Fix #277, #276, #275: Hardcoded contract addresses, glob validation, and config path fallback - #335
Merged
unrealtim-tech merged 4 commits intoJul 30, 2026
Conversation
Extend the hardcoded-address check to also detect C-prefixed 56-character StrKey strings (Soroban contract addresses) in addition to the existing G-prefixed Ed25519 account keys. This addresses contract addresses being hardcoded (e.g. token contract addresses) which are arguably more common in Soroban contracts than hardcoded account keys. Changes: - Update find_candidate_keys() to check for both 'G' and 'C' prefixes - Add unit test for hardcoded C-prefixed contract address (positive case) - Confirm G.../C... short strings are still ignored (negative case) - Update hardcoded-address-vulnerable fixture to include C-prefixed example - Update docs/checks.md to mention both G and C prefixes Closes SorobanGuard#277 Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Instead of silently dropping malformed glob patterns, the analyzer now returns a clear error message naming the bad pattern and exits with code 2 (consistent with other CLI input-validation failures). Changes: - Add InvalidGlobPattern variant to ScanError enum - Update collect_rust_paths() to report glob parsing errors - Update scan_files() to report glob parsing errors - Add tests for invalid exclude and include glob patterns Closes SorobanGuard#276
Make the CLI scan path argument optional and implement fallback logic: - CLI positional argument takes precedence if provided - If not provided, fall back to [scan] path from soroban-guard.toml - If neither is provided, exit with error This enables users to set a default scan path in their config file, making the CLI more convenient for repeated scans of the same target. Changes: - Changed Scan command path from required to optional - Added path resolution logic with proper precedence - Load config from current directory to check for default path - Updated documentation to mention config fallback - Added test to verify config path fallback behavior Closes SorobanGuard#275
|
@Bruno755 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR addresses three related issues in the Guard-CLI analyzer and CLI:
hardcoded-addresscheck only detectsG-prefixed keys, missesC-prefixed Soroban contract addresses #277: Extend hardcoded-address check to detect C-prefixed Soroban contract addresses--include/--excludeglob patterns are silently ignored #276: Report errors for invalid --include/--exclude glob patterns instead of silently ignoring themScanConfig.pathis parsed fromsoroban-guard.tomlbut never applied #275: Implement scan path fallback from soroban-guard.toml configChanges
Issue #277: C-prefixed Contract Address Detection
find_candidate_keys()in hardcoded_address.rs to check for both 'G' (account) and 'C' (contract) prefixesIssue #276: Invalid Glob Pattern Validation
InvalidGlobPatternvariant to ScanError enumcollect_rust_paths()to validate glob patterns and return error on failurescan_files()to validate glob patterns and return error on failureIssue #275: Config Path Fallback
Testing
All changes include comprehensive tests:
Closes #277
Closes #276
Closes #275