Repository navigation
docs(security): pin the exact freerasp the RASP template was checked against, and say what its test guard covers - #1006
Merged
Merged
Conversation
…against, and say what its test guard covers The opt-in recipe ran flutter pub add freerasp:^8.2.4, which resolves the newest 8.x, while the guide called the version pinned; it now adds exactly 8.2.4 and says a different version means re-checking ThreatCallback. The guide also claimed any freerasp upgrade that adds a detection fails the tests, but the guard covers new Threat values only: a new optional ThreatCallback parameter still compiles and its detection is dropped, so the guide now says to compare the parameters by hand on every upgrade. Refs #994 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The RASP opt-in recipe ran
flutter pub add freerasp:^8.2.4. That resolves to the newest 8.x at the time the adopter enables RASP, while the guide called the version "pinned". The guide also said any freerasp upgrade that adds a detection failsflutter test. The guard only covers newThreatvalues, though. EveryThreatCallbackparameter is optional, so a version that adds a callback of its own (asonMalwarealready is) still compiles with the adapter leaving it null, and freeRASP drops that detection without logging it.Change (docs-only route, as criteria 1, 2 and 4 allow).
freerasp:8.2.4. The guide says this is the only version the adapter was checked against, and that moving off it means re-checkingThreatCallback.Threatvalues only, and thatThreatCallback's parameters must be compared with the ones_start()passes, by hand, on every upgrade.The template test is not extended to read
ThreatCallback's parameters from the package source. With the docs route, criterion 4 needs no scratch run of the renamed tests.rasp_is_opt_in_test.dartpasses, andcheck_docsis OK.Pre-merge review: not run. The diff is text only: the security guide, plus the header comment of a
.dart.templatefile that is never compiled. That counts as the docs-only exemption.Refs #994
🤖 Generated with Claude Code