@snovon/solast 0.2.0

package/dist/detectors/unvalidated-interface-address.js

@@ -0,0 +1,377 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UnvalidatedInterfaceAddressDetector = void 0;
+const ast_1 = require("./_common/ast");
+const RULE_ID = 'unvalidated-interface-address';
+const PATTERN = `${RULE_ID}/constructor-parameter-store`;
+class UnvalidatedInterfaceAddressDetector {
+    id = RULE_ID;
+    patternKey = RULE_ID;
+    supportedAstKinds = ['parser'];
+    descriptor = {
+        id: RULE_ID,
+        shortDescription: 'Constructor address parameters should be validated before being stored as interface dependencies.',
+        helpUri: 'https://snovon.com/',
+        defaultSeverity: 'low',
+        help: 'Validate constructor-supplied interface or address dependencies with a zero-address or code-presence guard before storing them in contract/interface-typed state.',
+    };
+    currentFile = '';
+    findings = [];
+    contract = null;
+    userDefinedTypes = emptyUserDefinedTypeIndex();
+    setFile(file) {
+        this.currentFile = file;
+        this.findings = [];
+        this.contract = null;
+        this.userDefinedTypes = emptyUserDefinedTypeIndex();
+    }
+    getFindings() {
+        return this.findings;
+    }
+    SourceUnit(node) {
+        this.userDefinedTypes = collectUserDefinedTypeIndex(node);
+    }
+    ContractDefinition(node) {
+        if (!(0, ast_1.isNode)(node, 'ContractDefinition') || node?.kind === 'interface' || node?.kind === 'library') {
+            this.contract = null;
+            return;
+        }
+        this.contract = {
+            name: String(node?.name || '<anonymous>'),
+            node,
+            storageInterfaceVars: collectStorageInterfaceVars(node, this.userDefinedTypes),
+            validatingModifiers: collectValidatingModifiers(node),
+        };
+    }
+    ContractDefinition_post(_node) {
+        this.contract = null;
+    }
+    ['ContractDefinition:exit'](node) {
+        this.ContractDefinition_post(node);
+    }
+    FunctionDefinition(node) {
+        if (!this.contract || !node?.isConstructor || !node?.body)
+            return;
+        const trackedParams = collectConstructorParams(node);
+        if (trackedParams.size === 0 || this.contract.storageInterfaceVars.size === 0)
+            return;
+        const validated = new Set();
+        this.applyModifierValidations(node, trackedParams, validated);
+        for (const statement of node.body.statements || []) {
+            for (const paramName of trackedParams) {
+                if (statementValidatesParam(statement, paramName))
+                    validated.add(paramName);
+            }
+            const assignment = storageAssignmentFromParam(statement, this.contract.storageInterfaceVars, trackedParams);
+            if (!assignment || validated.has(assignment.paramName))
+                continue;
+            this.findings.push(makeFinding(this.currentFile, this.contract.name, '<constructor>', assignment.node, node, assignment.paramName, assignment.storageName));
+        }
+    }
+    applyModifierValidations(fn, trackedParams, validated) {
+        if (!this.contract)
+            return;
+        for (const modifier of fn.modifiers || []) {
+            const modifierDef = this.contract.validatingModifiers.get(String(modifier?.name || ''));
+            if (!modifierDef)
+                continue;
+            const params = modifierDef.parameters || [];
+            const args = modifier.arguments || [];
+            for (let i = 0; i < params.length; i++) {
+                const modifierParam = String(params[i]?.name || '');
+                const constructorArg = identifierName(args[i]);
+                if (!modifierParam || !constructorArg || !trackedParams.has(constructorArg))
+                    continue;
+                if (modifierValidatesParam(modifierDef, modifierParam))
+                    validated.add(constructorArg);
+            }
+        }
+    }
+}
+exports.UnvalidatedInterfaceAddressDetector = UnvalidatedInterfaceAddressDetector;
+function makeFinding(file, contractName, functionName, node, fallbackNode, paramName, storageName) {
+    const loc = (0, ast_1.assertLoc)(node, fallbackNode);
+    return {
+        file,
+        contract: contractName,
+        'function': functionName,
+        line: loc.line,
+        endLine: loc.endLine,
+        column: loc.column,
