apunkt/nyx
1
0
Fork 0
mirror of https://github.com/elicpeter/nyx.git synced 2026-06-21 20:18:06 +02:00
Code Issues Projects Releases Packages Wiki Activity

Release/0.5.0 (#35)

Browse source 
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures

* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests

* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements

* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles

* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing

* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling

* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures

* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration

* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests

* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic

* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection

* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements

* feat: Enable auth-state analysis by default and update relevant tests in benchmark config

* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test

* docs: update CHANGELOG.md

* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers

* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers

* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse

* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation

* feat: Refactor function parameters and constants for improved clarity and maintainability

* refactor: Reorder module imports and improve formatting for consistency

* refactor: Fix formatting erorrs

* refactor: Fix clippy warnings

* refactor: Fix fmt warnings (again)

* chore: Update dependencies and improve feature configuration

* Add comprehensive tests for undertested modules (#36) (COPILOT)

* Add comprehensive tests for undertested modules

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083

* Add comprehensive tests for ext, project, walk, and errors modules

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* chore: Update dependencies and improve feature configuration

* fix: formatting errors in new tests

* chore: Update license list in about.toml

* chore: made functions input inline

* chore: updated cfg graph to take up the full page

* chore: add Prettier configuration and update code formatting

* Add frontend test suite with Vitest (111 tests) (#37)

* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7

* ci: add frontend test step to CI workflow

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* chore: simplify array initialization in test files for consistency

* ran typecheck

* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage

* feat: update routing in AppLayout and improve empty state message in ExplorerPage

* feat: enhance scan progress tracking with additional metrics and stages

* feat: update license information and add license check script

* feat: implement cross-file symbolic execution with callee body persistence

* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering

* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions

* feat: enhance resource tracking with proxy method summaries and improve finding extraction

* feat: add terminal function exit detection for accurate resource leak analysis

* feat: add warnings for loops and functions without bodies to improve error recovery

* feat: update lambda expression handling to ensure proper function classification and control flow

* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling

* feat: add inline return taint analysis and regression tests for improved security checks

* feat: add engine version management and migration handling for database schema updates

* feat: enhance first_call_ident to skip nested function bodies and add regression tests

* feat: enhance callee name resolution with two-segment normalization and disambiguation

* feat: add cross-file context flags and debug assertions for taint analysis

* feat: refactor taint analysis structure to unify context handling and improve clarity

* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests

* docs: updated CHANGELOG.md

* fmt: formatting fixes

* fix: fixed frontend formatting and lint warnings

* fix: optimized ci

* fix: optimized ci

* Add comprehensive multi-file test coverage to Nyx (#38)

* Initial checklist for multi-file test suite expansion

Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage

Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* deleted root repo

* rebuilt to test for regressions

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>

* feat: enhance import alias resolution and taint tracking

* feat: implement security hardening with CSRF protection and path validation

* feat: add support for import alias bindings in Python, PHP, and Rust

* feat: enhance CFG analysis modes and improve code readability

* feat: add detection for parameterized SQL queries to enhance security

* feat: add safe internal redirect handling and enhance session destroy validation

* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads

* feat: enhance taint detection by adding support for inline source member expressions in call arguments

* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments

* feat: add support for Throw statement in control flow and error handling

* feat: add debug and echo endpoints with potential information leakage

* feat: implement internal redirect suppression and enhance taint detection

* feat: implement module alias tracking for dynamic dispatch in JS/TS

* feat: add authorization analysis module with Express support

* feat: add authorization analysis module with Express support

* feat: add tests for admin guard requirements and clean checks in authorization analysis

* feat: integrate Koa and Fastify frameworks into authorization analysis

* feat: add Flask and Django support to authorization analysis module

* feat: add support for Rails and Sinatra frameworks in authorization analysis

* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis

* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis

* feat: add support for Rails and Sinatra in authorization analysis

* chore: add .DS_Store to .gitignore

* refactor: simplify conditional checks and improve readability in multiple files

* refactor: update usage of Option methods for improved clarity and consistency

* refactor: improve code readability by simplifying conditional checks and formatting

* refactor: improve code formatting and readability by simplifying conditional checks

* refactor: simplify conditional checks and improve readability in multiple files

* refactor: simplify conditional checks in axum.rs for improved readability

* feat: add CodeQL analysis configuration for enhanced security scanning

* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)

* chore: start test coverage improvement work

Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* test: add comprehensive tests for src/output.rs SARIF builder

Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* refactor: improve code formatting and readability in output.rs

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>

* refactor: improve code formatting and readability in output.rs

* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* refactor: enhance triage file path handling with improved error management and validation

* refactor: updated func summaries for richer detail

* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries

* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution

* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls

* refactor: implement new Flask routes for safe and unsafe shell command execution

* refactor: separate receiver handling in SSA operations and enhance taint propagation

* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments

* refactor: implement auth decorator extraction and classification for multiple languages

* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation

* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic

* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior

* refactor: standardize default struct initialization across multiple files

* feat: add scripts for formatting checks and auto-fixes with test summaries

* refactor: simplify character splitting and enhance namespace qualifier handling

* refactor: improve documentation clarity and enhance code readability in resolver logic

* refactor: replace default struct initialization with explicit field assignments for clarity

* feat: enhance anonymous function naming by deriving context-based bindings

* refactor: streamline match expressions for improved readability and performance

* refactor: streamline match expressions for improved readability and performance

* refactor: replace loop with while let for improved clarity and performance

* feat: add SSA constant propagation support to analysis context for improved accuracy

* feat: add SSA constant propagation support to analysis context for improved accuracy

* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis

* feat: add static map analysis for command injection suppression and type safety

* refactor: simplify match statements and reduce line breaks for improved readability

* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution

Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.

Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.

Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.

Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.

Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding

Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet.  SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.

Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.

Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`.  `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters.  Dedup key extended with the primary location
so multi-site events aren't collapsed back together.

Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
  != ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
  non-empty `file_rel` — the cap-only → None translation upstream
  guarantees this.

Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved.  A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.

build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.

Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing).  All 1566 lib
tests + integration tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(output): phase 3/5 consume primary sink location in diag + SARIF

When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.

Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
  resolved back to an absolute path via a shared resolve_file_rel
  helper. Empty file_rel (single-file scans where namespace == "")
  resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
  SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
  file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
  locations[0] already reflects the primary sink position via the
  updated diag line/col.

Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.

Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
  the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
  inside the closure).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(bench): phase 4/5 validate primary sink attribution across corpus

Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.

Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
  Case. When present, score_location_level additionally requires at
  least one flow_step in the finding's evidence trace to fall within
  ±2 of the call-site range. When absent, the check is skipped —
  fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
  now-primary Diag.line post-phase-3).

Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
  transform::wrap call site (a cross-file propagator, not a sink);
  line 9 is Command::new, the real sink. The ±2 tolerance happened to
  mask this stale attribution but it was semantically wrong — phase 4
  is the right time to correct it. Also adds expected_call_site_lines
  [8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
  This fixture's sink (Command::new inside run_cmd at line 5) was the
  motivating case for phases 1-3; adding the call-site assertion
  guards against regression to caller-line attribution.

New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
  takes two tainted params and invokes two Command sinks on
  consecutive lines. Locks in that primary line lands inside the
  helper (lines 5-6), not at the caller (line 12). Notes document
  that SinkSite is currently one-per-callee so both findings today
  collapse onto the first sink; expected_sink_lines=[5,6] and
  expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
  004): sink os.system lives in helper.py (cross-file), caller in
  app.py reads env source and calls run_cmd. Verifies phase 3's
  cross-file primary attribution: Diag.path = helper.py, Diag.line =
  5, with app.py:7 recorded in flow_steps as a Call step.

Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
  pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
  TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
  F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
  264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test

Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body.  Asserts the
resulting Finding.primary_location is exactly that triple.

The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file.  This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.

Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).

Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor: clean up formatting and improve readability in multiple files

* refactor: simplify type definition for deduplication key in findings

* test(harness): add must_not_match expectation for FP regression guards

Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules

* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking

* feat: update switch statement handling to improve control flow analysis

* feat: implement promisify alias handling for JS/TS to enhance taint tracking

* feat: enhance taint tracking by refining expectation handling and adding mode filtering

* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters

* feat: update taint tracking rules to enforce full mode matching and improve flow analysis

* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis

* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding

* feat: refine framework detection and update expectation handling for Echo and Sinatra

* feat: implement max_count for taint tracking expectations and deduplicate findings

* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files

* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity

* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files

* feat: add structural invariant checks for SSA bodies

* feat: ensure deterministic phi emission order using BTreeSet

* feat: enhance handling of terminators to ensure authoritative flow through successor edges

* feat: enhance Goto terminator handling to ensure all successors are marked executable

* feat: refactor code for improved readability and organization

* feat: simplify predicate checks and enhance readability in SSA handling

* feat: implement per-file parse timeout and enhance file size handling

* feat: migrate analysis engine toggles from environment variables to configuration file

* feat: remove unnecessary whitespace in hostile_input_tests.rs

* feat: remove unnecessary whitespace in hostile_input_tests.rs

* feat: update dependencies and enhance documentation on language maturity

* feat: enhance security headers and improve request body limits

* feat: implement sink capability bits for deduplication and enhance evidence tagging

* feat: implement dynamic activation handling for gated sinks and enhance validation logic

* feat: enhance configuration documentation and clarify inline analysis cache behavior

* feat: implement panic recovery during analysis to continue scans past errors

* feat: add expectations configuration for taint analysis and performance metrics

* feat: enhance error handling and logging during file reading and mutex locking

* feat: add cross-file body loading tests and plumbing for CF-1 phase

* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures

* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality

* feat: enhance classification span handling in CFG and AST for improved source attribution

* feat: add new Express routes for handling user input and telemetry data

* feat: implement ternary expression handling in CFG with diamond structure for JS/TS

* feat: implement Phase CF-3 abstract-domain transfer channels in summaries

* feat: add support for string-prefix transfer in cross-file calls and update tests

* docs: reduce RESULTS.md doc size

* feat: implement Phase CF-4 per-return-path summary decomposition with tests

* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization

* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests

* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests

* refactor: update comments and documentation for clarity and consistency

* style: format code for consistency and readability

* refactor: simplify verdict handling and improve edge checking logic

* refactor: optimize path and identifier collection by avoiding unnecessary cloning

* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults

* refactor: update documentation and improve clarity in configuration files

* refactor: update documentation and improve clarity in configuration files

* feat: add JS/TS pass-2 convergence tests and expectations configuration

* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic

* feat: implement Phase 7 deduplication and alternative path linking for taint findings

* feat: implement structural DFS index for anonymous functions and update naming conventions

* feat: add Phase 8 regression tests for container-element taint in JS and Python

* feat: add engine-depth profiles and explain-engine option for CLI

* feat: update expectations and add new README fixtures for multi-file scan regression

* feat: implement Phase 11 callback-alias and factory patterns with regression tests

* feat: implement Terminator::Switch for multi-way dispatch and add regression tests

* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants

* refactor: extract cfg and ssa_transfer to submodules

* refactor: cargo fmt

* refactor: remove unnecessary blank line in cfg_tests.rs

* refactor: remove unnecessary planning file

* chore: update Rust version to 1.88 and bump dependencies in Cargo files

* feat: enhance triage UI with new layout and controls, update README for clarity

* feat: enhance triage UI with new layout and controls, update README for clarity

* chore: remove outdated section from README for version 0.5.0

* docs: improve clarity and consistency in README content

* chore: add "GPL-3.0-or-later" to license options in about.toml

* chore: update license handling in about.toml and check-licenses.mjs

* style: format code for improved readability in TriagePage component

* style: format code for improved readability in TriagePage component

* chore: enhance license handling and improve body_id scoping in seed lookup

* feat: introduce owner and parent body IDs for enhanced seed scoping

* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating

* feat: add Undef SSA operation for improved control-flow handling

* style: improve code formatting for consistency and readability in multiple files

* feat: add 16-function chain SCC across multiple files for enhanced analysis

* style: simplify code formatting for improved readability in multiple files

* fix: update CapHitReason default implementation and improve README clarity

* docs: enhance README with detailed explanations of taint analysis and limitations

* docs: refine README for clarity and consistency in taint analysis section

* style: improve code formatting for better readability in NewScanModal and scans

* fix: update cargo-about command to use --offline for deterministic license generation

* fix: update cargo-about command to use --offline for deterministic license generation

* ci: add step to prime cargo registry cache for deterministic license generation

* feat: add support for non-sink collections in authorization analysis

* feat: enhance authorization checks with row-level ownership equality and binding tracking

* feat: implement self-scoped user handling and enhance ownership checks

* refactor: simplify assertions and formatting in authorization analysis tests

* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure

* docs: update AI disclosure section for clarity and conciseness

* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure

* feat: enhance authorization analysis with SSA-derived variable type classification

* feat: implement auth_finding_to_diag function for enhanced security diagnostics

* feat: add args_value_refs to CallSite struct for enhanced argument tracking

* feat: add args_value_refs to CallSite struct for enhanced argument tracking

* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag

* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks

* feat: enhance error message handling in cli_validation_tests for better Windows compatibility

* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration

* feat: enhance release build process with SBOM generation and SLSA provenance

* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries

* feat: introduce PathFact handling for path safety checks and rejection logic

* feat: introduce PathFact handling for path safety checks and rejection logic

* feat: update benchmark data and enhance path sanitization logic with new safety checks

* feat: document AI assistance in frontend UI development and human review process

* feat: add return path facts for enhanced path safety checks and update documentation

* chore: update release date for version 0.5.0 in CHANGELOG.md

* chore: clean up ci.yml by removing outdated comments and clarifying steps

* feat: implement cross-language path sanitizers and validators for enhanced security

* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks

* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases

* refactor: simplify conditional formatting and improve code readability in executor and lower modules

* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues

* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers

* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers

* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests

* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs

---------

Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Eli Peter 2026-04-25 17:59:11 -04:00 • committed by GitHub
parent c4ce08b452
commit 41128177d2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2144 changed files with 201812 additions and 8927 deletions
Download patch file Download diff file Expand all files Collapse all files

