);
})}
@@ -250,7 +254,11 @@ export function SurfacePage() {
+
{
render(
{
}
let bytes: Vec = s.bytes().filter(|b| !b.is_ascii_whitespace()).collect();
let mut out = Vec::with_capacity(bytes.len() / 4 * 3);
- let mut iter = bytes.chunks(4);
- while let Some(chunk) = iter.next() {
+ for chunk in bytes.chunks(4) {
if chunk.len() < 2 {
return None;
}
diff --git a/src/dynamic/build_pool/ruby.rs b/src/dynamic/build_pool/ruby.rs
index b8326777..082124d0 100644
--- a/src/dynamic/build_pool/ruby.rs
+++ b/src/dynamic/build_pool/ruby.rs
@@ -53,14 +53,14 @@ impl BuildPool for RubyPool {
let start = Instant::now();
// `bundle check` short-circuits when the host already has every gem.
- if let Ok(o) = self.bundle(workdir).arg("check").output() {
- if o.status.success() {
- return PoolCompileResult {
- success: true,
- stderr: String::new(),
- duration: start.elapsed(),
- };
- }
+ if let Ok(o) = self.bundle(workdir).arg("check").output()
+ && o.status.success()
+ {
+ return PoolCompileResult {
+ success: true,
+ stderr: String::new(),
+ duration: start.elapsed(),
+ };
}
// The install target is pinned to a writable vendor dir via
diff --git a/src/dynamic/build_sandbox.rs b/src/dynamic/build_sandbox.rs
index 8897683d..cc727148 100644
--- a/src/dynamic/build_sandbox.rs
+++ b/src/dynamic/build_sandbox.rs
@@ -100,16 +100,16 @@ pub fn prepare_rust(spec: &HarnessSpec, workdir: &Path) -> Result Result<(), String> {
- if is_pool_enabled("rust") {
- if let Ok(pool) = RustPool::try_new() {
- let pool_args = [binary_dest.to_string_lossy().into_owned()];
- let res = pool.compile_batch(workdir, &pool_args);
- if res.success {
- return Ok(());
- }
- if pool.is_healthy() {
- return Err(res.stderr);
- }
+ if is_pool_enabled("rust")
+ && let Ok(pool) = RustPool::try_new()
+ {
+ let pool_args = [binary_dest.to_string_lossy().into_owned()];
+ let res = pool.compile_batch(workdir, &pool_args);
+ if res.success {
+ return Ok(());
+ }
+ if pool.is_healthy() {
+ return Err(res.stderr);
}
}
try_build_rust_binary(workdir, binary_dest)
@@ -496,15 +496,15 @@ pub fn prepare_ruby(spec: &HarnessSpec, workdir: &Path) -> Result Result<(), String> {
- if is_pool_enabled("ruby") {
- if let Ok(pool) = RubyPool::try_new() {
- let res = pool.compile_batch(workdir, &[]);
- if res.success {
- return Ok(());
- }
- if pool.is_healthy() {
- return Err(res.stderr);
- }
+ if is_pool_enabled("ruby")
+ && let Ok(pool) = RubyPool::try_new()
+ {
+ let res = pool.compile_batch(workdir, &[]);
+ if res.success {
+ return Ok(());
+ }
+ if pool.is_healthy() {
+ return Err(res.stderr);
}
}
try_bundle_install(workdir)
@@ -672,15 +672,15 @@ pub fn prepare_node(spec: &HarnessSpec, workdir: &Path) -> Result Result<(), String> {
- if is_pool_enabled("node") {
- if let Ok(pool) = NodePool::try_new() {
- let res = pool.compile_batch(workdir, &[]);
- if res.success {
- return Ok(());
- }
- if pool.is_healthy() {
- return Err(res.stderr);
- }
+ if is_pool_enabled("node")
+ && let Ok(pool) = NodePool::try_new()
+ {
+ let res = pool.compile_batch(workdir, &[]);
+ if res.success {
+ return Ok(());
+ }
+ if pool.is_healthy() {
+ return Err(res.stderr);
}
}
try_npm_install(workdir)
@@ -804,16 +804,16 @@ pub fn prepare_go(spec: &HarnessSpec, workdir: &Path) -> Result Result<(), String> {
- if is_pool_enabled("go") {
- if let Ok(pool) = GoPool::try_new() {
- let pool_args = [binary_dest.to_string_lossy().into_owned()];
- let res = pool.compile_batch(workdir, &pool_args);
- if res.success {
- return Ok(());
- }
- if pool.is_healthy() {
- return Err(res.stderr);
- }
+ if is_pool_enabled("go")
+ && let Ok(pool) = GoPool::try_new()
+ {
+ let pool_args = [binary_dest.to_string_lossy().into_owned()];
+ let res = pool.compile_batch(workdir, &pool_args);
+ if res.success {
+ return Ok(());
+ }
+ if pool.is_healthy() {
+ return Err(res.stderr);
}
}
try_build_go_binary(workdir, binary_dest)
@@ -1115,22 +1115,22 @@ fn try_compile_java_with_toolchain(
// the direct-spawn legacy path so an operator with a broken JDK
// install still gets a deterministic build error from `javac`
// itself rather than from the pool wrapper.
- if is_pool_enabled("java") {
- if let Some(pool) = javac_pool_for(toolchain_id) {
- let result = pool.compile_batch(workdir, &args);
- if result.success {
- return finalize_java_compile(workdir, cache_path, lib_on_cp);
- }
- if pool.is_healthy() {
- // The compile itself failed (real source error) -- surface
- // the worker's stderr verbatim.
- return Err(result.stderr);
- }
- // Worker crashed: drop the cached pool so the next call
- // re-spawns it, then fall through to the legacy direct-spawn
- // path so this build still has a chance to succeed.
- drop_javac_pool(toolchain_id);
+ if is_pool_enabled("java")
+ && let Some(pool) = javac_pool_for(toolchain_id)
+ {
+ let result = pool.compile_batch(workdir, &args);
+ if result.success {
+ return finalize_java_compile(workdir, cache_path, lib_on_cp);
}
+ if pool.is_healthy() {
+ // The compile itself failed (real source error) -- surface
+ // the worker's stderr verbatim.
+ return Err(result.stderr);
+ }
+ // Worker crashed: drop the cached pool so the next call
+ // re-spawns it, then fall through to the legacy direct-spawn
+ // path so this build still has a chance to succeed.
+ drop_javac_pool(toolchain_id);
}
let javac = std::env::var("NYX_JAVAC_BIN").unwrap_or_else(|_| "javac".to_owned());
@@ -1372,15 +1372,15 @@ pub fn prepare_php(spec: &HarnessSpec, workdir: &Path) -> Result Result<(), String> {
- if is_pool_enabled("php") {
- if let Ok(pool) = PhpPool::try_new() {
- let res = pool.compile_batch(workdir, &[]);
- if res.success {
- return Ok(());
- }
- if pool.is_healthy() {
- return Err(res.stderr);
- }
+ if is_pool_enabled("php")
+ && let Ok(pool) = PhpPool::try_new()
+ {
+ let res = pool.compile_batch(workdir, &[]);
+ if res.success {
+ return Ok(());
+ }
+ if pool.is_healthy() {
+ return Err(res.stderr);
}
}
try_composer_install(workdir)
@@ -1486,19 +1486,19 @@ pub fn prepare_c(
/// static-link toggle is forwarded so the pool can reproduce the
/// Strict-profile `-static` fallback.
fn build_c_binary(workdir: &Path, binary_dest: &Path, static_link: bool) -> Result<(), String> {
- if is_pool_enabled("c") {
- if let Ok(pool) = CPool::try_new() {
- let pool_args = [
- binary_dest.to_string_lossy().into_owned(),
- if static_link { "static" } else { "dynamic" }.to_owned(),
- ];
- let res = pool.compile_batch(workdir, &pool_args);
- if res.success {
- return Ok(());
- }
- if pool.is_healthy() {
- return Err(res.stderr);
- }
+ if is_pool_enabled("c")
+ && let Ok(pool) = CPool::try_new()
+ {
+ let pool_args = [
+ binary_dest.to_string_lossy().into_owned(),
+ if static_link { "static" } else { "dynamic" }.to_owned(),
+ ];
+ let res = pool.compile_batch(workdir, &pool_args);
+ if res.success {
+ return Ok(());
+ }
+ if pool.is_healthy() {
+ return Err(res.stderr);
}
}
try_build_c_binary(workdir, binary_dest, static_link)
@@ -1654,16 +1654,16 @@ pub fn prepare_cpp(spec: &HarnessSpec, workdir: &Path) -> Result Result<(), String> {
- if is_pool_enabled("cpp") {
- if let Ok(pool) = CppPool::try_new() {
- let pool_args = [binary_dest.to_string_lossy().into_owned()];
- let res = pool.compile_batch(workdir, &pool_args);
- if res.success {
- return Ok(());
- }
- if pool.is_healthy() {
- return Err(res.stderr);
- }
+ if is_pool_enabled("cpp")
+ && let Ok(pool) = CppPool::try_new()
+ {
+ let pool_args = [binary_dest.to_string_lossy().into_owned()];
+ let res = pool.compile_batch(workdir, &pool_args);
+ if res.success {
+ return Ok(());
+ }
+ if pool.is_healthy() {
+ return Err(res.stderr);
}
}
try_build_cpp_binary(workdir, binary_dest)
diff --git a/src/dynamic/corpus/path_trav/java.rs b/src/dynamic/corpus/path_trav/java.rs
index 2a1a9bd5..8b21c4d4 100644
--- a/src/dynamic/corpus/path_trav/java.rs
+++ b/src/dynamic/corpus/path_trav/java.rs
@@ -27,10 +27,10 @@ use super::super::{CuratedPayload, Oracle, PayloadProvenance, PayloadRef};
/// `../nyx_pt_canary` traversal resolves.
