Open
Conversation
@0xrusowsky @Dargon789 fix(fmt): handle trailing coments between base contracts Revert 142 master (#296) * Create ci_cargo.yml (#72) Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com> * Create config.yml Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com> * Rename ci_cargo.yml to cargo.yml Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com> * fix(fmt): handle trailing coments between base contracts (foundry-rs#12127) * fix(fmt): account for ternary operators when estimating size * fix(fmt): handle comments between inherited base contracts * test: layout + base inheritance * Revert "fix(fmt): handle trailing coments between base contracts (foundry-rs#12127)" This reverts commit b8b5fbb. * Update cargo.yml (#172) CI/CD Configuration Update: The CircleCI configuration file, .circleci/cargo.yml, has been updated to use a newer version of the Rust Docker image. Rust Toolchain Version Bump: The cimg/rust Docker image version has been incremented from 1.88.0 to 1.89.0, ensuring builds and tests run with the latest stable Rust toolchain. Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com> * Fix cloning of compiler settings for Vyper input Replace context.clone().compiler_settings.vyper with context.compiler_settings.vyper.clone() to avoid unnecessary cloning of the entire VerificationContext. This reduces memory allocations when creating VyperInput instances. Applied to both etherscan and sourcify verification providers. * Remove duplicate logic in TxSigner::address() implementations --------- Signed-off-by: AU_gdev_19 <64915515+Dargon789@users.noreply.github.com> Co-authored-by: 0xrusowsky <90208954+0xrusowsky@users.noreply.github.com> Co-authored-by: Gengar <creeptogengar@gmail.com> Co-authored-by: Aganis <aganisgash@gmail.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Review or Edit in CodeSandboxOpen the branch in Web Editor • VS Code • Insiders |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Sorry @Dargon789, you have reached your weekly rate limit of 500000 diff characters.
Please try again later or upgrade to continue using Sourcery
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
… in path expression Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Dargon789 <64915515+Dargon789@users.noreply.github.com>
Summary of ChangesHello @Dargon789, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request focuses on maintaining the project's health and expanding its capabilities by updating core dependencies, particularly within the Highlights
Changelog
Ignored Files
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
This was
linked to
issues
Feb 20, 2026
… in path expression Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Dargon789 <64915515+Dargon789@users.noreply.github.com>
This was
linked to
issues
Feb 21, 2026
Closed
| let mut base = env::temp_dir(); | ||
| base.push("foundry_test_utils"); | ||
| // Ignore errors here; they will surface when the path is actually used. | ||
| let _ = fs::create_dir_all(&base); |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High test
This autofix suggestion was applied.
Show autofix suggestion
Hide autofix suggestion
This autofix suggestion was applied.
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 7 days ago
In general, to fix uncontrolled path issues stemming from env::temp_dir, we should (a) resolve the temp directory to a canonical, absolute path, (b) fall back to a known-safe default if that resolution fails, and (c) ensure that all subsequent filesystem operations remain within this base directory. For the specific create_dir_all issue, the easiest hardening step is to normalize env::temp_dir() and prevent obviously unsafe values (like relative paths or paths that cannot be canonicalized to something absolute) from being used as the base.
The single best minimal fix here is to adjust the initialization of TEST_UTIL_BASE so that it derives its base directory from a canonicalized temp directory and gracefully falls back if canonicalization fails. That means: call env::temp_dir(), attempt canonicalize() on it; if that fails, fall back to std::env::current_dir() or to the original env::temp_dir() value; then append "foundry_test_utils" and call create_dir_all. This way, create_dir_all is only applied to an absolute, normalized base path, reducing the impact of a tainted environment directory. We keep the same semantics (still under the system temp dir in normal circumstances) but add a trust boundary.
Concretely, in crates/test-utils/src/util.rs around lines 15–21, we will change the LazyLock initializer for TEST_UTIL_BASE. We'll introduce a local variable for the temp directory, attempt to canonicalize it, fall back safely if needed, then push the subdirectory and create it. No new imports are required since std::fs and std::env are already imported, and PathBuf is available.
Suggested changeset
1
crates/test-utils/src/util.rs
| @@ -13,7 +13,12 @@ | ||
| /// Using a fixed directory under the system temp dir avoids trusting the current | ||
| /// working directory (which may be user-controlled) as a security boundary. | ||
| static TEST_UTIL_BASE: LazyLock<PathBuf> = LazyLock::new(|| { | ||
| let mut base = env::temp_dir(); | ||
| // Resolve the system temp directory to an absolute, canonical path where possible. | ||
| // If canonicalization fails for any reason, fall back to the raw temp_dir value. | ||
| let tmp = env::temp_dir(); | ||
| let mut base = tmp | ||
| .canonicalize() | ||
| .unwrap_or(tmp); | ||
| base.push("foundry_test_utils"); | ||
| // Ignore errors here; they will surface when the path is actually used. | ||
| let _ = fs::create_dir_all(&base); |
Copilot is powered by AI and may make mistakes. Always verify output.
Dargon789
committed this autofix suggestion 7 days ago.
… in path expression Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Dargon789 <64915515+Dargon789@users.noreply.github.com>
This comment was marked as outdated.
This comment was marked as outdated.
… in path expression Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Signed-off-by: Dargon789 <64915515+Dargon789@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
Solution
PR Checklist