Remove extract_symbols_regex and all its helpers (parse_impl_type,
qualify_fn_name, is_std_trait, skip_balanced_angles, find_top_level_keyword)
plus all 17 regex-specific tests. The AST path is the only extraction
method now — files that fail to parse are skipped with a warning rather
than falling back to brittle regex matching.
-853 lines of regex code that was the source of every symbol extraction
bug (for leaks, where leaks, trait-as-type, duplicates, <method>
placeholders).
https://claude.ai/code/session_01P1LKP6aqGt68rQAXrF6kSE
Instead of regex-matching unified diff lines, the enrichment pipeline
now fetches the full before/after file contents from GitHub, parses
them with syn::parse_file, walks the AST to extract all fn items with
their fully-qualified paths (including impl block context), and diffs
the two symbol sets to classify Added/Modified/Deleted.
This eliminates entire classes of regex bugs:
- impl Trait for Type: syn's ItemImpl has separate trait_ and self_ty
fields, so the implementing type is always correct
- where clauses: parsed into generics.where_clause, never in the type
- nested generics: syn handles all nesting correctly
- #[cfg(test)] modules: checked via attributes, not path heuristics
- Duplicate symbols: set-based diffing produces each symbol exactly once
Falls back to regex per-file when:
- AST parsing fails (syntax errors, macro-heavy files)
- File contents can't be fetched (missing metadata, API errors)
- File didn't exist at either ref (handled as all-Added or all-Deleted)
New files:
- src/ast_differ.rs: AST visitor + symbol set diffing (8 tests)
Changes:
- src/github.rs: Added parent_sha, owner, repo to PatchDiff;
added fetch_file_contents() for raw file retrieval
- src/diff_analyzer.rs: extract_symbols() now tries AST first;
regex path renamed to extract_symbols_regex()
- Cargo.toml: Added quote dependency for token stream hashing
https://claude.ai/code/session_01P1LKP6aqGt68rQAXrF6kSE
Bug 4 - Duplicate symbols (~43 entries, 195 extra): When a fn signature
was both deleted and added (modified), each line independently produced
a symbol. Added dedup to the fn-declaration path that upgrades existing
entries to Modified instead of adding duplicates.
Bug 5 - Trait name as type (~146 symbols): Truncated hunk headers like
`impl From<X>` (without `for ActualType`) caused the trait name to be
captured as the implementing type, producing wrong symbols like
`From::from`. Added is_std_trait() blocklist to return None for
well-known traits when `for` is absent, falling through to the safer
`<method>` placeholder.
Added 4 regression tests. All 51 tests pass.
https://claude.ai/code/session_01P1LKP6aqGt68rQAXrF6kSE
The old --existing-db flag skipped already-enriched entries by advisory
ID, so improvements to diff_analyzer.rs had no effect on the committed
vuln_db.json. The new --re-enrich flag re-fetches diffs for existing
entries and re-extracts symbols using the current code, updating them
in-place.
The CI enrich job now passes --re-enrich so that code changes to the
symbol extraction pipeline are reflected in the PR's vuln_db.json diff.
https://claude.ai/code/session_01P1LKP6aqGt68rQAXrF6kSE
Replaces the old enrichment-dry-run job with an enrich job that:
- Only runs on pull requests (not push to main)
- Checks out the PR branch (not merge ref) so it can push back
- Builds with --release for faster enrichment
- Uses --existing-db to resume from the committed vuln_db.json
- Enriches up to 20 new advisories with a 25-min timeout
- Commits and pushes updated vuln_db.json if it changed
- Also uploads as an artifact for inspection
The workflow has contents: write permission so the bot can push
commits to the PR branch.
https://claude.ai/code/session_01P1LKP6aqGt68rQAXrF6kSE
1. Fix `for` keyword leaking into symbol names (~14 entries): replaced
greedy regex `<.*>` with bracket-counting parser `parse_impl_type()`
that correctly handles nested generics like `impl<T> From<Py<T>> for PyObject`.
2. Fix `where` clause leaking into symbol names (~5 entries): the new
parser stops at top-level `where` keywords.
3. Filter test functions from symbol extraction (~39 entries): skip
`#[test]`/`#[cfg(test)]` attributed functions and `test_*` named
functions in diff output.
Added 9 regression tests. All 47 tests pass.
https://claude.ai/code/session_01P1LKP6aqGt68rQAXrF6kSE
Documents project architecture, key files, commands, test fixtures,
vuln_db.json structure, and known limitations found during spot-checking
of the enriched vulnerability database.
