rsconstruct 0.9.144
medium severity process_spawn in build_script code (152 places): std::process::Command::new
19
low
Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.
Evidence
| Points | Signal | Where | What |
|---|---|---|---|
| 10 | static:process_spawn static · rsconstruct | build.rs:25 | medium severity process_spawn in build_script code (152 places): std::process::Command::new |
| 2 | static:credential_access static · rsconstruct | src/processor/mass_generator/npm.rs:28 | medium severity credential_access in library code (4 places): .npmrc |
| 2 | static:secret_environment_variable static · rsconstruct | src/download.rs:112 | medium severity secret_environment_variable in library code (20 places): GITHUB_TOKEN |
| 2 | static:shell_command static · rsconstruct | src/engines/actionlint/rules/shell_name.rs:17 | medium severity shell_command in library code (14 places): powershell |
| 2 | static:yara:persistence_locations static · rsconstruct | docs/src/commands.md:953 | medium severity yara:persistence_locations in library code (2 places): Paths and keys used to persist on a developer machine |
| 1 | static:build_script static · rsconstruct | build.rs | low severity build_script in build_script code: build.rs |
Behavior
New since the previous version
static:credential_access
Profile
static:credential_access static:process_spawn static:secret_environment_variable static:shell_command static:yara:persistence_locations
Static findings
12 groups
medium secret_environment_variable library 20
GITHUB_TOKENsrc/download.rs:112 src/download.rs:223 src/download.rs:249 src/download.rs:266 src/download.rs:267 src/download.rs:275 src/download.rs:279 src/engines/hadolint/rules.rs:2319GH_TOKENsrc/download.rs:112 src/download.rs:266 src/download.rs:270 src/download.rs:271 src/download.rs:275 src/download.rs:276 src/engines/hadolint/rules.rs:2317AWS_ACCESS_KEY_IDsrc/engines/hadolint/rules.rs:2297AWS_SECRET_ACCESS_KEYsrc/engines/hadolint/rules.rs:2298DOCKER_PASSWORDsrc/engines/hadolint/rules.rs:2308NPM_TOKENsrc/engines/hadolint/rules.rs:2323OPENAI_API_KEYsrc/engines/hadolint/rules.rs:2329
medium shell_command library 14
powershellsrc/engines/actionlint/rules/shell_name.rs:17 src/engines/actionlint/rules/shell_name.rs:18 src/engines/hadolint/rules.rs:2533(?x:\u{a}\u{9}u_(?:char|short|int|long) | # bsd\u{a}\u{9}u(?:nchar|short|int|long) # sysv\u{a})src/engines/checkpatch/globals.rs:204\.(h|c|rs|s|S|sh|dtsi|dts)$src/engines/checkpatch/lines.rs:593\b($Declare)\s*(?!char\b|short\b|int\b|long\b)\s*($Ident)?\s*[=,;\[\)\(]src/engines/checkpatch/lines.rs:1593\b(const|volatile|void|char|short|int|long|float|double|signed|unsigned|schar|u?int8_t|u?int16_t|u?int32_t|u?int64_t)\s+(register|static|extern|typedef)\bsrc/engines/cpplint/checks.rs:276^(?:(char(16_t|32_t)?)|wchar_t|bool|short|int|long|signed|unsigned|float|double|(ptrdiff_t|size_t|max_align_t|nullptr_t)|(u?int(_fast|_least)?(8|16|32|64)_t)|(u?int(max|ptr)_t)|)$src/engines/cpplint/tables.rs:439Avoid use of wget without progress bar. Use `wget --progress=dot:giga <url>`. Or consider using `-q` or `-nv` (shorthands for `--quiet` or `--no-verbose`).src/engines/hadolint/rules.rs:1631FROM alpine:3.20\u{a}RUN cd /tmp && sudo apk add curl && echo "$(wget -q x | tee y)" ; pip install a\u{a}src/engines/hadolint/tests.rs:73'time' is undefined for pipelines. time single stage or bash -c instead.src/engines/shellcheck/commands.rs:958HTTP cache unreachable for {} (curl exit {:?})src/remote_cache.rs:259HTTP cache unreachable for {url} (curl exit {:?})src/remote_cache.rs:315chmod +x {path}src/tools.rs:746
