Fix scanner readiness blockers

Author: ktsaou

.agents/sow/done/SOW-0029-20260701-ci-scanner-readiness.md

@@ -8180,78 +8180,14 @@
           "patternId": "spectral_typed-enum"
         }
       ]
-    },
-    {
-      "toolId": "Revive",
-      "patterns": [
-        {
-          "patternId": "Revive_unsecure-url-scheme"
-        },
-        {
-          "patternId": "Revive_imports-blocklist"
-        },
-        {
-          "patternId": "Revive_unchecked-type-assertion"
-        },
-        {
-          "patternId": "Revive_datarace"
-        },
-        {
-          "patternId": "Revive_unconditional-recursion"
-        },
-        {
-          "patternId": "Revive_context-as-argument"
-        },
-        {
-          "patternId": "Revive_context-keys-type"
-        },
-        {
-          "patternId": "Revive_indent-error-flow"
-        },
-        {
-          "patternId": "Revive_receiver-naming"
-        },
-        {
-          "patternId": "Revive_increment-decrement"
-        },
-        {
-          "patternId": "Revive_unexported-return"
-        },
-        {
-          "patternId": "Revive_dot-imports"
-        },
-        {
-          "patternId": "Revive_range"
-        },
-        {
-          "patternId": "Revive_time-naming"
-        },
-        {
-          "patternId": "Revive_unreachable-code"
-        },
-        {
-          "patternId": "Revive_blank-imports"
-        },
-        {
-          "patternId": "Revive_error-return"
-        },
-        {
-          "patternId": "Revive_var-declaration"
-        },
-        {
-          "patternId": "Revive_errorf"
-        },
-        {
-          "patternId": "Revive_superfluous-else"
-        },
-        {
-          "patternId": "Revive_error-naming"
-        }
-      ]
     }
   ],
   "exclude": [
     "bench/**",
-    "tests/**"
+    "benchmarks-*",
+    "tests/**",
+    "**/*_test.go",
+    "**/*_tests.rs",
+    "**/tests.rs"
   ]
 }

.codacy/codacy.config.json

@@ -62,7 +62,7 @@ if(NOT NETIPC_WINDOWS_RUNTIME)
     target_include_directories(netipc_uds PUBLIC
         src/libnetdata/netipc/include
     )
-    target_link_libraries(netipc_uds PUBLIC netipc_protocol)
+    target_link_libraries(netipc_uds PUBLIC netipc_protocol Threads::Threads)
 
     # --- C library: L1 POSIX SHM transport (Linux only) ----------------------
 

CMakeLists.txt

@@ -30,8 +30,7 @@ mod string_reverse;
 
 pub use apps_lookup::{apps_lookup_dispatch, AppsLookupHandler};
 pub use cgroups_cache::{
-    CgroupsCache, CgroupsCacheItem, CgroupsCacheItemView, CgroupsCacheReadGuard,
-    CgroupsCacheStatus,
+    CgroupsCache, CgroupsCacheItem, CgroupsCacheItemView, CgroupsCacheReadGuard, CgroupsCacheStatus,
 };
 pub use cgroups_lookup::{cgroups_lookup_dispatch, CgroupsLookupHandler};
 pub use cgroups_snapshot::{snapshot_dispatch, snapshot_max_items, SnapshotHandler};

src/crates/netipc/Cargo.lock

@@ -87,7 +87,9 @@ impl CgroupsCacheState {
 }
 
 fn lock_mutex<T>(mutex: &Mutex<T>) -> MutexGuard<'_, T> {
-    mutex.lock().unwrap_or_else(|poisoned| poisoned.into_inner())
+    mutex
+        .lock()
+        .unwrap_or_else(|poisoned| poisoned.into_inner())
 }
 
 fn read_lock<T>(lock: &RwLock<T>) -> RwLockReadGuard<'_, T> {
@@ -128,11 +130,7 @@ fn cache_build_buckets(items: &[CgroupsCacheItem]) -> Vec<CgroupsHashBucket> {
 }
 
 impl CgroupsCacheSnapshot {
-    fn from_items(
-        items: Vec<CgroupsCacheItem>,
-        systemd_enabled: u32,
-        generation: u64,
-    ) -> Self {
+    fn from_items(items: Vec<CgroupsCacheItem>, systemd_enabled: u32, generation: u64) -> Self {
         let buckets = cache_build_buckets(&items);
         Self {
             items,

