2025-06-23 20:27:16 +02:00
|
|
|
use crate::errors::{NyxError, NyxResult};
|
Release/0.5.0 (#35)
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures
* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests
* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements
* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles
* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing
* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling
* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures
* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration
* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests
* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic
* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection
* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements
* feat: Enable auth-state analysis by default and update relevant tests in benchmark config
* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test
* docs: update CHANGELOG.md
* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers
* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers
* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse
* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation
* feat: Refactor function parameters and constants for improved clarity and maintainability
* refactor: Reorder module imports and improve formatting for consistency
* refactor: Fix formatting erorrs
* refactor: Fix clippy warnings
* refactor: Fix fmt warnings (again)
* chore: Update dependencies and improve feature configuration
* Add comprehensive tests for undertested modules (#36) (COPILOT)
* Add comprehensive tests for undertested modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
* Add comprehensive tests for ext, project, walk, and errors modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: Update dependencies and improve feature configuration
* fix: formatting errors in new tests
* chore: Update license list in about.toml
* chore: made functions input inline
* chore: updated cfg graph to take up the full page
* chore: add Prettier configuration and update code formatting
* Add frontend test suite with Vitest (111 tests) (#37)
* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7
* ci: add frontend test step to CI workflow
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: simplify array initialization in test files for consistency
* ran typecheck
* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage
* feat: update routing in AppLayout and improve empty state message in ExplorerPage
* feat: enhance scan progress tracking with additional metrics and stages
* feat: update license information and add license check script
* feat: implement cross-file symbolic execution with callee body persistence
* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering
* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions
* feat: enhance resource tracking with proxy method summaries and improve finding extraction
* feat: add terminal function exit detection for accurate resource leak analysis
* feat: add warnings for loops and functions without bodies to improve error recovery
* feat: update lambda expression handling to ensure proper function classification and control flow
* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling
* feat: add inline return taint analysis and regression tests for improved security checks
* feat: add engine version management and migration handling for database schema updates
* feat: enhance first_call_ident to skip nested function bodies and add regression tests
* feat: enhance callee name resolution with two-segment normalization and disambiguation
* feat: add cross-file context flags and debug assertions for taint analysis
* feat: refactor taint analysis structure to unify context handling and improve clarity
* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests
* docs: updated CHANGELOG.md
* fmt: formatting fixes
* fix: fixed frontend formatting and lint warnings
* fix: optimized ci
* fix: optimized ci
* Add comprehensive multi-file test coverage to Nyx (#38)
* Initial checklist for multi-file test suite expansion
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* deleted root repo
* rebuilt to test for regressions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* feat: enhance import alias resolution and taint tracking
* feat: implement security hardening with CSRF protection and path validation
* feat: add support for import alias bindings in Python, PHP, and Rust
* feat: enhance CFG analysis modes and improve code readability
* feat: add detection for parameterized SQL queries to enhance security
* feat: add safe internal redirect handling and enhance session destroy validation
* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads
* feat: enhance taint detection by adding support for inline source member expressions in call arguments
* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments
* feat: add support for Throw statement in control flow and error handling
* feat: add debug and echo endpoints with potential information leakage
* feat: implement internal redirect suppression and enhance taint detection
* feat: implement module alias tracking for dynamic dispatch in JS/TS
* feat: add authorization analysis module with Express support
* feat: add authorization analysis module with Express support
* feat: add tests for admin guard requirements and clean checks in authorization analysis
* feat: integrate Koa and Fastify frameworks into authorization analysis
* feat: add Flask and Django support to authorization analysis module
* feat: add support for Rails and Sinatra frameworks in authorization analysis
* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis
* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis
* feat: add support for Rails and Sinatra in authorization analysis
* chore: add .DS_Store to .gitignore
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: update usage of Option methods for improved clarity and consistency
* refactor: improve code readability by simplifying conditional checks and formatting
* refactor: improve code formatting and readability by simplifying conditional checks
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: simplify conditional checks in axum.rs for improved readability
* feat: add CodeQL analysis configuration for enhanced security scanning
* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)
* chore: start test coverage improvement work
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* test: add comprehensive tests for src/output.rs SARIF builder
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* refactor: improve code formatting and readability in output.rs
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* refactor: improve code formatting and readability in output.rs
* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* refactor: enhance triage file path handling with improved error management and validation
* refactor: updated func summaries for richer detail
* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries
* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution
* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls
* refactor: implement new Flask routes for safe and unsafe shell command execution
* refactor: separate receiver handling in SSA operations and enhance taint propagation
* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments
* refactor: implement auth decorator extraction and classification for multiple languages
* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation
* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic
* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior
* refactor: standardize default struct initialization across multiple files
* feat: add scripts for formatting checks and auto-fixes with test summaries
* refactor: simplify character splitting and enhance namespace qualifier handling
* refactor: improve documentation clarity and enhance code readability in resolver logic
* refactor: replace default struct initialization with explicit field assignments for clarity
* feat: enhance anonymous function naming by deriving context-based bindings
* refactor: streamline match expressions for improved readability and performance
* refactor: streamline match expressions for improved readability and performance
* refactor: replace loop with while let for improved clarity and performance
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis
* feat: add static map analysis for command injection suppression and type safety
* refactor: simplify match statements and reduce line breaks for improved readability
* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution
Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.
Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.
Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.
Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.
Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding
Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet. SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.
Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.
Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`. `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters. Dedup key extended with the primary location
so multi-site events aren't collapsed back together.
Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
!= ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
non-empty `file_rel` — the cap-only → None translation upstream
guarantees this.
Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved. A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.
build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.
Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing). All 1566 lib
tests + integration tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(output): phase 3/5 consume primary sink location in diag + SARIF
When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.
Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
resolved back to an absolute path via a shared resolve_file_rel
helper. Empty file_rel (single-file scans where namespace == "")
resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
locations[0] already reflects the primary sink position via the
updated diag line/col.
Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.
Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
inside the closure).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(bench): phase 4/5 validate primary sink attribution across corpus
Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.
Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
Case. When present, score_location_level additionally requires at
least one flow_step in the finding's evidence trace to fall within
±2 of the call-site range. When absent, the check is skipped —
fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
now-primary Diag.line post-phase-3).
Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
transform::wrap call site (a cross-file propagator, not a sink);
line 9 is Command::new, the real sink. The ±2 tolerance happened to
mask this stale attribution but it was semantically wrong — phase 4
is the right time to correct it. Also adds expected_call_site_lines
[8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
This fixture's sink (Command::new inside run_cmd at line 5) was the
motivating case for phases 1-3; adding the call-site assertion
guards against regression to caller-line attribution.
New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
takes two tainted params and invokes two Command sinks on
consecutive lines. Locks in that primary line lands inside the
helper (lines 5-6), not at the caller (line 12). Notes document
that SinkSite is currently one-per-callee so both findings today
collapse onto the first sink; expected_sink_lines=[5,6] and
expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
004): sink os.system lives in helper.py (cross-file), caller in
app.py reads env source and calls run_cmd. Verifies phase 3's
cross-file primary attribution: Diag.path = helper.py, Diag.line =
5, with app.py:7 recorded in flow_steps as a Call step.
Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test
Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body. Asserts the
resulting Finding.primary_location is exactly that triple.
The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file. This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.
Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).
Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: clean up formatting and improve readability in multiple files
* refactor: simplify type definition for deduplication key in findings
* test(harness): add must_not_match expectation for FP regression guards
Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules
* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking
* feat: update switch statement handling to improve control flow analysis
* feat: implement promisify alias handling for JS/TS to enhance taint tracking
* feat: enhance taint tracking by refining expectation handling and adding mode filtering
* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters
* feat: update taint tracking rules to enforce full mode matching and improve flow analysis
* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis
* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding
* feat: refine framework detection and update expectation handling for Echo and Sinatra
* feat: implement max_count for taint tracking expectations and deduplicate findings
* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files
* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity
* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files
* feat: add structural invariant checks for SSA bodies
* feat: ensure deterministic phi emission order using BTreeSet
* feat: enhance handling of terminators to ensure authoritative flow through successor edges
* feat: enhance Goto terminator handling to ensure all successors are marked executable
* feat: refactor code for improved readability and organization
* feat: simplify predicate checks and enhance readability in SSA handling
* feat: implement per-file parse timeout and enhance file size handling
* feat: migrate analysis engine toggles from environment variables to configuration file
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: update dependencies and enhance documentation on language maturity
* feat: enhance security headers and improve request body limits
* feat: implement sink capability bits for deduplication and enhance evidence tagging
* feat: implement dynamic activation handling for gated sinks and enhance validation logic
* feat: enhance configuration documentation and clarify inline analysis cache behavior
* feat: implement panic recovery during analysis to continue scans past errors
* feat: add expectations configuration for taint analysis and performance metrics
* feat: enhance error handling and logging during file reading and mutex locking
* feat: add cross-file body loading tests and plumbing for CF-1 phase
* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures
* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality
* feat: enhance classification span handling in CFG and AST for improved source attribution
* feat: add new Express routes for handling user input and telemetry data
* feat: implement ternary expression handling in CFG with diamond structure for JS/TS
* feat: implement Phase CF-3 abstract-domain transfer channels in summaries
* feat: add support for string-prefix transfer in cross-file calls and update tests
* docs: reduce RESULTS.md doc size
* feat: implement Phase CF-4 per-return-path summary decomposition with tests
* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization
* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests
* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests
* refactor: update comments and documentation for clarity and consistency
* style: format code for consistency and readability
* refactor: simplify verdict handling and improve edge checking logic
* refactor: optimize path and identifier collection by avoiding unnecessary cloning
* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults
* refactor: update documentation and improve clarity in configuration files
* refactor: update documentation and improve clarity in configuration files
* feat: add JS/TS pass-2 convergence tests and expectations configuration
* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic
* feat: implement Phase 7 deduplication and alternative path linking for taint findings
* feat: implement structural DFS index for anonymous functions and update naming conventions
* feat: add Phase 8 regression tests for container-element taint in JS and Python
* feat: add engine-depth profiles and explain-engine option for CLI
* feat: update expectations and add new README fixtures for multi-file scan regression
* feat: implement Phase 11 callback-alias and factory patterns with regression tests
* feat: implement Terminator::Switch for multi-way dispatch and add regression tests
* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants
* refactor: extract cfg and ssa_transfer to submodules
* refactor: cargo fmt
* refactor: remove unnecessary blank line in cfg_tests.rs
* refactor: remove unnecessary planning file
* chore: update Rust version to 1.88 and bump dependencies in Cargo files
* feat: enhance triage UI with new layout and controls, update README for clarity
* feat: enhance triage UI with new layout and controls, update README for clarity
* chore: remove outdated section from README for version 0.5.0
* docs: improve clarity and consistency in README content
* chore: add "GPL-3.0-or-later" to license options in about.toml
* chore: update license handling in about.toml and check-licenses.mjs
* style: format code for improved readability in TriagePage component
* style: format code for improved readability in TriagePage component
* chore: enhance license handling and improve body_id scoping in seed lookup
* feat: introduce owner and parent body IDs for enhanced seed scoping
* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating
* feat: add Undef SSA operation for improved control-flow handling
* style: improve code formatting for consistency and readability in multiple files
* feat: add 16-function chain SCC across multiple files for enhanced analysis
* style: simplify code formatting for improved readability in multiple files
* fix: update CapHitReason default implementation and improve README clarity
* docs: enhance README with detailed explanations of taint analysis and limitations
* docs: refine README for clarity and consistency in taint analysis section
* style: improve code formatting for better readability in NewScanModal and scans
* fix: update cargo-about command to use --offline for deterministic license generation
* fix: update cargo-about command to use --offline for deterministic license generation
* ci: add step to prime cargo registry cache for deterministic license generation
* feat: add support for non-sink collections in authorization analysis
* feat: enhance authorization checks with row-level ownership equality and binding tracking
* feat: implement self-scoped user handling and enhance ownership checks
* refactor: simplify assertions and formatting in authorization analysis tests
* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure
* docs: update AI disclosure section for clarity and conciseness
* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure
* feat: enhance authorization analysis with SSA-derived variable type classification
* feat: implement auth_finding_to_diag function for enhanced security diagnostics
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag
* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks
* feat: enhance error message handling in cli_validation_tests for better Windows compatibility
* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration
* feat: enhance release build process with SBOM generation and SLSA provenance
* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: update benchmark data and enhance path sanitization logic with new safety checks
* feat: document AI assistance in frontend UI development and human review process
* feat: add return path facts for enhanced path safety checks and update documentation
* chore: update release date for version 0.5.0 in CHANGELOG.md
* chore: clean up ci.yml by removing outdated comments and clarifying steps
* feat: implement cross-language path sanitizers and validators for enhanced security
* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks
* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases
* refactor: simplify conditional formatting and improve code readability in executor and lower modules
* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests
* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs
---------
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-25 17:59:11 -04:00
|
|
|
use std::fs;
|
|
|
|
|
use std::io::Read;
|
2025-06-24 20:27:06 +02:00
|
|
|
use std::path::{Path, PathBuf};
|
2025-06-16 16:46:22 +02:00
|
|
|
|
2025-06-23 20:27:16 +02:00
|
|
|
/// Determine `<project-name, path/to/<project>.sqlite>`.
|
2025-06-24 20:27:06 +02:00
|
|
|
pub fn get_project_info(project_path: &Path, config_dir: &Path) -> NyxResult<(String, PathBuf)> {
|
|
|
|
|
let project_name = project_path
|
|
|
|
|
.file_name()
|
|
|
|
|
.and_then(|n| n.to_str())
|
|
|
|
|
.ok_or_else(|| NyxError::Other("Unable to determine project name".into()))?;
|
2025-06-23 20:27:16 +02:00
|
|
|
|
2025-06-24 20:27:06 +02:00
|
|
|
let db_name = sanitize_project_name(project_name);
|
2025-06-28 17:36:14 +02:00
|
|
|
let db_path = config_dir.join(format!("{db_name}.sqlite"));
|
2025-06-23 20:27:16 +02:00
|
|
|
|
2025-06-24 20:27:06 +02:00
|
|
|
Ok((project_name.to_owned(), db_path))
|
2025-06-16 16:46:22 +02:00
|
|
|
}
|
|
|
|
|
|
2025-06-23 20:27:16 +02:00
|
|
|
pub fn sanitize_project_name(name: &str) -> String {
|
2025-06-24 20:27:06 +02:00
|
|
|
name.to_lowercase()
|
|
|
|
|
.chars()
|
|
|
|
|
.map(|c| match c {
|
|
|
|
|
' ' | '\t' | '\n' | '\r' => '_',
|
|
|
|
|
c if c.is_alphanumeric() || c == '_' || c == '-' => c,
|
|
|
|
|
_ => '_',
|
|
|
|
|
})
|
|
|
|
|
.collect::<String>()
|
|
|
|
|
.split('_')
|
|
|
|
|
.filter(|s| !s.is_empty())
|
|
|
|
|
.collect::<Vec<_>>()
|
|
|
|
|
.join("_")
|
|
|
|
|
}
|
2025-06-24 23:18:01 +02:00
|
|
|
|
Release/0.5.0 (#35)
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures
* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests
* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements
* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles
* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing
* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling
* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures
* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration
* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests
* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic
* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection
* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements
* feat: Enable auth-state analysis by default and update relevant tests in benchmark config
* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test
* docs: update CHANGELOG.md
* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers
* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers
* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse
* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation
* feat: Refactor function parameters and constants for improved clarity and maintainability
* refactor: Reorder module imports and improve formatting for consistency
* refactor: Fix formatting erorrs
* refactor: Fix clippy warnings
* refactor: Fix fmt warnings (again)
* chore: Update dependencies and improve feature configuration
* Add comprehensive tests for undertested modules (#36) (COPILOT)
* Add comprehensive tests for undertested modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
* Add comprehensive tests for ext, project, walk, and errors modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: Update dependencies and improve feature configuration
* fix: formatting errors in new tests
* chore: Update license list in about.toml
* chore: made functions input inline
* chore: updated cfg graph to take up the full page
* chore: add Prettier configuration and update code formatting
* Add frontend test suite with Vitest (111 tests) (#37)
* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7
* ci: add frontend test step to CI workflow
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: simplify array initialization in test files for consistency
* ran typecheck
* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage
* feat: update routing in AppLayout and improve empty state message in ExplorerPage
* feat: enhance scan progress tracking with additional metrics and stages
* feat: update license information and add license check script
* feat: implement cross-file symbolic execution with callee body persistence
* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering
* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions
* feat: enhance resource tracking with proxy method summaries and improve finding extraction
* feat: add terminal function exit detection for accurate resource leak analysis
* feat: add warnings for loops and functions without bodies to improve error recovery
* feat: update lambda expression handling to ensure proper function classification and control flow
* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling
* feat: add inline return taint analysis and regression tests for improved security checks
* feat: add engine version management and migration handling for database schema updates
* feat: enhance first_call_ident to skip nested function bodies and add regression tests
* feat: enhance callee name resolution with two-segment normalization and disambiguation
* feat: add cross-file context flags and debug assertions for taint analysis
* feat: refactor taint analysis structure to unify context handling and improve clarity
* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests
* docs: updated CHANGELOG.md
* fmt: formatting fixes
* fix: fixed frontend formatting and lint warnings
* fix: optimized ci
* fix: optimized ci
* Add comprehensive multi-file test coverage to Nyx (#38)
* Initial checklist for multi-file test suite expansion
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* deleted root repo
* rebuilt to test for regressions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* feat: enhance import alias resolution and taint tracking
* feat: implement security hardening with CSRF protection and path validation
* feat: add support for import alias bindings in Python, PHP, and Rust
* feat: enhance CFG analysis modes and improve code readability
* feat: add detection for parameterized SQL queries to enhance security
* feat: add safe internal redirect handling and enhance session destroy validation
* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads
* feat: enhance taint detection by adding support for inline source member expressions in call arguments
* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments
* feat: add support for Throw statement in control flow and error handling
* feat: add debug and echo endpoints with potential information leakage
* feat: implement internal redirect suppression and enhance taint detection
* feat: implement module alias tracking for dynamic dispatch in JS/TS
* feat: add authorization analysis module with Express support
* feat: add authorization analysis module with Express support
* feat: add tests for admin guard requirements and clean checks in authorization analysis
* feat: integrate Koa and Fastify frameworks into authorization analysis
* feat: add Flask and Django support to authorization analysis module
* feat: add support for Rails and Sinatra frameworks in authorization analysis
* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis
* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis
* feat: add support for Rails and Sinatra in authorization analysis
* chore: add .DS_Store to .gitignore
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: update usage of Option methods for improved clarity and consistency
* refactor: improve code readability by simplifying conditional checks and formatting
* refactor: improve code formatting and readability by simplifying conditional checks
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: simplify conditional checks in axum.rs for improved readability
* feat: add CodeQL analysis configuration for enhanced security scanning
* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)
* chore: start test coverage improvement work
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* test: add comprehensive tests for src/output.rs SARIF builder
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* refactor: improve code formatting and readability in output.rs
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* refactor: improve code formatting and readability in output.rs
* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* refactor: enhance triage file path handling with improved error management and validation
* refactor: updated func summaries for richer detail
* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries
* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution
* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls
* refactor: implement new Flask routes for safe and unsafe shell command execution
* refactor: separate receiver handling in SSA operations and enhance taint propagation
* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments
* refactor: implement auth decorator extraction and classification for multiple languages
* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation
* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic
* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior
* refactor: standardize default struct initialization across multiple files
* feat: add scripts for formatting checks and auto-fixes with test summaries
* refactor: simplify character splitting and enhance namespace qualifier handling
* refactor: improve documentation clarity and enhance code readability in resolver logic
* refactor: replace default struct initialization with explicit field assignments for clarity
* feat: enhance anonymous function naming by deriving context-based bindings
* refactor: streamline match expressions for improved readability and performance
* refactor: streamline match expressions for improved readability and performance
* refactor: replace loop with while let for improved clarity and performance
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis
* feat: add static map analysis for command injection suppression and type safety
* refactor: simplify match statements and reduce line breaks for improved readability
* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution
Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.
Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.
Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.
Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.
Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding
Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet. SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.
Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.
Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`. `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters. Dedup key extended with the primary location
so multi-site events aren't collapsed back together.
Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
!= ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
non-empty `file_rel` — the cap-only → None translation upstream
guarantees this.
Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved. A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.
build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.
Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing). All 1566 lib
tests + integration tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(output): phase 3/5 consume primary sink location in diag + SARIF
When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.
Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
resolved back to an absolute path via a shared resolve_file_rel
helper. Empty file_rel (single-file scans where namespace == "")
resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
locations[0] already reflects the primary sink position via the
updated diag line/col.
Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.
Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
inside the closure).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(bench): phase 4/5 validate primary sink attribution across corpus
Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.
Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
Case. When present, score_location_level additionally requires at
least one flow_step in the finding's evidence trace to fall within
±2 of the call-site range. When absent, the check is skipped —
fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
now-primary Diag.line post-phase-3).
Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
transform::wrap call site (a cross-file propagator, not a sink);
line 9 is Command::new, the real sink. The ±2 tolerance happened to
mask this stale attribution but it was semantically wrong — phase 4
is the right time to correct it. Also adds expected_call_site_lines
[8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
This fixture's sink (Command::new inside run_cmd at line 5) was the
motivating case for phases 1-3; adding the call-site assertion
guards against regression to caller-line attribution.
New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
takes two tainted params and invokes two Command sinks on
consecutive lines. Locks in that primary line lands inside the
helper (lines 5-6), not at the caller (line 12). Notes document
that SinkSite is currently one-per-callee so both findings today
collapse onto the first sink; expected_sink_lines=[5,6] and
expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
004): sink os.system lives in helper.py (cross-file), caller in
app.py reads env source and calls run_cmd. Verifies phase 3's
cross-file primary attribution: Diag.path = helper.py, Diag.line =
5, with app.py:7 recorded in flow_steps as a Call step.
Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test
Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body. Asserts the
resulting Finding.primary_location is exactly that triple.
The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file. This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.
Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).
Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: clean up formatting and improve readability in multiple files
* refactor: simplify type definition for deduplication key in findings
* test(harness): add must_not_match expectation for FP regression guards
Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules
* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking
* feat: update switch statement handling to improve control flow analysis
* feat: implement promisify alias handling for JS/TS to enhance taint tracking
* feat: enhance taint tracking by refining expectation handling and adding mode filtering
* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters
* feat: update taint tracking rules to enforce full mode matching and improve flow analysis
* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis
* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding
* feat: refine framework detection and update expectation handling for Echo and Sinatra
* feat: implement max_count for taint tracking expectations and deduplicate findings
* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files
* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity
* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files
* feat: add structural invariant checks for SSA bodies
* feat: ensure deterministic phi emission order using BTreeSet
* feat: enhance handling of terminators to ensure authoritative flow through successor edges
* feat: enhance Goto terminator handling to ensure all successors are marked executable
* feat: refactor code for improved readability and organization
* feat: simplify predicate checks and enhance readability in SSA handling
* feat: implement per-file parse timeout and enhance file size handling
* feat: migrate analysis engine toggles from environment variables to configuration file
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: update dependencies and enhance documentation on language maturity
* feat: enhance security headers and improve request body limits
* feat: implement sink capability bits for deduplication and enhance evidence tagging
* feat: implement dynamic activation handling for gated sinks and enhance validation logic
* feat: enhance configuration documentation and clarify inline analysis cache behavior
* feat: implement panic recovery during analysis to continue scans past errors
* feat: add expectations configuration for taint analysis and performance metrics
* feat: enhance error handling and logging during file reading and mutex locking
* feat: add cross-file body loading tests and plumbing for CF-1 phase
* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures
* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality
* feat: enhance classification span handling in CFG and AST for improved source attribution
* feat: add new Express routes for handling user input and telemetry data
* feat: implement ternary expression handling in CFG with diamond structure for JS/TS
* feat: implement Phase CF-3 abstract-domain transfer channels in summaries
* feat: add support for string-prefix transfer in cross-file calls and update tests
* docs: reduce RESULTS.md doc size
* feat: implement Phase CF-4 per-return-path summary decomposition with tests
* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization
* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests
* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests
* refactor: update comments and documentation for clarity and consistency
* style: format code for consistency and readability
* refactor: simplify verdict handling and improve edge checking logic
* refactor: optimize path and identifier collection by avoiding unnecessary cloning
* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults
* refactor: update documentation and improve clarity in configuration files
* refactor: update documentation and improve clarity in configuration files
* feat: add JS/TS pass-2 convergence tests and expectations configuration
* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic
* feat: implement Phase 7 deduplication and alternative path linking for taint findings
* feat: implement structural DFS index for anonymous functions and update naming conventions
* feat: add Phase 8 regression tests for container-element taint in JS and Python
* feat: add engine-depth profiles and explain-engine option for CLI
* feat: update expectations and add new README fixtures for multi-file scan regression
* feat: implement Phase 11 callback-alias and factory patterns with regression tests
* feat: implement Terminator::Switch for multi-way dispatch and add regression tests
* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants
* refactor: extract cfg and ssa_transfer to submodules
* refactor: cargo fmt
* refactor: remove unnecessary blank line in cfg_tests.rs
* refactor: remove unnecessary planning file
* chore: update Rust version to 1.88 and bump dependencies in Cargo files
* feat: enhance triage UI with new layout and controls, update README for clarity
* feat: enhance triage UI with new layout and controls, update README for clarity
* chore: remove outdated section from README for version 0.5.0
* docs: improve clarity and consistency in README content
* chore: add "GPL-3.0-or-later" to license options in about.toml
* chore: update license handling in about.toml and check-licenses.mjs
* style: format code for improved readability in TriagePage component
* style: format code for improved readability in TriagePage component
* chore: enhance license handling and improve body_id scoping in seed lookup
* feat: introduce owner and parent body IDs for enhanced seed scoping
* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating
* feat: add Undef SSA operation for improved control-flow handling
* style: improve code formatting for consistency and readability in multiple files
* feat: add 16-function chain SCC across multiple files for enhanced analysis
* style: simplify code formatting for improved readability in multiple files
* fix: update CapHitReason default implementation and improve README clarity
* docs: enhance README with detailed explanations of taint analysis and limitations
* docs: refine README for clarity and consistency in taint analysis section
* style: improve code formatting for better readability in NewScanModal and scans
* fix: update cargo-about command to use --offline for deterministic license generation
* fix: update cargo-about command to use --offline for deterministic license generation
* ci: add step to prime cargo registry cache for deterministic license generation
* feat: add support for non-sink collections in authorization analysis
* feat: enhance authorization checks with row-level ownership equality and binding tracking
* feat: implement self-scoped user handling and enhance ownership checks
* refactor: simplify assertions and formatting in authorization analysis tests
* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure
* docs: update AI disclosure section for clarity and conciseness
* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure
* feat: enhance authorization analysis with SSA-derived variable type classification
* feat: implement auth_finding_to_diag function for enhanced security diagnostics
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag
* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks
* feat: enhance error message handling in cli_validation_tests for better Windows compatibility
* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration
* feat: enhance release build process with SBOM generation and SLSA provenance
* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: update benchmark data and enhance path sanitization logic with new safety checks
* feat: document AI assistance in frontend UI development and human review process
* feat: add return path facts for enhanced path safety checks and update documentation
* chore: update release date for version 0.5.0 in CHANGELOG.md
* chore: clean up ci.yml by removing outdated comments and clarifying steps
* feat: implement cross-language path sanitizers and validators for enhanced security
* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks
* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases
* refactor: simplify conditional formatting and improve code readability in executor and lower modules
* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests
* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs
---------
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-25 17:59:11 -04:00
|
|
|
/// A web framework detected from project manifests.
|
|
|
|
|
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
|
|
|
|
|
pub enum DetectedFramework {
|
|
|
|
|
Express,
|
|
|
|
|
Koa,
|
|
|
|
|
Fastify,
|
|
|
|
|
React,
|
|
|
|
|
Flask,
|
|
|
|
|
Django,
|
|
|
|
|
Spring,
|
|
|
|
|
Gin,
|
|
|
|
|
Echo,
|
|
|
|
|
Laravel,
|
|
|
|
|
Rails,
|
|
|
|
|
Sinatra,
|
|
|
|
|
ActixWeb,
|
|
|
|
|
Rocket,
|
|
|
|
|
Axum,
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/// Frameworks detected in the project root.
|
|
|
|
|
#[derive(Debug, Clone, Default)]
|
|
|
|
|
pub struct FrameworkContext {
|
|
|
|
|
pub frameworks: Vec<DetectedFramework>,
|
2026-05-02 16:44:49 -04:00
|
|
|
/// Language ecosystems whose root manifest existed and was inspected.
|
|
|
|
|
/// Lets `lang_has_web_framework` distinguish "no manifest at all" from
|
|
|
|
|
/// "manifest present but listed no matching framework" — the second
|
|
|
|
|
/// case is a positive signal that the project has no HTTP boundary in
|
|
|
|
|
/// that language, the first is just absence-of-information.
|
|
|
|
|
pub inspected_langs: std::collections::HashSet<&'static str>,
|
Release/0.5.0 (#35)
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures
* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests
* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements
* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles
* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing
* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling
* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures
* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration
* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests
* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic
* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection
* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements
* feat: Enable auth-state analysis by default and update relevant tests in benchmark config
* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test
* docs: update CHANGELOG.md
* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers
* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers
* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse
* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation
* feat: Refactor function parameters and constants for improved clarity and maintainability
* refactor: Reorder module imports and improve formatting for consistency
* refactor: Fix formatting erorrs
* refactor: Fix clippy warnings
* refactor: Fix fmt warnings (again)
* chore: Update dependencies and improve feature configuration
* Add comprehensive tests for undertested modules (#36) (COPILOT)
* Add comprehensive tests for undertested modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
* Add comprehensive tests for ext, project, walk, and errors modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: Update dependencies and improve feature configuration
* fix: formatting errors in new tests
* chore: Update license list in about.toml
* chore: made functions input inline
* chore: updated cfg graph to take up the full page
* chore: add Prettier configuration and update code formatting
* Add frontend test suite with Vitest (111 tests) (#37)
* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7
* ci: add frontend test step to CI workflow
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: simplify array initialization in test files for consistency
* ran typecheck
* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage
* feat: update routing in AppLayout and improve empty state message in ExplorerPage
* feat: enhance scan progress tracking with additional metrics and stages
* feat: update license information and add license check script
* feat: implement cross-file symbolic execution with callee body persistence
* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering
* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions
* feat: enhance resource tracking with proxy method summaries and improve finding extraction
* feat: add terminal function exit detection for accurate resource leak analysis
* feat: add warnings for loops and functions without bodies to improve error recovery
* feat: update lambda expression handling to ensure proper function classification and control flow
* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling
* feat: add inline return taint analysis and regression tests for improved security checks
* feat: add engine version management and migration handling for database schema updates
* feat: enhance first_call_ident to skip nested function bodies and add regression tests
* feat: enhance callee name resolution with two-segment normalization and disambiguation
* feat: add cross-file context flags and debug assertions for taint analysis
* feat: refactor taint analysis structure to unify context handling and improve clarity
* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests
* docs: updated CHANGELOG.md
* fmt: formatting fixes
* fix: fixed frontend formatting and lint warnings
* fix: optimized ci
* fix: optimized ci
* Add comprehensive multi-file test coverage to Nyx (#38)
* Initial checklist for multi-file test suite expansion
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* deleted root repo
* rebuilt to test for regressions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* feat: enhance import alias resolution and taint tracking
* feat: implement security hardening with CSRF protection and path validation
* feat: add support for import alias bindings in Python, PHP, and Rust
* feat: enhance CFG analysis modes and improve code readability
* feat: add detection for parameterized SQL queries to enhance security
* feat: add safe internal redirect handling and enhance session destroy validation
* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads
* feat: enhance taint detection by adding support for inline source member expressions in call arguments
* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments
* feat: add support for Throw statement in control flow and error handling
* feat: add debug and echo endpoints with potential information leakage
* feat: implement internal redirect suppression and enhance taint detection
* feat: implement module alias tracking for dynamic dispatch in JS/TS
* feat: add authorization analysis module with Express support
* feat: add authorization analysis module with Express support
* feat: add tests for admin guard requirements and clean checks in authorization analysis
* feat: integrate Koa and Fastify frameworks into authorization analysis
* feat: add Flask and Django support to authorization analysis module
* feat: add support for Rails and Sinatra frameworks in authorization analysis
* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis
* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis
* feat: add support for Rails and Sinatra in authorization analysis
* chore: add .DS_Store to .gitignore
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: update usage of Option methods for improved clarity and consistency
* refactor: improve code readability by simplifying conditional checks and formatting
* refactor: improve code formatting and readability by simplifying conditional checks
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: simplify conditional checks in axum.rs for improved readability
* feat: add CodeQL analysis configuration for enhanced security scanning
* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)
* chore: start test coverage improvement work
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* test: add comprehensive tests for src/output.rs SARIF builder
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* refactor: improve code formatting and readability in output.rs
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* refactor: improve code formatting and readability in output.rs
* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* refactor: enhance triage file path handling with improved error management and validation
* refactor: updated func summaries for richer detail
* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries
* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution
* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls
* refactor: implement new Flask routes for safe and unsafe shell command execution
* refactor: separate receiver handling in SSA operations and enhance taint propagation
* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments
* refactor: implement auth decorator extraction and classification for multiple languages
* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation
* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic
* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior
* refactor: standardize default struct initialization across multiple files
* feat: add scripts for formatting checks and auto-fixes with test summaries
* refactor: simplify character splitting and enhance namespace qualifier handling
* refactor: improve documentation clarity and enhance code readability in resolver logic
* refactor: replace default struct initialization with explicit field assignments for clarity
* feat: enhance anonymous function naming by deriving context-based bindings
* refactor: streamline match expressions for improved readability and performance
* refactor: streamline match expressions for improved readability and performance
* refactor: replace loop with while let for improved clarity and performance
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis
* feat: add static map analysis for command injection suppression and type safety
* refactor: simplify match statements and reduce line breaks for improved readability
* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution
Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.
Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.
Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.
Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.
Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding
Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet. SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.
Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.
Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`. `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters. Dedup key extended with the primary location
so multi-site events aren't collapsed back together.
Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
!= ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
non-empty `file_rel` — the cap-only → None translation upstream
guarantees this.
Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved. A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.
build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.
Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing). All 1566 lib
tests + integration tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(output): phase 3/5 consume primary sink location in diag + SARIF
When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.
Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
resolved back to an absolute path via a shared resolve_file_rel
helper. Empty file_rel (single-file scans where namespace == "")
resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
locations[0] already reflects the primary sink position via the
updated diag line/col.
Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.
Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
inside the closure).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(bench): phase 4/5 validate primary sink attribution across corpus
Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.
Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
Case. When present, score_location_level additionally requires at
least one flow_step in the finding's evidence trace to fall within
±2 of the call-site range. When absent, the check is skipped —
fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
now-primary Diag.line post-phase-3).
Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
transform::wrap call site (a cross-file propagator, not a sink);
line 9 is Command::new, the real sink. The ±2 tolerance happened to
mask this stale attribution but it was semantically wrong — phase 4
is the right time to correct it. Also adds expected_call_site_lines
[8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
This fixture's sink (Command::new inside run_cmd at line 5) was the
motivating case for phases 1-3; adding the call-site assertion
guards against regression to caller-line attribution.
New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
takes two tainted params and invokes two Command sinks on
consecutive lines. Locks in that primary line lands inside the
helper (lines 5-6), not at the caller (line 12). Notes document
that SinkSite is currently one-per-callee so both findings today
collapse onto the first sink; expected_sink_lines=[5,6] and
expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
004): sink os.system lives in helper.py (cross-file), caller in
app.py reads env source and calls run_cmd. Verifies phase 3's
cross-file primary attribution: Diag.path = helper.py, Diag.line =
5, with app.py:7 recorded in flow_steps as a Call step.
Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test
Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body. Asserts the
resulting Finding.primary_location is exactly that triple.
The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file. This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.
Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).
Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: clean up formatting and improve readability in multiple files
* refactor: simplify type definition for deduplication key in findings
* test(harness): add must_not_match expectation for FP regression guards
Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules
* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking
* feat: update switch statement handling to improve control flow analysis
* feat: implement promisify alias handling for JS/TS to enhance taint tracking
* feat: enhance taint tracking by refining expectation handling and adding mode filtering
* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters
* feat: update taint tracking rules to enforce full mode matching and improve flow analysis
* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis
* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding
* feat: refine framework detection and update expectation handling for Echo and Sinatra
* feat: implement max_count for taint tracking expectations and deduplicate findings
* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files
* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity
* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files
* feat: add structural invariant checks for SSA bodies
* feat: ensure deterministic phi emission order using BTreeSet
* feat: enhance handling of terminators to ensure authoritative flow through successor edges
* feat: enhance Goto terminator handling to ensure all successors are marked executable
* feat: refactor code for improved readability and organization
* feat: simplify predicate checks and enhance readability in SSA handling
* feat: implement per-file parse timeout and enhance file size handling
* feat: migrate analysis engine toggles from environment variables to configuration file
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: update dependencies and enhance documentation on language maturity
* feat: enhance security headers and improve request body limits
* feat: implement sink capability bits for deduplication and enhance evidence tagging
* feat: implement dynamic activation handling for gated sinks and enhance validation logic
* feat: enhance configuration documentation and clarify inline analysis cache behavior
* feat: implement panic recovery during analysis to continue scans past errors
* feat: add expectations configuration for taint analysis and performance metrics
* feat: enhance error handling and logging during file reading and mutex locking
* feat: add cross-file body loading tests and plumbing for CF-1 phase
* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures
* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality
* feat: enhance classification span handling in CFG and AST for improved source attribution
* feat: add new Express routes for handling user input and telemetry data
* feat: implement ternary expression handling in CFG with diamond structure for JS/TS
* feat: implement Phase CF-3 abstract-domain transfer channels in summaries
* feat: add support for string-prefix transfer in cross-file calls and update tests
* docs: reduce RESULTS.md doc size
* feat: implement Phase CF-4 per-return-path summary decomposition with tests
* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization
* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests
* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests
* refactor: update comments and documentation for clarity and consistency
* style: format code for consistency and readability
* refactor: simplify verdict handling and improve edge checking logic
* refactor: optimize path and identifier collection by avoiding unnecessary cloning
* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults
* refactor: update documentation and improve clarity in configuration files
* refactor: update documentation and improve clarity in configuration files
* feat: add JS/TS pass-2 convergence tests and expectations configuration
* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic
* feat: implement Phase 7 deduplication and alternative path linking for taint findings
* feat: implement structural DFS index for anonymous functions and update naming conventions
* feat: add Phase 8 regression tests for container-element taint in JS and Python
* feat: add engine-depth profiles and explain-engine option for CLI
* feat: update expectations and add new README fixtures for multi-file scan regression
* feat: implement Phase 11 callback-alias and factory patterns with regression tests
* feat: implement Terminator::Switch for multi-way dispatch and add regression tests
* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants
* refactor: extract cfg and ssa_transfer to submodules
* refactor: cargo fmt
* refactor: remove unnecessary blank line in cfg_tests.rs
* refactor: remove unnecessary planning file
* chore: update Rust version to 1.88 and bump dependencies in Cargo files
* feat: enhance triage UI with new layout and controls, update README for clarity
* feat: enhance triage UI with new layout and controls, update README for clarity
* chore: remove outdated section from README for version 0.5.0
* docs: improve clarity and consistency in README content
* chore: add "GPL-3.0-or-later" to license options in about.toml
* chore: update license handling in about.toml and check-licenses.mjs
* style: format code for improved readability in TriagePage component
* style: format code for improved readability in TriagePage component
* chore: enhance license handling and improve body_id scoping in seed lookup
* feat: introduce owner and parent body IDs for enhanced seed scoping
* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating
* feat: add Undef SSA operation for improved control-flow handling
* style: improve code formatting for consistency and readability in multiple files
* feat: add 16-function chain SCC across multiple files for enhanced analysis
* style: simplify code formatting for improved readability in multiple files
* fix: update CapHitReason default implementation and improve README clarity
* docs: enhance README with detailed explanations of taint analysis and limitations
* docs: refine README for clarity and consistency in taint analysis section
* style: improve code formatting for better readability in NewScanModal and scans
* fix: update cargo-about command to use --offline for deterministic license generation
* fix: update cargo-about command to use --offline for deterministic license generation
* ci: add step to prime cargo registry cache for deterministic license generation
* feat: add support for non-sink collections in authorization analysis
* feat: enhance authorization checks with row-level ownership equality and binding tracking
* feat: implement self-scoped user handling and enhance ownership checks
* refactor: simplify assertions and formatting in authorization analysis tests
* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure
* docs: update AI disclosure section for clarity and conciseness
* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure
* feat: enhance authorization analysis with SSA-derived variable type classification
* feat: implement auth_finding_to_diag function for enhanced security diagnostics
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag
* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks
* feat: enhance error message handling in cli_validation_tests for better Windows compatibility
* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration
* feat: enhance release build process with SBOM generation and SLSA provenance
* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: update benchmark data and enhance path sanitization logic with new safety checks
* feat: document AI assistance in frontend UI development and human review process
* feat: add return path facts for enhanced path safety checks and update documentation
* chore: update release date for version 0.5.0 in CHANGELOG.md
* chore: clean up ci.yml by removing outdated comments and clarifying steps
* feat: implement cross-language path sanitizers and validators for enhanced security
* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks
* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases
* refactor: simplify conditional formatting and improve code readability in executor and lower modules
* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests
* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs
---------
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-25 17:59:11 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
impl FrameworkContext {
|
|
|
|
|
pub fn has(&self, fw: DetectedFramework) -> bool {
|
|
|
|
|
self.frameworks.contains(&fw)
|
|
|
|
|
}
|
2026-05-02 16:44:49 -04:00
|
|
|
|
|
|
|
|
/// Three-valued web-framework presence query for a language slug.
|
|
|
|
|
///
|
|
|
|
|
/// * `Some(true)` ─ at least one framework for `lang` is in `frameworks`.
|
|
|
|
|
/// * `Some(false)` ─ a manifest for `lang` was inspected but listed no
|
|
|
|
|
/// matching framework. The project genuinely has no HTTP boundary
|
|
|
|
|
/// in this language.
|
|
|
|
|
/// * `None` ─ no manifest for `lang` was inspected (e.g. single-file
|
|
|
|
|
/// scans without a project root). Caller should fall back to
|
|
|
|
|
/// prior-behavior heuristics.
|
|
|
|
|
pub fn lang_has_web_framework(&self, lang: &str) -> Option<bool> {
|
|
|
|
|
let (frameworks_for_lang, manifest_lang_key): (&[DetectedFramework], &str) = match lang {
|
|
|
|
|
"javascript" | "typescript" | "js" | "ts" => (
|
|
|
|
|
&[
|
|
|
|
|
DetectedFramework::Express,
|
|
|
|
|
DetectedFramework::Koa,
|
|
|
|
|
DetectedFramework::Fastify,
|
|
|
|
|
],
|
|
|
|
|
"node",
|
|
|
|
|
),
|
|
|
|
|
"python" | "py" => (
|
|
|
|
|
&[DetectedFramework::Flask, DetectedFramework::Django],
|
|
|
|
|
"python",
|
|
|
|
|
),
|
|
|
|
|
"java" => (&[DetectedFramework::Spring], "java"),
|
|
|
|
|
"go" => (&[DetectedFramework::Gin, DetectedFramework::Echo], "go"),
|
|
|
|
|
"ruby" | "rb" => (
|
|
|
|
|
&[DetectedFramework::Rails, DetectedFramework::Sinatra],
|
|
|
|
|
"ruby",
|
|
|
|
|
),
|
|
|
|
|
"php" => (&[DetectedFramework::Laravel], "php"),
|
|
|
|
|
"rust" | "rs" => (
|
|
|
|
|
&[
|
|
|
|
|
DetectedFramework::Axum,
|
|
|
|
|
DetectedFramework::ActixWeb,
|
|
|
|
|
DetectedFramework::Rocket,
|
|
|
|
|
],
|
|
|
|
|
"rust",
|
|
|
|
|
),
|
|
|
|
|
_ => return None,
|
|
|
|
|
};
|
|
|
|
|
if frameworks_for_lang.iter().any(|fw| self.has(*fw)) {
|
|
|
|
|
return Some(true);
|
|
|
|
|
}
|
|
|
|
|
if self.inspected_langs.contains(manifest_lang_key) {
|
|
|
|
|
return Some(false);
|
|
|
|
|
}
|
|
|
|
|
None
|
|
|
|
|
}
|
Release/0.5.0 (#35)
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures
* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests
* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements
* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles
* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing
* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling
* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures
* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration
* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests
* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic
* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection
* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements
* feat: Enable auth-state analysis by default and update relevant tests in benchmark config
* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test
* docs: update CHANGELOG.md
* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers
* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers
* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse
* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation
* feat: Refactor function parameters and constants for improved clarity and maintainability
* refactor: Reorder module imports and improve formatting for consistency
* refactor: Fix formatting erorrs
* refactor: Fix clippy warnings
* refactor: Fix fmt warnings (again)
* chore: Update dependencies and improve feature configuration
* Add comprehensive tests for undertested modules (#36) (COPILOT)
* Add comprehensive tests for undertested modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
* Add comprehensive tests for ext, project, walk, and errors modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: Update dependencies and improve feature configuration
* fix: formatting errors in new tests
* chore: Update license list in about.toml
* chore: made functions input inline
* chore: updated cfg graph to take up the full page
* chore: add Prettier configuration and update code formatting
* Add frontend test suite with Vitest (111 tests) (#37)
* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7
* ci: add frontend test step to CI workflow
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: simplify array initialization in test files for consistency
* ran typecheck
* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage
* feat: update routing in AppLayout and improve empty state message in ExplorerPage
* feat: enhance scan progress tracking with additional metrics and stages
* feat: update license information and add license check script
* feat: implement cross-file symbolic execution with callee body persistence
* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering
* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions
* feat: enhance resource tracking with proxy method summaries and improve finding extraction
* feat: add terminal function exit detection for accurate resource leak analysis
* feat: add warnings for loops and functions without bodies to improve error recovery
* feat: update lambda expression handling to ensure proper function classification and control flow
* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling
* feat: add inline return taint analysis and regression tests for improved security checks
* feat: add engine version management and migration handling for database schema updates
* feat: enhance first_call_ident to skip nested function bodies and add regression tests
* feat: enhance callee name resolution with two-segment normalization and disambiguation
* feat: add cross-file context flags and debug assertions for taint analysis
* feat: refactor taint analysis structure to unify context handling and improve clarity
* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests
* docs: updated CHANGELOG.md
* fmt: formatting fixes
* fix: fixed frontend formatting and lint warnings
* fix: optimized ci
* fix: optimized ci
* Add comprehensive multi-file test coverage to Nyx (#38)
* Initial checklist for multi-file test suite expansion
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* deleted root repo
* rebuilt to test for regressions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* feat: enhance import alias resolution and taint tracking
* feat: implement security hardening with CSRF protection and path validation
* feat: add support for import alias bindings in Python, PHP, and Rust
* feat: enhance CFG analysis modes and improve code readability
* feat: add detection for parameterized SQL queries to enhance security
* feat: add safe internal redirect handling and enhance session destroy validation
* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads
* feat: enhance taint detection by adding support for inline source member expressions in call arguments
* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments
* feat: add support for Throw statement in control flow and error handling
* feat: add debug and echo endpoints with potential information leakage
* feat: implement internal redirect suppression and enhance taint detection
* feat: implement module alias tracking for dynamic dispatch in JS/TS
* feat: add authorization analysis module with Express support
* feat: add authorization analysis module with Express support
* feat: add tests for admin guard requirements and clean checks in authorization analysis
* feat: integrate Koa and Fastify frameworks into authorization analysis
* feat: add Flask and Django support to authorization analysis module
* feat: add support for Rails and Sinatra frameworks in authorization analysis
* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis
* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis
* feat: add support for Rails and Sinatra in authorization analysis
* chore: add .DS_Store to .gitignore
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: update usage of Option methods for improved clarity and consistency
* refactor: improve code readability by simplifying conditional checks and formatting
* refactor: improve code formatting and readability by simplifying conditional checks
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: simplify conditional checks in axum.rs for improved readability
* feat: add CodeQL analysis configuration for enhanced security scanning
* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)
* chore: start test coverage improvement work
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* test: add comprehensive tests for src/output.rs SARIF builder
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* refactor: improve code formatting and readability in output.rs
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* refactor: improve code formatting and readability in output.rs
* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* refactor: enhance triage file path handling with improved error management and validation
* refactor: updated func summaries for richer detail
* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries
* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution
* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls
* refactor: implement new Flask routes for safe and unsafe shell command execution
* refactor: separate receiver handling in SSA operations and enhance taint propagation
* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments
* refactor: implement auth decorator extraction and classification for multiple languages
* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation
* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic
* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior
* refactor: standardize default struct initialization across multiple files
* feat: add scripts for formatting checks and auto-fixes with test summaries
* refactor: simplify character splitting and enhance namespace qualifier handling
* refactor: improve documentation clarity and enhance code readability in resolver logic
* refactor: replace default struct initialization with explicit field assignments for clarity
* feat: enhance anonymous function naming by deriving context-based bindings
* refactor: streamline match expressions for improved readability and performance
* refactor: streamline match expressions for improved readability and performance
* refactor: replace loop with while let for improved clarity and performance
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis
* feat: add static map analysis for command injection suppression and type safety
* refactor: simplify match statements and reduce line breaks for improved readability
* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution
Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.
Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.
Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.
Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.
Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding
Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet. SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.
Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.
Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`. `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters. Dedup key extended with the primary location
so multi-site events aren't collapsed back together.
Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
!= ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
non-empty `file_rel` — the cap-only → None translation upstream
guarantees this.
Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved. A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.
build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.
Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing). All 1566 lib
tests + integration tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(output): phase 3/5 consume primary sink location in diag + SARIF
When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.
Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
resolved back to an absolute path via a shared resolve_file_rel
helper. Empty file_rel (single-file scans where namespace == "")
resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
locations[0] already reflects the primary sink position via the
updated diag line/col.
Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.
Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
inside the closure).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(bench): phase 4/5 validate primary sink attribution across corpus
Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.
Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
Case. When present, score_location_level additionally requires at
least one flow_step in the finding's evidence trace to fall within
±2 of the call-site range. When absent, the check is skipped —
fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
now-primary Diag.line post-phase-3).
Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
transform::wrap call site (a cross-file propagator, not a sink);
line 9 is Command::new, the real sink. The ±2 tolerance happened to
mask this stale attribution but it was semantically wrong — phase 4
is the right time to correct it. Also adds expected_call_site_lines
[8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
This fixture's sink (Command::new inside run_cmd at line 5) was the
motivating case for phases 1-3; adding the call-site assertion
guards against regression to caller-line attribution.
New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
takes two tainted params and invokes two Command sinks on
consecutive lines. Locks in that primary line lands inside the
helper (lines 5-6), not at the caller (line 12). Notes document
that SinkSite is currently one-per-callee so both findings today
collapse onto the first sink; expected_sink_lines=[5,6] and
expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
004): sink os.system lives in helper.py (cross-file), caller in
app.py reads env source and calls run_cmd. Verifies phase 3's
cross-file primary attribution: Diag.path = helper.py, Diag.line =
5, with app.py:7 recorded in flow_steps as a Call step.
Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test
Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body. Asserts the
resulting Finding.primary_location is exactly that triple.
The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file. This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.
Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).
Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: clean up formatting and improve readability in multiple files
* refactor: simplify type definition for deduplication key in findings
* test(harness): add must_not_match expectation for FP regression guards
Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules
* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking
* feat: update switch statement handling to improve control flow analysis
* feat: implement promisify alias handling for JS/TS to enhance taint tracking
* feat: enhance taint tracking by refining expectation handling and adding mode filtering
* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters
* feat: update taint tracking rules to enforce full mode matching and improve flow analysis
* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis
* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding
* feat: refine framework detection and update expectation handling for Echo and Sinatra
* feat: implement max_count for taint tracking expectations and deduplicate findings
* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files
* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity
* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files
* feat: add structural invariant checks for SSA bodies
* feat: ensure deterministic phi emission order using BTreeSet
* feat: enhance handling of terminators to ensure authoritative flow through successor edges
* feat: enhance Goto terminator handling to ensure all successors are marked executable
* feat: refactor code for improved readability and organization
* feat: simplify predicate checks and enhance readability in SSA handling
* feat: implement per-file parse timeout and enhance file size handling
* feat: migrate analysis engine toggles from environment variables to configuration file
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: update dependencies and enhance documentation on language maturity
* feat: enhance security headers and improve request body limits
* feat: implement sink capability bits for deduplication and enhance evidence tagging
* feat: implement dynamic activation handling for gated sinks and enhance validation logic
* feat: enhance configuration documentation and clarify inline analysis cache behavior
* feat: implement panic recovery during analysis to continue scans past errors
* feat: add expectations configuration for taint analysis and performance metrics
* feat: enhance error handling and logging during file reading and mutex locking
* feat: add cross-file body loading tests and plumbing for CF-1 phase
* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures
* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality
* feat: enhance classification span handling in CFG and AST for improved source attribution
* feat: add new Express routes for handling user input and telemetry data
* feat: implement ternary expression handling in CFG with diamond structure for JS/TS
* feat: implement Phase CF-3 abstract-domain transfer channels in summaries
* feat: add support for string-prefix transfer in cross-file calls and update tests
* docs: reduce RESULTS.md doc size
* feat: implement Phase CF-4 per-return-path summary decomposition with tests
* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization
* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests
* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests
* refactor: update comments and documentation for clarity and consistency
* style: format code for consistency and readability
* refactor: simplify verdict handling and improve edge checking logic
* refactor: optimize path and identifier collection by avoiding unnecessary cloning
* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults
* refactor: update documentation and improve clarity in configuration files
* refactor: update documentation and improve clarity in configuration files
* feat: add JS/TS pass-2 convergence tests and expectations configuration
* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic
* feat: implement Phase 7 deduplication and alternative path linking for taint findings
* feat: implement structural DFS index for anonymous functions and update naming conventions
* feat: add Phase 8 regression tests for container-element taint in JS and Python
* feat: add engine-depth profiles and explain-engine option for CLI
* feat: update expectations and add new README fixtures for multi-file scan regression
* feat: implement Phase 11 callback-alias and factory patterns with regression tests
* feat: implement Terminator::Switch for multi-way dispatch and add regression tests
* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants
* refactor: extract cfg and ssa_transfer to submodules
* refactor: cargo fmt
* refactor: remove unnecessary blank line in cfg_tests.rs
* refactor: remove unnecessary planning file
* chore: update Rust version to 1.88 and bump dependencies in Cargo files
* feat: enhance triage UI with new layout and controls, update README for clarity
* feat: enhance triage UI with new layout and controls, update README for clarity
* chore: remove outdated section from README for version 0.5.0
* docs: improve clarity and consistency in README content
* chore: add "GPL-3.0-or-later" to license options in about.toml
* chore: update license handling in about.toml and check-licenses.mjs
* style: format code for improved readability in TriagePage component
* style: format code for improved readability in TriagePage component
* chore: enhance license handling and improve body_id scoping in seed lookup
* feat: introduce owner and parent body IDs for enhanced seed scoping
* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating
* feat: add Undef SSA operation for improved control-flow handling
* style: improve code formatting for consistency and readability in multiple files
* feat: add 16-function chain SCC across multiple files for enhanced analysis
* style: simplify code formatting for improved readability in multiple files
* fix: update CapHitReason default implementation and improve README clarity
* docs: enhance README with detailed explanations of taint analysis and limitations
* docs: refine README for clarity and consistency in taint analysis section
* style: improve code formatting for better readability in NewScanModal and scans
* fix: update cargo-about command to use --offline for deterministic license generation
* fix: update cargo-about command to use --offline for deterministic license generation
* ci: add step to prime cargo registry cache for deterministic license generation
* feat: add support for non-sink collections in authorization analysis
* feat: enhance authorization checks with row-level ownership equality and binding tracking
* feat: implement self-scoped user handling and enhance ownership checks
* refactor: simplify assertions and formatting in authorization analysis tests
* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure
* docs: update AI disclosure section for clarity and conciseness
* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure
* feat: enhance authorization analysis with SSA-derived variable type classification
* feat: implement auth_finding_to_diag function for enhanced security diagnostics
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag
* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks
* feat: enhance error message handling in cli_validation_tests for better Windows compatibility
* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration
* feat: enhance release build process with SBOM generation and SLSA provenance
* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: update benchmark data and enhance path sanitization logic with new safety checks
* feat: document AI assistance in frontend UI development and human review process
* feat: add return path facts for enhanced path safety checks and update documentation
* chore: update release date for version 0.5.0 in CHANGELOG.md
* chore: clean up ci.yml by removing outdated comments and clarifying steps
* feat: implement cross-language path sanitizers and validators for enhanced security
* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks
* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases
* refactor: simplify conditional formatting and improve code readability in executor and lower modules
* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests
* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs
---------
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-25 17:59:11 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/// Maximum bytes to read from each manifest file.
|
|
|
|
|
const MANIFEST_READ_LIMIT: usize = 64 * 1024;
|
|
|
|
|
|
|
|
|
|
/// Read up to `MANIFEST_READ_LIMIT` bytes from a file.
|
|
|
|
|
fn read_bounded(path: &Path) -> Option<String> {
|
|
|
|
|
let file = fs::File::open(path).ok()?;
|
|
|
|
|
let mut reader = std::io::BufReader::new(file).take(MANIFEST_READ_LIMIT as u64);
|
|
|
|
|
let mut out = String::new();
|
|
|
|
|
reader.read_to_string(&mut out).ok()?;
|
|
|
|
|
Some(out)
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/// Scan file source bytes for import statements referencing known web
|
|
|
|
|
/// frameworks. Used to augment the project-level [`FrameworkContext`] with
|
|
|
|
|
/// per-file signals, so that single-file scans (no package.json / go.mod /
|
|
|
|
|
/// Gemfile nearby) still trigger framework-conditional rules.
|
|
|
|
|
///
|
|
|
|
|
/// Intentionally a coarse byte-level substring check against the quoted module
|
|
|
|
|
/// specifier (e.g. `'fastify'`, `"github.com/labstack/echo/v4"`,
|
2026-04-29 19:53:34 -04:00
|
|
|
/// `'sinatra'`). Only the first 8 KiB of the file are inspected, imports /
|
Release/0.5.0 (#35)
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures
* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests
* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements
* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles
* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing
* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling
* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures
* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration
* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests
* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic
* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection
* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements
* feat: Enable auth-state analysis by default and update relevant tests in benchmark config
* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test
* docs: update CHANGELOG.md
* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers
* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers
* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse
* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation
* feat: Refactor function parameters and constants for improved clarity and maintainability
* refactor: Reorder module imports and improve formatting for consistency
* refactor: Fix formatting erorrs
* refactor: Fix clippy warnings
* refactor: Fix fmt warnings (again)
* chore: Update dependencies and improve feature configuration
* Add comprehensive tests for undertested modules (#36) (COPILOT)
* Add comprehensive tests for undertested modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
* Add comprehensive tests for ext, project, walk, and errors modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: Update dependencies and improve feature configuration
* fix: formatting errors in new tests
* chore: Update license list in about.toml
* chore: made functions input inline
* chore: updated cfg graph to take up the full page
* chore: add Prettier configuration and update code formatting
* Add frontend test suite with Vitest (111 tests) (#37)
* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7
* ci: add frontend test step to CI workflow
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: simplify array initialization in test files for consistency
* ran typecheck
* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage
* feat: update routing in AppLayout and improve empty state message in ExplorerPage
* feat: enhance scan progress tracking with additional metrics and stages
* feat: update license information and add license check script
* feat: implement cross-file symbolic execution with callee body persistence
* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering
* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions
* feat: enhance resource tracking with proxy method summaries and improve finding extraction
* feat: add terminal function exit detection for accurate resource leak analysis
* feat: add warnings for loops and functions without bodies to improve error recovery
* feat: update lambda expression handling to ensure proper function classification and control flow
* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling
* feat: add inline return taint analysis and regression tests for improved security checks
* feat: add engine version management and migration handling for database schema updates
* feat: enhance first_call_ident to skip nested function bodies and add regression tests
* feat: enhance callee name resolution with two-segment normalization and disambiguation
* feat: add cross-file context flags and debug assertions for taint analysis
* feat: refactor taint analysis structure to unify context handling and improve clarity
* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests
* docs: updated CHANGELOG.md
* fmt: formatting fixes
* fix: fixed frontend formatting and lint warnings
* fix: optimized ci
* fix: optimized ci
* Add comprehensive multi-file test coverage to Nyx (#38)
* Initial checklist for multi-file test suite expansion
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* deleted root repo
* rebuilt to test for regressions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* feat: enhance import alias resolution and taint tracking
* feat: implement security hardening with CSRF protection and path validation
* feat: add support for import alias bindings in Python, PHP, and Rust
* feat: enhance CFG analysis modes and improve code readability
* feat: add detection for parameterized SQL queries to enhance security
* feat: add safe internal redirect handling and enhance session destroy validation
* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads
* feat: enhance taint detection by adding support for inline source member expressions in call arguments
* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments
* feat: add support for Throw statement in control flow and error handling
* feat: add debug and echo endpoints with potential information leakage
* feat: implement internal redirect suppression and enhance taint detection
* feat: implement module alias tracking for dynamic dispatch in JS/TS
* feat: add authorization analysis module with Express support
* feat: add authorization analysis module with Express support
* feat: add tests for admin guard requirements and clean checks in authorization analysis
* feat: integrate Koa and Fastify frameworks into authorization analysis
* feat: add Flask and Django support to authorization analysis module
* feat: add support for Rails and Sinatra frameworks in authorization analysis
* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis
* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis
* feat: add support for Rails and Sinatra in authorization analysis
* chore: add .DS_Store to .gitignore
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: update usage of Option methods for improved clarity and consistency
* refactor: improve code readability by simplifying conditional checks and formatting
* refactor: improve code formatting and readability by simplifying conditional checks
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: simplify conditional checks in axum.rs for improved readability
* feat: add CodeQL analysis configuration for enhanced security scanning
* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)
* chore: start test coverage improvement work
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* test: add comprehensive tests for src/output.rs SARIF builder
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* refactor: improve code formatting and readability in output.rs
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* refactor: improve code formatting and readability in output.rs
* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* refactor: enhance triage file path handling with improved error management and validation
* refactor: updated func summaries for richer detail
* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries
* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution
* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls
* refactor: implement new Flask routes for safe and unsafe shell command execution
* refactor: separate receiver handling in SSA operations and enhance taint propagation
* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments
* refactor: implement auth decorator extraction and classification for multiple languages
* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation
* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic
* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior
* refactor: standardize default struct initialization across multiple files
* feat: add scripts for formatting checks and auto-fixes with test summaries
* refactor: simplify character splitting and enhance namespace qualifier handling
* refactor: improve documentation clarity and enhance code readability in resolver logic
* refactor: replace default struct initialization with explicit field assignments for clarity
* feat: enhance anonymous function naming by deriving context-based bindings
* refactor: streamline match expressions for improved readability and performance
* refactor: streamline match expressions for improved readability and performance
* refactor: replace loop with while let for improved clarity and performance
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis
* feat: add static map analysis for command injection suppression and type safety
* refactor: simplify match statements and reduce line breaks for improved readability
* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution
Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.
Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.
Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.
Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.
Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding
Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet. SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.
Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.
Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`. `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters. Dedup key extended with the primary location
so multi-site events aren't collapsed back together.
Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
!= ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
non-empty `file_rel` — the cap-only → None translation upstream
guarantees this.
Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved. A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.
build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.
Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing). All 1566 lib
tests + integration tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(output): phase 3/5 consume primary sink location in diag + SARIF
When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.
Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
resolved back to an absolute path via a shared resolve_file_rel
helper. Empty file_rel (single-file scans where namespace == "")
resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
locations[0] already reflects the primary sink position via the
updated diag line/col.
Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.
Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
inside the closure).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(bench): phase 4/5 validate primary sink attribution across corpus
Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.
Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
Case. When present, score_location_level additionally requires at
least one flow_step in the finding's evidence trace to fall within
±2 of the call-site range. When absent, the check is skipped —
fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
now-primary Diag.line post-phase-3).
Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
transform::wrap call site (a cross-file propagator, not a sink);
line 9 is Command::new, the real sink. The ±2 tolerance happened to
mask this stale attribution but it was semantically wrong — phase 4
is the right time to correct it. Also adds expected_call_site_lines
[8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
This fixture's sink (Command::new inside run_cmd at line 5) was the
motivating case for phases 1-3; adding the call-site assertion
guards against regression to caller-line attribution.
New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
takes two tainted params and invokes two Command sinks on
consecutive lines. Locks in that primary line lands inside the
helper (lines 5-6), not at the caller (line 12). Notes document
that SinkSite is currently one-per-callee so both findings today
collapse onto the first sink; expected_sink_lines=[5,6] and
expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
004): sink os.system lives in helper.py (cross-file), caller in
app.py reads env source and calls run_cmd. Verifies phase 3's
cross-file primary attribution: Diag.path = helper.py, Diag.line =
5, with app.py:7 recorded in flow_steps as a Call step.
Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test
Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body. Asserts the
resulting Finding.primary_location is exactly that triple.
The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file. This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.
Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).
Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: clean up formatting and improve readability in multiple files
* refactor: simplify type definition for deduplication key in findings
* test(harness): add must_not_match expectation for FP regression guards
Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules
* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking
* feat: update switch statement handling to improve control flow analysis
* feat: implement promisify alias handling for JS/TS to enhance taint tracking
* feat: enhance taint tracking by refining expectation handling and adding mode filtering
* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters
* feat: update taint tracking rules to enforce full mode matching and improve flow analysis
* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis
* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding
* feat: refine framework detection and update expectation handling for Echo and Sinatra
* feat: implement max_count for taint tracking expectations and deduplicate findings
* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files
* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity
* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files
* feat: add structural invariant checks for SSA bodies
* feat: ensure deterministic phi emission order using BTreeSet
* feat: enhance handling of terminators to ensure authoritative flow through successor edges
* feat: enhance Goto terminator handling to ensure all successors are marked executable
* feat: refactor code for improved readability and organization
* feat: simplify predicate checks and enhance readability in SSA handling
* feat: implement per-file parse timeout and enhance file size handling
* feat: migrate analysis engine toggles from environment variables to configuration file
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: update dependencies and enhance documentation on language maturity
* feat: enhance security headers and improve request body limits
* feat: implement sink capability bits for deduplication and enhance evidence tagging
* feat: implement dynamic activation handling for gated sinks and enhance validation logic
* feat: enhance configuration documentation and clarify inline analysis cache behavior
* feat: implement panic recovery during analysis to continue scans past errors
* feat: add expectations configuration for taint analysis and performance metrics
* feat: enhance error handling and logging during file reading and mutex locking
* feat: add cross-file body loading tests and plumbing for CF-1 phase
* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures
* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality
* feat: enhance classification span handling in CFG and AST for improved source attribution
* feat: add new Express routes for handling user input and telemetry data
* feat: implement ternary expression handling in CFG with diamond structure for JS/TS
* feat: implement Phase CF-3 abstract-domain transfer channels in summaries
* feat: add support for string-prefix transfer in cross-file calls and update tests
* docs: reduce RESULTS.md doc size
* feat: implement Phase CF-4 per-return-path summary decomposition with tests
* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization
* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests
* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests
* refactor: update comments and documentation for clarity and consistency
* style: format code for consistency and readability
* refactor: simplify verdict handling and improve edge checking logic
* refactor: optimize path and identifier collection by avoiding unnecessary cloning
* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults
* refactor: update documentation and improve clarity in configuration files
* refactor: update documentation and improve clarity in configuration files
* feat: add JS/TS pass-2 convergence tests and expectations configuration
* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic
* feat: implement Phase 7 deduplication and alternative path linking for taint findings
* feat: implement structural DFS index for anonymous functions and update naming conventions
* feat: add Phase 8 regression tests for container-element taint in JS and Python
* feat: add engine-depth profiles and explain-engine option for CLI
* feat: update expectations and add new README fixtures for multi-file scan regression
* feat: implement Phase 11 callback-alias and factory patterns with regression tests
* feat: implement Terminator::Switch for multi-way dispatch and add regression tests
* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants
* refactor: extract cfg and ssa_transfer to submodules
* refactor: cargo fmt
* refactor: remove unnecessary blank line in cfg_tests.rs
* refactor: remove unnecessary planning file
* chore: update Rust version to 1.88 and bump dependencies in Cargo files
* feat: enhance triage UI with new layout and controls, update README for clarity
* feat: enhance triage UI with new layout and controls, update README for clarity
* chore: remove outdated section from README for version 0.5.0
* docs: improve clarity and consistency in README content
* chore: add "GPL-3.0-or-later" to license options in about.toml
* chore: update license handling in about.toml and check-licenses.mjs
* style: format code for improved readability in TriagePage component
* style: format code for improved readability in TriagePage component
* chore: enhance license handling and improve body_id scoping in seed lookup
* feat: introduce owner and parent body IDs for enhanced seed scoping
* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating
* feat: add Undef SSA operation for improved control-flow handling
* style: improve code formatting for consistency and readability in multiple files
* feat: add 16-function chain SCC across multiple files for enhanced analysis
* style: simplify code formatting for improved readability in multiple files
* fix: update CapHitReason default implementation and improve README clarity
* docs: enhance README with detailed explanations of taint analysis and limitations
* docs: refine README for clarity and consistency in taint analysis section
* style: improve code formatting for better readability in NewScanModal and scans
* fix: update cargo-about command to use --offline for deterministic license generation
* fix: update cargo-about command to use --offline for deterministic license generation
* ci: add step to prime cargo registry cache for deterministic license generation
* feat: add support for non-sink collections in authorization analysis
* feat: enhance authorization checks with row-level ownership equality and binding tracking
* feat: implement self-scoped user handling and enhance ownership checks
* refactor: simplify assertions and formatting in authorization analysis tests
* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure
* docs: update AI disclosure section for clarity and conciseness
* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure
* feat: enhance authorization analysis with SSA-derived variable type classification
* feat: implement auth_finding_to_diag function for enhanced security diagnostics
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag
* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks
* feat: enhance error message handling in cli_validation_tests for better Windows compatibility
* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration
* feat: enhance release build process with SBOM generation and SLSA provenance
* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: update benchmark data and enhance path sanitization logic with new safety checks
* feat: document AI assistance in frontend UI development and human review process
* feat: add return path facts for enhanced path safety checks and update documentation
* chore: update release date for version 0.5.0 in CHANGELOG.md
* chore: clean up ci.yml by removing outdated comments and clarifying steps
* feat: implement cross-language path sanitizers and validators for enhanced security
* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks
* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases
* refactor: simplify conditional formatting and improve code readability in executor and lower modules
* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests
* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs
---------
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-25 17:59:11 -04:00
|
|
|
/// requires live at the top. Returns an empty list for languages without a
|
|
|
|
|
/// framework detection policy here.
|
|
|
|
|
pub fn detect_in_file_frameworks(bytes: &[u8], lang_slug: &str) -> Vec<DetectedFramework> {
|
|
|
|
|
let head_len = bytes.len().min(8 * 1024);
|
|
|
|
|
let head = match std::str::from_utf8(&bytes[..head_len]) {
|
|
|
|
|
Ok(s) => s,
|
|
|
|
|
Err(_) => return Vec::new(),
|
|
|
|
|
};
|
|
|
|
|
let matches_module = |name: &str| {
|
|
|
|
|
// Quoted single or double, as appears in `from 'fastify'` /
|
|
|
|
|
// `require("fastify")` / `import('fastify')` / `require 'sinatra'`.
|
|
|
|
|
head.contains(&format!("'{name}'")) || head.contains(&format!("\"{name}\""))
|
|
|
|
|
};
|
|
|
|
|
let mut fws = Vec::new();
|
|
|
|
|
match lang_slug {
|
|
|
|
|
"javascript" | "typescript" | "js" | "ts" => {
|
|
|
|
|
if matches_module("fastify") {
|
|
|
|
|
fws.push(DetectedFramework::Fastify);
|
|
|
|
|
}
|
|
|
|
|
if matches_module("express") {
|
|
|
|
|
fws.push(DetectedFramework::Express);
|
|
|
|
|
}
|
|
|
|
|
if matches_module("koa")
|
|
|
|
|
|| matches_module("@koa/router")
|
|
|
|
|
|| matches_module("koa-router")
|
|
|
|
|
{
|
|
|
|
|
fws.push(DetectedFramework::Koa);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
"go" => {
|
|
|
|
|
// Go imports are quoted module paths. Match a distinctive prefix
|
|
|
|
|
// so any major version (`/v3`, `/v4`, …) still detects.
|
|
|
|
|
if head.contains("\"github.com/labstack/echo") {
|
|
|
|
|
fws.push(DetectedFramework::Echo);
|
|
|
|
|
}
|
|
|
|
|
if head.contains("\"github.com/gin-gonic/gin\"") {
|
|
|
|
|
fws.push(DetectedFramework::Gin);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
"ruby" | "rb" => {
|
|
|
|
|
// Ruby requires: `require 'sinatra'` or `require 'sinatra/base'`.
|
|
|
|
|
if matches_module("sinatra") || matches_module("sinatra/base") {
|
|
|
|
|
fws.push(DetectedFramework::Sinatra);
|
|
|
|
|
}
|
|
|
|
|
// Rails apps don't always `require 'rails'` directly (they load
|
|
|
|
|
// via config/boot.rb), but when they do, surface it.
|
|
|
|
|
if matches_module("rails") || matches_module("rails/all") {
|
|
|
|
|
fws.push(DetectedFramework::Rails);
|
|
|
|
|
}
|
|
|
|
|
}
|
2026-05-02 16:44:49 -04:00
|
|
|
// Rust is intentionally not handled here — adding axum / actix_web
|
|
|
|
|
// / rocket detection here would also flip framework-conditional
|
|
|
|
|
// *label* rules on for files in workspaces whose root Cargo.toml
|
|
|
|
|
// doesn't list the crate (e.g. meilisearch's root, which carries
|
|
|
|
|
// actix-web only in subcrates), and the existing actix label set
|
|
|
|
|
// marks `HttpResponse.json` as a `Cap::HTML_ESCAPE` sink ─ a
|
|
|
|
|
// pattern that fires on every actix route that echoes a path
|
|
|
|
|
// parameter back to the client (legitimate behavior, not XSS).
|
|
|
|
|
//
|
|
|
|
|
// The auth-analysis path uses `auth_analysis::extract`'s own
|
|
|
|
|
// per-file Rust check (see `compute_web_framework_signal`) so the
|
|
|
|
|
// signal is available without touching the label augmentation.
|
Release/0.5.0 (#35)
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures
* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests
* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements
* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles
* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing
* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling
* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures
* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration
* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests
* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic
* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection
* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements
* feat: Enable auth-state analysis by default and update relevant tests in benchmark config
* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test
* docs: update CHANGELOG.md
* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers
* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers
* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse
* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation
* feat: Refactor function parameters and constants for improved clarity and maintainability
* refactor: Reorder module imports and improve formatting for consistency
* refactor: Fix formatting erorrs
* refactor: Fix clippy warnings
* refactor: Fix fmt warnings (again)
* chore: Update dependencies and improve feature configuration
* Add comprehensive tests for undertested modules (#36) (COPILOT)
* Add comprehensive tests for undertested modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
* Add comprehensive tests for ext, project, walk, and errors modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: Update dependencies and improve feature configuration
* fix: formatting errors in new tests
* chore: Update license list in about.toml
* chore: made functions input inline
* chore: updated cfg graph to take up the full page
* chore: add Prettier configuration and update code formatting
* Add frontend test suite with Vitest (111 tests) (#37)
* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7
* ci: add frontend test step to CI workflow
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: simplify array initialization in test files for consistency
* ran typecheck
* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage
* feat: update routing in AppLayout and improve empty state message in ExplorerPage
* feat: enhance scan progress tracking with additional metrics and stages
* feat: update license information and add license check script
* feat: implement cross-file symbolic execution with callee body persistence
* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering
* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions
* feat: enhance resource tracking with proxy method summaries and improve finding extraction
* feat: add terminal function exit detection for accurate resource leak analysis
* feat: add warnings for loops and functions without bodies to improve error recovery
* feat: update lambda expression handling to ensure proper function classification and control flow
* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling
* feat: add inline return taint analysis and regression tests for improved security checks
* feat: add engine version management and migration handling for database schema updates
* feat: enhance first_call_ident to skip nested function bodies and add regression tests
* feat: enhance callee name resolution with two-segment normalization and disambiguation
* feat: add cross-file context flags and debug assertions for taint analysis
* feat: refactor taint analysis structure to unify context handling and improve clarity
* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests
* docs: updated CHANGELOG.md
* fmt: formatting fixes
* fix: fixed frontend formatting and lint warnings
* fix: optimized ci
* fix: optimized ci
* Add comprehensive multi-file test coverage to Nyx (#38)
* Initial checklist for multi-file test suite expansion
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* deleted root repo
* rebuilt to test for regressions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* feat: enhance import alias resolution and taint tracking
* feat: implement security hardening with CSRF protection and path validation
* feat: add support for import alias bindings in Python, PHP, and Rust
* feat: enhance CFG analysis modes and improve code readability
* feat: add detection for parameterized SQL queries to enhance security
* feat: add safe internal redirect handling and enhance session destroy validation
* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads
* feat: enhance taint detection by adding support for inline source member expressions in call arguments
* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments
* feat: add support for Throw statement in control flow and error handling
* feat: add debug and echo endpoints with potential information leakage
* feat: implement internal redirect suppression and enhance taint detection
* feat: implement module alias tracking for dynamic dispatch in JS/TS
* feat: add authorization analysis module with Express support
* feat: add authorization analysis module with Express support
* feat: add tests for admin guard requirements and clean checks in authorization analysis
* feat: integrate Koa and Fastify frameworks into authorization analysis
* feat: add Flask and Django support to authorization analysis module
* feat: add support for Rails and Sinatra frameworks in authorization analysis
* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis
* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis
* feat: add support for Rails and Sinatra in authorization analysis
* chore: add .DS_Store to .gitignore
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: update usage of Option methods for improved clarity and consistency
* refactor: improve code readability by simplifying conditional checks and formatting
* refactor: improve code formatting and readability by simplifying conditional checks
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: simplify conditional checks in axum.rs for improved readability
* feat: add CodeQL analysis configuration for enhanced security scanning
* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)
* chore: start test coverage improvement work
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* test: add comprehensive tests for src/output.rs SARIF builder
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* refactor: improve code formatting and readability in output.rs
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* refactor: improve code formatting and readability in output.rs
* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* refactor: enhance triage file path handling with improved error management and validation
* refactor: updated func summaries for richer detail
* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries
* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution
* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls
* refactor: implement new Flask routes for safe and unsafe shell command execution
* refactor: separate receiver handling in SSA operations and enhance taint propagation
* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments
* refactor: implement auth decorator extraction and classification for multiple languages
* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation
* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic
* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior
* refactor: standardize default struct initialization across multiple files
* feat: add scripts for formatting checks and auto-fixes with test summaries
* refactor: simplify character splitting and enhance namespace qualifier handling
* refactor: improve documentation clarity and enhance code readability in resolver logic
* refactor: replace default struct initialization with explicit field assignments for clarity
* feat: enhance anonymous function naming by deriving context-based bindings
* refactor: streamline match expressions for improved readability and performance
* refactor: streamline match expressions for improved readability and performance
* refactor: replace loop with while let for improved clarity and performance
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis
* feat: add static map analysis for command injection suppression and type safety
* refactor: simplify match statements and reduce line breaks for improved readability
* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution
Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.
Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.
Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.
Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.
Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding
Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet. SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.
Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.
Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`. `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters. Dedup key extended with the primary location
so multi-site events aren't collapsed back together.
Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
!= ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
non-empty `file_rel` — the cap-only → None translation upstream
guarantees this.
Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved. A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.
build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.
Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing). All 1566 lib
tests + integration tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(output): phase 3/5 consume primary sink location in diag + SARIF
When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.
Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
resolved back to an absolute path via a shared resolve_file_rel
helper. Empty file_rel (single-file scans where namespace == "")
resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
locations[0] already reflects the primary sink position via the
updated diag line/col.
Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.
Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
inside the closure).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(bench): phase 4/5 validate primary sink attribution across corpus
Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.
Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
Case. When present, score_location_level additionally requires at
least one flow_step in the finding's evidence trace to fall within
±2 of the call-site range. When absent, the check is skipped —
fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
now-primary Diag.line post-phase-3).
Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
transform::wrap call site (a cross-file propagator, not a sink);
line 9 is Command::new, the real sink. The ±2 tolerance happened to
mask this stale attribution but it was semantically wrong — phase 4
is the right time to correct it. Also adds expected_call_site_lines
[8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
This fixture's sink (Command::new inside run_cmd at line 5) was the
motivating case for phases 1-3; adding the call-site assertion
guards against regression to caller-line attribution.
New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
takes two tainted params and invokes two Command sinks on
consecutive lines. Locks in that primary line lands inside the
helper (lines 5-6), not at the caller (line 12). Notes document
that SinkSite is currently one-per-callee so both findings today
collapse onto the first sink; expected_sink_lines=[5,6] and
expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
004): sink os.system lives in helper.py (cross-file), caller in
app.py reads env source and calls run_cmd. Verifies phase 3's
cross-file primary attribution: Diag.path = helper.py, Diag.line =
5, with app.py:7 recorded in flow_steps as a Call step.
Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test
Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body. Asserts the
resulting Finding.primary_location is exactly that triple.
The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file. This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.
Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).
Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: clean up formatting and improve readability in multiple files
* refactor: simplify type definition for deduplication key in findings
* test(harness): add must_not_match expectation for FP regression guards
Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules
* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking
* feat: update switch statement handling to improve control flow analysis
* feat: implement promisify alias handling for JS/TS to enhance taint tracking
* feat: enhance taint tracking by refining expectation handling and adding mode filtering
* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters
* feat: update taint tracking rules to enforce full mode matching and improve flow analysis
* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis
* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding
* feat: refine framework detection and update expectation handling for Echo and Sinatra
* feat: implement max_count for taint tracking expectations and deduplicate findings
* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files
* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity
* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files
* feat: add structural invariant checks for SSA bodies
* feat: ensure deterministic phi emission order using BTreeSet
* feat: enhance handling of terminators to ensure authoritative flow through successor edges
* feat: enhance Goto terminator handling to ensure all successors are marked executable
* feat: refactor code for improved readability and organization
* feat: simplify predicate checks and enhance readability in SSA handling
* feat: implement per-file parse timeout and enhance file size handling
* feat: migrate analysis engine toggles from environment variables to configuration file
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: update dependencies and enhance documentation on language maturity
* feat: enhance security headers and improve request body limits
* feat: implement sink capability bits for deduplication and enhance evidence tagging
* feat: implement dynamic activation handling for gated sinks and enhance validation logic
* feat: enhance configuration documentation and clarify inline analysis cache behavior
* feat: implement panic recovery during analysis to continue scans past errors
* feat: add expectations configuration for taint analysis and performance metrics
* feat: enhance error handling and logging during file reading and mutex locking
* feat: add cross-file body loading tests and plumbing for CF-1 phase
* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures
* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality
* feat: enhance classification span handling in CFG and AST for improved source attribution
* feat: add new Express routes for handling user input and telemetry data
* feat: implement ternary expression handling in CFG with diamond structure for JS/TS
* feat: implement Phase CF-3 abstract-domain transfer channels in summaries
* feat: add support for string-prefix transfer in cross-file calls and update tests
* docs: reduce RESULTS.md doc size
* feat: implement Phase CF-4 per-return-path summary decomposition with tests
* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization
* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests
* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests
* refactor: update comments and documentation for clarity and consistency
* style: format code for consistency and readability
* refactor: simplify verdict handling and improve edge checking logic
* refactor: optimize path and identifier collection by avoiding unnecessary cloning
* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults
* refactor: update documentation and improve clarity in configuration files
* refactor: update documentation and improve clarity in configuration files
* feat: add JS/TS pass-2 convergence tests and expectations configuration
* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic
* feat: implement Phase 7 deduplication and alternative path linking for taint findings
* feat: implement structural DFS index for anonymous functions and update naming conventions
* feat: add Phase 8 regression tests for container-element taint in JS and Python
* feat: add engine-depth profiles and explain-engine option for CLI
* feat: update expectations and add new README fixtures for multi-file scan regression
* feat: implement Phase 11 callback-alias and factory patterns with regression tests
* feat: implement Terminator::Switch for multi-way dispatch and add regression tests
* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants
* refactor: extract cfg and ssa_transfer to submodules
* refactor: cargo fmt
* refactor: remove unnecessary blank line in cfg_tests.rs
* refactor: remove unnecessary planning file
* chore: update Rust version to 1.88 and bump dependencies in Cargo files
* feat: enhance triage UI with new layout and controls, update README for clarity
* feat: enhance triage UI with new layout and controls, update README for clarity
* chore: remove outdated section from README for version 0.5.0
* docs: improve clarity and consistency in README content
* chore: add "GPL-3.0-or-later" to license options in about.toml
* chore: update license handling in about.toml and check-licenses.mjs
* style: format code for improved readability in TriagePage component
* style: format code for improved readability in TriagePage component
* chore: enhance license handling and improve body_id scoping in seed lookup
* feat: introduce owner and parent body IDs for enhanced seed scoping
* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating
* feat: add Undef SSA operation for improved control-flow handling
* style: improve code formatting for consistency and readability in multiple files
* feat: add 16-function chain SCC across multiple files for enhanced analysis
* style: simplify code formatting for improved readability in multiple files
* fix: update CapHitReason default implementation and improve README clarity
* docs: enhance README with detailed explanations of taint analysis and limitations
* docs: refine README for clarity and consistency in taint analysis section
* style: improve code formatting for better readability in NewScanModal and scans
* fix: update cargo-about command to use --offline for deterministic license generation
* fix: update cargo-about command to use --offline for deterministic license generation
* ci: add step to prime cargo registry cache for deterministic license generation
* feat: add support for non-sink collections in authorization analysis
* feat: enhance authorization checks with row-level ownership equality and binding tracking
* feat: implement self-scoped user handling and enhance ownership checks
* refactor: simplify assertions and formatting in authorization analysis tests
* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure
* docs: update AI disclosure section for clarity and conciseness
* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure
* feat: enhance authorization analysis with SSA-derived variable type classification
* feat: implement auth_finding_to_diag function for enhanced security diagnostics
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag
* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks
* feat: enhance error message handling in cli_validation_tests for better Windows compatibility
* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration
* feat: enhance release build process with SBOM generation and SLSA provenance
* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: update benchmark data and enhance path sanitization logic with new safety checks
* feat: document AI assistance in frontend UI development and human review process
* feat: add return path facts for enhanced path safety checks and update documentation
* chore: update release date for version 0.5.0 in CHANGELOG.md
* chore: clean up ci.yml by removing outdated comments and clarifying steps
* feat: implement cross-language path sanitizers and validators for enhanced security
* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks
* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases
* refactor: simplify conditional formatting and improve code readability in executor and lower modules
* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests
* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs
---------
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-25 17:59:11 -04:00
|
|
|
_ => {}
|
|
|
|
|
}
|
|
|
|
|
fws
|
|
|
|
|
}
|
|
|
|
|
|
2026-05-02 16:44:49 -04:00
|
|
|
/// Coarse per-file signal: does the file's leading byte range mention
|
|
|
|
|
/// at least one Rust web-framework symbol path (`axum::`, `actix_web::`,
|
|
|
|
|
/// `rocket::`)? Used by [`crate::auth_analysis::extract`] to gate the
|
|
|
|
|
/// `is_external_input_param_name` arm of `unit_has_user_input_evidence`
|
|
|
|
|
/// without affecting framework-conditional *label* rules.
|
|
|
|
|
///
|
|
|
|
|
/// Returns `false` for non-Rust source.
|
|
|
|
|
pub fn rust_file_imports_web_framework(bytes: &[u8]) -> bool {
|
|
|
|
|
let head_len = bytes.len().min(8 * 1024);
|
|
|
|
|
let head = match std::str::from_utf8(&bytes[..head_len]) {
|
|
|
|
|
Ok(s) => s,
|
|
|
|
|
Err(_) => return false,
|
|
|
|
|
};
|
|
|
|
|
head.contains("axum::")
|
|
|
|
|
|| head.contains("axum_extra::")
|
|
|
|
|
|| head.contains("actix_web::")
|
|
|
|
|
|| head.contains("rocket::")
|
|
|
|
|
}
|
|
|
|
|
|
Release/0.5.0 (#35)
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures
* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests
* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements
* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles
* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing
* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling
* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures
* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration
* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests
* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic
* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection
* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements
* feat: Enable auth-state analysis by default and update relevant tests in benchmark config
* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test
* docs: update CHANGELOG.md
* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers
* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers
* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse
* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation
* feat: Refactor function parameters and constants for improved clarity and maintainability
* refactor: Reorder module imports and improve formatting for consistency
* refactor: Fix formatting erorrs
* refactor: Fix clippy warnings
* refactor: Fix fmt warnings (again)
* chore: Update dependencies and improve feature configuration
* Add comprehensive tests for undertested modules (#36) (COPILOT)
* Add comprehensive tests for undertested modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
* Add comprehensive tests for ext, project, walk, and errors modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: Update dependencies and improve feature configuration
* fix: formatting errors in new tests
* chore: Update license list in about.toml
* chore: made functions input inline
* chore: updated cfg graph to take up the full page
* chore: add Prettier configuration and update code formatting
* Add frontend test suite with Vitest (111 tests) (#37)
* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7
* ci: add frontend test step to CI workflow
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: simplify array initialization in test files for consistency
* ran typecheck
* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage
* feat: update routing in AppLayout and improve empty state message in ExplorerPage
* feat: enhance scan progress tracking with additional metrics and stages
* feat: update license information and add license check script
* feat: implement cross-file symbolic execution with callee body persistence
* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering
* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions
* feat: enhance resource tracking with proxy method summaries and improve finding extraction
* feat: add terminal function exit detection for accurate resource leak analysis
* feat: add warnings for loops and functions without bodies to improve error recovery
* feat: update lambda expression handling to ensure proper function classification and control flow
* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling
* feat: add inline return taint analysis and regression tests for improved security checks
* feat: add engine version management and migration handling for database schema updates
* feat: enhance first_call_ident to skip nested function bodies and add regression tests
* feat: enhance callee name resolution with two-segment normalization and disambiguation
* feat: add cross-file context flags and debug assertions for taint analysis
* feat: refactor taint analysis structure to unify context handling and improve clarity
* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests
* docs: updated CHANGELOG.md
* fmt: formatting fixes
* fix: fixed frontend formatting and lint warnings
* fix: optimized ci
* fix: optimized ci
* Add comprehensive multi-file test coverage to Nyx (#38)
* Initial checklist for multi-file test suite expansion
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* deleted root repo
* rebuilt to test for regressions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* feat: enhance import alias resolution and taint tracking
* feat: implement security hardening with CSRF protection and path validation
* feat: add support for import alias bindings in Python, PHP, and Rust
* feat: enhance CFG analysis modes and improve code readability
* feat: add detection for parameterized SQL queries to enhance security
* feat: add safe internal redirect handling and enhance session destroy validation
* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads
* feat: enhance taint detection by adding support for inline source member expressions in call arguments
* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments
* feat: add support for Throw statement in control flow and error handling
* feat: add debug and echo endpoints with potential information leakage
* feat: implement internal redirect suppression and enhance taint detection
* feat: implement module alias tracking for dynamic dispatch in JS/TS
* feat: add authorization analysis module with Express support
* feat: add authorization analysis module with Express support
* feat: add tests for admin guard requirements and clean checks in authorization analysis
* feat: integrate Koa and Fastify frameworks into authorization analysis
* feat: add Flask and Django support to authorization analysis module
* feat: add support for Rails and Sinatra frameworks in authorization analysis
* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis
* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis
* feat: add support for Rails and Sinatra in authorization analysis
* chore: add .DS_Store to .gitignore
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: update usage of Option methods for improved clarity and consistency
* refactor: improve code readability by simplifying conditional checks and formatting
* refactor: improve code formatting and readability by simplifying conditional checks
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: simplify conditional checks in axum.rs for improved readability
* feat: add CodeQL analysis configuration for enhanced security scanning
* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)
* chore: start test coverage improvement work
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* test: add comprehensive tests for src/output.rs SARIF builder
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* refactor: improve code formatting and readability in output.rs
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* refactor: improve code formatting and readability in output.rs
* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* refactor: enhance triage file path handling with improved error management and validation
* refactor: updated func summaries for richer detail
* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries
* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution
* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls
* refactor: implement new Flask routes for safe and unsafe shell command execution
* refactor: separate receiver handling in SSA operations and enhance taint propagation
* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments
* refactor: implement auth decorator extraction and classification for multiple languages
* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation
* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic
* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior
* refactor: standardize default struct initialization across multiple files
* feat: add scripts for formatting checks and auto-fixes with test summaries
* refactor: simplify character splitting and enhance namespace qualifier handling
* refactor: improve documentation clarity and enhance code readability in resolver logic
* refactor: replace default struct initialization with explicit field assignments for clarity
* feat: enhance anonymous function naming by deriving context-based bindings
* refactor: streamline match expressions for improved readability and performance
* refactor: streamline match expressions for improved readability and performance
* refactor: replace loop with while let for improved clarity and performance
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis
* feat: add static map analysis for command injection suppression and type safety
* refactor: simplify match statements and reduce line breaks for improved readability
* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution
Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.
Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.
Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.
Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.
Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding
Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet. SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.
Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.
Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`. `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters. Dedup key extended with the primary location
so multi-site events aren't collapsed back together.
Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
!= ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
non-empty `file_rel` — the cap-only → None translation upstream
guarantees this.
Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved. A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.
build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.
Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing). All 1566 lib
tests + integration tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(output): phase 3/5 consume primary sink location in diag + SARIF
When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.
Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
resolved back to an absolute path via a shared resolve_file_rel
helper. Empty file_rel (single-file scans where namespace == "")
resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
locations[0] already reflects the primary sink position via the
updated diag line/col.
Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.
Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
inside the closure).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(bench): phase 4/5 validate primary sink attribution across corpus
Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.
Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
Case. When present, score_location_level additionally requires at
least one flow_step in the finding's evidence trace to fall within
±2 of the call-site range. When absent, the check is skipped —
fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
now-primary Diag.line post-phase-3).
Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
transform::wrap call site (a cross-file propagator, not a sink);
line 9 is Command::new, the real sink. The ±2 tolerance happened to
mask this stale attribution but it was semantically wrong — phase 4
is the right time to correct it. Also adds expected_call_site_lines
[8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
This fixture's sink (Command::new inside run_cmd at line 5) was the
motivating case for phases 1-3; adding the call-site assertion
guards against regression to caller-line attribution.
New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
takes two tainted params and invokes two Command sinks on
consecutive lines. Locks in that primary line lands inside the
helper (lines 5-6), not at the caller (line 12). Notes document
that SinkSite is currently one-per-callee so both findings today
collapse onto the first sink; expected_sink_lines=[5,6] and
expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
004): sink os.system lives in helper.py (cross-file), caller in
app.py reads env source and calls run_cmd. Verifies phase 3's
cross-file primary attribution: Diag.path = helper.py, Diag.line =
5, with app.py:7 recorded in flow_steps as a Call step.
Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test
Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body. Asserts the
resulting Finding.primary_location is exactly that triple.
The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file. This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.
Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).
Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: clean up formatting and improve readability in multiple files
* refactor: simplify type definition for deduplication key in findings
* test(harness): add must_not_match expectation for FP regression guards
Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules
* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking
* feat: update switch statement handling to improve control flow analysis
* feat: implement promisify alias handling for JS/TS to enhance taint tracking
* feat: enhance taint tracking by refining expectation handling and adding mode filtering
* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters
* feat: update taint tracking rules to enforce full mode matching and improve flow analysis
* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis
* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding
* feat: refine framework detection and update expectation handling for Echo and Sinatra
* feat: implement max_count for taint tracking expectations and deduplicate findings
* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files
* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity
* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files
* feat: add structural invariant checks for SSA bodies
* feat: ensure deterministic phi emission order using BTreeSet
* feat: enhance handling of terminators to ensure authoritative flow through successor edges
* feat: enhance Goto terminator handling to ensure all successors are marked executable
* feat: refactor code for improved readability and organization
* feat: simplify predicate checks and enhance readability in SSA handling
* feat: implement per-file parse timeout and enhance file size handling
* feat: migrate analysis engine toggles from environment variables to configuration file
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: update dependencies and enhance documentation on language maturity
* feat: enhance security headers and improve request body limits
* feat: implement sink capability bits for deduplication and enhance evidence tagging
* feat: implement dynamic activation handling for gated sinks and enhance validation logic
* feat: enhance configuration documentation and clarify inline analysis cache behavior
* feat: implement panic recovery during analysis to continue scans past errors
* feat: add expectations configuration for taint analysis and performance metrics
* feat: enhance error handling and logging during file reading and mutex locking
* feat: add cross-file body loading tests and plumbing for CF-1 phase
* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures
* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality
* feat: enhance classification span handling in CFG and AST for improved source attribution
* feat: add new Express routes for handling user input and telemetry data
* feat: implement ternary expression handling in CFG with diamond structure for JS/TS
* feat: implement Phase CF-3 abstract-domain transfer channels in summaries
* feat: add support for string-prefix transfer in cross-file calls and update tests
* docs: reduce RESULTS.md doc size
* feat: implement Phase CF-4 per-return-path summary decomposition with tests
* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization
* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests
* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests
* refactor: update comments and documentation for clarity and consistency
* style: format code for consistency and readability
* refactor: simplify verdict handling and improve edge checking logic
* refactor: optimize path and identifier collection by avoiding unnecessary cloning
* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults
* refactor: update documentation and improve clarity in configuration files
* refactor: update documentation and improve clarity in configuration files
* feat: add JS/TS pass-2 convergence tests and expectations configuration
* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic
* feat: implement Phase 7 deduplication and alternative path linking for taint findings
* feat: implement structural DFS index for anonymous functions and update naming conventions
* feat: add Phase 8 regression tests for container-element taint in JS and Python
* feat: add engine-depth profiles and explain-engine option for CLI
* feat: update expectations and add new README fixtures for multi-file scan regression
* feat: implement Phase 11 callback-alias and factory patterns with regression tests
* feat: implement Terminator::Switch for multi-way dispatch and add regression tests
* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants
* refactor: extract cfg and ssa_transfer to submodules
* refactor: cargo fmt
* refactor: remove unnecessary blank line in cfg_tests.rs
* refactor: remove unnecessary planning file
* chore: update Rust version to 1.88 and bump dependencies in Cargo files
* feat: enhance triage UI with new layout and controls, update README for clarity
* feat: enhance triage UI with new layout and controls, update README for clarity
* chore: remove outdated section from README for version 0.5.0
* docs: improve clarity and consistency in README content
* chore: add "GPL-3.0-or-later" to license options in about.toml
* chore: update license handling in about.toml and check-licenses.mjs
* style: format code for improved readability in TriagePage component
* style: format code for improved readability in TriagePage component
* chore: enhance license handling and improve body_id scoping in seed lookup
* feat: introduce owner and parent body IDs for enhanced seed scoping
* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating
* feat: add Undef SSA operation for improved control-flow handling
* style: improve code formatting for consistency and readability in multiple files
* feat: add 16-function chain SCC across multiple files for enhanced analysis
* style: simplify code formatting for improved readability in multiple files
* fix: update CapHitReason default implementation and improve README clarity
* docs: enhance README with detailed explanations of taint analysis and limitations
* docs: refine README for clarity and consistency in taint analysis section
* style: improve code formatting for better readability in NewScanModal and scans
* fix: update cargo-about command to use --offline for deterministic license generation
* fix: update cargo-about command to use --offline for deterministic license generation
* ci: add step to prime cargo registry cache for deterministic license generation
* feat: add support for non-sink collections in authorization analysis
* feat: enhance authorization checks with row-level ownership equality and binding tracking
* feat: implement self-scoped user handling and enhance ownership checks
* refactor: simplify assertions and formatting in authorization analysis tests
* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure
* docs: update AI disclosure section for clarity and conciseness
* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure
* feat: enhance authorization analysis with SSA-derived variable type classification
* feat: implement auth_finding_to_diag function for enhanced security diagnostics
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag
* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks
* feat: enhance error message handling in cli_validation_tests for better Windows compatibility
* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration
* feat: enhance release build process with SBOM generation and SLSA provenance
* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: update benchmark data and enhance path sanitization logic with new safety checks
* feat: document AI assistance in frontend UI development and human review process
* feat: add return path facts for enhanced path safety checks and update documentation
* chore: update release date for version 0.5.0 in CHANGELOG.md
* chore: clean up ci.yml by removing outdated comments and clarifying steps
* feat: implement cross-language path sanitizers and validators for enhanced security
* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks
* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases
* refactor: simplify conditional formatting and improve code readability in executor and lower modules
* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests
* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs
---------
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-25 17:59:11 -04:00
|
|
|
/// Detect frameworks from manifest files in the project root.
|
|
|
|
|
pub fn detect_frameworks(root: &Path) -> FrameworkContext {
|
|
|
|
|
let mut fws = Vec::new();
|
2026-05-02 16:44:49 -04:00
|
|
|
let mut inspected: std::collections::HashSet<&'static str> = std::collections::HashSet::new();
|
Release/0.5.0 (#35)
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures
* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests
* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements
* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles
* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing
* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling
* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures
* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration
* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests
* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic
* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection
* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements
* feat: Enable auth-state analysis by default and update relevant tests in benchmark config
* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test
* docs: update CHANGELOG.md
* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers
* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers
* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse
* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation
* feat: Refactor function parameters and constants for improved clarity and maintainability
* refactor: Reorder module imports and improve formatting for consistency
* refactor: Fix formatting erorrs
* refactor: Fix clippy warnings
* refactor: Fix fmt warnings (again)
* chore: Update dependencies and improve feature configuration
* Add comprehensive tests for undertested modules (#36) (COPILOT)
* Add comprehensive tests for undertested modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
* Add comprehensive tests for ext, project, walk, and errors modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: Update dependencies and improve feature configuration
* fix: formatting errors in new tests
* chore: Update license list in about.toml
* chore: made functions input inline
* chore: updated cfg graph to take up the full page
* chore: add Prettier configuration and update code formatting
* Add frontend test suite with Vitest (111 tests) (#37)
* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7
* ci: add frontend test step to CI workflow
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: simplify array initialization in test files for consistency
* ran typecheck
* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage
* feat: update routing in AppLayout and improve empty state message in ExplorerPage
* feat: enhance scan progress tracking with additional metrics and stages
* feat: update license information and add license check script
* feat: implement cross-file symbolic execution with callee body persistence
* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering
* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions
* feat: enhance resource tracking with proxy method summaries and improve finding extraction
* feat: add terminal function exit detection for accurate resource leak analysis
* feat: add warnings for loops and functions without bodies to improve error recovery
* feat: update lambda expression handling to ensure proper function classification and control flow
* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling
* feat: add inline return taint analysis and regression tests for improved security checks
* feat: add engine version management and migration handling for database schema updates
* feat: enhance first_call_ident to skip nested function bodies and add regression tests
* feat: enhance callee name resolution with two-segment normalization and disambiguation
* feat: add cross-file context flags and debug assertions for taint analysis
* feat: refactor taint analysis structure to unify context handling and improve clarity
* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests
* docs: updated CHANGELOG.md
* fmt: formatting fixes
* fix: fixed frontend formatting and lint warnings
* fix: optimized ci
* fix: optimized ci
* Add comprehensive multi-file test coverage to Nyx (#38)
* Initial checklist for multi-file test suite expansion
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* deleted root repo
* rebuilt to test for regressions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* feat: enhance import alias resolution and taint tracking
* feat: implement security hardening with CSRF protection and path validation
* feat: add support for import alias bindings in Python, PHP, and Rust
* feat: enhance CFG analysis modes and improve code readability
* feat: add detection for parameterized SQL queries to enhance security
* feat: add safe internal redirect handling and enhance session destroy validation
* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads
* feat: enhance taint detection by adding support for inline source member expressions in call arguments
* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments
* feat: add support for Throw statement in control flow and error handling
* feat: add debug and echo endpoints with potential information leakage
* feat: implement internal redirect suppression and enhance taint detection
* feat: implement module alias tracking for dynamic dispatch in JS/TS
* feat: add authorization analysis module with Express support
* feat: add authorization analysis module with Express support
* feat: add tests for admin guard requirements and clean checks in authorization analysis
* feat: integrate Koa and Fastify frameworks into authorization analysis
* feat: add Flask and Django support to authorization analysis module
* feat: add support for Rails and Sinatra frameworks in authorization analysis
* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis
* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis
* feat: add support for Rails and Sinatra in authorization analysis
* chore: add .DS_Store to .gitignore
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: update usage of Option methods for improved clarity and consistency
* refactor: improve code readability by simplifying conditional checks and formatting
* refactor: improve code formatting and readability by simplifying conditional checks
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: simplify conditional checks in axum.rs for improved readability
* feat: add CodeQL analysis configuration for enhanced security scanning
* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)
* chore: start test coverage improvement work
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* test: add comprehensive tests for src/output.rs SARIF builder
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* refactor: improve code formatting and readability in output.rs
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* refactor: improve code formatting and readability in output.rs
* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* refactor: enhance triage file path handling with improved error management and validation
* refactor: updated func summaries for richer detail
* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries
* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution
* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls
* refactor: implement new Flask routes for safe and unsafe shell command execution
* refactor: separate receiver handling in SSA operations and enhance taint propagation
* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments
* refactor: implement auth decorator extraction and classification for multiple languages
* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation
* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic
* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior
* refactor: standardize default struct initialization across multiple files
* feat: add scripts for formatting checks and auto-fixes with test summaries
* refactor: simplify character splitting and enhance namespace qualifier handling
* refactor: improve documentation clarity and enhance code readability in resolver logic
* refactor: replace default struct initialization with explicit field assignments for clarity
* feat: enhance anonymous function naming by deriving context-based bindings
* refactor: streamline match expressions for improved readability and performance
* refactor: streamline match expressions for improved readability and performance
* refactor: replace loop with while let for improved clarity and performance
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis
* feat: add static map analysis for command injection suppression and type safety
* refactor: simplify match statements and reduce line breaks for improved readability
* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution
Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.
Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.
Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.
Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.
Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding
Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet. SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.
Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.
Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`. `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters. Dedup key extended with the primary location
so multi-site events aren't collapsed back together.
Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
!= ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
non-empty `file_rel` — the cap-only → None translation upstream
guarantees this.
Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved. A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.
build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.
Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing). All 1566 lib
tests + integration tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(output): phase 3/5 consume primary sink location in diag + SARIF
When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.
Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
resolved back to an absolute path via a shared resolve_file_rel
helper. Empty file_rel (single-file scans where namespace == "")
resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
locations[0] already reflects the primary sink position via the
updated diag line/col.
Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.
Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
inside the closure).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(bench): phase 4/5 validate primary sink attribution across corpus
Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.
Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
Case. When present, score_location_level additionally requires at
least one flow_step in the finding's evidence trace to fall within
±2 of the call-site range. When absent, the check is skipped —
fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
now-primary Diag.line post-phase-3).
Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
transform::wrap call site (a cross-file propagator, not a sink);
line 9 is Command::new, the real sink. The ±2 tolerance happened to
mask this stale attribution but it was semantically wrong — phase 4
is the right time to correct it. Also adds expected_call_site_lines
[8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
This fixture's sink (Command::new inside run_cmd at line 5) was the
motivating case for phases 1-3; adding the call-site assertion
guards against regression to caller-line attribution.
New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
takes two tainted params and invokes two Command sinks on
consecutive lines. Locks in that primary line lands inside the
helper (lines 5-6), not at the caller (line 12). Notes document
that SinkSite is currently one-per-callee so both findings today
collapse onto the first sink; expected_sink_lines=[5,6] and
expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
004): sink os.system lives in helper.py (cross-file), caller in
app.py reads env source and calls run_cmd. Verifies phase 3's
cross-file primary attribution: Diag.path = helper.py, Diag.line =
5, with app.py:7 recorded in flow_steps as a Call step.
Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test
Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body. Asserts the
resulting Finding.primary_location is exactly that triple.
The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file. This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.
Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).
Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: clean up formatting and improve readability in multiple files
* refactor: simplify type definition for deduplication key in findings
* test(harness): add must_not_match expectation for FP regression guards
Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules
* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking
* feat: update switch statement handling to improve control flow analysis
* feat: implement promisify alias handling for JS/TS to enhance taint tracking
* feat: enhance taint tracking by refining expectation handling and adding mode filtering
* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters
* feat: update taint tracking rules to enforce full mode matching and improve flow analysis
* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis
* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding
* feat: refine framework detection and update expectation handling for Echo and Sinatra
* feat: implement max_count for taint tracking expectations and deduplicate findings
* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files
* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity
* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files
* feat: add structural invariant checks for SSA bodies
* feat: ensure deterministic phi emission order using BTreeSet
* feat: enhance handling of terminators to ensure authoritative flow through successor edges
* feat: enhance Goto terminator handling to ensure all successors are marked executable
* feat: refactor code for improved readability and organization
* feat: simplify predicate checks and enhance readability in SSA handling
* feat: implement per-file parse timeout and enhance file size handling
* feat: migrate analysis engine toggles from environment variables to configuration file
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: update dependencies and enhance documentation on language maturity
* feat: enhance security headers and improve request body limits
* feat: implement sink capability bits for deduplication and enhance evidence tagging
* feat: implement dynamic activation handling for gated sinks and enhance validation logic
* feat: enhance configuration documentation and clarify inline analysis cache behavior
* feat: implement panic recovery during analysis to continue scans past errors
* feat: add expectations configuration for taint analysis and performance metrics
* feat: enhance error handling and logging during file reading and mutex locking
* feat: add cross-file body loading tests and plumbing for CF-1 phase
* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures
* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality
* feat: enhance classification span handling in CFG and AST for improved source attribution
* feat: add new Express routes for handling user input and telemetry data
* feat: implement ternary expression handling in CFG with diamond structure for JS/TS
* feat: implement Phase CF-3 abstract-domain transfer channels in summaries
* feat: add support for string-prefix transfer in cross-file calls and update tests
* docs: reduce RESULTS.md doc size
* feat: implement Phase CF-4 per-return-path summary decomposition with tests
* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization
* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests
* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests
* refactor: update comments and documentation for clarity and consistency
* style: format code for consistency and readability
* refactor: simplify verdict handling and improve edge checking logic
* refactor: optimize path and identifier collection by avoiding unnecessary cloning
* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults
* refactor: update documentation and improve clarity in configuration files
* refactor: update documentation and improve clarity in configuration files
* feat: add JS/TS pass-2 convergence tests and expectations configuration
* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic
* feat: implement Phase 7 deduplication and alternative path linking for taint findings
* feat: implement structural DFS index for anonymous functions and update naming conventions
* feat: add Phase 8 regression tests for container-element taint in JS and Python
* feat: add engine-depth profiles and explain-engine option for CLI
* feat: update expectations and add new README fixtures for multi-file scan regression
* feat: implement Phase 11 callback-alias and factory patterns with regression tests
* feat: implement Terminator::Switch for multi-way dispatch and add regression tests
* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants
* refactor: extract cfg and ssa_transfer to submodules
* refactor: cargo fmt
* refactor: remove unnecessary blank line in cfg_tests.rs
* refactor: remove unnecessary planning file
* chore: update Rust version to 1.88 and bump dependencies in Cargo files
* feat: enhance triage UI with new layout and controls, update README for clarity
* feat: enhance triage UI with new layout and controls, update README for clarity
* chore: remove outdated section from README for version 0.5.0
* docs: improve clarity and consistency in README content
* chore: add "GPL-3.0-or-later" to license options in about.toml
* chore: update license handling in about.toml and check-licenses.mjs
* style: format code for improved readability in TriagePage component
* style: format code for improved readability in TriagePage component
* chore: enhance license handling and improve body_id scoping in seed lookup
* feat: introduce owner and parent body IDs for enhanced seed scoping
* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating
* feat: add Undef SSA operation for improved control-flow handling
* style: improve code formatting for consistency and readability in multiple files
* feat: add 16-function chain SCC across multiple files for enhanced analysis
* style: simplify code formatting for improved readability in multiple files
* fix: update CapHitReason default implementation and improve README clarity
* docs: enhance README with detailed explanations of taint analysis and limitations
* docs: refine README for clarity and consistency in taint analysis section
* style: improve code formatting for better readability in NewScanModal and scans
* fix: update cargo-about command to use --offline for deterministic license generation
* fix: update cargo-about command to use --offline for deterministic license generation
* ci: add step to prime cargo registry cache for deterministic license generation
* feat: add support for non-sink collections in authorization analysis
* feat: enhance authorization checks with row-level ownership equality and binding tracking
* feat: implement self-scoped user handling and enhance ownership checks
* refactor: simplify assertions and formatting in authorization analysis tests
* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure
* docs: update AI disclosure section for clarity and conciseness
* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure
* feat: enhance authorization analysis with SSA-derived variable type classification
* feat: implement auth_finding_to_diag function for enhanced security diagnostics
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag
* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks
* feat: enhance error message handling in cli_validation_tests for better Windows compatibility
* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration
* feat: enhance release build process with SBOM generation and SLSA provenance
* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: update benchmark data and enhance path sanitization logic with new safety checks
* feat: document AI assistance in frontend UI development and human review process
* feat: add return path facts for enhanced path safety checks and update documentation
* chore: update release date for version 0.5.0 in CHANGELOG.md
* chore: clean up ci.yml by removing outdated comments and clarifying steps
* feat: implement cross-language path sanitizers and validators for enhanced security
* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks
* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases
* refactor: simplify conditional formatting and improve code readability in executor and lower modules
* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests
* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs
---------
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-25 17:59:11 -04:00
|
|
|
|
|
|
|
|
// ── Node.js (package.json) ──
|
|
|
|
|
if let Some(content) = read_bounded(&root.join("package.json")) {
|
2026-05-02 16:44:49 -04:00
|
|
|
inspected.insert("node");
|
Release/0.5.0 (#35)
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures
* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests
* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements
* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles
* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing
* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling
* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures
* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration
* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests
* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic
* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection
* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements
* feat: Enable auth-state analysis by default and update relevant tests in benchmark config
* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test
* docs: update CHANGELOG.md
* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers
* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers
* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse
* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation
* feat: Refactor function parameters and constants for improved clarity and maintainability
* refactor: Reorder module imports and improve formatting for consistency
* refactor: Fix formatting erorrs
* refactor: Fix clippy warnings
* refactor: Fix fmt warnings (again)
* chore: Update dependencies and improve feature configuration
* Add comprehensive tests for undertested modules (#36) (COPILOT)
* Add comprehensive tests for undertested modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
* Add comprehensive tests for ext, project, walk, and errors modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: Update dependencies and improve feature configuration
* fix: formatting errors in new tests
* chore: Update license list in about.toml
* chore: made functions input inline
* chore: updated cfg graph to take up the full page
* chore: add Prettier configuration and update code formatting
* Add frontend test suite with Vitest (111 tests) (#37)
* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7
* ci: add frontend test step to CI workflow
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: simplify array initialization in test files for consistency
* ran typecheck
* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage
* feat: update routing in AppLayout and improve empty state message in ExplorerPage
* feat: enhance scan progress tracking with additional metrics and stages
* feat: update license information and add license check script
* feat: implement cross-file symbolic execution with callee body persistence
* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering
* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions
* feat: enhance resource tracking with proxy method summaries and improve finding extraction
* feat: add terminal function exit detection for accurate resource leak analysis
* feat: add warnings for loops and functions without bodies to improve error recovery
* feat: update lambda expression handling to ensure proper function classification and control flow
* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling
* feat: add inline return taint analysis and regression tests for improved security checks
* feat: add engine version management and migration handling for database schema updates
* feat: enhance first_call_ident to skip nested function bodies and add regression tests
* feat: enhance callee name resolution with two-segment normalization and disambiguation
* feat: add cross-file context flags and debug assertions for taint analysis
* feat: refactor taint analysis structure to unify context handling and improve clarity
* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests
* docs: updated CHANGELOG.md
* fmt: formatting fixes
* fix: fixed frontend formatting and lint warnings
* fix: optimized ci
* fix: optimized ci
* Add comprehensive multi-file test coverage to Nyx (#38)
* Initial checklist for multi-file test suite expansion
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* deleted root repo
* rebuilt to test for regressions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* feat: enhance import alias resolution and taint tracking
* feat: implement security hardening with CSRF protection and path validation
* feat: add support for import alias bindings in Python, PHP, and Rust
* feat: enhance CFG analysis modes and improve code readability
* feat: add detection for parameterized SQL queries to enhance security
* feat: add safe internal redirect handling and enhance session destroy validation
* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads
* feat: enhance taint detection by adding support for inline source member expressions in call arguments
* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments
* feat: add support for Throw statement in control flow and error handling
* feat: add debug and echo endpoints with potential information leakage
* feat: implement internal redirect suppression and enhance taint detection
* feat: implement module alias tracking for dynamic dispatch in JS/TS
* feat: add authorization analysis module with Express support
* feat: add authorization analysis module with Express support
* feat: add tests for admin guard requirements and clean checks in authorization analysis
* feat: integrate Koa and Fastify frameworks into authorization analysis
* feat: add Flask and Django support to authorization analysis module
* feat: add support for Rails and Sinatra frameworks in authorization analysis
* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis
* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis
* feat: add support for Rails and Sinatra in authorization analysis
* chore: add .DS_Store to .gitignore
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: update usage of Option methods for improved clarity and consistency
* refactor: improve code readability by simplifying conditional checks and formatting
* refactor: improve code formatting and readability by simplifying conditional checks
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: simplify conditional checks in axum.rs for improved readability
* feat: add CodeQL analysis configuration for enhanced security scanning
* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)
* chore: start test coverage improvement work
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* test: add comprehensive tests for src/output.rs SARIF builder
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* refactor: improve code formatting and readability in output.rs
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* refactor: improve code formatting and readability in output.rs
* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* refactor: enhance triage file path handling with improved error management and validation
* refactor: updated func summaries for richer detail
* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries
* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution
* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls
* refactor: implement new Flask routes for safe and unsafe shell command execution
* refactor: separate receiver handling in SSA operations and enhance taint propagation
* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments
* refactor: implement auth decorator extraction and classification for multiple languages
* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation
* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic
* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior
* refactor: standardize default struct initialization across multiple files
* feat: add scripts for formatting checks and auto-fixes with test summaries
* refactor: simplify character splitting and enhance namespace qualifier handling
* refactor: improve documentation clarity and enhance code readability in resolver logic
* refactor: replace default struct initialization with explicit field assignments for clarity
* feat: enhance anonymous function naming by deriving context-based bindings
* refactor: streamline match expressions for improved readability and performance
* refactor: streamline match expressions for improved readability and performance
* refactor: replace loop with while let for improved clarity and performance
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis
* feat: add static map analysis for command injection suppression and type safety
* refactor: simplify match statements and reduce line breaks for improved readability
* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution
Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.
Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.
Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.
Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.
Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding
Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet. SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.
Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.
Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`. `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters. Dedup key extended with the primary location
so multi-site events aren't collapsed back together.
Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
!= ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
non-empty `file_rel` — the cap-only → None translation upstream
guarantees this.
Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved. A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.
build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.
Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing). All 1566 lib
tests + integration tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(output): phase 3/5 consume primary sink location in diag + SARIF
When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.
Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
resolved back to an absolute path via a shared resolve_file_rel
helper. Empty file_rel (single-file scans where namespace == "")
resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
locations[0] already reflects the primary sink position via the
updated diag line/col.
Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.
Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
inside the closure).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(bench): phase 4/5 validate primary sink attribution across corpus
Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.
Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
Case. When present, score_location_level additionally requires at
least one flow_step in the finding's evidence trace to fall within
±2 of the call-site range. When absent, the check is skipped —
fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
now-primary Diag.line post-phase-3).
Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
transform::wrap call site (a cross-file propagator, not a sink);
line 9 is Command::new, the real sink. The ±2 tolerance happened to
mask this stale attribution but it was semantically wrong — phase 4
is the right time to correct it. Also adds expected_call_site_lines
[8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
This fixture's sink (Command::new inside run_cmd at line 5) was the
motivating case for phases 1-3; adding the call-site assertion
guards against regression to caller-line attribution.
New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
takes two tainted params and invokes two Command sinks on
consecutive lines. Locks in that primary line lands inside the
helper (lines 5-6), not at the caller (line 12). Notes document
that SinkSite is currently one-per-callee so both findings today
collapse onto the first sink; expected_sink_lines=[5,6] and
expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
004): sink os.system lives in helper.py (cross-file), caller in
app.py reads env source and calls run_cmd. Verifies phase 3's
cross-file primary attribution: Diag.path = helper.py, Diag.line =
5, with app.py:7 recorded in flow_steps as a Call step.
Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test
Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body. Asserts the
resulting Finding.primary_location is exactly that triple.
The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file. This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.
Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).
Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: clean up formatting and improve readability in multiple files
* refactor: simplify type definition for deduplication key in findings
* test(harness): add must_not_match expectation for FP regression guards
Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules
* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking
* feat: update switch statement handling to improve control flow analysis
* feat: implement promisify alias handling for JS/TS to enhance taint tracking
* feat: enhance taint tracking by refining expectation handling and adding mode filtering
* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters
* feat: update taint tracking rules to enforce full mode matching and improve flow analysis
* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis
* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding
* feat: refine framework detection and update expectation handling for Echo and Sinatra
* feat: implement max_count for taint tracking expectations and deduplicate findings
* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files
* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity
* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files
* feat: add structural invariant checks for SSA bodies
* feat: ensure deterministic phi emission order using BTreeSet
* feat: enhance handling of terminators to ensure authoritative flow through successor edges
* feat: enhance Goto terminator handling to ensure all successors are marked executable
* feat: refactor code for improved readability and organization
* feat: simplify predicate checks and enhance readability in SSA handling
* feat: implement per-file parse timeout and enhance file size handling
* feat: migrate analysis engine toggles from environment variables to configuration file
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: update dependencies and enhance documentation on language maturity
* feat: enhance security headers and improve request body limits
* feat: implement sink capability bits for deduplication and enhance evidence tagging
* feat: implement dynamic activation handling for gated sinks and enhance validation logic
* feat: enhance configuration documentation and clarify inline analysis cache behavior
* feat: implement panic recovery during analysis to continue scans past errors
* feat: add expectations configuration for taint analysis and performance metrics
* feat: enhance error handling and logging during file reading and mutex locking
* feat: add cross-file body loading tests and plumbing for CF-1 phase
* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures
* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality
* feat: enhance classification span handling in CFG and AST for improved source attribution
* feat: add new Express routes for handling user input and telemetry data
* feat: implement ternary expression handling in CFG with diamond structure for JS/TS
* feat: implement Phase CF-3 abstract-domain transfer channels in summaries
* feat: add support for string-prefix transfer in cross-file calls and update tests
* docs: reduce RESULTS.md doc size
* feat: implement Phase CF-4 per-return-path summary decomposition with tests
* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization
* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests
* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests
* refactor: update comments and documentation for clarity and consistency
* style: format code for consistency and readability
* refactor: simplify verdict handling and improve edge checking logic
* refactor: optimize path and identifier collection by avoiding unnecessary cloning
* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults
* refactor: update documentation and improve clarity in configuration files
* refactor: update documentation and improve clarity in configuration files
* feat: add JS/TS pass-2 convergence tests and expectations configuration
* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic
* feat: implement Phase 7 deduplication and alternative path linking for taint findings
* feat: implement structural DFS index for anonymous functions and update naming conventions
* feat: add Phase 8 regression tests for container-element taint in JS and Python
* feat: add engine-depth profiles and explain-engine option for CLI
* feat: update expectations and add new README fixtures for multi-file scan regression
* feat: implement Phase 11 callback-alias and factory patterns with regression tests
* feat: implement Terminator::Switch for multi-way dispatch and add regression tests
* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants
* refactor: extract cfg and ssa_transfer to submodules
* refactor: cargo fmt
* refactor: remove unnecessary blank line in cfg_tests.rs
* refactor: remove unnecessary planning file
* chore: update Rust version to 1.88 and bump dependencies in Cargo files
* feat: enhance triage UI with new layout and controls, update README for clarity
* feat: enhance triage UI with new layout and controls, update README for clarity
* chore: remove outdated section from README for version 0.5.0
* docs: improve clarity and consistency in README content
* chore: add "GPL-3.0-or-later" to license options in about.toml
* chore: update license handling in about.toml and check-licenses.mjs
* style: format code for improved readability in TriagePage component
* style: format code for improved readability in TriagePage component
* chore: enhance license handling and improve body_id scoping in seed lookup
* feat: introduce owner and parent body IDs for enhanced seed scoping
* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating
* feat: add Undef SSA operation for improved control-flow handling
* style: improve code formatting for consistency and readability in multiple files
* feat: add 16-function chain SCC across multiple files for enhanced analysis
* style: simplify code formatting for improved readability in multiple files
* fix: update CapHitReason default implementation and improve README clarity
* docs: enhance README with detailed explanations of taint analysis and limitations
* docs: refine README for clarity and consistency in taint analysis section
* style: improve code formatting for better readability in NewScanModal and scans
* fix: update cargo-about command to use --offline for deterministic license generation
* fix: update cargo-about command to use --offline for deterministic license generation
* ci: add step to prime cargo registry cache for deterministic license generation
* feat: add support for non-sink collections in authorization analysis
* feat: enhance authorization checks with row-level ownership equality and binding tracking
* feat: implement self-scoped user handling and enhance ownership checks
* refactor: simplify assertions and formatting in authorization analysis tests
* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure
* docs: update AI disclosure section for clarity and conciseness
* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure
* feat: enhance authorization analysis with SSA-derived variable type classification
* feat: implement auth_finding_to_diag function for enhanced security diagnostics
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag
* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks
* feat: enhance error message handling in cli_validation_tests for better Windows compatibility
* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration
* feat: enhance release build process with SBOM generation and SLSA provenance
* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: update benchmark data and enhance path sanitization logic with new safety checks
* feat: document AI assistance in frontend UI development and human review process
* feat: add return path facts for enhanced path safety checks and update documentation
* chore: update release date for version 0.5.0 in CHANGELOG.md
* chore: clean up ci.yml by removing outdated comments and clarifying steps
* feat: implement cross-language path sanitizers and validators for enhanced security
* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks
* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases
* refactor: simplify conditional formatting and improve code readability in executor and lower modules
* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests
* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs
---------
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-25 17:59:11 -04:00
|
|
|
// Crude substring search in the "dependencies" block area.
|
2026-04-29 19:53:34 -04:00
|
|
|
// Good enough for detection, no JSON parsing overhead.
|
Release/0.5.0 (#35)
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures
* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests
* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements
* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles
* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing
* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling
* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures
* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration
* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests
* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic
* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection
* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements
* feat: Enable auth-state analysis by default and update relevant tests in benchmark config
* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test
* docs: update CHANGELOG.md
* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers
* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers
* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse
* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation
* feat: Refactor function parameters and constants for improved clarity and maintainability
* refactor: Reorder module imports and improve formatting for consistency
* refactor: Fix formatting erorrs
* refactor: Fix clippy warnings
* refactor: Fix fmt warnings (again)
* chore: Update dependencies and improve feature configuration
* Add comprehensive tests for undertested modules (#36) (COPILOT)
* Add comprehensive tests for undertested modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
* Add comprehensive tests for ext, project, walk, and errors modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: Update dependencies and improve feature configuration
* fix: formatting errors in new tests
* chore: Update license list in about.toml
* chore: made functions input inline
* chore: updated cfg graph to take up the full page
* chore: add Prettier configuration and update code formatting
* Add frontend test suite with Vitest (111 tests) (#37)
* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7
* ci: add frontend test step to CI workflow
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: simplify array initialization in test files for consistency
* ran typecheck
* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage
* feat: update routing in AppLayout and improve empty state message in ExplorerPage
* feat: enhance scan progress tracking with additional metrics and stages
* feat: update license information and add license check script
* feat: implement cross-file symbolic execution with callee body persistence
* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering
* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions
* feat: enhance resource tracking with proxy method summaries and improve finding extraction
* feat: add terminal function exit detection for accurate resource leak analysis
* feat: add warnings for loops and functions without bodies to improve error recovery
* feat: update lambda expression handling to ensure proper function classification and control flow
* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling
* feat: add inline return taint analysis and regression tests for improved security checks
* feat: add engine version management and migration handling for database schema updates
* feat: enhance first_call_ident to skip nested function bodies and add regression tests
* feat: enhance callee name resolution with two-segment normalization and disambiguation
* feat: add cross-file context flags and debug assertions for taint analysis
* feat: refactor taint analysis structure to unify context handling and improve clarity
* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests
* docs: updated CHANGELOG.md
* fmt: formatting fixes
* fix: fixed frontend formatting and lint warnings
* fix: optimized ci
* fix: optimized ci
* Add comprehensive multi-file test coverage to Nyx (#38)
* Initial checklist for multi-file test suite expansion
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* deleted root repo
* rebuilt to test for regressions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* feat: enhance import alias resolution and taint tracking
* feat: implement security hardening with CSRF protection and path validation
* feat: add support for import alias bindings in Python, PHP, and Rust
* feat: enhance CFG analysis modes and improve code readability
* feat: add detection for parameterized SQL queries to enhance security
* feat: add safe internal redirect handling and enhance session destroy validation
* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads
* feat: enhance taint detection by adding support for inline source member expressions in call arguments
* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments
* feat: add support for Throw statement in control flow and error handling
* feat: add debug and echo endpoints with potential information leakage
* feat: implement internal redirect suppression and enhance taint detection
* feat: implement module alias tracking for dynamic dispatch in JS/TS
* feat: add authorization analysis module with Express support
* feat: add authorization analysis module with Express support
* feat: add tests for admin guard requirements and clean checks in authorization analysis
* feat: integrate Koa and Fastify frameworks into authorization analysis
* feat: add Flask and Django support to authorization analysis module
* feat: add support for Rails and Sinatra frameworks in authorization analysis
* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis
* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis
* feat: add support for Rails and Sinatra in authorization analysis
* chore: add .DS_Store to .gitignore
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: update usage of Option methods for improved clarity and consistency
* refactor: improve code readability by simplifying conditional checks and formatting
* refactor: improve code formatting and readability by simplifying conditional checks
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: simplify conditional checks in axum.rs for improved readability
* feat: add CodeQL analysis configuration for enhanced security scanning
* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)
* chore: start test coverage improvement work
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* test: add comprehensive tests for src/output.rs SARIF builder
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* refactor: improve code formatting and readability in output.rs
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* refactor: improve code formatting and readability in output.rs
* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* refactor: enhance triage file path handling with improved error management and validation
* refactor: updated func summaries for richer detail
* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries
* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution
* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls
* refactor: implement new Flask routes for safe and unsafe shell command execution
* refactor: separate receiver handling in SSA operations and enhance taint propagation
* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments
* refactor: implement auth decorator extraction and classification for multiple languages
* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation
* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic
* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior
* refactor: standardize default struct initialization across multiple files
* feat: add scripts for formatting checks and auto-fixes with test summaries
* refactor: simplify character splitting and enhance namespace qualifier handling
* refactor: improve documentation clarity and enhance code readability in resolver logic
* refactor: replace default struct initialization with explicit field assignments for clarity
* feat: enhance anonymous function naming by deriving context-based bindings
* refactor: streamline match expressions for improved readability and performance
* refactor: streamline match expressions for improved readability and performance
* refactor: replace loop with while let for improved clarity and performance
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis
* feat: add static map analysis for command injection suppression and type safety
* refactor: simplify match statements and reduce line breaks for improved readability
* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution
Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.
Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.
Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.
Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.
Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding
Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet. SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.
Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.
Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`. `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters. Dedup key extended with the primary location
so multi-site events aren't collapsed back together.
Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
!= ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
non-empty `file_rel` — the cap-only → None translation upstream
guarantees this.
Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved. A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.
build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.
Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing). All 1566 lib
tests + integration tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(output): phase 3/5 consume primary sink location in diag + SARIF
When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.
Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
resolved back to an absolute path via a shared resolve_file_rel
helper. Empty file_rel (single-file scans where namespace == "")
resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
locations[0] already reflects the primary sink position via the
updated diag line/col.
Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.
Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
inside the closure).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(bench): phase 4/5 validate primary sink attribution across corpus
Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.
Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
Case. When present, score_location_level additionally requires at
least one flow_step in the finding's evidence trace to fall within
±2 of the call-site range. When absent, the check is skipped —
fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
now-primary Diag.line post-phase-3).
Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
transform::wrap call site (a cross-file propagator, not a sink);
line 9 is Command::new, the real sink. The ±2 tolerance happened to
mask this stale attribution but it was semantically wrong — phase 4
is the right time to correct it. Also adds expected_call_site_lines
[8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
This fixture's sink (Command::new inside run_cmd at line 5) was the
motivating case for phases 1-3; adding the call-site assertion
guards against regression to caller-line attribution.
New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
takes two tainted params and invokes two Command sinks on
consecutive lines. Locks in that primary line lands inside the
helper (lines 5-6), not at the caller (line 12). Notes document
that SinkSite is currently one-per-callee so both findings today
collapse onto the first sink; expected_sink_lines=[5,6] and
expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
004): sink os.system lives in helper.py (cross-file), caller in
app.py reads env source and calls run_cmd. Verifies phase 3's
cross-file primary attribution: Diag.path = helper.py, Diag.line =
5, with app.py:7 recorded in flow_steps as a Call step.
Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test
Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body. Asserts the
resulting Finding.primary_location is exactly that triple.
The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file. This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.
Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).
Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: clean up formatting and improve readability in multiple files
* refactor: simplify type definition for deduplication key in findings
* test(harness): add must_not_match expectation for FP regression guards
Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules
* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking
* feat: update switch statement handling to improve control flow analysis
* feat: implement promisify alias handling for JS/TS to enhance taint tracking
* feat: enhance taint tracking by refining expectation handling and adding mode filtering
* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters
* feat: update taint tracking rules to enforce full mode matching and improve flow analysis
* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis
* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding
* feat: refine framework detection and update expectation handling for Echo and Sinatra
* feat: implement max_count for taint tracking expectations and deduplicate findings
* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files
* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity
* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files
* feat: add structural invariant checks for SSA bodies
* feat: ensure deterministic phi emission order using BTreeSet
* feat: enhance handling of terminators to ensure authoritative flow through successor edges
* feat: enhance Goto terminator handling to ensure all successors are marked executable
* feat: refactor code for improved readability and organization
* feat: simplify predicate checks and enhance readability in SSA handling
* feat: implement per-file parse timeout and enhance file size handling
* feat: migrate analysis engine toggles from environment variables to configuration file
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: update dependencies and enhance documentation on language maturity
* feat: enhance security headers and improve request body limits
* feat: implement sink capability bits for deduplication and enhance evidence tagging
* feat: implement dynamic activation handling for gated sinks and enhance validation logic
* feat: enhance configuration documentation and clarify inline analysis cache behavior
* feat: implement panic recovery during analysis to continue scans past errors
* feat: add expectations configuration for taint analysis and performance metrics
* feat: enhance error handling and logging during file reading and mutex locking
* feat: add cross-file body loading tests and plumbing for CF-1 phase
* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures
* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality
* feat: enhance classification span handling in CFG and AST for improved source attribution
* feat: add new Express routes for handling user input and telemetry data
* feat: implement ternary expression handling in CFG with diamond structure for JS/TS
* feat: implement Phase CF-3 abstract-domain transfer channels in summaries
* feat: add support for string-prefix transfer in cross-file calls and update tests
* docs: reduce RESULTS.md doc size
* feat: implement Phase CF-4 per-return-path summary decomposition with tests
* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization
* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests
* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests
* refactor: update comments and documentation for clarity and consistency
* style: format code for consistency and readability
* refactor: simplify verdict handling and improve edge checking logic
* refactor: optimize path and identifier collection by avoiding unnecessary cloning
* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults
* refactor: update documentation and improve clarity in configuration files
* refactor: update documentation and improve clarity in configuration files
* feat: add JS/TS pass-2 convergence tests and expectations configuration
* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic
* feat: implement Phase 7 deduplication and alternative path linking for taint findings
* feat: implement structural DFS index for anonymous functions and update naming conventions
* feat: add Phase 8 regression tests for container-element taint in JS and Python
* feat: add engine-depth profiles and explain-engine option for CLI
* feat: update expectations and add new README fixtures for multi-file scan regression
* feat: implement Phase 11 callback-alias and factory patterns with regression tests
* feat: implement Terminator::Switch for multi-way dispatch and add regression tests
* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants
* refactor: extract cfg and ssa_transfer to submodules
* refactor: cargo fmt
* refactor: remove unnecessary blank line in cfg_tests.rs
* refactor: remove unnecessary planning file
* chore: update Rust version to 1.88 and bump dependencies in Cargo files
* feat: enhance triage UI with new layout and controls, update README for clarity
* feat: enhance triage UI with new layout and controls, update README for clarity
* chore: remove outdated section from README for version 0.5.0
* docs: improve clarity and consistency in README content
* chore: add "GPL-3.0-or-later" to license options in about.toml
* chore: update license handling in about.toml and check-licenses.mjs
* style: format code for improved readability in TriagePage component
* style: format code for improved readability in TriagePage component
* chore: enhance license handling and improve body_id scoping in seed lookup
* feat: introduce owner and parent body IDs for enhanced seed scoping
* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating
* feat: add Undef SSA operation for improved control-flow handling
* style: improve code formatting for consistency and readability in multiple files
* feat: add 16-function chain SCC across multiple files for enhanced analysis
* style: simplify code formatting for improved readability in multiple files
* fix: update CapHitReason default implementation and improve README clarity
* docs: enhance README with detailed explanations of taint analysis and limitations
* docs: refine README for clarity and consistency in taint analysis section
* style: improve code formatting for better readability in NewScanModal and scans
* fix: update cargo-about command to use --offline for deterministic license generation
* fix: update cargo-about command to use --offline for deterministic license generation
* ci: add step to prime cargo registry cache for deterministic license generation
* feat: add support for non-sink collections in authorization analysis
* feat: enhance authorization checks with row-level ownership equality and binding tracking
* feat: implement self-scoped user handling and enhance ownership checks
* refactor: simplify assertions and formatting in authorization analysis tests
* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure
* docs: update AI disclosure section for clarity and conciseness
* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure
* feat: enhance authorization analysis with SSA-derived variable type classification
* feat: implement auth_finding_to_diag function for enhanced security diagnostics
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag
* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks
* feat: enhance error message handling in cli_validation_tests for better Windows compatibility
* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration
* feat: enhance release build process with SBOM generation and SLSA provenance
* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: update benchmark data and enhance path sanitization logic with new safety checks
* feat: document AI assistance in frontend UI development and human review process
* feat: add return path facts for enhanced path safety checks and update documentation
* chore: update release date for version 0.5.0 in CHANGELOG.md
* chore: clean up ci.yml by removing outdated comments and clarifying steps
* feat: implement cross-language path sanitizers and validators for enhanced security
* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks
* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases
* refactor: simplify conditional formatting and improve code readability in executor and lower modules
* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests
* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs
---------
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-25 17:59:11 -04:00
|
|
|
if content.contains("\"express\"") {
|
|
|
|
|
fws.push(DetectedFramework::Express);
|
|
|
|
|
}
|
|
|
|
|
if (content.contains("\"koa\"")
|
|
|
|
|
|| content.contains("\"@koa/router\"")
|
|
|
|
|
|| content.contains("\"koa-router\""))
|
|
|
|
|
&& !fws.contains(&DetectedFramework::Koa)
|
|
|
|
|
{
|
|
|
|
|
fws.push(DetectedFramework::Koa);
|
|
|
|
|
}
|
|
|
|
|
if content.contains("\"fastify\"") && !fws.contains(&DetectedFramework::Fastify) {
|
|
|
|
|
fws.push(DetectedFramework::Fastify);
|
|
|
|
|
}
|
|
|
|
|
if content.contains("\"react\"") {
|
|
|
|
|
fws.push(DetectedFramework::React);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// ── Python ──
|
|
|
|
|
for name in &["requirements.txt", "Pipfile", "pyproject.toml"] {
|
|
|
|
|
if let Some(content) = read_bounded(&root.join(name)) {
|
2026-05-02 16:44:49 -04:00
|
|
|
inspected.insert("python");
|
Release/0.5.0 (#35)
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures
* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests
* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements
* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles
* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing
* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling
* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures
* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration
* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests
* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic
* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection
* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements
* feat: Enable auth-state analysis by default and update relevant tests in benchmark config
* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test
* docs: update CHANGELOG.md
* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers
* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers
* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse
* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation
* feat: Refactor function parameters and constants for improved clarity and maintainability
* refactor: Reorder module imports and improve formatting for consistency
* refactor: Fix formatting erorrs
* refactor: Fix clippy warnings
* refactor: Fix fmt warnings (again)
* chore: Update dependencies and improve feature configuration
* Add comprehensive tests for undertested modules (#36) (COPILOT)
* Add comprehensive tests for undertested modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
* Add comprehensive tests for ext, project, walk, and errors modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: Update dependencies and improve feature configuration
* fix: formatting errors in new tests
* chore: Update license list in about.toml
* chore: made functions input inline
* chore: updated cfg graph to take up the full page
* chore: add Prettier configuration and update code formatting
* Add frontend test suite with Vitest (111 tests) (#37)
* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7
* ci: add frontend test step to CI workflow
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: simplify array initialization in test files for consistency
* ran typecheck
* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage
* feat: update routing in AppLayout and improve empty state message in ExplorerPage
* feat: enhance scan progress tracking with additional metrics and stages
* feat: update license information and add license check script
* feat: implement cross-file symbolic execution with callee body persistence
* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering
* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions
* feat: enhance resource tracking with proxy method summaries and improve finding extraction
* feat: add terminal function exit detection for accurate resource leak analysis
* feat: add warnings for loops and functions without bodies to improve error recovery
* feat: update lambda expression handling to ensure proper function classification and control flow
* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling
* feat: add inline return taint analysis and regression tests for improved security checks
* feat: add engine version management and migration handling for database schema updates
* feat: enhance first_call_ident to skip nested function bodies and add regression tests
* feat: enhance callee name resolution with two-segment normalization and disambiguation
* feat: add cross-file context flags and debug assertions for taint analysis
* feat: refactor taint analysis structure to unify context handling and improve clarity
* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests
* docs: updated CHANGELOG.md
* fmt: formatting fixes
* fix: fixed frontend formatting and lint warnings
* fix: optimized ci
* fix: optimized ci
* Add comprehensive multi-file test coverage to Nyx (#38)
* Initial checklist for multi-file test suite expansion
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* deleted root repo
* rebuilt to test for regressions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* feat: enhance import alias resolution and taint tracking
* feat: implement security hardening with CSRF protection and path validation
* feat: add support for import alias bindings in Python, PHP, and Rust
* feat: enhance CFG analysis modes and improve code readability
* feat: add detection for parameterized SQL queries to enhance security
* feat: add safe internal redirect handling and enhance session destroy validation
* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads
* feat: enhance taint detection by adding support for inline source member expressions in call arguments
* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments
* feat: add support for Throw statement in control flow and error handling
* feat: add debug and echo endpoints with potential information leakage
* feat: implement internal redirect suppression and enhance taint detection
* feat: implement module alias tracking for dynamic dispatch in JS/TS
* feat: add authorization analysis module with Express support
* feat: add authorization analysis module with Express support
* feat: add tests for admin guard requirements and clean checks in authorization analysis
* feat: integrate Koa and Fastify frameworks into authorization analysis
* feat: add Flask and Django support to authorization analysis module
* feat: add support for Rails and Sinatra frameworks in authorization analysis
* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis
* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis
* feat: add support for Rails and Sinatra in authorization analysis
* chore: add .DS_Store to .gitignore
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: update usage of Option methods for improved clarity and consistency
* refactor: improve code readability by simplifying conditional checks and formatting
* refactor: improve code formatting and readability by simplifying conditional checks
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: simplify conditional checks in axum.rs for improved readability
* feat: add CodeQL analysis configuration for enhanced security scanning
* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)
* chore: start test coverage improvement work
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* test: add comprehensive tests for src/output.rs SARIF builder
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* refactor: improve code formatting and readability in output.rs
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* refactor: improve code formatting and readability in output.rs
* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* refactor: enhance triage file path handling with improved error management and validation
* refactor: updated func summaries for richer detail
* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries
* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution
* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls
* refactor: implement new Flask routes for safe and unsafe shell command execution
* refactor: separate receiver handling in SSA operations and enhance taint propagation
* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments
* refactor: implement auth decorator extraction and classification for multiple languages
* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation
* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic
* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior
* refactor: standardize default struct initialization across multiple files
* feat: add scripts for formatting checks and auto-fixes with test summaries
* refactor: simplify character splitting and enhance namespace qualifier handling
* refactor: improve documentation clarity and enhance code readability in resolver logic
* refactor: replace default struct initialization with explicit field assignments for clarity
* feat: enhance anonymous function naming by deriving context-based bindings
* refactor: streamline match expressions for improved readability and performance
* refactor: streamline match expressions for improved readability and performance
* refactor: replace loop with while let for improved clarity and performance
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis
* feat: add static map analysis for command injection suppression and type safety
* refactor: simplify match statements and reduce line breaks for improved readability
* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution
Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.
Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.
Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.
Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.
Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding
Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet. SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.
Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.
Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`. `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters. Dedup key extended with the primary location
so multi-site events aren't collapsed back together.
Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
!= ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
non-empty `file_rel` — the cap-only → None translation upstream
guarantees this.
Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved. A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.
build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.
Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing). All 1566 lib
tests + integration tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(output): phase 3/5 consume primary sink location in diag + SARIF
When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.
Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
resolved back to an absolute path via a shared resolve_file_rel
helper. Empty file_rel (single-file scans where namespace == "")
resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
locations[0] already reflects the primary sink position via the
updated diag line/col.
Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.
Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
inside the closure).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(bench): phase 4/5 validate primary sink attribution across corpus
Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.
Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
Case. When present, score_location_level additionally requires at
least one flow_step in the finding's evidence trace to fall within
±2 of the call-site range. When absent, the check is skipped —
fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
now-primary Diag.line post-phase-3).
Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
transform::wrap call site (a cross-file propagator, not a sink);
line 9 is Command::new, the real sink. The ±2 tolerance happened to
mask this stale attribution but it was semantically wrong — phase 4
is the right time to correct it. Also adds expected_call_site_lines
[8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
This fixture's sink (Command::new inside run_cmd at line 5) was the
motivating case for phases 1-3; adding the call-site assertion
guards against regression to caller-line attribution.
New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
takes two tainted params and invokes two Command sinks on
consecutive lines. Locks in that primary line lands inside the
helper (lines 5-6), not at the caller (line 12). Notes document
that SinkSite is currently one-per-callee so both findings today
collapse onto the first sink; expected_sink_lines=[5,6] and
expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
004): sink os.system lives in helper.py (cross-file), caller in
app.py reads env source and calls run_cmd. Verifies phase 3's
cross-file primary attribution: Diag.path = helper.py, Diag.line =
5, with app.py:7 recorded in flow_steps as a Call step.
Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test
Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body. Asserts the
resulting Finding.primary_location is exactly that triple.
The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file. This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.
Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).
Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: clean up formatting and improve readability in multiple files
* refactor: simplify type definition for deduplication key in findings
* test(harness): add must_not_match expectation for FP regression guards
Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules
* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking
* feat: update switch statement handling to improve control flow analysis
* feat: implement promisify alias handling for JS/TS to enhance taint tracking
* feat: enhance taint tracking by refining expectation handling and adding mode filtering
* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters
* feat: update taint tracking rules to enforce full mode matching and improve flow analysis
* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis
* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding
* feat: refine framework detection and update expectation handling for Echo and Sinatra
* feat: implement max_count for taint tracking expectations and deduplicate findings
* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files
* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity
* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files
* feat: add structural invariant checks for SSA bodies
* feat: ensure deterministic phi emission order using BTreeSet
* feat: enhance handling of terminators to ensure authoritative flow through successor edges
* feat: enhance Goto terminator handling to ensure all successors are marked executable
* feat: refactor code for improved readability and organization
* feat: simplify predicate checks and enhance readability in SSA handling
* feat: implement per-file parse timeout and enhance file size handling
* feat: migrate analysis engine toggles from environment variables to configuration file
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: update dependencies and enhance documentation on language maturity
* feat: enhance security headers and improve request body limits
* feat: implement sink capability bits for deduplication and enhance evidence tagging
* feat: implement dynamic activation handling for gated sinks and enhance validation logic
* feat: enhance configuration documentation and clarify inline analysis cache behavior
* feat: implement panic recovery during analysis to continue scans past errors
* feat: add expectations configuration for taint analysis and performance metrics
* feat: enhance error handling and logging during file reading and mutex locking
* feat: add cross-file body loading tests and plumbing for CF-1 phase
* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures
* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality
* feat: enhance classification span handling in CFG and AST for improved source attribution
* feat: add new Express routes for handling user input and telemetry data
* feat: implement ternary expression handling in CFG with diamond structure for JS/TS
* feat: implement Phase CF-3 abstract-domain transfer channels in summaries
* feat: add support for string-prefix transfer in cross-file calls and update tests
* docs: reduce RESULTS.md doc size
* feat: implement Phase CF-4 per-return-path summary decomposition with tests
* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization
* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests
* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests
* refactor: update comments and documentation for clarity and consistency
* style: format code for consistency and readability
* refactor: simplify verdict handling and improve edge checking logic
* refactor: optimize path and identifier collection by avoiding unnecessary cloning
* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults
* refactor: update documentation and improve clarity in configuration files
* refactor: update documentation and improve clarity in configuration files
* feat: add JS/TS pass-2 convergence tests and expectations configuration
* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic
* feat: implement Phase 7 deduplication and alternative path linking for taint findings
* feat: implement structural DFS index for anonymous functions and update naming conventions
* feat: add Phase 8 regression tests for container-element taint in JS and Python
* feat: add engine-depth profiles and explain-engine option for CLI
* feat: update expectations and add new README fixtures for multi-file scan regression
* feat: implement Phase 11 callback-alias and factory patterns with regression tests
* feat: implement Terminator::Switch for multi-way dispatch and add regression tests
* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants
* refactor: extract cfg and ssa_transfer to submodules
* refactor: cargo fmt
* refactor: remove unnecessary blank line in cfg_tests.rs
* refactor: remove unnecessary planning file
* chore: update Rust version to 1.88 and bump dependencies in Cargo files
* feat: enhance triage UI with new layout and controls, update README for clarity
* feat: enhance triage UI with new layout and controls, update README for clarity
* chore: remove outdated section from README for version 0.5.0
* docs: improve clarity and consistency in README content
* chore: add "GPL-3.0-or-later" to license options in about.toml
* chore: update license handling in about.toml and check-licenses.mjs
* style: format code for improved readability in TriagePage component
* style: format code for improved readability in TriagePage component
* chore: enhance license handling and improve body_id scoping in seed lookup
* feat: introduce owner and parent body IDs for enhanced seed scoping
* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating
* feat: add Undef SSA operation for improved control-flow handling
* style: improve code formatting for consistency and readability in multiple files
* feat: add 16-function chain SCC across multiple files for enhanced analysis
* style: simplify code formatting for improved readability in multiple files
* fix: update CapHitReason default implementation and improve README clarity
* docs: enhance README with detailed explanations of taint analysis and limitations
* docs: refine README for clarity and consistency in taint analysis section
* style: improve code formatting for better readability in NewScanModal and scans
* fix: update cargo-about command to use --offline for deterministic license generation
* fix: update cargo-about command to use --offline for deterministic license generation
* ci: add step to prime cargo registry cache for deterministic license generation
* feat: add support for non-sink collections in authorization analysis
* feat: enhance authorization checks with row-level ownership equality and binding tracking
* feat: implement self-scoped user handling and enhance ownership checks
* refactor: simplify assertions and formatting in authorization analysis tests
* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure
* docs: update AI disclosure section for clarity and conciseness
* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure
* feat: enhance authorization analysis with SSA-derived variable type classification
* feat: implement auth_finding_to_diag function for enhanced security diagnostics
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag
* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks
* feat: enhance error message handling in cli_validation_tests for better Windows compatibility
* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration
* feat: enhance release build process with SBOM generation and SLSA provenance
* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: update benchmark data and enhance path sanitization logic with new safety checks
* feat: document AI assistance in frontend UI development and human review process
* feat: add return path facts for enhanced path safety checks and update documentation
* chore: update release date for version 0.5.0 in CHANGELOG.md
* chore: clean up ci.yml by removing outdated comments and clarifying steps
* feat: implement cross-language path sanitizers and validators for enhanced security
* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks
* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases
* refactor: simplify conditional formatting and improve code readability in executor and lower modules
* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests
* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs
---------
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-25 17:59:11 -04:00
|
|
|
let lower = content.to_ascii_lowercase();
|
|
|
|
|
if lower.contains("flask") && !fws.contains(&DetectedFramework::Flask) {
|
|
|
|
|
fws.push(DetectedFramework::Flask);
|
|
|
|
|
}
|
|
|
|
|
if lower.contains("django") && !fws.contains(&DetectedFramework::Django) {
|
|
|
|
|
fws.push(DetectedFramework::Django);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// ── Java (Maven / Gradle) ──
|
|
|
|
|
for name in &["pom.xml", "build.gradle", "build.gradle.kts"] {
|
|
|
|
|
if let Some(content) = read_bounded(&root.join(name)) {
|
2026-05-02 16:44:49 -04:00
|
|
|
inspected.insert("java");
|
Release/0.5.0 (#35)
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures
* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests
* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements
* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles
* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing
* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling
* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures
* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration
* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests
* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic
* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection
* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements
* feat: Enable auth-state analysis by default and update relevant tests in benchmark config
* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test
* docs: update CHANGELOG.md
* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers
* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers
* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse
* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation
* feat: Refactor function parameters and constants for improved clarity and maintainability
* refactor: Reorder module imports and improve formatting for consistency
* refactor: Fix formatting erorrs
* refactor: Fix clippy warnings
* refactor: Fix fmt warnings (again)
* chore: Update dependencies and improve feature configuration
* Add comprehensive tests for undertested modules (#36) (COPILOT)
* Add comprehensive tests for undertested modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
* Add comprehensive tests for ext, project, walk, and errors modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: Update dependencies and improve feature configuration
* fix: formatting errors in new tests
* chore: Update license list in about.toml
* chore: made functions input inline
* chore: updated cfg graph to take up the full page
* chore: add Prettier configuration and update code formatting
* Add frontend test suite with Vitest (111 tests) (#37)
* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7
* ci: add frontend test step to CI workflow
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: simplify array initialization in test files for consistency
* ran typecheck
* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage
* feat: update routing in AppLayout and improve empty state message in ExplorerPage
* feat: enhance scan progress tracking with additional metrics and stages
* feat: update license information and add license check script
* feat: implement cross-file symbolic execution with callee body persistence
* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering
* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions
* feat: enhance resource tracking with proxy method summaries and improve finding extraction
* feat: add terminal function exit detection for accurate resource leak analysis
* feat: add warnings for loops and functions without bodies to improve error recovery
* feat: update lambda expression handling to ensure proper function classification and control flow
* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling
* feat: add inline return taint analysis and regression tests for improved security checks
* feat: add engine version management and migration handling for database schema updates
* feat: enhance first_call_ident to skip nested function bodies and add regression tests
* feat: enhance callee name resolution with two-segment normalization and disambiguation
* feat: add cross-file context flags and debug assertions for taint analysis
* feat: refactor taint analysis structure to unify context handling and improve clarity
* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests
* docs: updated CHANGELOG.md
* fmt: formatting fixes
* fix: fixed frontend formatting and lint warnings
* fix: optimized ci
* fix: optimized ci
* Add comprehensive multi-file test coverage to Nyx (#38)
* Initial checklist for multi-file test suite expansion
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* deleted root repo
* rebuilt to test for regressions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* feat: enhance import alias resolution and taint tracking
* feat: implement security hardening with CSRF protection and path validation
* feat: add support for import alias bindings in Python, PHP, and Rust
* feat: enhance CFG analysis modes and improve code readability
* feat: add detection for parameterized SQL queries to enhance security
* feat: add safe internal redirect handling and enhance session destroy validation
* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads
* feat: enhance taint detection by adding support for inline source member expressions in call arguments
* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments
* feat: add support for Throw statement in control flow and error handling
* feat: add debug and echo endpoints with potential information leakage
* feat: implement internal redirect suppression and enhance taint detection
* feat: implement module alias tracking for dynamic dispatch in JS/TS
* feat: add authorization analysis module with Express support
* feat: add authorization analysis module with Express support
* feat: add tests for admin guard requirements and clean checks in authorization analysis
* feat: integrate Koa and Fastify frameworks into authorization analysis
* feat: add Flask and Django support to authorization analysis module
* feat: add support for Rails and Sinatra frameworks in authorization analysis
* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis
* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis
* feat: add support for Rails and Sinatra in authorization analysis
* chore: add .DS_Store to .gitignore
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: update usage of Option methods for improved clarity and consistency
* refactor: improve code readability by simplifying conditional checks and formatting
* refactor: improve code formatting and readability by simplifying conditional checks
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: simplify conditional checks in axum.rs for improved readability
* feat: add CodeQL analysis configuration for enhanced security scanning
* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)
* chore: start test coverage improvement work
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* test: add comprehensive tests for src/output.rs SARIF builder
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* refactor: improve code formatting and readability in output.rs
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* refactor: improve code formatting and readability in output.rs
* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* refactor: enhance triage file path handling with improved error management and validation
* refactor: updated func summaries for richer detail
* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries
* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution
* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls
* refactor: implement new Flask routes for safe and unsafe shell command execution
* refactor: separate receiver handling in SSA operations and enhance taint propagation
* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments
* refactor: implement auth decorator extraction and classification for multiple languages
* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation
* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic
* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior
* refactor: standardize default struct initialization across multiple files
* feat: add scripts for formatting checks and auto-fixes with test summaries
* refactor: simplify character splitting and enhance namespace qualifier handling
* refactor: improve documentation clarity and enhance code readability in resolver logic
* refactor: replace default struct initialization with explicit field assignments for clarity
* feat: enhance anonymous function naming by deriving context-based bindings
* refactor: streamline match expressions for improved readability and performance
* refactor: streamline match expressions for improved readability and performance
* refactor: replace loop with while let for improved clarity and performance
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis
* feat: add static map analysis for command injection suppression and type safety
* refactor: simplify match statements and reduce line breaks for improved readability
* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution
Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.
Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.
Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.
Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.
Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding
Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet. SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.
Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.
Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`. `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters. Dedup key extended with the primary location
so multi-site events aren't collapsed back together.
Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
!= ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
non-empty `file_rel` — the cap-only → None translation upstream
guarantees this.
Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved. A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.
build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.
Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing). All 1566 lib
tests + integration tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(output): phase 3/5 consume primary sink location in diag + SARIF
When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.
Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
resolved back to an absolute path via a shared resolve_file_rel
helper. Empty file_rel (single-file scans where namespace == "")
resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
locations[0] already reflects the primary sink position via the
updated diag line/col.
Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.
Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
inside the closure).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(bench): phase 4/5 validate primary sink attribution across corpus
Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.
Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
Case. When present, score_location_level additionally requires at
least one flow_step in the finding's evidence trace to fall within
±2 of the call-site range. When absent, the check is skipped —
fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
now-primary Diag.line post-phase-3).
Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
transform::wrap call site (a cross-file propagator, not a sink);
line 9 is Command::new, the real sink. The ±2 tolerance happened to
mask this stale attribution but it was semantically wrong — phase 4
is the right time to correct it. Also adds expected_call_site_lines
[8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
This fixture's sink (Command::new inside run_cmd at line 5) was the
motivating case for phases 1-3; adding the call-site assertion
guards against regression to caller-line attribution.
New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
takes two tainted params and invokes two Command sinks on
consecutive lines. Locks in that primary line lands inside the
helper (lines 5-6), not at the caller (line 12). Notes document
that SinkSite is currently one-per-callee so both findings today
collapse onto the first sink; expected_sink_lines=[5,6] and
expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
004): sink os.system lives in helper.py (cross-file), caller in
app.py reads env source and calls run_cmd. Verifies phase 3's
cross-file primary attribution: Diag.path = helper.py, Diag.line =
5, with app.py:7 recorded in flow_steps as a Call step.
Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test
Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body. Asserts the
resulting Finding.primary_location is exactly that triple.
The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file. This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.
Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).
Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: clean up formatting and improve readability in multiple files
* refactor: simplify type definition for deduplication key in findings
* test(harness): add must_not_match expectation for FP regression guards
Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules
* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking
* feat: update switch statement handling to improve control flow analysis
* feat: implement promisify alias handling for JS/TS to enhance taint tracking
* feat: enhance taint tracking by refining expectation handling and adding mode filtering
* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters
* feat: update taint tracking rules to enforce full mode matching and improve flow analysis
* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis
* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding
* feat: refine framework detection and update expectation handling for Echo and Sinatra
* feat: implement max_count for taint tracking expectations and deduplicate findings
* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files
* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity
* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files
* feat: add structural invariant checks for SSA bodies
* feat: ensure deterministic phi emission order using BTreeSet
* feat: enhance handling of terminators to ensure authoritative flow through successor edges
* feat: enhance Goto terminator handling to ensure all successors are marked executable
* feat: refactor code for improved readability and organization
* feat: simplify predicate checks and enhance readability in SSA handling
* feat: implement per-file parse timeout and enhance file size handling
* feat: migrate analysis engine toggles from environment variables to configuration file
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: update dependencies and enhance documentation on language maturity
* feat: enhance security headers and improve request body limits
* feat: implement sink capability bits for deduplication and enhance evidence tagging
* feat: implement dynamic activation handling for gated sinks and enhance validation logic
* feat: enhance configuration documentation and clarify inline analysis cache behavior
* feat: implement panic recovery during analysis to continue scans past errors
* feat: add expectations configuration for taint analysis and performance metrics
* feat: enhance error handling and logging during file reading and mutex locking
* feat: add cross-file body loading tests and plumbing for CF-1 phase
* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures
* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality
* feat: enhance classification span handling in CFG and AST for improved source attribution
* feat: add new Express routes for handling user input and telemetry data
* feat: implement ternary expression handling in CFG with diamond structure for JS/TS
* feat: implement Phase CF-3 abstract-domain transfer channels in summaries
* feat: add support for string-prefix transfer in cross-file calls and update tests
* docs: reduce RESULTS.md doc size
* feat: implement Phase CF-4 per-return-path summary decomposition with tests
* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization
* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests
* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests
* refactor: update comments and documentation for clarity and consistency
* style: format code for consistency and readability
* refactor: simplify verdict handling and improve edge checking logic
* refactor: optimize path and identifier collection by avoiding unnecessary cloning
* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults
* refactor: update documentation and improve clarity in configuration files
* refactor: update documentation and improve clarity in configuration files
* feat: add JS/TS pass-2 convergence tests and expectations configuration
* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic
* feat: implement Phase 7 deduplication and alternative path linking for taint findings
* feat: implement structural DFS index for anonymous functions and update naming conventions
* feat: add Phase 8 regression tests for container-element taint in JS and Python
* feat: add engine-depth profiles and explain-engine option for CLI
* feat: update expectations and add new README fixtures for multi-file scan regression
* feat: implement Phase 11 callback-alias and factory patterns with regression tests
* feat: implement Terminator::Switch for multi-way dispatch and add regression tests
* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants
* refactor: extract cfg and ssa_transfer to submodules
* refactor: cargo fmt
* refactor: remove unnecessary blank line in cfg_tests.rs
* refactor: remove unnecessary planning file
* chore: update Rust version to 1.88 and bump dependencies in Cargo files
* feat: enhance triage UI with new layout and controls, update README for clarity
* feat: enhance triage UI with new layout and controls, update README for clarity
* chore: remove outdated section from README for version 0.5.0
* docs: improve clarity and consistency in README content
* chore: add "GPL-3.0-or-later" to license options in about.toml
* chore: update license handling in about.toml and check-licenses.mjs
* style: format code for improved readability in TriagePage component
* style: format code for improved readability in TriagePage component
* chore: enhance license handling and improve body_id scoping in seed lookup
* feat: introduce owner and parent body IDs for enhanced seed scoping
* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating
* feat: add Undef SSA operation for improved control-flow handling
* style: improve code formatting for consistency and readability in multiple files
* feat: add 16-function chain SCC across multiple files for enhanced analysis
* style: simplify code formatting for improved readability in multiple files
* fix: update CapHitReason default implementation and improve README clarity
* docs: enhance README with detailed explanations of taint analysis and limitations
* docs: refine README for clarity and consistency in taint analysis section
* style: improve code formatting for better readability in NewScanModal and scans
* fix: update cargo-about command to use --offline for deterministic license generation
* fix: update cargo-about command to use --offline for deterministic license generation
* ci: add step to prime cargo registry cache for deterministic license generation
* feat: add support for non-sink collections in authorization analysis
* feat: enhance authorization checks with row-level ownership equality and binding tracking
* feat: implement self-scoped user handling and enhance ownership checks
* refactor: simplify assertions and formatting in authorization analysis tests
* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure
* docs: update AI disclosure section for clarity and conciseness
* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure
* feat: enhance authorization analysis with SSA-derived variable type classification
* feat: implement auth_finding_to_diag function for enhanced security diagnostics
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag
* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks
* feat: enhance error message handling in cli_validation_tests for better Windows compatibility
* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration
* feat: enhance release build process with SBOM generation and SLSA provenance
* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: update benchmark data and enhance path sanitization logic with new safety checks
* feat: document AI assistance in frontend UI development and human review process
* feat: add return path facts for enhanced path safety checks and update documentation
* chore: update release date for version 0.5.0 in CHANGELOG.md
* chore: clean up ci.yml by removing outdated comments and clarifying steps
* feat: implement cross-language path sanitizers and validators for enhanced security
* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks
* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases
* refactor: simplify conditional formatting and improve code readability in executor and lower modules
* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests
* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs
---------
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-25 17:59:11 -04:00
|
|
|
if (content.contains("spring-boot") || content.contains("spring-web"))
|
|
|
|
|
&& !fws.contains(&DetectedFramework::Spring)
|
|
|
|
|
{
|
|
|
|
|
fws.push(DetectedFramework::Spring);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// ── Go (go.mod) ──
|
|
|
|
|
if let Some(content) = read_bounded(&root.join("go.mod")) {
|
2026-05-02 16:44:49 -04:00
|
|
|
inspected.insert("go");
|
Release/0.5.0 (#35)
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures
* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests
* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements
* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles
* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing
* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling
* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures
* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration
* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests
* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic
* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection
* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements
* feat: Enable auth-state analysis by default and update relevant tests in benchmark config
* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test
* docs: update CHANGELOG.md
* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers
* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers
* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse
* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation
* feat: Refactor function parameters and constants for improved clarity and maintainability
* refactor: Reorder module imports and improve formatting for consistency
* refactor: Fix formatting erorrs
* refactor: Fix clippy warnings
* refactor: Fix fmt warnings (again)
* chore: Update dependencies and improve feature configuration
* Add comprehensive tests for undertested modules (#36) (COPILOT)
* Add comprehensive tests for undertested modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
* Add comprehensive tests for ext, project, walk, and errors modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: Update dependencies and improve feature configuration
* fix: formatting errors in new tests
* chore: Update license list in about.toml
* chore: made functions input inline
* chore: updated cfg graph to take up the full page
* chore: add Prettier configuration and update code formatting
* Add frontend test suite with Vitest (111 tests) (#37)
* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7
* ci: add frontend test step to CI workflow
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: simplify array initialization in test files for consistency
* ran typecheck
* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage
* feat: update routing in AppLayout and improve empty state message in ExplorerPage
* feat: enhance scan progress tracking with additional metrics and stages
* feat: update license information and add license check script
* feat: implement cross-file symbolic execution with callee body persistence
* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering
* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions
* feat: enhance resource tracking with proxy method summaries and improve finding extraction
* feat: add terminal function exit detection for accurate resource leak analysis
* feat: add warnings for loops and functions without bodies to improve error recovery
* feat: update lambda expression handling to ensure proper function classification and control flow
* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling
* feat: add inline return taint analysis and regression tests for improved security checks
* feat: add engine version management and migration handling for database schema updates
* feat: enhance first_call_ident to skip nested function bodies and add regression tests
* feat: enhance callee name resolution with two-segment normalization and disambiguation
* feat: add cross-file context flags and debug assertions for taint analysis
* feat: refactor taint analysis structure to unify context handling and improve clarity
* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests
* docs: updated CHANGELOG.md
* fmt: formatting fixes
* fix: fixed frontend formatting and lint warnings
* fix: optimized ci
* fix: optimized ci
* Add comprehensive multi-file test coverage to Nyx (#38)
* Initial checklist for multi-file test suite expansion
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* deleted root repo
* rebuilt to test for regressions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* feat: enhance import alias resolution and taint tracking
* feat: implement security hardening with CSRF protection and path validation
* feat: add support for import alias bindings in Python, PHP, and Rust
* feat: enhance CFG analysis modes and improve code readability
* feat: add detection for parameterized SQL queries to enhance security
* feat: add safe internal redirect handling and enhance session destroy validation
* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads
* feat: enhance taint detection by adding support for inline source member expressions in call arguments
* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments
* feat: add support for Throw statement in control flow and error handling
* feat: add debug and echo endpoints with potential information leakage
* feat: implement internal redirect suppression and enhance taint detection
* feat: implement module alias tracking for dynamic dispatch in JS/TS
* feat: add authorization analysis module with Express support
* feat: add authorization analysis module with Express support
* feat: add tests for admin guard requirements and clean checks in authorization analysis
* feat: integrate Koa and Fastify frameworks into authorization analysis
* feat: add Flask and Django support to authorization analysis module
* feat: add support for Rails and Sinatra frameworks in authorization analysis
* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis
* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis
* feat: add support for Rails and Sinatra in authorization analysis
* chore: add .DS_Store to .gitignore
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: update usage of Option methods for improved clarity and consistency
* refactor: improve code readability by simplifying conditional checks and formatting
* refactor: improve code formatting and readability by simplifying conditional checks
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: simplify conditional checks in axum.rs for improved readability
* feat: add CodeQL analysis configuration for enhanced security scanning
* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)
* chore: start test coverage improvement work
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* test: add comprehensive tests for src/output.rs SARIF builder
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* refactor: improve code formatting and readability in output.rs
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* refactor: improve code formatting and readability in output.rs
* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* refactor: enhance triage file path handling with improved error management and validation
* refactor: updated func summaries for richer detail
* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries
* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution
* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls
* refactor: implement new Flask routes for safe and unsafe shell command execution
* refactor: separate receiver handling in SSA operations and enhance taint propagation
* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments
* refactor: implement auth decorator extraction and classification for multiple languages
* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation
* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic
* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior
* refactor: standardize default struct initialization across multiple files
* feat: add scripts for formatting checks and auto-fixes with test summaries
* refactor: simplify character splitting and enhance namespace qualifier handling
* refactor: improve documentation clarity and enhance code readability in resolver logic
* refactor: replace default struct initialization with explicit field assignments for clarity
* feat: enhance anonymous function naming by deriving context-based bindings
* refactor: streamline match expressions for improved readability and performance
* refactor: streamline match expressions for improved readability and performance
* refactor: replace loop with while let for improved clarity and performance
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis
* feat: add static map analysis for command injection suppression and type safety
* refactor: simplify match statements and reduce line breaks for improved readability
* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution
Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.
Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.
Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.
Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.
Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding
Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet. SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.
Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.
Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`. `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters. Dedup key extended with the primary location
so multi-site events aren't collapsed back together.
Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
!= ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
non-empty `file_rel` — the cap-only → None translation upstream
guarantees this.
Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved. A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.
build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.
Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing). All 1566 lib
tests + integration tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(output): phase 3/5 consume primary sink location in diag + SARIF
When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.
Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
resolved back to an absolute path via a shared resolve_file_rel
helper. Empty file_rel (single-file scans where namespace == "")
resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
locations[0] already reflects the primary sink position via the
updated diag line/col.
Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.
Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
inside the closure).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(bench): phase 4/5 validate primary sink attribution across corpus
Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.
Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
Case. When present, score_location_level additionally requires at
least one flow_step in the finding's evidence trace to fall within
±2 of the call-site range. When absent, the check is skipped —
fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
now-primary Diag.line post-phase-3).
Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
transform::wrap call site (a cross-file propagator, not a sink);
line 9 is Command::new, the real sink. The ±2 tolerance happened to
mask this stale attribution but it was semantically wrong — phase 4
is the right time to correct it. Also adds expected_call_site_lines
[8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
This fixture's sink (Command::new inside run_cmd at line 5) was the
motivating case for phases 1-3; adding the call-site assertion
guards against regression to caller-line attribution.
New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
takes two tainted params and invokes two Command sinks on
consecutive lines. Locks in that primary line lands inside the
helper (lines 5-6), not at the caller (line 12). Notes document
that SinkSite is currently one-per-callee so both findings today
collapse onto the first sink; expected_sink_lines=[5,6] and
expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
004): sink os.system lives in helper.py (cross-file), caller in
app.py reads env source and calls run_cmd. Verifies phase 3's
cross-file primary attribution: Diag.path = helper.py, Diag.line =
5, with app.py:7 recorded in flow_steps as a Call step.
Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test
Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body. Asserts the
resulting Finding.primary_location is exactly that triple.
The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file. This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.
Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).
Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: clean up formatting and improve readability in multiple files
* refactor: simplify type definition for deduplication key in findings
* test(harness): add must_not_match expectation for FP regression guards
Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules
* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking
* feat: update switch statement handling to improve control flow analysis
* feat: implement promisify alias handling for JS/TS to enhance taint tracking
* feat: enhance taint tracking by refining expectation handling and adding mode filtering
* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters
* feat: update taint tracking rules to enforce full mode matching and improve flow analysis
* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis
* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding
* feat: refine framework detection and update expectation handling for Echo and Sinatra
* feat: implement max_count for taint tracking expectations and deduplicate findings
* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files
* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity
* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files
* feat: add structural invariant checks for SSA bodies
* feat: ensure deterministic phi emission order using BTreeSet
* feat: enhance handling of terminators to ensure authoritative flow through successor edges
* feat: enhance Goto terminator handling to ensure all successors are marked executable
* feat: refactor code for improved readability and organization
* feat: simplify predicate checks and enhance readability in SSA handling
* feat: implement per-file parse timeout and enhance file size handling
* feat: migrate analysis engine toggles from environment variables to configuration file
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: update dependencies and enhance documentation on language maturity
* feat: enhance security headers and improve request body limits
* feat: implement sink capability bits for deduplication and enhance evidence tagging
* feat: implement dynamic activation handling for gated sinks and enhance validation logic
* feat: enhance configuration documentation and clarify inline analysis cache behavior
* feat: implement panic recovery during analysis to continue scans past errors
* feat: add expectations configuration for taint analysis and performance metrics
* feat: enhance error handling and logging during file reading and mutex locking
* feat: add cross-file body loading tests and plumbing for CF-1 phase
* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures
* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality
* feat: enhance classification span handling in CFG and AST for improved source attribution
* feat: add new Express routes for handling user input and telemetry data
* feat: implement ternary expression handling in CFG with diamond structure for JS/TS
* feat: implement Phase CF-3 abstract-domain transfer channels in summaries
* feat: add support for string-prefix transfer in cross-file calls and update tests
* docs: reduce RESULTS.md doc size
* feat: implement Phase CF-4 per-return-path summary decomposition with tests
* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization
* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests
* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests
* refactor: update comments and documentation for clarity and consistency
* style: format code for consistency and readability
* refactor: simplify verdict handling and improve edge checking logic
* refactor: optimize path and identifier collection by avoiding unnecessary cloning
* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults
* refactor: update documentation and improve clarity in configuration files
* refactor: update documentation and improve clarity in configuration files
* feat: add JS/TS pass-2 convergence tests and expectations configuration
* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic
* feat: implement Phase 7 deduplication and alternative path linking for taint findings
* feat: implement structural DFS index for anonymous functions and update naming conventions
* feat: add Phase 8 regression tests for container-element taint in JS and Python
* feat: add engine-depth profiles and explain-engine option for CLI
* feat: update expectations and add new README fixtures for multi-file scan regression
* feat: implement Phase 11 callback-alias and factory patterns with regression tests
* feat: implement Terminator::Switch for multi-way dispatch and add regression tests
* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants
* refactor: extract cfg and ssa_transfer to submodules
* refactor: cargo fmt
* refactor: remove unnecessary blank line in cfg_tests.rs
* refactor: remove unnecessary planning file
* chore: update Rust version to 1.88 and bump dependencies in Cargo files
* feat: enhance triage UI with new layout and controls, update README for clarity
* feat: enhance triage UI with new layout and controls, update README for clarity
* chore: remove outdated section from README for version 0.5.0
* docs: improve clarity and consistency in README content
* chore: add "GPL-3.0-or-later" to license options in about.toml
* chore: update license handling in about.toml and check-licenses.mjs
* style: format code for improved readability in TriagePage component
* style: format code for improved readability in TriagePage component
* chore: enhance license handling and improve body_id scoping in seed lookup
* feat: introduce owner and parent body IDs for enhanced seed scoping
* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating
* feat: add Undef SSA operation for improved control-flow handling
* style: improve code formatting for consistency and readability in multiple files
* feat: add 16-function chain SCC across multiple files for enhanced analysis
* style: simplify code formatting for improved readability in multiple files
* fix: update CapHitReason default implementation and improve README clarity
* docs: enhance README with detailed explanations of taint analysis and limitations
* docs: refine README for clarity and consistency in taint analysis section
* style: improve code formatting for better readability in NewScanModal and scans
* fix: update cargo-about command to use --offline for deterministic license generation
* fix: update cargo-about command to use --offline for deterministic license generation
* ci: add step to prime cargo registry cache for deterministic license generation
* feat: add support for non-sink collections in authorization analysis
* feat: enhance authorization checks with row-level ownership equality and binding tracking
* feat: implement self-scoped user handling and enhance ownership checks
* refactor: simplify assertions and formatting in authorization analysis tests
* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure
* docs: update AI disclosure section for clarity and conciseness
* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure
* feat: enhance authorization analysis with SSA-derived variable type classification
* feat: implement auth_finding_to_diag function for enhanced security diagnostics
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag
* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks
* feat: enhance error message handling in cli_validation_tests for better Windows compatibility
* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration
* feat: enhance release build process with SBOM generation and SLSA provenance
* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: update benchmark data and enhance path sanitization logic with new safety checks
* feat: document AI assistance in frontend UI development and human review process
* feat: add return path facts for enhanced path safety checks and update documentation
* chore: update release date for version 0.5.0 in CHANGELOG.md
* chore: clean up ci.yml by removing outdated comments and clarifying steps
* feat: implement cross-language path sanitizers and validators for enhanced security
* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks
* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases
* refactor: simplify conditional formatting and improve code readability in executor and lower modules
* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests
* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs
---------
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-25 17:59:11 -04:00
|
|
|
if content.contains("gin-gonic/gin") {
|
|
|
|
|
fws.push(DetectedFramework::Gin);
|
|
|
|
|
}
|
|
|
|
|
if content.contains("labstack/echo") {
|
|
|
|
|
fws.push(DetectedFramework::Echo);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// ── PHP (composer.json) ──
|
|
|
|
|
if let Some(content) = read_bounded(&root.join("composer.json")) {
|
2026-05-02 16:44:49 -04:00
|
|
|
inspected.insert("php");
|
Release/0.5.0 (#35)
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures
* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests
* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements
* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles
* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing
* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling
* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures
* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration
* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests
* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic
* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection
* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements
* feat: Enable auth-state analysis by default and update relevant tests in benchmark config
* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test
* docs: update CHANGELOG.md
* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers
* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers
* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse
* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation
* feat: Refactor function parameters and constants for improved clarity and maintainability
* refactor: Reorder module imports and improve formatting for consistency
* refactor: Fix formatting erorrs
* refactor: Fix clippy warnings
* refactor: Fix fmt warnings (again)
* chore: Update dependencies and improve feature configuration
* Add comprehensive tests for undertested modules (#36) (COPILOT)
* Add comprehensive tests for undertested modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
* Add comprehensive tests for ext, project, walk, and errors modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: Update dependencies and improve feature configuration
* fix: formatting errors in new tests
* chore: Update license list in about.toml
* chore: made functions input inline
* chore: updated cfg graph to take up the full page
* chore: add Prettier configuration and update code formatting
* Add frontend test suite with Vitest (111 tests) (#37)
* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7
* ci: add frontend test step to CI workflow
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: simplify array initialization in test files for consistency
* ran typecheck
* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage
* feat: update routing in AppLayout and improve empty state message in ExplorerPage
* feat: enhance scan progress tracking with additional metrics and stages
* feat: update license information and add license check script
* feat: implement cross-file symbolic execution with callee body persistence
* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering
* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions
* feat: enhance resource tracking with proxy method summaries and improve finding extraction
* feat: add terminal function exit detection for accurate resource leak analysis
* feat: add warnings for loops and functions without bodies to improve error recovery
* feat: update lambda expression handling to ensure proper function classification and control flow
* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling
* feat: add inline return taint analysis and regression tests for improved security checks
* feat: add engine version management and migration handling for database schema updates
* feat: enhance first_call_ident to skip nested function bodies and add regression tests
* feat: enhance callee name resolution with two-segment normalization and disambiguation
* feat: add cross-file context flags and debug assertions for taint analysis
* feat: refactor taint analysis structure to unify context handling and improve clarity
* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests
* docs: updated CHANGELOG.md
* fmt: formatting fixes
* fix: fixed frontend formatting and lint warnings
* fix: optimized ci
* fix: optimized ci
* Add comprehensive multi-file test coverage to Nyx (#38)
* Initial checklist for multi-file test suite expansion
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* deleted root repo
* rebuilt to test for regressions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* feat: enhance import alias resolution and taint tracking
* feat: implement security hardening with CSRF protection and path validation
* feat: add support for import alias bindings in Python, PHP, and Rust
* feat: enhance CFG analysis modes and improve code readability
* feat: add detection for parameterized SQL queries to enhance security
* feat: add safe internal redirect handling and enhance session destroy validation
* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads
* feat: enhance taint detection by adding support for inline source member expressions in call arguments
* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments
* feat: add support for Throw statement in control flow and error handling
* feat: add debug and echo endpoints with potential information leakage
* feat: implement internal redirect suppression and enhance taint detection
* feat: implement module alias tracking for dynamic dispatch in JS/TS
* feat: add authorization analysis module with Express support
* feat: add authorization analysis module with Express support
* feat: add tests for admin guard requirements and clean checks in authorization analysis
* feat: integrate Koa and Fastify frameworks into authorization analysis
* feat: add Flask and Django support to authorization analysis module
* feat: add support for Rails and Sinatra frameworks in authorization analysis
* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis
* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis
* feat: add support for Rails and Sinatra in authorization analysis
* chore: add .DS_Store to .gitignore
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: update usage of Option methods for improved clarity and consistency
* refactor: improve code readability by simplifying conditional checks and formatting
* refactor: improve code formatting and readability by simplifying conditional checks
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: simplify conditional checks in axum.rs for improved readability
* feat: add CodeQL analysis configuration for enhanced security scanning
* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)
* chore: start test coverage improvement work
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* test: add comprehensive tests for src/output.rs SARIF builder
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* refactor: improve code formatting and readability in output.rs
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* refactor: improve code formatting and readability in output.rs
* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* refactor: enhance triage file path handling with improved error management and validation
* refactor: updated func summaries for richer detail
* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries
* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution
* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls
* refactor: implement new Flask routes for safe and unsafe shell command execution
* refactor: separate receiver handling in SSA operations and enhance taint propagation
* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments
* refactor: implement auth decorator extraction and classification for multiple languages
* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation
* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic
* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior
* refactor: standardize default struct initialization across multiple files
* feat: add scripts for formatting checks and auto-fixes with test summaries
* refactor: simplify character splitting and enhance namespace qualifier handling
* refactor: improve documentation clarity and enhance code readability in resolver logic
* refactor: replace default struct initialization with explicit field assignments for clarity
* feat: enhance anonymous function naming by deriving context-based bindings
* refactor: streamline match expressions for improved readability and performance
* refactor: streamline match expressions for improved readability and performance
* refactor: replace loop with while let for improved clarity and performance
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis
* feat: add static map analysis for command injection suppression and type safety
* refactor: simplify match statements and reduce line breaks for improved readability
* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution
Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.
Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.
Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.
Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.
Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding
Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet. SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.
Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.
Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`. `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters. Dedup key extended with the primary location
so multi-site events aren't collapsed back together.
Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
!= ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
non-empty `file_rel` — the cap-only → None translation upstream
guarantees this.
Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved. A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.
build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.
Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing). All 1566 lib
tests + integration tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(output): phase 3/5 consume primary sink location in diag + SARIF
When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.
Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
resolved back to an absolute path via a shared resolve_file_rel
helper. Empty file_rel (single-file scans where namespace == "")
resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
locations[0] already reflects the primary sink position via the
updated diag line/col.
Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.
Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
inside the closure).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(bench): phase 4/5 validate primary sink attribution across corpus
Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.
Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
Case. When present, score_location_level additionally requires at
least one flow_step in the finding's evidence trace to fall within
±2 of the call-site range. When absent, the check is skipped —
fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
now-primary Diag.line post-phase-3).
Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
transform::wrap call site (a cross-file propagator, not a sink);
line 9 is Command::new, the real sink. The ±2 tolerance happened to
mask this stale attribution but it was semantically wrong — phase 4
is the right time to correct it. Also adds expected_call_site_lines
[8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
This fixture's sink (Command::new inside run_cmd at line 5) was the
motivating case for phases 1-3; adding the call-site assertion
guards against regression to caller-line attribution.
New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
takes two tainted params and invokes two Command sinks on
consecutive lines. Locks in that primary line lands inside the
helper (lines 5-6), not at the caller (line 12). Notes document
that SinkSite is currently one-per-callee so both findings today
collapse onto the first sink; expected_sink_lines=[5,6] and
expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
004): sink os.system lives in helper.py (cross-file), caller in
app.py reads env source and calls run_cmd. Verifies phase 3's
cross-file primary attribution: Diag.path = helper.py, Diag.line =
5, with app.py:7 recorded in flow_steps as a Call step.
Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test
Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body. Asserts the
resulting Finding.primary_location is exactly that triple.
The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file. This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.
Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).
Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: clean up formatting and improve readability in multiple files
* refactor: simplify type definition for deduplication key in findings
* test(harness): add must_not_match expectation for FP regression guards
Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules
* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking
* feat: update switch statement handling to improve control flow analysis
* feat: implement promisify alias handling for JS/TS to enhance taint tracking
* feat: enhance taint tracking by refining expectation handling and adding mode filtering
* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters
* feat: update taint tracking rules to enforce full mode matching and improve flow analysis
* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis
* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding
* feat: refine framework detection and update expectation handling for Echo and Sinatra
* feat: implement max_count for taint tracking expectations and deduplicate findings
* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files
* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity
* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files
* feat: add structural invariant checks for SSA bodies
* feat: ensure deterministic phi emission order using BTreeSet
* feat: enhance handling of terminators to ensure authoritative flow through successor edges
* feat: enhance Goto terminator handling to ensure all successors are marked executable
* feat: refactor code for improved readability and organization
* feat: simplify predicate checks and enhance readability in SSA handling
* feat: implement per-file parse timeout and enhance file size handling
* feat: migrate analysis engine toggles from environment variables to configuration file
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: update dependencies and enhance documentation on language maturity
* feat: enhance security headers and improve request body limits
* feat: implement sink capability bits for deduplication and enhance evidence tagging
* feat: implement dynamic activation handling for gated sinks and enhance validation logic
* feat: enhance configuration documentation and clarify inline analysis cache behavior
* feat: implement panic recovery during analysis to continue scans past errors
* feat: add expectations configuration for taint analysis and performance metrics
* feat: enhance error handling and logging during file reading and mutex locking
* feat: add cross-file body loading tests and plumbing for CF-1 phase
* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures
* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality
* feat: enhance classification span handling in CFG and AST for improved source attribution
* feat: add new Express routes for handling user input and telemetry data
* feat: implement ternary expression handling in CFG with diamond structure for JS/TS
* feat: implement Phase CF-3 abstract-domain transfer channels in summaries
* feat: add support for string-prefix transfer in cross-file calls and update tests
* docs: reduce RESULTS.md doc size
* feat: implement Phase CF-4 per-return-path summary decomposition with tests
* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization
* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests
* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests
* refactor: update comments and documentation for clarity and consistency
* style: format code for consistency and readability
* refactor: simplify verdict handling and improve edge checking logic
* refactor: optimize path and identifier collection by avoiding unnecessary cloning
* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults
* refactor: update documentation and improve clarity in configuration files
* refactor: update documentation and improve clarity in configuration files
* feat: add JS/TS pass-2 convergence tests and expectations configuration
* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic
* feat: implement Phase 7 deduplication and alternative path linking for taint findings
* feat: implement structural DFS index for anonymous functions and update naming conventions
* feat: add Phase 8 regression tests for container-element taint in JS and Python
* feat: add engine-depth profiles and explain-engine option for CLI
* feat: update expectations and add new README fixtures for multi-file scan regression
* feat: implement Phase 11 callback-alias and factory patterns with regression tests
* feat: implement Terminator::Switch for multi-way dispatch and add regression tests
* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants
* refactor: extract cfg and ssa_transfer to submodules
* refactor: cargo fmt
* refactor: remove unnecessary blank line in cfg_tests.rs
* refactor: remove unnecessary planning file
* chore: update Rust version to 1.88 and bump dependencies in Cargo files
* feat: enhance triage UI with new layout and controls, update README for clarity
* feat: enhance triage UI with new layout and controls, update README for clarity
* chore: remove outdated section from README for version 0.5.0
* docs: improve clarity and consistency in README content
* chore: add "GPL-3.0-or-later" to license options in about.toml
* chore: update license handling in about.toml and check-licenses.mjs
* style: format code for improved readability in TriagePage component
* style: format code for improved readability in TriagePage component
* chore: enhance license handling and improve body_id scoping in seed lookup
* feat: introduce owner and parent body IDs for enhanced seed scoping
* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating
* feat: add Undef SSA operation for improved control-flow handling
* style: improve code formatting for consistency and readability in multiple files
* feat: add 16-function chain SCC across multiple files for enhanced analysis
* style: simplify code formatting for improved readability in multiple files
* fix: update CapHitReason default implementation and improve README clarity
* docs: enhance README with detailed explanations of taint analysis and limitations
* docs: refine README for clarity and consistency in taint analysis section
* style: improve code formatting for better readability in NewScanModal and scans
* fix: update cargo-about command to use --offline for deterministic license generation
* fix: update cargo-about command to use --offline for deterministic license generation
* ci: add step to prime cargo registry cache for deterministic license generation
* feat: add support for non-sink collections in authorization analysis
* feat: enhance authorization checks with row-level ownership equality and binding tracking
* feat: implement self-scoped user handling and enhance ownership checks
* refactor: simplify assertions and formatting in authorization analysis tests
* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure
* docs: update AI disclosure section for clarity and conciseness
* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure
* feat: enhance authorization analysis with SSA-derived variable type classification
* feat: implement auth_finding_to_diag function for enhanced security diagnostics
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag
* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks
* feat: enhance error message handling in cli_validation_tests for better Windows compatibility
* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration
* feat: enhance release build process with SBOM generation and SLSA provenance
* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: update benchmark data and enhance path sanitization logic with new safety checks
* feat: document AI assistance in frontend UI development and human review process
* feat: add return path facts for enhanced path safety checks and update documentation
* chore: update release date for version 0.5.0 in CHANGELOG.md
* chore: clean up ci.yml by removing outdated comments and clarifying steps
* feat: implement cross-language path sanitizers and validators for enhanced security
* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks
* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases
* refactor: simplify conditional formatting and improve code readability in executor and lower modules
* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests
* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs
---------
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-25 17:59:11 -04:00
|
|
|
if content.contains("laravel/framework") {
|
|
|
|
|
fws.push(DetectedFramework::Laravel);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// ── Ruby (Gemfile) ──
|
|
|
|
|
if let Some(content) = read_bounded(&root.join("Gemfile")) {
|
2026-05-02 16:44:49 -04:00
|
|
|
inspected.insert("ruby");
|
Release/0.5.0 (#35)
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures
* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests
* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements
* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles
* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing
* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling
* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures
* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration
* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests
* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic
* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection
* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements
* feat: Enable auth-state analysis by default and update relevant tests in benchmark config
* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test
* docs: update CHANGELOG.md
* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers
* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers
* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse
* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation
* feat: Refactor function parameters and constants for improved clarity and maintainability
* refactor: Reorder module imports and improve formatting for consistency
* refactor: Fix formatting erorrs
* refactor: Fix clippy warnings
* refactor: Fix fmt warnings (again)
* chore: Update dependencies and improve feature configuration
* Add comprehensive tests for undertested modules (#36) (COPILOT)
* Add comprehensive tests for undertested modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
* Add comprehensive tests for ext, project, walk, and errors modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: Update dependencies and improve feature configuration
* fix: formatting errors in new tests
* chore: Update license list in about.toml
* chore: made functions input inline
* chore: updated cfg graph to take up the full page
* chore: add Prettier configuration and update code formatting
* Add frontend test suite with Vitest (111 tests) (#37)
* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7
* ci: add frontend test step to CI workflow
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: simplify array initialization in test files for consistency
* ran typecheck
* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage
* feat: update routing in AppLayout and improve empty state message in ExplorerPage
* feat: enhance scan progress tracking with additional metrics and stages
* feat: update license information and add license check script
* feat: implement cross-file symbolic execution with callee body persistence
* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering
* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions
* feat: enhance resource tracking with proxy method summaries and improve finding extraction
* feat: add terminal function exit detection for accurate resource leak analysis
* feat: add warnings for loops and functions without bodies to improve error recovery
* feat: update lambda expression handling to ensure proper function classification and control flow
* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling
* feat: add inline return taint analysis and regression tests for improved security checks
* feat: add engine version management and migration handling for database schema updates
* feat: enhance first_call_ident to skip nested function bodies and add regression tests
* feat: enhance callee name resolution with two-segment normalization and disambiguation
* feat: add cross-file context flags and debug assertions for taint analysis
* feat: refactor taint analysis structure to unify context handling and improve clarity
* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests
* docs: updated CHANGELOG.md
* fmt: formatting fixes
* fix: fixed frontend formatting and lint warnings
* fix: optimized ci
* fix: optimized ci
* Add comprehensive multi-file test coverage to Nyx (#38)
* Initial checklist for multi-file test suite expansion
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* deleted root repo
* rebuilt to test for regressions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* feat: enhance import alias resolution and taint tracking
* feat: implement security hardening with CSRF protection and path validation
* feat: add support for import alias bindings in Python, PHP, and Rust
* feat: enhance CFG analysis modes and improve code readability
* feat: add detection for parameterized SQL queries to enhance security
* feat: add safe internal redirect handling and enhance session destroy validation
* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads
* feat: enhance taint detection by adding support for inline source member expressions in call arguments
* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments
* feat: add support for Throw statement in control flow and error handling
* feat: add debug and echo endpoints with potential information leakage
* feat: implement internal redirect suppression and enhance taint detection
* feat: implement module alias tracking for dynamic dispatch in JS/TS
* feat: add authorization analysis module with Express support
* feat: add authorization analysis module with Express support
* feat: add tests for admin guard requirements and clean checks in authorization analysis
* feat: integrate Koa and Fastify frameworks into authorization analysis
* feat: add Flask and Django support to authorization analysis module
* feat: add support for Rails and Sinatra frameworks in authorization analysis
* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis
* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis
* feat: add support for Rails and Sinatra in authorization analysis
* chore: add .DS_Store to .gitignore
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: update usage of Option methods for improved clarity and consistency
* refactor: improve code readability by simplifying conditional checks and formatting
* refactor: improve code formatting and readability by simplifying conditional checks
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: simplify conditional checks in axum.rs for improved readability
* feat: add CodeQL analysis configuration for enhanced security scanning
* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)
* chore: start test coverage improvement work
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* test: add comprehensive tests for src/output.rs SARIF builder
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* refactor: improve code formatting and readability in output.rs
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* refactor: improve code formatting and readability in output.rs
* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* refactor: enhance triage file path handling with improved error management and validation
* refactor: updated func summaries for richer detail
* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries
* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution
* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls
* refactor: implement new Flask routes for safe and unsafe shell command execution
* refactor: separate receiver handling in SSA operations and enhance taint propagation
* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments
* refactor: implement auth decorator extraction and classification for multiple languages
* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation
* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic
* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior
* refactor: standardize default struct initialization across multiple files
* feat: add scripts for formatting checks and auto-fixes with test summaries
* refactor: simplify character splitting and enhance namespace qualifier handling
* refactor: improve documentation clarity and enhance code readability in resolver logic
* refactor: replace default struct initialization with explicit field assignments for clarity
* feat: enhance anonymous function naming by deriving context-based bindings
* refactor: streamline match expressions for improved readability and performance
* refactor: streamline match expressions for improved readability and performance
* refactor: replace loop with while let for improved clarity and performance
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis
* feat: add static map analysis for command injection suppression and type safety
* refactor: simplify match statements and reduce line breaks for improved readability
* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution
Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.
Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.
Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.
Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.
Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding
Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet. SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.
Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.
Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`. `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters. Dedup key extended with the primary location
so multi-site events aren't collapsed back together.
Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
!= ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
non-empty `file_rel` — the cap-only → None translation upstream
guarantees this.
Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved. A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.
build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.
Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing). All 1566 lib
tests + integration tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(output): phase 3/5 consume primary sink location in diag + SARIF
When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.
Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
resolved back to an absolute path via a shared resolve_file_rel
helper. Empty file_rel (single-file scans where namespace == "")
resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
locations[0] already reflects the primary sink position via the
updated diag line/col.
Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.
Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
inside the closure).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(bench): phase 4/5 validate primary sink attribution across corpus
Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.
Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
Case. When present, score_location_level additionally requires at
least one flow_step in the finding's evidence trace to fall within
±2 of the call-site range. When absent, the check is skipped —
fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
now-primary Diag.line post-phase-3).
Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
transform::wrap call site (a cross-file propagator, not a sink);
line 9 is Command::new, the real sink. The ±2 tolerance happened to
mask this stale attribution but it was semantically wrong — phase 4
is the right time to correct it. Also adds expected_call_site_lines
[8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
This fixture's sink (Command::new inside run_cmd at line 5) was the
motivating case for phases 1-3; adding the call-site assertion
guards against regression to caller-line attribution.
New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
takes two tainted params and invokes two Command sinks on
consecutive lines. Locks in that primary line lands inside the
helper (lines 5-6), not at the caller (line 12). Notes document
that SinkSite is currently one-per-callee so both findings today
collapse onto the first sink; expected_sink_lines=[5,6] and
expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
004): sink os.system lives in helper.py (cross-file), caller in
app.py reads env source and calls run_cmd. Verifies phase 3's
cross-file primary attribution: Diag.path = helper.py, Diag.line =
5, with app.py:7 recorded in flow_steps as a Call step.
Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test
Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body. Asserts the
resulting Finding.primary_location is exactly that triple.
The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file. This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.
Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).
Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: clean up formatting and improve readability in multiple files
* refactor: simplify type definition for deduplication key in findings
* test(harness): add must_not_match expectation for FP regression guards
Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules
* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking
* feat: update switch statement handling to improve control flow analysis
* feat: implement promisify alias handling for JS/TS to enhance taint tracking
* feat: enhance taint tracking by refining expectation handling and adding mode filtering
* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters
* feat: update taint tracking rules to enforce full mode matching and improve flow analysis
* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis
* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding
* feat: refine framework detection and update expectation handling for Echo and Sinatra
* feat: implement max_count for taint tracking expectations and deduplicate findings
* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files
* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity
* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files
* feat: add structural invariant checks for SSA bodies
* feat: ensure deterministic phi emission order using BTreeSet
* feat: enhance handling of terminators to ensure authoritative flow through successor edges
* feat: enhance Goto terminator handling to ensure all successors are marked executable
* feat: refactor code for improved readability and organization
* feat: simplify predicate checks and enhance readability in SSA handling
* feat: implement per-file parse timeout and enhance file size handling
* feat: migrate analysis engine toggles from environment variables to configuration file
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: update dependencies and enhance documentation on language maturity
* feat: enhance security headers and improve request body limits
* feat: implement sink capability bits for deduplication and enhance evidence tagging
* feat: implement dynamic activation handling for gated sinks and enhance validation logic
* feat: enhance configuration documentation and clarify inline analysis cache behavior
* feat: implement panic recovery during analysis to continue scans past errors
* feat: add expectations configuration for taint analysis and performance metrics
* feat: enhance error handling and logging during file reading and mutex locking
* feat: add cross-file body loading tests and plumbing for CF-1 phase
* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures
* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality
* feat: enhance classification span handling in CFG and AST for improved source attribution
* feat: add new Express routes for handling user input and telemetry data
* feat: implement ternary expression handling in CFG with diamond structure for JS/TS
* feat: implement Phase CF-3 abstract-domain transfer channels in summaries
* feat: add support for string-prefix transfer in cross-file calls and update tests
* docs: reduce RESULTS.md doc size
* feat: implement Phase CF-4 per-return-path summary decomposition with tests
* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization
* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests
* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests
* refactor: update comments and documentation for clarity and consistency
* style: format code for consistency and readability
* refactor: simplify verdict handling and improve edge checking logic
* refactor: optimize path and identifier collection by avoiding unnecessary cloning
* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults
* refactor: update documentation and improve clarity in configuration files
* refactor: update documentation and improve clarity in configuration files
* feat: add JS/TS pass-2 convergence tests and expectations configuration
* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic
* feat: implement Phase 7 deduplication and alternative path linking for taint findings
* feat: implement structural DFS index for anonymous functions and update naming conventions
* feat: add Phase 8 regression tests for container-element taint in JS and Python
* feat: add engine-depth profiles and explain-engine option for CLI
* feat: update expectations and add new README fixtures for multi-file scan regression
* feat: implement Phase 11 callback-alias and factory patterns with regression tests
* feat: implement Terminator::Switch for multi-way dispatch and add regression tests
* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants
* refactor: extract cfg and ssa_transfer to submodules
* refactor: cargo fmt
* refactor: remove unnecessary blank line in cfg_tests.rs
* refactor: remove unnecessary planning file
* chore: update Rust version to 1.88 and bump dependencies in Cargo files
* feat: enhance triage UI with new layout and controls, update README for clarity
* feat: enhance triage UI with new layout and controls, update README for clarity
* chore: remove outdated section from README for version 0.5.0
* docs: improve clarity and consistency in README content
* chore: add "GPL-3.0-or-later" to license options in about.toml
* chore: update license handling in about.toml and check-licenses.mjs
* style: format code for improved readability in TriagePage component
* style: format code for improved readability in TriagePage component
* chore: enhance license handling and improve body_id scoping in seed lookup
* feat: introduce owner and parent body IDs for enhanced seed scoping
* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating
* feat: add Undef SSA operation for improved control-flow handling
* style: improve code formatting for consistency and readability in multiple files
* feat: add 16-function chain SCC across multiple files for enhanced analysis
* style: simplify code formatting for improved readability in multiple files
* fix: update CapHitReason default implementation and improve README clarity
* docs: enhance README with detailed explanations of taint analysis and limitations
* docs: refine README for clarity and consistency in taint analysis section
* style: improve code formatting for better readability in NewScanModal and scans
* fix: update cargo-about command to use --offline for deterministic license generation
* fix: update cargo-about command to use --offline for deterministic license generation
* ci: add step to prime cargo registry cache for deterministic license generation
* feat: add support for non-sink collections in authorization analysis
* feat: enhance authorization checks with row-level ownership equality and binding tracking
* feat: implement self-scoped user handling and enhance ownership checks
* refactor: simplify assertions and formatting in authorization analysis tests
* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure
* docs: update AI disclosure section for clarity and conciseness
* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure
* feat: enhance authorization analysis with SSA-derived variable type classification
* feat: implement auth_finding_to_diag function for enhanced security diagnostics
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag
* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks
* feat: enhance error message handling in cli_validation_tests for better Windows compatibility
* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration
* feat: enhance release build process with SBOM generation and SLSA provenance
* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: update benchmark data and enhance path sanitization logic with new safety checks
* feat: document AI assistance in frontend UI development and human review process
* feat: add return path facts for enhanced path safety checks and update documentation
* chore: update release date for version 0.5.0 in CHANGELOG.md
* chore: clean up ci.yml by removing outdated comments and clarifying steps
* feat: implement cross-language path sanitizers and validators for enhanced security
* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks
* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases
* refactor: simplify conditional formatting and improve code readability in executor and lower modules
* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests
* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs
---------
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-25 17:59:11 -04:00
|
|
|
if content.contains("'rails'") || content.contains("\"rails\"") {
|
|
|
|
|
fws.push(DetectedFramework::Rails);
|
|
|
|
|
}
|
|
|
|
|
if content.contains("'sinatra'") || content.contains("\"sinatra\"") {
|
|
|
|
|
fws.push(DetectedFramework::Sinatra);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// ── Rust (Cargo.toml) ──
|
|
|
|
|
if let Some(content) = read_bounded(&root.join("Cargo.toml")) {
|
2026-05-02 16:44:49 -04:00
|
|
|
inspected.insert("rust");
|
Release/0.5.0 (#35)
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures
* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests
* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements
* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles
* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing
* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling
* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures
* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration
* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests
* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic
* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection
* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements
* feat: Enable auth-state analysis by default and update relevant tests in benchmark config
* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test
* docs: update CHANGELOG.md
* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers
* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers
* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse
* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation
* feat: Refactor function parameters and constants for improved clarity and maintainability
* refactor: Reorder module imports and improve formatting for consistency
* refactor: Fix formatting erorrs
* refactor: Fix clippy warnings
* refactor: Fix fmt warnings (again)
* chore: Update dependencies and improve feature configuration
* Add comprehensive tests for undertested modules (#36) (COPILOT)
* Add comprehensive tests for undertested modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
* Add comprehensive tests for ext, project, walk, and errors modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: Update dependencies and improve feature configuration
* fix: formatting errors in new tests
* chore: Update license list in about.toml
* chore: made functions input inline
* chore: updated cfg graph to take up the full page
* chore: add Prettier configuration and update code formatting
* Add frontend test suite with Vitest (111 tests) (#37)
* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7
* ci: add frontend test step to CI workflow
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: simplify array initialization in test files for consistency
* ran typecheck
* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage
* feat: update routing in AppLayout and improve empty state message in ExplorerPage
* feat: enhance scan progress tracking with additional metrics and stages
* feat: update license information and add license check script
* feat: implement cross-file symbolic execution with callee body persistence
* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering
* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions
* feat: enhance resource tracking with proxy method summaries and improve finding extraction
* feat: add terminal function exit detection for accurate resource leak analysis
* feat: add warnings for loops and functions without bodies to improve error recovery
* feat: update lambda expression handling to ensure proper function classification and control flow
* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling
* feat: add inline return taint analysis and regression tests for improved security checks
* feat: add engine version management and migration handling for database schema updates
* feat: enhance first_call_ident to skip nested function bodies and add regression tests
* feat: enhance callee name resolution with two-segment normalization and disambiguation
* feat: add cross-file context flags and debug assertions for taint analysis
* feat: refactor taint analysis structure to unify context handling and improve clarity
* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests
* docs: updated CHANGELOG.md
* fmt: formatting fixes
* fix: fixed frontend formatting and lint warnings
* fix: optimized ci
* fix: optimized ci
* Add comprehensive multi-file test coverage to Nyx (#38)
* Initial checklist for multi-file test suite expansion
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* deleted root repo
* rebuilt to test for regressions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* feat: enhance import alias resolution and taint tracking
* feat: implement security hardening with CSRF protection and path validation
* feat: add support for import alias bindings in Python, PHP, and Rust
* feat: enhance CFG analysis modes and improve code readability
* feat: add detection for parameterized SQL queries to enhance security
* feat: add safe internal redirect handling and enhance session destroy validation
* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads
* feat: enhance taint detection by adding support for inline source member expressions in call arguments
* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments
* feat: add support for Throw statement in control flow and error handling
* feat: add debug and echo endpoints with potential information leakage
* feat: implement internal redirect suppression and enhance taint detection
* feat: implement module alias tracking for dynamic dispatch in JS/TS
* feat: add authorization analysis module with Express support
* feat: add authorization analysis module with Express support
* feat: add tests for admin guard requirements and clean checks in authorization analysis
* feat: integrate Koa and Fastify frameworks into authorization analysis
* feat: add Flask and Django support to authorization analysis module
* feat: add support for Rails and Sinatra frameworks in authorization analysis
* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis
* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis
* feat: add support for Rails and Sinatra in authorization analysis
* chore: add .DS_Store to .gitignore
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: update usage of Option methods for improved clarity and consistency
* refactor: improve code readability by simplifying conditional checks and formatting
* refactor: improve code formatting and readability by simplifying conditional checks
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: simplify conditional checks in axum.rs for improved readability
* feat: add CodeQL analysis configuration for enhanced security scanning
* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)
* chore: start test coverage improvement work
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* test: add comprehensive tests for src/output.rs SARIF builder
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* refactor: improve code formatting and readability in output.rs
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* refactor: improve code formatting and readability in output.rs
* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* refactor: enhance triage file path handling with improved error management and validation
* refactor: updated func summaries for richer detail
* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries
* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution
* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls
* refactor: implement new Flask routes for safe and unsafe shell command execution
* refactor: separate receiver handling in SSA operations and enhance taint propagation
* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments
* refactor: implement auth decorator extraction and classification for multiple languages
* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation
* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic
* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior
* refactor: standardize default struct initialization across multiple files
* feat: add scripts for formatting checks and auto-fixes with test summaries
* refactor: simplify character splitting and enhance namespace qualifier handling
* refactor: improve documentation clarity and enhance code readability in resolver logic
* refactor: replace default struct initialization with explicit field assignments for clarity
* feat: enhance anonymous function naming by deriving context-based bindings
* refactor: streamline match expressions for improved readability and performance
* refactor: streamline match expressions for improved readability and performance
* refactor: replace loop with while let for improved clarity and performance
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis
* feat: add static map analysis for command injection suppression and type safety
* refactor: simplify match statements and reduce line breaks for improved readability
* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution
Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.
Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.
Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.
Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.
Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding
Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet. SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.
Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.
Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`. `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters. Dedup key extended with the primary location
so multi-site events aren't collapsed back together.
Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
!= ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
non-empty `file_rel` — the cap-only → None translation upstream
guarantees this.
Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved. A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.
build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.
Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing). All 1566 lib
tests + integration tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(output): phase 3/5 consume primary sink location in diag + SARIF
When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.
Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
resolved back to an absolute path via a shared resolve_file_rel
helper. Empty file_rel (single-file scans where namespace == "")
resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
locations[0] already reflects the primary sink position via the
updated diag line/col.
Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.
Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
inside the closure).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(bench): phase 4/5 validate primary sink attribution across corpus
Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.
Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
Case. When present, score_location_level additionally requires at
least one flow_step in the finding's evidence trace to fall within
±2 of the call-site range. When absent, the check is skipped —
fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
now-primary Diag.line post-phase-3).
Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
transform::wrap call site (a cross-file propagator, not a sink);
line 9 is Command::new, the real sink. The ±2 tolerance happened to
mask this stale attribution but it was semantically wrong — phase 4
is the right time to correct it. Also adds expected_call_site_lines
[8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
This fixture's sink (Command::new inside run_cmd at line 5) was the
motivating case for phases 1-3; adding the call-site assertion
guards against regression to caller-line attribution.
New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
takes two tainted params and invokes two Command sinks on
consecutive lines. Locks in that primary line lands inside the
helper (lines 5-6), not at the caller (line 12). Notes document
that SinkSite is currently one-per-callee so both findings today
collapse onto the first sink; expected_sink_lines=[5,6] and
expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
004): sink os.system lives in helper.py (cross-file), caller in
app.py reads env source and calls run_cmd. Verifies phase 3's
cross-file primary attribution: Diag.path = helper.py, Diag.line =
5, with app.py:7 recorded in flow_steps as a Call step.
Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test
Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body. Asserts the
resulting Finding.primary_location is exactly that triple.
The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file. This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.
Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).
Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: clean up formatting and improve readability in multiple files
* refactor: simplify type definition for deduplication key in findings
* test(harness): add must_not_match expectation for FP regression guards
Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules
* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking
* feat: update switch statement handling to improve control flow analysis
* feat: implement promisify alias handling for JS/TS to enhance taint tracking
* feat: enhance taint tracking by refining expectation handling and adding mode filtering
* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters
* feat: update taint tracking rules to enforce full mode matching and improve flow analysis
* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis
* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding
* feat: refine framework detection and update expectation handling for Echo and Sinatra
* feat: implement max_count for taint tracking expectations and deduplicate findings
* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files
* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity
* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files
* feat: add structural invariant checks for SSA bodies
* feat: ensure deterministic phi emission order using BTreeSet
* feat: enhance handling of terminators to ensure authoritative flow through successor edges
* feat: enhance Goto terminator handling to ensure all successors are marked executable
* feat: refactor code for improved readability and organization
* feat: simplify predicate checks and enhance readability in SSA handling
* feat: implement per-file parse timeout and enhance file size handling
* feat: migrate analysis engine toggles from environment variables to configuration file
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: update dependencies and enhance documentation on language maturity
* feat: enhance security headers and improve request body limits
* feat: implement sink capability bits for deduplication and enhance evidence tagging
* feat: implement dynamic activation handling for gated sinks and enhance validation logic
* feat: enhance configuration documentation and clarify inline analysis cache behavior
* feat: implement panic recovery during analysis to continue scans past errors
* feat: add expectations configuration for taint analysis and performance metrics
* feat: enhance error handling and logging during file reading and mutex locking
* feat: add cross-file body loading tests and plumbing for CF-1 phase
* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures
* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality
* feat: enhance classification span handling in CFG and AST for improved source attribution
* feat: add new Express routes for handling user input and telemetry data
* feat: implement ternary expression handling in CFG with diamond structure for JS/TS
* feat: implement Phase CF-3 abstract-domain transfer channels in summaries
* feat: add support for string-prefix transfer in cross-file calls and update tests
* docs: reduce RESULTS.md doc size
* feat: implement Phase CF-4 per-return-path summary decomposition with tests
* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization
* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests
* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests
* refactor: update comments and documentation for clarity and consistency
* style: format code for consistency and readability
* refactor: simplify verdict handling and improve edge checking logic
* refactor: optimize path and identifier collection by avoiding unnecessary cloning
* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults
* refactor: update documentation and improve clarity in configuration files
* refactor: update documentation and improve clarity in configuration files
* feat: add JS/TS pass-2 convergence tests and expectations configuration
* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic
* feat: implement Phase 7 deduplication and alternative path linking for taint findings
* feat: implement structural DFS index for anonymous functions and update naming conventions
* feat: add Phase 8 regression tests for container-element taint in JS and Python
* feat: add engine-depth profiles and explain-engine option for CLI
* feat: update expectations and add new README fixtures for multi-file scan regression
* feat: implement Phase 11 callback-alias and factory patterns with regression tests
* feat: implement Terminator::Switch for multi-way dispatch and add regression tests
* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants
* refactor: extract cfg and ssa_transfer to submodules
* refactor: cargo fmt
* refactor: remove unnecessary blank line in cfg_tests.rs
* refactor: remove unnecessary planning file
* chore: update Rust version to 1.88 and bump dependencies in Cargo files
* feat: enhance triage UI with new layout and controls, update README for clarity
* feat: enhance triage UI with new layout and controls, update README for clarity
* chore: remove outdated section from README for version 0.5.0
* docs: improve clarity and consistency in README content
* chore: add "GPL-3.0-or-later" to license options in about.toml
* chore: update license handling in about.toml and check-licenses.mjs
* style: format code for improved readability in TriagePage component
* style: format code for improved readability in TriagePage component
* chore: enhance license handling and improve body_id scoping in seed lookup
* feat: introduce owner and parent body IDs for enhanced seed scoping
* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating
* feat: add Undef SSA operation for improved control-flow handling
* style: improve code formatting for consistency and readability in multiple files
* feat: add 16-function chain SCC across multiple files for enhanced analysis
* style: simplify code formatting for improved readability in multiple files
* fix: update CapHitReason default implementation and improve README clarity
* docs: enhance README with detailed explanations of taint analysis and limitations
* docs: refine README for clarity and consistency in taint analysis section
* style: improve code formatting for better readability in NewScanModal and scans
* fix: update cargo-about command to use --offline for deterministic license generation
* fix: update cargo-about command to use --offline for deterministic license generation
* ci: add step to prime cargo registry cache for deterministic license generation
* feat: add support for non-sink collections in authorization analysis
* feat: enhance authorization checks with row-level ownership equality and binding tracking
* feat: implement self-scoped user handling and enhance ownership checks
* refactor: simplify assertions and formatting in authorization analysis tests
* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure
* docs: update AI disclosure section for clarity and conciseness
* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure
* feat: enhance authorization analysis with SSA-derived variable type classification
* feat: implement auth_finding_to_diag function for enhanced security diagnostics
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag
* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks
* feat: enhance error message handling in cli_validation_tests for better Windows compatibility
* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration
* feat: enhance release build process with SBOM generation and SLSA provenance
* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: update benchmark data and enhance path sanitization logic with new safety checks
* feat: document AI assistance in frontend UI development and human review process
* feat: add return path facts for enhanced path safety checks and update documentation
* chore: update release date for version 0.5.0 in CHANGELOG.md
* chore: clean up ci.yml by removing outdated comments and clarifying steps
* feat: implement cross-language path sanitizers and validators for enhanced security
* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks
* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases
* refactor: simplify conditional formatting and improve code readability in executor and lower modules
* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests
* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs
---------
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-25 17:59:11 -04:00
|
|
|
if content.contains("actix-web") {
|
|
|
|
|
fws.push(DetectedFramework::ActixWeb);
|
|
|
|
|
}
|
|
|
|
|
if content.contains("rocket") && !fws.contains(&DetectedFramework::Rocket) {
|
|
|
|
|
fws.push(DetectedFramework::Rocket);
|
|
|
|
|
}
|
|
|
|
|
if content.contains("axum") {
|
|
|
|
|
fws.push(DetectedFramework::Axum);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2026-05-02 16:44:49 -04:00
|
|
|
FrameworkContext {
|
|
|
|
|
frameworks: fws,
|
|
|
|
|
inspected_langs: inspected,
|
|
|
|
|
}
|
Release/0.5.0 (#35)
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures
* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests
* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements
* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles
* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing
* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling
* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures
* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration
* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests
* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic
* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection
* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements
* feat: Enable auth-state analysis by default and update relevant tests in benchmark config
* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test
* docs: update CHANGELOG.md
* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers
* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers
* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse
* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation
* feat: Refactor function parameters and constants for improved clarity and maintainability
* refactor: Reorder module imports and improve formatting for consistency
* refactor: Fix formatting erorrs
* refactor: Fix clippy warnings
* refactor: Fix fmt warnings (again)
* chore: Update dependencies and improve feature configuration
* Add comprehensive tests for undertested modules (#36) (COPILOT)
* Add comprehensive tests for undertested modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
* Add comprehensive tests for ext, project, walk, and errors modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: Update dependencies and improve feature configuration
* fix: formatting errors in new tests
* chore: Update license list in about.toml
* chore: made functions input inline
* chore: updated cfg graph to take up the full page
* chore: add Prettier configuration and update code formatting
* Add frontend test suite with Vitest (111 tests) (#37)
* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7
* ci: add frontend test step to CI workflow
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: simplify array initialization in test files for consistency
* ran typecheck
* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage
* feat: update routing in AppLayout and improve empty state message in ExplorerPage
* feat: enhance scan progress tracking with additional metrics and stages
* feat: update license information and add license check script
* feat: implement cross-file symbolic execution with callee body persistence
* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering
* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions
* feat: enhance resource tracking with proxy method summaries and improve finding extraction
* feat: add terminal function exit detection for accurate resource leak analysis
* feat: add warnings for loops and functions without bodies to improve error recovery
* feat: update lambda expression handling to ensure proper function classification and control flow
* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling
* feat: add inline return taint analysis and regression tests for improved security checks
* feat: add engine version management and migration handling for database schema updates
* feat: enhance first_call_ident to skip nested function bodies and add regression tests
* feat: enhance callee name resolution with two-segment normalization and disambiguation
* feat: add cross-file context flags and debug assertions for taint analysis
* feat: refactor taint analysis structure to unify context handling and improve clarity
* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests
* docs: updated CHANGELOG.md
* fmt: formatting fixes
* fix: fixed frontend formatting and lint warnings
* fix: optimized ci
* fix: optimized ci
* Add comprehensive multi-file test coverage to Nyx (#38)
* Initial checklist for multi-file test suite expansion
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* deleted root repo
* rebuilt to test for regressions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* feat: enhance import alias resolution and taint tracking
* feat: implement security hardening with CSRF protection and path validation
* feat: add support for import alias bindings in Python, PHP, and Rust
* feat: enhance CFG analysis modes and improve code readability
* feat: add detection for parameterized SQL queries to enhance security
* feat: add safe internal redirect handling and enhance session destroy validation
* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads
* feat: enhance taint detection by adding support for inline source member expressions in call arguments
* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments
* feat: add support for Throw statement in control flow and error handling
* feat: add debug and echo endpoints with potential information leakage
* feat: implement internal redirect suppression and enhance taint detection
* feat: implement module alias tracking for dynamic dispatch in JS/TS
* feat: add authorization analysis module with Express support
* feat: add authorization analysis module with Express support
* feat: add tests for admin guard requirements and clean checks in authorization analysis
* feat: integrate Koa and Fastify frameworks into authorization analysis
* feat: add Flask and Django support to authorization analysis module
* feat: add support for Rails and Sinatra frameworks in authorization analysis
* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis
* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis
* feat: add support for Rails and Sinatra in authorization analysis
* chore: add .DS_Store to .gitignore
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: update usage of Option methods for improved clarity and consistency
* refactor: improve code readability by simplifying conditional checks and formatting
* refactor: improve code formatting and readability by simplifying conditional checks
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: simplify conditional checks in axum.rs for improved readability
* feat: add CodeQL analysis configuration for enhanced security scanning
* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)
* chore: start test coverage improvement work
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* test: add comprehensive tests for src/output.rs SARIF builder
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* refactor: improve code formatting and readability in output.rs
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* refactor: improve code formatting and readability in output.rs
* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* refactor: enhance triage file path handling with improved error management and validation
* refactor: updated func summaries for richer detail
* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries
* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution
* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls
* refactor: implement new Flask routes for safe and unsafe shell command execution
* refactor: separate receiver handling in SSA operations and enhance taint propagation
* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments
* refactor: implement auth decorator extraction and classification for multiple languages
* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation
* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic
* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior
* refactor: standardize default struct initialization across multiple files
* feat: add scripts for formatting checks and auto-fixes with test summaries
* refactor: simplify character splitting and enhance namespace qualifier handling
* refactor: improve documentation clarity and enhance code readability in resolver logic
* refactor: replace default struct initialization with explicit field assignments for clarity
* feat: enhance anonymous function naming by deriving context-based bindings
* refactor: streamline match expressions for improved readability and performance
* refactor: streamline match expressions for improved readability and performance
* refactor: replace loop with while let for improved clarity and performance
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis
* feat: add static map analysis for command injection suppression and type safety
* refactor: simplify match statements and reduce line breaks for improved readability
* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution
Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.
Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.
Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.
Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.
Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding
Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet. SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.
Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.
Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`. `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters. Dedup key extended with the primary location
so multi-site events aren't collapsed back together.
Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
!= ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
non-empty `file_rel` — the cap-only → None translation upstream
guarantees this.
Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved. A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.
build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.
Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing). All 1566 lib
tests + integration tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(output): phase 3/5 consume primary sink location in diag + SARIF
When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.
Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
resolved back to an absolute path via a shared resolve_file_rel
helper. Empty file_rel (single-file scans where namespace == "")
resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
locations[0] already reflects the primary sink position via the
updated diag line/col.
Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.
Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
inside the closure).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(bench): phase 4/5 validate primary sink attribution across corpus
Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.
Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
Case. When present, score_location_level additionally requires at
least one flow_step in the finding's evidence trace to fall within
±2 of the call-site range. When absent, the check is skipped —
fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
now-primary Diag.line post-phase-3).
Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
transform::wrap call site (a cross-file propagator, not a sink);
line 9 is Command::new, the real sink. The ±2 tolerance happened to
mask this stale attribution but it was semantically wrong — phase 4
is the right time to correct it. Also adds expected_call_site_lines
[8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
This fixture's sink (Command::new inside run_cmd at line 5) was the
motivating case for phases 1-3; adding the call-site assertion
guards against regression to caller-line attribution.
New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
takes two tainted params and invokes two Command sinks on
consecutive lines. Locks in that primary line lands inside the
helper (lines 5-6), not at the caller (line 12). Notes document
that SinkSite is currently one-per-callee so both findings today
collapse onto the first sink; expected_sink_lines=[5,6] and
expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
004): sink os.system lives in helper.py (cross-file), caller in
app.py reads env source and calls run_cmd. Verifies phase 3's
cross-file primary attribution: Diag.path = helper.py, Diag.line =
5, with app.py:7 recorded in flow_steps as a Call step.
Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test
Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body. Asserts the
resulting Finding.primary_location is exactly that triple.
The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file. This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.
Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).
Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: clean up formatting and improve readability in multiple files
* refactor: simplify type definition for deduplication key in findings
* test(harness): add must_not_match expectation for FP regression guards
Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules
* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking
* feat: update switch statement handling to improve control flow analysis
* feat: implement promisify alias handling for JS/TS to enhance taint tracking
* feat: enhance taint tracking by refining expectation handling and adding mode filtering
* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters
* feat: update taint tracking rules to enforce full mode matching and improve flow analysis
* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis
* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding
* feat: refine framework detection and update expectation handling for Echo and Sinatra
* feat: implement max_count for taint tracking expectations and deduplicate findings
* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files
* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity
* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files
* feat: add structural invariant checks for SSA bodies
* feat: ensure deterministic phi emission order using BTreeSet
* feat: enhance handling of terminators to ensure authoritative flow through successor edges
* feat: enhance Goto terminator handling to ensure all successors are marked executable
* feat: refactor code for improved readability and organization
* feat: simplify predicate checks and enhance readability in SSA handling
* feat: implement per-file parse timeout and enhance file size handling
* feat: migrate analysis engine toggles from environment variables to configuration file
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: update dependencies and enhance documentation on language maturity
* feat: enhance security headers and improve request body limits
* feat: implement sink capability bits for deduplication and enhance evidence tagging
* feat: implement dynamic activation handling for gated sinks and enhance validation logic
* feat: enhance configuration documentation and clarify inline analysis cache behavior
* feat: implement panic recovery during analysis to continue scans past errors
* feat: add expectations configuration for taint analysis and performance metrics
* feat: enhance error handling and logging during file reading and mutex locking
* feat: add cross-file body loading tests and plumbing for CF-1 phase
* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures
* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality
* feat: enhance classification span handling in CFG and AST for improved source attribution
* feat: add new Express routes for handling user input and telemetry data
* feat: implement ternary expression handling in CFG with diamond structure for JS/TS
* feat: implement Phase CF-3 abstract-domain transfer channels in summaries
* feat: add support for string-prefix transfer in cross-file calls and update tests
* docs: reduce RESULTS.md doc size
* feat: implement Phase CF-4 per-return-path summary decomposition with tests
* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization
* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests
* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests
* refactor: update comments and documentation for clarity and consistency
* style: format code for consistency and readability
* refactor: simplify verdict handling and improve edge checking logic
* refactor: optimize path and identifier collection by avoiding unnecessary cloning
* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults
* refactor: update documentation and improve clarity in configuration files
* refactor: update documentation and improve clarity in configuration files
* feat: add JS/TS pass-2 convergence tests and expectations configuration
* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic
* feat: implement Phase 7 deduplication and alternative path linking for taint findings
* feat: implement structural DFS index for anonymous functions and update naming conventions
* feat: add Phase 8 regression tests for container-element taint in JS and Python
* feat: add engine-depth profiles and explain-engine option for CLI
* feat: update expectations and add new README fixtures for multi-file scan regression
* feat: implement Phase 11 callback-alias and factory patterns with regression tests
* feat: implement Terminator::Switch for multi-way dispatch and add regression tests
* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants
* refactor: extract cfg and ssa_transfer to submodules
* refactor: cargo fmt
* refactor: remove unnecessary blank line in cfg_tests.rs
* refactor: remove unnecessary planning file
* chore: update Rust version to 1.88 and bump dependencies in Cargo files
* feat: enhance triage UI with new layout and controls, update README for clarity
* feat: enhance triage UI with new layout and controls, update README for clarity
* chore: remove outdated section from README for version 0.5.0
* docs: improve clarity and consistency in README content
* chore: add "GPL-3.0-or-later" to license options in about.toml
* chore: update license handling in about.toml and check-licenses.mjs
* style: format code for improved readability in TriagePage component
* style: format code for improved readability in TriagePage component
* chore: enhance license handling and improve body_id scoping in seed lookup
* feat: introduce owner and parent body IDs for enhanced seed scoping
* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating
* feat: add Undef SSA operation for improved control-flow handling
* style: improve code formatting for consistency and readability in multiple files
* feat: add 16-function chain SCC across multiple files for enhanced analysis
* style: simplify code formatting for improved readability in multiple files
* fix: update CapHitReason default implementation and improve README clarity
* docs: enhance README with detailed explanations of taint analysis and limitations
* docs: refine README for clarity and consistency in taint analysis section
* style: improve code formatting for better readability in NewScanModal and scans
* fix: update cargo-about command to use --offline for deterministic license generation
* fix: update cargo-about command to use --offline for deterministic license generation
* ci: add step to prime cargo registry cache for deterministic license generation
* feat: add support for non-sink collections in authorization analysis
* feat: enhance authorization checks with row-level ownership equality and binding tracking
* feat: implement self-scoped user handling and enhance ownership checks
* refactor: simplify assertions and formatting in authorization analysis tests
* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure
* docs: update AI disclosure section for clarity and conciseness
* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure
* feat: enhance authorization analysis with SSA-derived variable type classification
* feat: implement auth_finding_to_diag function for enhanced security diagnostics
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag
* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks
* feat: enhance error message handling in cli_validation_tests for better Windows compatibility
* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration
* feat: enhance release build process with SBOM generation and SLSA provenance
* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: update benchmark data and enhance path sanitization logic with new safety checks
* feat: document AI assistance in frontend UI development and human review process
* feat: add return path facts for enhanced path safety checks and update documentation
* chore: update release date for version 0.5.0 in CHANGELOG.md
* chore: clean up ci.yml by removing outdated comments and clarifying steps
* feat: implement cross-language path sanitizers and validators for enhanced security
* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks
* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases
* refactor: simplify conditional formatting and improve code readability in executor and lower modules
* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests
* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs
---------
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-25 17:59:11 -04:00
|
|
|
}
|
|
|
|
|
|
2025-06-24 23:18:01 +02:00
|
|
|
#[test]
|
|
|
|
|
fn sanitize_project_name_is_idempotent_and_lossless_enough() {
|
2025-06-24 23:38:32 +02:00
|
|
|
let samples = [
|
|
|
|
|
("My Project", "my_project"),
|
|
|
|
|
("Hello-World", "hello-world"),
|
|
|
|
|
("mixed_case", "mixed_case"),
|
|
|
|
|
("tabs\tspaces\n", "tabs_spaces"),
|
|
|
|
|
(" multiple ", "multiple"),
|
|
|
|
|
("weird@$*chars", "weird_chars"),
|
|
|
|
|
];
|
|
|
|
|
|
|
|
|
|
for (input, expected) in samples {
|
2025-06-28 17:36:14 +02:00
|
|
|
assert_eq!(sanitize_project_name(input), expected, "input: {input}");
|
2025-06-24 23:38:32 +02:00
|
|
|
assert_eq!(sanitize_project_name(expected), expected);
|
|
|
|
|
}
|
2025-06-24 23:18:01 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn get_project_info_uses_sanitized_name_in_sqlite_path() {
|
2025-06-24 23:38:32 +02:00
|
|
|
let tmp = tempfile::tempdir().unwrap();
|
|
|
|
|
let root = tmp.path();
|
2025-06-24 23:18:01 +02:00
|
|
|
|
2025-06-24 23:38:32 +02:00
|
|
|
let project_dir = root.join("Example Project");
|
|
|
|
|
std::fs::create_dir(&project_dir).unwrap();
|
2025-06-24 23:18:01 +02:00
|
|
|
|
2025-06-24 23:38:32 +02:00
|
|
|
let (project_name, db_path) =
|
|
|
|
|
get_project_info(&project_dir, root).expect("should detect project");
|
2025-06-24 23:18:01 +02:00
|
|
|
|
2025-06-24 23:38:32 +02:00
|
|
|
assert_eq!(project_name, "Example Project");
|
|
|
|
|
assert_eq!(db_path, root.join("example_project.sqlite"));
|
|
|
|
|
}
|
Release/0.5.0 (#35)
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures
* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests
* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements
* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles
* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing
* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling
* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures
* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration
* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests
* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic
* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection
* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements
* feat: Enable auth-state analysis by default and update relevant tests in benchmark config
* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test
* docs: update CHANGELOG.md
* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers
* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers
* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse
* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation
* feat: Refactor function parameters and constants for improved clarity and maintainability
* refactor: Reorder module imports and improve formatting for consistency
* refactor: Fix formatting erorrs
* refactor: Fix clippy warnings
* refactor: Fix fmt warnings (again)
* chore: Update dependencies and improve feature configuration
* Add comprehensive tests for undertested modules (#36) (COPILOT)
* Add comprehensive tests for undertested modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
* Add comprehensive tests for ext, project, walk, and errors modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: Update dependencies and improve feature configuration
* fix: formatting errors in new tests
* chore: Update license list in about.toml
* chore: made functions input inline
* chore: updated cfg graph to take up the full page
* chore: add Prettier configuration and update code formatting
* Add frontend test suite with Vitest (111 tests) (#37)
* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7
* ci: add frontend test step to CI workflow
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: simplify array initialization in test files for consistency
* ran typecheck
* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage
* feat: update routing in AppLayout and improve empty state message in ExplorerPage
* feat: enhance scan progress tracking with additional metrics and stages
* feat: update license information and add license check script
* feat: implement cross-file symbolic execution with callee body persistence
* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering
* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions
* feat: enhance resource tracking with proxy method summaries and improve finding extraction
* feat: add terminal function exit detection for accurate resource leak analysis
* feat: add warnings for loops and functions without bodies to improve error recovery
* feat: update lambda expression handling to ensure proper function classification and control flow
* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling
* feat: add inline return taint analysis and regression tests for improved security checks
* feat: add engine version management and migration handling for database schema updates
* feat: enhance first_call_ident to skip nested function bodies and add regression tests
* feat: enhance callee name resolution with two-segment normalization and disambiguation
* feat: add cross-file context flags and debug assertions for taint analysis
* feat: refactor taint analysis structure to unify context handling and improve clarity
* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests
* docs: updated CHANGELOG.md
* fmt: formatting fixes
* fix: fixed frontend formatting and lint warnings
* fix: optimized ci
* fix: optimized ci
* Add comprehensive multi-file test coverage to Nyx (#38)
* Initial checklist for multi-file test suite expansion
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* deleted root repo
* rebuilt to test for regressions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* feat: enhance import alias resolution and taint tracking
* feat: implement security hardening with CSRF protection and path validation
* feat: add support for import alias bindings in Python, PHP, and Rust
* feat: enhance CFG analysis modes and improve code readability
* feat: add detection for parameterized SQL queries to enhance security
* feat: add safe internal redirect handling and enhance session destroy validation
* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads
* feat: enhance taint detection by adding support for inline source member expressions in call arguments
* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments
* feat: add support for Throw statement in control flow and error handling
* feat: add debug and echo endpoints with potential information leakage
* feat: implement internal redirect suppression and enhance taint detection
* feat: implement module alias tracking for dynamic dispatch in JS/TS
* feat: add authorization analysis module with Express support
* feat: add authorization analysis module with Express support
* feat: add tests for admin guard requirements and clean checks in authorization analysis
* feat: integrate Koa and Fastify frameworks into authorization analysis
* feat: add Flask and Django support to authorization analysis module
* feat: add support for Rails and Sinatra frameworks in authorization analysis
* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis
* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis
* feat: add support for Rails and Sinatra in authorization analysis
* chore: add .DS_Store to .gitignore
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: update usage of Option methods for improved clarity and consistency
* refactor: improve code readability by simplifying conditional checks and formatting
* refactor: improve code formatting and readability by simplifying conditional checks
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: simplify conditional checks in axum.rs for improved readability
* feat: add CodeQL analysis configuration for enhanced security scanning
* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)
* chore: start test coverage improvement work
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* test: add comprehensive tests for src/output.rs SARIF builder
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* refactor: improve code formatting and readability in output.rs
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* refactor: improve code formatting and readability in output.rs
* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* refactor: enhance triage file path handling with improved error management and validation
* refactor: updated func summaries for richer detail
* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries
* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution
* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls
* refactor: implement new Flask routes for safe and unsafe shell command execution
* refactor: separate receiver handling in SSA operations and enhance taint propagation
* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments
* refactor: implement auth decorator extraction and classification for multiple languages
* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation
* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic
* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior
* refactor: standardize default struct initialization across multiple files
* feat: add scripts for formatting checks and auto-fixes with test summaries
* refactor: simplify character splitting and enhance namespace qualifier handling
* refactor: improve documentation clarity and enhance code readability in resolver logic
* refactor: replace default struct initialization with explicit field assignments for clarity
* feat: enhance anonymous function naming by deriving context-based bindings
* refactor: streamline match expressions for improved readability and performance
* refactor: streamline match expressions for improved readability and performance
* refactor: replace loop with while let for improved clarity and performance
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis
* feat: add static map analysis for command injection suppression and type safety
* refactor: simplify match statements and reduce line breaks for improved readability
* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution
Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.
Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.
Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.
Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.
Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding
Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet. SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.
Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.
Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`. `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters. Dedup key extended with the primary location
so multi-site events aren't collapsed back together.
Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
!= ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
non-empty `file_rel` — the cap-only → None translation upstream
guarantees this.
Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved. A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.
build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.
Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing). All 1566 lib
tests + integration tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(output): phase 3/5 consume primary sink location in diag + SARIF
When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.
Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
resolved back to an absolute path via a shared resolve_file_rel
helper. Empty file_rel (single-file scans where namespace == "")
resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
locations[0] already reflects the primary sink position via the
updated diag line/col.
Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.
Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
inside the closure).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(bench): phase 4/5 validate primary sink attribution across corpus
Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.
Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
Case. When present, score_location_level additionally requires at
least one flow_step in the finding's evidence trace to fall within
±2 of the call-site range. When absent, the check is skipped —
fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
now-primary Diag.line post-phase-3).
Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
transform::wrap call site (a cross-file propagator, not a sink);
line 9 is Command::new, the real sink. The ±2 tolerance happened to
mask this stale attribution but it was semantically wrong — phase 4
is the right time to correct it. Also adds expected_call_site_lines
[8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
This fixture's sink (Command::new inside run_cmd at line 5) was the
motivating case for phases 1-3; adding the call-site assertion
guards against regression to caller-line attribution.
New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
takes two tainted params and invokes two Command sinks on
consecutive lines. Locks in that primary line lands inside the
helper (lines 5-6), not at the caller (line 12). Notes document
that SinkSite is currently one-per-callee so both findings today
collapse onto the first sink; expected_sink_lines=[5,6] and
expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
004): sink os.system lives in helper.py (cross-file), caller in
app.py reads env source and calls run_cmd. Verifies phase 3's
cross-file primary attribution: Diag.path = helper.py, Diag.line =
5, with app.py:7 recorded in flow_steps as a Call step.
Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test
Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body. Asserts the
resulting Finding.primary_location is exactly that triple.
The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file. This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.
Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).
Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: clean up formatting and improve readability in multiple files
* refactor: simplify type definition for deduplication key in findings
* test(harness): add must_not_match expectation for FP regression guards
Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules
* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking
* feat: update switch statement handling to improve control flow analysis
* feat: implement promisify alias handling for JS/TS to enhance taint tracking
* feat: enhance taint tracking by refining expectation handling and adding mode filtering
* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters
* feat: update taint tracking rules to enforce full mode matching and improve flow analysis
* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis
* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding
* feat: refine framework detection and update expectation handling for Echo and Sinatra
* feat: implement max_count for taint tracking expectations and deduplicate findings
* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files
* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity
* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files
* feat: add structural invariant checks for SSA bodies
* feat: ensure deterministic phi emission order using BTreeSet
* feat: enhance handling of terminators to ensure authoritative flow through successor edges
* feat: enhance Goto terminator handling to ensure all successors are marked executable
* feat: refactor code for improved readability and organization
* feat: simplify predicate checks and enhance readability in SSA handling
* feat: implement per-file parse timeout and enhance file size handling
* feat: migrate analysis engine toggles from environment variables to configuration file
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: update dependencies and enhance documentation on language maturity
* feat: enhance security headers and improve request body limits
* feat: implement sink capability bits for deduplication and enhance evidence tagging
* feat: implement dynamic activation handling for gated sinks and enhance validation logic
* feat: enhance configuration documentation and clarify inline analysis cache behavior
* feat: implement panic recovery during analysis to continue scans past errors
* feat: add expectations configuration for taint analysis and performance metrics
* feat: enhance error handling and logging during file reading and mutex locking
* feat: add cross-file body loading tests and plumbing for CF-1 phase
* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures
* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality
* feat: enhance classification span handling in CFG and AST for improved source attribution
* feat: add new Express routes for handling user input and telemetry data
* feat: implement ternary expression handling in CFG with diamond structure for JS/TS
* feat: implement Phase CF-3 abstract-domain transfer channels in summaries
* feat: add support for string-prefix transfer in cross-file calls and update tests
* docs: reduce RESULTS.md doc size
* feat: implement Phase CF-4 per-return-path summary decomposition with tests
* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization
* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests
* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests
* refactor: update comments and documentation for clarity and consistency
* style: format code for consistency and readability
* refactor: simplify verdict handling and improve edge checking logic
* refactor: optimize path and identifier collection by avoiding unnecessary cloning
* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults
* refactor: update documentation and improve clarity in configuration files
* refactor: update documentation and improve clarity in configuration files
* feat: add JS/TS pass-2 convergence tests and expectations configuration
* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic
* feat: implement Phase 7 deduplication and alternative path linking for taint findings
* feat: implement structural DFS index for anonymous functions and update naming conventions
* feat: add Phase 8 regression tests for container-element taint in JS and Python
* feat: add engine-depth profiles and explain-engine option for CLI
* feat: update expectations and add new README fixtures for multi-file scan regression
* feat: implement Phase 11 callback-alias and factory patterns with regression tests
* feat: implement Terminator::Switch for multi-way dispatch and add regression tests
* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants
* refactor: extract cfg and ssa_transfer to submodules
* refactor: cargo fmt
* refactor: remove unnecessary blank line in cfg_tests.rs
* refactor: remove unnecessary planning file
* chore: update Rust version to 1.88 and bump dependencies in Cargo files
* feat: enhance triage UI with new layout and controls, update README for clarity
* feat: enhance triage UI with new layout and controls, update README for clarity
* chore: remove outdated section from README for version 0.5.0
* docs: improve clarity and consistency in README content
* chore: add "GPL-3.0-or-later" to license options in about.toml
* chore: update license handling in about.toml and check-licenses.mjs
* style: format code for improved readability in TriagePage component
* style: format code for improved readability in TriagePage component
* chore: enhance license handling and improve body_id scoping in seed lookup
* feat: introduce owner and parent body IDs for enhanced seed scoping
* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating
* feat: add Undef SSA operation for improved control-flow handling
* style: improve code formatting for consistency and readability in multiple files
* feat: add 16-function chain SCC across multiple files for enhanced analysis
* style: simplify code formatting for improved readability in multiple files
* fix: update CapHitReason default implementation and improve README clarity
* docs: enhance README with detailed explanations of taint analysis and limitations
* docs: refine README for clarity and consistency in taint analysis section
* style: improve code formatting for better readability in NewScanModal and scans
* fix: update cargo-about command to use --offline for deterministic license generation
* fix: update cargo-about command to use --offline for deterministic license generation
* ci: add step to prime cargo registry cache for deterministic license generation
* feat: add support for non-sink collections in authorization analysis
* feat: enhance authorization checks with row-level ownership equality and binding tracking
* feat: implement self-scoped user handling and enhance ownership checks
* refactor: simplify assertions and formatting in authorization analysis tests
* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure
* docs: update AI disclosure section for clarity and conciseness
* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure
* feat: enhance authorization analysis with SSA-derived variable type classification
* feat: implement auth_finding_to_diag function for enhanced security diagnostics
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag
* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks
* feat: enhance error message handling in cli_validation_tests for better Windows compatibility
* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration
* feat: enhance release build process with SBOM generation and SLSA provenance
* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: update benchmark data and enhance path sanitization logic with new safety checks
* feat: document AI assistance in frontend UI development and human review process
* feat: add return path facts for enhanced path safety checks and update documentation
* chore: update release date for version 0.5.0 in CHANGELOG.md
* chore: clean up ci.yml by removing outdated comments and clarifying steps
* feat: implement cross-language path sanitizers and validators for enhanced security
* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks
* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases
* refactor: simplify conditional formatting and improve code readability in executor and lower modules
* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests
* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs
---------
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-25 17:59:11 -04:00
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn detect_frameworks_from_package_json() {
|
|
|
|
|
let tmp = tempfile::tempdir().unwrap();
|
|
|
|
|
let root = tmp.path();
|
|
|
|
|
fs::write(
|
|
|
|
|
root.join("package.json"),
|
|
|
|
|
r#"{"dependencies": {"express": "^4.18.0", "koa": "^2.15.0", "fastify": "^4.0.0", "react": "^18.0.0"}}"#,
|
|
|
|
|
)
|
|
|
|
|
.unwrap();
|
|
|
|
|
let ctx = detect_frameworks(root);
|
|
|
|
|
assert!(ctx.has(DetectedFramework::Express));
|
|
|
|
|
assert!(ctx.has(DetectedFramework::Koa));
|
|
|
|
|
assert!(ctx.has(DetectedFramework::Fastify));
|
|
|
|
|
assert!(ctx.has(DetectedFramework::React));
|
|
|
|
|
assert!(!ctx.has(DetectedFramework::Flask));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn detect_frameworks_empty_dir() {
|
|
|
|
|
let tmp = tempfile::tempdir().unwrap();
|
|
|
|
|
let ctx = detect_frameworks(tmp.path());
|
|
|
|
|
assert!(ctx.frameworks.is_empty());
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn detect_frameworks_gemfile_rails() {
|
|
|
|
|
let tmp = tempfile::tempdir().unwrap();
|
|
|
|
|
let root = tmp.path();
|
|
|
|
|
fs::write(root.join("Gemfile"), "gem 'rails', '~> 7.0'\ngem 'puma'\n").unwrap();
|
|
|
|
|
let ctx = detect_frameworks(root);
|
|
|
|
|
assert!(ctx.has(DetectedFramework::Rails));
|
|
|
|
|
assert!(!ctx.has(DetectedFramework::Sinatra));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn detect_frameworks_gemfile_sinatra() {
|
|
|
|
|
let tmp = tempfile::tempdir().unwrap();
|
|
|
|
|
let root = tmp.path();
|
|
|
|
|
fs::write(root.join("Gemfile"), "gem 'sinatra'\ngem 'puma'\n").unwrap();
|
|
|
|
|
let ctx = detect_frameworks(root);
|
|
|
|
|
assert!(ctx.has(DetectedFramework::Sinatra));
|
|
|
|
|
assert!(!ctx.has(DetectedFramework::Rails));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn detect_frameworks_python_flask_from_requirements() {
|
|
|
|
|
let tmp = tempfile::tempdir().unwrap();
|
|
|
|
|
let root = tmp.path();
|
|
|
|
|
fs::write(
|
|
|
|
|
root.join("requirements.txt"),
|
|
|
|
|
"Flask==2.3.0\nrequests>=2.28\n",
|
|
|
|
|
)
|
|
|
|
|
.unwrap();
|
|
|
|
|
let ctx = detect_frameworks(root);
|
|
|
|
|
assert!(ctx.has(DetectedFramework::Flask));
|
|
|
|
|
assert!(!ctx.has(DetectedFramework::Django));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn detect_frameworks_python_django_from_pyproject() {
|
|
|
|
|
let tmp = tempfile::tempdir().unwrap();
|
|
|
|
|
let root = tmp.path();
|
|
|
|
|
fs::write(
|
|
|
|
|
root.join("pyproject.toml"),
|
|
|
|
|
"[project]\nname = \"myapp\"\ndependencies = [\"django>=4.0\"]\n",
|
|
|
|
|
)
|
|
|
|
|
.unwrap();
|
|
|
|
|
let ctx = detect_frameworks(root);
|
|
|
|
|
assert!(ctx.has(DetectedFramework::Django));
|
|
|
|
|
assert!(!ctx.has(DetectedFramework::Flask));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn detect_frameworks_go_mod_gin() {
|
|
|
|
|
let tmp = tempfile::tempdir().unwrap();
|
|
|
|
|
let root = tmp.path();
|
|
|
|
|
fs::write(
|
|
|
|
|
root.join("go.mod"),
|
|
|
|
|
"module example.com/app\n\nrequire (\n\tgithub.com/gin-gonic/gin v1.9.0\n)\n",
|
|
|
|
|
)
|
|
|
|
|
.unwrap();
|
|
|
|
|
let ctx = detect_frameworks(root);
|
|
|
|
|
assert!(ctx.has(DetectedFramework::Gin));
|
|
|
|
|
assert!(!ctx.has(DetectedFramework::Echo));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn detect_frameworks_go_mod_echo() {
|
|
|
|
|
let tmp = tempfile::tempdir().unwrap();
|
|
|
|
|
let root = tmp.path();
|
|
|
|
|
fs::write(
|
|
|
|
|
root.join("go.mod"),
|
|
|
|
|
"module example.com/app\n\nrequire (\n\tgithub.com/labstack/echo/v4 v4.11.0\n)\n",
|
|
|
|
|
)
|
|
|
|
|
.unwrap();
|
|
|
|
|
let ctx = detect_frameworks(root);
|
|
|
|
|
assert!(ctx.has(DetectedFramework::Echo));
|
|
|
|
|
assert!(!ctx.has(DetectedFramework::Gin));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn detect_frameworks_java_spring_from_pom_xml() {
|
|
|
|
|
let tmp = tempfile::tempdir().unwrap();
|
|
|
|
|
let root = tmp.path();
|
|
|
|
|
fs::write(
|
|
|
|
|
root.join("pom.xml"),
|
|
|
|
|
"<project>\n <dependencies>\n <dependency>\n <groupId>org.springframework.boot</groupId>\n <artifactId>spring-boot-starter-web</artifactId>\n </dependency>\n </dependencies>\n</project>\n",
|
|
|
|
|
)
|
|
|
|
|
.unwrap();
|
|
|
|
|
let ctx = detect_frameworks(root);
|
|
|
|
|
assert!(ctx.has(DetectedFramework::Spring));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn detect_frameworks_java_spring_from_build_gradle() {
|
|
|
|
|
let tmp = tempfile::tempdir().unwrap();
|
|
|
|
|
let root = tmp.path();
|
|
|
|
|
fs::write(
|
|
|
|
|
root.join("build.gradle"),
|
|
|
|
|
"plugins {\n id 'org.springframework.boot' version '3.1.0'\n}\ndependencies {\n implementation 'org.springframework.boot:spring-web:3.1.0'\n}\n",
|
|
|
|
|
)
|
|
|
|
|
.unwrap();
|
|
|
|
|
let ctx = detect_frameworks(root);
|
|
|
|
|
assert!(ctx.has(DetectedFramework::Spring));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn detect_frameworks_php_laravel_from_composer_json() {
|
|
|
|
|
let tmp = tempfile::tempdir().unwrap();
|
|
|
|
|
let root = tmp.path();
|
|
|
|
|
fs::write(
|
|
|
|
|
root.join("composer.json"),
|
|
|
|
|
r#"{"require": {"laravel/framework": "^10.0", "php": "^8.1"}}"#,
|
|
|
|
|
)
|
|
|
|
|
.unwrap();
|
|
|
|
|
let ctx = detect_frameworks(root);
|
|
|
|
|
assert!(ctx.has(DetectedFramework::Laravel));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn detect_frameworks_rust_axum_from_cargo_toml() {
|
|
|
|
|
let tmp = tempfile::tempdir().unwrap();
|
|
|
|
|
let root = tmp.path();
|
|
|
|
|
fs::write(
|
|
|
|
|
root.join("Cargo.toml"),
|
|
|
|
|
"[dependencies]\naxum = \"0.7\"\ntokio = { version = \"1\", features = [\"full\"] }\n",
|
|
|
|
|
)
|
|
|
|
|
.unwrap();
|
|
|
|
|
let ctx = detect_frameworks(root);
|
|
|
|
|
assert!(ctx.has(DetectedFramework::Axum));
|
|
|
|
|
assert!(!ctx.has(DetectedFramework::ActixWeb));
|
|
|
|
|
assert!(!ctx.has(DetectedFramework::Rocket));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn detect_frameworks_rust_actix_web_from_cargo_toml() {
|
|
|
|
|
let tmp = tempfile::tempdir().unwrap();
|
|
|
|
|
let root = tmp.path();
|
|
|
|
|
fs::write(
|
|
|
|
|
root.join("Cargo.toml"),
|
|
|
|
|
"[dependencies]\nactix-web = \"4\"\n",
|
|
|
|
|
)
|
|
|
|
|
.unwrap();
|
|
|
|
|
let ctx = detect_frameworks(root);
|
|
|
|
|
assert!(ctx.has(DetectedFramework::ActixWeb));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn detect_frameworks_multiple_in_same_project() {
|
|
|
|
|
let tmp = tempfile::tempdir().unwrap();
|
|
|
|
|
let root = tmp.path();
|
|
|
|
|
// A project using both Express and React
|
|
|
|
|
fs::write(
|
|
|
|
|
root.join("package.json"),
|
|
|
|
|
r#"{"dependencies": {"express": "^4", "@koa/router": "^12", "fastify": "^4", "react": "^18"}}"#,
|
|
|
|
|
)
|
|
|
|
|
.unwrap();
|
|
|
|
|
let ctx = detect_frameworks(root);
|
|
|
|
|
assert!(ctx.has(DetectedFramework::Express));
|
|
|
|
|
assert!(ctx.has(DetectedFramework::Koa));
|
|
|
|
|
assert!(ctx.has(DetectedFramework::Fastify));
|
|
|
|
|
assert!(ctx.has(DetectedFramework::React));
|
|
|
|
|
assert_eq!(ctx.frameworks.len(), 4);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn sanitize_project_name_numeric_and_special() {
|
|
|
|
|
assert_eq!(sanitize_project_name("project123"), "project123");
|
|
|
|
|
assert_eq!(sanitize_project_name("123"), "123");
|
|
|
|
|
assert_eq!(sanitize_project_name("a.b.c"), "a_b_c");
|
|
|
|
|
// hyphens are preserved as-is (only underscores are collapsed)
|
|
|
|
|
assert_eq!(sanitize_project_name("a--b"), "a--b");
|
|
|
|
|
// Leading/trailing underscores from replacements get collapsed
|
|
|
|
|
assert_eq!(sanitize_project_name("__init__"), "init");
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn get_project_info_returns_error_for_root_path() {
|
|
|
|
|
let tmp = tempfile::tempdir().unwrap();
|
|
|
|
|
// A path that ends with "/" (root) has no file_name
|
|
|
|
|
let result = get_project_info(std::path::Path::new("/"), tmp.path());
|
|
|
|
|
assert!(result.is_err());
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn framework_context_has_is_false_for_absent_framework() {
|
|
|
|
|
let ctx = FrameworkContext::default();
|
|
|
|
|
assert!(!ctx.has(DetectedFramework::Express));
|
|
|
|
|
assert!(!ctx.has(DetectedFramework::Flask));
|
|
|
|
|
assert!(!ctx.has(DetectedFramework::Spring));
|
|
|
|
|
}
|
|
|
|
|
|
2026-05-02 16:44:49 -04:00
|
|
|
#[test]
|
|
|
|
|
fn lang_has_web_framework_three_valued_for_rust() {
|
|
|
|
|
let tmp = tempfile::tempdir().unwrap();
|
|
|
|
|
let root = tmp.path();
|
|
|
|
|
// Cargo.toml present, no axum / actix-web / rocket → Some(false).
|
|
|
|
|
fs::write(root.join("Cargo.toml"), "[dependencies]\nserde = \"1\"\n").unwrap();
|
|
|
|
|
let ctx = detect_frameworks(root);
|
|
|
|
|
assert_eq!(ctx.lang_has_web_framework("rust"), Some(false));
|
|
|
|
|
assert_eq!(ctx.lang_has_web_framework("python"), None);
|
|
|
|
|
|
|
|
|
|
// Cargo.toml present and names axum → Some(true).
|
|
|
|
|
fs::write(root.join("Cargo.toml"), "[dependencies]\naxum = \"0.7\"\n").unwrap();
|
|
|
|
|
let ctx = detect_frameworks(root);
|
|
|
|
|
assert_eq!(ctx.lang_has_web_framework("rust"), Some(true));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn lang_has_web_framework_none_when_manifest_absent() {
|
|
|
|
|
// No Cargo.toml at root → Rust manifest not inspected → None.
|
|
|
|
|
let tmp = tempfile::tempdir().unwrap();
|
|
|
|
|
let ctx = detect_frameworks(tmp.path());
|
|
|
|
|
assert_eq!(ctx.lang_has_web_framework("rust"), None);
|
|
|
|
|
assert_eq!(ctx.lang_has_web_framework("python"), None);
|
|
|
|
|
assert_eq!(ctx.lang_has_web_framework("ruby"), None);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn rust_file_imports_web_framework_recognises_axum_actix_rocket() {
|
|
|
|
|
assert!(rust_file_imports_web_framework(
|
|
|
|
|
b"use axum::Router;\nfn main() {}\n"
|
|
|
|
|
));
|
|
|
|
|
assert!(rust_file_imports_web_framework(
|
|
|
|
|
b"use actix_web::web;\nfn main() {}\n"
|
|
|
|
|
));
|
|
|
|
|
assert!(rust_file_imports_web_framework(
|
|
|
|
|
b"use rocket::get;\nfn main() {}\n"
|
|
|
|
|
));
|
|
|
|
|
assert!(rust_file_imports_web_framework(
|
|
|
|
|
b"use axum_extra::routing::RouterExt;\n"
|
|
|
|
|
));
|
|
|
|
|
// Not a web framework import → false.
|
|
|
|
|
assert!(!rust_file_imports_web_framework(
|
|
|
|
|
b"use std::path::Path;\nuse serde::Deserialize;\nfn main() {}\n"
|
|
|
|
|
));
|
|
|
|
|
// Bare crate name in a comment doesn't satisfy the `<crate>::`
|
|
|
|
|
// path prefix — substring is conservative on purpose.
|
|
|
|
|
assert!(!rust_file_imports_web_framework(
|
|
|
|
|
b"// migrating away from axum\nfn main() {}\n"
|
|
|
|
|
));
|
|
|
|
|
}
|
|
|
|
|
|
Release/0.5.0 (#35)
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures
* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests
* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements
* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles
* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing
* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling
* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures
* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration
* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests
* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic
* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection
* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements
* feat: Enable auth-state analysis by default and update relevant tests in benchmark config
* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test
* docs: update CHANGELOG.md
* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers
* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers
* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse
* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation
* feat: Refactor function parameters and constants for improved clarity and maintainability
* refactor: Reorder module imports and improve formatting for consistency
* refactor: Fix formatting erorrs
* refactor: Fix clippy warnings
* refactor: Fix fmt warnings (again)
* chore: Update dependencies and improve feature configuration
* Add comprehensive tests for undertested modules (#36) (COPILOT)
* Add comprehensive tests for undertested modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
* Add comprehensive tests for ext, project, walk, and errors modules
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: Update dependencies and improve feature configuration
* fix: formatting errors in new tests
* chore: Update license list in about.toml
* chore: made functions input inline
* chore: updated cfg graph to take up the full page
* chore: add Prettier configuration and update code formatting
* Add frontend test suite with Vitest (111 tests) (#37)
* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7
* ci: add frontend test step to CI workflow
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* chore: simplify array initialization in test files for consistency
* ran typecheck
* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage
* feat: update routing in AppLayout and improve empty state message in ExplorerPage
* feat: enhance scan progress tracking with additional metrics and stages
* feat: update license information and add license check script
* feat: implement cross-file symbolic execution with callee body persistence
* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering
* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions
* feat: enhance resource tracking with proxy method summaries and improve finding extraction
* feat: add terminal function exit detection for accurate resource leak analysis
* feat: add warnings for loops and functions without bodies to improve error recovery
* feat: update lambda expression handling to ensure proper function classification and control flow
* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling
* feat: add inline return taint analysis and regression tests for improved security checks
* feat: add engine version management and migration handling for database schema updates
* feat: enhance first_call_ident to skip nested function bodies and add regression tests
* feat: enhance callee name resolution with two-segment normalization and disambiguation
* feat: add cross-file context flags and debug assertions for taint analysis
* feat: refactor taint analysis structure to unify context handling and improve clarity
* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests
* docs: updated CHANGELOG.md
* fmt: formatting fixes
* fix: fixed frontend formatting and lint warnings
* fix: optimized ci
* fix: optimized ci
* Add comprehensive multi-file test coverage to Nyx (#38)
* Initial checklist for multi-file test suite expansion
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* deleted root repo
* rebuilt to test for regressions
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* feat: enhance import alias resolution and taint tracking
* feat: implement security hardening with CSRF protection and path validation
* feat: add support for import alias bindings in Python, PHP, and Rust
* feat: enhance CFG analysis modes and improve code readability
* feat: add detection for parameterized SQL queries to enhance security
* feat: add safe internal redirect handling and enhance session destroy validation
* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads
* feat: enhance taint detection by adding support for inline source member expressions in call arguments
* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments
* feat: add support for Throw statement in control flow and error handling
* feat: add debug and echo endpoints with potential information leakage
* feat: implement internal redirect suppression and enhance taint detection
* feat: implement module alias tracking for dynamic dispatch in JS/TS
* feat: add authorization analysis module with Express support
* feat: add authorization analysis module with Express support
* feat: add tests for admin guard requirements and clean checks in authorization analysis
* feat: integrate Koa and Fastify frameworks into authorization analysis
* feat: add Flask and Django support to authorization analysis module
* feat: add support for Rails and Sinatra frameworks in authorization analysis
* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis
* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis
* feat: add support for Rails and Sinatra in authorization analysis
* chore: add .DS_Store to .gitignore
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: update usage of Option methods for improved clarity and consistency
* refactor: improve code readability by simplifying conditional checks and formatting
* refactor: improve code formatting and readability by simplifying conditional checks
* refactor: simplify conditional checks and improve readability in multiple files
* refactor: simplify conditional checks in axum.rs for improved readability
* feat: add CodeQL analysis configuration for enhanced security scanning
* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)
* chore: start test coverage improvement work
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* test: add comprehensive tests for src/output.rs SARIF builder
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
* refactor: improve code formatting and readability in output.rs
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>
* refactor: improve code formatting and readability in output.rs
* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
* refactor: enhance triage file path handling with improved error management and validation
* refactor: updated func summaries for richer detail
* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries
* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution
* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls
* refactor: implement new Flask routes for safe and unsafe shell command execution
* refactor: separate receiver handling in SSA operations and enhance taint propagation
* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments
* refactor: implement auth decorator extraction and classification for multiple languages
* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation
* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic
* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior
* refactor: standardize default struct initialization across multiple files
* feat: add scripts for formatting checks and auto-fixes with test summaries
* refactor: simplify character splitting and enhance namespace qualifier handling
* refactor: improve documentation clarity and enhance code readability in resolver logic
* refactor: replace default struct initialization with explicit field assignments for clarity
* feat: enhance anonymous function naming by deriving context-based bindings
* refactor: streamline match expressions for improved readability and performance
* refactor: streamline match expressions for improved readability and performance
* refactor: replace loop with while let for improved clarity and performance
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: add SSA constant propagation support to analysis context for improved accuracy
* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis
* feat: add static map analysis for command injection suppression and type safety
* refactor: simplify match statements and reduce line breaks for improved readability
* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution
Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.
Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.
Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.
Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.
Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding
Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet. SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.
Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.
Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`. `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters. Dedup key extended with the primary location
so multi-site events aren't collapsed back together.
Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
!= ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
non-empty `file_rel` — the cap-only → None translation upstream
guarantees this.
Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved. A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.
build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.
Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing). All 1566 lib
tests + integration tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(output): phase 3/5 consume primary sink location in diag + SARIF
When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.
Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
resolved back to an absolute path via a shared resolve_file_rel
helper. Empty file_rel (single-file scans where namespace == "")
resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
locations[0] already reflects the primary sink position via the
updated diag line/col.
Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.
Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
inside the closure).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(bench): phase 4/5 validate primary sink attribution across corpus
Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.
Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
Case. When present, score_location_level additionally requires at
least one flow_step in the finding's evidence trace to fall within
±2 of the call-site range. When absent, the check is skipped —
fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
now-primary Diag.line post-phase-3).
Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
transform::wrap call site (a cross-file propagator, not a sink);
line 9 is Command::new, the real sink. The ±2 tolerance happened to
mask this stale attribution but it was semantically wrong — phase 4
is the right time to correct it. Also adds expected_call_site_lines
[8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
This fixture's sink (Command::new inside run_cmd at line 5) was the
motivating case for phases 1-3; adding the call-site assertion
guards against regression to caller-line attribution.
New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
takes two tainted params and invokes two Command sinks on
consecutive lines. Locks in that primary line lands inside the
helper (lines 5-6), not at the caller (line 12). Notes document
that SinkSite is currently one-per-callee so both findings today
collapse onto the first sink; expected_sink_lines=[5,6] and
expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
004): sink os.system lives in helper.py (cross-file), caller in
app.py reads env source and calls run_cmd. Verifies phase 3's
cross-file primary attribution: Diag.path = helper.py, Diag.line =
5, with app.py:7 recorded in flow_steps as a Call step.
Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test
Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body. Asserts the
resulting Finding.primary_location is exactly that triple.
The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file. This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.
Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).
Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* refactor: clean up formatting and improve readability in multiple files
* refactor: simplify type definition for deduplication key in findings
* test(harness): add must_not_match expectation for FP regression guards
Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules
* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking
* feat: update switch statement handling to improve control flow analysis
* feat: implement promisify alias handling for JS/TS to enhance taint tracking
* feat: enhance taint tracking by refining expectation handling and adding mode filtering
* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters
* feat: update taint tracking rules to enforce full mode matching and improve flow analysis
* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis
* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding
* feat: refine framework detection and update expectation handling for Echo and Sinatra
* feat: implement max_count for taint tracking expectations and deduplicate findings
* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files
* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity
* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files
* feat: add structural invariant checks for SSA bodies
* feat: ensure deterministic phi emission order using BTreeSet
* feat: enhance handling of terminators to ensure authoritative flow through successor edges
* feat: enhance Goto terminator handling to ensure all successors are marked executable
* feat: refactor code for improved readability and organization
* feat: simplify predicate checks and enhance readability in SSA handling
* feat: implement per-file parse timeout and enhance file size handling
* feat: migrate analysis engine toggles from environment variables to configuration file
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: remove unnecessary whitespace in hostile_input_tests.rs
* feat: update dependencies and enhance documentation on language maturity
* feat: enhance security headers and improve request body limits
* feat: implement sink capability bits for deduplication and enhance evidence tagging
* feat: implement dynamic activation handling for gated sinks and enhance validation logic
* feat: enhance configuration documentation and clarify inline analysis cache behavior
* feat: implement panic recovery during analysis to continue scans past errors
* feat: add expectations configuration for taint analysis and performance metrics
* feat: enhance error handling and logging during file reading and mutex locking
* feat: add cross-file body loading tests and plumbing for CF-1 phase
* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures
* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality
* feat: enhance classification span handling in CFG and AST for improved source attribution
* feat: add new Express routes for handling user input and telemetry data
* feat: implement ternary expression handling in CFG with diamond structure for JS/TS
* feat: implement Phase CF-3 abstract-domain transfer channels in summaries
* feat: add support for string-prefix transfer in cross-file calls and update tests
* docs: reduce RESULTS.md doc size
* feat: implement Phase CF-4 per-return-path summary decomposition with tests
* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization
* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests
* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests
* refactor: update comments and documentation for clarity and consistency
* style: format code for consistency and readability
* refactor: simplify verdict handling and improve edge checking logic
* refactor: optimize path and identifier collection by avoiding unnecessary cloning
* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults
* refactor: update documentation and improve clarity in configuration files
* refactor: update documentation and improve clarity in configuration files
* feat: add JS/TS pass-2 convergence tests and expectations configuration
* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic
* feat: implement Phase 7 deduplication and alternative path linking for taint findings
* feat: implement structural DFS index for anonymous functions and update naming conventions
* feat: add Phase 8 regression tests for container-element taint in JS and Python
* feat: add engine-depth profiles and explain-engine option for CLI
* feat: update expectations and add new README fixtures for multi-file scan regression
* feat: implement Phase 11 callback-alias and factory patterns with regression tests
* feat: implement Terminator::Switch for multi-way dispatch and add regression tests
* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants
* refactor: extract cfg and ssa_transfer to submodules
* refactor: cargo fmt
* refactor: remove unnecessary blank line in cfg_tests.rs
* refactor: remove unnecessary planning file
* chore: update Rust version to 1.88 and bump dependencies in Cargo files
* feat: enhance triage UI with new layout and controls, update README for clarity
* feat: enhance triage UI with new layout and controls, update README for clarity
* chore: remove outdated section from README for version 0.5.0
* docs: improve clarity and consistency in README content
* chore: add "GPL-3.0-or-later" to license options in about.toml
* chore: update license handling in about.toml and check-licenses.mjs
* style: format code for improved readability in TriagePage component
* style: format code for improved readability in TriagePage component
* chore: enhance license handling and improve body_id scoping in seed lookup
* feat: introduce owner and parent body IDs for enhanced seed scoping
* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating
* feat: add Undef SSA operation for improved control-flow handling
* style: improve code formatting for consistency and readability in multiple files
* feat: add 16-function chain SCC across multiple files for enhanced analysis
* style: simplify code formatting for improved readability in multiple files
* fix: update CapHitReason default implementation and improve README clarity
* docs: enhance README with detailed explanations of taint analysis and limitations
* docs: refine README for clarity and consistency in taint analysis section
* style: improve code formatting for better readability in NewScanModal and scans
* fix: update cargo-about command to use --offline for deterministic license generation
* fix: update cargo-about command to use --offline for deterministic license generation
* ci: add step to prime cargo registry cache for deterministic license generation
* feat: add support for non-sink collections in authorization analysis
* feat: enhance authorization checks with row-level ownership equality and binding tracking
* feat: implement self-scoped user handling and enhance ownership checks
* refactor: simplify assertions and formatting in authorization analysis tests
* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure
* docs: update AI disclosure section for clarity and conciseness
* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure
* feat: enhance authorization analysis with SSA-derived variable type classification
* feat: implement auth_finding_to_diag function for enhanced security diagnostics
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add args_value_refs to CallSite struct for enhanced argument tracking
* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag
* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks
* feat: enhance error message handling in cli_validation_tests for better Windows compatibility
* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration
* feat: enhance release build process with SBOM generation and SLSA provenance
* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: introduce PathFact handling for path safety checks and rejection logic
* feat: update benchmark data and enhance path sanitization logic with new safety checks
* feat: document AI assistance in frontend UI development and human review process
* feat: add return path facts for enhanced path safety checks and update documentation
* chore: update release date for version 0.5.0 in CHANGELOG.md
* chore: clean up ci.yml by removing outdated comments and clarifying steps
* feat: implement cross-language path sanitizers and validators for enhanced security
* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks
* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases
* refactor: simplify conditional formatting and improve code readability in executor and lower modules
* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers
* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests
* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs
---------
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-25 17:59:11 -04:00
|
|
|
#[test]
|
|
|
|
|
fn detect_in_file_frameworks_go_echo() {
|
|
|
|
|
let src = b"package main\nimport (\n\t\"net/http\"\n\t\"github.com/labstack/echo/v4\"\n)\nfunc x() {}\n";
|
|
|
|
|
let fws = detect_in_file_frameworks(src, "go");
|
|
|
|
|
assert!(fws.contains(&DetectedFramework::Echo));
|
|
|
|
|
assert!(!fws.contains(&DetectedFramework::Gin));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn detect_in_file_frameworks_go_gin() {
|
|
|
|
|
let src = b"package main\nimport \"github.com/gin-gonic/gin\"\n";
|
|
|
|
|
let fws = detect_in_file_frameworks(src, "go");
|
|
|
|
|
assert!(fws.contains(&DetectedFramework::Gin));
|
|
|
|
|
assert!(!fws.contains(&DetectedFramework::Echo));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn detect_in_file_frameworks_ruby_sinatra() {
|
|
|
|
|
let src = b"require 'sinatra'\nget '/' do\n 'hi'\nend\n";
|
|
|
|
|
let fws = detect_in_file_frameworks(src, "ruby");
|
|
|
|
|
assert!(fws.contains(&DetectedFramework::Sinatra));
|
|
|
|
|
assert!(!fws.contains(&DetectedFramework::Rails));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn detect_in_file_frameworks_ruby_sinatra_base() {
|
|
|
|
|
let src = b"require \"sinatra/base\"\nclass App < Sinatra::Base; end\n";
|
|
|
|
|
let fws = detect_in_file_frameworks(src, "ruby");
|
|
|
|
|
assert!(fws.contains(&DetectedFramework::Sinatra));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn detect_in_file_frameworks_plain_go_no_framework() {
|
|
|
|
|
let src = b"package main\nimport \"fmt\"\nfunc main() { fmt.Println(\"hi\") }\n";
|
|
|
|
|
let fws = detect_in_file_frameworks(src, "go");
|
|
|
|
|
assert!(fws.is_empty());
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
|
fn detect_in_file_frameworks_plain_ruby_no_framework() {
|
|
|
|
|
let src = b"require 'json'\nputs JSON.parse('{}')\n";
|
|
|
|
|
let fws = detect_in_file_frameworks(src, "ruby");
|
|
|
|
|
assert!(fws.is_empty());
|
|
|
|
|
}
|