medium credential_access library 4
medium process_spawn build_script 3
std::process::Command::newbuild.rs:25 build.rs:42 build.rs:66
medium yara_match persistence_locations library 2
Paths and keys used to persist on a developer machinedocs/src/commands.md:953 docs/src/completions.md:20
low process_spawn library 116
std::process::Command::newsrc/analyzers/cpp.rs:104 src/analyzers/mod.rs:155 src/analyzers/mod.rs:218 src/analyzers/tera.rs:483 src/builder/clean.rs:316 src/builder/clean.rs:363 src/builder/doctor.rs:402 src/builder/doctor.rs:409 src/builder/graph.rs:78 src/builder/graph.rs:96 src/builder/graph.rs:237 src/builder/tools.rs:32 src/builder/tools.rs:48 src/builder/tools.rs:100 src/builder/tools.rs:110 src/engines/checkpatch/tests.rs:61 src/engines/checkpatch/tests.rs:324 src/engines/checkpatch/tests.rs:422 src/engines/checkpatch/tests.rs:521 src/engines/checkstyle/tests.rs:210 src/engines/checkstyle/tests.rs:225 src/engines/perlcritic/tests.rs:287 src/engines/perlcritic/tests.rs:303 src/engines/shellcheck/tests.rs:118 src/engines/shellcheck/tests.rs:128 src/processor/checker/aspell.rs:83 src/processor/checker/clang_tidy.rs:33 src/processor/checker/clippy.rs:56 src/processor/checker/make.rs:39 src/processor/checker/markdownlint.rs:70 src/processor/checker/mdl.rs:120 src/processor/explicit/generic.rs:145 src/processor/generator/a2x.rs:22 src/processor/generator/cc_single_file.rs:262 src/processor/generator/cc_single_file.rs:284 src/processor/generator/cc_single_file.rs:302 src/processor/generator/cc_single_file.rs:543 src/processor/generator/chromium.rs:25 src/processor/generator/drawio.rs:25 src/processor/generator/generic.rs:71 src/processor/generator/jinja2.rs:58 src/processor/generator/libreoffice.rs:42 src/processor/generator/mako.rs:54 src/processor/generator/markdown2html.rs:22 src/processor/generator/marp.rs:167 src/processor/generator/mermaid.rs:21 src/processor/generator/objdump.rs:22 src/processor/generator/pandoc.rs:93 src/processor/generator/pdflatex.rs:142 src/processor/generator/pdflatex.rs:167 and 51 morestd::process::Commandsrc/download.rs:123 src/processor/generator/cc_single_file.rs:504 src/processor/mass_generator/generic.rs:124 src/processor/mass_generator/generic.rs:285 src/processor/mass_generator/generic.rs:302 src/processor/mass_generator/linux_module.rs:171 src/processor/mod.rs:131 src/processor/mod.rs:142 src/processor/mod.rs:173 src/processor/mod.rs:312 src/processor/mod.rs:319 src/processor/mod.rs:328 src/processor/mod.rs:341 src/processor/mod.rs:724tokio::process::Command::newsrc/processor/mod.rs:207
low process_spawn test 33
std::process::Command::newtests/common/mod.rs:20 tests/common/mod.rs:66 tests/common/mod.rs:153 tests/processor/checker/icheckpatch.rs:74 tests/processor/checker/icheckstyle.rs:240 tests/processor/checker/iperlcritic.rs:247 tests/processor/checker/ishellcheck.rs:167 tests/processor/generator/cc_single_file.rs:339 tests/processor/generator/cc_single_file.rs:389 tests/processor/generator/cc_single_file.rs:438 tests/processor/generator/cc_single_file.rs:485 tests/processor/generator/cc_single_file.rs:532 tests/processor/generator/cc_single_file.rs:583 tests/processor/generator/cc_single_file.rs:634 tests/processor/generator/cc_single_file.rs:681 tests/processor/generator/cc_single_file.rs:735 tests/processor/generator/cc_single_file.rs:810 