LibFs.buildFileForContract's unlink block has no test, and no test in this repo can currently reach it

[thedavidmeister]

Audit scope: whole-repo, commit 7aa85a4

Dimension 2 (test coverage) · medium

src/lib/LibFs.sol:68-71

Problem

Deleting the entire if (vm.exists(path)) { vm.removeFile(path); } block leaves
134/134 tests passing. vm.writeFile truncates, so every content test passes
without the unlink. The block's only documented justification is symlink
replacement (LibFs.sol:49-51), and that has no test. (#41 established that the
remove-then-write is unobservable through the NatSpec's idempotency claim; this
is the coverage half — the one behaviour the block is actually kept for is
unprobed.)

There is no symlink-creating cheatcode in forge-std 1.16.1 (only readLink) and
ffi is not enabled anywhere in this repo, so no test can currently reach the
branch's real behaviour.

Evidence

Mutant: unlink block deleted, 134/134 tests still pass.

Proposed fix

Set ffi = true in foundry.toml — the tradeoff, that any test can then shell
out, is named here for triage rather than decided. The narrower forge test --ffi route would need a change in rainix's shared CI, since the reusable runs
plain forge test. Then a test that keeps everything inside the existing grant:

    /// A symlink at the path is unlinked, so the write lands at the path rather
    /// than following the link to its target. A dangling link is the case that
    /// matters: `vm.exists` resolves symlinks and reports it absent.
    function testBuildFileForContractReplacesDanglingSymlink() external {
        string memory name = "LibFsBuildSymlink";
        string memory path = LibFs.pathForContract(name);
        string memory target = "src/generated/LibFsBuildSymlinkTarget.txt";
        cleanupPath(path);
        cleanupPath(target);

        string[] memory command = new string[](4);
        command[0] = "ln";
        command[1] = "-s";
        command[2] = "LibFsBuildSymlinkTarget.txt";
        command[3] = path;
        vm.ffi(command);

        address instance = address(new CodeGennable());
        string memory body = "\n// symlink\n";
        LibFs.buildFileForContract(vm, instance, name, body);

        assertFalse(vm.exists(target), "the write followed the symlink off the path");
        assertEq(vm.readFile(path), expectedFile(instance, body));
        cleanupPath(path);
        cleanupPath(target);
    }

[thedavidmeister]

Resolved by #110, merged as
308ad50b3119fbf81c7122a4e9131295ce006a34.

That PR landed all three parts of this issue:

• ffi = true in foundry.toml's [profile.default], with the tradeoff
  named in a comment above it. The decision this issue left to triage is taken.
• src/lib/LibFs.sol: vm.exists resolves symlinks, so a dangling link at
  the path read as absent and the unlink block was never reached on the one
  input it exists for. Unlink a symlink with no target before writing the generated file #110 added LibFs.isPresent, which falls back to
  vm.readLink — an answer about the path itself rather than what it resolves
  to — and the block now guards on isPresent(vm, path). Without this, the test
  proposed in this issue could not have passed.
• test/src/lib/LibFs.isPresent.t.sol, including
  testBuildFileForContractReplacesDanglingSymlink — the test named in the
  proposed fix here, against the corrected source. It puts a dangling symlink at
  the generated path with ln -s, runs buildFileForContract, then asserts the
  link's target was never created, that the path is no longer a symlink, and
  that its content equals a control contract generated at a path holding nothing.
  Deleting if (isPresent(vm, path)) { vm.removeFile(path); } makes vm.writeFile
  follow the link and create the target, which reds the first of those. The
  mutant reported here no longer survives.

PR #109 ("Cover buildFileForContract's unlink with a hard link") was opened
against this issue in parallel and is closed unmerged — its ffi = true would
have been a duplicate TOML key in [profile.default], and its hard-link test
covers the same block while pinning an undocumented property (that the write
lands on a new inode).