fix(ffi): remove unchecked @ptrCast from cartridge shims (CWE-704) by hyperpolymath · Pull Request #290 · hyperpolymath/boj-server

hyperpolymath · 2026-07-21T06:20:15Z

What

Removes the unchecked @ptrCast from the cartridge FFI shims (CWE-704: Incorrect Type
Conversion or Cast) across 115 files.

-    const s = std.mem.span(@as([*:0]const u8, @ptrCast(tool_name)));
+    const s = std.mem.sliceTo(tool_name, 0);

std.mem.sliceTo(ptr, 0) scans the C string to the first NUL — no @ptrCast, no [*:0]
re-typing. The cast asserted a sentinel-terminated type that the [*c] parameter does not
guarantee, so a non-NUL-terminated tool_name was undefined behaviour rather than a
bounded read.

Why now

Secondary benefit: the previous form depended on std.mem.spanZ/span semantics that
changed in Zig 0.14+, so this also unblocks compilation under the CI pin.

Scope

115 cartridges/*/ffi/cartridge_shim.zig
ffi/zig/src/cartridge_shim.zig, ffi/zig/src/abi_verify.zig
Unit tests updated to pass [*c]const u8 directly instead of @ptrCast-ing a [*:0]

Diff: +1833 / −1149. Merges cleanly against main (0 conflicts).

Note on red checks

Required checks on this PR will report startup_failure for reasons unrelated to this
change: this repository has allowed_actions: selected with an empty patterns_allowed,
so every workflow using a non-GitHub-owned action is refused before any job starts (20 of
25 workflows). The sibling boj-server-cartridges has allowed_actions: all and is fully
green on the same workflow set.

Held as draft until that repository-settings fix lands; the code change itself is
complete and self-contained.

Sweeps all 114 vendored copies of cartridge_shim.zig in boj-server — including the canonical shared source ffi/zig/src/cartridge_shim.zig — to the blessed post-#146 idiom: std.mem.sliceTo(tool_name, 0) with [*c]const u8 test locals and no @ptrCast. Mirrors PR #89 in boj-server-cartridges, which is the split-out of these cartridges. Why the casts were redundant, not unsafe: a [*:0]const u8 sentinel pointer coerces implicitly to the [*c]const u8 that toolIs/invokeArgsNull accept, so @ptrCast(name) was a no-op widening — but a C-oriented scanner (Hypatia code_safety/zig_ptr_cast, CWE-704) still flags it as an unchecked pointer type conversion. Typing the local as [*c]const u8 up front removes the finding rather than suppressing it. Also folds in ffi/zig/src/abi_verify.zig (ABI-conformance tests C.6/C.7), which called shim.toolIs/invokeArgsNull via @ptrCast. NOTE: that file was modified in the shared working tree by a concurrent agent; it is included here because it is the identical CWE-704 fix — flag if it should land separately. Verification (zig 0.15.2, the CI-pinned version): - every cartridge_shim.zig compiles and passes `zig test` standalone; - the edited abi_verify C.6/C.7 idiom verified in isolation against the real shim (8/8), since the full `zig build test` graph does not compile under 0.15.2 for reasons unrelated to this change (see below). Out of scope, reported separately: (1) .github/workflows/zig-test.yml has been startup_failure (0s) on main since >=2026-07-09, so this repo's Zig CI validates nothing and this PR's zig-test check cannot pass on any branch; (2) catalogue/guardian/loader/coprocessor/sdp reference the removed std.atomic.Mutex and do not compile under the pinned 0.15.2. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

github-actions · 2026-07-21T07:04:40Z

🔍 Hypatia Security Scan

Findings: 230 issues detected

Severity	Count
🔴 Critical	15
🟠 High	137
🟡 Medium	78

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "pages-deploy.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/upload-pages-artifact@v3 needs attention",
    "type": "unpinned_action",
    "file": "pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/deploy-pages@v4 needs attention",
    "type": "unpinned_action",
    "file": "pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in build.yml",
    "type": "missing_timeout_minutes",
    "file": "build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in pages-deploy.yml",
    "type": "missing_timeout_minutes",
    "file": "pages-deploy.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in push-email-notify.yml",
    "type": "missing_timeout_minutes",
    "file": "push-email-notify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "missing_timeout_minutes",
    "file": "scorecard-enforcer.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

