nyx/frontend/src/pages/debug/PointerViewerPage.tsx

201 lines
5.3 KiB
TypeScript
Raw Normal View History

Prerelease cleanup (#46) * feat: Add const_bound_vars tracking to prevent false positives in ownership checks * feat: Introduce field interner and typed bounded vars for enhanced type tracking * feat: Add typed_call_receivers and typed_bounded_dto_fields for enhanced type tracking * feat: Centralize method name extraction with bare_method_name helper * feat: Implement Phase-6 hierarchy fan-out for runtime virtual dispatch * feat: Enhance C++ taint tracking with additional container operations and inline method resolution * feat: Introduce field-sensitive points-to analysis for enhanced resource tracking * feat: Implement Pointer-Phase 6 subscript handling for enhanced container analysis * test: Add comprehensive tests for JavaScript control flow constructs and lattice operations * docs: Update advanced analysis documentation with field-sensitive points-to and hierarchy fan-out details * test: Add comprehensive tests for lattice algebra laws and SSA edge cases * feat: Add destructured session user handling and safe user ID access patterns * feat: Implement row-population reverse-walk for enhanced authorization checks * feat: Enhance authorization checks with local alias chain for self-actor types * feat: Introduce ActiveRecord query safety checks and enhance snippet extraction * feat: Implement chained method call inner-gate rebinding for SSRF prevention * feat: Add observability and error modules, enhance debug functionality, and implement theme context * feat: Remove Auth Analysis page and update navigation to redirect to Explorer * feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor * feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor * feat: Reset path-safe-suppressed spans before lowering to maintain analysis integrity * fix(ssa): ungate debug_assert_bfs_ordering for release-tests build The helper at src/ssa/lower.rs was gated `#[cfg(debug_assertions)]` while the unit test at the bottom of the file was gated only `#[cfg(test)]`. Since `cfg(test)` is set in release builds with `--tests` but `cfg(debug_assertions)` is not, `cargo build --release --tests` failed with E0425. Removing the gate fixes the build; the body is `debug_assert!` only, so the helper is free in release. Also drop the gate at the call site to avoid a `dead_code` warning when the lib is built without `--tests`. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * test(closure-capture): flip JS/TS fixtures to required-finding The JS and TS closure-capture fixtures pinned the old broken behaviour via `forbidden_findings: [{ "id_prefix": "taint-" }]`. The engine now correctly traces taint through the closure boundary (env source captured by an arrow function, sunk via `child_process.exec` inside the body), so the formerly-forbidden finding is a true positive. Match the Python sibling's shape — `required_findings` with `id_prefix` + `min_count` plus a small `noise_budget` — and rewrite the companion READMEs and the phase8_fragility_tests doc-comments from "known gap" to "regression guard". Verified: - cargo test --release --test phase8_fragility_tests → 8/8 pass - cargo test --release --lib bfs_assertion → pass - corpus benchmark F1 = 0.9976 (TP=205, FP=1, FN=0) — unchanged Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat: Add OWASP mapping and baseline mutation hooks for enhanced security analysis * feat: Introduce health module and enhance health score computation with calibration tests * feat: Add expectations configuration and cleanup .gitignore for log files * feat: Implement theme selection and enhance settings panel for triage sync * feat: Suppress false positives for strcpy calls with literal sources in AST * feat: Update analyse_function_ssa to return body CFG for accurate analysis * feat: Add bug report and feature request templates for improved issue tracking * feat: removed dev scripts * feat: update README.md for clarity and consistency in fixture descriptions * feat: removed dev docs * feat: clean up error handling and UI elements for improved user experience * feat: adjust button sizes in HeaderBar for better UI consistency * feat: enhance taint analysis with additional context for sanitizer and taint findings * cargo fmt * prettier * refactor: simplify conditional checks and improve code readability in AST and screenshot capture scripts * feat: add script to frame PNG screenshots with brand gradient * feat: add fuzzing support with new targets and CI workflows * refactor: streamline match expressions and improve formatting in CLI and output handling * feat: enhance configuration display with detailed output options * feat: stage demo configuration for improved CLI screenshot output * feat: expose merge_configs function for user-configurable settings * refactor: simplify code structure and improve readability in config handling * refactor: improve descriptions for vulnerability