mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-15 20:05:13 +02:00
Release/0.5.0 (#35)
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures * feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests * feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements * feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles * feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing * feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling * feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures * feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration * feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests * feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic * feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection * feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements * feat: Enable auth-state analysis by default and update relevant tests in benchmark config * test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test * docs: update CHANGELOG.md * feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers * feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers * feat: Implement per-index array slot tracking in symbolic heap with overflow collapse * feat: Add implicit definition handling for uninitialized declarations in SSA value allocation * feat: Refactor function parameters and constants for improved clarity and maintainability * refactor: Reorder module imports and improve formatting for consistency * refactor: Fix formatting erorrs * refactor: Fix clippy warnings * refactor: Fix fmt warnings (again) * chore: Update dependencies and improve feature configuration * Add comprehensive tests for undertested modules (#36) (COPILOT) * Add comprehensive tests for undertested modules Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083 * Add comprehensive tests for ext, project, walk, and errors modules Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> * chore: Update dependencies and improve feature configuration * fix: formatting errors in new tests * chore: Update license list in about.toml * chore: made functions input inline * chore: updated cfg graph to take up the full page * chore: add Prettier configuration and update code formatting * Add frontend test suite with Vitest (111 tests) (#37) * Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7 * ci: add frontend test step to CI workflow Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> * chore: simplify array initialization in test files for consistency * ran typecheck * feat: add AnalysisWorkspace component and integrate it into CfgViewerPage * feat: update routing in AppLayout and improve empty state message in ExplorerPage * feat: enhance scan progress tracking with additional metrics and stages * feat: update license information and add license check script * feat: implement cross-file symbolic execution with callee body persistence * feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering * feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions * feat: enhance resource tracking with proxy method summaries and improve finding extraction * feat: add terminal function exit detection for accurate resource leak analysis * feat: add warnings for loops and functions without bodies to improve error recovery * feat: update lambda expression handling to ensure proper function classification and control flow * feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling * feat: add inline return taint analysis and regression tests for improved security checks * feat: add engine version management and migration handling for database schema updates * feat: enhance first_call_ident to skip nested function bodies and add regression tests * feat: enhance callee name resolution with two-segment normalization and disambiguation * feat: add cross-file context flags and debug assertions for taint analysis * feat: refactor taint analysis structure to unify context handling and improve clarity * feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests * docs: updated CHANGELOG.md * fmt: formatting fixes * fix: fixed frontend formatting and lint warnings * fix: optimized ci * fix: optimized ci * Add comprehensive multi-file test coverage to Nyx (#38) * Initial checklist for multi-file test suite expansion Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23 Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> * Add 12 new multi-file test fixtures with TP/TN/near-miss coverage Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23 Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> * deleted root repo * rebuilt to test for regressions --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> Co-authored-by: elipeter <elicpeter@gmail.com> * feat: enhance import alias resolution and taint tracking * feat: implement security hardening with CSRF protection and path validation * feat: add support for import alias bindings in Python, PHP, and Rust * feat: enhance CFG analysis modes and improve code readability * feat: add detection for parameterized SQL queries to enhance security * feat: add safe internal redirect handling and enhance session destroy validation * feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads * feat: enhance taint detection by adding support for inline source member expressions in call arguments * feat: implement pre-emission of Source nodes for inline source member expressions in call arguments * feat: add support for Throw statement in control flow and error handling * feat: add debug and echo endpoints with potential information leakage * feat: implement internal redirect suppression and enhance taint detection * feat: implement module alias tracking for dynamic dispatch in JS/TS * feat: add authorization analysis module with Express support * feat: add authorization analysis module with Express support * feat: add tests for admin guard requirements and clean checks in authorization analysis * feat: integrate Koa and Fastify frameworks into authorization analysis * feat: add Flask and Django support to authorization analysis module * feat: add support for Rails and Sinatra frameworks in authorization analysis * feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis * feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis * feat: add support for Rails and Sinatra in authorization analysis * chore: add .DS_Store to .gitignore * refactor: simplify conditional checks and improve readability in multiple files * refactor: update usage of Option methods for improved clarity and consistency * refactor: improve code readability by simplifying conditional checks and formatting * refactor: improve code formatting and readability by simplifying conditional checks * refactor: simplify conditional checks and improve readability in multiple files * refactor: simplify conditional checks in axum.rs for improved readability * feat: add CodeQL analysis configuration for enhanced security scanning * test: add comprehensive tests for `src/output.rs` SARIF builder (#39) * chore: start test coverage improvement work Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423 Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> * test: add comprehensive tests for src/output.rs SARIF builder Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423 Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> * refactor: improve code formatting and readability in output.rs --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> Co-authored-by: elipeter <elicpeter@gmail.com> * refactor: improve code formatting and readability in output.rs * Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * refactor: enhance triage file path handling with improved error management and validation * refactor: updated func summaries for richer detail * refactor: update SSA summary extraction to use canonical FuncKey for distinct entries * refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution * refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls * refactor: implement new Flask routes for safe and unsafe shell command execution * refactor: separate receiver handling in SSA operations and enhance taint propagation * refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments * refactor: implement auth decorator extraction and classification for multiple languages * refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation * refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic * refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior * refactor: standardize default struct initialization across multiple files * feat: add scripts for formatting checks and auto-fixes with test summaries * refactor: simplify character splitting and enhance namespace qualifier handling * refactor: improve documentation clarity and enhance code readability in resolver logic * refactor: replace default struct initialization with explicit field assignments for clarity * feat: enhance anonymous function naming by deriving context-based bindings * refactor: streamline match expressions for improved readability and performance * refactor: streamline match expressions for improved readability and performance * refactor: replace loop with while let for improved clarity and performance * feat: add SSA constant propagation support to analysis context for improved accuracy * feat: add SSA constant propagation support to analysis context for improved accuracy * feat: implement shell metacharacter validation and bounded-length checks in Rust analysis * feat: add static map analysis for command injection suppression and type safety * refactor: simplify match statements and reduce line breaks for improved readability * feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the primary sink source-location through function summaries. Swap SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a backward-compatible cap_sites() helper and serde defaults so pre-phase-1 on-disk rows continue to deserialise cleanly. Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the locator in for the persisted pass-1 path, while pass-2 intra-file transient summaries fall back to cap-only sites (behavior unchanged). Merge: GlobalSummaries::insert now unions sink sites with (file_rel, line, col, cap) dedup via shared union_param_sink_sites helper. Database: JSON-serialised summary columns carry the new shape automatically; no schema change needed. Phase 2 will consume SinkSite in build_taint_diag() to overwrite the caller-site Finding.line with the callee's sink line when resolved via summary. Phase 1 keeps behavior unchanged: scanning tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the same (wrong) line 10 finding. Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink sites, legacy-JSON default handling for both summary types, and merge dedup. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding Plumb Phase 1's SinkSite through the event pipeline into Findings, no output change yet. SsaTaintEvent gains `primary_sink_site: Option<SinkSite>`; when the main or callback sink-emission path has non-empty `param_to_sink_sites`, filter to sites whose `(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per distinct site — the multi-primary collapse keeps each downstream Finding single-primary. Resolution: ResolvedSummary and SinkInfo gain mirror `param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink` (SSA + callback paths) and `FuncSummary.param_to_sink` (global paths). Label, local-summary, and interop resolution paths leave the field empty — they only ever had cap-level info to begin with. Finding: new `primary_location: Option<SinkLocation>` with `file_rel/line/col`. `ssa_events_to_findings` maps `event.primary_sink_site` → `Finding.primary_location`, filtering cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never leaks to formatters. Dedup key extended with the primary location so multi-site events aren't collapsed back together. Invariants (debug_assert!): * every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps != ∅` — enforced by the pick_primary_sink_sites* filters; * every populated Finding.primary_location has `line != 0` AND non-empty `file_rel` — the cap-only → None translation upstream guarantees this. Deliberately independent of `uses_summary`: that flag tracks whether the *taint chain* used a summary, whereas primary attribution requires only that the *sink* itself was summary-resolved. A local source reaching a cross-file sink produces `uses_summary=false` alongside a populated primary_location — documented on Finding.primary_location, covered by `cross_file_sink_finding_carries_primary_location`. build_taint_diag, SARIF/JSON/explanation formatters, and the benchmark scorer remain untouched: finding.line still comes from `cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10 and the benchmark's rs-cmdi-003 row still shows FN in the LOC column. Tests: `cross_file_sink_finding_carries_primary_location` (proves plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and `cross_file_sink_cap_only_site_leaves_primary_location_none` (regression guard against cap-only sites surfacing). All 1566 lib tests + integration tests pass. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(output): phase 3/5 consume primary sink location in diag + SARIF When a finding's primary_location (populated in phase 2 from a callee summary's SinkSite) names the dangerous instruction inside a callee body, attribute the diagnostic line to that location instead of the caller's call site. The call site is demoted to a Call step in flow_steps, and a synthetic Sink step at the primary location is appended so analysts still see the full trace. Changes: - Add scan_root parameter to build_taint_diag so file_rel can be resolved back to an absolute path via a shared resolve_file_rel helper. Empty file_rel (single-file scans where namespace == "") resolves to the file under analysis. - Extend SinkLocation with snippet, carried from the upstream SinkSite so the formatter needs no second file read. - Relax the ssa_events_to_findings debug_assert to allow empty file_rel, which is valid when scan root equals the file itself. - SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[]; locations[0] already reflects the primary sink position via the updated diag line/col. Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs now reports line 5 (Command::new) as the primary sink, with the call site at line 10 visible in flow_steps. Two expect.json fixtures updated (must_match line_range widened): - javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is the real sink inside run()). - rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new inside the closure). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(bench): phase 4/5 validate primary sink attribution across corpus Extend the benchmark scorer and ground truth to lock in phase 3's primary-location behavior, and add fixtures that exercise the new capability end-to-end. Scorer (tests/benchmark_test.rs): - Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on Case. When present, score_location_level additionally requires at least one flow_step in the finding's evidence trace to fall within ±2 of the call-site range. When absent, the check is skipped — fully forward-compatible with existing fixtures. - Retain ±2 tolerance on expected_sink_lines (compared against the now-primary Diag.line post-phase-3). Ground truth edits: - rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the transform::wrap call site (a cross-file propagator, not a sink); line 9 is Command::new, the real sink. The ±2 tolerance happened to mask this stale attribution but it was semantically wrong — phase 4 is the right time to correct it. Also adds expected_call_site_lines [8,8] so the new field is exercised on an existing cross-file case. - rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call). This fixture's sink (Command::new inside run_cmd at line 5) was the motivating case for phases 1-3; adding the call-site assertion guards against regression to caller-line attribution. New fixtures: - rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both takes two tainted params and invokes two Command sinks on consecutive lines. Locks in that primary line lands inside the helper (lines 5-6), not at the caller (line 12). Notes document that SinkSite is currently one-per-callee so both findings today collapse onto the first sink; expected_sink_lines=[5,6] and expected_call_site_lines=[12,12] stay valid either way. - python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross- 004): sink os.system lives in helper.py (cross-file), caller in app.py reads env source and calls run_cmd. Verifies phase 3's cross-file primary attribution: Diag.path = helper.py, Diag.line = 5, with app.py:7 recorded in flow_steps as a Call step. Acceptance: - `cargo test --test benchmark_test -- --ignored --nocapture` passes. - rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are TP/TP/TP. - Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994 F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on 264 pre-phase-4, delta is the +2 new cases both resolving TP). - Full `cargo test` green (1566 lib tests + all integration tests). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(taint): phase 5/5 lock Finding.primary_location contract via regression test Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three emission stages (pick_primary_sink_sites → emit_ssa_taint_events → ssa_events_to_findings) against a minimal caller SSA body. Asserts the resulting Finding.primary_location is exactly that triple. The existing integration tests in src/taint/tests.rs cover the coarse FuncSummary path end-to-end through analyse_file. This test locks in the lower-level SSA-side plumbing so a future refactor that silently drops the site between pick → emit → findings fails here rather than only at the benchmark layer. Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003 remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4). Closes the primary sink-location attribution feature (phases 1-5/5): * Phase 1 — SinkSite data model on summaries. * Phase 2 — SinkSite threaded into SsaTaintEvent and Finding. * Phase 3 — diag + SARIF consume primary_location. * Phase 4 — benchmark validates primary_call_site_lines across corpus. * Phase 5 — regression test locks the event→finding contract. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor: clean up formatting and improve readability in multiple files * refactor: simplify type definition for deduplication key in findings * test(harness): add must_not_match expectation for FP regression guards Extends ExpectedFinding with must_not_match field that asserts a diagnostic must NOT fire — presence is a hard failure. Non-consuming scan so it coexists with must_match entries on the same rule_id. Adds forbidden_violations accumulator and updates summary line. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules * feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking * feat: update switch statement handling to improve control flow analysis * feat: implement promisify alias handling for JS/TS to enhance taint tracking * feat: enhance taint tracking by refining expectation handling and adding mode filtering * feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters * feat: update taint tracking rules to enforce full mode matching and improve flow analysis * feat: enhance Ruby subshell handling to improve taint tracking and flow analysis * feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding * feat: refine framework detection and update expectation handling for Echo and Sinatra * feat: implement max_count for taint tracking expectations and deduplicate findings * feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files * feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity * feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files * feat: add structural invariant checks for SSA bodies * feat: ensure deterministic phi emission order using BTreeSet * feat: enhance handling of terminators to ensure authoritative flow through successor edges * feat: enhance Goto terminator handling to ensure all successors are marked executable * feat: refactor code for improved readability and organization * feat: simplify predicate checks and enhance readability in SSA handling * feat: implement per-file parse timeout and enhance file size handling * feat: migrate analysis engine toggles from environment variables to configuration file * feat: remove unnecessary whitespace in hostile_input_tests.rs * feat: remove unnecessary whitespace in hostile_input_tests.rs * feat: update dependencies and enhance documentation on language maturity * feat: enhance security headers and improve request body limits * feat: implement sink capability bits for deduplication and enhance evidence tagging * feat: implement dynamic activation handling for gated sinks and enhance validation logic * feat: enhance configuration documentation and clarify inline analysis cache behavior * feat: implement panic recovery during analysis to continue scans past errors * feat: add expectations configuration for taint analysis and performance metrics * feat: enhance error handling and logging during file reading and mutex locking * feat: add cross-file body loading tests and plumbing for CF-1 phase * feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures * feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality * feat: enhance classification span handling in CFG and AST for improved source attribution * feat: add new Express routes for handling user input and telemetry data * feat: implement ternary expression handling in CFG with diamond structure for JS/TS * feat: implement Phase CF-3 abstract-domain transfer channels in summaries * feat: add support for string-prefix transfer in cross-file calls and update tests * docs: reduce RESULTS.md doc size * feat: implement Phase CF-4 per-return-path summary decomposition with tests * feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization * feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests * feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests * refactor: update comments and documentation for clarity and consistency * style: format code for consistency and readability * refactor: simplify verdict handling and improve edge checking logic * refactor: optimize path and identifier collection by avoiding unnecessary cloning * chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults * refactor: update documentation and improve clarity in configuration files * refactor: update documentation and improve clarity in configuration files * feat: add JS/TS pass-2 convergence tests and expectations configuration * feat: add Phase 5 regression tests for inline cache origin attribution and update related logic * feat: implement Phase 7 deduplication and alternative path linking for taint findings * feat: implement structural DFS index for anonymous functions and update naming conventions * feat: add Phase 8 regression tests for container-element taint in JS and Python * feat: add engine-depth profiles and explain-engine option for CLI * feat: update expectations and add new README fixtures for multi-file scan regression * feat: implement Phase 11 callback-alias and factory patterns with regression tests * feat: implement Terminator::Switch for multi-way dispatch and add regression tests * feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants * refactor: extract cfg and ssa_transfer to submodules * refactor: cargo fmt * refactor: remove unnecessary blank line in cfg_tests.rs * refactor: remove unnecessary planning file * chore: update Rust version to 1.88 and bump dependencies in Cargo files * feat: enhance triage UI with new layout and controls, update README for clarity * feat: enhance triage UI with new layout and controls, update README for clarity * chore: remove outdated section from README for version 0.5.0 * docs: improve clarity and consistency in README content * chore: add "GPL-3.0-or-later" to license options in about.toml * chore: update license handling in about.toml and check-licenses.mjs * style: format code for improved readability in TriagePage component * style: format code for improved readability in TriagePage component * chore: enhance license handling and improve body_id scoping in seed lookup * feat: introduce owner and parent body IDs for enhanced seed scoping * feat: implement direction-aware engine provenance with new CLI flag for strict CI gating * feat: add Undef SSA operation for improved control-flow handling * style: improve code formatting for consistency and readability in multiple files * feat: add 16-function chain SCC across multiple files for enhanced analysis * style: simplify code formatting for improved readability in multiple files * fix: update CapHitReason default implementation and improve README clarity * docs: enhance README with detailed explanations of taint analysis and limitations * docs: refine README for clarity and consistency in taint analysis section * style: improve code formatting for better readability in NewScanModal and scans * fix: update cargo-about command to use --offline for deterministic license generation * fix: update cargo-about command to use --offline for deterministic license generation * ci: add step to prime cargo registry cache for deterministic license generation * feat: add support for non-sink collections in authorization analysis * feat: enhance authorization checks with row-level ownership equality and binding tracking * feat: implement self-scoped user handling and enhance ownership checks * refactor: simplify assertions and formatting in authorization analysis tests * fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure * docs: update AI disclosure section for clarity and conciseness * feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure * feat: enhance authorization analysis with SSA-derived variable type classification * feat: implement auth_finding_to_diag function for enhanced security diagnostics * feat: add args_value_refs to CallSite struct for enhanced argument tracking * feat: add args_value_refs to CallSite struct for enhanced argument tracking * feat: add direction-aware engine provenance with LossDirection classification and new CLI flag * feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks * feat: enhance error message handling in cli_validation_tests for better Windows compatibility * feat: optimize release profile settings in Cargo.toml and update CodeQL configuration * feat: enhance release build process with SBOM generation and SLSA provenance * feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries * feat: introduce PathFact handling for path safety checks and rejection logic * feat: introduce PathFact handling for path safety checks and rejection logic * feat: update benchmark data and enhance path sanitization logic with new safety checks * feat: document AI assistance in frontend UI development and human review process * feat: add return path facts for enhanced path safety checks and update documentation * chore: update release date for version 0.5.0 in CHANGELOG.md * chore: clean up ci.yml by removing outdated comments and clarifying steps * feat: implement cross-language path sanitizers and validators for enhanced security * feat: enhance SSA value usage tracking by including block terminators and improve path safety checks * feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases * refactor: simplify conditional formatting and improve code readability in executor and lower modules * feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues * feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers * feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers * feat: add transform classifiers for Java, Go, and Ruby with corresponding tests * refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Eli Peter