tests/processor/generator/cc_single_file.rs:862 tests/processor/generator/cc_single_file.rs:906 tests/processor/generator/cc_single_file.rs:1016 tests/processor/generator/cc_single_file.rs:1160 tests/processor/generator/cc_single_file.rs:1168 tests/processor/generator/cc_single_file.rs:1282 tests/processor/generator/cc_single_file.rs:1298 tests/processor/generator/tera.rs:611 tests/processor/generator/tera.rs:677 tests/processor/generator/tera.rs:682 tests/processor/mass_generator/cc.rs:164 tests/processor/mass_generator/cc.rs:699 tests/processor/mass_generator/cc.rs:762 tests/processor/mass_generator/sphinx.rs:124 tests/processor/mass_generator/zola.rs:235std::process::Commandtests/common/mod.rs:64
low network_access library 2
ureq::getsrc/download.rs:148 src/webcache.rs:114
low build_script build_script 1
build.rsbuild.rs
info url_literal library 144
http://src/analyzers/markdown.rs:58 src/analyzers/sass.rs:199 src/engines/hadolint/rules.rs:778 src/processor/checker/marp_images.rs:42 src/processor/checker/terms.rs:446 src/remote_cache.rs:66https://src/analyzers/markdown.rs:59 src/analyzers/sass.rs:200 src/engines/hadolint/rules.rs:778 src/processor/checker/marp_images.rs:43 src/processor/checker/terms.rs:446 src/remote_cache.rs:66ftp://src/analyzers/markdown.rs:60\u{a}@use "sass:math";\u{a}@use "vars" as v;\u{a}@use 'theme' with ($accent: "red", $font: 'x');\u{a}@forward "mixins" show button;\u{a}@import "a", 'b';\u{a}@import "plain.css";\u{a}@import url(remot…src/analyzers/sass.rs:376$u: "http://x";\u{a}@use "kept";\u{a}src/analyzers/sass.rs:401<!DOCTYPE html>\u{a}<html>\u{a}<head>\u{a} <meta charset="UTF-8">\u{a} <title>RSConstruct Tools Graph</title>\u{a} <script src="https://cdn.jsdelivr.net/npm/mermaid/dist/mermaid.min.js"></scr…src/builder/tools.rs:1344\u{a}version = 1\u{a}requires-python = ">=3.14"\u{a}\u{a}[[package]]\u{a}name = "demo"\u{a}version = "0.1.0"\u{a}source = { editable = "." }\u{a}\u{a}[[package]]\u{a}name = "flask"\u{a}version = "3.1.…src/config/tests.rs:1385\u{a}version = 1\u{a}\u{a}[[package]]\u{a}name = "somelib"\u{a}version = "1.0.0"\u{a}source = { git = "https://example.com/somelib.git" }\u{a}src/config/tests.rs:1416\u{a}version = 1\u{a}\u{a}[[package]]\u{a}name = "demo"\u{a}version = "0.1.0"\u{a}source = { virtual = "." }\u{a}\u{a}[[package]]\u{a}name = "flask"\u{a}version = "3.1.0"\u{a}source = { registry = "ht…src/config/tests.rs:1443# This file was autogenerated by uv.\u{a}-e .\u{a}flask==3.1.0\u{a}pywin32==312 ; sys_platform == 'win32'\u{a}\u{a}--index-url https://pypi.org/simple\u{a}werkzeug==3.1.3\u{a}src/config/tests.rs:1540https://raw.githubusercontent.com/src/download.rs:79https://api.github.com/src/download.rs:140https://example.com/x.gzsrc/download.rs:202 src/download.rs:211 src/download.rs:213 src/download.rs:246 src/download.rs:289https://raw.githubusercontent.com/torvalds/linux/master/scripts/checkpatch.plsrc/download.rs:222https://github.com/biomejs/biome/releases/latest/download/biome-linux-x64src/download.rs:247 src/tools.rs:1252{} is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs.github.com/en/actions/reference/security/secure-use#good-prac…src/engines/actionlint/expr/insecure.rs:235object filter extracts potentially untrusted properties {}. avoid using the value directly in inline scripts. instead, pass the value through an environment variable. see https://docs.github.com/en/ac…src/engines/actionlint/expr/insecure.rs:243context {} is not allowed