+        ruleId: RULE_ID,
+        pattern: PATTERN,
+        severity: 'low',
+        confidence: 'medium',
+        category: 'input-validation',
+        message: `Constructor parameter '${paramName}' is stored in interface-typed state '${storageName}' ` +
+            `without a preceding zero-address or code-presence validation.`,
+        findingId: '',
+        contractHash: '',
+        contractName,
+        functionName,
+        sourceLocation: { line: loc.line, column: loc.column },
+    };
+}
+function emptyUserDefinedTypeIndex() {
+    return {
+        contractLike: new Set(),
+        excluded: new Set(),
+    };
+}
+function collectUserDefinedTypeIndex(sourceUnit) {
+    const index = emptyUserDefinedTypeIndex();
+    for (const child of sourceUnit?.children || []) {
+        if ((0, ast_1.isNode)(child, 'ContractDefinition') && child?.name && child?.kind !== 'library') {
+            index.contractLike.add(String(child.name));
+            collectContractExcludedTypes(child, index.excluded);
+        }
+        else if ((0, ast_1.isNode)(child, 'ContractDefinition') && child?.name && child?.kind === 'library') {
+            index.excluded.add(String(child.name));
+        }
+        else if (((0, ast_1.isNode)(child, 'StructDefinition') || (0, ast_1.isNode)(child, 'EnumDefinition')) && child?.name) {
+            index.excluded.add(String(child.name));
+        }
+        else if ((0, ast_1.isNode)(child, 'ImportDirective')) {
+            collectImportedSymbolNames(child, index.contractLike);
+        }
+    }
+    return index;
+}
+function collectContractExcludedTypes(contract, excluded) {
+    for (const subNode of contract?.subNodes || []) {
+        if (((0, ast_1.isNode)(subNode, 'StructDefinition') || (0, ast_1.isNode)(subNode, 'EnumDefinition')) && subNode?.name) {
+            excluded.add(String(subNode.name));
+        }
+    }
+}
+function collectImportedSymbolNames(importDirective, names) {
+    for (const entry of importDirective?.symbolAliases || []) {
+        const local = importAliasLocalName(entry);
+        if (local)
+            names.add(local);
+    }
+}
+function importAliasLocalName(entry) {
+    if (!entry)
+        return '';
+    if (Array.isArray(entry))
+        return aliasName(entry[1]) || aliasName(entry[0]);
+    return aliasName(entry.local) || aliasName(entry.alias) || aliasName(entry.name);
+}
+function aliasName(value) {
+    if (!value)
+        return '';
+    if (typeof value === 'string')
+        return value;
+    if (typeof value?.name === 'string')
+        return value.name;
+    return '';
+}
+function collectStorageInterfaceVars(contract, userDefinedTypes) {
+    const vars = new Set();
+    for (const subNode of contract?.subNodes || []) {
+        if (!(0, ast_1.isNode)(subNode, 'StateVariableDeclaration'))
+            continue;
+        for (const variable of subNode.variables || []) {
+            const name = String(variable?.name || '');
+            if (!name || variable?.isDeclaredConst || variable?.isImmutable)
+                continue;
+            if (isContractLikeType(variable?.typeName, userDefinedTypes))
+                vars.add(name);
+        }
+    }
+    return vars;
+}
+function collectValidatingModifiers(contract) {
+    const modifiers = new Map();
+    for (const subNode of contract?.subNodes || []) {
+        if ((0, ast_1.isNode)(subNode, 'ModifierDefinition') && subNode?.name) {
+            modifiers.set(String(subNode.name), subNode);
+        }
+    }
+    return modifiers;
+}
+function collectConstructorParams(fn) {
+    const params = new Set();
+    for (const param of fn?.parameters || []) {
+        const name = String(param?.name || '');
+        if (!name)
+            continue;
+        if (isAddressType(param?.typeName) || (0, ast_1.isNode)(param?.typeName, 'UserDefinedTypeName')) {
+            params.add(name);
+        }
+    }
+    return params;
+}
+function isContractLikeType(typeName, userDefinedTypes) {
+    if (!(0, ast_1.isNode)(typeName, 'UserDefinedTypeName'))
+        return false;
+    const name = userDefinedName(typeName);
+    if (!name)
+        return true;
+    if (userDefinedTypes.excluded.has(name))
+        return false;
+    if (userDefinedTypes.contractLike.has(name))
+        return true;
+    // Unknown UDT — typically file-level imports without symbol aliases (`import "./IFoo.sol";`).
