Skip to content

Commit 04b0cf2

Browse files
Jonathan D.A. Jewellclaude
Jonathan D.A. Jewell
and
claude
committed
fix: integrate shared third-party excludes + fix stale line-number bugs
- Source lib/third-party-excludes.sh in 17 fix scripts, replacing per-script SKIP_DIRS with the shared FIND_THIRD_PARTY_EXCLUDES array - Fix stale line-number bug in 5 scripts (innerhtml, secret-to-env, unchecked-error, resource-leak, sql-parameterize) by processing grep -n results in reverse order (sort -rn) so sed insertions don't shift subsequent line numbers Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 parent 8963ebd commit 04b0cf2

17 files changed

Lines changed: 92 additions & 77 deletions

‎scripts/fix-atom-exhaustion.sh‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@
1515

1616
set -euo pipefail
1717

18+
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
19+
source "$SCRIPT_DIR/lib/third-party-excludes.sh" 2>/dev/null || true
20+
1821
REPO_PATH="${1:?Usage: $0 <repo-path> <finding-json>}"
1922
FINDING_JSON="${2:?Missing finding JSON file}"
2023

@@ -26,13 +29,8 @@ echo " Repo: $REPO_PATH"
2629
echo " Pattern: $PATTERN_ID"
2730
echo ""
2831

29-
# Directories to skip
30-
SKIP_DIRS=( "_build" "deps" ".git" )
31-
32-
FIND_EXCLUDES=()
33-
for dir in "${SKIP_DIRS[@]}"; do
34-
FIND_EXCLUDES+=( -not -path "*/${dir}/*" )
35-
done
32+
# Use shared third-party exclusions
33+
FIND_EXCLUDES=(-not -path "*/.git/*" "${FIND_THIRD_PARTY_EXCLUDES[@]}")
3634

3735
# Find all Elixir source files
3836
EX_FILES=()

‎scripts/fix-believe-me.sh‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@
1010

1111
set -euo pipefail
1212

13+
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
14+
source "$SCRIPT_DIR/lib/third-party-excludes.sh" 2>/dev/null || true
15+
1316
REPO_PATH="${1:?Usage: $0 <repo-path> <finding-json>}"
1417
FINDING_JSON="${2:?Missing finding JSON file}"
1518

@@ -36,7 +39,7 @@ while IFS= read -r -d '' file; do
3639

3740
((FIXED_COUNT++)) || true
3841
fi
39-
done < <(find "$REPO_PATH" -type f -name "*.idr" -not -path "*/\.git/*" -not -path "*/.pack/*" -print0 2>/dev/null)
42+
done < <(find "$REPO_PATH" -type f -name "*.idr" -not -path "*/.git/*" "${FIND_THIRD_PARTY_EXCLUDES[@]}" -not -path "*/.pack/*" -print0 2>/dev/null)
4043

4144
echo ""
4245
if [[ "$FIXED_COUNT" -gt 0 ]]; then

‎scripts/fix-command-injection.sh‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,9 @@
2020

2121
set -euo pipefail
2222

23+
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
24+
source "$SCRIPT_DIR/lib/third-party-excludes.sh" 2>/dev/null || true
25+
2326
REPO_PATH="${1:?Usage: $0 <repo-path> <finding-json>}"
2427
FINDING_JSON="${2:?Missing finding JSON file}"
2528

@@ -31,14 +34,8 @@ echo " Repo: $REPO_PATH"
3134
echo " Pattern: $PATTERN_ID"
3235
echo ""
3336

34-
# Directories to skip
35-
SKIP_DIRS=(".git" "target" "node_modules" "_build" ".lake")
36-
37-
# Build the -not -path clauses for find
38-
FIND_EXCLUDES=()
39-
for d in "${SKIP_DIRS[@]}"; do
40-
FIND_EXCLUDES+=(-not -path "*/${d}/*")
41-
done
37+
# Use shared third-party exclusions
38+
FIND_EXCLUDES=(-not -path "*/.git/*" "${FIND_THIRD_PARTY_EXCLUDES[@]}")
4239

4340
FIXED_COUNT=0
4441

‎scripts/fix-dynamic-code-exec.sh‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@
1313

