Skip to content

fix: various issues #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Ignacio-Freire wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: various issues #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 32 additions & 7 deletions docs/ConfigOptions.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ The `olympix-config.json` file follows the structure below. All paths should be
{
"IgnoredVulnerabilities" : {
"<DETECTOR-SLUG>" : {
"<FILENAME>" : [<LINENUM>, ...]
"<FILENAME>" : [<LINE_NUM>, ...]
}, ...
},
"IgnoredPaths" : [
Expand All @@ -19,7 +19,7 @@ The `olympix-config.json` file follows the structure below. All paths should be
],
"TrustedVariables": {
"<DETECTOR-SLUG>" : {
"<FILENAME>" : [<LINENUM>, ...]
"<FILENAME>" : [<LINE_NUM>, ...]
}, ...
},
"TrustedContracts": {
Expand All @@ -36,15 +36,37 @@ The `olympix-config.json` file follows the structure below. All paths should be
* **`IgnoredVulnerabilities`**: A dictionary to ignore specific vulnerability types.
* **`<DETECTOR-SLUG>`**: The unique identifier for the vulnerability (e.g., `reentrancy`). You can get a list of all slugs by running the `olympix show-vulnerabilities` command.
* **`<FILENAME>`**: The path to the file containing the vulnerability.
* **`[<LINENUM>, ...]`**: An array of line numbers in that file to ignore for that specific vulnerability.
* **`[<LINE_NUM>, ...]`**: An array of line numbers in that file to ignore for that specific vulnerability.

* **`IgnoredPaths`**: An array of filepaths or directory paths to completely exclude from the analysis. The analyzer will ignore any file path that starts with one of the provided patterns.

* **`TrustedPaths`**: An array of filepaths that should be considered trusted. This can help reduce the severity or number of reported issues from known safe code, such as audited third-party libraries.

* **`TrustedVariables`**: A dictionary used to mark specific variables (at specific lines) as trusted for a given check. This is particularly useful for silencing findings like `unfuzzed-variables` where a variable is intentionally left in a certain state. The structure is identical to `IgnoredVulnerabilities`.

* **`TrustedContracts`**: A dictionary used to mark entire contracts as trusted for a specific detector. This is useful when a contract's design is known to be safe against a particular vulnerability (e.g., a contract that is non-reentrant by design).
* **`TrustedVariables`**: A dictionary used to mark specific variables (at specific lines) as trusted for a given check. This is particularly useful for silencing findings like `unfuzzed-variables` where a variable is intentionally left in a certain state. The structure is identical to `IgnoredVulnerabilities`. This applies to the following detectors:

- `unfuzzed-local-variables`
- `unfuzzed-state-variables`
- `low-level-call-params-verified`
- `uninitialized-local-storage`
- `uninitialized-state-variable`
- `unused-state-variable`

* **`TrustedContracts`**: A dictionary used to mark entire contracts as trusted for a specific detector. This is useful when a contract's design is known to be safe against a particular vulnerability (e.g., a contract that is non-reentrant by design). This applies to the following detectors:

- `unchecked-token-transfer`
- `reentrancy`
- `low-level-call-params-verified`
- `oracle-manipulation`
- `delegatecall-in-loop`
- `arbitrary-delegatecall`
- `calls-in-loop`
- `external-call-potential-out-of-gas`
- `call-without-gas-budget`
- `arbitrary-transfer-from`
- `function-selector-clash`
- `unchecked-low-level`
- `reentrancy-events`
- `unused-return-function-call`

## Example
Here is an example `olympix-config.json` file demonstrating how to use the different options:
Expand Down Expand Up @@ -88,10 +110,13 @@ To use these features, ensure that:
The original `.olympix-ignore.json` file is still supported for ignoring vulnerabilities and paths.

If both files are present, their configurations will be merged. The tools will recognize any of these filenames at your project's root:

* `olympix-config.json`
* `.olympix-config.json`
* `olympix-ignore.json`
* `.olympix-ignore.json`

---

!!! Warning Be extra-confident before disabling any vulnerabilities, as this could allow bugs to silently pass into production—bugs that might not even exist yet. Ignoring vulnerabilities should only be done after a thorough review to ensure that it does not introduce security risks in the future.
!!! Warning
Be **extra-confident** before disabling any vulnerabilities, as this could allow bugs to silently pass into production—bugs that might not even exist yet. Ignoring vulnerabilities should only be done after a thorough review to ensure that it does not introduce security risks in the future.
85 changes: 0 additions & 85 deletions docs/IgnoreOptions.md
View file
Open in desktop

This file was deleted.

4 changes: 2 additions & 2 deletions docs/VSCode Extension/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,14 +13,14 @@ The Olympix VSCode extension brings powerful security analysis right into your e

---

## 💡 Quick Fixes
## Quick Fixes

The **Olympix Quick Fix** feature is designed to accelerate your development workflow by providing instant, actionable solutions to detected vulnerabilities. When our analyzer identifies a potential issue, it may also suggest a code snippet that can resolve it.

### How It Works

1. **Detection:** When a vulnerability is found, it will be highlighted in the "Problems" tab of VS Code, and a squiggle will appear under the affected code.
2. **Action:** A lightbulb icon 💡 will appear next to the highlighted line. Click the icon or use the keyboard shortcut (`Ctrl`+`.` on Windows/Linux, `Cmd`+`.` on macOS).
2. **Action:** A lightbulb icon will appear next to the highlighted line. Click the icon or use the keyboard shortcut (`Ctrl`+`.` on Windows/Linux, `Cmd`+`.` on macOS).
3. **Apply:** Select the "Apply Olympix Quick Fix" option from the context menu to automatically insert the suggested code change.

### Example: Locked Ether Vulnerability
Expand Down