here. {notes}. see https://docs.github.com/en/actions/learn-github-actions/contexts#context-availability for more detailssrc/engines/actionlint/expr/sema.rs:461calling function {} is not allowed here. {} is only available in {}. see https://docs.github.com/en/actions/learn-github-actions/contexts#context-availability for more detailssrc/engines/actionlint/expr/sema.rs:478configuration variable name {} must not start with the GITHUB_ prefix (case insensitive). note: see the convention at https://docs.github.com/en/actions/learn-github-actions/variables#naming-conventio…src/engines/actionlint/expr/sema.rs:593configuration variable name {} can only contain alphabets, decimal numbers, and '_'. note: see the convention at https://docs.github.com/en/actions/learn-github-actions/variables#naming-conventions-fo…src/engines/actionlint/expr/sema.rs:606docker://src/engines/actionlint/parse.rs:1421 src/engines/actionlint/rules/action.rs:288 src/engines/actionlint/rules/action.rs:603 src/engines/actionlint/rules/action.rs:604 src/engines/actionlint/rules/action.rs:806invalid runner name {} at runs.using in {} action defined at {}. valid runners are "composite", "docker", "node20", and "node24". see https://docs.github.com/en/actions/creating-actions/metadata-synta…src/engines/actionlint/rules/action.rs:585incorrect icon name {} at branding.icon in metadata of {} action at {}. see the official document to know the exhaustive list of supported icons: https://docs.github.com/en/actions/creating-actions/me…src/engines/actionlint/rules/action.rs:657incorrect color {} at branding.icon in metadata of {} action at {}. see the official document to know the exhaustive list of supported colors: https://docs.github.com/en/actions/creating-actions/metad…src/engines/actionlint/rules/action.rs:670workflow command {} was deprecated. use `{a}` instead: https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actionssrc/engines/actionlint/rules/deprecated_commands.rs:54unknown Webhook event {}. see https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#webhook-events for list of all Webhook event namessrc/engines/actionlint/rules/events.rs:321maximum number of inputs for "workflow_dispatch" event is 25 but {} inputs are provided. see https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#providing-inputssrc/engines/actionlint/rules/events.rs:534{}. note: filter pattern syntax is explained at https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#filter-pattern-cheat-sheetsrc/engines/actionlint/rules/glob.rs:342reusable workflow call {} at "uses" is not following the format "owner/repo/path/to/workflow.yml@ref" nor "./path/to/workflow.yml". see https://docs.github.com/en/actions/learn-github-actions/reusing-…src/engines/actionlint/rules/workflow_call.rs:1812:3: unknown Webhook event "pussh". see https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#webhook-events for list of all Webhook event names [events]src/engines/actionlint/tests.rs:113<?xml version="1.0"?>\u{a}<!DOCTYPE module PUBLIC "-//Checkstyle//DTD Checkstyle Configuration 1.3//EN" "https://checkstyle.org/dtds/configuration_1_3.dtd">\u{a}<module name="Checker">\u{a}{checker_pr…src/engines/checkstyle/tests.rs:347\s*//.