mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-21 20:18:06 +02:00
Release/0.5.0 (#35)
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures * feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests * feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements * feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles * feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing * feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling * feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures * feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration * feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests * feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic * feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection * feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements * feat: Enable auth-state analysis by default and update relevant tests in benchmark config * test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test * docs: update CHANGELOG.md * feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers * feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers * feat: Implement per-index array slot tracking in symbolic heap with overflow collapse * feat: Add implicit definition handling for uninitialized declarations in SSA value allocation * feat: Refactor function parameters and constants for improved clarity and maintainability * refactor: Reorder module imports and improve formatting for consistency * refactor: Fix formatting erorrs * refactor: Fix clippy warnings * refactor: Fix fmt warnings (again) * chore: Update dependencies and improve feature configuration * Add comprehensive tests for undertested modules (#36) (COPILOT) * Add comprehensive tests for undertested modules Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083 * Add comprehensive tests for ext, project, walk, and errors modules Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083 --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> * chore: Update dependencies and improve feature configuration * fix: formatting errors in new tests * chore: Update license list in about.toml * chore: made functions input inline * chore: updated cfg graph to take up the full page * chore: add Prettier configuration and update code formatting * Add frontend test suite with Vitest (111 tests) (#37) * Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7 * ci: add frontend test step to CI workflow Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> * chore: simplify array initialization in test files for consistency * ran typecheck * feat: add AnalysisWorkspace component and integrate it into CfgViewerPage * feat: update routing in AppLayout and improve empty state message in ExplorerPage * feat: enhance scan progress tracking with additional metrics and stages * feat: update license information and add license check script * feat: implement cross-file symbolic execution with callee body persistence * feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering * feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions * feat: enhance resource tracking with proxy method summaries and improve finding extraction * feat: add terminal function exit detection for accurate resource leak analysis * feat: add warnings for loops and functions without bodies to improve error recovery * feat: update lambda expression handling to ensure proper function classification and control flow * feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling * feat: add inline return taint analysis and regression tests for improved security checks * feat: add engine version management and migration handling for database schema updates * feat: enhance first_call_ident to skip nested function bodies and add regression tests * feat: enhance callee name resolution with two-segment normalization and disambiguation * feat: add cross-file context flags and debug assertions for taint analysis * feat: refactor taint analysis structure to unify context handling and improve clarity * feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests * docs: updated CHANGELOG.md * fmt: formatting fixes * fix: fixed frontend formatting and lint warnings * fix: optimized ci * fix: optimized ci * Add comprehensive multi-file test coverage to Nyx (#38) * Initial checklist for multi-file test suite expansion Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23 Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> * Add 12 new multi-file test fixtures with TP/TN/near-miss coverage Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23 Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> * deleted root repo * rebuilt to test for regressions --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> Co-authored-by: elipeter <elicpeter@gmail.com> * feat: enhance import alias resolution and taint tracking * feat: implement security hardening with CSRF protection and path validation * feat: add support for import alias bindings in Python, PHP, and Rust * feat: enhance CFG analysis modes and improve code readability * feat: add detection for parameterized SQL queries to enhance security * feat: add safe internal redirect handling and enhance session destroy validation * feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads * feat: enhance taint detection by adding support for inline source member expressions in call arguments * feat: implement pre-emission of Source nodes for inline source member expressions in call arguments * feat: add support for Throw statement in control flow and error handling * feat: add debug and echo endpoints with potential information leakage * feat: implement internal redirect suppression and enhance taint detection * feat: implement module alias tracking for dynamic dispatch in JS/TS * feat: add authorization analysis module with Express support * feat: add authorization analysis module with Express support * feat: add tests for admin guard requirements and clean checks in authorization analysis * feat: integrate Koa and Fastify frameworks into authorization analysis * feat: add Flask and Django support to authorization analysis module * feat: add support for Rails and Sinatra frameworks in authorization analysis * feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis * feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis * feat: add support for Rails and Sinatra in authorization analysis * chore: add .DS_Store to .gitignore * refactor: simplify conditional checks and improve readability in multiple files * refactor: update usage of Option methods for improved clarity and consistency * refactor: improve code readability by simplifying conditional checks and formatting * refactor: