Static read-through audit of plugins/sector-electronics — otherwise the most defensively validated of the sector plugins. One verified finding.
1. Decision-critical field has no bounds check
Location: src/lib.rs:55-66, 71, 77-78
Issue: repairabilityScore is read cold via num() and used to gate compliance (pass threshold >= 6.0), but validate_input never range-checks it (unlike gtin, productCategory, energyEfficiencyClass, co2ePerUnitKg, recycledContentPct, all of which are validated). The field is documented as a 0-10 scale.
Failure scenario: A submission with energyEfficiencyClass: "A" and repairabilityScore: 999999 (or any garbage value ≥ 6) passes repair_pass and yields Compliant — a fail-open result on a field with zero format/bounds checking, and the nonsensical value is recorded verbatim as the published metric. (Compare sector-furniture, where the same field is metric-only and never gates a verdict — there the missing bound doesn't matter; here it does.)
Static read-through audit of
plugins/sector-electronics— otherwise the most defensively validated of the sector plugins. One verified finding.1. Decision-critical field has no bounds check
Location:
src/lib.rs:55-66,71,77-78Issue:
repairabilityScoreis read cold vianum()and used to gate compliance (pass threshold>= 6.0), butvalidate_inputnever range-checks it (unlikegtin,productCategory,energyEfficiencyClass,co2ePerUnitKg,recycledContentPct, all of which are validated). The field is documented as a 0-10 scale.Failure scenario: A submission with
energyEfficiencyClass: "A"andrepairabilityScore: 999999(or any garbage value ≥ 6) passesrepair_passand yieldsCompliant— a fail-open result on a field with zero format/bounds checking, and the nonsensical value is recorded verbatim as the published metric. (Comparesector-furniture, where the same field is metric-only and never gates a verdict — there the missing bound doesn't matter; here it does.)