Lint: warn about versions in the distant future being affected
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 2k
- Forks
- 198
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 8
Description
Sometimes people specify patched versions with an upper bound, e.g. using the ^ operator, so that all currently existing versions are covered, but versions released in the distant future would be marked as unpatched.
This is clearly unintentional unless there are no patched versions, but is easy to miss in manual review.
Examples where this was initially missed: https://github.com/RustSec/advisory-db/pull/951 https://github.com/RustSec/advisory-db/pull/945
We should add a lint that warns about this (unless patched = []).
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review the RustSec linting entry point and the advisory validation path, using the examples in pull requests 951 and 945 as behavior cases. The work is done when a lint warns about patched versions bounded in the distant future, while not warning when patched is an empty list.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- security, tooling
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100