*http(s?)://\S*$src/engines/cpplint/checks.rs:1592Do not use unnamed namespaces in header files. See https://google-styleguide.googlecode.com/svn/trunk/cppguide.xml#Namespaces for more information.src/engines/cpplint/language.rs:360git://src/engines/hadolint/rules.rs:673git+ssh://src/engines/hadolint/rules.rs:673git+http://src/engines/hadolint/rules.rs:673git+https://src/engines/hadolint/rules.rs:673\u{a}[elm]\u{a}"svg" = 1\u{a}"svg > title" = 1\u{a}"svg > path" = [1, 3]\u{a}"rect" = false\u{a}"*" = false\u{a}\u{a}[[attr]]\u{a}"rule::selector" = "svg"\u{a}"rule::whitelist" = true\u{a}"rule::order…src/engines/svglint/tests.rs:30<svg xmlns="http://www.w3.org/2000/svg"><path d="M1 1"/></svg>\u{a}src/engines/svglint/tests.rs:68<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" role="img">\u{a} <title>t</title>\u{a} <path d="M1 1L2 2z" fill="green"/>\u{a} <rect width="1" height="1"/>\u{a} <path d="X" fill="red" …src/engines/svglint/tests.rs:75\u{a}\u{a}<svg viewBox="0 0 24 24" role="img" xmlns="http://www.w3.org/2000/svg">\u{a}<title>t</title><path d="M1 1" fill="red" bogus="1"/>\u{a}<title>u</title></svg>\u{a}src/engines/svglint/tests.rs:147http://www.w3.org/1999/xhtmlsrc/engines/tidy/clean.rs:657 src/engines/tidy/clean.rs:660 src/engines/tidy/parser.rs:21http://www.w3.org/TR/REC-html40/strict.dtdsrc/engines/tidy/tables.rs:622http://www.w3.org/TR/REC-html40/loose.dtdsrc/engines/tidy/tables.rs:629http://www.w3.org/TR/REC-html40/frameset.dtdsrc/engines/tidy/tables.rs:636http://www.w3.org/TR/html4/strict.dtdsrc/engines/tidy/tables.rs:643http://www.w3.org/TR/html4/loose.dtdsrc/engines/tidy/tables.rs:650http://www.w3.org/TR/html4/frameset.dtdsrc/engines/tidy/tables.rs:657http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtdsrc/engines/tidy/tables.rs:664http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtdsrc/engines/tidy/tables.rs:671http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtdsrc/engines/tidy/tables.rs:678http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtdsrc/engines/tidy/tables.rs:685http://www.w3.org/TR/xhtml-basic/xhtml-basic10.dtdsrc/engines/tidy/tables.rs:692http://www.w3.org/XML/1998/namespacesrc/engines/xmllint/parser.rs:18<a xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="nope.xsd"/>\u{a}src/engines/xmllint/tests.rs:41<!DOCTYPE a SYSTEM "http://example.invalid/a.dtd"><a> </a>\u{a}src/engines/xmllint/tests.rs:88<?xml version="1.0" encoding="UTF-8"?>\u{a}<xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema"\u{a} targetNamespace="urn:keynote" xmlns:tns="urn:keynote" elementFormDefault="qualified">\u{a} …src/engines/xmllint/tests.rs:355<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">\u{a} <xs:simpleType name="Color">\u{a} <xs:restriction base="xs:string"><xs:pattern value="#[0-9a-f]{6}"/></xs:restriction>\u{a} </xs:simpl…src/engines/xmllint/tests.rs:596<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">\u{a} <xs:group name="g"><xs:sequence/></xs:group>\u{a}</xs:schema>src/engines/xmllint/tests.rs:681<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"><xs:element/></xs:schema>src/engines/xmllint/tests.rs:694<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">\u{a} <xs:include schemaLocation="types.xsd"/>\u{a} <xs:element name="n" type="Small"/>\u{a}</xs:schema>src/engines/xmllint/tests.rs:706<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">\u{a} <xs:simpleType name="Small">\u{a} <xs:restriction base="xs:int"><xs:maxInclusive value="9"/></xs:restriction>\u{a} </xs:simpleType>…src/engines/xmllint/tests.rs:714http://www.w3.org/2001/XMLSchemasrc/engines/xmllint/xsd.rs:23 