@openzeppelin/upgrades-core 1.20.5 → 1.21.0

package/src/validate/run.ts

@@ -1,6 +1,6 @@
 import { Node } from 'solidity-ast/node';
-import { isNodeType, findAll } from 'solidity-ast/utils';
-import type { ContractDefinition } from 'solidity-ast';
+import { isNodeType, findAll, ASTDereferencer } from 'solidity-ast/utils';
+import type { ContractDefinition, FunctionDefinition } from 'solidity-ast';
 
 import { SolcOutput, SolcBytecode } from '../solc-api';
 import { SrcDecoder } from '../src-decoder';
@@ -68,6 +68,26 @@ interface ValidationErrorOpcode extends ValidationErrorBase {
   kind: 'delegatecall' | 'selfdestruct';
 }
 
+interface OpcodePattern {
+  kind: 'delegatecall' | 'selfdestruct';
+  pattern: RegExp;
+}
+
+const OPCODES = {
+  delegatecall: {
+    kind: 'delegatecall',
+    pattern: /^t_function_baredelegatecall_/,
+  },
+  selfdestruct: {
+    kind: 'selfdestruct',
+    pattern: /^t_function_selfdestruct_/,
+  },
+} as const;
+
+export function isOpcodeError(error: ValidationErrorBase): error is ValidationErrorOpcode {
+  return error.kind === 'delegatecall' || error.kind === 'selfdestruct';
+}
+
 interface ValidationErrorUpgradeability extends ValidationErrorBase {
   kind: 'missing-public-upgradeto';
 }
@@ -84,34 +104,49 @@ function* execall(re: RegExp, text: string) {
   }
 }
 
-function getAllowed(node: Node): string[] {
+function getAllowed(node: Node, reachable: boolean): string[] {
   if ('documentation' in node) {
+    const tag = `oz-upgrades-unsafe-allow${reachable ? '-reachable' : ''}`;
     const doc = typeof node.documentation === 'string' ? node.documentation : node.documentation?.text ?? '';
+    return getAnnotationArgs(doc, tag);
+  } else {
+    return [];
+  }
+}
 
-    const result: string[] = [];
-    for (const { groups } of execall(
-      /^\s*(?:@(?<title>\w+)(?::(?<tag>[a-z][a-z-]*))? )?(?<args>(?:(?!^\s@\w+)[^])*)/m,
-      doc,
-    )) {
-      if (groups && groups.title === 'custom' && groups.tag === 'oz-upgrades-unsafe-allow') {
-        result.push(...groups.args.split(/\s+/));
+/**
+ * Get args from the doc string matching the given tag
+ */
+export function getAnnotationArgs(doc: string, tag: string) {
+  const result: string[] = [];
+  for (const { groups } of execall(
+    /^\s*(?:@(?<title>\w+)(?::(?<tag>[a-z][a-z-]*))? )?(?<args>(?:(?!^\s*@\w+)[^])*)/m,
+    doc,
+  )) {
+    if (groups && groups.title === 'custom' && groups.tag === tag) {
+      const trimmedArgs = groups.args.trim();
+      if (trimmedArgs.length > 0) {
+        result.push(...trimmedArgs.split(/\s+/));
       }
     }
+  }
 
-    result.forEach(arg => {
-      if (!(errorKinds as readonly string[]).includes(arg)) {
-        throw new Error(`NatSpec: oz-upgrades-unsafe-allow argument not recognized: ${arg}`);
-      }
-    });
+  result.forEach(arg => {
+    if (!(errorKinds as readonly string[]).includes(arg)) {
+      throw new Error(`NatSpec: ${tag} argument not recognized: ${arg}`);
+    }
+  });
 