pub const CANARY_FILENAME: &str = "nyx_pt_canary";
-/// Canary file CONTENT — the collision-resistant FILE_IO marker. Alphanumeric
-/// + underscore so a faithful HTML/URL escaper leaves it intact when the
-/// fixture writes the read bytes to the response. NOT a substring of any
-/// payload path.
+/// Canary file content for the collision-resistant FILE_IO marker. It uses
+/// alphanumeric characters plus underscore, so a faithful HTML/URL escaper
+/// leaves it intact when the fixture writes the read bytes to the response.
+/// NOT a substring of any payload path.
pub const CANARY_MARKER: &str = "NYX_PATHTRAVERSAL_R34D_a7f3c1d8";
pub const PAYLOADS: &[CuratedPayload] = &[
diff --git a/src/dynamic/oracle.rs b/src/dynamic/oracle.rs
index 07efabe8..d8466621 100644
--- a/src/dynamic/oracle.rs
+++ b/src/dynamic/oracle.rs
@@ -2021,7 +2021,7 @@ mod tests {
.all(|b| b.is_ascii_hexdigit() && !b.is_ascii_uppercase()),
"render must be lowercase hex: {r}",
);
- assert!(Canary::ENTROPY_BITS >= 128);
+ const { assert!(Canary::ENTROPY_BITS >= 128) };
assert!(
r.len() * 4 >= 128,
"rendered canary clears the 128-bit floor"
diff --git a/src/dynamic/sandbox/process_linux.rs b/src/dynamic/sandbox/process_linux.rs
index 2f62f960..0ac5919e 100644
--- a/src/dynamic/sandbox/process_linux.rs
+++ b/src/dynamic/sandbox/process_linux.rs
@@ -287,7 +287,7 @@ unsafe extern "C" {
target: *const i8,
fstype: *const i8,
flags: u64,
- data: *const i8,
+ data: *const core::ffi::c_void,
) -> i32;
fn write(fd: i32, buf: *const u8, count: usize) -> isize;
fn __errno_location() -> *mut i32;
@@ -319,10 +319,6 @@ fn apply_no_new_privs() -> PrimitiveStatus {
}
}
-fn apply_unshare() -> PrimitiveStatus {
- apply_unshare_with_flags(CLONE_NEWUSER | CLONE_NEWPID | CLONE_NEWNS)
-}
-
fn apply_unshare_with_flags(flags: i32) -> PrimitiveStatus {
// CLONE_NEWUSER must come first on most modern kernels so the
// unprivileged caller can map uid/gid; CLONE_NEWPID + CLONE_NEWNS
@@ -388,9 +384,10 @@ struct BindMount {
/// the [`HardeningOutcome`] wire record, so callers that care about the
/// bind-mount succeeding gate on whether the harness produced output.
///
-/// Called in pre_exec between [`apply_unshare`] and [`apply_chroot`] so
-/// the new mount namespace is private to the child + grandchildren and
-/// the workdir is still reachable at its host-side absolute path.
+/// Called in pre_exec after [`apply_unshare_with_flags`] and before
+/// [`apply_chroot`] so the new mount namespace is private to the child +
+/// grandchildren and the workdir is still reachable at its host-side absolute
+/// path.
fn apply_bind_mounts(mounts: &[BindMount]) {
let none = b"none\0";
for m in mounts {
diff --git a/tests/oracle_canary_audit.rs b/tests/oracle_canary_audit.rs
index 6b017a2f..c23f7f1c 100644
--- a/tests/oracle_canary_audit.rs
+++ b/tests/oracle_canary_audit.rs
@@ -130,10 +130,7 @@ fn corpus_canaries_use_placeholder_and_are_substitutable() {
/// once for the oracle — and the two must agree).
#[test]
fn canary_entropy_and_determinism() {
- assert!(
- Canary::ENTROPY_BITS >= 128,
- "Canary::ENTROPY_BITS must clear the 128-bit floor",
- );
+ const { assert!(Canary::ENTROPY_BITS >= 128) };
let bytes = Canary::generate("spec-hash-under-audit");
assert_eq!(bytes.len(), 32, "canary is 256 bits of BLAKE3 output");