fix(assail): null-check-aware UncheckedAllocation + precise eval detectors

[hyperpolymath]

Three precision fixes to the assail analyzers that produced false positives across the estate — found while triaging hyperpolymath/proven#68 and JoshuaJewell/paint-type#86, and the root cause of why genuine fixes didn't clear. All conservative: no new false negatives.

1. UncheckedAllocation is now actually "unchecked"-aware (C)

The detector flagged every malloc(...) regardless of a NULL check, and emitted a line-less, file-level finding. Now it:

• scans per line and skips a malloc whose result is NULL-checked within a short window (if (p == NULL), if (!p), nullptr);
• attaches a line number — which also lets an inline // panic-attack: accepted marker suppress a reviewed site (previously impossible: marker suppression is line-gated).

This is precisely why a real null-check fix (proven stubs.c) never cleared before.

2. eval() detectors are word-boundary aware (JS / Python)

contains("eval(") matched FFI symbol names like proven_calculator_eval(. Now \beval\s*\( (and \b(?:eval|exec)\s*\( for Python). Genuine eval( still flagged.

3. Shell eval no longer matches the --eval CLI flag

contains("eval ") matched --eval. Now the eval builtin is matched only in statement position — (?m)(?:^|[\s;&|(])eval[ \t]. --eval/-eval no longer flagged; the real shell eval builtin still is.

Verification

• 4 new tests (tests/analyzer_tests.rs): null-checked malloc skipped; genuinely-unchecked still flagged; shell --eval flag not flagged but builtin is; FFI *_eval( not flagged but real eval() is.
• Full analyzer suite 17/17 green, zero warnings.
• End-to-end: rebuilt 2.5.5 and re-scanned —
  • proven: 1 → 0 active Critical/High (stubs.c clears; the genuine fix finally registers).
  • paint-type: 36 → 35 (the gossamer --eval benchmark FP clears; the 3 irreducible believe_me axioms + 32 genuinely-unsafe vendored Zig FFI correctly remain — no over-suppression).

Refs #32, hyperpolymath/proven#68.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 34 issues detected

Severity	Count
🔴 Critical	1
🟠 High	12
🟡 Medium	21

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in instant-sync.yml",
    "type": "secret_action_without_presence_gate",
    "file": "instant-sync.yml",
    "action": "peter-evans/repository-dispatch",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/panic-attack/panic-attack/src/attestation/chain.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unsafe block -- requires SAFETY comment (1 occurrences, CWE-676)",
    "type": "unsafe_block",
    "file": "/home/runner/work/panic-attack/panic-attack/src/jit_context.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "mem::transmute bypasses type safety with unchecked bit reinterpretation (12 occurrences, CWE-704)",
    "type": "transmute",
    "file": "/home/runner/work/panic-attack/panic-attack/src/jit_context.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "expect() in hot path (4 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/panic-attack/panic-attack/src/assail/analyzer.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (1 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/panic-attack/panic-attack/src/query/mod.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (4 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/panic-attack/panic-attack/benches/scan_bench.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (2 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/panic-attack/panic-attack/benches/scan_bench.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "expect() in hot path (1 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/panic-attack/panic-attack/examples/attack_harness.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (9 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/panic-attack/panic-attack/examples/vulnerable_program.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence