Stan Report

In this section, you can find the general information about the used Stan tool, compile-time and run-time environment variables and settings, including build information, system data and execution configurations.

Here you can find the overall conclusion based on the various metadata and gathered information during the work of Stan on this project.

Based on the analysis results, Stan found different vulnerabilities distributed among the analysed files. In Stan terminology, we call such vulnerability as Observation. Below you can see the more detailed information about each observation, and find the possible ways to fix them for your project.

📄 src/Stan/Example.hs

• Module	Stan.Example
  Lines of Code	62

• Extensions from .cabal

  1. ConstraintKinds
  2. DeriveGeneric
  3. DerivingStrategies
  4. GeneralizedNewtypeDeriving
  5. InstanceSigs
  6. KindSignatures
  7. LambdaCase
  8. OverloadedStrings
  9. RecordWildCards
  10. ScopedTypeVariables
  11. StandaloneDeriving
  12. TupleSections
  13. TypeApplications
  14. ViewPatterns

  Extensions from module

  1. NoUndecidableInstances
  2. PatternSynonyms

• Observations

  ID	OBS-STAN-0211-saA9eI-24:21
  Severity	Error
  Description	Usage of '</>' for URLs results in the errors on Windows
  Inspection ID	STAN-0211
  Category	AntiPattern
  File	src/Stan/Example.hs

    23 ┃ 
    24 ┃ mkMyUrlPart myUrl = myUrl </> "asd"
    25 ┃                     ^^^^^^^^^^^^^^^
  

  Possible solutions

  • {Extra dependency} Use type-safe library for URLs
  • Concatenate URLs with slashes '/'

  ID	OBS-STAN-0207-saA9eI-27:14
  Severity	PotentialBug
  Description	Usage of Foldable methods on (,), Maybe, Either
  Inspection ID	STAN-0207
  Category	AntiPattern
  File	src/Stan/Example.hs

    26 ┃ 
    27 ┃ pairLength = length ((1, 2) :: (Int, Int))
    28 ┃              ^^^^^^
  

  Possible solutions

  • Use more explicit functions with specific monomorphic types

  ID	OBS-STAN-0201-saA9eI-30:16
  Severity	PotentialBug
  Description	Creating a list with wrong number of indices
  Inspection ID	STAN-0201
  Category	AntiPattern
  File	src/Stan/Example.hs

    29 ┃ 
    30 ┃ listIndxs xs = [0 .. length xs]
    31 ┃                ^^^^^^^^^^^^^^^^
  

  Possible solutions

  • Replace '[0 .. length xs]' with '[0 .. length xs - 1]'
  • Use 'zip [0 ..] xs` to work with list of pairs: index and element

  ID	OBS-STAN-0203-saA9eI-33:16
  Severity	Error
  Description	Usage of 'pack' function that doesn't handle Unicode characters
  Inspection ID	STAN-0203
  Category	AntiPattern
  File	src/Stan/Example.hs

    32 ┃ 
    33 ┃ toByteString = BS8.pack
    34 ┃                ^^^^^^^^
  

  Possible solutions

  • Convert to 'Text' and use 'encodeUtf8' from 'Data.Text.Encoding'
  • {Extra dependency} Use 'encodeUtf8' from 'relude'
  • {Extra dependency} Use the 'utf8-string' package

  ID	OBS-STAN-0215-saA9eI-36:13
  Severity	Error
  Description	Usage of '/' or '\' in paths results in the errors on different operation systems
  Inspection ID	STAN-0215
  Category	AntiPattern
  File	src/Stan/Example.hs

    35 ┃ 
    36 ┃ pathToX x = "src/lib" </> x
    37 ┃             ^^^^^^^^^^^^^^^
  

  Possible solutions

  • {Extra dependency} Use '</>' operator from 'filepath'

  ID	OBS-STAN-0001-saA9eI-39:20
  Severity	Warning
  Description	Usage of partial function 'head' for lists
  Inspection ID	STAN-0001
  Category	Partial List
  File	src/Stan/Example.hs