patterns in various languages * feat: update MIT License section with additional usage details and copyright information * feat: update screenshots * refactor: update build process and paths for frontend assets * feat: add cross-file taint fuzzing target and supporting dictionary * refactor: clean up formatting and comments in fuzz configuration and example files * refactor: remove outdated comments and clean up CI configuration files * chore: update changelog dates and improve formatting in documentation * refactor: update Cargo.toml and CI configuration for improved packaging and build process * refactor: enhance quote-stripping logic to prevent panics and add regression tests --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-29 00:58:38 -04:00
import { useMemo } from 'react';
import { useDebugPointer } from '../../api/queries/debug';
import { ApiError } from '../../api/client';
import { EmptyState } from '../../components/ui/EmptyState';
import { ErrorState } from '../../components/ui/ErrorState';
import { LoadingState } from '../../components/ui/LoadingState';
import type {
PointerLocationView,
PointerValueView,
PointerFieldEntryView,
} from '../../api/types';
interface PointerAnalysisPanelProps {
file: string;
functionName: string;
}
export function PointerAnalysisPanel({
file,
functionName,
}: PointerAnalysisPanelProps) {
const { data, isLoading, error } = useDebugPointer(file, functionName);
if (isLoading) {
return <LoadingState message="Loading points-to facts..." />;
}
if (error) {
if (error instanceof ApiError && error.status === 404) {
return (
<EmptyState message="Pointer analysis is not available for the selected function." />
);
}
return <ErrorState message="Failed to load pointer analysis." />;
}
if (
!data ||
(data.values.length === 0 &&
data.field_reads.length === 0 &&
data.field_writes.length === 0)
) {
return (
<EmptyState message="No points-to facts were derived for this function. Pointer analysis flags up parameters, allocation sites, and field projections; functions that only manipulate scalars will appear empty." />
);
}
return (
<div className="abstract-interp-viewer">
<div className="abstract-block">
<div className="abstract-block-header">
<h3 style={{ margin: 0 }}>Per-Value Points-To</h3>
<span className="text-secondary">
{data.values.length} value
{data.values.length === 1 ? '' : 's'} · {data.location_count}{' '}
location
{data.location_count === 1 ? '' : 's'}
</span>
</div>
{data.values.length === 0 ? (
<p className="abstract-empty">
All SSA values point to nothing tracked.
</p>
) : (
<PointerValueTable values={data.values} locations={data.locations} />
)}
</div>
{data.field_reads.length > 0 && (
<FieldEntriesBlock
title="Field Reads"
entries={data.field_reads}
emptyHint="(no parameter field reads recorded)"
/>
)}
{data.field_writes.length > 0 && (
<FieldEntriesBlock
title="Field Writes"
entries={data.field_writes}
emptyHint="(no parameter field writes recorded)"
/>
)}
</div>
);
}
function PointerValueTable({
values,
locations,
}: {
values: PointerValueView[];
locations: PointerLocationView[];
}) {
const locById = useMemo(() => {
const map = new Map<number, PointerLocationView>();
for (const loc of locations) map.set(loc.id, loc);
return map;
}, [locations]);
return (
<table className="abstract-table">
<thead>
<tr>
<th>Value</th>
<th>Name</th>
<th>Points-To</th>
</tr>
</thead>
<tbody>
{values.map((v) => (
<tr key={v.ssa_value}>
<td className="mono">v{v.ssa_value}</td>
<td className="mono">{v.var_name ?? '-'}</td>
<td>
{v.is_top ? (
<span
className="cap-badge cap-badge-sink"
title="Over-approximation"
>
(top)
</span>
) : (
v.points_to.map((id) => (
<LocationChip key={id} loc={locById.get(id)} />
))
)}
</td>
</tr>
))}
</tbody>
</table>
);
}
function LocationChip({ loc }: { loc?: PointerLocationView }) {
if (!loc) {
return (
<span className="cap-badge" title="Unknown location id">
?
</span>
);
}
const className =
loc.kind === 'Top'
? 'cap-badge cap-badge-sink'
: loc.kind === 'Field'
? 'cap-badge cap-badge-sanitizer'
: 'cap-badge cap-badge-source';
return (
<span
className={className}
title={`${loc.kind} (loc#${loc.id})`}
style={{ marginRight: 4 }}
>
{loc.display}
</span>
);
}
function FieldEntriesBlock({
title,
entries,
emptyHint,
}: {
title: string;
entries: PointerFieldEntryView[];
emptyHint: string;
}) {
return (
<div className="abstract-block">
<div className="abstract-block-header">
<h3 style={{ margin: 0 }}>{title}</h3>
<span className="text-secondary">
{entries.length} entr{entries.length === 1 ? 'y' : 'ies'}
</span>
</div>
{entries.length === 0 ? (
<p className="abstract-empty">{emptyHint}</p>
) : (
<table className="abstract-table">
<thead>
<tr>
<th>Target</th>
<th>Field</th>
</tr>
</thead>
<tbody>
{entries.map((e, i) => (
<tr key={`${e.param_index ?? 'self'}-${e.field}-${i}`}>
<td className="mono">
{e.param_index === null ? 'self' : `param[${e.param_index}]`}
</td>
<td className="mono">{e.field}</td>
</tr>
))}
</tbody>
</table>
)}
</div>
);
}