PLSysSec / PLSysSec/cargo-scan
Updated roadmap for traits
Open
Nobody has claimed this yet.
roadmap-v1
- Dominant language
- Rust
- Stars
- 47
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
New roadmap for traits. Replaces #30
For v0:
- add tracking code to maintain, for each trait, the total set of caller-checked effects and unsafety for that trait (in the current package scope, among all implementations)
- add information to our audit/policy files: in addition to the public functions, we also need the traits (both implemented by and exposed by/declared by that crate). For each trait: whether caller-checked or unsafe, which specific caller-checked effects
- In the call graph in scanner, make sure trait methods are added to the call graph
- In the call graph in scanner, make sure name resolution for traits points to the abstract trait as added to the call graph.
Possibly for v0, or save for v1:
- In the call graph in scanner, add specific trait implementations in addition to the abstract trait method
- In a non-generic context when we know the trait that is pointed to, point to the specific trait implementation instead of the abstract trait method.
- For dynamic trait objects, just point to the abstract trait method
For v1:
- For dynamic trait objects, track which specific possible trait impls it could point to
- For traits called in a generic context, track which specific possible trait impls it could point to
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the scanner's call-graph handling and the audit/policy files, focusing on the unchecked v0 requirements. Done means tracking caller-checked effects and unsafety for each trait and recording the requested trait information for crates; the v1 dynamic and generic trait work is explicitly deferred.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security, tooling
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100