573
src/abstract_interp/bit_domain.rs Normal file
View file

@ -0,0 +1,573 @@
//! Bit-level abstract domain for abstract interpretation.
//!
//! Tracks known-zero and known-one bit masks over the 64-bit two's complement
//! representation of `i64` values. This enables precise reasoning about bitwise
//! operations (`&`, `|`, `^`, `<<`, `>>`) that interval analysis alone cannot
//! capture.
//!
//! ## Integer model
//!
//! Operates on signed `i64` two's complement:
//! - Bit positions 0-62 are value bits, bit 63 is the sign bit.
//! - `known_zero & known_one == 0` invariant (a bit cannot be both).
//! - `from_const(n)` sets all 64 bits as known.
//! - `is_non_negative()` checks sign bit (63) is `known_zero`.
use crate::abstract_interp::IntervalFact;
use crate::state::lattice::{AbstractDomain, Lattice};
use serde::{Deserialize, Serialize};
/// Bit-level abstract fact: known-zero and known-one masks.
///
/// - `top()` = `{known_zero: 0, known_one: 0}` — no bits known
/// - `bottom()` = `{known_zero: MAX, known_one: MAX}` — contradictory
/// - `from_const(n)` = all 64 bits known
///
/// Invariant: `known_zero & known_one == 0` for non-bottom values.
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct BitFact {
/// Bitmask of bit positions provably zero.
pub known_zero: u64,
/// Bitmask of bit positions provably one.
pub known_one: u64,
}
impl BitFact {
/// Top: no bits known.
pub fn top() -> Self {
Self {
known_zero: 0,
known_one: 0,
}
}
/// Bottom: contradictory (all bits both zero and one).
pub fn bottom() -> Self {
Self {
known_zero: u64::MAX,
known_one: u64::MAX,
}
}
/// All bits known from a concrete constant.
pub fn from_const(n: i64) -> Self {
let bits = n as u64;
Self {
known_zero: !bits,
known_one: bits,
}
}
pub fn is_top(&self) -> bool {
self.known_zero == 0 && self.known_one == 0
}
pub fn is_bottom(&self) -> bool {
self.known_zero & self.known_one != 0
}
/// True if the sign bit (63) is provably zero → value is non-negative.
pub fn is_non_negative(&self) -> bool {
self.known_zero & (1u64 << 63) != 0
}
// ── Bitwise transfer functions ──────────────────────────────────────
/// Bitwise AND transfer: `result[i] = a[i] & b[i]`.
///
/// - A bit is known-zero if EITHER input is known-zero.
/// - A bit is known-one if BOTH inputs are known-one.
pub fn bit_and(&self, other: &Self) -> Self {
if self.is_bottom() || other.is_bottom() {
return Self::bottom();
}
Self {
known_zero: self.known_zero | other.known_zero,
known_one: self.known_one & other.known_one,
}
}
/// Bitwise OR transfer: `result[i] = a[i] | b[i]`.
///
/// - A bit is known-one if EITHER input is known-one.
/// - A bit is known-zero if BOTH inputs are known-zero.
pub fn bit_or(&self, other: &Self) -> Self {
if self.is_bottom() || other.is_bottom() {
return Self::bottom();
}
Self {
known_zero: self.known_zero & other.known_zero,
known_one: self.known_one | other.known_one,
}
}
/// Bitwise XOR transfer: `result[i] = a[i] ^ b[i]`.
///
/// - A bit is known-one if one input is known-one and the other known-zero.
/// - A bit is known-zero if both inputs are same (both known-one or both known-zero).
pub fn bit_xor(&self, other: &Self) -> Self {
if self.is_bottom() || other.is_bottom() {
return Self::bottom();
}
Self {
known_zero: (self.known_zero & other.known_zero) | (self.known_one & other.known_one),
known_one: (self.known_one & other.known_zero) | (self.known_zero & other.known_one),
}
}
/// Left shift transfer: `result = self << shift_amount`.
///
/// Precise when shift amount is a singleton in `0..63`. The low `k` bits
/// of the result are provably zero (vacated by the shift). Known bits
/// from the input are shifted up.
pub fn left_shift(&self, shift: &IntervalFact) -> Self {
if self.is_bottom() || shift.is_bottom() {
return Self::bottom();
}
// Only precise for singleton shift amounts
match (shift.lo, shift.hi) {
(Some(lo), Some(hi)) if lo == hi && (0..=63).contains(&lo) => {
let k = lo as u32;
Self {
// Known-zero bits shift up; low k bits are vacated (known zero)
known_zero: (self.known_zero << k) | ((1u64 << k) - 1),
// Known-one bits shift up
known_one: self.known_one << k,
}
}
_ => Self::top(),
}
}
/// Right shift transfer: `result = self >> shift_amount` (arithmetic).
///
/// Precise when shift amount is a singleton in `0..63`. For non-negative
/// values (sign bit known-zero), the high `k` bits are provably zero.
/// For negative values (sign bit known-one), high bits are provably one.
/// When sign is unknown, high bits become unknown.
pub fn right_shift(&self, shift: &IntervalFact) -> Self {
if self.is_bottom() || shift.is_bottom() {
return Self::bottom();
}
match (shift.lo, shift.hi) {
(Some(lo), Some(hi)) if lo == hi && (0..=63).contains(&lo) => {
let k = lo as u32;
let high_mask = if k == 0 { 0u64 } else { u64::MAX << (64 - k) };
if self.is_non_negative() {
// Non-negative: arithmetic right shift fills with 0
Self {
known_zero: (self.known_zero >> k) | high_mask,
known_one: self.known_one >> k,
}
} else if self.known_one & (1u64 << 63) != 0 {
// Known negative: arithmetic right shift fills with 1
Self {
known_zero: self.known_zero >> k,
known_one: (self.known_one >> k) | high_mask,
}
} else {
// Sign unknown: shift known bits, high bits become unknown
Self {
known_zero: self.known_zero >> k,
known_one: self.known_one >> k,
}
}
}
_ => Self::top(),
}
}
/// Compute an upper bound hint from known-zero bits.
///
/// When the value is non-negative and has high known-zero bits, returns
/// the tightest upper bound implied by those bits: the highest possible
/// value given the known-zero constraints.
///
/// Returns `None` if no useful bound can be derived.
pub fn upper_bound_hint(&self) -> Option<i64> {
if !self.is_non_negative() || self.is_bottom() {
return None;
}
// The highest possible value is: all unknown bits set to 1, known-one
// bits set to 1, known-zero bits set to 0.
// That's: !known_zero & 0x7FFF_FFFF_FFFF_FFFF (non-negative)
let max_val = !self.known_zero & 0x7FFF_FFFF_FFFF_FFFFu64;
Some(max_val as i64)
}
}
impl Lattice for BitFact {
fn bot() -> Self {
Self::bottom()
}
/// Join: keep only bits known in BOTH operands.
fn join(&self, other: &Self) -> Self {
// Special case: bottom joined with anything is the other
if self.is_bottom() {
return other.clone();
}
if other.is_bottom() {
return self.clone();
}
Self {
known_zero: self.known_zero & other.known_zero,
known_one: self.known_one & other.known_one,
}
}
/// Partial order: `self ⊑ other` iff self knows at least as many bits as other.
fn leq(&self, other: &Self) -> bool {
if self.is_bottom() {
return true;
}
if other.is_bottom() {
return false;
}
// self ⊑ other: self is more precise (has more known bits)
// Every known bit in other must also be known in self
(other.known_zero & !self.known_zero) == 0 && (other.known_one & !self.known_one) == 0
}
}
impl AbstractDomain for BitFact {
fn top() -> Self {
Self::top()
}
/// Meet: combine knowledge from both operands.
fn meet(&self, other: &Self) -> Self {
if self.is_bottom() || other.is_bottom() {
return Self::bottom();
}
let kz = self.known_zero | other.known_zero;
let ko = self.known_one | other.known_one;
// Check consistency: a bit can't be both known-zero and known-one
if kz & ko != 0 {
return Self::bottom();
}
Self {
known_zero: kz,
known_one: ko,
}
}
/// Widen: same as join (finite lattice height — 64 bits × 3 states).
fn widen(&self, other: &Self) -> Self {
self.join(other)
}
}