-    return result;
-  } else {
-    return [];
-  }
+  return result;
+}
+
+function skipCheckReachable(error: string, node: Node): boolean {
+  return getAllowed(node, true).includes(error);
 }
 
 function skipCheck(error: string, node: Node): boolean {
-  return getAllowed(node).includes(error);
+  // skip both allow and allow-reachable errors in the lexical scope
+  return getAllowed(node, false).includes(error) || getAllowed(node, true).includes(error);
 }
 
 function getFullyQualifiedName(source: string, contractName: string) {
@@ -163,7 +198,7 @@ export function validate(solcOutput: SolcOutput, decodeSrc: SrcDecoder, solcVers
         validation[key].src = decodeSrc(contractDef);
         validation[key].errors = [
           ...getConstructorErrors(contractDef, decodeSrc),
-          ...getOpcodeErrors(contractDef, decodeSrc),
+          ...getOpcodeErrors(contractDef, deref, decodeSrc),
           ...getStateVariableErrors(contractDef, decodeSrc),
           // TODO: add linked libraries support
           // https://github.com/OpenZeppelin/openzeppelin-upgrades/issues/52
@@ -206,27 +241,151 @@ function* getConstructorErrors(contractDef: ContractDefinition, decodeSrc: SrcDe
   }
 }
 
-function* getOpcodeErrors(contractDef: ContractDefinition, decodeSrc: SrcDecoder): Generator<ValidationErrorOpcode> {
-  for (const fnCall of findAll('FunctionCall', contractDef, node => skipCheck('delegatecall', node))) {
+function* getOpcodeErrors(
+  contractDef: ContractDefinition,
+  deref: ASTDereferencer,
+  decodeSrc: SrcDecoder,
+): Generator<ValidationErrorOpcode> {
+  yield* getContractOpcodeErrors(contractDef, deref, decodeSrc, OPCODES.delegatecall, 'main');
+  yield* getContractOpcodeErrors(contractDef, deref, decodeSrc, OPCODES.selfdestruct, 'main');
+}
+
+/**
+ * Whether this node is being visited as part of a main contract, or as an inherited contract or function
+ */
+type Scope = 'main' | 'inherited';
+
+function* getContractOpcodeErrors(
+  contractDef: ContractDefinition,
+  deref: ASTDereferencer,
+  decodeSrc: SrcDecoder,
+  opcode: OpcodePattern,
+  scope: Scope,
+  visitedNodeIds = new Map<number, Scope>(),
+): Generator<ValidationErrorOpcode> {
+  if (wasVisited(contractDef.id, scope, visitedNodeIds)) {
+    // We return early here, but the errors from this node were emitted when the node was marked as visited.
+    return;
+  } else {
+    visitedNodeIds.set(contractDef.id, scope);
+  }
+
+  yield* getFunctionOpcodeErrors(contractDef, deref, decodeSrc, opcode, scope, visitedNodeIds);
+  yield* getInheritedContractOpcodeErrors(contractDef, deref, decodeSrc, opcode, visitedNodeIds);
+}
+
+function wasVisited(key: number, scope: Scope, visitedNodeIds: Map<number, Scope>) {
+  return (
+    (scope === 'inherited' && visitedNodeIds.has(key)) || // looking up an inherited contract, and it was previously checked as a main contract OR inherited contract
+    (scope === 'main' && visitedNodeIds.get(key) === 'main') // looking up a main contract, and it was previously checked as a main contract
+  );
+}
+
+function* getFunctionOpcodeErrors(
+  contractOrFunctionDef: ContractDefinition | FunctionDefinition,
+  deref: ASTDereferencer,
+  decodeSrc: SrcDecoder,
+  opcode: OpcodePattern,
+  scope: Scope,
+  visitedNodeIds: Map<number, Scope>,
+): Generator<ValidationErrorOpcode> {
+  const parentContractDef = getParentDefinition(deref, contractOrFunctionDef);
+  if (parentContractDef === undefined || !skipCheck(opcode.kind, parentContractDef)) {
+    yield* getDirectFunctionOpcodeErrors(contractOrFunctionDef, decodeSrc, opcode, scope);
+  }
+  if (parentContractDef === undefined || !skipCheckReachable(opcode.kind, parentContractDef)) {
+    yield* getReferencedFunctionOpcodeErrors(contractOrFunctionDef, deref, decodeSrc, opcode, scope, visitedNodeIds);
+  }
+}
+
+function* getDirectFunctionOpcodeErrors(
+  contractOrFunctionDef: ContractDefinition | FunctionDefinition,
+  decodeSrc: SrcDecoder,
+  opcode: OpcodePattern,
+  scope: Scope,
+) {
+  for (const fnCall of findAll(
+    'FunctionCall',
+    contractOrFunctionDef,
+    node => skipCheck(opcode.kind, node) || (scope === 'inherited' && isInternalFunction(node)),
+  )) {
     const fn = fnCall.expression;
-    if (fn.typeDescriptions.typeIdentifier?.match(/^t_function_baredelegatecall_/)) {
+    if (fn.typeDescriptions.typeIdentifier?.match(opcode.pattern)) {
       yield {
-        kind: 'delegatecall',
+        kind: opcode.kind,
         src: decodeSrc(fnCall),
       };
     }
   }
-  for (const fnCall of findAll('FunctionCall', contractDef, node => skipCheck('selfdestruct', node))) {
+}
+
+function* getReferencedFunctionOpcodeErrors(
+  contractOrFunctionDef: ContractDefinition | FunctionDefinition,
+  deref: ASTDereferencer,
+  decodeSrc: SrcDecoder,
+  opcode: OpcodePattern,
+  scope: Scope,
+  visitedNodeIds: Map<number, Scope>,
+) {
+  for (const fnCall of findAll(
+    'FunctionCall',
+    contractOrFunctionDef,
+    node => skipCheckReachable(opcode.kind, node) || (scope === 'inherited' && isInternalFunction(node)),
+  )) {
     const fn = fnCall.expression;
-    if (fn.typeDescriptions.typeIdentifier?.match(/^t_function_selfdestruct_/)) {
-      yield {
-        kind: 'selfdestruct',
-        src: decodeSrc(fnCall),
-      };
+    if ('referencedDeclaration' in fn && fn.referencedDeclaration && fn.referencedDeclaration > 0) {
+      // non-positive references refer to built-in functions
+      const referencedNode = tryDerefFunction(deref, fn.referencedDeclaration);
+      if (referencedNode !== undefined) {
+        if (!wasVisited(referencedNode.id, scope, visitedNodeIds)) {
+          visitedNodeIds.set(referencedNode.id, scope);
+          yield* getFunctionOpcodeErrors(referencedNode, deref, decodeSrc, opcode, scope, visitedNodeIds);
+        }
+      }
     }
   }
 }
 