+    // Default to in-scope so cross-file interface dependencies aren't silently missed.
+    return true;
+}
+function isAddressType(typeName) {
+    return (0, ast_1.isNode)(typeName, 'ElementaryTypeName') && String(typeName?.name || '') === 'address';
+}
+function userDefinedName(typeName) {
+    const path = String(typeName?.namePath || typeName?.name || '');
+    const parts = path.split('.');
+    return parts[parts.length - 1] || path;
+}
+function storageAssignmentFromParam(statement, storageVars, trackedParams) {
+    if (!(0, ast_1.isNode)(statement, 'ExpressionStatement'))
+        return null;
+    const expression = statement.expression;
+    if (!(0, ast_1.isNode)(expression, 'BinaryOperation') || expression.operator !== '=')
+        return null;
+    const storageName = identifierName(expression.left);
+    if (!storageName || !storageVars.has(storageName))
+        return null;
+    const paramName = assignedParamName(expression.right);
+    if (!paramName || !trackedParams.has(paramName))
+        return null;
+    return { node: expression, paramName, storageName };
+}
+function assignedParamName(expression) {
+    const direct = identifierName(expression);
+    if (direct)
+        return direct;
+    if ((0, ast_1.isNode)(expression, 'FunctionCall') && (expression.arguments || []).length === 1) {
+        return identifierName(expression.arguments[0]);
+    }
+    return '';
+}
+function statementValidatesParam(statement, paramName) {
+    if ((0, ast_1.isNode)(statement, 'ExpressionStatement')) {
+        const expr = statement.expression;
+        if (isRequireOrAssertCall(expr)) {
+            return expressionValidatesParam(expr.arguments?.[0], paramName, true);
+        }
+    }
+    if ((0, ast_1.isNode)(statement, 'IfStatement') && statementContainsRevert(statement.trueBody)) {
+        return expressionValidatesParam(statement.condition, paramName, false);
+    }
+    return false;
+}
+function modifierValidatesParam(modifierDef, paramName) {
+    for (const statement of modifierDef?.body?.statements || []) {
+        if ((0, ast_1.isNode)(statement, 'ExpressionStatement') && identifierName(statement.expression) === '_')
+            break;
+        if (statementValidatesParam(statement, paramName))
+            return true;
+    }
+    return false;
+}
+function expressionValidatesParam(expression, paramName, truthyMeansSafe) {
+    if (!expression)
+        return false;
+    if ((0, ast_1.isNode)(expression, 'BinaryOperation')) {
+        if (isZeroAddressGuard(expression, paramName, truthyMeansSafe))
+            return true;
+        if (isCodeLengthGuard(expression, paramName, truthyMeansSafe))
+            return true;
+    }
+    if ((0, ast_1.isNode)(expression, 'UnaryOperation') && expression.operator === '!') {
+        return expressionValidatesParam(expression.subExpression, paramName, !truthyMeansSafe);
+    }
+    return false;
+}
+function isZeroAddressGuard(expression, paramName, truthyMeansSafe) {
+    const expectedOperator = truthyMeansSafe ? '!=' : '==';
+    if (expression.operator !== expectedOperator)
+        return false;
+    return ((expressionReferencesParam(expression.left, paramName) && isZeroAddress(expression.right)) ||
+        (expressionReferencesParam(expression.right, paramName) && isZeroAddress(expression.left)));
+}
+function isCodeLengthGuard(expression, paramName, truthyMeansSafe) {
+    const left = codeLengthParamName(expression.left);
+    const right = codeLengthParamName(expression.right);
+    if (truthyMeansSafe) {
+        if (left === paramName && isZeroLiteral(expression.right) && (expression.operator === '>' || expression.operator === '!='))
+            return true;