// ── Tests ────────────────────────────────────────────────────────────────
#[cfg(test)]
mod tests {
use super::*;
// ── Constructors ────────────────────────────────────────────────────
#[test]
fn from_const_positive() {
let f = BitFact::from_const(0x0F);
assert_eq!(f.known_one, 0x0F);
assert_eq!(f.known_zero, !0x0Fu64);
assert!(f.is_non_negative());
}
#[test]
fn from_const_negative() {
let f = BitFact::from_const(-1);
assert_eq!(f.known_one, u64::MAX);
assert_eq!(f.known_zero, 0);
assert!(!f.is_non_negative());
}
#[test]
fn from_const_zero() {
let f = BitFact::from_const(0);
assert_eq!(f.known_one, 0);
assert_eq!(f.known_zero, u64::MAX);
assert!(f.is_non_negative());
}
#[test]
fn top_and_bottom() {
assert!(BitFact::top().is_top());
assert!(!BitFact::top().is_bottom());
assert!(BitFact::bottom().is_bottom());
assert!(!BitFact::bottom().is_top());
}
// ── Lattice properties ──────────────────────────────────────────────
#[test]
fn join_commutative() {
let a = BitFact::from_const(0xFF);
let b = BitFact::from_const(0x0F);
assert_eq!(a.join(&b), b.join(&a));
}
#[test]
fn join_idempotent() {
let a = BitFact::from_const(42);
assert_eq!(a.join(&a), a);
}
#[test]
fn join_relaxes_bits() {
// 0xFF and 0x0F share bits 0-3 as known-one
let a = BitFact::from_const(0xFF);
let b = BitFact::from_const(0x0F);
let j = a.join(&b);
// Bits 0-3 are one in both, so known_one should have those
assert_eq!(j.known_one & 0xFF, 0x0F);
// Bits 4-7 differ (one in a, zero in b), so unknown
assert_eq!(j.known_zero & 0xF0, 0);
assert_eq!(j.known_one & 0xF0, 0);
}
#[test]
fn meet_commutative() {
let a = BitFact {
known_zero: 0xF0,
known_one: 0x0F,
};
let b = BitFact {
known_zero: 0x0F00,
known_one: 0,
};
assert_eq!(
<BitFact as AbstractDomain>::meet(&a, &b),
<BitFact as AbstractDomain>::meet(&b, &a)
);
}
#[test]
fn meet_contradiction_is_bottom() {
let a = BitFact {
known_zero: 0,
known_one: 0x01,
};
let b = BitFact {
known_zero: 0x01,
known_one: 0,
};
assert!(<BitFact as AbstractDomain>::meet(&a, &b).is_bottom());
}
#[test]
fn leq_reflexive() {
let a = BitFact::from_const(42);
assert!(a.leq(&a));
}
#[test]
fn leq_bottom_is_least() {
assert!(BitFact::bottom().leq(&BitFact::top()));
assert!(BitFact::bottom().leq(&BitFact::from_const(0)));
}
#[test]
fn leq_more_precise_is_lower() {
let precise = BitFact::from_const(0xFF);
let vague = BitFact::top();
assert!(precise.leq(&vague));
assert!(!vague.leq(&precise));
}
// ── Bitwise AND transfer ────────────────────────────────────────────
#[test]
fn bit_and_transfer() {
let a = BitFact::from_const(0xFF);
let b = BitFact::from_const(0x0F);
let result = a.bit_and(&b);
// 0xFF & 0x0F = 0x0F
assert_eq!(result.known_one, 0x0F);
// All bits not in 0x0F are known-zero
assert_eq!(result.known_zero, !0x0Fu64);
}
#[test]
fn bit_and_with_mask_bounds() {
// Unknown value AND'd with constant mask 0x07
let unknown = BitFact::top();
let mask = BitFact::from_const(0x07);
let result = unknown.bit_and(&mask);
// Bits above bit 2 are known-zero (from mask)
assert_eq!(result.known_zero & !0x07u64, !0x07u64);
// Low 3 bits are unknown (input was unknown)
assert_eq!(result.known_one & 0x07, 0);
}
// ── Bitwise OR transfer ─────────────────────────────────────────────
#[test]
fn bit_or_transfer() {
let a = BitFact::from_const(0xF0);
let b = BitFact::from_const(0x0F);
let result = a.bit_or(&b);
assert_eq!(result.known_one, 0xFF);
assert_eq!(result.known_zero, !0xFFu64);
}
#[test]
fn bit_or_with_unknown() {
let unknown = BitFact::top();
let bits = BitFact::from_const(0x01);
let result = unknown.bit_or(&bits);
// Bit 0 is known-one (from OR with 1)
assert_ne!(result.known_one & 0x01, 0);
// Other bits unknown
assert_eq!(result.known_zero & 0x01, 0);
}
// ── Bitwise XOR transfer ────────────────────────────────────────────
#[test]
fn bit_xor_transfer() {
let a = BitFact::from_const(0xFF);
let b = BitFact::from_const(0x0F);
let result = a.bit_xor(&b);
// 0xFF ^ 0x0F = 0xF0
assert_eq!(result.known_one, 0xF0);
assert_eq!(result.known_zero, !0xF0u64);
}
#[test]
fn bit_xor_self_is_zero() {
let a = BitFact::from_const(42);
let result = a.bit_xor(&a);
// x ^ x = 0
assert_eq!(result.known_one, 0);
assert_eq!(result.known_zero, u64::MAX);
}
#[test]
fn bit_xor_with_zero_is_identity() {
let a = BitFact::from_const(0xFF);
let zero = BitFact::from_const(0);
let result = a.bit_xor(&zero);
assert_eq!(result, a);
}
// ── Left shift transfer ─────────────────────────────────────────────
#[test]
fn left_shift_known_bits() {
let a = BitFact::from_const(0x0F);
let shift = IntervalFact::exact(4);
let result = a.left_shift(&shift);
// 0x0F << 4 = 0xF0
assert_eq!(result.known_one, 0xF0);
// Low 4 bits are known-zero (vacated)
assert_ne!(result.known_zero & 0x0F, 0);
}
#[test]
fn left_shift_range_is_top() {
let a = BitFact::from_const(0x0F);
let shift = IntervalFact {
lo: Some(1),
hi: Some(3),
};
let result = a.left_shift(&shift);
assert!(result.is_top());
}
#[test]
fn left_shift_invalid_is_top() {
let a = BitFact::from_const(0x0F);
let shift = IntervalFact::exact(64);
assert!(a.left_shift(&shift).is_top());
let neg_shift = IntervalFact::exact(-1);
assert!(a.left_shift(&neg_shift).is_top());
}
// ── Right shift transfer ────────────────────────────────────────────
#[test]
fn right_shift_known_bits_non_negative() {
let a = BitFact::from_const(0xF0);
let shift = IntervalFact::exact(4);
let result = a.right_shift(&shift);
// 0xF0 >> 4 = 0x0F (non-negative, high bits zero)
assert_eq!(result.known_one, 0x0F);
// High 4 bits should be known-zero
assert_ne!(result.known_zero & (0xFu64 << 60), 0);
}
#[test]
fn right_shift_negative_fills_ones() {
// -16 = ...1111_0000 in two's complement
let a = BitFact::from_const(-16);
let shift = IntervalFact::exact(4);
let result = a.right_shift(&shift);
// -16 >> 4 = -1 (arithmetic shift fills with 1)
assert_eq!(result.known_one, u64::MAX);
assert_eq!(result.known_zero, 0);
}
#[test]
fn right_shift_unknown_sign() {
// Sign bit unknown — high bits after shift should be unknown
let a = BitFact {
known_zero: 0x0F,
known_one: 0,
};
let shift = IntervalFact::exact(4);
let result = a.right_shift(&shift);
// Can't determine high bits → they should NOT be in known_zero or known_one
let high_mask = 0xFu64 << 60;
assert_eq!(result.known_zero & high_mask, 0);
assert_eq!(result.known_one & high_mask, 0);
}
// ── Upper bound hint ────────────────────────────────────────────────
#[test]
fn upper_bound_hint_constant() {
let f = BitFact::from_const(7);
assert_eq!(f.upper_bound_hint(), Some(7));
}
#[test]
fn upper_bound_hint_masked() {
// Unknown value masked with 0x07 → high bits known zero → max = 7
let unknown = BitFact::top();
let mask = BitFact::from_const(0x07);
let result = unknown.bit_and(&mask);
assert_eq!(result.upper_bound_hint(), Some(7));
}
#[test]
fn upper_bound_hint_negative_is_none() {
let f = BitFact::from_const(-1);
assert_eq!(f.upper_bound_hint(), None);
}
#[test]
fn upper_bound_hint_top_is_none() {
assert_eq!(BitFact::top().upper_bound_hint(), None);
}
// ── is_non_negative ─────────────────────────────────────────────────
#[test]
fn is_non_negative_positive() {
assert!(BitFact::from_const(42).is_non_negative());
assert!(BitFact::from_const(0).is_non_negative());
}
#[test]
fn is_non_negative_negative() {
assert!(!BitFact::from_const(-1).is_non_negative());
assert!(!BitFact::from_const(i64::MIN).is_non_negative());
}
#[test]
fn is_non_negative_unknown() {
assert!(!BitFact::top().is_non_negative());
}
}

