[Fizzadar]

Four rules for bugs that came up in GroupMe's launch QA. Each fires on the GroupMe code from before the fixes, and they're general enough to apply to other bridges.

Rule	Severity	Flags	GroupMe fix it would have caught
MC001	error	A bridgev2.Avatar built in the function with a non-constant MXC and no Hash. bridgev2 skips the update when the hash is unchanged and an MXC is set (portal.updateAvatar, ghost.UpdateAvatar), so avatar changes after the first are lost.	beeper/groupme#41
MC002	warning	m.image capabilities that accept image/gif when nothing in the package uses event.CapMsgGIF. Clients only enable the GIF picker with fi.mau.gif.	beeper/groupme#34
MC003	warning	Image, video or audio content with a URL that gets no Info on any path to the end of the function, using the CFG. Content passed to another function is skipped.	beeper/groupme#30, beeper/groupme#39
EP004	warning	In a function with no results, a json.Unmarshal/Decode/proto.Unmarshal failure whose branch is only a bare return. continue isn't flagged, because loops often skip rows of other shapes on purpose.	beeper/groupme-lib#1

Rules for avatars or content passed in from elsewhere stay quiet. A constant MXC is exempt from MC001: it's a fixed avatar, so it never needs an update to get through.

Sweep

I ran it over 31 bridge repos: every bridgev2.NetworkConnector repo in mautrix/beeper, plus discord@megadiscord and groupme-lib, minus line, snapchat, codex and mautrix/go. After exempting constant MXCs (ai-bridge's fixed default assistant avatar), every remaining finding is a real bug:

• MC001 (2):
  • beeper/reddit pkg/connector/chatinfo.go:52 assigns a direct media MXC to an avatar with no hash.
  • beeper/bookface pkg/connector/client.go:234 returns a direct media avatar with no hash.
• EP004 (2): beeper/groupme-lib real_time_handler.go:26 and :124. These are the same silent drop that lib#1 fixed for line 62, still present in two other push handlers.
• MC002, MC003: nothing on current bridges. On GroupMe at f3574c1 (before QA), MC002 fires on the capabilities and MC003 on both image/video branches of directMediaContent.

go vet and go test ./rules pass. staticcheck isn't installed in this environment.

Tag @indent to continue the conversation here.