src/processor/checker/ixmllint.rs:156http://www.w3.org/2001/XMLSchema-instancesrc/engines/xmllint/xsd.rs:24this:\u{a} is:\u{a} - a:\u{a} http://localhost/very/very/very/very/very/very/very/very/long/url\u{a}\u{a}# this comment is too long,\u{a}# but hard to split:\u{a}# http://localhost/another/…src/engines/yamllint/tests.rs:617- foobar: http://localhost/very/very/very/very/very/very/very/very/long/url\u{a}src/engines/yamllint/tests.rs:631 src/engines/yamllint/tests.rs:641this:\u{a} is:\u{a} - a:\u{a} http://localhost/very/very/very/very/very/very/very/very/long/url\u{a}src/engines/yamllint/tests.rs:649quoted-strings:\u{a} required: false\u{a} extra-required: ['^http://', '^ftp://']\u{a}src/engines/yamllint/tests.rs:723- localhost\u{a}- "localhost"\u{a}- "http://localhost"\u{a}- "ftp://localhost"\u{a}src/engines/yamllint/tests.rs:728- http://localhost\u{a}- ftp://localhost\u{a}src/engines/yamllint/tests.rs:733quoted-strings:\u{a} required: only-when-needed\u{a} extra-allowed: ['^http://', '^ftp://']\u{a} extra-required: [QUOTED]\u{a}src/engines/yamllint/tests.rs:738- localhost\u{a}- "http://localhost"\u{a}- "ftp://localhost"\u{a}- "this is a string that needs to be QUOTED"\u{a}src/engines/yamllint/tests.rs:743<!DOCTYPE html>\u{a}<html>\u{a}<head>\u{a} <meta charset="UTF-8">\u{a} <title>RSConstruct Build Graph</title>\u{a} <script src="https://cdn.jsdelivr.net/npm/mermaid/dist/mermaid.min.js"></scr…src/graph_render.rs:305file://{}src/object_store/mod.rs:255 src/processor/generator/chromium.rs:23 src/remote_cache.rs:470 src/tools.rs:2600 src/tools.rs:2632|https?://[^\s)>""]+src/processor/checker/zspell.rs:178url: https://example.com/path\u{a}time: 10:30src/processor/generator/tags.rs:1929https://example.com/pathsrc/processor/generator/tags.rs:1931s3://src/remote_cache.rs:64 src/remote_cache.rs:86file://src/remote_cache.rs:68 src/remote_cache.rs:343Unsupported remote cache URL: {url}. Supported schemes: s3://, http://, https://, file://src/remote_cache.rs:72s3://{}/{}src/remote_cache.rs:113Invalid file:// URLsrc/remote_cache.rs:343s3://my-bucket/cache/prefixsrc/remote_cache.rs:490s3://bucketsrc/remote_cache.rs:498Could not connect to the endpoint URL: "https://s3.example.amazonaws.com/"src/remote_cache.rs:542https://crates.io/api/v1/crates/{name}src/tool_lock.rs:422https://rubygems.org/api/v1/versions/{name}/latest.jsonsrc/tool_lock.rs:426https://registry.npmjs.org/{}/latestsrc/tool_lock.rs:432https://pypi.org/pypi/{name}/jsonsrc/tool_lock.rs:438https://example.com/rumdl.tar.gzsrc/tool_lock.rs:1089version = 1\u{a}\u{a}[[package]]\u{a}name = "ruff"\u{a}version = "0.14.0"\u{a}source = { registry = "https://pypi.org/simple" }\u{a}src/tool_lock.rs:1299https://api.github.com/repos/{repo}/releases/latestsrc/tools.rs:862https://github.com/src/tools.rs:873 src/tools.rs:884https://github.com/{repo}/releases/download/{tag}/{asset}src/tools.rs:878https://github.com/oxc-project/oxc/releases/download/oxlint_v1.86.0/oxlint-x86_64-unknown-linux-gnu.tar.gzsrc/tools.rs:1196https://github.com/rvben/rumdl/releases/download/v0.2.66/rumdl-v0.2.66-x86_64-unknown-linux-gnu.tar.gzsrc/tools.rs:1203https://github.com/getzola/zola/releases/download/v0.23.3/zola-v0.23.3-x86_64-unknown-linux-gnu.tar.gzsrc/tools.rs:1213https://github.com/tamasfe/taplo/releases/latest/download/taplo-linux-x86_64.gzsrc/tools.rs:1218 src/tools.rs:2354 