1414
set -euo pipefail
1515

16+
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
17+
source "$SCRIPT_DIR/lib/third-party-excludes.sh" 2>/dev/null || true
18+
1619
REPO_PATH="${1:?Usage: $0 <repo-path> <finding-json>}"
1720
FINDING_JSON="${2:?Missing finding JSON file}"
1821

@@ -24,14 +27,8 @@ echo " Repo: $REPO_PATH"
2427
echo " Pattern: $PATTERN_ID"
2528
echo ""
2629

27-
# Directories to skip
28-
SKIP_DIRS=( ".git" "node_modules" "target" "_build" "vendor" ".lake" )
29-
30-
# Build the -not -path predicates for find
31-
FIND_EXCLUDES=()
32-
for dir in "${SKIP_DIRS[@]}"; do
33-
FIND_EXCLUDES+=( -not -path "*/${dir}/*" )
34-
done
30+
# Use shared third-party exclusions
31+
FIND_EXCLUDES=(-not -path "*/.git/*" "${FIND_THIRD_PARTY_EXCLUDES[@]}")
3532

3633
FIXED_COUNT=0
3734

‎scripts/fix-eval-to-safe.sh‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@
1414

1515
set -euo pipefail
1616

17+
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
18+
source "$SCRIPT_DIR/lib/third-party-excludes.sh" 2>/dev/null || true
19+
1720
REPO_PATH="${1:?Usage: $0 <repo-path> <finding-json>}"
1821
FINDING_JSON="${2:?Missing finding JSON file}"
1922

@@ -22,13 +25,8 @@ echo " Repo: $REPO_PATH"
2225

2326
FIXED_COUNT=0
2427

25-
# Directories to skip
26-
SKIP_DIRS=( ".git" "node_modules" "target" "_build" "vendor" )
27-
28-
FIND_EXCLUDES=()
29-
for dir in "${SKIP_DIRS[@]}"; do
30-
FIND_EXCLUDES+=( -not -path "*/${dir}/*" )
31-
done
28+
# Use shared third-party exclusions
29+
FIND_EXCLUDES=(-not -path "*/.git/*" "${FIND_THIRD_PARTY_EXCLUDES[@]}")
3230

3331
# --- Shell files (.sh, .bash) ---
3432
while IFS= read -r -d '' file; do

‎scripts/fix-hardcoded-secrets.sh‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@
1717

1818
set -euo pipefail
1919

20+
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
21+
source "$SCRIPT_DIR/lib/third-party-excludes.sh" 2>/dev/null || true
22+
2023
REPO_PATH="${1:?Usage: $0 <repo-path> <finding-json>}"
2124
FINDING_JSON="${2:?Missing finding JSON file}"
2225

@@ -28,13 +31,8 @@ echo " Repo: $REPO_PATH"
2831
echo " Pattern: $PATTERN_ID"
2932
echo ""
3033

31-
# Directories to skip
32-
SKIP_DIRS=(".git" "target" "node_modules" "_build" ".lake")
33-
34-
FIND_EXCLUDES=()
35-
for d in "${SKIP_DIRS[@]}"; do
36-
FIND_EXCLUDES+=(-not -path "*/${d}/*")
37-
done
34+
# Use shared third-party exclusions
35+
FIND_EXCLUDES=(-not -path "*/.git/*" "${FIND_THIRD_PARTY_EXCLUDES[@]}")
3836

3937
FIXED_COUNT=0
4038

‎scripts/fix-innerhtml.sh‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@
1010

1111
set -euo pipefail
1212

13+
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
14+
source "$SCRIPT_DIR/lib/third-party-excludes.sh" 2>/dev/null || true
15+
1316
REPO_PATH="${1:?Usage: $0 <repo-path> <finding-json>}"
1417
FINDING_JSON="${2:?Missing finding JSON file}"
1518

@@ -48,7 +51,7 @@ while IFS= read -r -d '' file; do
4851
sed -i "${line_num}s/\.innerHTML\s*=/.textContent =/" "$file" 2>/dev/null || true
4952
changed=true
5053
fi
51-
done < <(grep -nP '\.innerHTML\s*=' "$file" 2>/dev/null | cut -d: -f1)
54+
done < <(grep -nP '\.innerHTML\s*=' "$file" 2>/dev/null | cut -d: -f1 | sort -rn)
5255
fi
5356

