Merge pull request #11 from trailofbits/dev/version-0.8.0

Version 0.8.0

CHANGELOG.md

@@ -1,47 +1,67 @@
 # Release Notes
 
+## v0.8.0 (2023-03-21)
+
+### Features
+
+-   Circomspect will now only report findings for potential issues in the files
+    specified on the command line. (It will still attempt to parse included
+    files, but these will only be used to inform the analysis of the files
+    specified by the user.)
+-   Added support for tags, tuples, and anonymous components. Circomspect now
+    supports Circom versions 2.0.0 - 2.1.4.
+-   Added templates to the `bn254-specific-circuits` analysis pass.
+-   Added `unused-output-signal` analysis pass.
+-   All uses of the name BN128 have been replaced with BN254.
+
+### Bug fixes
+
+-   Rewrote the `unconstrained-less-than` analysis pass to better capture the
+    underlying issue.
+-   Fixed an issue where the cyclomatic complexity calculation could underflow
+    in some cases in the `overly-complex-function-or-template` analysis pass.
+-   Fixed an issue in the Sarif export implementation where reporting
+    descriptors were added multiple times.
 
 ## v0.7.2 (2022-12-01)
 
 ### Features
 
-  - Added a URL to the issue description for each output.
-
+-   Added a URL to the issue description for each output.
 
 ### Bug Fixes
 
-  - Rewrote description of the unconstrained less-than analysis pass, as the
+-   Rewrote description of the unconstrained less-than analysis pass, as the
     previous description was too broad.
-  - Fixed grammar in the under-constrained signal warning message.
-
+-   Fixed grammar in the under-constrained signal warning message.
 
 ## v0.7.0 (2022-11-29)
 
-
 ### Features
 
-  - New analysis pass (`unconstrained-less-than`) that detects uses of the
+-   New analysis pass (`unconstrained-less-than`) that detects uses of the
     Circomlib `LessThan` template where the input signals are not constrained
     to be less than the bit size passed to `LessThan`.
-  - New analysis pass (`unconstrained-division`) that detects signal assignments
-    containing division, where the divisor is not constrained to be non-zero.
-  - New analysis pass (`bn128-specific-circuits`) that detects uses of Circomlib
-    templates with hard-coded BN128-specific constants together with a custom curve like BLS12-381 or Goldilocks.
-  - New analysis pass (`under-constrained-signal`) that detects intermediate
+-   New analysis pass (`unconstrained-division`) that detects signal
+    assignments containing division, where the divisor is not constrained to be
+    non-zero.
+-   New analysis pass (`bn254-specific-circuits`) that detects uses of
+    Circomlib templates with hard-coded BN254-specific constants together with
+    a custom curve like BLS12-381 or Goldilocks.
+-   New analysis pass (`under-constrained-signal`) that detects intermediate
     signals which do not occur in at least two separate constraints.
-  - Rule name is now included in Sarif output. (The rule name is now also
+-   Rule name is now included in Sarif output. (The rule name is now also
     displayed by the VSCode Sarif extension.)
-  - Improved parsing error messages.
-
+-   Improved parsing error messages.
 
 ### Bug Fixes
 
-  - Fixed an issue during value propagation where values would be propagated to
+-   Fixed an issue during value propagation where values would be propagated to
     arrays by mistake.
-  - Fixed an issue in the `nonstrict-binary-conversion` analysis pass where
+-   Fixed an issue in the `nonstrict-binary-conversion` analysis pass where
     some instantiations of `Num2Bits` and `Bits2Num` would not be detected.
-  - Fixed an issue where the maximum degree of switch expressions were evaluated
-    incorrectly.
-  - Previous versions could take a very long time to complete value and degree
-    propagation. These analyses are now time boxed and will exit if the analysis
-    takes more than 10 seconds to complete.
+-   Fixed an issue where the maximum degree of switch expressions were
+    evaluated incorrectly.
+-   Previous versions could take a very long time to complete value and degree
+    propagation. These analyses are now time boxed and will exit if the
+    analysis takes more than 10 seconds to complete.

Cargo.toml

@@ -4,5 +4,5 @@ members = [
   "parser",
   "program_analysis",
   "program_structure",
-  "program_structure_tests"
+  "program_structure_tests",
 ]

