fix(engine): CFG/SSA/taint/IPA soundness, precision & recall fixes

This commit is contained in:
elipeter 2026-06-11 16:46:01 -05:00
parent 59e4359257
commit 246f32a419
39 changed files with 4729 additions and 465 deletions

View file

@ -403,6 +403,12 @@ pub static KINDS: Map<&'static str, Kind> = phf_map! {
"impl_item" => Kind::Block,
"trait_item" => Kind::Block,
"declaration_list" => Kind::Block,
// Inline modules `mod foo { ... }` wrap their items in a
// `declaration_list`; map to Block so the CFG builder recurses into the
// body and the `function_item`s inside are lowered, instead of dropping
// the whole module (the old `Kind::Trivia` mapping discarded every
// function/source/sink inside an inline module).
"mod_item" => Kind::Block,
// data-flow
"call_expression" => Kind::CallFn,
@ -430,7 +436,6 @@ pub static KINDS: Map<&'static str, Kind> = phf_map! {
"{" => Kind::Trivia, "}" => Kind::Trivia, "\n" => Kind::Trivia,
"use_declaration" => Kind::Trivia,
"attribute_item" => Kind::Trivia,
"mod_item" => Kind::Trivia,
"type_item" => Kind::Trivia,
};
@ -614,3 +619,18 @@ pub fn phase_c_auth_rules() -> Vec<RuntimeLabelRule> {
},
]
}
#[cfg(test)]
mod tests {
use super::KINDS;
use crate::labels::Kind;
#[test]
fn mod_item_is_walkable_block_not_trivia() {
// Inline `mod foo { ... }` must be a Block so the CFG builder recurses
// into the module body; the old Trivia mapping dropped every function,
// source, and sink inside inline modules.
assert_eq!(KINDS.get("mod_item"), Some(&Kind::Block));
assert_ne!(KINDS.get("mod_item"), Some(&Kind::Trivia));
}
}