+function tryDerefFunction(deref: ASTDereferencer, referencedDeclaration: number): FunctionDefinition | undefined {
+  try {
+    return deref(['FunctionDefinition'], referencedDeclaration);
+  } catch (e: any) {
+    if (!e.message.includes('No node with id')) {
+      throw e;
+    }
+  }
+}
+
+function* getInheritedContractOpcodeErrors(
+  contractDef: ContractDefinition,
+  deref: ASTDereferencer,
+  decodeSrc: SrcDecoder,
+  opcode: OpcodePattern,
+  visitedNodeIds: Map<number, Scope>,
+) {
+  if (!skipCheckReachable(opcode.kind, contractDef)) {
+    for (const base of contractDef.baseContracts) {
+      const referencedContract = deref('ContractDefinition', base.baseName.referencedDeclaration);
+      yield* getContractOpcodeErrors(referencedContract, deref, decodeSrc, opcode, 'inherited', visitedNodeIds);
+    }
+  }
+}
+
+function getParentDefinition(deref: ASTDereferencer, contractOrFunctionDef: ContractDefinition | FunctionDefinition) {
+  const parentNode = deref(['ContractDefinition', 'SourceUnit'], contractOrFunctionDef.scope);
+  if (parentNode.nodeType === 'ContractDefinition') {
+    return parentNode;
+  }
+}
+
+function isInternalFunction(node: Node) {
+  return (
+    node.nodeType === 'FunctionDefinition' &&
+    node.kind !== 'constructor' && // do not consider constructors as internal, because they are always called by children contracts' constructors
+    (node.visibility === 'internal' || node.visibility === 'private')
+  );
+}
+
 function* getStateVariableErrors(
   contractDef: ContractDefinition,
   decodeSrc: SrcDecoder,

