op-supervisor: experimental cross-safety, with hazard detection #12460
Conversation
|
Semgrep found 3
require() must include a reason string Ignore this finding from sol-style-require-reason.Semgrep found 2 No Semgrep found 15
TODO in error handling code Ignore this finding from err-todo. |
protolambda
force-pushed
the
interop-dependency-set
branch
from
962730f to
e7fb182
Compare
protolambda
force-pushed
the
cross-safe-updates
branch
from
bef1185 to
0608c35
Compare
protolambda
force-pushed
the
cross-safe-updates
branch
from
0608c35 to
ac862df
Compare
|
Semgrep found 6
Inputs to functions must be prepended with an underscore ( |
ghost
force-pushed
the
cross-safe-updates
branch
from
ac862df to
2e889c9
Compare
|
Semgrep found 3
No |
![semgrep-app[bot]](https://avatars.githubusercontent.com/in/60555?s=60&v=4){kind=small}
|
|
||
| var ( | ||
| ErrChainIndexNotFound = fmt.Errorf("no index found for chain ID") | ||
| ErrChainIDNotFound = fmt.Errorf("no chain ID found for index") |
There was a problem hiding this comment.
No fmt.Errorf invocations without fmt arguments allowed
| ) | ||
|
|
||
| var ( | ||
| ErrChainIndexNotFound = fmt.Errorf("no index found for chain ID") |
There was a problem hiding this comment.
No fmt.Errorf invocations without fmt arguments allowed
…cy set, fix some interfaces
protolambda
force-pushed
the
cross-safe-updates
branch
from
9570157 to
ddb07ff
Compare
| Dependencies map[types.ChainID]*StaticConfigDependency `json:"dependencies"` | ||
| } | ||
|
|
||
| func (ds *StaticConfigDependencySet) MarshalJSON() ([]byte, error) { |
There was a problem hiding this comment.
MarshalJSON with a pointer receiver has surprising results: golang/go#22967
Ignore this finding from marshal-json-pointer-receiver.
|
Semgrep found 1 No |
|
Semgrep found 1 Prefer |
|
Semgrep found 1 require() must include a reason string Ignore this finding from sol-style-require-reason.Semgrep found 5
Inputs to functions must be prepended with an underscore ( |
|
Semgrep found 1 Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'. Ignore this finding from no-direct-write-to-responsewriter.Semgrep found 1 Untrusted input could be used to tamper with a web page rendering, which can lead to a Cross-site scripting (XSS) vulnerability. XSS vulnerabilities occur when untrusted input executes malicious JavaScript code, leading to issues such as account compromise and sensitive information leakage. To prevent this vulnerability, validate the user input, perform contextual output encoding or sanitize the input. For more information, see: Go XSS prevention. View Dataflow Graphflowchart LR
classDef invis fill:white, stroke: none
classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none
subgraph File0["<b>op-challenger/game/fault/trace/prestates/multi_test.go</b>"]
direction LR
%% Source
subgraph Source
direction LR
v0["<a href=https://github.com/ethereum-optimism/optimism/blob/4e80661c00e4fb3ab2d0d8fc2921e05b6abee2f2/op-challenger/game/fault/trace/prestates/multi_test.go#L194 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 194] r.URL</a>"]
end
%% Intermediate
%% Sink
subgraph Sink
direction LR
v1["<a href=https://github.com/ethereum-optimism/optimism/blob/4e80661c00e4fb3ab2d0d8fc2921e05b6abee2f2/op-challenger/game/fault/trace/prestates/multi_test.go#L194 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 194] w.Write([]byte(r.URL.Path))</a>"]
end
end
%% Class Assignment
Source:::invis
Sink:::invis
File0:::invis
%% Connections
Source --> Sink
|
axelKingsley
force-pushed
the
cross-safe-updates
branch
from
4e80661 to
7573534
Compare
|
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
|
Semgrep found 1 Modifiers that don't do something before and after execution are banned. Ignore this finding from ban_non_wraparound_modifiers. |
|
Semgrep found 3 require() must include a reason string Ignore this finding from sol-style-require-reason. |
|
Closing in favor of #12624 |
3 participants
Description
Implement cross-safe and cross-unsafe resolution.
Not integrated fully into op-supervisor yet, meant to function as encapsulated routines, and then instantiate under a worker routine, which is then managed by the backend.
Based on #12450 : once we integrate, we'll need to instantiate a cross-safe and cross-unsafe worker per chain in the dependency set, regardless of RPC connectivity.
Tests
Work in progress.
Additional context
Metadata
Fix #12075