src/crates/netipc/src/service/raw.rs

@@ -4604,8 +4604,7 @@ fn test_cache_concurrent_readers_refresh() {
                 let guard = cache.read_lock();
                 match guard.get(1001, "docker-abc123") {
                     Some(view)
-                        if view.hash == 1001
-                            && view.path == "/sys/fs/cgroup/docker/abc123" =>
+                        if view.hash == 1001 && view.path == "/sys/fs/cgroup/docker/abc123" =>
                     {
                         let copy = guard.dup(view);
                         if copy.hash != view.hash || copy.name != view.name {
@@ -4894,8 +4893,7 @@ fn test_cache_refresh_preserves_old_cache_on_malformed_snapshot_item() {
         status.refresh_failure_count,
         old_status.refresh_failure_count + 1
     );
-    let preserved =
-        cache_dup(&cache, 1001, "docker-abc123").expect("old cache item should remain");
+    let preserved = cache_dup(&cache, 1001, "docker-abc123").expect("old cache item should remain");
     assert_eq!(preserved.hash, old_item.hash);
     assert_eq!(preserved.path, old_item.path);
     assert!(

src/crates/netipc/src/service/raw/cgroups_cache.rs

@@ -183,21 +183,24 @@ func (v *CgroupsLookupRequestView) itemBytes(index uint32) ([]byte, []byte, erro
 			return nil, nil, ErrOverflow
 		}
 	}
-	dirOff64 := uint64(index) * uint64(LookupDirEntrySize)
-	if dirOff64 > uint64(maxIntValue()) || CgroupsLookupReqHdr > maxIntValue()-int(dirOff64) {
+	dirOff, ok := checkedInt(uint64(index) * uint64(LookupDirEntrySize))
+	if !ok || CgroupsLookupReqHdr > maxIntValue()-dirOff {
 		return nil, nil, ErrOverflow
 	}
-	base := CgroupsLookupReqHdr + int(dirOff64) // #nosec G115 -- bounded by maxIntValue above.
+	base := CgroupsLookupReqHdr + dirOff
 	if base > len(v.payload)-LookupDirEntrySize {
 		return nil, nil, ErrOutOfBounds
 	}
 	off32 := ne.Uint32(v.payload[base : base+4])
 	length32 := ne.Uint32(v.payload[base+4 : base+8])
-	if uint64(off32) > uint64(maxIntValue()) || uint64(length32) > uint64(maxIntValue()) {
+	off, ok := checkedInt(uint64(off32))
+	if !ok {
+		return nil, nil, ErrOutOfBounds
+	}
+	length, ok := checkedInt(uint64(length32))
+	if !ok {
 		return nil, nil, ErrOutOfBounds
 	}
-	length := int(length32) // #nosec G115 -- bounded by maxIntValue above.
-	off := int(off32)       // #nosec G115 -- bounded by maxIntValue above.
 	item, err := lookupPayloadSlice(v.payload, dirEnd, off, length)
 	if err != nil {
 		return nil, nil, err

src/crates/netipc/src/service/raw_unix_tests.rs

@@ -301,7 +301,7 @@ func BatchDirDecode(buf []byte, itemCount uint32, packedAreaLen uint32) ([]Batch
 // Checks alignment and that each entry falls within packedAreaLen.
 func BatchDirValidate(buf []byte, itemCount uint32, packedAreaLen uint32) error {
 	dirSize64 := uint64(itemCount) * 8
-	if dirSize64 > uint64(maxIntValue()) {
+	if dirSize64 > maxIntUint64() {
 		return ErrBadItemCount
 	}
 	dirSize := int(dirSize64) // #nosec G115 -- bounded by maxIntValue above.
@@ -331,7 +331,7 @@ func BatchItemGet(payload []byte, itemCount uint32, index uint32) ([]byte, error
 	}
 
 	dirSize64 := uint64(itemCount) * 8
-	if dirSize64 > uint64(maxIntValue()) {
+	if dirSize64 > maxIntUint64() {
 		return nil, ErrBadItemCount
 	}
 	dirSize := int(dirSize64) // #nosec G115 -- bounded by maxIntValue above.
@@ -348,7 +348,7 @@ func BatchItemGet(payload []byte, itemCount uint32, index uint32) ([]byte, error
 	if off%uint32(Alignment) != 0 {
 		return nil, ErrBadAlignment
 	}
-	if uint64(off)+uint64(length) > uint64(packedAreaLen) {
+	if !uint32RangeWithinInt(off, length, packedAreaLen) {
 		return nil, ErrOutOfBounds
 	}
 