1035
src/abstract_interp/interval.rs Normal file
View file

File diff suppressed because it is too large Load diff

712
src/abstract_interp/mod.rs Normal file
View file

@ -0,0 +1,712 @@
//! Abstract interpretation framework.
//!
//! Provides a product abstract domain ([`AbstractValue`]) composing independent
//! subdomains:
//! - [`IntervalFact`]: numeric interval `[lo, hi]` with arithmetic transfer
//! - [`StringFact`]: string prefix + suffix with concatenation transfer
//! - [`BitFact`]: known-zero/known-one bit masks for bitwise transfer
//!
//! Abstract values are stored per-SSA-value in [`AbstractState`], which is
//! carried through the taint analysis worklist in `SsaTaintState`. The framework
//! propagates abstract values forward through SSA operations, joins at CFG
//! merges, and widens at loop heads to ensure termination.
//!
//! ## Feature gate
//!
//! Enabled by default. Disable via `analysis.engine.abstract_interpretation
//! = false` in `nyx.conf` or the `--no-abstract-interp` CLI flag.
pub mod bit_domain;
pub mod interval;
pub mod path_domain;
pub mod string_domain;
pub use bit_domain::BitFact;
pub use interval::IntervalFact;
pub use path_domain::{PathFact, Tri};
pub use string_domain::StringFact;
use crate::ssa::ir::SsaValue;
use crate::state::lattice::{AbstractDomain, Lattice};
use serde::{Deserialize, Serialize};
use smallvec::SmallVec;
/// Feature gate: check if abstract interpretation is enabled.
///
/// Controlled by `analysis.engine.abstract_interpretation` in `nyx.conf`
/// (default `true`) or the `--abstract-interp / --no-abstract-interp` CLI
/// flag. The legacy `NYX_ABSTRACT_INTERP` env var is consulted only when no
/// runtime has been installed (library use / legacy tests).
pub fn is_enabled() -> bool {
crate::utils::analysis_options::current().abstract_interpretation
}
// ── AbstractValue ───────────────────────────────────────────────────────
/// Per-SSA-value abstract element: product of all subdomains.
///
/// Each subdomain is independent — join, meet, widen, and leq are applied
/// component-wise. Adding a new subdomain requires adding a field here
/// and updating the component-wise implementations.
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct AbstractValue {
pub interval: IntervalFact,
pub string: StringFact,
pub bits: BitFact,
#[serde(default, skip_serializing_if = "path_fact_is_top")]
pub path: PathFact,
}
fn path_fact_is_top(p: &PathFact) -> bool {
p.is_top()
}
impl AbstractValue {
pub fn top() -> Self {
Self {
interval: IntervalFact::top(),
string: StringFact::top(),
bits: BitFact::top(),
path: PathFact::top(),
}
}
pub fn bottom() -> Self {
Self {
interval: IntervalFact::bottom(),
string: StringFact::bottom(),
bits: BitFact::bottom(),
path: PathFact::bottom(),
}
}
/// Construct a value with a specific [`PathFact`] and every other
/// subdomain at Top. Used by the Rust path-primitive transfer rules.
pub fn with_path_fact(path: PathFact) -> Self {
Self {
interval: IntervalFact::top(),
string: StringFact::top(),
bits: BitFact::top(),
path,
}
}
pub fn is_top(&self) -> bool {
self.interval.is_top() && self.string.is_top() && self.bits.is_top() && self.path.is_top()
}
pub fn is_bottom(&self) -> bool {
self.interval.is_bottom()
&& self.string.is_bottom()
&& self.bits.is_bottom()
&& self.path.is_bottom()
}
pub fn join(&self, other: &Self) -> Self {
Self {
interval: self.interval.join(&other.interval),
string: self.string.join(&other.string),
bits: self.bits.join(&other.bits),
path: self.path.join(&other.path),
}
}
pub fn meet(&self, other: &Self) -> Self {
Self {
interval: self.interval.meet(&other.interval),
string: self.string.meet(&other.string),
bits: <BitFact as AbstractDomain>::meet(&self.bits, &other.bits),
path: <PathFact as AbstractDomain>::meet(&self.path, &other.path),
}
}
pub fn widen(&self, other: &Self) -> Self {
Self {
interval: self.interval.widen(&other.interval),
string: self.string.widen(&other.string),
bits: self.bits.widen(&other.bits),
path: self.path.widen(&other.path),
}
}
pub fn leq(&self, other: &Self) -> bool {
self.interval.leq(&other.interval)
&& self.string.leq(&other.string)
&& self.bits.leq(&other.bits)
&& self.path.leq(&other.path)
}
}
impl Lattice for AbstractValue {
fn bot() -> Self {
Self::bottom()
}
fn join(&self, other: &Self) -> Self {
self.join(other)
}
fn leq(&self, other: &Self) -> bool {
self.leq(other)
}
}
impl AbstractDomain for AbstractValue {
fn top() -> Self {
Self::top()
}
fn meet(&self, other: &Self) -> Self {
self.meet(other)
}
fn widen(&self, other: &Self) -> Self {
self.widen(other)
}
}
// ── AbstractTransfer ────────────────────────────────────────────────────
/// Maximum length of a literal prefix tracked by [`StringTransfer::LiteralPrefix`].
///
/// Caps the on-disk summary size when a callee produces a long known prefix.
/// The interval domain already has a natural bound (two `i64`s); the string
/// side needs an explicit cap so a callee that returns a 10KB constant does
/// not balloon every cross-file summary that references it.
pub const MAX_LITERAL_PREFIX_LEN: usize = 64;
/// Per-parameter interval-to-return transform.
///
/// This is a **bounded** description of how a caller-known interval on one
/// parameter maps to the callee's return interval. The forms are intentionally
/// restricted so the summary size stays constant regardless of callee body
/// complexity:
///
/// * [`IntervalTransfer::Top`] — no interval knowledge crosses (default).
/// * [`IntervalTransfer::Identity`] — return = param (pass-through).
/// * [`IntervalTransfer::Affine`] — return = param * `mul` + `add` with
/// `i64` constants; overflow defaults to Top at apply time.
/// * [`IntervalTransfer::Clamped`] — return is always in `[lo, hi]` regardless
/// of input. Captures callee-intrinsic bounds (e.g. `saturating` ops).
///
/// No unbounded expression trees, no nesting. A callee whose behaviour does
/// not fit one of these forms falls back to `Top` — we never try to encode
/// richer algebra in the summary.
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Default)]
pub enum IntervalTransfer {
#[default]
Top,
Identity,
Affine {
add: i64,
mul: i64,
},
Clamped {
lo: i64,
hi: i64,
},
}
impl IntervalTransfer {
/// Apply the transform to a caller-known input interval.
pub fn apply(&self, input: &IntervalFact) -> IntervalFact {
match self {
Self::Top => IntervalFact::top(),
Self::Identity => input.clone(),
Self::Affine { add, mul } => input
.mul(&IntervalFact::exact(*mul))
.add(&IntervalFact::exact(*add)),
Self::Clamped { lo, hi } if lo <= hi => IntervalFact {
lo: Some(*lo),
hi: Some(*hi),
},
Self::Clamped { .. } => IntervalFact::top(),
}
}
/// Join two transforms. Used when multiple return paths produce
/// differing transforms for the same parameter: the aggregate is the
/// widest safe form.
pub fn join(&self, other: &Self) -> Self {
use IntervalTransfer::*;
match (self, other) {
(Top, _) | (_, Top) => Top,
(a, b) if a == b => a.clone(),
(Clamped { lo: a, hi: b }, Clamped { lo: c, hi: d }) => Clamped {
lo: (*a).min(*c),
hi: (*b).max(*d),
},
// Identity ⊔ anything else = Top (different flow shapes).
_ => Top,
}
}
}
/// Per-parameter string-to-return transform.
///
/// Mirrors [`IntervalTransfer`] for the string subdomain. Bounded by
/// [`MAX_LITERAL_PREFIX_LEN`] to keep summary size constant.
///
/// * [`StringTransfer::Unknown`] — default.
/// * [`StringTransfer::Identity`] — return = param.
/// * [`StringTransfer::LiteralPrefix`] — return has this literal prefix
/// regardless of input (callee-intrinsic).
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, Default)]
pub enum StringTransfer {
#[default]
Unknown,
Identity,
LiteralPrefix(String),
}
impl StringTransfer {
/// Construct a `LiteralPrefix`, truncating to [`MAX_LITERAL_PREFIX_LEN`]
/// and degrading to `Unknown` on empty input.
pub fn literal_prefix(s: &str) -> Self {
if s.is_empty() {
return Self::Unknown;
}
if s.len() <= MAX_LITERAL_PREFIX_LEN {
Self::LiteralPrefix(s.to_string())
} else {
// Truncate on a char boundary to stay valid UTF-8.
let mut cut = MAX_LITERAL_PREFIX_LEN;
while cut > 0 && !s.is_char_boundary(cut) {
cut -= 1;
}
if cut == 0 {
Self::Unknown
} else {
Self::LiteralPrefix(s[..cut].to_string())
}
}
}
/// Apply the transform to a caller-known input string fact.
pub fn apply(&self, input: &StringFact) -> StringFact {
match self {
Self::Unknown => StringFact::top(),
Self::Identity => input.clone(),
Self::LiteralPrefix(p) => StringFact::from_prefix(p),
}
}
/// Join two transforms.
pub fn join(&self, other: &Self) -> Self {
use StringTransfer::*;
match (self, other) {
(Unknown, _) | (_, Unknown) => Unknown,
(a, b) if a == b => a.clone(),
(LiteralPrefix(a), LiteralPrefix(b)) => {
// Longest common prefix.
let lcp: String = a
.chars()
.zip(b.chars())
.take_while(|(x, y)| x == y)
.map(|(x, _)| x)
.collect();
if lcp.is_empty() {
Unknown
} else {
Self::literal_prefix(&lcp)
}
}
// Identity vs LiteralPrefix → Unknown (different flow shapes).
_ => Unknown,
}
}
}
/// Per-parameter abstract-domain transfer channel.
///
/// Combines the per-subdomain transforms into one record attached to each
/// parameter in [`crate::summary::ssa_summary::SsaFuncSummary`]. Used at
/// cross-file call sites to synthesise a return abstract value from the
/// caller's knowledge of each argument, without having to re-run the callee.