README.md

@@ -23,7 +23,6 @@ project by running `cargo build` in the project root. To install from source, us
   cargo install --path cli
 ```
 
-
 ## Running Circomspect
 
 To run Circomspect on a file or directory, simply run
@@ -38,7 +37,7 @@ To output the results to a Sarif file (which can be read by the [VSCode Sarif Vi
 
 ![VSCode example image](https://github.com/trailofbits/circomspect/raw/main/doc/vscode.png)
 
-Circomspect supports the same curves that Circom does: BN128, BLS12-381, and Goldilocks. If you are using a different curve than the default (BN128) you can set the curve using the command line option `--curve`.
+Circomspect supports the same curves that Circom does: BN254, BLS12-381, and Goldilocks. If you are using a different curve than the default (BN254) you can set the curve using the command line option `--curve`.
 
 ## Analysis Passes
 

circom_algebra/Cargo.toml

@@ -1,7 +1,8 @@
 [package]
 name = "circomspect-circom-algebra"
-version = "2.0.1"
-edition = "2018"
+version = "2.0.2"
+edition = "2021"
+rust-version = "1.65"
 license = "LGPL-3.0-only"
 authors = ["hermeGarcia <[email protected]>"]
 description = "Support crate for the Circomspect static analyzer"

cli/Cargo.toml

@@ -1,23 +1,24 @@
 [package]
 name = "circomspect"
-version = "0.7.2"
+version = "0.8.0"
 edition = "2021"
+rust-version = "1.65"
 license = "LGPL-3.0-only"
 authors = ["Trail of Bits"]
 readme = "../README.md"
 description = "A static analyzer and linter for the Circom zero-knowledge DSL"
-repository = "https://github.com/trailofbits/circomspect"
 keywords = ["cryptography", "static-analysis", "zero-knowledge", "circom"]
+repository = "https://github.com/trailofbits/circomspect"
 
 [dependencies]
 anyhow = "1.0"
 atty = "0.2"
 # Stay on Clap version 3 until version 4 supports coloured help output.
 clap = { version = "3.2", features = ["derive"] }
 log = "0.4"
-parser = { package = "circomspect-parser", version = "2.0.11", path = "../parser" }
+parser = { package = "circomspect-parser", version = "2.1.2", path = "../parser" }
 pretty_env_logger = "0.4"
-program_analysis = { package = "circomspect-program-analysis", version = "0.7.1", path = "../program_analysis" }
-program_structure = { package = "circomspect-program-structure", version = "2.0.11", path = "../program_structure" }
+program_analysis = { package = "circomspect-program-analysis", version = "0.8.0", path = "../program_analysis" }
+program_structure = { package = "circomspect-program-structure", version = "2.1.2", path = "../program_structure" }
 serde_json = "1.0"
 termcolor = "1.1"

cli/src/main.rs

@@ -1,13 +1,13 @@
-mod config;
-mod analysis_runner;
-
+use std::collections::HashSet;
 use std::path::PathBuf;
 use std::process::ExitCode;
 use clap::{CommandFactory, Parser};
 
-use analysis_runner::AnalysisRunner;
+use program_analysis::config;
+use program_analysis::analysis_runner::AnalysisRunner;
 
 use program_structure::constants::Curve;
+use program_structure::file_definition::FileID;
 use program_structure::report::Report;
 use program_structure::report::MessageCategory;
 use program_structure::writers::{LogWriter, ReportWriter, SarifWriter, CachedStdoutWriter};
@@ -35,11 +35,17 @@ struct Cli {
     #[clap(short = 'v', long = "verbose")]
     verbose: bool,
 
-    /// Set curve (BN128, BLS12_381, or GOLDILOCKS)
+    /// Set curve (BN254, BLS12_381, or GOLDILOCKS)
     #[clap(short = 'c', long = "curve", name = "NAME", default_value = config::DEFAULT_CURVE)]
     curve: Curve,
 }
 
+/// Returns true if a primary location of the report corresponds to a file
+/// specified on the command line by the user.
+fn filter_by_file(report: &Report, user_inputs: &HashSet<FileID>) -> bool {
+    report.primary_file_ids().iter().any(|file_id| user_inputs.contains(file_id))
+}
+
 /// Returns true if the report level is greater than or equal to the given
 /// level.
 fn filter_by_level(report: &Report, output_level: &MessageCategory) -> bool {
@@ -62,23 +68,30 @@ fn main() -> ExitCode {
         }
     }
 
-    // Set up analysis runner and analyze all functions and templates.
+    // Set up analysis runner.
+    let (mut runner, reports) = AnalysisRunner::new(options.curve).with_files(&options.input_files);
+
+    // Set up writer and write reports to `stdout`.
     let allow_list = options.allow_list.clone();
+    let user_inputs = runner.file_library().user_inputs().clone();
     let mut stdout_writer = CachedStdoutWriter::new(options.verbose)
-        .add_filter(move |report: &Report| filter_by_id(report, &allow_list))
-        .add_filter(move |report: &Report| filter_by_level(report, &options.output_level));
-    let mut runner = AnalysisRunner::new(&options.curve);
-    runner.with_files(&options.input_files, &mut stdout_writer);
+        .add_filter(move |report: &Report| filter_by_level(report, &options.output_level))
+        .add_filter(move |report: &Report| filter_by_file(report, &user_inputs))
+        .add_filter(move |report: &Report| filter_by_id(report, &allow_list));
+    stdout_writer.write_reports(&reports, runner.file_library());
 
-    runner.analyze_functions(&mut stdout_writer);
-    runner.analyze_templates(&mut stdout_writer);
+    // Analyze functions and templates in user provided input files.
+    runner.analyze_functions(&mut stdout_writer, true);
+    runner.analyze_templates(&mut stdout_writer, true);
 
     // If a Sarif file is passed to the program we write the reports to it.
     if let Some(sarif_file) = options.sarif_file {
         let allow_list = options.allow_list.clone();
+        let user_inputs = runner.file_library().user_inputs().clone();
         let mut sarif_writer = SarifWriter::new(&sarif_file)
-            .add_filter(move |report: &Report| filter_by_id(report, &allow_list))
-            .add_filter(move |report: &Report| filter_by_level(report, &options.output_level));
+            .add_filter(move |report: &Report| filter_by_level(report, &options.output_level))
+            .add_filter(move |report: &Report| filter_by_file(report, &user_inputs))
+            .add_filter(move |report: &Report| filter_by_id(report, &allow_list));
         if sarif_writer.write_reports(stdout_writer.reports(), runner.file_library()) > 0 {
             stdout_writer.write_message(&format!("Result written to `{}`.", sarif_file.display()));
         }