@@ -404,30 +404,31 @@ func NewBatchBuilder(buf []byte, maxItems uint32) *BatchBuilder {
 // Add appends an item payload. Handles alignment padding.
 func (b *BatchBuilder) Add(item []byte) error {
 	maxInt := maxIntValue()
+	itemLen32, itemLenFitsU32 := checkedU32Int(len(item))
 	// Inline the common case; addSlow preserves the precise error returns for
 	// overflow and unusual bounds.
 	if b.itemCount < b.maxItems &&
 		b.dirEnd >= 0 &&
 		b.dataOffset >= 0 &&
 		b.dataOffset <= maxInt-7 &&
-		uint64(len(item)) <= uint64(^uint32(0)) {
+		itemLenFitsU32 {
 		alignedOff := Align8(b.dataOffset)
-		if uint64(alignedOff) <= uint64(^uint32(0)) &&
+		alignedOff32, alignedOffFitsU32 := checkedU32Int(alignedOff)
+		if alignedOffFitsU32 &&
 			alignedOff <= maxInt-b.dirEnd &&
 			len(item) <= maxInt-alignedOff {
 			absPos := b.dirEnd + alignedOff
 			if len(item) <= maxInt-absPos {
 				itemEnd := absPos + len(item)
-				idx64 := uint64(b.itemCount) * 8
-				if idx64 <= uint64(maxInt) {
-					idx := int(idx64) // #nosec G115 -- bounded by maxInt above.
+				idx, ok := checkedInt(uint64(b.itemCount) * 8)
+				if ok {
 					if itemEnd <= len(b.buf) && idx <= len(b.buf)-8 {
 						if alignedOff > b.dataOffset {
 							clear(b.buf[b.dirEnd+b.dataOffset : b.dirEnd+alignedOff])
 						}
 						copy(b.buf[absPos:], item)
-						ne.PutUint32(b.buf[idx:idx+4], uint32(alignedOff))  // #nosec G115 -- bounded above.
-						ne.PutUint32(b.buf[idx+4:idx+8], uint32(len(item))) // #nosec G115 -- bounded above.
+						ne.PutUint32(b.buf[idx:idx+4], alignedOff32)
+						ne.PutUint32(b.buf[idx+4:idx+8], itemLen32)
 						b.dataOffset = alignedOff + len(item)
 						b.itemCount++
 						return nil
@@ -447,10 +448,12 @@ func (b *BatchBuilder) addSlow(item []byte) error {
 		return ErrOverflow
 	}
 	alignedOff := Align8(b.dataOffset)
-	if uint64(alignedOff) > uint64(^uint32(0)) {
+	alignedOff32, ok := checkedU32Int(alignedOff)
+	if !ok {
 		return ErrOverflow
 	}
-	if uint64(len(item)) > uint64(^uint32(0)) {
+	itemLen32, ok := checkedU32Int(len(item))
+	if !ok {
 		return ErrOverflow
 	}
 	if alignedOff > maxIntValue()-b.dirEnd {
@@ -481,16 +484,13 @@ func (b *BatchBuilder) addSlow(item []byte) error {
 	copy(b.buf[absPos:], item)
 
 	// Write directory entry.
-	idx64 := uint64(b.itemCount) * 8
-	if idx64 > uint64(maxIntValue()) {
+	idx, ok := checkedInt(uint64(b.itemCount) * 8)
+	if !ok {
 		return ErrOverflow
 	}
-	idx := int(idx64) // #nosec G115 -- bounded by maxIntValue above.
 	if idx > len(b.buf)-8 {
 		return ErrOverflow
 	}
-	alignedOff32 := uint32(alignedOff) // #nosec G115 -- bounded by uint32 max above.
-	itemLen32 := uint32(len(item))     // #nosec G115 -- bounded by uint32 max above.
 	ne.PutUint32(b.buf[idx:idx+4], alignedOff32)
 	ne.PutUint32(b.buf[idx+4:idx+8], itemLen32)