|
| 1 | +# Oracle sweep rerun — 2026-07-11 (verifying #230/#231 against the 2026-07-10 baseline) |
| 2 | + |
| 3 | +Follow-up to [`oracle-sweep-2026-07-10.md`](oracle-sweep-2026-07-10.md) (issue |
| 4 | +#201). That sweep drafted 8 precision-gap issues (#218-#225) from real |
| 5 | +own-only findings in 5 OSS repos. Two follow-up PRs have since shipped fixes: |
| 6 | + |
| 7 | +- [#230](https://github.com/PhysShell/Own.NET/pull/230) — DependencyProperty/ |
| 8 | + property-changed old→new subscription-rotation recognition (issue #219). |
| 9 | +- [#231](https://github.com/PhysShell/Own.NET/pull/231) — four smaller |
| 10 | + precision gaps in one PR: `CommandManager.RequerySuggested` allowlist |
| 11 | + (#223), `using (field = new T())` release (#220), template-part |
| 12 | + local/pattern-var exemption (#222), self-detaching handler (#224). |
| 13 | + |
| 14 | +This note reruns `own-check` (the real Roslyn extractor + Python core, not |
| 15 | +the CodeQL/Infer# cross-tool oracle — that side of the comparison is |
| 16 | +unaffected by these fixes) against the **same 4 repos, at the exact same |
| 17 | +pinned commits** as the 2026-07-10 sweep, on `main` at `3ca4bde` (both PRs |
| 18 | +merged), and diffs the resulting SARIF against the `own.txt` baselines kept |
| 19 | +from that sweep. Goal: confirm the fixes silence exactly the documented false |
| 20 | +positives, add no regressions, and leave every documented real bug flagged. |
| 21 | + |
| 22 | +## Method |
| 23 | + |
| 24 | +- Reused the exact repo clones from the 2026-07-10 run (still pinned at the |
| 25 | + same commits: MahApps.Metro `72099e3`, MaterialDesignInXamlToolkit |
| 26 | + `ef3a5ea`, AvalonEdit `ed0bd14`, ShareX `0df9ca4`) — an apples-to-apples |
| 27 | + comparison, no drift from upstream changes. |
| 28 | +- Built `OwnSharp.Extractor` fresh off `origin/main` (`3ca4bde`). |
| 29 | +- Ran the identical command the `oracle.yml` workflow uses: |
| 30 | + `scripts/own-check.sh --format sarif --severity warning -- <repo>`, with |
| 31 | + the same `OWN_EXTRA_REF_DIRS` (WindowsDesktop ref pack) materialized the |
| 32 | + same way, so framework-event resolution is on equal footing with the |
| 33 | + original run (confirmed: OWN050 unresolved-reference advisory counts are |
| 34 | + byte-for-byte identical before/after in all 4 repos — coverage didn't |
| 35 | + shift, only the fixes' targets did). |
| 36 | +- Diffed old vs new SARIF results by normalized `(file, line)` per rule ID. |
| 37 | + |
| 38 | +## Headline delta |
| 39 | + |
| 40 | +| repo | OWN001+OWN014 before | after | Δ | new findings introduced | |
| 41 | +|---|---:|---:|---:|---:| |
| 42 | +| MahApps.Metro | 3 | 1 | **−2** | 0 | |
| 43 | +| MaterialDesignInXamlToolkit | 23 | 19 | **−4** | 0 | |
| 44 | +| AvalonEdit | 24 (23 OWN001 + 1 OWN014) | 17 | **−7** | 0 | |
| 45 | +| ShareX | 235 | 232 | **−3** | 0 | |
| 46 | +| **total** | **285** | **269** | **−16** | **0** | |
| 47 | + |
| 48 | +Zero new findings anywhere — the fixes are pure precision gains, not |
| 49 | +trade-offs. (Raw finding counts here are literal SARIF result counts, not |
| 50 | +the hand-grouped "own-only" site counts in the 2026-07-10 table, so absolute |
| 51 | +numbers differ slightly from that table; deltas are what matter.) |
| 52 | + |
| 53 | +## Removed findings, mapped to the fix that closed them |
| 54 | + |
| 55 | +| repo | site | issue / PR | rule | |
| 56 | +|---|---|---|---| |
| 57 | +| MahApps.Metro | `Actions/CommandTriggerAction.cs:116` | #219 / #230 (DP rotation) | OWN001 | |