    38 ┃ 
    39 ┃ getFirstIPromise = P.head
    40 ┃                    ^^^^^^
  

  Possible solutions

  • Replace list with 'NonEmpty' from 'Data.List.NonEmpty'
  • Use explicit pattern-matching over lists

  ID	OBS-STAN-0009-saA9eI-42:12
  Severity	Warning
  Description	Usage of partial function 'read' for parsing 'String'
  Inspection ID	STAN-0009
  Category	Partial
  File	src/Stan/Example.hs

    41 ┃ 
    42 ┃ parseInt = P.read
    43 ┃            ^^^^^^
  

  Possible solutions

  • Use 'readMaybe' or 'readEither' to handle failed parsing

  ID	OBS-STAN-0302-saA9eI-44:16
  Severity	Style
  Description	Using tuples of big size (>= 4) can decrease code readability
  Inspection ID	STAN-0302
  Category	AntiPattern Syntax
  File	src/Stan/Example.hs

    43 ┃ 
    44 ┃ quad :: Int -> (Int, Int, Int, Int)
    45 ┃                ^^^^^^^^^^^^^^^^^^^^
  

  Possible solutions

  • Consider defining and using a custom data type to improve code comprehension

  ID	OBS-STAN-0302-saA9eI-45:10
  Severity	Style
  Description	Using tuples of big size (>= 4) can decrease code readability
  Inspection ID	STAN-0302
  Category	AntiPattern Syntax
  File	src/Stan/Example.hs

    44 ┃ 
    45 ┃ quad x = (x, x, x, x)
    46 ┃          ^^^^^^^^^^^^
  

  Possible solutions

  • Consider defining and using a custom data type to improve code comprehension

  ID	OBS-STAN-0301-saA9eI-47:1
  Severity	Style
  Description	Using the implicit default fixity for operator: infixl 9
  Inspection ID	STAN-0301
  Category	Syntax
  File	src/Stan/Example.hs

    46 ┃ 
    47 ┃ (?+?) :: Int -> Int -> Int
    48 ┃ ^^^^^
  

  Possible solutions

  • Add 'infix[l|r]' declaration to the operator with explicit precedence

  ID	OBS-STAN-0214-saA9eI-51:1
  Severity	Performance
  Description	Usage of multiple comparison operators instead of single 'compare'
  Inspection ID	STAN-0214
  Category	AntiPattern
  File	src/Stan/Example.hs

    50 ┃ 
    51 ┃ isEq x y
    52 ┃     | x < y = False
    53 ┃     | x > y = False
    54 ┃     | otherwise = True
    55 ┃ ^^^^^^^^^^^^^^^^^^^^^^
  

  Possible solutions

  • Rewrite code to use single 'compare' instead of many comparison operators

  ID	OBS-STAN-0213-saA9eI-57:37
  Severity	Warning
  Description	Pattern matching on '_' for sum types can create maintainability issues
  Inspection ID	STAN-0213
  Category	AntiPattern
  File	src/Stan/Example.hs

    56 ┃ 
    57 ┃ prettyOrdering = \case {GT -> "GT"; _ -> "LT"}
    58 ┃                                     ^^^^^^^^^
  

  Possible solutions

  • Pattern match on each constructor explicitly
  • Add meaningful names to holes, e.g. '_anyOtherFailure'

  ID	OBS-STAN-0206-saA9eI-61:7
  Severity	Performance
  Description	Defining lazy fields in data types can lead to unexpected space leaks
  Inspection ID	STAN-0206
  Category	SpaceLeak Syntax
  File	src/Stan/Example.hs

    60 ┃ 
    61 ┃     , userAge  :: Int
    62 ┃       ^^^^^^^^^^^^^^^
  

  Possible solutions

  • Add '!' before the type, e.g. !Int or !(Maybe Bool)
  • Enable the 'StrictData' extension: {-# LANGUAGE StrictData #-}