search

stackmuncher / stm_app

This software engineer profile builder turns your code into a detailed list of skills for an online directory of software developers.
https://stackmuncher.com
GNU Affero General Public License v3.0
22 stars 1 forks source link

Leakage of local imports from older commits into contributor reports #5

Open rimutaka opened 3 years ago

rimutaka commented 3 years ago

The current implementation of local import detection uses the list of files (tree) from HEAD to check if any of the imports have similar names. Those that match are deemed to be local and are not included in refs section of the report.

The problem arises when a line of code from an older commit from a contributor is matched against the latest tree - some of the files could be renamed or deleted. There will be no match for the import and it will be included in the report as an external reference.

Only contributor reports are affected because they contain info from older commits. The project report looks at the latest (HEAD).

This is a potential privacy issue because some names can be leaked.

Getting the tree for every historical commit is expensive. The solution should include caching of all trees or just their diffs. This is not a quick change.

rimutaka commented 2 years ago

See mrepol742/PROJECT-WEBVIUM for a user-submitted example. Thanks @mrepol742 for reporting it.