devtools: Add discouraged function check to pre-commit.
What the developer wrote
Authored by Se7enZ
devtools: Add discouraged function check to pre-commit.
Reimplements `make check-discouraged-functions` for Python regex.
What changed, and why it matters
This commit adds a new automated code-quality check that flags risky C functions like gets, scanf, sprintf, fgets, and fputs during pre-commit. It is a defensive tooling change, not a fix for an active security bug. There is no patch to any runtime code, so it does not directly change the software's security posture, but it helps prevent unsafe functions from being introduced in the future.
No immediate action required. Treat as routine hardening of developer tooling. Review whether existing code already contains matches and, if so, consider addressing them separately.
Security signals we found
Adds check for historically unsafe C standard library functions (gets, scanf, sprintf)
Also flags fgets/fputs, which are less dangerous but discouraged by project policy
Tooling-only change; no source-code bug is patched
Evidence from the diff
The change extends .pre-commit-config.yaml with a pygrep hook that reimplements make check-discouraged-functions. The regex ‘^a-z_/(’ matches calls to these functions in C files, excluding ccan and contrib directories. This is a static-analysis/prevention control, not a vulnerability remediation.
Changed components
.pre-commit-config.yamlInspect captured patch +8 / −0
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index b9a48260..0f8dc272 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -28,3 +28,11 @@ repos:
entry: (->|\.)(milli)?satoshis(?!.*\/\*\ Raw:)|(?<!sizeof)\(struct\ amount_(m)?sat\)
types: [ c ]
exclude: common/amount|.*/test/.*
+
+ # Reimplementation of `make check-discouraged-functions` for pygrep.
+ - id: check-discouraged-functions
+ name: Check for usage of discouraged funtions
+ language: pygrep
+ entry: '[^a-z_/](?:fgets|fputs|gets|scanf|sprintf)\('
+ types: [ c ]
+ exclude: ccan|contrib
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.