GitHub
parent
c4ce08b452
commit
41128177d2
2144 changed files with 201812 additions and 8927 deletions
104
frontend/src/api/client.ts
Normal file
104
frontend/src/api/client.ts
Normal file
|
|
@ -0,0 +1,104 @@
|
|||
const BASE = '/api';
|
||||
const CSRF_HEADER = 'X-Nyx-CSRF';
|
||||
let csrfTokenPromise: Promise<string> | null = null;
|
||||
|
||||
export class ApiError extends Error {
|
||||
constructor(
|
||||
public status: number,
|
||||
message: string,
|
||||
) {
|
||||
super(message);
|
||||
this.name = 'ApiError';
|
||||
}
|
||||
}
|
||||
|
||||
async function getCsrfToken(): Promise<string> {
|
||||
if (!csrfTokenPromise) {
|
||||
csrfTokenPromise = fetch(`${BASE}/session`)
|
||||
.then(async (res) => {
|
||||
if (!res.ok) {
|
||||
throw new ApiError(
|
||||
res.status,
|
||||
await res.text().catch(() => res.statusText),
|
||||
);
|
||||
}
|
||||
|
||||
const text = await res.text();
|
||||
const payload = text
|
||||
? (JSON.parse(text) as { csrf_token?: unknown })
|
||||
: {};
|
||||
if (
|
||||
typeof payload.csrf_token !== 'string' ||
|
||||
payload.csrf_token.length === 0
|
||||
) {
|
||||
throw new ApiError(500, 'Missing CSRF token');
|
||||
}
|
||||
|
||||
return payload.csrf_token;
|
||||
})
|
||||
.catch((error) => {
|
||||
csrfTokenPromise = null;
|
||||
throw error;
|
||||
});
|
||||
}
|
||||
|
||||
return csrfTokenPromise;
|
||||
}
|
||||
|
||||
function isMutatingMethod(method?: string): boolean {
|
||||
const upper = (method || 'GET').toUpperCase();
|
||||
return (
|
||||
upper === 'POST' ||
|
||||
upper === 'PUT' ||
|
||||
upper === 'PATCH' ||
|
||||
upper === 'DELETE'
|
||||
);
|
||||
}
|
||||
|
||||
async function request<T>(path: string, opts: RequestInit = {}): Promise<T> {
|
||||
const { headers: rawHeaders, ...rest } = opts;
|
||||
const url = `${BASE}${path}`;
|
||||
const headers: Record<string, string> = {
|
||||
...(rawHeaders as Record<string, string>),
|
||||
};
|
||||
if (isMutatingMethod(rest.method)) {
|
||||
headers[CSRF_HEADER] = await getCsrfToken();
|
||||
}
|
||||
if (opts.body) {
|
||||
headers['Content-Type'] = 'application/json';
|
||||
}
|
||||
const res = await fetch(url, {
|
||||
...rest,
|
||||
headers,
|
||||
});
|
||||
|
||||
if (!res.ok) {
|
||||
const text = await res.text().catch(() => res.statusText);
|
||||
throw new ApiError(res.status, text);
|
||||
}
|
||||
|
||||
// Handle empty responses
|
||||
const text = await res.text();
|
||||
if (!text) return undefined as T;
|
||||
return JSON.parse(text) as T;
|
||||
}
|
||||
|
||||
export function apiGet<T>(path: string, signal?: AbortSignal): Promise<T> {
|
||||
return request<T>(path, { signal });
|
||||
}
|
||||
|
||||
export function apiPost<T>(
|
||||
path: string,
|
||||
body?: unknown,
|
||||
signal?: AbortSignal,
|
||||
): Promise<T> {
|
||||
return request<T>(path, {
|
||||
method: 'POST',
|
||||
body: body != null ? JSON.stringify(body) : undefined,
|
||||
signal,
|
||||
});
|
||||
}
|
||||
|
||||
export function apiDelete<T>(path: string, signal?: AbortSignal): Promise<T> {
|
||||
return request<T>(path, { method: 'DELETE', signal });
|
||||
}
|
||||
157
frontend/src/api/mutations/config.ts
Normal file
157
frontend/src/api/mutations/config.ts
Normal file
|
|
@ -0,0 +1,157 @@
|
|||
import { useMutation, useQueryClient } from '@tanstack/react-query';
|
||||
import { apiPost, apiDelete } from '../client';
|
||||
import type { LabelEntryView, TerminatorView, ProfileView } from '../types';
|
||||
|
||||
// --- Sources ---
|
||||
|
||||
export interface AddLabelBody {
|
||||
lang: string;
|
||||
matchers: string[];
|
||||
cap: string;
|
||||
case_sensitive?: boolean;
|
||||
}
|
||||
|
||||
export function useAddSource() {
|
||||
const qc = useQueryClient();
|
||||
return useMutation({
|
||||
mutationFn: (body: AddLabelBody) =>
|
||||
apiPost<LabelEntryView>('/config/sources', body),
|
||||
onSuccess: () => {
|
||||
qc.invalidateQueries({ queryKey: ['config', 'sources'] });
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
export function useDeleteSource() {
|
||||
const qc = useQueryClient();
|
||||
return useMutation({
|
||||
mutationFn: (body: AddLabelBody) => apiDelete<void>('/config/sources'),
|
||||
onSuccess: () => {
|
||||
qc.invalidateQueries({ queryKey: ['config', 'sources'] });
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
// --- Sinks ---
|
||||
|
||||
export function useAddSink() {
|
||||
const qc = useQueryClient();
|
||||
return useMutation({
|
||||
mutationFn: (body: AddLabelBody) =>
|
||||
apiPost<LabelEntryView>('/config/sinks', body),
|
||||
onSuccess: () => {
|
||||
qc.invalidateQueries({ queryKey: ['config', 'sinks'] });
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
export function useDeleteSink() {
|
||||
const qc = useQueryClient();
|
||||
return useMutation({
|
||||
mutationFn: (body: AddLabelBody) => apiDelete<void>('/config/sinks'),
|
||||
onSuccess: () => {
|
||||
qc.invalidateQueries({ queryKey: ['config', 'sinks'] });
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
// --- Sanitizers ---
|
||||
|
||||
export function useAddSanitizer() {
|
||||
const qc = useQueryClient();
|
||||
return useMutation({
|
||||
mutationFn: (body: AddLabelBody) =>
|
||||
apiPost<LabelEntryView>('/config/sanitizers', body),
|
||||
onSuccess: () => {
|
||||
qc.invalidateQueries({ queryKey: ['config', 'sanitizers'] });
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
export function useDeleteSanitizer() {
|
||||
const qc = useQueryClient();
|
||||
return useMutation({
|
||||
mutationFn: (body: AddLabelBody) => apiDelete<void>('/config/sanitizers'),
|
||||
onSuccess: () => {
|
||||
qc.invalidateQueries({ queryKey: ['config', 'sanitizers'] });
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
// --- Terminators ---
|
||||
|
||||
export interface AddTerminatorBody {
|
||||
lang: string;
|
||||
name: string;
|
||||
}
|
||||
|
||||
export function useAddTerminator() {
|
||||
const qc = useQueryClient();
|
||||
return useMutation({
|
||||
mutationFn: (body: AddTerminatorBody) =>
|
||||
apiPost<TerminatorView>('/config/terminators', body),
|
||||
onSuccess: () => {
|
||||
qc.invalidateQueries({ queryKey: ['config', 'terminators'] });
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
export function useDeleteTerminator() {
|
||||
const qc = useQueryClient();
|
||||
return useMutation({
|
||||
mutationFn: (body: AddTerminatorBody) =>
|
||||
apiDelete<void>('/config/terminators'),
|
||||
onSuccess: () => {
|
||||
qc.invalidateQueries({ queryKey: ['config', 'terminators'] });
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
// --- Profiles ---
|
||||
|
||||
export function useAddProfile() {
|
||||
const qc = useQueryClient();
|
||||
return useMutation({
|
||||
mutationFn: (body: { name: string; settings: Record<string, unknown> }) =>
|
||||
apiPost<ProfileView>('/config/profiles', body),
|
||||
onSuccess: () => {
|
||||
qc.invalidateQueries({ queryKey: ['config', 'profiles'] });
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
export function useDeleteProfile() {
|
||||
const qc = useQueryClient();
|
||||
return useMutation({
|
||||
mutationFn: (name: string) =>
|
||||
apiDelete<void>(`/config/profiles/${encodeURIComponent(name)}`),
|
||||
onSuccess: () => {
|
||||
qc.invalidateQueries({ queryKey: ['config', 'profiles'] });
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
export function useActivateProfile() {
|
||||
const qc = useQueryClient();
|
||||
return useMutation({
|
||||
mutationFn: (name: string) =>
|
||||
apiPost<void>(`/config/profiles/${encodeURIComponent(name)}/activate`),
|
||||
onSuccess: () => {
|
||||
qc.invalidateQueries({ queryKey: ['config'] });
|
||||
qc.invalidateQueries({ queryKey: ['config', 'profiles'] });
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
// --- Triage Sync ---
|
||||
|
||||
export function useToggleTriageSync() {
|
||||
const qc = useQueryClient();
|
||||
return useMutation({
|
||||
mutationFn: (body: { enabled: boolean }) =>
|
||||
apiPost<void>('/config/triage-sync', body),
|
||||
onSuccess: () => {
|
||||