github-actions · 2026-07-21T07:38:39Z

🏁 path-claims bench

Commit a4a3eb2

Numbers

path-claims bench  (node v22.23.1)

  scenario                                              iters       ms        ns/op          ops/s
  --------------------------------------------------------------------------------------------------------------
  register: 10 active claims, 3 new paths               50000 iters    182 ms      3.66 µs/op    273.6k ops/s
  register: 100 active claims, 3 new paths              20000 iters    321 ms     16.07 µs/op     62.2k ops/s
  register: 1000 active claims, 3 new paths              5000 iters    928 ms    185.71 µs/op      5.4k ops/s
  register: 100 active claims, 20 new paths              5000 iters    367 ms     73.56 µs/op     13.6k ops/s

  pathsOverlap: deep diverge at segment 4             1000000 iters    160 ms     160.0 ns/op     6.25M ops/s
  pathsOverlap: short prefix match                    1000000 iters    134 ms     134.7 ns/op     7.42M ops/s

  refresh (existing claim)                             100000 iters     11 ms     111.8 ns/op     8.94M ops/s
  list (100 active claims)                              50000 iters    282 ms      5.66 µs/op    176.8k ops/s

  (Bench numbers depend on host; use deltas across commits, not absolute values.)

Host-dependent — compare deltas across commits, not absolute values.

github-actions · 2026-07-21T12:07:43Z

🔍 Hypatia Security Scan

Findings: 230 issues detected

Severity	Count
🔴 Critical	15
🟠 High	137
🟡 Medium	78

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "pages-deploy.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/upload-pages-artifact@v3 needs attention",
    "type": "unpinned_action",
    "file": "pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action actions/deploy-pages@v4 needs attention",
    "type": "unpinned_action",
    "file": "pages.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in build.yml",
    "type": "missing_timeout_minutes",
    "file": "build.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in pages-deploy.yml",
    "type": "missing_timeout_minutes",
    "file": "pages-deploy.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in push-email-notify.yml",
    "type": "missing_timeout_minutes",
    "file": "push-email-notify.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "missing_timeout_minutes",
    "file": "scorecard-enforcer.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in scorecard-enforcer.yml",
    "type": "scorecard_publish_with_run_step",
    "file": "scorecard-enforcer.yml",
    "action": "split_scorecard_publish_job",
    "rule_module": "workflow_audit",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence

hyperpolymath marked this pull request as ready for review July 21, 2026 12:06

Merge branch 'main' into fix/zig-ptr-cast-shim

3d716a4

hyperpolymath merged commit 5b59f48 into main Jul 21, 2026
21 of 32 checks passed

hyperpolymath deleted the fix/zig-ptr-cast-shim branch July 21, 2026 12:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(ffi): remove unchecked @ptrCast from cartridge shims (CWE-704)#290

fix(ffi): remove unchecked @ptrCast from cartridge shims (CWE-704)#290
hyperpolymath merged 2 commits into
mainfrom
fix/zig-ptr-cast-shim

hyperpolymath commented Jul 21, 2026

Uh oh!

github-actions Bot commented Jul 21, 2026

Uh oh!

github-actions Bot commented Jul 21, 2026 •

edited

Loading

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

hyperpolymath commented Jul 21, 2026

What

Why now

Scope

Note on red checks

Uh oh!

github-actions Bot commented Jul 21, 2026

🔍 Hypatia Security Scan

Uh oh!

github-actions Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🏁 path-claims bench

Uh oh!

Uh oh!

github-actions Bot commented Jul 21, 2026

🔍 Hypatia Security Scan

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions Bot commented Jul 21, 2026 •

edited

Loading