Consensys / mythx-cli

A command line interface for the MythX smart contract security analysis API
https://mythx-cli.readthedocs.io/
MIT License
84 stars 29 forks source link

Make paths in output clickable #157

Closed maurelian closed 4 years ago

maurelian commented 4 years ago

Description

When I get the MythX output via the CLI, it's somewhat onerous to go look at the issue in the code.

Suggestion

For each finding, print the file path with line number, in my terminal this makes it so that I can open the file right at the location. It would be somwhat similar to the screenshot I found in #11.

dmuhs commented 4 years ago

I have fought with myself for quite some time on this feature. There are a few reasons why the CLI would have issues with this:

  1. Path anonymization: We try to honour the user's privacy when submitting issues to MythX. This is done by aggregating all file paths the user wants to submit and removing their common prefixes. This allows us to guarantee that there are no ambiguities across paths, while (almost certainly) removing sensitive information from the user paths, e.g. the machine's user name. Only the sanitized paths end up in the MythX backend.
  2. When fetching the reports, naturally, the sanitized paths are returned. Implementing this feature would mean that the file system would have to be searched for paths that have the same suffix as the report's path. That's a fairly expensive operation, even when assuming that the user is still in the same project directory as they were in when the submission happened. It's likely that they aren't - which would require an exhaustive FS search. That could confuse users and result in a massive performance hit.
  3. Making links clickable is not worth the cost described above, especially when this is a feature that varies from one terminal emulator to the other.

I don't doubt that the feature would be a UX improvement, but the potential performance cost and user confusion when things don't work out don't speak for implementation at this point.