qc.invalidateQueries({ queryKey: ['triage', 'sync-status'] });
|
||||
},
|
||||
});
|
||||
}
|
||||
24
frontend/src/api/mutations/rules.ts
Normal file
24
frontend/src/api/mutations/rules.ts
Normal file
|
|
@ -0,0 +1,24 @@
|
|||
import { useMutation, useQueryClient } from '@tanstack/react-query';
|
||||
import { apiPost } from '../client';
|
||||
|
||||
export function useToggleRule() {
|
||||
const qc = useQueryClient();
|
||||
return useMutation({
|
||||
mutationFn: (id: string) =>
|
||||
apiPost<void>(`/rules/${encodeURIComponent(id)}/toggle`),
|
||||
onSuccess: () => {
|
||||
qc.invalidateQueries({ queryKey: ['rules'] });
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
export function useCloneRule() {
|
||||
const qc = useQueryClient();
|
||||
return useMutation({
|
||||
mutationFn: (body: { rule_id: string }) =>
|
||||
apiPost<void>('/rules/clone', body),
|
||||
onSuccess: () => {
|
||||
qc.invalidateQueries({ queryKey: ['rules'] });
|
||||
},
|
||||
});
|
||||
}
|
||||
34
frontend/src/api/mutations/scans.ts
Normal file
34
frontend/src/api/mutations/scans.ts
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
import { useMutation, useQueryClient } from '@tanstack/react-query';
|
||||
import { apiPost, apiDelete } from '../client';
|
||||
import type { ScanView } from '../types';
|
||||
|
||||
export type ScanMode = 'full' | 'ast' | 'cfg' | 'taint';
|
||||
export type EngineProfile = 'fast' | 'balanced' | 'deep';
|
||||
|
||||
export interface StartScanBody {
|
||||
scan_root?: string;
|
||||
mode?: ScanMode;
|
||||
engine_profile?: EngineProfile;
|
||||
}
|
||||
|
||||
export function useStartScan() {
|
||||
const qc = useQueryClient();
|
||||
return useMutation({
|
||||
mutationFn: (body?: StartScanBody) => apiPost<ScanView>('/scans', body),
|
||||
onSuccess: () => {
|
||||
qc.invalidateQueries({ queryKey: ['scans'] });
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
export function useDeleteScan() {
|
||||
const qc = useQueryClient();
|
||||
return useMutation({
|
||||
mutationFn: (id: string) =>
|
||||
apiDelete<void>(`/scans/${encodeURIComponent(id)}`),
|
||||
onSuccess: () => {
|
||||
qc.invalidateQueries({ queryKey: ['scans'] });
|
||||
qc.invalidateQueries({ queryKey: ['overview'] });
|
||||
},
|
||||
});
|
||||
}
|
||||
86
frontend/src/api/mutations/triage.ts
Normal file
86
frontend/src/api/mutations/triage.ts
Normal file
|
|
@ -0,0 +1,86 @@
|
|||
import { useMutation, useQueryClient } from '@tanstack/react-query';
|
||||
import { apiPost, apiDelete } from '../client';
|
||||
|
||||
export interface BulkTriageBody {
|
||||
fingerprints: string[];
|
||||
state: string;
|
||||
note?: string;
|
||||
}
|
||||
|
||||
export interface UpdateFindingTriageBody {
|
||||
state: string;
|
||||
note?: string;
|
||||
}
|
||||
|
||||
export interface AddSuppressionBody {
|
||||
by: string;
|
||||
value: string;
|
||||
note?: string;
|
||||
}
|
||||
|
||||
export function useBulkTriage() {
|
||||
const qc = useQueryClient();
|
||||
return useMutation({
|
||||
mutationFn: (body: BulkTriageBody) => apiPost<void>('/triage', body),
|
||||
onSuccess: () => {
|
||||
qc.invalidateQueries({ queryKey: ['findings'] });
|
||||
qc.invalidateQueries({ queryKey: ['triage'] });
|
||||
qc.invalidateQueries({ queryKey: ['overview'] });
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
export function useUpdateFindingTriage() {
|
||||
const qc = useQueryClient();
|
||||
return useMutation({
|
||||
mutationFn: ({
|
||||
index,
|
||||
...body
|
||||
}: UpdateFindingTriageBody & { index: number | string }) =>
|
||||
apiPost<void>(`/findings/${index}/triage`, body),
|
||||
onSuccess: () => {
|
||||
qc.invalidateQueries({ queryKey: ['findings'] });
|
||||
qc.invalidateQueries({ queryKey: ['triage'] });
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
export function useAddSuppression() {
|
||||
const qc = useQueryClient();
|
||||
return useMutation({
|
||||
mutationFn: (body: AddSuppressionBody) =>
|
||||
apiPost<void>('/triage/suppress', body),
|
||||
onSuccess: () => {
|
||||
qc.invalidateQueries({ queryKey: ['triage'] });
|
||||
qc.invalidateQueries({ queryKey: ['findings'] });
|
||||
qc.invalidateQueries({ queryKey: ['triage', 'suppress'] });
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
export function useDeleteSuppression() {
|
||||
const qc = useQueryClient();
|
||||
return useMutation({
|
||||
mutationFn: (id: number) => apiDelete<void>(`/triage/suppress?id=${id}`),
|
||||
onSuccess: () => {
|
||||
qc.invalidateQueries({ queryKey: ['triage', 'suppress'] });
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
export function useTriageExport() {
|
||||
return useMutation({
|
||||
mutationFn: () => apiPost<unknown>('/triage/export'),
|
||||
});
|
||||
}
|
||||
|
||||
export function useTriageImport() {
|
||||
const qc = useQueryClient();
|
||||
return useMutation({
|
||||
mutationFn: () => apiPost<unknown>('/triage/import'),
|
||||
onSuccess: () => {
|
||||
qc.invalidateQueries({ queryKey: ['triage'] });
|
||||
qc.invalidateQueries({ queryKey: ['findings'] });
|
||||
},
|
||||
});
|
||||
}
|
||||
48
frontend/src/api/queries/config.ts
Normal file
48
frontend/src/api/queries/config.ts
Normal file
|
|
@ -0,0 +1,48 @@
|
|||
import { useQuery } from '@tanstack/react-query';
|
||||
import { apiGet } from '../client';
|
||||
import type { LabelEntryView, TerminatorView, ProfileView } from '../types';
|
||||
|
||||
export function useConfig() {
|
||||
return useQuery({
|
||||
queryKey: ['config'],
|
||||
queryFn: ({ signal }) => apiGet<unknown>('/config', signal),
|
||||
});
|
||||
}
|
||||
|
||||
export function useSources() {
|
||||
return useQuery({
|
||||
queryKey: ['config', 'sources'],
|
||||
queryFn: ({ signal }) =>
|
||||
apiGet<LabelEntryView[]>('/config/sources', signal),
|
||||
});
|
||||
}
|
||||
|
||||
export function useSinks() {
|
||||
return useQuery({
|
||||
queryKey: ['config', 'sinks'],
|
||||
queryFn: ({ signal }) => apiGet<LabelEntryView[]>('/config/sinks', signal),
|
||||
});
|
||||
}
|
||||
|
||||
export function useSanitizers() {
|
||||
return useQuery({
|
||||
queryKey: ['config', 'sanitizers'],
|
||||
queryFn: ({ signal }) =>
|
||||
apiGet<LabelEntryView[]>('/config/sanitizers', signal),
|
||||
});
|
||||
}
|
||||
|
||||
export function useTerminators() {
|
||||
return useQuery({
|
||||
queryKey: ['config', 'terminators'],
|
||||
queryFn: ({ signal }) =>
|
||||
apiGet<TerminatorView[]>('/config/terminators', signal),
|
||||
});
|
||||
}
|
||||
|
||||
export function useProfiles() {
|
||||
return useQuery({
|
||||
queryKey: ['config', 'profiles'],
|
||||
queryFn: ({ signal }) => apiGet<ProfileView[]>('/config/profiles', signal),
|
||||
});
|
||||
}
|
||||
111
frontend/src/api/queries/debug.ts
Normal file
111
frontend/src/api/queries/debug.ts
Normal file
|
|
@ -0,0 +1,111 @@
|
|||
import { useQuery } from '@tanstack/react-query';
|
||||
import { apiGet } from '../client';
|
||||
import type {
|
||||
FunctionInfo,
|
||||
CfgGraphView,
|
||||
SsaBodyView,
|
||||
TaintAnalysisView,
|
||||
AbstractInterpView,
|
||||
SymexView,
|
||||
CallGraphView,
|
||||
FuncSummaryView,
|
||||
} from '../types';
|
||||
|
||||
export function useDebugFunctions(file: string | null) {
|
||||
return useQuery({
|
||||
queryKey: ['debug', 'functions', file],
|
||||
queryFn: ({ signal }) =>
|
||||
apiGet<FunctionInfo[]>(
|
||||
`/debug/functions?file=${encodeURIComponent(file!)}`,
|
||||
signal,
|
||||
),
|
||||
enabled: !!file,
|
||||
});
|
||||
}
|
||||
|
||||
export function useDebugCfg(file: string | null, fn_name: string | null) {
|
||||
return useQuery({
|
||||
queryKey: ['debug', 'cfg', file, fn_name],
|
||||
queryFn: ({ signal }) =>
|
||||
apiGet<CfgGraphView>(
|
||||
`/debug/cfg?file=${encodeURIComponent(file!)}&function=${encodeURIComponent(fn_name!)}`,
|
||||
signal,
|
||||
),
|
||||
enabled: !!file && !!fn_name,
|
||||
});
|
||||
}
|
||||
|
||||
export function useDebugSsa(file: string | null, fn_name: string | null) {
|
||||
return useQuery({
|
||||
queryKey: ['debug', 'ssa', file, fn_name],
|
||||
queryFn: ({ signal }) =>
|
||||
apiGet<SsaBodyView>(
|
||||
`/debug/ssa?file=${encodeURIComponent(file!)}&function=${encodeURIComponent(fn_name!)}`,
|
||||
signal,
|
||||
),
|
||||
enabled: !!file && !!fn_name,
|
||||
});
|
||||
}
|
||||
|
||||
export function useDebugTaint(file: string | null, fn_name: string | null) {
|
||||
return useQuery({
|
||||
queryKey: ['debug', 'taint', file, fn_name],
|
||||
queryFn: ({ signal }) =>
|
||||
apiGet<TaintAnalysisView>(
|
||||
`/debug/taint?file=${encodeURIComponent(file!)}&function=${encodeURIComponent(fn_name!)}`,
|
||||
signal,
|
||||
),
|
||||
enabled: !!file && !!fn_name,
|
||||
});
|
||||
}
|
||||
|
||||
export function useDebugAbstractInterp(
|
||||
file: string | null,
|
||||
fn_name: string | null,
|
||||
) {
|
||||
return useQuery({
|
||||
queryKey: ['debug', 'abstract-interp', file, fn_name],
|
||||
queryFn: ({ signal }) =>
|
||||
apiGet<AbstractInterpView>(
|
||||
`/debug/abstract-interp?file=${encodeURIComponent(file!)}&function=${encodeURIComponent(fn_name!)}`,
