mirror of
https://github.com/CharlesWiltgen/Axiom.git
synced 2026-09-20 19:58:20 +08:00
Charles Wiltgen
93f793709f
The warn tier's last 8 findings were all real values sitting in fixtures: three
Apple OS binary UUIDs (libsystem_kernel.dylib, /usr/bin/yes, dyld) from a real
cpuprofile trace, and a display UUID captured from `devicectl device appResize
set`. None was sensitive, and the obvious response was to exempt them — which
would have been the wrong one. An exemption is permanent: it lives in the scanner
forever, and each one narrows what the gate can still catch.
The values were also inert. cmd_resize_test.go asserts the parsed "Actual size"
field and never reads the display id; the cpuprofile assertions need only the
fixture and the expectation to agree.
So the fixtures carry synthetic UUIDs now, and the scanner's own test assembles
its unpatterned control values from parts rather than writing literals. That last
part matters because the test file is shipped content like any other — a literal
there is a value the gate has to carry forever. Same move e6f267ce made for the
deny-list values: build it, don't ship it.
The tier is therefore empty with no exemptions, so the next warning is real.
Measured with `node scripts/leak-scan.ts` over 1978 shipped files: 16 -> 8 -> 0.
The 8 in the middle were real but not identifying — one OS-binary UUID per
architecture, plus a display id that devicectl regenerates on every boot
(measured across three boots of one simulator).
cmd_resize_test.go's comment claimed a verbatim capture above a value that is
now synthetic; corrected.
Verified: 518/518 unit tests, xcprof/xcsym/xcui go suites, leak scan 0/0.
58 lines
1.6 KiB
Go
58 lines
1.6 KiB
Go
package main
|
|
|
|
import (
|
|
"context"
|
|
"os/exec"
|
|
"testing"
|
|
)
|
|
|
|
func TestReadUUIDs_ParsesOutput(t *testing.T) {
|
|
sample := `UUID: AAAAAAAA-0000-0000-0000-000000000005 (arm64) /path/to/MyApp
|
|
UUID: ABCDEF01-2345-6789-ABCD-EF0123456789 (arm64e) /path/to/MyApp
|
|
`
|
|
got := parseDwarfdumpUUIDs([]byte(sample))
|
|
if len(got) != 2 {
|
|
t.Fatalf("expected 2 UUIDs, got %d", len(got))
|
|
}
|
|
if got[0].UUID != "AAAAAAAA-0000-0000-0000-000000000005" {
|
|
t.Errorf("UUID 0: got %q", got[0].UUID)
|
|
}
|
|
if got[0].Arch != "arm64" {
|
|
t.Errorf("arch 0: got %q", got[0].Arch)
|
|
}
|
|
if got[1].Arch != "arm64e" {
|
|
t.Errorf("arch 1: got %q", got[1].Arch)
|
|
}
|
|
}
|
|
|
|
func TestReadUUIDs_RealBinary(t *testing.T) {
|
|
if _, err := exec.LookPath("xcrun"); err != nil {
|
|
t.Skip("xcrun not available")
|
|
}
|
|
uuids, err := ReadUUIDs(context.Background(), "/bin/ls")
|
|
if err != nil {
|
|
t.Fatalf("ReadUUIDs(/bin/ls): %v", err)
|
|
}
|
|
if len(uuids) == 0 {
|
|
t.Error("expected at least one UUID from /bin/ls")
|
|
}
|
|
}
|
|
|
|
func TestNormalizeUUID(t *testing.T) {
|
|
cases := []struct {
|
|
in, want string
|
|
}{
|
|
{"abcdef01-2345-6789-abcd-ef0123456789", "ABCDEF01-2345-6789-ABCD-EF0123456789"},
|
|
{"ABCDEF0123456789ABCDEF0123456789", "ABCDEF01-2345-6789-ABCD-EF0123456789"},
|
|
{"abcdef0123456789abcdef0123456789", "ABCDEF01-2345-6789-ABCD-EF0123456789"},
|
|
// malformed passthrough (upper-cased but otherwise untouched so callers can error on them)
|
|
{"abcdef01234567 89abcdef0123456789", "ABCDEF01234567 89ABCDEF0123456789"},
|
|
{"not-a-uuid", "NOT-A-UUID"},
|
|
}
|
|
for _, c := range cases {
|
|
if got := NormalizeUUID(c.in); got != c.want {
|
|
t.Errorf("NormalizeUUID(%q) = %q, want %q", c.in, got, c.want)
|
|
}
|
|
}
|
|
}
|