///
/// Composition rule: `apply(input) = (interval.apply, string.apply,
/// bits=top)`. The bit domain is always Top — we do not track cross-file
/// bit transfers.
#[derive(Clone, Debug, PartialEq, Eq, Default, Serialize, Deserialize)]
pub struct AbstractTransfer {
#[serde(default, skip_serializing_if = "is_interval_top")]
pub interval: IntervalTransfer,
#[serde(default, skip_serializing_if = "is_string_unknown")]
pub string: StringTransfer,
}
fn is_interval_top(t: &IntervalTransfer) -> bool {
matches!(t, IntervalTransfer::Top)
}
fn is_string_unknown(t: &StringTransfer) -> bool {
matches!(t, StringTransfer::Unknown)
}
impl AbstractTransfer {
/// Fully-imprecise transfer: no information crosses. Used as the
/// conservative default when a parameter's flow does not fit any of the
/// bounded forms.
pub fn top() -> Self {
Self::default()
}
/// True when neither subdomain carries any information — equivalent to
/// "omit this entry entirely".
pub fn is_top(&self) -> bool {
is_interval_top(&self.interval) && is_string_unknown(&self.string)
}
/// Apply the transform to a caller-known input abstract value.
pub fn apply(&self, input: &AbstractValue) -> AbstractValue {
AbstractValue {
interval: self.interval.apply(&input.interval),
string: self.string.apply(&input.string),
bits: BitFact::top(),
path: PathFact::top(),
}
}
/// Join two transfers component-wise.
pub fn join(&self, other: &Self) -> Self {
Self {
interval: self.interval.join(&other.interval),
string: self.string.join(&other.string),
}
}
}
// ── AbstractState ───────────────────────────────────────────────────────
/// Maximum abstract values tracked per block (performance bound).
const MAX_ABSTRACT_VALUES: usize = 64;
/// Per-block abstract state: sorted map from SsaValue → AbstractValue.
///
/// Values not in the map are implicitly Top (no knowledge). Sorted by
/// SsaValue for O(n) merge-join, matching the pattern used by
/// `SsaTaintState.values`.
#[derive(Clone, Debug, PartialEq, Eq)]
pub struct AbstractState {
values: SmallVec<[(SsaValue, AbstractValue); 8]>,
}
impl AbstractState {
pub fn empty() -> Self {
Self {
values: SmallVec::new(),
}
}
/// Get abstract value for an SSA value. Returns Top if absent.
pub fn get(&self, v: SsaValue) -> AbstractValue {
self.values
.binary_search_by_key(&v, |(id, _)| *id)
.ok()
.map(|idx| self.values[idx].1.clone())
.unwrap_or_else(AbstractValue::top)
}
/// Set abstract value for an SSA value. Drops Top values to save space.
pub fn set(&mut self, v: SsaValue, val: AbstractValue) {
if val.is_top() {
// Don't store Top — it's the default
if let Ok(idx) = self.values.binary_search_by_key(&v, |(id, _)| *id) {
self.values.remove(idx);
}
return;
}
match self.values.binary_search_by_key(&v, |(id, _)| *id) {
Ok(idx) => self.values[idx].1 = val,
Err(idx) => {
if self.values.len() < MAX_ABSTRACT_VALUES {
self.values.insert(idx, (v, val));
}
// Over budget: silently drop (conservative — defaults to Top)
}
}
}
/// Merge-join two abstract states. Values present in both are joined;
/// values present in only one side are dropped (absent = Top, join with
/// Top = Top).
pub fn join(&self, other: &Self) -> Self {
let mut result = SmallVec::with_capacity(self.values.len().min(other.values.len()));
let (mut i, mut j) = (0, 0);
while i < self.values.len() && j < other.values.len() {
match self.values[i].0.cmp(&other.values[j].0) {
std::cmp::Ordering::Less => {
// Only in self → join with Top = Top → drop
i += 1;
}
std::cmp::Ordering::Greater => {
// Only in other → drop
j += 1;
}
std::cmp::Ordering::Equal => {
let joined = self.values[i].1.join(&other.values[j].1);
if !joined.is_top() {
result.push((self.values[i].0, joined));
}
i += 1;
j += 1;
}
}
}
Self { values: result }
}
/// Merge-widen: for values present in both states, apply widening.
/// Values present in only one side are dropped (Top).
pub fn widen(&self, other: &Self) -> Self {
let mut result = SmallVec::with_capacity(self.values.len().min(other.values.len()));
let (mut i, mut j) = (0, 0);
while i < self.values.len() && j < other.values.len() {
match self.values[i].0.cmp(&other.values[j].0) {
std::cmp::Ordering::Less => {
i += 1;
}
std::cmp::Ordering::Greater => {
j += 1;
}
std::cmp::Ordering::Equal => {
let widened = self.values[i].1.widen(&other.values[j].1);
if !widened.is_top() {
result.push((self.values[i].0, widened));
}
i += 1;
j += 1;
}
}
}
Self { values: result }
}
/// Partial order: self ⊑ other.
pub fn leq(&self, other: &Self) -> bool {
// Every non-Top entry in self must have a corresponding entry in other
// with self[v] ⊑ other[v]. Entries only in other are fine (Top ⊑ anything
// is false, but absent self entries are Top which is handled).
for (v, val) in &self.values {
let other_val = other.get(*v);
if !val.leq(&other_val) {
return false;
}
}
true
}
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn abstract_value_top_bottom() {
assert!(AbstractValue::top().is_top());
assert!(AbstractValue::bottom().is_bottom());
assert!(!AbstractValue::top().is_bottom());
assert!(!AbstractValue::bottom().is_top());
}
#[test]
fn abstract_value_join_componentwise() {
let a = AbstractValue {
interval: IntervalFact::exact(1),
string: StringFact::from_prefix("https://a.com/"),
bits: BitFact::top(),
path: PathFact::top(),
};
let b = AbstractValue {
interval: IntervalFact::exact(5),
string: StringFact::from_prefix("https://b.com/"),
bits: BitFact::top(),
path: PathFact::top(),
};
let j = a.join(&b);
assert_eq!(j.interval.lo, Some(1));
assert_eq!(j.interval.hi, Some(5));
assert_eq!(j.string.prefix.as_deref(), Some("https://"));
}
#[test]
fn abstract_value_widen_componentwise() {
let old = AbstractValue {
interval: IntervalFact {
lo: Some(0),
hi: Some(5),
},
string: StringFact::from_prefix("hello"),
bits: BitFact::top(),
path: PathFact::top(),
};
let new = AbstractValue {
interval: IntervalFact {
lo: Some(0),
hi: Some(10),
},
string: StringFact::from_prefix("hello"),
bits: BitFact::top(),
path: PathFact::top(),
};
let w = old.widen(&new);
assert_eq!(w.interval.lo, Some(0)); // stable
assert_eq!(w.interval.hi, None); // grew → widened
assert_eq!(w.string.prefix.as_deref(), Some("hello")); // stable
}
#[test]
fn abstract_state_get_default_top() {
let state = AbstractState::empty();
assert!(state.get(SsaValue(42)).is_top());
}
#[test]
fn abstract_state_set_get() {
let mut state = AbstractState::empty();
let val = AbstractValue {
interval: IntervalFact::exact(10),
string: StringFact::top(),
bits: BitFact::top(),
path: PathFact::top(),
};
state.set(SsaValue(1), val.clone());
assert_eq!(state.get(SsaValue(1)), val);
}
#[test]
fn abstract_state_set_top_removes() {
let mut state = AbstractState::empty();
state.set(
SsaValue(1),
AbstractValue {
interval: IntervalFact::exact(5),
string: StringFact::top(),
bits: BitFact::top(),
path: PathFact::top(),
},
);
assert!(!state.get(SsaValue(1)).is_top());
state.set(SsaValue(1), AbstractValue::top());
assert!(state.get(SsaValue(1)).is_top());
assert!(state.values.is_empty());
}
#[test]
fn abstract_state_join() {
let mut a = AbstractState::empty();
a.set(
SsaValue(1),
AbstractValue {
interval: IntervalFact::exact(3),
string: StringFact::top(),
bits: BitFact::top(),
path: PathFact::top(),
},
);
a.set(
SsaValue(2),
AbstractValue {
interval: IntervalFact::exact(10),
string: StringFact::top(),
bits: BitFact::top(),
path: PathFact::top(),
},
);
let mut b = AbstractState::empty();
b.set(
SsaValue(1),
AbstractValue {
interval: IntervalFact::exact(7),
string: StringFact::top(),
bits: BitFact::top(),
path: PathFact::top(),
},
);
// SsaValue(2) not in b → join drops it (Top)
let j = a.join(&b);
// SsaValue(1): join [3,3] and [7,7] = [3,7]
let v1 = j.get(SsaValue(1));
assert_eq!(v1.interval.lo, Some(3));
assert_eq!(v1.interval.hi, Some(7));
// SsaValue(2): only in a → dropped to Top
assert!(j.get(SsaValue(2)).is_top());
}
#[test]
fn abstract_state_widen() {
let mut old = AbstractState::empty();
old.set(
SsaValue(1),
AbstractValue {
interval: IntervalFact {
lo: Some(0),
hi: Some(5),
},
string: StringFact::top(),
bits: BitFact::top(),
path: PathFact::top(),
},
);
let mut new = AbstractState::empty();
new.set(
SsaValue(1),
AbstractValue {
interval: IntervalFact {
lo: Some(0),
hi: Some(10),
},
string: StringFact::top(),
bits: BitFact::top(),
path: PathFact::top(),
},
);
let w = old.widen(&new);
let v1 = w.get(SsaValue(1));
assert_eq!(v1.interval.lo, Some(0)); // stable
assert_eq!(v1.interval.hi, None); // grew → widened
}
#[test]
fn loop_carried_phi_join_and_widen() {
// Simulate: x = 0; loop { x = phi(0, x+1) }
// Iteration 1: join([0,0], [1,1]) = [0,1]
let init = IntervalFact::exact(0);
let inc1 = IntervalFact::exact(1);
let phi1 = init.join(&inc1);
assert_eq!(phi1.lo, Some(0));
assert_eq!(phi1.hi, Some(1));
// Iteration 2: join([0,1], [1,2]) = [0,2]
let inc2 = IntervalFact {
lo: Some(1),
hi: Some(2),
};
let phi2 = phi1.join(&inc2);
assert_eq!(phi2.lo, Some(0));
assert_eq!(phi2.hi, Some(2));
// Widen: [0,1] vs [0,2] → upper bound grew → [0, None]
let widened = phi1.widen(&phi2);
assert_eq!(widened.lo, Some(0));
assert_eq!(widened.hi, None);
// Iteration 3: join([0,None], [1,None]) = [0,None] (stable!)
let inc3 = IntervalFact {
lo: Some(1),
hi: None,
};
let phi3 = widened.join(&inc3);
assert_eq!(phi3.lo, Some(0));
assert_eq!(phi3.hi, None);
assert_eq!(phi3, widened); // converged
}
}