|
||||
signal,
|
||||
),
|
||||
enabled: !!file && !!fn_name,
|
||||
});
|
||||
}
|
||||
|
||||
export function useDebugSymex(file: string | null, fn_name: string | null) {
|
||||
return useQuery({
|
||||
queryKey: ['debug', 'symex', file, fn_name],
|
||||
queryFn: ({ signal }) =>
|
||||
apiGet<SymexView>(
|
||||
`/debug/symex?file=${encodeURIComponent(file!)}&function=${encodeURIComponent(fn_name!)}`,
|
||||
signal,
|
||||
),
|
||||
enabled: !!file && !!fn_name,
|
||||
});
|
||||
}
|
||||
|
||||
export function useDebugCallGraph(scope: string, file?: string | null) {
|
||||
const params = new URLSearchParams({ scope });
|
||||
if (file) params.set('file', file);
|
||||
return useQuery({
|
||||
queryKey: ['debug', 'call-graph', scope, file],
|
||||
queryFn: ({ signal }) =>
|
||||
apiGet<CallGraphView>(`/debug/call-graph?${params}`, signal),
|
||||
});
|
||||
}
|
||||
|
||||
export function useDebugSummaries(
|
||||
file?: string | null,
|
||||
fn_name?: string | null,
|
||||
) {
|
||||
const params = new URLSearchParams();
|
||||
if (file) params.set('file', file);
|
||||
if (fn_name) params.set('function', fn_name);
|
||||
return useQuery({
|
||||
queryKey: ['debug', 'summaries', file, fn_name],
|
||||
queryFn: ({ signal }) =>
|
||||
apiGet<FuncSummaryView[]>(`/debug/summaries?${params}`, signal),
|
||||
});
|
||||
}
|
||||
37
frontend/src/api/queries/explorer.ts
Normal file
37
frontend/src/api/queries/explorer.ts
Normal file
|
|
@ -0,0 +1,37 @@
|
|||
import { useQuery } from '@tanstack/react-query';
|
||||
import { apiGet } from '../client';
|
||||
import type { TreeEntry, SymbolEntry, ExplorerFinding } from '../types';
|
||||
|
||||
export function useExplorerTree(path?: string) {
|
||||
return useQuery({
|
||||
queryKey: ['explorer', 'tree', path ?? ''],
|
||||
queryFn: ({ signal }) => {
|
||||
const qs = path ? `?path=${encodeURIComponent(path)}` : '';
|
||||
return apiGet<TreeEntry[]>(`/explorer/tree${qs}`, signal);
|
||||
},
|
||||
});
|
||||
}
|
||||
|
||||
export function useExplorerSymbols(path: string | null) {
|
||||
return useQuery({
|
||||
queryKey: ['explorer', 'symbols', path],
|
||||
queryFn: ({ signal }) =>
|
||||
apiGet<SymbolEntry[]>(
|
||||
`/explorer/symbols?path=${encodeURIComponent(path!)}`,
|
||||
signal,
|
||||
),
|
||||
enabled: !!path,
|
||||
});
|
||||
}
|
||||
|
||||
export function useExplorerFindings(path: string | null) {
|
||||
return useQuery({
|
||||
queryKey: ['explorer', 'findings', path],
|
||||
queryFn: ({ signal }) =>
|
||||
apiGet<ExplorerFinding[]>(
|
||||
`/explorer/findings?path=${encodeURIComponent(path!)}`,
|
||||
signal,
|
||||
),
|
||||
enabled: !!path,
|
||||
});
|
||||
}
|
||||
63
frontend/src/api/queries/findings.ts
Normal file
63
frontend/src/api/queries/findings.ts
Normal file
|
|
@ -0,0 +1,63 @@
|
|||
import { useQuery, type QueryClient } from '@tanstack/react-query';
|
||||
import { apiGet } from '../client';
|
||||
import type { PaginatedFindings, FindingView, FilterValues } from '../types';
|
||||
|
||||
export interface FindingsParams {
|
||||
page?: number;
|
||||
per_page?: number;
|
||||
severity?: string;
|
||||
category?: string;
|
||||
confidence?: string;
|
||||
language?: string;
|
||||
rule_id?: string;
|
||||
status?: string;
|
||||
search?: string;
|
||||
sort_by?: string;
|
||||
sort_dir?: string;
|
||||
}
|
||||
|
||||
function buildQuery(params: FindingsParams): string {
|
||||
const entries = Object.entries(params).filter(
|
||||
([, v]) => v !== undefined && v !== null && v !== '',
|
||||
);
|
||||
if (entries.length === 0) return '';
|
||||
const qs = new URLSearchParams(
|
||||
entries.map(([k, v]) => [k, String(v)]),
|
||||
).toString();
|
||||
return `?${qs}`;
|
||||
}
|
||||
|
||||
export function useFindings(params: FindingsParams = {}) {
|
||||
return useQuery({
|
||||
queryKey: ['findings', params],
|
||||
queryFn: ({ signal }) =>
|
||||
apiGet<PaginatedFindings>(`/findings${buildQuery(params)}`, signal),
|
||||
});
|
||||
}
|
||||
|
||||
export function useFinding(id: number | string) {
|
||||
return useQuery({
|
||||
queryKey: ['findings', id],
|
||||
queryFn: ({ signal }) => apiGet<FindingView>(`/findings/${id}`, signal),
|
||||
enabled: id !== undefined && id !== null && id !== '',
|
||||
});
|
||||
}
|
||||
|
||||
export function fetchFindingDetail(
|
||||
qc: QueryClient,
|
||||
index: number,
|
||||
signal?: AbortSignal,
|
||||
): Promise<FindingView> {
|
||||
return qc.fetchQuery({
|
||||
queryKey: ['findings', String(index)],
|
||||
queryFn: ({ signal: s }) =>
|
||||
apiGet<FindingView>(`/findings/${index}`, s ?? signal),
|
||||
});
|
||||
}
|
||||
|
||||
export function useFindingFilters() {
|
||||
return useQuery({
|
||||
queryKey: ['findings', 'filters'],
|
||||
queryFn: ({ signal }) => apiGet<FilterValues>('/findings/filters', signal),
|
||||
});
|
||||
}
|
||||
11
frontend/src/api/queries/health.ts
Normal file
11
frontend/src/api/queries/health.ts
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
import { useQuery } from '@tanstack/react-query';
|
||||
import { apiGet } from '../client';
|
||||
import type { HealthResponse } from '../types';
|
||||
|
||||
export function useHealth() {
|
||||
return useQuery({
|
||||
queryKey: ['health'],
|
||||
queryFn: ({ signal }) => apiGet<HealthResponse>('/health', signal),
|
||||
staleTime: 60_000,
|
||||
});
|
||||
}
|
||||
17
frontend/src/api/queries/overview.ts
Normal file
17
frontend/src/api/queries/overview.ts
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
import { useQuery } from '@tanstack/react-query';
|
||||
import { apiGet } from '../client';
|
||||
import type { OverviewResponse, TrendPoint } from '../types';
|
||||
|
||||
export function useOverview() {
|
||||
return useQuery({
|
||||
queryKey: ['overview'],
|
||||
queryFn: ({ signal }) => apiGet<OverviewResponse>('/overview', signal),
|
||||
});
|
||||
}
|
||||
|
||||
export function useOverviewTrends() {
|
||||
return useQuery({
|
||||
queryKey: ['overview', 'trends'],
|
||||
queryFn: ({ signal }) => apiGet<TrendPoint[]>('/overview/trends', signal),
|
||||
});
|
||||
}
|
||||
18
frontend/src/api/queries/rules.ts
Normal file
18
frontend/src/api/queries/rules.ts
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
import { useQuery } from '@tanstack/react-query';
|
||||
import { apiGet } from '../client';
|
||||
import type { RuleListItem, RuleDetailView } from '../types';
|
||||
|
||||
export function useRules() {
|
||||
return useQuery({
|
||||
queryKey: ['rules'],
|
||||
queryFn: ({ signal }) => apiGet<RuleListItem[]>('/rules', signal),
|
||||
});
|
||||
}
|
||||
|
||||
export function useRuleDetail(id: string) {
|
||||
return useQuery({
|
||||
queryKey: ['rules', id],
|
||||
queryFn: ({ signal }) => apiGet<RuleDetailView>(`/rules/${id}`, signal),
|
||||
enabled: !!id,
|
||||
});
|
||||
}
|
||||
89
frontend/src/api/queries/scans.ts
Normal file
89
frontend/src/api/queries/scans.ts
Normal file
|
|
@ -0,0 +1,89 @@
|
|||
import { useQuery } from '@tanstack/react-query';
|
||||
import { apiGet } from '../client';
|
||||
import type {
|
||||
ScanView,
|
||||
PaginatedFindings,
|
||||
ScanLogEntry,
|
||||
ScanMetricsSnapshot,
|
||||
CompareResponse,
|
||||
} from '../types';
|
||||
|
||||
export function useScans() {
|
||||
return useQuery({
|
||||
queryKey: ['scans'],
|
||||
queryFn: ({ signal }) => apiGet<ScanView[]>('/scans', signal),
|
||||
});
|
||||
}
|
||||
|
||||
export function useScan(id: string) {
|
||||
return useQuery({
|
||||
queryKey: ['scans', id],
|
||||
queryFn: ({ signal }) => apiGet<ScanView>(`/scans/${id}`, signal),
|
||||
enabled: !!id,
|
||||
});
|
||||
}
|
||||
|
||||
export interface ScanFindingsParams {
|
||||
page?: number;
|
||||
per_page?: number;
|
||||
severity?: string;
|
||||
category?: string;
|
||||
search?: string;
|
||||
}
|
||||
|
||||
function buildQuery(
|
||||
params: Record<string, string | number | boolean | undefined | null>,
|
||||
): string {
|
||||
const entries = Object.entries(params).filter(
|
||||
([, v]) => v !== undefined && v !== null && v !== '',
|
||||
);
|
||||
if (entries.length === 0) return '';
|
||||
const qs = new URLSearchParams(
|
||||
entries.map(([k, v]) => [k, String(v)]),
|
||||
).toString();
|
||||
return `?${qs}`;
|
||||
}
|
||||
|
||||
export function useScanFindings(id: string, params: ScanFindingsParams = {}) {
|
||||
return useQuery({
|
||||
queryKey: ['scans', id, 'findings', params],
|
||||
queryFn: ({ signal }) =>
|
||||
apiGet<PaginatedFindings>(
|
||||
`/scans/${id}/findings${buildQuery({ ...params })}`,
|
||||
signal,
|
||||
),
|
||||
enabled: !!id,
|
||||
});
|
||||
}
|
||||
|
||||
export function useScanLogs(id: string, level?: string) {
|
||||
return useQuery({
|
||||
queryKey: ['scans', id, 'logs', level],
|
||||
queryFn: ({ signal }) => {
|
||||
const qs = level ? `?level=${encodeURIComponent(level)}` : '';
|
||||
return apiGet<ScanLogEntry[]>(`/scans/${id}/logs${qs}`, signal);
|
||||
},
|
||||
enabled: !!id,
|
||||
});
|
||||
}
|
||||
|
||||
