test(desktop): net_guard grep-ban matches allow-list by full path + recursive src walk (LC-210-GREPBAN-FULLPATH) #289

Merged

longjacksonle merged 1 commit from fix/lc-210-grepban-fullpath into main

2026-05-31 05:13:18 +02:00

longjacksonle commented

2026-05-31 05:11:37 +02:00

Owner

Closes #285 (LC-210-GREPBAN-FULLPATH). Small fix-in-passing.

The desktop net_guard ureq grep-ban matched its allow-list by basename, diverging from the LC-152/204/206 bans, which match full relative paths specifically so a future same-basename file in a subdirectory cannot inherit the exemption. It was safe only because desktop/src/ is flat. Compounding it, the walker used a non-recursive read_dir, so a raw ureq added in any future subdir file would not have been scanned at all.

Both holes closed:

src_files() now walks src/ recursively.
The allow-list is matched against the path relative to src/ (forward-slash separated for cross-platform stability), so a hypothetical src/foo/welcome.rs is foo/welcome.rs (not exempt) and is scanned.

BAN_ALLOWED (net_guard.rs, welcome.rs) is unchanged because both files sit at the src root, so today's coverage is identical - the change only removes the latent subdir hole and re-aligns all four grep-bans on one convention. The load-bearing meta-test resolves src_root().join(allowed), which handles a future subdir entry too.

just test-desktop 13/13; just check clean (both server modes + desktop clippy -D warnings + fmt). No [operator-action] (test-infra hardening, no behavior change).

🤖 Generated with Claude Code

Closes #285 (LC-210-GREPBAN-FULLPATH). Small fix-in-passing. The desktop `net_guard` ureq grep-ban matched its allow-list by **basename**, diverging from the LC-152/204/206 bans, which match **full relative paths** specifically so a future same-basename file in a subdirectory cannot inherit the exemption. It was safe only because `desktop/src/` is flat. Compounding it, the walker used a non-recursive `read_dir`, so a raw `ureq` added in any future subdir file would not have been scanned at all. Both holes closed: - `src_files()` now walks `src/` **recursively**. - The allow-list is matched against the path **relative to `src/`** (forward-slash separated for cross-platform stability), so a hypothetical `src/foo/welcome.rs` is `foo/welcome.rs` (not exempt) and is scanned. `BAN_ALLOWED` (`net_guard.rs`, `welcome.rs`) is unchanged because both files sit at the src root, so today's coverage is identical - the change only removes the latent subdir hole and re-aligns all four grep-bans on one convention. The load-bearing meta-test resolves `src_root().join(allowed)`, which handles a future subdir entry too. `just test-desktop` 13/13; `just check` clean (both server modes + desktop clippy `-D warnings` + fmt). No `[operator-action]` (test-infra hardening, no behavior change). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

longjacksonle added 1 commit

2026-05-31 05:11:37 +02:00

test(desktop): match net_guard ureq grep-ban allow-list by full path, walk src recursively (LC-210-GREPBAN-FULLPATH, #285 )

check-secrets / TruffleHog (push) Successful in 5s

Details

check-secrets / Kingfisher (push) Successful in 5s

Details

check-secrets / TruffleHog (pull_request) Successful in 3s

Details

check-secrets / Nosey parker (push) Successful in 5s

Details

check-secrets / Nosey parker (pull_request) Successful in 4s

Details

check-secrets / Kingfisher (pull_request) Successful in 10s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

Check / clippy + fmt + tests (pull_request) Successful in 2m12s

Details

9a9da4ed7a

The LC-210 net_guard grep-ban matched its allow-list by basename, diverging from the LC-152/204/206 bans, which deliberately match full relative paths so a future same-basename file in a subdirectory cannot inherit the exemption. It was safe only because desktop/src/ is flat. Worse, the walker used a non-recursive read_dir, so a raw ureq added in any future subdir file would not be scanned at all.

Both holes are now closed: src_files() walks src/ recursively, and the allow-list is matched against the path RELATIVE TO src/ (forward-slash separated for cross-platform stability), so a hypothetical src/foo/welcome.rs is foo/welcome.rs - not exempt - and is scanned. BAN_ALLOWED entries (net_guard.rs, welcome.rs) are unchanged because both files sit at the src root, so today's coverage is identical; the change only removes the latent subdir hole and re-aligns all four grep-bans on one convention.

just test-desktop 13/13; just check clean (both server modes + desktop clippy + fmt).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>