commit 49b2b716aaa4fdc186202584fefccbc1ce62c479
Author: Matthew Finkel <sysrqb(a)torproject.org>
Date: Thu Jan 21 21:23:21 2021 +0000
Bug 40010: Use full patch diff for code audit
---
audits/java_audit.sh | 28 ++++++++++++++++++----------
1 file changed, 18 insertions(+), 10 deletions(-)
diff --git a/audits/java_audit.sh b/audits/java_audit.sh
index 1417011..b1183eb 100644
--- a/audits/java_audit.sh
+++ b/audits/java_audit.sh
@@ -11,6 +11,7 @@ OLD=$2
NEW=$3
SCOPE="java" # string: this is the java audit
+EXT="java kt"
declare -a KEYWORDS
@@ -62,21 +63,28 @@ KEYWORDS+=("::get\(")
cd $REPO_DIR
-if [ ! -f "release-${OLD}-${NEW}.diff" ];
-then
- echo "Diffing release-${OLD}-${NEW}.diff"
- git diff --color=always --color-moved $OLD $NEW -U20 > release-${OLD}-${NEW}.diff
-fi
-
-echo "Done with diff"
-
+# Step 1: Generate match pattern based on in-scope keywords
function join_by { local d=$1; shift; local f=$1; shift; printf %s "$f" "${@/#/$d}"; }
GREP_LINE="$(join_by \| ${KEYWORDS[@]})"
+# Step 2: Obtain patches for all in-scope files where a keyword is present
+echo "Diffing patches-${OLD}-${NEW}-${SCOPE}.diff"
+path=
+for ext in ${EXT}; do
+ path="${path} *.${ext}"
+done
+# Exclude Deleted and Unmerged files from diff
+DIFF_FILTER=ACMRTXB
+git diff --color=always --color-moved --diff-filter="${DIFF_FILTER}" -U20 -G"${GREP_LINE}" $OLD $NEW -- ${path} > patches-${OLD}-${NEW}-${SCOPE}.diff
+
+# Step 3: Highlight the keyword with an annoying, flashing color
export GREP_COLOR="05;37;41"
+# Capture the entire file and/or overlap with the previous match, add GREP_COLOR highlighting
+egrep -A10000 -B10000 --color=always "${GREP_LINE}" patches-${OLD}-${NEW}-${SCOPE}.diff > keywords-$OLD-$NEW-$SCOPE.diff
-# XXX: Arg this sometimes misses file context
-egrep -A40 -B40 --color=always "${GREP_LINE}" release-${OLD}-${NEW}.diff > keywords-${OLD}-${NEW}-$SCOPE.diff
+# Add a 'XXX MATCH XXX' at the end of each matched line, easily searchable.
+sed -i 's/\(\x1b\[05;37;41.*\)/\1 XXX MATCH XXX/' keywords-$OLD-$NEW-$SCOPE.diff
+# Step 4: Review the code changes
echo "Diff generated. View it with:"
echo " less -R $REPO_DIR/keywords-$OLD-$NEW-$SCOPE.diff"