export function useScanMetrics(id: string) {
|
||||
return useQuery({
|
||||
queryKey: ['scans', id, 'metrics'],
|
||||
queryFn: ({ signal }) =>
|
||||
apiGet<ScanMetricsSnapshot>(`/scans/${id}/metrics`, signal),
|
||||
enabled: !!id,
|
||||
});
|
||||
}
|
||||
|
||||
export function useScanCompare(left: string, right: string) {
|
||||
return useQuery({
|
||||
queryKey: ['scans', 'compare', left, right],
|
||||
queryFn: ({ signal }) =>
|
||||
apiGet<CompareResponse>(
|
||||
`/scans/compare?left=${encodeURIComponent(left)}&right=${encodeURIComponent(right)}`,
|
||||
signal,
|
||||
),
|
||||
enabled: !!left && !!right,
|
||||
});
|
||||
}
|
||||
67
frontend/src/api/queries/triage.ts
Normal file
67
frontend/src/api/queries/triage.ts
Normal file
|
|
@ -0,0 +1,67 @@
|
|||
import { useQuery } from '@tanstack/react-query';
|
||||
import { apiGet } from '../client';
|
||||
import type {
|
||||
PaginatedTriage,
|
||||
PaginatedAudit,
|
||||
SuppressionRule,
|
||||
SyncStatus,
|
||||
} from '../types';
|
||||
|
||||
export interface TriageParams {
|
||||
state?: string;
|
||||
page?: number;
|
||||
per_page?: number;
|
||||
}
|
||||
|
||||
export interface TriageAuditParams {
|
||||
fingerprint?: string;
|
||||
page?: number;
|
||||
per_page?: number;
|
||||
}
|
||||
|
||||
function buildQuery(
|
||||
params: Record<string, string | number | boolean | undefined | null>,
|
||||
): string {
|
||||
const entries = Object.entries(params).filter(
|
||||
([, v]) => v !== undefined && v !== null && v !== '',
|
||||
);
|
||||
if (entries.length === 0) return '';
|
||||
const qs = new URLSearchParams(
|
||||
entries.map(([k, v]) => [k, String(v)]),
|
||||
).toString();
|
||||
return `?${qs}`;
|
||||
}
|
||||
|
||||
export function useTriage(params: TriageParams = {}) {
|
||||
return useQuery({
|
||||
queryKey: ['triage', params],
|
||||
queryFn: ({ signal }) =>
|
||||
apiGet<PaginatedTriage>(`/triage${buildQuery({ ...params })}`, signal),
|
||||
});
|
||||
}
|
||||
|
||||
export function useTriageAudit(params: TriageAuditParams = {}) {
|
||||
return useQuery({
|
||||
queryKey: ['triage', 'audit', params],
|
||||
queryFn: ({ signal }) =>
|
||||
apiGet<PaginatedAudit>(
|
||||
`/triage/audit${buildQuery({ ...params })}`,
|
||||
signal,
|
||||
),
|
||||
});
|
||||
}
|
||||
|
||||
export function useSuppressions() {
|
||||
return useQuery({
|
||||
queryKey: ['triage', 'suppress'],
|
||||
queryFn: ({ signal }) =>
|
||||
apiGet<{ rules: SuppressionRule[] }>('/triage/suppress', signal),
|
||||
});
|
||||
}
|
||||
|
||||
export function useSyncStatus() {
|
||||
return useQuery({
|
||||
queryKey: ['triage', 'sync-status'],
|
||||
queryFn: ({ signal }) => apiGet<SyncStatus>('/triage/sync-status', signal),
|
||||
});
|
||||
}
|
||||
11
frontend/src/api/queryClient.ts
Normal file
11
frontend/src/api/queryClient.ts
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
import { QueryClient } from '@tanstack/react-query';
|
||||
|
||||
export const queryClient = new QueryClient({
|
||||
defaultOptions: {
|
||||
queries: {
|
||||
staleTime: 30_000,
|
||||
refetchOnWindowFocus: true,
|
||||
retry: 1,
|
||||
},
|
||||
},
|
||||
});
|
||||
593
frontend/src/api/types.ts
Normal file
593
frontend/src/api/types.ts
Normal file
|
|
@ -0,0 +1,593 @@
|
|||
// Evidence types (from src/evidence.rs)
|
||||
export type Confidence = 'Low' | 'Medium' | 'High';
|
||||
export type FlowStepKind = 'source' | 'assignment' | 'call' | 'phi' | 'sink';
|
||||
|
||||
export interface FlowStep {
|
||||
step: number;
|
||||
kind: FlowStepKind;
|
||||
file: string;
|
||||
line: number;
|
||||
col: number;
|
||||
snippet?: string;
|
||||
variable?: string;
|
||||
callee?: string;
|
||||
function?: string;
|
||||
is_cross_file?: boolean;
|
||||
}
|
||||
|
||||
export interface SpanEvidence {
|
||||
path: string;
|
||||
line: number;
|
||||
col: number;
|
||||
kind: string;
|
||||
snippet?: string;
|
||||
}
|
||||
|
||||
export interface StateEvidence {
|
||||
machine: string;
|
||||
subject?: string;
|
||||
from_state: string;
|
||||
to_state: string;
|
||||
}
|
||||
|
||||
export interface Evidence {
|
||||
source?: SpanEvidence;
|
||||
sink?: SpanEvidence;
|
||||
guards: SpanEvidence[];
|
||||
sanitizers: SpanEvidence[];
|
||||
state?: StateEvidence;
|
||||
notes: string[];
|
||||
flow_steps: FlowStep[];
|
||||
explanation?: string;
|
||||
confidence_limiters: string[];
|
||||
}
|
||||
|
||||
// Finding types
|
||||
export interface CodeContextView {
|
||||
start_line: number;
|
||||
lines: string[];
|
||||
highlight_line: number;
|
||||
}
|
||||
|
||||
export interface RelatedFindingView {
|
||||
index: number;
|
||||
rule_id: string;
|
||||
path: string;
|
||||
line: number;
|
||||
severity: string;
|
||||
}
|
||||
|
||||
export interface FindingView {
|
||||
index: number;
|
||||
fingerprint: string;
|
||||
portable_fingerprint?: string;
|
||||
path: string;
|
||||
line: number;
|
||||
col: number;
|
||||
severity: string;
|
||||
rule_id: string;
|
||||
category: string;
|
||||
confidence?: Confidence;
|
||||
rank_score?: number;
|
||||
message?: string;
|
||||
labels: [string, string][];
|
||||
path_validated: boolean;
|
||||
suppressed: boolean;
|
||||
language?: string;
|
||||
status: string;
|
||||
triage_state: string;
|
||||
triage_note?: string;
|
||||
code_context?: CodeContextView;
|
||||
evidence?: Evidence;
|
||||
guard_kind?: string;
|
||||
rank_reason?: [string, string][];
|
||||
sanitizer_status?: string;
|
||||
related_findings: RelatedFindingView[];
|
||||
}
|
||||
|
||||
export interface FindingSummary {
|
||||
total: number;
|
||||
by_severity: Record<string, number>;
|
||||
by_category: Record<string, number>;
|
||||
by_rule: Record<string, number>;
|
||||
by_file: Record<string, number>;
|
||||
}
|
||||
|
||||
export interface FilterValues {
|
||||
severities: string[];
|
||||
categories: string[];
|
||||
confidences: string[];
|
||||
languages: string[];
|
||||
rules: string[];
|
||||
statuses: string[];
|
||||
}
|
||||
|
||||
// Scan types
|
||||
export interface TimingBreakdown {
|
||||
walk_ms: number;
|
||||
pass1_ms: number;
|
||||
call_graph_ms: number;
|
||||
pass2_ms: number;
|
||||
post_process_ms: number;
|
||||
}
|
||||
|
||||
export interface ScanMetricsSnapshot {
|
||||
cfg_nodes: number;
|
||||
call_edges: number;
|
||||
functions_analyzed: number;
|
||||
summaries_reused: number;
|
||||
unresolved_calls: number;
|
||||
}
|
||||
|
||||
export interface ScanView {
|
||||
id: string;
|
||||
status: string;
|
||||
scan_root: string;
|
||||
started_at?: string;
|
||||
finished_at?: string;
|
||||
duration_secs?: number;
|
||||
finding_count?: number;
|
||||
error?: string;
|
||||
engine_version?: string;
|
||||
languages?: string[];
|
||||
files_scanned?: number;
|
||||
timing?: TimingBreakdown;
|
||||
metrics?: ScanMetricsSnapshot;
|
||||
}
|
||||
|
||||
// Scan Comparison types
|
||||
export interface CompareScanInfo {
|
||||
id: string;
|
||||
started_at?: string;
|
||||
finding_count: number;
|
||||
}
|
||||
|
||||
export interface CompareSummary {
|
||||
new_count: number;
|
||||
fixed_count: number;
|
||||
changed_count: number;
|
||||
unchanged_count: number;
|
||||
severity_delta: Record<string, number>;
|
||||
}
|
||||
|
||||
export interface ComparedFinding extends FindingView {
|
||||
fingerprint: string;
|
||||
}
|
||||
|
||||
export interface FieldChange {
|
||||
field: string;
|
||||
old_value: string;
|
||||
new_value: string;
|
||||
}
|
||||
|
||||
export interface ChangedFinding extends FindingView {
|
||||
fingerprint: string;
|
||||
changes: FieldChange[];
|
||||
}
|
||||
|
||||
export interface CompareResponse {
|
||||
left_scan: CompareScanInfo;
|
||||
right_scan: CompareScanInfo;
|
||||
summary: CompareSummary;
|
||||
new_findings: ComparedFinding[];
|
||||
fixed_findings: ComparedFinding[];
|
||||
changed_findings: ChangedFinding[];
|
||||
unchanged_findings: ComparedFinding[];
|
||||
}
|
||||
|
||||
// Overview types
|
||||
export interface OverviewCount {
|
||||
name: string;
|
||||
count: number;
|
||||
}
|
||||
|
||||
export interface NoisyRule {
|
||||
rule_id: string;
|
||||
finding_count: number;
|
||||
suppression_rate: number;
|
||||
}
|
||||
|
||||
export interface ScanSummary {
|
||||
id: string;
|
||||
status: string;
|
||||
started_at?: string;
|
||||
duration_secs?: number;
|
||||
finding_count?: number;
|
||||
}
|
||||
|
||||
export interface Insight {
|
||||
kind: string;
|
||||
message: string;
|
||||
severity: string;
|
||||
action_url?: string;
|
||||
}
|
||||
|
||||
export interface TrendPoint {
|
||||
scan_id: string;
|
||||
timestamp: string;
|
||||
total: number;
|
||||
by_severity: Record<string, number>;
|
||||
}
|
||||
|
||||
export interface OverviewResponse {
|
||||
state: string;
|
||||
total_findings: number;
|
||||
new_since_last: number;
|
||||
fixed_since_last: number;
|
||||
high_confidence_rate: number;
|
||||
triage_coverage: number;
|
||||
latest_scan_duration_secs?: number;
|
||||
latest_scan_id?: string;
|
||||
latest_scan_at?: string;
|
||||
