PLSysSec / PLSysSec/cargo-scan

Updated roadmap for traits

Open
#35 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

roadmap-v1
Dominant language
Rust
Stars
47
Forks
7
PR merge metrics
No merged PRs in 30d

Description

New roadmap for traits. Replaces #30

For v0:

  • add tracking code to maintain, for each trait, the total set of caller-checked effects and unsafety for that trait (in the current package scope, among all implementations)
  • add information to our audit/policy files: in addition to the public functions, we also need the traits (both implemented by and exposed by/declared by that crate). For each trait: whether caller-checked or unsafe, which specific caller-checked effects
  • In the call graph in scanner, make sure trait methods are added to the call graph
  • In the call graph in scanner, make sure name resolution for traits points to the abstract trait as added to the call graph.

Possibly for v0, or save for v1:

  • In the call graph in scanner, add specific trait implementations in addition to the abstract trait method
  • In a non-generic context when we know the trait that is pointed to, point to the specific trait implementation instead of the abstract trait method.
  • For dynamic trait objects, just point to the abstract trait method

For v1:

  • For dynamic trait objects, track which specific possible trait impls it could point to
  • For traits called in a generic context, track which specific possible trait impls it could point to

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading the scanner's call-graph handling and the audit/policy files, focusing on the unchecked v0 requirements. Done means tracking caller-checked effects and unsafety for each trait and recording the requested trait information for crates; the v1 dynamic and generic trait work is explicitly deferred.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
security, tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.