[audit] Security, AX compliance, missing tests, error handling #23

New issue

Open

opened 2026-03-22 16:40:59 +00:00 by Virgil · 1 comment

Virgil commented

2026-03-22 16:40:59 +00:00

Member

Full audit:

Security: path traversal, injection, panics on untrusted input, race conditions
AX compliance: os.Getenv → core.Env, filepath.* → core.Path*, fmt.Sprintf → core.Sprintf, strings.* → core.*, errors.New/fmt.Errorf → core.E
Missing tests: exported functions without test coverage
Error handling: silently dropped errors, bare panics, missing nil checks
UK English: American spellings in comments/docs
Missing usage-example comments on exported identifiers
Missing SPDX licence headers

Report all findings with severity and file:line. Do NOT fix.

Full audit: 1. Security: path traversal, injection, panics on untrusted input, race conditions 2. AX compliance: os.Getenv → core.Env, filepath.* → core.Path*, fmt.Sprintf → core.Sprintf, strings.* → core.*, errors.New/fmt.Errorf → core.E 3. Missing tests: exported functions without test coverage 4. Error handling: silently dropped errors, bare panics, missing nil checks 5. UK English: American spellings in comments/docs 6. Missing usage-example comments on exported identifiers 7. Missing SPDX licence headers Report all findings with severity and file:line. Do NOT fix.

Virgil commented

2026-03-22 16:54:28 +00:00

Author

Member

Spark Audit Findings

CRITICAL

Tests reference core.Env/core.Path not yet on main — path_test.go won't compile

HIGH (2)

Path traversal in embed asset scanner (embed.go:172, :190)
Delete safeguard uses raw os.Getenv (fs.go:257, :273)

MEDIUM — AX Compliance

os.Getenv: log.go:292/:295, fs.go:257/:273
filepath.*: app.go:44, data.go:169, fs.go (8 hits), embed.go
fmt.Sprintf + strings.*: multiple files

## Spark Audit Findings ### CRITICAL - Tests reference core.Env/core.Path not yet on main — path_test.go won't compile ### HIGH (2) 1. Path traversal in embed asset scanner (embed.go:172, :190) 2. Delete safeguard uses raw os.Getenv (fs.go:257, :273) ### MEDIUM — AX Compliance - os.Getenv: log.go:292/:295, fs.go:257/:273 - filepath.*: app.go:44, data.go:169, fs.go (8 hits), embed.go - fmt.Sprintf + strings.*: multiple files