package/src/validate-ignore-errors.test.ts

@@ -0,0 +1,137 @@
+import _test, { TestFn } from 'ava';
+import { artifacts } from 'hardhat';
+
+import { validate, getContractVersion, assertUpgradeSafe, ValidationOptions, RunValidation } from './validate';
+import { solcInputOutputDecoder } from './src-decoder';
+
+interface Context {
+  validation: RunValidation;
+}
+
+const test = _test as TestFn<Context>;
+
+test.before(async t => {
+  const contracts = [
+    'contracts/test/ignore-errors/SafeContract.sol:SafeContract',
+    'contracts/test/ignore-errors/SafeContractWithFreeFunctionCall.sol:SafeContractWithFreeFunctionCall',
+    'contracts/test/ignore-errors/SafeContractWithLibraryCall.sol:SafeContractWithLibraryCall',
+    'contracts/test/ignore-errors/SafeContractWithLibraryImport.sol:SafeContractWithLibraryImport',
+    'contracts/test/ignore-errors/SafeContractWithLibraryUsingFor.sol:SafeContractWithLibraryUsingFor',
+    'contracts/test/ignore-errors/SafeContractWithTransitiveLibraryCall.sol:SafeContractWithTransitiveLibraryCall',
+    'contracts/test/ignore-errors/SafeContractWithParentCall.sol:SafeContractWithParentCall',
+    'contracts/test/ignore-errors/RiskyParentContract.sol:RiskyParentContract',
+    'contracts/test/ignore-errors/UnsafeContract.sol:UnsafeContract',
+    'contracts/test/ignore-errors/UnsafeContractWithFreeFunctionCall.sol:UnsafeContractWithFreeFunctionCall',
+    'contracts/test/ignore-errors/UnsafeContractWithLibraryCall.sol:UnsafeContractWithLibraryCall',
+    'contracts/test/ignore-errors/UnsafeContractWithLibraryUsingFor.sol:UnsafeContractWithLibraryUsingFor',
+    'contracts/test/ignore-errors/UnsafeContractWithTransitiveLibraryCall.sol:UnsafeContractWithTransitiveLibraryCall',
+    'contracts/test/ignore-errors/UnsafeContractWithParentCall.sol:UnsafeContractWithParentCall',
+    'contracts/test/ignore-errors/UnsafeContractWithInheritedParent.sol:UnsafeContractWithInheritedParent',
+    'contracts/test/ignore-errors/UnsafeContractWithInheritedTransitiveParent.sol:UnsafeContractWithInheritedTransitiveParent',
+    'contracts/test/ignore-errors/UnsafeAllow.sol:UnsafeAllow',
+    'contracts/test/ignore-errors/AllowReachable.sol:AllowReachable',
+    'contracts/test/ignore-errors/UnsafeAllowReachableDifferentOpcode.sol:UnsafeAllowReachableDifferentOpcode',
+    'contracts/test/ignore-errors/UnsafeAllowParent.sol:UnsafeAllowParent',
+    'contracts/test/ignore-errors/AllowReachableParent.sol:AllowReachableParent',
+    'contracts/test/ignore-errors/UnsafeAllowReachableParentDifferentOpcode.sol:UnsafeAllowReachableParentDifferentOpcode',
+    'contracts/test/ignore-errors/AllowChildInheritedTransitive.sol:AllowChildInheritedTransitive',
+    'contracts/test/ignore-errors/AllowChild.sol:AllowChild',
+    'contracts/test/ignore-errors/AllowChildCallTransitive.sol:AllowChildCallTransitive',
+    'contracts/test/ignore-errors/AllowChildSelfReachable.sol:AllowChildSelfReachable',
+    'contracts/test/ignore-errors/SafeRecursion.sol:SafeRecursion',
+    'contracts/test/ignore-errors/UnsafeRecursion.sol:UnsafeRecursion',
+    'contracts/test/ignore-errors/Constructors.sol:UnsafeChild1',
+    'contracts/test/ignore-errors/Constructors.sol:UnsafeChild2',
+    'contracts/test/ignore-errors/Constructors.sol:UnsafeChild3',
+    'contracts/test/ignore-errors/Constructors.sol:UnsafeChild4',
+    'contracts/test/ignore-errors/Constructors.sol:AllowChild5',
+    'contracts/test/ignore-errors/Constructors.sol:AllowChild6',
+    'contracts/test/ignore-errors/Constructors.sol:UnsafeAllowChild7',
+    'contracts/test/ignore-errors/Constructors.sol:AllowReachableChild8',
+    'contracts/test/ignore-errors/Constructors.sol:UnsafeChild9',
+    // 'contracts/test/ignore-errors/Modifiers.sol:ModifierNotUsed',