5457
# Pattern 2: .innerHTML used in concatenation (.innerHTML += ...)
@@ -80,8 +83,8 @@ while IFS= read -r -d '' file; do
8083
((FIXED_COUNT++)) || true
8184
fi
8285
done < <(find "$REPO_PATH" -type f \( -name "*.js" -o -name "*.mjs" -o -name "*.jsx" -o -name "*.res" \) \
83-
-not -path "*/node_modules/*" -not -path "*/\.git/*" -not -path "*/target/*" \
84-
-not -path "*/_build/*" -not -name "*.min.js" -print0 2>/dev/null)
86+
-not -path "*/.git/*" "${FIND_THIRD_PARTY_EXCLUDES[@]}" \
87+
-not -name "*.min.js" -print0 2>/dev/null)
8588

8689
echo ""
8790
if [[ "$FIXED_COUNT" -gt 0 ]]; then

‎scripts/fix-resource-leak.sh‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@
1010

1111
set -euo pipefail
1212

13+
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
14+
source "$SCRIPT_DIR/lib/third-party-excludes.sh" 2>/dev/null || true
15+
1316
REPO_PATH="${1:?Usage: $0 <repo-path> <finding-json>}"
1417
FINDING_JSON="${2:?Missing finding JSON file}"
1518

@@ -36,15 +39,15 @@ while IFS= read -r -d '' file; do
3639
sed -i "${line_num}i\\ // TODO: ensure file handle is dropped/closed (use ? or explicit drop)" "$file" 2>/dev/null || true
3740
changed=true
3841
fi
39-
done < <(grep -nP 'File::open\(' "$file" 2>/dev/null | cut -d: -f1)
42+
done < <(grep -nP 'File::open\(' "$file" 2>/dev/null | cut -d: -f1 | sort -rn)
4043
fi
4144

4245
if [[ "$changed" == "true" ]]; then
4346
echo " FIXED $rel_path"
4447
((FIXED_COUNT++)) || true
4548
fi
4649
done < <(find "$REPO_PATH" -type f -name "*.rs" \
47-
-not -path "*/\.git/*" -not -path "*/target/*" -print0 2>/dev/null)
50+
-not -path "*/.git/*" "${FIND_THIRD_PARTY_EXCLUDES[@]}" -print0 2>/dev/null)
4851

4952
# --- Python: open() without with statement ---
5053
while IFS= read -r -d '' file; do
@@ -65,15 +68,15 @@ while IFS= read -r -d '' file; do
6568
sed -i "${line_num}i\\ # TODO: use 'with open(...)' context manager to prevent resource leak" "$file" 2>/dev/null || true
6669
changed=true
6770
fi
68-
done < <(grep -nP '^\s+\w+\s*=\s*open\(' "$file" 2>/dev/null | cut -d: -f1)
71+
done < <(grep -nP '^\s+\w+\s*=\s*open\(' "$file" 2>/dev/null | cut -d: -f1 | sort -rn)
6972
fi
7073

7174
if [[ "$changed" == "true" ]]; then
7275
echo " FIXED $rel_path"
7376
((FIXED_COUNT++)) || true
7477
fi
7578
done < <(find "$REPO_PATH" -type f -name "*.py" \
76-
-not -path "*/\.git/*" -not -path "*/venv/*" -not -path "*/__pycache__/*" -print0 2>/dev/null)
79+
-not -path "*/.git/*" "${FIND_THIRD_PARTY_EXCLUDES[@]}" -not -path "*/venv/*" -print0 2>/dev/null)
7780

7881
echo ""
7982
if [[ "$FIXED_COUNT" -gt 0 ]]; then

‎scripts/fix-secret-to-env.sh‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@
1010

1111
set -euo pipefail
1212

13+
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
14+
source "$SCRIPT_DIR/lib/third-party-excludes.sh" 2>/dev/null || true
15+
1316
REPO_PATH="${1:?Usage: $0 <repo-path> <finding-json>}"
1417
FINDING_JSON="${2:?Missing finding JSON file}"
1518

