @@
+# General
+
+The audit begins at the commit hash where the previous audit ended. Use code_audit.sh for creating the diff and highlighting potentially problematic code. The audit is scoped to a specific language (currently C/C++, Rust, Java/Kotlin, and Javascript).
+
+The output includes the entire patch where the new problematic code was introduced. Search for `XXX MATCH XXX` to find the next potential violation.
+
+`code_audit.sh` contains the list of known problematic APIs. New usage of these functions are documented and analyzed in this audit.
+
+## Firefox: https://github.com/mozilla/gecko-dev.git
+
+- Start: `feef2b7da6ff76b4c3c7a13e611eab6e97837ae2` ( `FIREFOX_102_0_1_RELEASE` )
+- End:   `1f1c56dc6bae6b3302471f097ed132ef44cded86`  ( `FIREFOX_103_0_2_RELEASE` )
+
+### Languages:
+- [x] java
+- [x] cpp
+- [x] js
+- [x] rust
+
+Nothing of interest (using `code_audit.sh`)
+
+---
+
+## Application Services: https://github.com/mozilla/application-services.git
+
+- Start: `0302b89604bb29adb34fdcd710feabd3dd01992d` ( `v93.5.0` )
+- End:   `b70c54882fec606d10e77520b1dd2ae144768747`  ( `v94.0.0` )
+
+### Languages:
+- [x] java
+- [x] cpp
+- [x] js
+- [x] rust
+
+Nothing of interest (using `code_audit.sh`)
+
+## Android Components: https://github.com/mozilla-mobile/android-components.git
+
+- Start: `c349019286e21e5179a59e33cec6ae528b108519`
+- End:   `ce720e6308e26588decd5f9d2b02e4658d5b9d14`  ( `v103.0.11` )
+
+### Languages:
+- [x] java
+- [x] cpp
+- [x] js
+- [x] rust
+
+<!--
+### foreach PROBLEMATIC_HASH:
+#### $(PROBLEMATIC_HASH)
+- Summary
+- Review Result: (SAFE|BAD)
+-->
+
+#### Problematic Commits
+- Biometric prompt feature (#12291): `b1723820859fce1c6d0a358e1edec4f4dec39234`
+
+## Fenix: https://github.com/mozilla-mobile/fenix.git
+
+- Start: `6e0ad035e384ef1fb7d8c8ac8d398470d953e1dc` ( `v103.0.0-beta.1` )
+- End:   `e0d3c03afefe699a7456214b0da140f74ef499f7`  ( `v103.2.0` )
+
+### Languages:
+- [x] java
+- [x] cpp
+- [x] js
+- [x] rust
+
+Nothing of interest (using `code_audit.sh`)
+
+## Ticket Review ##
+
+Bugzilla Query: `https://bugzilla.mozilla.org/buglist.cgi?query_format=advanced&resolution=FIXED&target_milestone=103%20Branch&order=priority%2Cbug_severity&limit=0`
+
+#### Problematic Tickets
+- **Use double-conversion library instead of dtoa for string-to-double conversion** https://bugzilla.mozilla.org/show_bug.cgi?id=1770158
+  - Uses upstream https://github.com/google/double-conversion from google
+  - Well tested and documentaiton doesn't suggest any hardware specific differences, quick look through the source suggest integer operations for the parsing/conversions


=====================================
audits/code_audit.sh
=====================================
@@ -148,7 +148,7 @@ case "${SCOPE}" in
 esac
 
 AUDIT_DIR=$(pwd)
-cd "$REPO_DIR"
+pushd "$REPO_DIR"
 
 # Step 2: Generate match pattern based on in-scope keywords
 function join_by { local d=$1; shift; local f=$1; shift; printf %s "$f" "${@/#/$d}"; }
@@ -174,7 +174,7 @@ rm -f "${REPORT_FILE}"
 # Flashing Color constants
 export GREP_COLOR="05;37;41"
 
-for COMMIT in $(git rev-list --ancestry-path $OLD..$NEW); do
+for COMMIT in $(git rev-list --ancestry-path $OLD~..$NEW); do
     TEMP_DIFF="$(mktemp)"
 
     echo "Diffing $COMMIT..."
@@ -201,6 +201,7 @@ for COMMIT in $(git rev-list --ancestry-path $OLD..$NEW); do
 
     rm -f "${TEMP_DIFF}"
 done
+popd
 
 # Step 5: Review the code changes
 
@@ -210,6 +211,7 @@ then
     echo "Report generated. View it with:"
     echo ""
     echo "less -R \"$(basename "${REPORT_FILE}")\""
+    less -R "$(basename ${REPORT_FILE})"
 else
     echo "No keywords found. No report generated"
 fi



View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/compare/b79d4e8ac1d55c428e85863da9c8dd5f58e7c4dc...210910a00edbde9caff5a49479bc66864c8c8f80

-- 
View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser-spec/-/compare/b79d4e8ac1d55c428e85863da9c8dd5f58e7c4dc...210910a00edbde9caff5a49479bc66864c8c8f80
You're receiving this email because of your account on gitlab.torproject.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.torproject.org/pipermail/tbb-commits/attachments/20230828/0becb02c/attachment-0001.htm>