1859
src/abstract_interp/path_domain.rs Normal file
View file

File diff suppressed because it is too large Load diff

678
src/abstract_interp/string_domain.rs Normal file
View file

@ -0,0 +1,678 @@
//! String abstract domain for abstract interpretation.
//!
//! Tracks known prefix, suffix, and — when provably bounded — the finite set
//! of possible concrete string values. Used for SSRF suppression (URL prefix
//! proves host is locked), command-injection suppression (lookup result
//! bounded to a safe set of literals), and general string analysis.
use crate::state::lattice::{AbstractDomain, Lattice};
use serde::{Deserialize, Serialize};
/// Maximum tracked prefix length (bytes).
pub const MAX_PREFIX_LEN: usize = 256;
/// Maximum tracked suffix length (bytes).
pub const MAX_SUFFIX_LEN: usize = 128;
/// Maximum tracked finite-domain cardinality. Beyond this, `domain` widens
/// to `None` (Top on the domain sub-field).
pub const MAX_DOMAIN_SIZE: usize = 16;
/// Single-character shell metacharacters. A string containing any of these
/// cannot be passed as a single shell word without escaping, so bounded
/// sets containing them cannot suppress `Cap::SHELL_ESCAPE`.
const SHELL_METACHARS: &[char] = &[
';', '|', '&', '`', '$', '>', '<', '(', ')', '\n', '\r', '\0', '\\', '"', '\'', ' ', '\t',
];
/// Return `true` when `s` contains no shell metacharacter and is therefore
/// safe to pass as a single shell token.
pub fn is_shell_safe_literal(s: &str) -> bool {
!s.chars().any(|c| SHELL_METACHARS.contains(&c))
}
/// String abstract domain: tracks known prefix, suffix, and finite domain.
///
/// Lattice ordering:
/// - `Bottom` ⊑ everything (unsatisfiable)
/// - Concrete facts ⊑ `Top` (no knowledge)
/// - `Some(prefix)` ⊑ `None` (no prefix known)
/// - `Some({a,b})` ⊑ `Some({a,b,c})` ⊑ `None` (subset → wider → Top)
///
/// Prefix, suffix, and domain are independent: a value can carry any subset
/// of the three.
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub struct StringFact {
/// Known prefix of the string. `None` = unknown.
pub prefix: Option<String>,
/// Known suffix of the string. `None` = unknown.
pub suffix: Option<String>,
/// Known finite set of possible concrete values. `None` = unknown set.
/// `Some(vec)` with `vec.len() <= MAX_DOMAIN_SIZE` = value ∈ `vec`.
/// Always sorted and deduped.
pub domain: Option<Vec<String>>,
/// True when this fact is Bottom (unsatisfiable).
is_bottom: bool,
}
impl StringFact {
/// Top: no knowledge about the string.
pub fn top() -> Self {
Self {
prefix: None,
suffix: None,
domain: None,
is_bottom: false,
}
}
/// Bottom: unsatisfiable / empty set.
pub fn bottom() -> Self {
Self {
prefix: None,
suffix: None,
domain: None,
is_bottom: true,
}
}
/// Exact known string value: prefix and suffix are the full string, and
/// the finite domain is `{s}`.
pub fn exact(s: &str) -> Self {
let prefix = truncate_prefix(s);
let suffix = truncate_suffix(s);
Self {
prefix: Some(prefix),
suffix: Some(suffix),
domain: Some(vec![s.to_string()]),
is_bottom: false,
}
}
/// Known prefix only.
pub fn from_prefix(p: &str) -> Self {
Self {
prefix: Some(truncate_prefix(p)),
suffix: None,
domain: None,
is_bottom: false,
}
}
/// Known suffix only.
pub fn from_suffix(s: &str) -> Self {
Self {
prefix: None,
suffix: Some(truncate_suffix(s)),
domain: None,
is_bottom: false,
}
}
/// Known finite set of possible concrete values.
///
/// Inputs are sorted and deduped. If the cardinality exceeds
/// [`MAX_DOMAIN_SIZE`] or the input is empty, the domain collapses to
/// `None` (Top on this sub-field). The prefix/suffix sub-fields remain
/// unset — callers can combine with [`Self::exact`] for single-element
/// sets if tighter facts are desired.
pub fn finite_set(values: Vec<String>) -> Self {
let mut v = values;
v.sort();
v.dedup();
let domain = if v.is_empty() || v.len() > MAX_DOMAIN_SIZE {
None
} else {
Some(v)
};
Self {
prefix: None,
suffix: None,
domain,
is_bottom: false,
}
}
pub fn is_top(&self) -> bool {
!self.is_bottom && self.prefix.is_none() && self.suffix.is_none() && self.domain.is_none()
}
pub fn is_bottom(&self) -> bool {
self.is_bottom
}
/// Returns `true` when the finite domain is known and every element is
/// free of shell metacharacters. Used to suppress `Cap::SHELL_ESCAPE`
/// when the payload is provably bounded to a safe set of words.
pub fn is_finite_shell_safe(&self) -> bool {
match &self.domain {
Some(values) if !values.is_empty() => values.iter().all(|s| is_shell_safe_literal(s)),
_ => false,
}
}
// ── Lattice operations ──────────────────────────────────────────────
/// Join: longest common prefix (LCP), longest common suffix (LCS), and
/// set union of finite domains (clipped at [`MAX_DOMAIN_SIZE`]).
pub fn join(&self, other: &Self) -> Self {
if self.is_bottom {
return other.clone();
}
if other.is_bottom {
return self.clone();
}
let prefix = match (&self.prefix, &other.prefix) {
(Some(a), Some(b)) => {
let lcp = longest_common_prefix(a, b);
if lcp.is_empty() { None } else { Some(lcp) }
}
_ => None,
};
let suffix = match (&self.suffix, &other.suffix) {
(Some(a), Some(b)) => {
let lcs = longest_common_suffix(a, b);
if lcs.is_empty() { None } else { Some(lcs) }
}
_ => None,
};
let domain = match (&self.domain, &other.domain) {
(Some(a), Some(b)) => {
let mut merged: Vec<String> = Vec::with_capacity(a.len() + b.len());
merged.extend_from_slice(a);
merged.extend_from_slice(b);
merged.sort();
merged.dedup();
if merged.len() > MAX_DOMAIN_SIZE {
None
} else {
Some(merged)
}
}
_ => None,
};
Self {
prefix,
suffix,
domain,
is_bottom: false,
}
}
/// Meet: intersection of all three sub-fields (conservative).
pub fn meet(&self, other: &Self) -> Self {
if self.is_bottom || other.is_bottom {
return Self::bottom();
}
let prefix = match (&self.prefix, &other.prefix) {
(Some(a), Some(b)) => {
if a.starts_with(b.as_str()) {
Some(a.clone())
} else if b.starts_with(a.as_str()) {
Some(b.clone())
} else {
return Self::bottom();
}
}
(Some(a), None) => Some(a.clone()),
(None, Some(b)) => Some(b.clone()),
(None, None) => None,
};
let suffix = match (&self.suffix, &other.suffix) {
(Some(a), Some(b)) => {
if a.ends_with(b.as_str()) {
Some(a.clone())
} else if b.ends_with(a.as_str()) {
Some(b.clone())
} else {
return Self::bottom();
}
}
(Some(a), None) => Some(a.clone()),
(None, Some(b)) => Some(b.clone()),
(None, None) => None,
};
let domain = match (&self.domain, &other.domain) {
(Some(a), Some(b)) => {
let inter: Vec<String> = a
.iter()
.filter(|s| b.binary_search(s).is_ok())
.cloned()
.collect();
if inter.is_empty() {
return Self::bottom();
}
Some(inter)
}
(Some(a), None) => Some(a.clone()),
(None, Some(b)) => Some(b.clone()),
(None, None) => None,
};
Self {
prefix,
suffix,
domain,
is_bottom: false,
}
}
/// Widen: drop any sub-field that changed between iterations.
pub fn widen(&self, other: &Self) -> Self {
if self.is_bottom {
return other.clone();
}
if other.is_bottom {
return self.clone();
}
let prefix = if self.prefix == other.prefix {
self.prefix.clone()
} else {
None
};
let suffix = if self.suffix == other.suffix {
self.suffix.clone()
} else {
None
};
let domain = if self.domain == other.domain {
self.domain.clone()
} else {
None
};
Self {
prefix,
suffix,
domain,
is_bottom: false,
}
}
pub fn leq(&self, other: &Self) -> bool {
if self.is_bottom {
return true;
}
if other.is_bottom {
return false;
}
let prefix_ok = match (&self.prefix, &other.prefix) {
(_, None) => true,
(None, Some(_)) => false,
(Some(a), Some(b)) => a.starts_with(b.as_str()),
};
let suffix_ok = match (&self.suffix, &other.suffix) {
(_, None) => true,
(None, Some(_)) => false,
(Some(a), Some(b)) => a.ends_with(b.as_str()),
};
let domain_ok = match (&self.domain, &other.domain) {
(_, None) => true,
(None, Some(_)) => false,
(Some(a), Some(b)) => a.iter().all(|s| b.binary_search(s).is_ok()),
};
prefix_ok && suffix_ok && domain_ok
}
// ── Transfer functions ──────────────────────────────────────────────
/// String concatenation: `self ++ other`.
///
/// - Prefix of result = prefix of `self` (left operand)
/// - Suffix of result = suffix of `other` (right operand)
/// - Domain: cross-product is too explosive to track; collapse to `None`.
pub fn concat(&self, other: &Self) -> Self {
if self.is_bottom || other.is_bottom {
return Self::bottom();
}
Self {
prefix: self.prefix.clone(),
suffix: other.suffix.clone(),
domain: None,
is_bottom: false,
}
}
}
impl Lattice for StringFact {
fn bot() -> Self {
Self::bottom()
}
fn join(&self, other: &Self) -> Self {
self.join(other)
}
fn leq(&self, other: &Self) -> bool {