+    'contracts/test/ignore-errors/Modifiers.sol:ModifierUsed',
+  ];
+
+  t.context.validation = {} as RunValidation;
+  for (const contract of contracts) {
+    const buildInfo = await artifacts.getBuildInfo(contract);
+    if (buildInfo === undefined) {
+      throw new Error(`Build info not found for contract ${contract}`);
+    }
+    const solcOutput = buildInfo.output;
+    const solcInput = buildInfo.input;
+    const decodeSrc = solcInputOutputDecoder(solcInput, solcOutput);
+    Object.assign(t.context.validation, validate(solcOutput, decodeSrc));
+  }
+});
+
+function testValid(name: string, kind: ValidationOptions['kind'], valid: boolean) {
+  testOverride(name, kind, {}, valid);
+}
+
+function testOverride(name: string, kind: ValidationOptions['kind'], opts: ValidationOptions, valid: boolean) {
+  const optKeys = Object.keys(opts);
+  const describeOpts = optKeys.length > 0 ? '(' + optKeys.join(', ') + ')' : '';
+  const testName = [valid ? 'accepts' : 'rejects', kind, name, describeOpts].join(' ');
+  test(testName, t => {
+    const version = getContractVersion(t.context.validation, name);
+    const assertUpgSafe = () => assertUpgradeSafe([t.context.validation], version, { kind, ...opts });
+    if (valid) {
+      t.notThrows(assertUpgSafe);
+    } else {
+      t.throws(assertUpgSafe);
+    }
+  });
+}
+
+testValid('SafeContract', 'transparent', true);
+testValid('SafeContractWithFreeFunctionCall', 'transparent', true);
+testValid('SafeContractWithLibraryCall', 'transparent', true);
+testValid('SafeContractWithLibraryImport', 'transparent', true);
+testValid('SafeContractWithLibraryUsingFor', 'transparent', true);
+testValid('SafeContractWithTransitiveLibraryCall', 'transparent', true);
+testValid('SafeContractWithParentCall', 'transparent', true);
+
+testValid('RiskyParentContract', 'transparent', false);
+
+testValid('UnsafeContract', 'transparent', false);
+testValid('UnsafeContractWithFreeFunctionCall', 'transparent', false);
+testValid('UnsafeContractWithLibraryCall', 'transparent', false);
+testValid('UnsafeContractWithLibraryUsingFor', 'transparent', false);
+testValid('UnsafeContractWithTransitiveLibraryCall', 'transparent', false);
+testValid('UnsafeContractWithParentCall', 'transparent', false);
+testValid('UnsafeContractWithInheritedParent', 'transparent', false);
+testValid('UnsafeContractWithInheritedTransitiveParent', 'transparent', false);
+
+testValid('UnsafeAllow', 'transparent', false);
+testValid('AllowReachable', 'transparent', true);
+testValid('UnsafeAllowReachableDifferentOpcode', 'transparent', false);
+
+testValid('UnsafeAllowParent', 'transparent', false);
+testValid('AllowReachableParent', 'transparent', true);
+testValid('UnsafeAllowReachableParentDifferentOpcode', 'transparent', false);
+
+testValid('AllowChildInheritedTransitive', 'transparent', true);
+testValid('AllowChild', 'transparent', true);
+testValid('AllowChildCallTransitive', 'transparent', true);
+
+testValid('AllowChildSelfReachable', 'transparent', true);
+
+testValid('SafeRecursion', 'transparent', true);
+testValid('UnsafeRecursion', 'transparent', false);
+
+testValid('UnsafeChild1', 'transparent', false);
+testValid('UnsafeChild2', 'transparent', false);
+testValid('UnsafeChild3', 'transparent', false);
+testValid('UnsafeChild4', 'transparent', false);
+testValid('AllowChild5', 'transparent', true);
+testValid('AllowChild6', 'transparent', true);
+testValid('UnsafeAllowChild7', 'transparent', false);
+testValid('AllowReachableChild8', 'transparent', true);
+testValid('UnsafeChild9', 'transparent', false);
+
+// TODO: do not throw an error in this case
+// testValid('ModifierNotUsed', 'transparent', true);
+
+testValid('ModifierUsed', 'transparent', false);