by_severity: Record<string, number>;
|
||||
by_category: Record<string, number>;
|
||||
by_language: Record<string, number>;
|
||||
top_files: OverviewCount[];
|
||||
top_directories: OverviewCount[];
|
||||
top_rules: OverviewCount[];
|
||||
noisy_rules: NoisyRule[];
|
||||
recent_scans: ScanSummary[];
|
||||
insights: Insight[];
|
||||
}
|
||||
|
||||
// Rules types
|
||||
export interface RuleListItem {
|
||||
id: string;
|
||||
title: string;
|
||||
language: string;
|
||||
kind: string;
|
||||
cap: string;
|
||||
matchers: string[];
|
||||
enabled: boolean;
|
||||
is_custom: boolean;
|
||||
is_gated: boolean;
|
||||
case_sensitive: boolean;
|
||||
finding_count: number;
|
||||
suppression_rate: number;
|
||||
}
|
||||
|
||||
export interface RuleDetailView extends RuleListItem {
|
||||
example_findings: RelatedFindingView[];
|
||||
}
|
||||
|
||||
// Config types
|
||||
export interface RuleView {
|
||||
lang: string;
|
||||
matchers: string[];
|
||||
kind: string;
|
||||
cap: string;
|
||||
}
|
||||
|
||||
export interface TerminatorView {
|
||||
lang: string;
|
||||
name: string;
|
||||
}
|
||||
|
||||
export interface LabelEntryView {
|
||||
lang: string;
|
||||
matchers: string[];
|
||||
cap: string;
|
||||
case_sensitive: boolean;
|
||||
is_builtin: boolean;
|
||||
}
|
||||
|
||||
export interface ProfileView {
|
||||
name: string;
|
||||
is_builtin: boolean;
|
||||
settings: Record<string, unknown>;
|
||||
}
|
||||
|
||||
// Health
|
||||
export interface HealthResponse {
|
||||
status: string;
|
||||
version: string;
|
||||
scan_root: string;
|
||||
}
|
||||
|
||||
// Paginated response wrappers
|
||||
export interface PaginatedFindings {
|
||||
findings: FindingView[];
|
||||
total: number;
|
||||
page: number;
|
||||
per_page: number;
|
||||
}
|
||||
|
||||
// Triage types
|
||||
export interface TriageEntry {
|
||||
fingerprint: string;
|
||||
state: string;
|
||||
note: string;
|
||||
updated_at: string;
|
||||
finding?: FindingView;
|
||||
}
|
||||
|
||||
export interface PaginatedTriage {
|
||||
entries: TriageEntry[];
|
||||
total: number;
|
||||
page: number;
|
||||
per_page: number;
|
||||
}
|
||||
|
||||
export interface AuditEntry {
|
||||
id: number;
|
||||
fingerprint: string;
|
||||
action: string;
|
||||
previous_state: string;
|
||||
new_state: string;
|
||||
note: string;
|
||||
timestamp: string;
|
||||
}
|
||||
|
||||
export interface PaginatedAudit {
|
||||
entries: AuditEntry[];
|
||||
total: number;
|
||||
page: number;
|
||||
per_page: number;
|
||||
}
|
||||
|
||||
export interface SuppressionRule {
|
||||
id: number;
|
||||
suppress_by: string;
|
||||
match_value: string;
|
||||
state: string;
|
||||
note: string;
|
||||
created_at: string;
|
||||
}
|
||||
|
||||
export interface SyncStatus {
|
||||
file_path: string;
|
||||
file_exists: boolean;
|
||||
sync_enabled: boolean;
|
||||
decisions: number;
|
||||
suppression_rules: number;
|
||||
}
|
||||
|
||||
// File viewer
|
||||
export interface FileResponse {
|
||||
path: string;
|
||||
lines: { number: number; content: string }[];
|
||||
total_lines: number;
|
||||
}
|
||||
|
||||
// Explorer types
|
||||
export interface TreeEntry {
|
||||
name: string;
|
||||
entry_type: 'file' | 'dir';
|
||||
path: string;
|
||||
language?: string;
|
||||
finding_count: number;
|
||||
severity_max?: string;
|
||||
}
|
||||
|
||||
export interface SymbolEntry {
|
||||
name: string;
|
||||
kind: string;
|
||||
line?: number;
|
||||
finding_count: number;
|
||||
namespace?: string;
|
||||
arity?: number;
|
||||
}
|
||||
|
||||
export interface ExplorerFinding {
|
||||
index: number;
|
||||
line: number;
|
||||
col: number;
|
||||
severity: string;
|
||||
rule_id: string;
|
||||
category: string;
|
||||
message?: string;
|
||||
confidence?: string;
|
||||
}
|
||||
|
||||
// Scan log entry
|
||||
export interface ScanLogEntry {
|
||||
timestamp: string;
|
||||
level: string;
|
||||
message: string;
|
||||
file_path?: string;
|
||||
detail?: string;
|
||||
}
|
||||
|
||||
// ── Debug view types ─────────────────────────────────────────────────────────
|
||||
|
||||
export interface FunctionInfo {
|
||||
name: string;
|
||||
namespace: string;
|
||||
param_count: number;
|
||||
line: number;
|
||||
source_caps: string[];
|
||||
sanitizer_caps: string[];
|
||||
sink_caps: string[];
|
||||
}
|
||||
|
||||
// CFG
|
||||
export interface CfgNodeView {
|
||||
id: number;
|
||||
kind: string;
|
||||
span: [number, number];
|
||||
line: number;
|
||||
defines?: string;
|
||||
uses: string[];
|
||||
callee?: string;
|
||||
labels: string[];
|
||||
condition_text?: string;
|
||||
enclosing_func?: string;
|
||||
}
|
||||
|
||||
export interface CfgEdgeView {
|
||||
source: number;
|
||||
target: number;
|
||||
kind: string;
|
||||
}
|
||||
|
||||
export interface CfgGraphView {
|
||||
nodes: CfgNodeView[];
|
||||
edges: CfgEdgeView[];
|
||||
entry: number;
|
||||
}
|
||||
|
||||
// SSA
|
||||
export interface SsaInstView {
|
||||
value: number;
|
||||
op: string;
|
||||
operands: string[];
|
||||
var_name?: string;
|
||||
span: [number, number];
|
||||
line: number;
|
||||
}
|
||||
|
||||
export interface SsaBlockView {
|
||||
id: number;
|
||||
phis: SsaInstView[];
|
||||
body: SsaInstView[];
|
||||
terminator: string;
|
||||
preds: number[];
|
||||
succs: number[];
|
||||
}
|
||||
|
||||
export interface SsaBodyView {
|
||||
blocks: SsaBlockView[];
|
||||
entry: number;
|
||||
num_values: number;
|
||||
}
|
||||
|
||||
// Taint
|
||||
export interface TaintValueView {
|
||||
ssa_value: number;
|
||||
var_name?: string;
|
||||
caps: string[];
|
||||
uses_summary: boolean;
|
||||
}
|
||||
|
||||
export interface TaintBlockStateView {
|
||||
block_id: number;
|
||||
values: TaintValueView[];
|
||||
validated_must: number;
|
||||
validated_may: number;
|
||||
}
|
||||
|
||||
export interface TaintEventView {
|
||||
sink_node: number;
|
||||
sink_caps: string[];
|
||||
tainted_values: TaintValueView[];
|
||||
all_validated: boolean;
|
||||
uses_summary: boolean;
|
||||
}
|
||||
|
||||
export interface TaintAnalysisView {
|
||||
block_states: TaintBlockStateView[];
|
||||
events: TaintEventView[];
|
||||
}
|
||||
|
||||
// Abstract Interpretation
|
||||
export interface AbstractValueView {
|
||||
ssa_value: number;
|
||||
var_name?: string;
|
||||
interval_lo?: number;
|
||||
interval_hi?: number;
|
||||
string_prefix?: string;
|
||||
string_suffix?: string;
|
||||
known_zero: number;
|
||||
known_one: number;
|
||||
}
|
||||
|
||||
export interface AbstractBlockView {
|
||||
block_id: number;
|
||||
values: AbstractValueView[];
|
||||
}
|
||||
|
||||
export interface TypeFactView {
|
||||
ssa_value: number;
|
||||
var_name?: string;
|
||||
type_kind: string;
|
||||
nullable: boolean;
|
||||
}
|
||||
|
||||
export interface ConstValueViewEntry {
|
||||
ssa_value: number;
|
||||
var_name?: string;
|
||||
value: string;
|
||||
}
|
||||
|
||||
export interface AbstractInterpView {
|
||||
blocks: AbstractBlockView[];
|
||||
type_facts: TypeFactView[];
|
||||
const_values: ConstValueViewEntry[];
|
||||
}
|
||||
|
||||
// Symbolic Execution
|
||||
export interface SymexValueView {
|
||||
ssa_value: number;
|
||||
var_name?: string;
|
||||
expression: string;
|
||||
}
|
||||
|
||||
export interface PathConstraintView {
|
||||
block: number;
|
||||
condition: string;
|
||||
polarity: boolean;
|
||||
}
|
||||
|
||||
export interface SymexView {
|
||||
values: SymexValueView[];
|
||||
path_constraints: PathConstraintView[];
|
||||
tainted_roots: number[];
|
||||
}
|
||||
|
||||
// Call Graph
|
||||
export interface CallGraphNodeView {
|
||||
id: number;
|
||||
name: string;
|
||||
file: string;
|
||||
lang: string;
|
||||
namespace: string;
|
||||
arity?: number;
|
||||
}
|
||||
|
||||
export interface CallGraphEdgeView {
|
||||
source: number;
|
||||
target: number;
|
||||
call_site: string;
|
||||
}
|
||||
|
||||
export interface CallGraphView {
|
||||
nodes: CallGraphNodeView[];
|
||||
edges: CallGraphEdgeView[];
|
||||
sccs: number[][];
|
||||
unresolved_count: number;
|
||||
ambiguous_count: number;
|
||||
}
|
||||
|
||||
// Summaries
|
||||
export interface ParamReturnView {
|
||||
param_index: number;
|
||||
transform: string;
|
||||
}
|
||||
|
||||
export interface ParamSinkView {
|
||||
param_index: number;
|
||||
sink_caps: string[];
|
||||
}
|
||||
|
||||
export interface SsaSummaryView {
|
||||
param_to_return: ParamReturnView[];
|
||||
param_to_sink: ParamSinkView[];
|
||||
source_caps: string[];
|
||||
}
|
||||
|
||||
export interface FuncSummaryView {
|
||||
name: string;
|
||||
file_path: string;
|
||||
lang: string;
|
||||
namespace: string;
|
||||
arity?: number;
|
||||
param_count: number;
|
||||
source_caps: string[];
|
||||
sanitizer_caps: string[];
|
||||
sink_caps: string[];
|
||||
propagates_taint: boolean;
|
||||
propagating_params: number[];
|
||||
tainted_sink_params: number[];
|
||||
callees: string[];
|
||||
ssa_summary?: SsaSummaryView;
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue