diff --git a/tools/toolkit-qa-check.sh b/tools/toolkit-qa-check.sh index 31722c3..c3028de 100755 --- a/tools/toolkit-qa-check.sh +++ b/tools/toolkit-qa-check.sh @@ -3318,9 +3318,42 @@ fi echo "" -# CRITICAL issues: Show ALL (no truncation) +# PRIORITY FILES: Show which files have CRITICAL/HIGH issues +if [ "$crit" -gt 0 ] || [ "$high" -gt 0 ]; then + echo -e "${BOLD}PRIORITY FILES (CRITICAL/HIGH issues):${NC}" + { + [ "$crit" -gt 0 ] && grep "^CRITICAL|" "$REPORT" | cut -d'|' -f2 + [ "$high" -gt 0 ] && grep "^HIGH|" "$REPORT" | cut -d'|' -f2 + } | sed "s|$TOOLKIT_PATH/||" | sort | uniq -c | sort -rn | head -10 | while read count file; do + # Get breakdown by severity for this file + crit_in_file=$(grep "^CRITICAL|.*${file}" "$REPORT" 2>/dev/null | wc -l) + high_in_file=$(grep "^HIGH|.*${file}" "$REPORT" 2>/dev/null | wc -l) + + if [ "$crit_in_file" -gt 0 ]; then + printf " ${RED}●${NC} %s ${RED}(CRITICAL: %d, HIGH: %d)${NC}\n" "$file" "$crit_in_file" "$high_in_file" + else + printf " ${YELLOW}●${NC} %s ${YELLOW}(HIGH: %d)${NC}\n" "$file" "$high_in_file" + fi + done + + # Calculate coverage + total_priority=$((crit + high)) + top3_count=$( + { + [ "$crit" -gt 0 ] && grep "^CRITICAL|" "$REPORT" | cut -d'|' -f2 + [ "$high" -gt 0 ] && grep "^HIGH|" "$REPORT" | cut -d'|' -f2 + } | sed "s|$TOOLKIT_PATH/||" | sort | uniq -c | sort -rn | head -3 | awk '{sum+=$1} END {print sum}' + ) + if [ "$total_priority" -gt 0 ] && [ -n "$top3_count" ] && [ "$top3_count" -gt 0 ]; then + coverage=$((top3_count * 100 / total_priority)) + echo -e " ${DIM}→ Fix top 3 files = ${coverage}% of CRITICAL/HIGH issues${NC}" + fi + echo "" +fi + +# CRITICAL issues grouped by file if [ "$crit" -gt 0 ]; then - echo -e "${RED}${BOLD}CRITICAL ISSUES ($crit) - MUST FIX:${NC}" + echo -e "${RED}${BOLD}CRITICAL ISSUES ($crit) - MUST FIX IMMEDIATELY:${NC}" grep "^CRITICAL|" "$REPORT" | while IFS='|' read -r sev file line issue; do rel_file="${file#$TOOLKIT_PATH/}" printf " ${RED}●${NC} %s:%s - %s\n" "$rel_file" "$line" "$issue" @@ -3328,53 +3361,71 @@ if [ "$crit" -gt 0 ]; then echo "" fi -# HIGH issues: Show top 20, group by file +# HIGH issues: Group by file for easier action if [ "$high" -gt 0 ]; then - echo -e "${YELLOW}${BOLD}HIGH ISSUES ($high) - FIX SOON:${NC}" - grep "^HIGH|" "$REPORT" | head -20 | while IFS='|' read -r sev file line issue; do - rel_file="${file#$TOOLKIT_PATH/}" - printf " ${YELLOW}●${NC} %s:%s - %s\n" "$rel_file" "$line" "$issue" - done - if [ "$high" -gt 20 ]; then - echo -e " ${DIM}... +$((high - 20)) more (run: grep '^HIGH' $REPORT)${NC}" - fi - echo "" -fi + echo -e "${YELLOW}${BOLD}HIGH ISSUES BY FILE (showing top 15 issues):${NC}" -# MEDIUM/LOW: Just show file counts -if [ "$med" -gt 0 ] || [ "$low" -gt 0 ]; then - echo -e "${BOLD}MEDIUM ($med) & LOW ($low) ISSUES BY FILE:${NC}" - { - grep "^MEDIUM|" "$REPORT" 2>/dev/null | cut -d'|' -f2 - grep "^LOW|" "$REPORT" 2>/dev/null | cut -d'|' -f2 - } | sed "s|$TOOLKIT_PATH/||" | sort | uniq -c | sort -rn | head -15 | while read count file; do - printf " ${DIM}%3d issues${NC} - %s\n" "$count" "$file" - done - echo -e " ${DIM}(Run: grep '^MEDIUM\\|^LOW' $REPORT | less)${NC}" - echo "" -fi + # Get unique files with HIGH issues + high_files=$(grep "^HIGH|" "$REPORT" | cut -d'|' -f2 | sed "s|$TOOLKIT_PATH/||" | sort -u) -# Top issue categories (compact view) -if [ "$total" -gt 0 ]; then - echo -e "${BOLD}TOP 10 ISSUE CATEGORIES:${NC}" - declare -A cat_counts - for tag in SQL-INJ CMD-INJ PANEL-CALL FILE-OP SECRET-LEAK RACE SOURCE RETURN NULL DEP TEMP SUBSHELL PIPE WORDSPLIT ARITH TEST REDIR TRAP ARRAY HEREDOC IF-MASK NUMCMP BG-JOB LOCALE PROC-SUB PRINTF REGEX BASHISM ESCAPE SLEEP-RACE IFS SUBSHELL-VAR TRAP-RACE PERF-LOOP PERF-CACHE PERF-READ RECURSION FD-LEAK ZOMBIE DISK-SPACE NET-TIMEOUT LOG-ROTATE CPU-LOOP HARDCODED-PATH MISSING-LIB USERDATA-ACCESS API-CHECK NO-CASE DB-PATTERN NO-USER-MGR NO-STANDALONE; do - count=$(grep -c "\[$tag\]" "$REPORT" 2>/dev/null || echo 0) - # Sanitize: ensure it's a single integer - count=$(echo "$count" | head -1 | tr -d '\n\r' | grep -o '^[0-9]*$' || echo 0) - [ "$count" -gt 0 ] 2>/dev/null && cat_counts[$tag]=$count - done + shown=0 + echo "$high_files" | while read -r rel_file; do + [ "$shown" -ge 15 ] && break - if [ ${#cat_counts[@]} -gt 0 ]; then - for tag in "${!cat_counts[@]}"; do - echo "${cat_counts[$tag]} $tag" - done | sort -rn | head -10 | while read count tag; do - printf " %-18s %3d issues\n" "$tag" "$count" + # Count issues in this file + file_high_count=$(grep "^HIGH|.*${rel_file}" "$REPORT" 2>/dev/null | wc -l) + + # Show first 3 issues from this file + echo -e " ${YELLOW}${rel_file}${NC} ${DIM}($file_high_count issues)${NC}" + grep "^HIGH|.*${rel_file}" "$REPORT" | head -3 | while IFS='|' read -r sev file line issue; do + printf " %s ${DIM}- %s${NC}\n" "$line" "$issue" + shown=$((shown + 1)) done + [ "$file_high_count" -gt 3 ] && echo -e " ${DIM}... +$((file_high_count - 3)) more in this file${NC}" + done + + if [ "$high" -gt 15 ]; then + echo -e " ${DIM}... +$((high - 15)) more issues (run: grep '^HIGH' $REPORT)${NC}" fi echo "" fi +# QUICK WINS: Show patterns that appear frequently (easy to fix multiple at once) +if [ "$total" -gt 0 ]; then + echo -e "${BOLD}QUICK WINS (patterns appearing 10+ times):${NC}" + quick_wins_found=0 + + # Check for common patterns + for tag in SOURCE TEMP HARDCODED-PATH WORDSPLIT NULL PIPE SUBSHELL; do + count=$(grep -c "\[$tag\]" "$REPORT" 2>/dev/null || echo 0) + count=$(echo "$count" | head -1 | tr -d '\n\r' | grep -o '^[0-9]*$' || echo 0) + + if [ "$count" -ge 10 ] 2>/dev/null; then + quick_wins_found=1 + case "$tag" in + SOURCE) desc="Add existence checks before sourcing files" ;; + TEMP) desc="Use mktemp instead of hardcoded /tmp paths" ;; + HARDCODED-PATH) desc="Replace hardcoded paths with detection" ;; + WORDSPLIT) desc="Quote variable expansions" ;; + NULL) desc="Add empty checks before using variables" ;; + PIPE) desc="Avoid useless pipes (use grep -q directly)" ;; + SUBSHELL) desc="Export variables to subshells" ;; + *) desc="Fix $tag pattern" ;; + esac + printf " ${CYAN}%3d ×${NC} %-20s ${DIM}%s${NC}\n" "$count" "$tag" "$desc" + fi + done + + [ "$quick_wins_found" -eq 0 ] && echo -e " ${DIM}No high-frequency patterns found${NC}" + echo "" +fi + +# MEDIUM/LOW summary (compact) +if [ "$med" -gt 0 ] || [ "$low" -gt 0 ]; then + echo -e "${DIM}MEDIUM: $med issues | LOW: $low issues | Full details: grep '^MEDIUM\\|^LOW' $REPORT${NC}" + echo "" +fi + # Cleanup rm -f "$TEMP_COUNTS"