https://claude.ai/code/session_01P1LKP6aqGt68rQAXrF6kSE
- Add --existing-db flag to enrich command to skip already-enriched advisories
- Add --timeout-secs flag to stop processing after a time budget
- Create .github/workflows/enrich.yml that runs hourly on a 55-minute budget
- Workflow commits enriched vuln_db.json to repo, checkpointing progress
- Each run picks up where the last left off, progressively enriching the backlog
https://claude.ai/code/session_01Pp3k3jGUtnTTqvMMr1uP4Y
Scanner fixes:
- Block comment tracking: skip lines inside /* ... */ blocks
- Skip `use` statements from being matched as call sites
- Free function call detection: `parse_cookie(...)` after direct import
- Type-aware suppression: when the receiver's type is positively known
and doesn't match the vulnerable type, suppress the finding entirely
(e.g., .abort() on MyHandle vs JoinHandle)
Golden test improvements:
- All assertions are now specific: exact counts (deps, reachable symbols,
files scanned), exact advisory IDs listed vs reachable, exact call site
locations (file:line), exact confidence levels (HIGH vs MEDIUM)
- Each test documents its fixture layout and expected positive/negative
findings in a header comment
New edge_cases_project fixture covering:
- Aliased imports (Decoder as HyperDecoder → dec.decode detected)
- Free function calls (parse_cookie after direct import)
- Commented-out code (block & line comments correctly skipped)
- False positive suppression (abort() on MyHandle, parse() on String)
- Typed method calls (jar.add(c) with explicit CookieJar type)
38 tests total (33 unit + 5 integration), all passing.
https://claude.ai/code/session_011sdj18ZvQYbDVwEKqrWDj1
Type tracking (type_tracker.rs):
- Uses syn AST parsing to resolve variable types from function parameters,
let bindings with annotations, constructor calls (Type::new()), struct
literals, builder patterns, and closure parameters
- Integrated into scanner to promote method-call matches from Medium to
High confidence when the receiver's type is known
Golden integration tests:
- vulnerable_project: 4 vulnerable deps, 3 with reachable calls across
multiple files (qualified calls, typed method calls, constructor-inferred
types). Verifies regex dep is listed but Compiler::compile is NOT reachable.
- safe_project: patched deps (hyper, smallvec) excluded, vulnerable deps
(tokio, regex) listed but no symbols reachable. Reports POSSIBLY SAFE.
- clean_project: no vulnerable deps at all. Reports CLEAN.
37 tests total (33 unit + 4 integration), all passing.
https://claude.ai/code/session_011sdj18ZvQYbDVwEKqrWDj1
Implements the next phase of cargo-deep-audit: given a Rust project and the
enriched vulnerability database, determine which vulnerable symbols are
actually called from user code.
New modules:
- lockfile.rs: Parse Cargo.lock to extract dependency names and versions
- scanner.rs: Scan .rs source files for references to vulnerable symbols
using import tracking (use statements) and call pattern matching, with
High/Medium confidence levels
- analyzer.rs: Orchestrate the full pipeline — load vuln_db, match against
lockfile versions (semver-aware), scan source, produce structured report
Changes:
- main.rs refactored into subcommands: `enrich` (Phase 1) and `analyze` (Phase 2)
- db.rs/diff_analyzer.rs: Added Deserialize support to load vuln_db.json
- CI workflow updated for subcommand syntax
- 24 tests total (21 unit + 3 integration), all passing
https://claude.ai/code/session_011sdj18ZvQYbDVwEKqrWDj1
1. Impl body changes with no fn context: When the fn declaration is too
far above for git to include in hunk headers or context lines, body
changes were silently dropped. Now emits symbols at the impl-type
level with a <method> placeholder (e.g. KeccakXofState::<method>).
2. PR diff uses files endpoint: Previously resolved PRs to their merge
commit, which could be a version-only bump with no .rs files (e.g.
quinn-proto PR #2559). Now uses /pulls/{n}/files to get all changes
across the entire PR.
3. Nested generics in impl regex: The impl block regex used [^>]* which
broke on nested generics like impl<T: Foo<Bar>>. Now uses .* for
greedy matching to the last >.
https://claude.ai/code/session_01AeNG3herWfKhos9uZVUY5d
When a multi-hunk diff has consecutive hunks in the same function,
git may show the impl block (not the fn) in the second hunk header.
Previously this reset current_context_fn to None, causing body-only
changes to be silently dropped.
Now hunk headers with impl but no fn preserve the existing fn context.
This fixes cases like libcrux-sha3's squeeze() where the actual
vulnerability fix (loop index change) was missed because the second
hunk header showed `impl KeccakXofState` instead of `fn squeeze`.
https://claude.ai/code/session_01AeNG3herWfKhos9uZVUY5d
- Parse markdown heading as title fallback when TOML title is missing,
fixing the "(no title)" entries
- Filter out test files (tests/, *_test.rs) from vulnerable symbols
since test code isn't callable library API
- Fix module path generation to handle workspace layouts
(crates/foo/src/bar.rs → foo::bar) and strip src/ properly
- Replace hyphens with underscores in module paths to match Rust
crate naming conventions (pyo3-ffi → pyo3_ffi)
https://claude.ai/code/session_01AeNG3herWfKhos9uZVUY5d
The RustSec advisory-db uses .md files with TOML in a fenced code block,
not plain .toml files. The parser now extracts the TOML block from markdown.
Also fixes:
- --limit now means "collect up to N enriched entries" instead of
"take first N candidates", so it keeps scanning until enough are found
- Suppressed dead_code warnings on Issue variant and deserialization-only fields
- Updated test fixtures to match the .md format
https://claude.ai/code/session_01AeNG3herWfKhos9uZVUY5d
Two jobs:
- test: builds and runs cargo test
- enrichment-dry-run: runs the pipeline against 10 real advisories
using the Actions GITHUB_TOKEN, uploads vuln_db.json as artifact
https://claude.ai/code/session_01AeNG3herWfKhos9uZVUY5d
