updates
ober
70c14e8e0e0d9f194bbd142e7418d2b546c9c468
--- a/data/anti-patterns.sexp +++ b/data/anti-patterns.sexp @@ -5852,4 +5852,43 @@ ("tools" "jerboa_check_balance" "make typed-json-value-bench" - "rg generated Rust for \"clone()\""))) + "rg generated Rust for \"clone()\"")) + (("advice" + . + "Document the payload layout at construction and consume the exact same indices in compiler dispatch. Add execution tests for one-argument and offset/default lag/lead.") + ("avoid" + . + "Keep binder and compiler payload layouts synchronized; do not infer vector slots independently in each module.") + ("id" . "window-payload-slot-mismatch") + ("kinds" "compiler" "window-functions") + ("pattern" + . + "A binder stores window payload fields in one order while the compiler reconstructs them in a different order, causing bx-kind/type errors at execution.") + ("severity" . "high") + ("tags" "lag" "lead" "window" "binder" "compiler") + ("title" . "Window compiler reads shifted payload slots") + ("tools" + "jerboa_check_balance" + "jerboa_verify" + "jerboa_run_tests")) + (("advice" + . + "Keep numeric compare helpers separate from sort predicates and add ascending/descending numeric ORDER BY tests for both fixnum and float keys.") + ("avoid" + . + "Confirm the local sort API contract before wiring a specialized comparator; convert numeric comparison results to boolean at the boundary.") + ("id" . "sort-predicate-return-contract") + ("kinds" "execution" "sorting") + ("pattern" + . + "A specialized ORDER BY branch returns -1/0/1 directly to a list sort API that expects a boolean before-predicate.") + ("severity" . "medium") + ("tags" "sort" "order-by" "predicate" "comparator" + "execution") + ("title" + . + "ORDER BY sort predicate returns numeric comparator") + ("tools" + "jerboa_howto" + "jerboa_run_tests" + "jerboa_verify"))) --- a/data/error-fixes.sexp +++ b/data/error-fixes.sexp @@ -3320,4 +3320,20 @@ ("pattern" . "attempt to add with overflow.*parse-decimal|attempt to multiply with overflow.*parse-decimal|generated Rust.*oversized.*port") - ("type" . "runtime"))) + ("type" . "runtime")) + (("code_example" + . + "(def (decimal-score-string? s)\n (let loop ([i 0] [saw-digit? #f] [saw-dot? #f])\n (if (= i (string-length s))\n saw-digit?\n (let ([ch (string-ref s i)])\n (cond [(and (char>=? ch #\\0) (char<=? ch #\\9)) (loop (+ i 1) #t saw-dot?)]\n [(and (char=? ch #\\.) (not saw-dot?)) (loop (+ i 1) saw-digit? #t)]\n [else #f])))))") + ("explanation" + . + "Jerboa's string->number accepts Scheme numeric syntax beyond plain decimal, including radix prefixes, exponents, fractions, and complex numbers. That is too broad for thresholds, ports, byte counts, lengths, or other security-sensitive fields.") + ("fix" + . + "Do not parse security-sensitive CLI/config decimal fields with string->number. Validate the accepted grammar first and parse only the intended decimal form, or use an existing decimal-only helper.") + ("id" + . + "avoid-string-to-number-for-security-sensitive-decimals") + ("pattern" + . + "string->number accepts non-decimal radix prefixes (#x10, #o10, #b10) and scientific notation (1e5).") + ("type" . "security-scan"))) --- a/data/features.sexp +++ b/data/features.sexp @@ -3972,4 +3972,40 @@ ("use_case" . "Creating tests/fixtures/typed/*.ss should keep the balanced whole-file writer safety while verifying the file through typecheck-typed-library-form or the typed build driver when the top-level form is typed-library.") + ("votes" . 0)) + (("description" + . + "Several local docs and cookbook examples say to run scripts with `jerboa run file.ss`, but the installed Jerboa 0.2.6 launcher accepts scripts directly as `jerboa file.ss` and treats `run` as a script path. The docs/tooling should either support both forms or update recipes/error-fix advice to match the current launcher.") + ("estimated_token_reduction" + . + "~300 tokens per CLI-script task by avoiding failed smoke runs and repair loops") + ("example_scenario" + . + "A verified script is smoke-tested with `jerboa run main-binary.ss --help` and fails with `Exception in load: failed for run: no such file or directory`.") + ("id" . "normalize-jerboa-script-run-guidance") + ("impact" . "medium") ("status" . "proposed") + ("tags" "script" "cli" "docs" "launcher") + ("title" . "Normalize Jerboa script invocation guidance") + ("use_case" + . + "Writing or verifying Jerboa command-line scripts without failing at runtime before user code starts.") + ("votes" . 0)) + (("description" + . + "`jerboa_anti_pattern_lookup` failed with `Exception in string-downcase: (\"FileNotFoundException.*\\\\.csv|AssetManager.*open|box_types\") is not a string` while searching for security-scanner token false positives. Lookup should tolerate list/regex pattern fields by stringifying or skipping malformed entries, then continue returning usable matches.") + ("estimated_token_reduction" + . + "~400 tokens per save-discoveries session when malformed entries are present") + ("example_scenario" + . + "During a Jerboa source edit, the security scanner flags a false positive around `token` identifiers. The required duplicate lookup crashes before showing existing guidance, forcing fallback to shell search.") + ("id" . "harden-anti-pattern-lookup-nonstring-patterns") + ("impact" . "medium") ("status" . "proposed") + ("tags" "anti-pattern" "lookup" "parser" "tooling") + ("title" + . + "Harden anti-pattern lookup against non-string pattern fields") + ("use_case" + . + "Saving discoveries and checking duplicates should not be blocked by one malformed or compound anti-pattern field.") ("votes" . 0)))