src/tools.rs:2495https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gzsrc/tools.rs:1227https://github.com/Kampfkarren/selene/releases/download/0.32.0/selene-0.32.0-linux.zipsrc/tools.rs:1238https://github.com/hadolint/hadolint/releases/latest/download/hadolint-Linux-x86_64src/tools.rs:1243https://raw.githubusercontent.com/torvalds/linux/e5f92606156a6a823992294d214c285b49cd72e9/scripts/checkpatch.plsrc/tools.rs:1269https://github.com/jgraph/drawio-desktop/releases/latestsrc/tools.rs:1277https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.debsrc/tools.rs:1290 src/tools.rs:1293cargo-deny v0.20.2:\u{a} cargo-deny\u{a}ripgrep v14.1.0:\u{a} rg\u{a}uv v0.9.0 (https://github.com/astral-sh/uv#abcdef12):\u{a} uv\u{a} uvx\u{a}src/tools.rs:2332https://github.com/tamasfe/taplo/releases/download/0.10.0/taplo-linux-x86_64.gzsrc/tools.rs:2358 src/tools.rs:2497https://dl.google.com/x.debsrc/tools.rs:2361https://github.com/hadolint/hadolint/releases/latest/download/hsrc/tools.rs:2365http://example.invalid/xsrc/webcache.rs:269
info url_literal test 28
<?xml version="1.0"?>\u{a}<!DOCTYPE module PUBLIC "-//Checkstyle//DTD Checkstyle Configuration 1.3//EN" "https://checkstyle.org/dtds/configuration_1_3.dtd">\u{a}<module name="Checker">\u{a} <module n…tests/processor/checker/icheckstyle.rs:9<svg xmlns="http://www.w3.org/2000/svg" role="img" viewBox="0 0 24 24">\u{a} <title>t</title>\u{a} <path d="M1 1" fill="red"/>\u{a}</svg>\u{a}tests/processor/checker/isvglint.rs:47<svg xmlns="http://www.w3.org/2000/svg">\u{a} <rect width="1" height="1"/>\u{a}</svg>\u{a}tests/processor/checker/isvglint.rs:71[processor.checker.isvglint]\u{a}src_dirs = ["img"]\u{a}[[processor.checker.isvglint.attr]]\u{a}"rule::selector" = "svg"\u{a}"rule::whitelist" = true\u{a}xmlns = "http://www.w3.org/2000/svg"\u{a}viewB…tests/processor/checker/isvglint.rs:88<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24" width="24"/>\u{a}tests/processor/checker/isvglint.rs:89<svg xmlns="http://www.w3.org/2000/svg"><g></svg>\u{a}tests/processor/checker/ixmllint.rs:62<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">\u{a} <xs:element name="a">\u{a} <xs:complexType>\u{a} <xs:sequence>\u{a} <xs:element name="b" type="xs:int" maxOccurs="unbounded…tests/processor/checker/ixmllint.rs:121<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">\u{a} <xs:attributeGroup name="g"/>\u{a}</xs:schema>\u{a}tests/processor/checker/ixmllint.rs:187<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">\u{a} <xs:include schemaLocation="types.xsd"/>\u{a} <xs:element name="n" type="Small"/>\u{a}</xs:schema>\u{a}tests/processor/checker/ixmllint.rs:200<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">\u{a} <xs:simpleType name="Small">\u{a} <xs:restriction base="xs:int"><xs:maxInclusive value="{max}"/></xs:restriction>\u{a} </xs:simpleType…tests/processor/checker/ixmllint.rs:204https://example.com/test_schema.jsontests/processor/checker/iyamlschema.rs:6{\u{a} "$schema": "http://json-schema.org/draft-07/schema#",\u{a} "type": "object",\u{a} "properties": {\u{a} "name": { "type": "string" },\u{a} "age": { "type": "integer" }…tests/processor/checker/iyamlschema.rs:11{\u{a} "$schema": "http://json-schema.org/draft-07/schema#",\u{a} "type": "object",\u{a} "properties": {\u{a} "name": { "type": "string" },\u{a} "age": { "ty…tests/processor/checker/iyamlschema.rs:122https://example.com/wrong_order_schema.jsontests/processor/checker/iyamlschema.rs:132source 'https://rubygems.org'\u{a}tests/processor/checker/mdl.rs:100# Doc\u{a}\u{a}* [Bash Manual](https://www.gnu.org/software/bash/manual/)\u{a}* [Manual](https://stedolan.github.io/jq/manual/)\u{a}* https://example.com/bash/jq/index.html\u{a}tests/processor/checker/terms.rs:328# Doc\u{a}\u{a}See [manual](https://www.gnu.org/software/bash/manual/) for bash usage.\u{a}tests/processor/checker/terms.rs:359---\u{a}url: https://example.com/path\u{a}time: 10:30\u{a}tags:\u{a} - tools:web\u{a}---\u{a}tests/processor/generator/tags.rs:461https://example.com/path\u{a}tests/processor/generator/tags.rs:465https://example.com/pathtests/processor/generator/tags.rs:476url:https://example.com/pathtests/processor/generator/tags.rs:491source 'https://rubygems.org'\u{a}gem 'rake'\u{a}tests/processor/mass_generator/gem.rs:23 tests/processor/mass_generator/gem.rs:67 tests/processor/mass_generator/gem.rs:127<svg xmlns="http://www.w3.org/2000/svg"/>\u{a}tests/processor/mass_generator/sphinx.rs:42base_url = "https://example.org"\u{a}default_language = "en"\u{a}title = "Fixture"\u{a}compile_sass = true\u{a}build_search_index = true\u{a}generate_feeds = true\u{a}taxonomies = [{ name = "tags", fe…tests/processor/mass_generator/zola.rs:12<svg xmlns="http://www.w3.org/2000/svg" width="10" height="10"><rect width="10" height="10" fill="red"/></svg>tests/tests_mod/build.rs:1465<svg xmlns="http://www.w3.org/2000/svg" width="10" height="10"><rect width="10" height="10" fill="blue"/></svg>tests/tests_mod/build.rs:1517
info unsafe_code library 4
4 unsafe blocks, functions or implssrc/platform.rs:153 unsafe blocks, functions or implssrc/processor/generator/tera.rs:361 unsafe blocks, functions or implssrc/registries/analyzer.rs:29 src/registries/processor.rs:92
Run: check
succeeded- Ended
- agent reported the end
- Guest
- exit code 0
- Run time
- 685 ms
- VM restore
- 57 ms
- Payload
- 17738 files, 348.8 MiB
- Files opened
- 964
Processes 2
Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number.
| Process | Arguments | Start | Took | Exit |
|---|---|---|---|---|
| cargo /usr/local/bin/cargo | check --locked --offline | 5 ms | 647 ms | 0 |
| └rustc /usr/local/bin/rustc | --crate-name crateward_probe --edition=2021 lib.rs --error-format=json --json=diagnostic-rendered-ansi,artifacts,future-incompat --crate-type lib --emit=dep-info,metadata -C embed-bitcode=no -C debuginfo=2 --check-cfg cfg(docsrs,test) --check-cfg cfg(feature, values()) -C metadata=d9152fcf76bf9b7f -C extra-filename=-8c7788aadf5d3a75 --out-dir /work/target/debug/deps -C incremental=/work/target/debug/incremental -L dependency=/work/target/debug/deps | 414 ms | 213 ms | 0 |
Network 0
No network activity.
Files 0
Secrets opened
None.
Written outside the build directories
None.
Scratch disk 0
- Files
- 21
- Directories
- 19
- Size
- 77.8 KiB
- Compiled units
- 1
Nothing outside the build areas.
Output
Standard error
warning: crateward-probe v0.0.0 (/cw/probe) ignoring invalid dependency `target` which is missing a lib target
Checking crateward-probe v0.0.0 (/cw/probe)
Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.58s
Timeline
6
| When | From | To | Event | Worker |
|---|---|---|---|---|
| 2026-10-27 15:12 UTC | Discovered | Fetched | fetched | fetcher-12688 |
| 2026-10-27 15:12 UTC | Fetched | ReadyForSandbox | static_analysis_completed | static-12726 |
| 2026-10-27 15:12 UTC | ReadyForSandbox | Running | sandbox_started | orchestrator-12760-slot1 |
| 2026-10-27 15:12 UTC | Running | DynamicallyAnalyzed | sandbox_completed | orchestrator-12760-slot1 |
| 2026-10-27 15:12 UTC | DynamicallyAnalyzed | Scored | scored | analyzer-12816 |
| 2026-10-27 15:12 UTC | Scored | Done | finalized | analyzer-12816 |