From 93ee7e2856afe27068571560a6a90d45918f3491 Mon Sep 17 00:00:00 2001 From: Kieran Eglin Date: Wed, 21 Feb 2024 09:32:19 -0800 Subject: [PATCH] Added static code analysis --- .check.exs | 12 +++++++++--- .sobelow-conf | 15 +++++++++++++++ ideas.md | 1 + mix.exs | 3 ++- mix.lock | 1 + 5 files changed, 28 insertions(+), 4 deletions(-) create mode 100644 .sobelow-conf diff --git a/.check.exs b/.check.exs index b214c41..ea8f94c 100644 --- a/.check.exs +++ b/.check.exs @@ -3,10 +3,10 @@ # parallel: false, ## don't print info about skipped tools - # skipped: false, + skipped: false, ## always run tools in fix mode (put it in ~/.check.exs locally, not in project config) - # fix: true, + fix: true, ## don't retry automatically even if last run resulted in failures # retry: false, @@ -14,7 +14,13 @@ ## list of tools (see `mix check` docs for a list of default curated tools) tools: [ {:compiler, env: %{"MIX_ENV" => "test"}}, - {:formatter, env: %{"MIX_ENV" => "test"}} + {:formatter, env: %{"MIX_ENV" => "test"}}, + {:sobelow, "mix sobelow --config"}, + # TODO: delete these and replace them with builtin ex_unit and formatter tools + # once Elixir 1.16.2 is released (see: https://github.com/karolsluszniak/ex_check/issues/41#issuecomment-1921390413) + {:elixir_tests, "mix test"}, + {:elixir_formatting, "mix format --check-formatted", fix: "mix format"}, + {:prettier_formatting, "yarn run prettier . --check", fix: "yarn run prettier . --write"} ## curated tools may be disabled (e.g. the check for compilation warnings) # {:compiler, false}, diff --git a/.sobelow-conf b/.sobelow-conf new file mode 100644 index 0000000..ed5bb1f --- /dev/null +++ b/.sobelow-conf @@ -0,0 +1,15 @@ +[ + verbose: false, + private: false, + skip: false, + router: nil, + exit: :medium, + format: "txt", + out: nil, + threshold: :low, + # All of these are ignorable because this app is intended to be single-user and self-hosted. + # There is an expectation that the user won't intentionally run a FS Traversal on themselves + ignore: ["CI.System", "Traversal.FileModule", "Config.HTTPS", "Config.CSP"], + ignore_files: [], + version: false +] diff --git a/ideas.md b/ideas.md index f46a327..93f1859 100644 --- a/ideas.md +++ b/ideas.md @@ -3,3 +3,4 @@ - Look into this and its recommended plugins https://hexdocs.pm/ex_check/readme.html - Add output template option for the source's friendly name - TODO: Install Elixir 1.16.2 when available to fix bug with `ex_check` https://github.com/karolsluszniak/ex_check/issues/41#issuecomment-1921390413 + - delete `{:elixir_tests, "mix test"}` and formatting check diff --git a/mix.exs b/mix.exs index 95fda31..7f3e61b 100644 --- a/mix.exs +++ b/mix.exs @@ -60,7 +60,8 @@ defmodule Pinchflat.MixProject do {:mox, "~> 1.0", only: :test}, {:credo, "~> 1.7", only: [:dev, :test], runtime: false}, {:ex_check, "~> 0.14.0", only: [:dev, :test], runtime: false}, - {:faker, "~> 0.17", only: :test} + {:faker, "~> 0.17", only: :test}, + {:sobelow, "~> 0.13", only: [:dev, :test], runtime: false} ] end diff --git a/mix.lock b/mix.lock index f01aeb8..e4f4777 100644 --- a/mix.lock +++ b/mix.lock @@ -43,6 +43,7 @@ "plug_cowboy": {:hex, :plug_cowboy, "2.6.1", "9a3bbfceeb65eff5f39dab529e5cd79137ac36e913c02067dba3963a26efe9b2", [:mix], [{:cowboy, "~> 2.7", [hex: :cowboy, repo: "hexpm", optional: false]}, {:cowboy_telemetry, "~> 0.3", [hex: :cowboy_telemetry, repo: "hexpm", optional: false]}, {:plug, "~> 1.14", [hex: :plug, repo: "hexpm", optional: false]}], "hexpm", "de36e1a21f451a18b790f37765db198075c25875c64834bcc82d90b309eb6613"}, "plug_crypto": {:hex, :plug_crypto, "2.0.0", "77515cc10af06645abbfb5e6ad7a3e9714f805ae118fa1a70205f80d2d70fe73", [:mix], [], "hexpm", "53695bae57cc4e54566d993eb01074e4d894b65a3766f1c43e2c61a1b0f45ea9"}, "ranch": {:hex, :ranch, "1.8.0", "8c7a100a139fd57f17327b6413e4167ac559fbc04ca7448e9be9057311597a1d", [:make, :rebar3], [], "hexpm", "49fbcfd3682fab1f5d109351b61257676da1a2fdbe295904176d5e521a2ddfe5"}, + "sobelow": {:hex, :sobelow, "0.13.0", "218afe9075904793f5c64b8837cc356e493d88fddde126a463839351870b8d1e", [:mix], [{:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}], "hexpm", "cd6e9026b85fc35d7529da14f95e85a078d9dd1907a9097b3ba6ac7ebbe34a0d"}, "swoosh": {:hex, :swoosh, "1.14.4", "94e9dba91f7695a10f49b0172c4a4cb658ef24abef7e8140394521b7f3bbb2d4", [:mix], [{:cowboy, "~> 1.1 or ~> 2.4", [hex: :cowboy, repo: "hexpm", optional: true]}, {:ex_aws, "~> 2.1", [hex: :ex_aws, repo: "hexpm", optional: true]}, {:finch, "~> 0.6", [hex: :finch, repo: "hexpm", optional: true]}, {:gen_smtp, "~> 0.13 or ~> 1.0", [hex: :gen_smtp, repo: "hexpm", optional: true]}, {:hackney, "~> 1.9", [hex: :hackney, repo: "hexpm", optional: true]}, {:jason, "~> 1.0", [hex: :jason, repo: "hexpm", optional: false]}, {:mail, "~> 0.2", [hex: :mail, repo: "hexpm", optional: true]}, {:mime, "~> 1.1 or ~> 2.0", [hex: :mime, repo: "hexpm", optional: false]}, {:plug, "~> 1.9", [hex: :plug, repo: "hexpm", optional: true]}, {:plug_cowboy, ">= 1.0.0", [hex: :plug_cowboy, repo: "hexpm", optional: true]}, {:req, "~> 0.4 or ~> 1.0", [hex: :req, repo: "hexpm", optional: true]}, {:telemetry, "~> 0.4.2 or ~> 1.0", [hex: :telemetry, repo: "hexpm", optional: false]}], "hexpm", "081c5a590e4ba85cc89baddf7b2beecf6c13f7f84a958f1cd969290815f0f026"}, "tailwind": {:hex, :tailwind, "0.2.2", "9e27288b568ede1d88517e8c61259bc214a12d7eed271e102db4c93fcca9b2cd", [:mix], [{:castore, ">= 0.0.0", [hex: :castore, repo: "hexpm", optional: false]}], "hexpm", "ccfb5025179ea307f7f899d1bb3905cd0ac9f687ed77feebc8f67bdca78565c4"}, "telemetry": {:hex, :telemetry, "1.2.1", "68fdfe8d8f05a8428483a97d7aab2f268aaff24b49e0f599faa091f1d4e7f61c", [:rebar3], [], "hexpm", "dad9ce9d8effc621708f99eac538ef1cbe05d6a874dd741de2e689c47feafed5"},