tenseleyflow/shithub / f67813c

Browse files

H5: lint-policy-boundary catches != and visibility-literal patterns

Authored by mfwolffe <wolffemf@dukes.jmu.edu>
SHA
f67813c7acc92d0058522cd7088c5265384d1de7
Parents
52ab4e1
Tree
b4a2799

1 changed file

StatusFile+-
M scripts/lint-policy-boundary.sh 11 1
scripts/lint-policy-boundary.shmodified
@@ -29,13 +29,23 @@ set -euo pipefail
2929
3030
 cd "$(git rev-parse --show-toplevel)"
3131
32
-# Patterns that smell like an inline auth decision.
32
+# Patterns that smell like an inline auth decision. The audit found
33
+# negation forms (`!=`) slipping past the original equality-only set,
34
+# so both directions are covered. Same for the visibility shape — both
35
+# `== "private"` literal and the typed-enum compare.
3336
 PATTERNS=(
3437
   '\.OwnerUserID == '
38
+  '\.OwnerUserID != '
3539
   '\.OwnerUserID\.Int64 == '
40
+  '\.OwnerUserID\.Int64 != '
3641
   '== .*\.OwnerUserID'
42
+  '!= .*\.OwnerUserID'
3743
   '\.Visibility == .*RepoVisibility'
44
+  '\.Visibility != .*RepoVisibility'
45
+  '\.Visibility == "(public|private)"'
46
+  '\.Visibility != "(public|private)"'
3847
   'if .*\.IsArchived '
48
+  'if !.*\.IsArchived '
3949
 )
4050
4151
 # Files we're guarding — anywhere a request handler or hook lives.