Static read-through audit of plugins/sector-detergent. Two verified findings.
1. Fail-open on the sector's one enforced rule
Location: src/lib.rs:55, 62-68
Issue: validate_input only requires surfactants to be a non-empty array — it never checks that elements are objects or have a biodegradable field. calculate_metrics flags NonCompliant only when biodegradable is explicitly JSON false; anything else (omitted, null, string "false", non-object entry) evaluates to None and returns NotAssessed instead. The module doc claims "all surfactants must be readily biodegradable" is enforced "today."
Failure scenario: surfactants: [{"name":"LAS","concentrationBand":"5-15%"}] (field omitted) passes validation and returns NotAssessed, not NonCompliant, even though biodegradability is genuinely undeclared.
2. co2ePerUnitKg has zero validation
Location: src/lib.rs:75
Issue: Not in the required-field list; num() only filters for finite floats, not sign or range.
Failure scenario: A negative or absurd value (e.g. -999.0) is silently recorded as the reported CO2e metric with no rejection.
Static read-through audit of
plugins/sector-detergent. Two verified findings.1. Fail-open on the sector's one enforced rule
Location:
src/lib.rs:55,62-68Issue:
validate_inputonly requiressurfactantsto be a non-empty array — it never checks that elements are objects or have abiodegradablefield.calculate_metricsflagsNonCompliantonly whenbiodegradableis explicitly JSONfalse; anything else (omitted,null, string"false", non-object entry) evaluates toNoneand returnsNotAssessedinstead. The module doc claims "all surfactants must be readily biodegradable" is enforced "today."Failure scenario:
surfactants: [{"name":"LAS","concentrationBand":"5-15%"}](field omitted) passes validation and returnsNotAssessed, notNonCompliant, even though biodegradability is genuinely undeclared.2.
co2ePerUnitKghas zero validationLocation:
src/lib.rs:75Issue: Not in the required-field list;
num()only filters for finite floats, not sign or range.Failure scenario: A negative or absurd value (e.g.
-999.0) is silently recorded as the reported CO2e metric with no rejection.