Enforcing kernel assumptions
Nobody has claimed this yet.
- Dominant language
- Lean
- Stars
- 9.2k
- Forks
- 990
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 175
Description
We have added a few kernel extensions that make assumptions about the Nat and String types. For example, the kernel assumes the term Expr.lit (literal.natVal 0) has type Nat. So, in principle, adversarial users may try to create their own Core.lean (using prelude) where Nat is, for example, the empty type. Right now, we do not have protections against this kind of abuse. This is a very low priority issue, but it is important to document it.
There are many possible ways to fix this. For example, we can check in the Kernel whether Nat and String are the ones
we expect at addDecl.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the kernel's addDecl entry point and the custom Core.lean/prelude scenario described in the issue. Document the assumptions about Nat and String, the adversarial situation, and the expected limitation or protection; done means the risk and intended behavior are recorded in an appropriate project documentation location.
Written by the indexing model from the issue text.
Assessment
- Domain
- compilers, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100