self.leq(other)
}
}
impl AbstractDomain for StringFact {
fn top() -> Self {
Self::top()
}
fn meet(&self, other: &Self) -> Self {
self.meet(other)
}
fn widen(&self, other: &Self) -> Self {
self.widen(other)
}
}
// ── Helpers ─────────────────────────────────────────────────────────────
fn truncate_prefix(s: &str) -> String {
if s.len() <= MAX_PREFIX_LEN {
s.to_string()
} else {
// Find a char boundary at or before MAX_PREFIX_LEN
let mut end = MAX_PREFIX_LEN;
while end > 0 && !s.is_char_boundary(end) {
end -= 1;
}
s[..end].to_string()
}
}
fn truncate_suffix(s: &str) -> String {
if s.len() <= MAX_SUFFIX_LEN {
s.to_string()
} else {
let start = s.len() - MAX_SUFFIX_LEN;
let mut start = start;
while start < s.len() && !s.is_char_boundary(start) {
start += 1;
}
s[start..].to_string()
}
}
/// Longest common prefix of two strings.
pub fn longest_common_prefix(a: &str, b: &str) -> String {
a.bytes()
.zip(b.bytes())
.take_while(|(x, y)| x == y)
.map(|(x, _)| x as char)
.collect()
}
/// Longest common suffix of two strings.
pub fn longest_common_suffix(a: &str, b: &str) -> String {
let lcs: String = a
.bytes()
.rev()
.zip(b.bytes().rev())
.take_while(|(x, y)| x == y)
.map(|(x, _)| x as char)
.collect();
lcs.chars().rev().collect()
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn top_and_bottom() {
assert!(StringFact::top().is_top());
assert!(!StringFact::top().is_bottom());
assert!(StringFact::bottom().is_bottom());
assert!(!StringFact::bottom().is_top());
}
#[test]
fn exact_sets_both() {
let f = StringFact::exact("hello");
assert_eq!(f.prefix.as_deref(), Some("hello"));
assert_eq!(f.suffix.as_deref(), Some("hello"));
assert_eq!(f.domain.as_deref(), Some(&["hello".to_string()][..]));
}
// ── LCP / LCS helpers ───────────────────────────────────────────
#[test]
fn lcp_basic() {
assert_eq!(longest_common_prefix("abcdef", "abcxyz"), "abc");
assert_eq!(longest_common_prefix("abc", "abc"), "abc");
assert_eq!(longest_common_prefix("abc", "xyz"), "");
assert_eq!(longest_common_prefix("", "abc"), "");
}
#[test]
fn lcs_basic() {
assert_eq!(longest_common_suffix("hello.json", "world.json"), ".json");
assert_eq!(longest_common_suffix("abc", "xyz"), "");
assert_eq!(longest_common_suffix("abc", "abc"), "abc");
}
// ── Join ────────────────────────────────────────────────────────
#[test]
fn join_same_prefix() {
let a = StringFact::from_prefix("https://api.com/users/");
let b = StringFact::from_prefix("https://api.com/items/");
let j = a.join(&b);
assert_eq!(j.prefix.as_deref(), Some("https://api.com/"));
}
#[test]
fn join_no_common_prefix() {
let a = StringFact::from_prefix("https://a.com/");
let b = StringFact::from_prefix("http://b.com/");
let j = a.join(&b);
assert_eq!(j.prefix.as_deref(), Some("http")); // common: "http"
}
#[test]
fn join_suffix() {
let a = StringFact::from_suffix(".json");
let b = StringFact::from_suffix(".json");
assert_eq!(a.join(&b).suffix.as_deref(), Some(".json"));
}
#[test]
fn join_different_suffix() {
let a = StringFact::from_suffix(".json");
let b = StringFact::from_suffix(".xml");
assert_eq!(a.join(&b).suffix, None);
}
#[test]
fn join_with_bottom() {
let a = StringFact::from_prefix("hello");
assert_eq!(a.join(&StringFact::bottom()), a);
assert_eq!(StringFact::bottom().join(&a), a);
}
#[test]
fn join_finite_sets_union() {
let a = StringFact::finite_set(vec!["ls".into(), "cat".into()]);
let b = StringFact::finite_set(vec!["true".into(), "ls".into()]);
let j = a.join(&b);
let d = j.domain.expect("union");
assert_eq!(d, vec!["cat", "ls", "true"]);
}
#[test]
fn join_finite_sets_overflow_to_top() {
// 9 + 9 = 18 > MAX_DOMAIN_SIZE = 16 → domain collapses to None.
let a = StringFact::finite_set((0..9).map(|n| format!("a{n}")).collect::<Vec<_>>());
let b = StringFact::finite_set((0..9).map(|n| format!("b{n}")).collect::<Vec<_>>());
let j = a.join(&b);
assert!(j.domain.is_none());
}
#[test]
fn join_unknown_domain_yields_top() {
let a = StringFact::finite_set(vec!["x".into()]);
let b = StringFact::from_prefix("x");
assert!(a.join(&b).domain.is_none());
}
// ── Meet ────────────────────────────────────────────────────────
#[test]
fn meet_consistent_prefix() {
let a = StringFact::from_prefix("https://");
let b = StringFact::from_prefix("https://api.com/");
let m = a.meet(&b);
assert_eq!(m.prefix.as_deref(), Some("https://api.com/"));
}
#[test]
fn meet_contradictory_prefix() {
let a = StringFact::from_prefix("https://a.com/");
let b = StringFact::from_prefix("https://b.com/");
assert!(a.meet(&b).is_bottom());
}
#[test]
fn meet_finite_sets_intersect() {
let a = StringFact::finite_set(vec!["ls".into(), "cat".into(), "true".into()]);
let b = StringFact::finite_set(vec!["ls".into(), "true".into()]);
let m = a.meet(&b);
assert_eq!(
m.domain.as_deref(),
Some(&["ls".to_string(), "true".to_string()][..])
);
}
#[test]
fn meet_finite_sets_empty_is_bottom() {
let a = StringFact::finite_set(vec!["ls".into()]);
let b = StringFact::finite_set(vec!["cat".into()]);
assert!(a.meet(&b).is_bottom());
}
// ── Widen ───────────────────────────────────────────────────────
#[test]
fn widen_stable() {
let a = StringFact::from_prefix("https://api.com/");
assert_eq!(a.widen(&a), a);
}
#[test]
fn widen_changed_prefix() {
let old = StringFact::from_prefix("https://api.com/v1/");
let new = StringFact::from_prefix("https://api.com/v2/");
let w = old.widen(&new);
assert_eq!(w.prefix, None); // changed → dropped
}
#[test]
fn widen_changed_domain() {
let old = StringFact::finite_set(vec!["ls".into()]);
let new = StringFact::finite_set(vec!["ls".into(), "cat".into()]);
assert!(old.widen(&new).domain.is_none());
}
// ── Concat ──────────────────────────────────────────────────────
#[test]
fn concat_exact() {
let a = StringFact::exact("hello");
let b = StringFact::exact(" world");
let c = a.concat(&b);
assert_eq!(c.prefix.as_deref(), Some("hello"));
assert_eq!(c.suffix.as_deref(), Some(" world"));
// domain drops because cross-product is not tracked
assert!(c.domain.is_none());
}
#[test]
fn concat_prefix_with_top() {
let a = StringFact::from_prefix("https://api.com/");
let b = StringFact::top();
let c = a.concat(&b);
assert_eq!(c.prefix.as_deref(), Some("https://api.com/"));
assert_eq!(c.suffix, None);
}
#[test]
fn concat_top_with_suffix() {
let a = StringFact::top();
let b = StringFact::from_suffix(".json");
let c = a.concat(&b);
assert_eq!(c.prefix, None);
assert_eq!(c.suffix.as_deref(), Some(".json"));
}
// ── Leq ─────────────────────────────────────────────────────────
#[test]
fn leq_more_specific_prefix() {
let specific = StringFact::from_prefix("https://api.com/users/");
let general = StringFact::from_prefix("https://api.com/");
assert!(specific.leq(&general));
assert!(!general.leq(&specific));
}
#[test]
fn leq_top_greatest() {
let a = StringFact::from_prefix("hello");
assert!(a.leq(&StringFact::top()));
assert!(!StringFact::top().leq(&a));
}
#[test]
fn leq_bottom_least() {
assert!(StringFact::bottom().leq(&StringFact::top()));
assert!(StringFact::bottom().leq(&StringFact::from_prefix("x")));
}
#[test]
fn leq_finite_subset() {
let sub = StringFact::finite_set(vec!["ls".into()]);
let sup = StringFact::finite_set(vec!["ls".into(), "cat".into()]);
assert!(sub.leq(&sup));
assert!(!sup.leq(&sub));
}
// ── Finite-set / shell safety ───────────────────────────────────
#[test]
fn finite_set_sorts_and_dedups() {
let f = StringFact::finite_set(vec!["b".into(), "a".into(), "a".into()]);
assert_eq!(
f.domain.as_deref(),
Some(&["a".to_string(), "b".to_string()][..])
);
}
#[test]
fn finite_set_overflow_is_top() {
let many: Vec<String> = (0..(MAX_DOMAIN_SIZE + 1))
.map(|n| format!("v{n}"))
.collect();
let f = StringFact::finite_set(many);
assert!(f.domain.is_none());
}
#[test]
fn finite_set_empty_is_top() {
let f = StringFact::finite_set(vec![]);
assert!(f.domain.is_none());
assert!(f.is_top());
}
#[test]
fn shell_safe_detects_metachars() {
assert!(is_shell_safe_literal("ls"));
assert!(is_shell_safe_literal("cat"));
assert!(is_shell_safe_literal("no-metachars"));
assert!(!is_shell_safe_literal("rm;reboot"));
assert!(!is_shell_safe_literal("echo $HOME"));
assert!(!is_shell_safe_literal("a|b"));
assert!(!is_shell_safe_literal("a b")); // whitespace splits shell words
}
#[test]
fn is_finite_shell_safe_only_when_bounded() {
assert!(!StringFact::top().is_finite_shell_safe());
assert!(!StringFact::from_prefix("ls").is_finite_shell_safe());
assert!(StringFact::finite_set(vec!["ls".into(), "cat".into()]).is_finite_shell_safe());
assert!(
!StringFact::finite_set(vec!["ls".into(), "rm;reboot".into()]).is_finite_shell_safe()
);
}
}