| 58 | +| MahApps.Metro | `Controls/MetroWindow.cs:1448` | #222 / #231 (template-part pattern var) | OWN001 | |
| 59 | +| MaterialDesignInXamlToolkit | `SmartHint.cs:205-208` (×4) | #219 / #230 (DP rotation) | OWN001 | |
| 60 | +| AvalonEdit | `Editing/AbstractMargin.cs:99` | #219 / #230 (DP rotation) | OWN001 | |
| 61 | +| AvalonEdit | `Editing/LineNumberMargin.cs:114` | #219 / #230 (DP rotation) | OWN001 | |
| 62 | +| AvalonEdit | `Folding/FoldingMargin.cs:218` | #219 / #230 (DP rotation) | OWN001 | |
| 63 | +| AvalonEdit | `CodeCompletion/OverloadViewer.cs:58,64` | #222 / #231 (template-part local) | OWN001 | |
| 64 | +| AvalonEdit | `Search/DropDownButton.cs:78` | #224 / #231 (self-detaching handler) | OWN001 | |
| 65 | +| AvalonEdit | `Editing/ImeSupport.cs:47` (`CommandManager.RequerySuggested`) | #223 / #231 (weak-event allowlist) | **OWN014** | |
| 66 | +| ShareX | `Cryptographic/HashChecker.cs:42` | #220 / #231 (`using (field = new T())`) | OWN001 | |
| 67 | +| ShareX | `TaskEx.cs:41` | #220 / #231 | OWN001 | |
| 68 | +| ShareX | `IndexerJson.cs:35` | #220 / #231 | OWN001 | |
| 69 | + |
| 70 | +By fix: rotation (#219/#230) accounts for 8 of the 16 removed findings — |
| 71 | +beating the "−6+" estimate from the original sweep note (which only |
| 72 | +individually verified 6 sites; the rerun confirms all 8 rotation sites in |
| 73 | +the baseline actually clear). The other three #231 fixes account for the |
| 74 | +remaining 8: template-part locals (3), self-detach (1), weak-event allowlist |
| 75 | +(1, on the OWN014 hard-error tier as designed — not OWN001), using-field |
| 76 | +release (3). |
| 77 | + |
| 78 | +## Real bugs — confirmed still flagged |
| 79 | + |
| 80 | +Every documented true positive from the 2026-07-10 triage is still present, |
| 81 | +unchanged, after the rerun: |
| 82 | + |
| 83 | +- ShareX `HistoryLib/HistoryItemManager_ContextMenu.cs` cluster (48 findings |
| 84 | + — no `Dispose()` at all). |
| 85 | +- ShareX `ShapeManagerMenu.cs` cluster (the flagship `menuForm` leak, |
| 86 | + reduced to `corpus/real-world/sharex-shapemanager-menuform-leak/`). |
| 87 | +- ShareX plain `Timer`/`ImageList` fields (`ColorUserControl.cs`, |
| 88 | + `AutoCaptureForm.cs`, `UploadersConfigForm.cs`). |
| 89 | +- AvalonEdit `TextView.cs:1843,1946` (`services`, `hoverLogic` — no |
| 90 | + `Dispose()` at all). |
| 91 | + |
| 92 | +## Still open (out of this fix pair's scope) |
| 93 | + |
| 94 | +Findings tied to issue #221 (self-owned-source exemption too narrow — |
| 95 | +`Behavior<T>.AssociatedObject`, app-scoped subscriber, self-owned-collection- |
| 96 | +element) are untouched, as expected — #221 wasn't part of #230/#231: |
| 97 | + |
| 98 | +- MahApps.Metro `Behaviors/TiltBehavior.cs:70` (the sole remaining finding). |
| 99 | +- MaterialDesignInXamlToolkit `App.xaml.cs:22`, `ListsAndGridsViewModel.cs`, |
| 100 | + `CircleWipe.cs`/`FadeWipe.cs`, and the 7 bulk-review |
| 101 | + `themeManager.ThemeChanged` sites (19 remaining findings total). |
| 102 | + |
| 103 | +## Not rerun |
| 104 | + |
| 105 | +ClosedXML (the clean-code control from the original sweep) wasn't included — |
| 106 | +none of its findings related to #219-#225, and it isn't part of the WPF/ |
| 107 | +WinForms domain #230/#231 targeted. The CodeQL/Infer# oracle side wasn't |
| 108 | +rerun either — these fixes only change Own.NET's own emission, and the |
| 109 | +oracle comparators' output is unaffected by them. |
0 commit comments