rust-doctor: detect_programming_language complexity — accepted risk

Metadata

Vulnerabilities (0)

No vulnerabilities.

Raw JSON

{
  "$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
  "document": {
    "category": "csaf_informational_advisory",
    "csaf_version": "2.1",
    "distribution": {
      "tlp": {
        "label": "CLEAR",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "rust-doctor reports cyclomatic complexity of 46 (threshold: 15) for the detect_programming_language function. This function is an intentionally large pattern-matching dispatcher that classifies text content into programming languages based on syntactic markers. Splitting it would reduce readability without improving safety.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "The function detect_programming_language() in src/lib.rs has high cyclomatic complexity because it is a flat dispatcher matching text content against patterns for C/C++, Rust, Go, Java, CSS, Python, JavaScript, TypeScript, Makefile, and YAML. Each branch is independent, has no side effects, and returns early. The function is fully covered by unit tests, property tests, and fuzz targets (fuzz_content). Extracting each language check into a separate function would scatter logically cohesive code across many small functions, harming readability without improving safety or testability.",
        "title": "Detailed Description"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@ndaal.eu",
      "name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
      "namespace": "https://ndaal.eu/csaf"
    },
    "references": [
      {
        "category": "self",
        "summary": "This advisory in CSAF 2.1 format",
        "url": "https://ndaal.eu/csaf/2026/ndaal-sa-2026-013.json"
      },
      {
        "category": "external",
        "summary": "ndaal CSAF Trusted Provider feed",
        "url": "https://ndaal.eu/.well-known/csaf/provider-metadata.json"
      }
    ],
    "title": "rust-doctor: detect_programming_language complexity — accepted risk",
    "tracking": {
      "current_release_date": "2026-04-12T08:00:00Z",
      "id": "ndaal-sa-2026-013",
      "initial_release_date": "2026-04-12T08:00:00Z",
      "revision_history": [
        {
          "date": "2026-04-12T08:00:00Z",
          "number": "1",
          "summary": "Initial assessment: accepted risk"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "ndaal GmbH & Co KG",
        "branches": [
          {
            "category": "product_name",
            "name": "mimetype-cli",
            "branches": [
              {
                "category": "product_version",
                "name": "0.1.0",
                "product": {
                  "name": "mimetype-cli 0.1.0",
                  "product_id": "CSAFPID-mimetype-cli-0.1.0"
                }
              }
            ]
          }
        ]
      }
    ]
  }
}