@@ -67,7 +70,7 @@ while IFS= read -r -d '' file; do
6770
((FIXED_COUNT++)) || true
6871
fi
6972
done < <(find "$REPO_PATH" -type f \( -name "*.sh" -o -name "*.bash" -o -name "*.env.example" \) \
70-
-not -path "*/\.git/*" -not -path "*/node_modules/*" -print0 2>/dev/null)
73+
-not -path "*/.git/*" "${FIND_THIRD_PARTY_EXCLUDES[@]}" -print0 2>/dev/null)
7174

7275
# --- YAML/config files ---
7376
while IFS= read -r -d '' file; do
@@ -97,14 +100,14 @@ while IFS= read -r -d '' file; do
97100

98101
sed -i "${line_num}i\\ # SECURITY: replace hardcoded secret with environment variable" "$file" 2>/dev/null || true
99102
changed=true
100-
done < <(grep -niP "^\\s*${SECRET_KEYS}:\\s*[\"'].+[\"']" "$file" 2>/dev/null || true)
103+
done < <(grep -niP "^\\s*${SECRET_KEYS}:\\s*[\"'].+[\"']" "$file" 2>/dev/null | sort -t: -k1,1 -rn || true)
101104

102105
if [[ "$changed" == "true" ]]; then
103106
echo " FIXED $rel_path — added secret warnings"
104107
((FIXED_COUNT++)) || true
105108
fi
106109
done < <(find "$REPO_PATH" -type f \( -name "*.yml" -o -name "*.yaml" -o -name "*.toml" \) \
107-
-not -path "*/\.git/*" -not -path "*/node_modules/*" \
110+
-not -path "*/.git/*" "${FIND_THIRD_PARTY_EXCLUDES[@]}" \
108111
-not -path "*/.github/workflows/*" -print0 2>/dev/null)
109112

110113
# --- Elixir config files ---
@@ -128,7 +131,7 @@ while IFS= read -r -d '' file; do
128131
sed -i "${line_num}i\\ # SECURITY: replace hardcoded secret with System.get_env/1" "$file" 2>/dev/null || true
129132
changed=true
130133
fi
131-
done < <(grep -nP "${SECRET_KEYS}:\\s*\"[^\"]{8,}\"" "$file" 2>/dev/null | cut -d: -f1)
134+
done < <(grep -nP "${SECRET_KEYS}:\\s*\"[^\"]{8,}\"" "$file" 2>/dev/null | cut -d: -f1 | sort -rn)
132135
fi
133136
fi
134137

@@ -137,7 +140,7 @@ while IFS= read -r -d '' file; do
137140
((FIXED_COUNT++)) || true
138141
fi
139142
done < <(find "$REPO_PATH" -type f \( -name "*.ex" -o -name "*.exs" \) \
140-
-not -path "*/_build/*" -not -path "*/deps/*" -not -path "*/\.git/*" -print0 2>/dev/null)
143+
-not -path "*/.git/*" "${FIND_THIRD_PARTY_EXCLUDES[@]}" -print0 2>/dev/null)
141144

142145
echo ""
143146
if [[ "$FIXED_COUNT" -gt 0 ]]; then

‎scripts/fix-shell-quoting.sh‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@
1010

1111
set -euo pipefail
1212

13+
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
14+
source "$SCRIPT_DIR/lib/third-party-excludes.sh" 2>/dev/null || true
15+
1316
REPO_PATH="${1:?Usage: $0 <repo-path> <finding-json>}"
1417
FINDING_JSON="${2:?Missing finding JSON file}"
1518

@@ -26,7 +29,7 @@ echo ""
2629
SHELL_FILES=()
2730
while IFS= read -r -d '' f; do
2831
SHELL_FILES+=("$f")
29-
done < <(find "$REPO_PATH" -type f \( -name "*.sh" -o -name "*.bash" \) -not -path "*/\.git/*" -not -path "*/node_modules/*" -not -path "*/target/*" -print0 2>/dev/null)
32+
done < <(find "$REPO_PATH" -type f \( -name "*.sh" -o -name "*.bash" \) -not -path "*/.git/*" "${FIND_THIRD_PARTY_EXCLUDES[@]}" -print0 2>/dev/null)
3033

3134
# Also check .yml/.yaml files for shell: sections
3235
while IFS= read -r -d '' f; do

0 commit comments

Comments
 (0)