+        if (right === paramName && isZeroLiteral(expression.left) && expression.operator === '<')
+            return true;
+        return false;
+    }
+    if (left === paramName && isZeroLiteral(expression.right) && (expression.operator === '==' || expression.operator === '<='))
+        return true;
+    if (right === paramName && isZeroLiteral(expression.left) && expression.operator === '>=')
+        return true;
+    return false;
+}
+function expressionReferencesParam(expression, paramName) {
+    if (identifierName(expression) === paramName)
+        return true;
+    if ((0, ast_1.isNode)(expression, 'FunctionCall') && (expression.arguments || []).length === 1) {
+        return expressionReferencesParam(expression.arguments[0], paramName);
+    }
+    return false;
+}
+function codeLengthParamName(expression) {
+    if (!(0, ast_1.isNode)(expression, 'MemberAccess') || expression.memberName !== 'length')
+        return '';
+    const codeAccess = expression.expression;
+    if (!(0, ast_1.isNode)(codeAccess, 'MemberAccess') || codeAccess.memberName !== 'code')
+        return '';
+    const base = codeAccess.expression;
+    if (identifierName(base))
+        return identifierName(base);
+    if ((0, ast_1.isNode)(base, 'FunctionCall') && (base.arguments || []).length === 1) {
+        return identifierName(base.arguments[0]);
+    }
+    return '';
+}
+function isRequireOrAssertCall(expression) {
+    if (!(0, ast_1.isNode)(expression, 'FunctionCall'))
+        return false;
+    const name = identifierName(expression.expression);
+    return name === 'require' || name === 'assert';
+}
+function statementContainsRevert(statement) {
+    if (!statement)
+        return false;
+    if ((0, ast_1.isNode)(statement, 'RevertStatement') || (0, ast_1.isNode)(statement, 'ThrowStatement'))
+        return true;
+    if ((0, ast_1.isNode)(statement, 'Block')) {
+        return (statement.statements || []).some(statementContainsRevert);
+    }
+    if ((0, ast_1.isNode)(statement, 'ExpressionStatement') && (0, ast_1.isNode)(statement.expression, 'FunctionCall')) {
+        return identifierName(statement.expression.expression) === 'revert';
+    }
+    return false;
+}
+function isZeroAddress(expression) {
+    if (isZeroLiteral(expression))
+        return true;
+    if (!(0, ast_1.isNode)(expression, 'FunctionCall'))
+        return false;
+    const name = identifierName(expression.expression);
+    if (name === 'address' && (expression.arguments || []).length === 1) {
+        return isZeroLiteral(expression.arguments[0]);
+    }
+    if ((expression.arguments || []).length === 1) {
+        return isZeroAddress(expression.arguments[0]);
+    }
+    return false;
+}
+function isZeroLiteral(expression) {
+    if ((0, ast_1.isNode)(expression, 'NumberLiteral')) {
+        const value = String(expression.number || expression.value || '');
+        return value === '0' || value === '0x0';
+    }
+    if ((0, ast_1.isNode)(expression, 'HexNumber')) {
+        return /^0x0*$/i.test(String(expression.value || ''));
+    }
+    return false;
+}
+function identifierName(expression) {
+    return (0, ast_1.isNode)(expression, 'Identifier') ? String(expression.name || '') : '';
+}
+//# sourceMappingURL=unvalidated-interface-address.js.map

package/dist/detectors/uups-uninitialized-storage.d.ts

@@ -0,0 +1,9 @@
+import type { ScanResult } from '../index';
+export declare class UupsUninitializedStorageDetector {
+    readonly id = "uups-uninitialized-storage";
+    readonly patternKey = "uups-uninitialized-storage";
+    readonly supportedAstKinds: "parser"[];
+    scanAst(ast: any, file: string): ScanResult[];
+    private findUninitializedStoragePointers;
+    private findUninitializedUpgradeAuthority;
+}