FuelLabs / sway

🌴 Empowering everyone to build reliable and efficient smart contracts.
https://docs.fuel.network/docs/sway/
Apache License 2.0
62.65k stars 5.36k forks source link

Module Dependencies Can Be Cyclic #6386

Open IGI-111 opened 2 months ago

IGI-111 commented 2 months ago

CS-FSSA-020

An early check in the compilation process, before type-checking begins, ensures that the module dependency graph has no cycles. However, the algorithm employed is broken, as it only goes "one level deep", instead of building the full dependency graph: for each (sub)module, it only looks for dependency cycles among the submodules directly imported (plus the "parent" module itself).

As a result, in a project structure like the following:

src/
|---main.sw
|---a.sw
|---a/
 |---b.sw
 |---b/
 |---c.sw

one can craft the dependency cycle main -> a -> b -> c -> a

tritao commented 1 month ago

Related: https://github.com/FuelLabs/sway/issues/6467