nccgroup / sobelow

Security-focused static analysis for the Phoenix Framework
Apache License 2.0
1.66k stars 92 forks source link

Macro.to_string/2 deprecation warning #115

Closed florish closed 1 year ago

florish commented 1 year ago

Hi, on running mix compile with Elixir 1.14.2 and Erlang/OTP 25.1, I get the following warning:

==> sobelow
Compiling 51 files (.ex)
warning: Macro.to_string/2 is deprecated. Use Macro.to_string/1 instead
Invalid call found at 2 locations:
  lib/sobelow/print.ex:212: Sobelow.Print.print_code/2
  lib/sobelow/print.ex:226: Sobelow.Print.print_file_path_code/2

Nothing is broken yet, but I figured it would be helpful to open this issue, as this could become problematic in future Elixir versions.

I'm willing to help by opening a PR, but do not have any experience with Macro.to_string/1,2 and/or the sobelow codebase yet, which means I'm not entirely sure which path to follow here.

dennym commented 1 year ago

This would be a nice fix. Plenty of github action examples also run mix compile --warnings-as-errors which currently fails due to this.

houllette commented 1 year ago

I'm still getting familiar with the codebase myself, but have started to dig into this a little bit. Looks like from this comment from @josevalim, we may have to just do a prewalk as sort of a pre-pass on the data.

josevalim commented 1 year ago

normalize_template_var can be a prewalk pass. Then, for highlighting variables, you could do a prewalk and wrap them into something that will become __sobelow_highlight__(var) when converted to string. Then do a pass on the string and convert the highlight into ascii. :D

Another option is to do something like this: do a prewalk, create a variable named __sobelow_highlight_#{n}__ for each highlight, and then introduce the variable into the AST instead of the highlight. Then you convert to string and then you replace all __sobelow_highlight_N__ in the output by the specific code you want to highlight