improve code formatting and readability by simplifying conditional checks * refactor: simplify conditional checks and improve readability in multiple files * refactor: simplify conditional checks in axum.rs for improved readability * feat: add CodeQL analysis configuration for enhanced security scanning * test: add comprehensive tests for `src/output.rs` SARIF builder (#39) * chore: start test coverage improvement work Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423 Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> * test: add comprehensive tests for src/output.rs SARIF builder Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423 Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> * refactor: improve code formatting and readability in output.rs --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com> Co-authored-by: elipeter <elicpeter@gmail.com> * refactor: improve code formatting and readability in output.rs * Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> * refactor: enhance triage file path handling with improved error management and validation * refactor: updated func summaries for richer detail * refactor: update SSA summary extraction to use canonical FuncKey for distinct entries * refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution * refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls * refactor: implement new Flask routes for safe and unsafe shell command execution * refactor: separate receiver handling in SSA operations and enhance taint propagation * refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments * refactor: implement auth decorator extraction and classification for multiple languages * refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation * refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic * refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior * refactor: standardize default struct initialization across multiple files * feat: add scripts for formatting checks and auto-fixes with test summaries * refactor: simplify character splitting and enhance namespace qualifier handling * refactor: improve documentation clarity and enhance code readability in resolver logic * refactor: replace default struct initialization with explicit field assignments for clarity * feat: enhance anonymous function naming by deriving context-based bindings * refactor: streamline match expressions for improved readability and performance * refactor: streamline match expressions for improved readability and performance * refactor: replace loop with while let for improved clarity and performance * feat: add SSA constant propagation support to analysis context for improved accuracy * feat: add SSA constant propagation support to analysis context for improved accuracy * feat: implement shell metacharacter validation and bounded-length checks in Rust analysis * feat: add static map analysis for command injection suppression and type safety * refactor: simplify match statements and reduce line breaks for improved readability * feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the primary sink source-location through function summaries. Swap SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a backward-compatible cap_sites() helper and serde defaults so pre-phase-1 on-disk rows continue to deserialise cleanly. Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the locator in for the persisted pass-1 path, while pass-2 intra-file transient summaries fall back to cap-only sites (behavior unchanged). Merge: GlobalSummaries::insert now unions sink sites with (file_rel, line, col, cap) dedup via shared union_param_sink_sites helper. Database: JSON-serialised summary columns carry the new shape automatically; no schema change needed. Phase 2 will consume SinkSite in build_taint_diag() to overwrite the caller-site Finding.line with the callee's sink line when resolved via summary. Phase 1 keeps behavior unchanged: scanning tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the same (wrong) line 10 finding. Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink sites, legacy-JSON default handling for both summary types, and merge dedup. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding Plumb Phase 1's SinkSite through the event pipeline into Findings, no output change yet. SsaTaintEvent gains `primary_sink_site: Option<SinkSite>`; when the main or callback sink-emission path has non-empty `param_to_sink_sites`, filter to sites whose `(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per distinct site — the multi-primary collapse keeps each downstream Finding single-primary. Resolution: ResolvedSummary and SinkInfo gain mirror `param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink` (SSA + callback paths) and `FuncSummary.param_to_sink` (global paths). Label, local-summary, and interop resolution paths leave the field empty — they only ever had cap-level info to begin with. Finding: new `primary_location: Option<SinkLocation>` with `file_rel/line/col`. `ssa_events_to_findings` maps `event.primary_sink_site` → `Finding.primary_location`, filtering cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never leaks to formatters. Dedup key extended with the primary location so multi-site events aren't collapsed back together. Invariants (debug_assert!): * every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps != ∅` — enforced by the pick_primary_sink_sites* filters; * every populated Finding.primary_location has `line != 0` AND non-empty `file_rel` — the cap-only → None translation upstream guarantees this. Deliberately independent of `uses_summary`: that flag tracks whether the *taint chain* used a summary, whereas primary attribution requires only that the *sink* itself was summary-resolved. A local source reaching a cross-file sink produces `uses_summary=false` alongside a populated primary_location — documented on Finding.primary_location, covered by `cross_file_sink_finding_carries_primary_location`. build_taint_diag, SARIF/JSON/explanation formatters, and the benchmark scorer remain untouched: finding.line still comes from `cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10 and the benchmark's rs-cmdi-003 row still shows FN in the LOC column. Tests: `cross_file_sink_finding_carries_primary_location` (proves plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and `cross_file_sink_cap_only_site_leaves_primary_location_none` (regression guard against cap-only sites surfacing). All 1566 lib tests + integration tests pass. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(output): phase 3/5 consume primary sink location in diag + SARIF When a finding's primary_location (populated in phase 2 from a callee summary's SinkSite) names the dangerous instruction inside a callee body, attribute the diagnostic line to that location instead of the caller's call site. The call site is demoted to a Call step in flow_steps, and a synthetic Sink step at the primary location is appended so analysts still see the full trace. Changes: - Add scan_root parameter to build_taint_diag so file_rel can be resolved back to an absolute path via a shared resolve_file_rel helper. Empty file_rel (single-file scans where namespace == "") resolves to the file under analysis. - Extend SinkLocation with snippet, carried from the upstream SinkSite so the formatter needs no second file read. - Relax the ssa_events_to_findings debug_assert to allow empty file_rel, which is valid when scan root equals the file itself. - SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[]; locations[0] already reflects the primary sink position via the updated diag line/col. Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs now reports line 5 (Command::new) as the primary sink, with the call site at line 10 visible in flow_steps. Two expect.json fixtures updated (must_match line_range widened): - javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is the real sink inside run()). - rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new inside the closure). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(bench): phase 4/5 validate primary sink attribution across corpus Extend the benchmark scorer and ground truth to lock in phase 3's primary-location behavior, and add fixtures that exercise the new capability end-to-end. Scorer (tests/benchmark_test.rs): - Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on Case. When present, score_location_level additionally requires at least one flow_step in the finding's evidence trace to fall within ±2 of the call-site range. When absent, the check is skipped — fully forward-compatible with existing fixtures. - Retain ±2 tolerance on expected_sink_lines (compared against the now-primary Diag.line post-phase-3). Ground truth edits: - rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the transform::wrap call site (a cross-file propagator, not a sink); line 9 is Command::new, the real sink. The ±2 tolerance happened to mask this stale attribution but it was semantically wrong — phase 4 is the right time to correct it. Also adds expected_call_site_lines [8,8] so the new field is exercised on an existing cross-file case. - rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call). This fixture's sink (Command::new inside run_cmd at line 5) was the motivating case for phases 1-3; adding the call-site assertion guards against regression to caller-line attribution. New fixtures: - rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both takes two tainted params and invokes two Command sinks on consecutive lines. Locks in that primary line lands inside the helper (lines 5-6), not at the caller (line 12). Notes document that SinkSite is currently one-per-callee so both findings today collapse onto the first sink; expected_sink_lines=[5,6] and expected_call_site_lines=[12,12] stay valid either way. - python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross- 004): sink os.system lives in helper.py (cross-file), caller in app.py reads env source and calls run_cmd. Verifies phase 3's cross-file primary attribution: Diag.path = helper.py, Diag.line = 5, with app.py:7 recorded in flow_steps as a Call step. Acceptance: - `cargo test --test benchmark_test -- --ignored --nocapture` passes. - rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are TP/TP/TP. - Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994 F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on 264 pre-phase-4, delta is the +2 new cases both resolving TP). - Full `cargo test` green (1566 lib tests + all integration tests). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(taint): phase 5/5 lock Finding.primary_location contract via regression test Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three emission stages (pick_primary_sink_sites → emit_ssa_taint_events → ssa_events_to_findings) against a minimal caller SSA body. Asserts the resulting Finding.primary_location is exactly that triple. The existing integration tests in src/taint/tests.rs cover the coarse FuncSummary path end-to-end through analyse_file. This test locks in the lower-level SSA-side plumbing so a future refactor that silently drops the site between pick → emit → findings fails here rather than only at the benchmark layer. Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003 remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4). Closes the primary sink-location attribution feature (phases 1-5/5): * Phase 1 — SinkSite data model on summaries. * Phase 2 — SinkSite threaded into SsaTaintEvent and Finding. * Phase 3 — diag + SARIF consume primary_location. * Phase 4 — benchmark validates primary_call_site_lines across corpus. * Phase 5 — regression test locks the event→finding contract. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * refactor: clean up formatting and improve readability in multiple files * refactor: simplify type definition for deduplication key in findings * test(harness): add must_not_match expectation for FP regression guards Extends ExpectedFinding with must_not_match field that asserts a diagnostic must NOT fire — presence is a hard failure. Non-consuming scan so it coexists with must_match entries on the same rule_id. Adds forbidden_violations accumulator and updates summary line. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules * feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking * feat: update switch statement handling to improve control flow analysis * feat: implement promisify alias handling for JS/TS to enhance taint tracking * feat: enhance taint tracking by refining expectation handling and adding mode filtering * feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters * feat: update taint tracking rules to enforce full mode matching and improve flow analysis * feat: enhance Ruby subshell handling to improve taint tracking and flow analysis * feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding * feat: refine framework detection and update expectation handling for Echo and Sinatra * feat: implement max_count for taint tracking expectations and deduplicate findings * feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files * feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity * feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files * feat: add structural invariant checks for SSA bodies * feat: ensure deterministic phi emission order using BTreeSet * feat: enhance handling of terminators to ensure authoritative flow through successor edges * feat: enhance Goto terminator handling to ensure all successors are marked executable * feat: refactor code for improved readability and organization * feat: simplify predicate checks and enhance readability in SSA handling * feat: implement per-file parse timeout and enhance file size handling * feat: migrate analysis engine toggles from environment variables to configuration file * feat: remove unnecessary whitespace in hostile_input_tests.rs * feat: remove unnecessary whitespace in hostile_input_tests.rs * feat: update dependencies and enhance documentation on language maturity * feat: enhance security headers and improve request body limits * feat: implement sink capability bits for deduplication and enhance evidence tagging * feat: implement dynamic activation handling for gated sinks and enhance validation logic * feat: enhance configuration documentation and clarify inline analysis cache behavior * feat: implement panic recovery during analysis to continue scans past errors * feat: add expectations configuration for taint analysis and performance metrics * feat: enhance error handling and logging during file reading and mutex locking * feat: add cross-file body loading tests and plumbing for CF-1 phase * feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures * feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality * feat: enhance classification span handling in CFG and AST for improved source attribution * feat: add new Express routes for handling user input and telemetry data * feat: implement ternary expression handling in CFG with diamond structure for JS/TS * feat: implement Phase CF-3 abstract-domain transfer channels in summaries * feat: add support for string-prefix transfer in cross-file calls and update tests * docs: reduce RESULTS.md doc size * feat: implement Phase CF-4 per-return-path summary decomposition with tests * feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization * feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests * feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests * refactor: update comments and documentation for clarity and consistency * style: format code for consistency and readability * refactor: simplify verdict handling and improve edge checking logic * refactor: optimize path and identifier collection by avoiding unnecessary cloning * chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults * refactor: update documentation and improve clarity in configuration files * refactor: update documentation and improve clarity in configuration files * feat: add JS/TS pass-2 convergence tests and expectations configuration * feat: add Phase 5 regression tests for inline cache origin attribution and update related logic * feat: implement Phase 7 deduplication and alternative path linking for taint findings * feat: implement structural DFS index for anonymous functions and update naming conventions * feat: add Phase 8 regression tests for container-element taint in JS and Python * feat: add engine-depth profiles and explain-engine option for CLI * feat: update expectations and add new README fixtures for multi-file scan regression * feat: implement Phase 11 callback-alias and factory patterns with regression tests * feat: implement Terminator::Switch for multi-way dispatch and add regression tests * feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants * refactor: extract cfg and ssa_transfer to submodules * refactor: cargo fmt * refactor: remove unnecessary blank line in cfg_tests.rs * refactor: remove unnecessary planning file * chore: update Rust version to 1.88 and bump dependencies in Cargo files * feat: enhance triage UI with new layout and controls, update README for clarity * feat: enhance triage UI with new layout and controls, update README for clarity * chore: remove outdated section from README for version 0.5.0 * docs: improve clarity and consistency in README content * chore: add "GPL-3.0-or-later" to license options in about.toml * chore: update license handling in about.toml and check-licenses.mjs * style: format code for improved readability in TriagePage component * style: format code for improved readability in TriagePage component * chore: enhance license handling and improve body_id scoping in seed lookup * feat: introduce owner and parent body IDs for enhanced seed scoping * feat: implement direction-aware engine provenance with new CLI flag for strict CI gating * feat: add Undef SSA operation for improved control-flow handling * style: improve code formatting for consistency and readability in multiple files * feat: add 16-function chain SCC across multiple files for enhanced analysis * style: simplify code formatting for improved readability in multiple files * fix: update CapHitReason default implementation and improve README clarity * docs: enhance README with detailed explanations of taint analysis and limitations * docs: refine README for clarity and consistency in taint analysis section * style: improve code formatting for better readability in NewScanModal and scans * fix: update cargo-about command to use --offline for deterministic license generation * fix: update cargo-about command to use --offline for deterministic license generation * ci: add step to prime cargo registry cache for deterministic license generation * feat: add support for non-sink collections in authorization analysis * feat: enhance authorization checks with row-level ownership equality and binding tracking * feat: implement self-scoped user handling and enhance ownership checks * refactor: simplify assertions and formatting in authorization analysis tests * fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure * docs: update AI disclosure section for clarity and conciseness * feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure * feat: enhance authorization analysis with SSA-derived variable type classification * feat: implement auth_finding_to_diag function for enhanced security diagnostics * feat: add args_value_refs to CallSite struct for enhanced argument tracking * feat: add args_value_refs to CallSite struct for enhanced argument tracking * feat: add direction-aware engine provenance with LossDirection classification and new CLI flag * feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks * feat: enhance error message handling in cli_validation_tests for better Windows compatibility * feat: optimize release profile settings in Cargo.toml and update CodeQL configuration * feat: enhance release build process with SBOM generation and SLSA provenance * feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries * feat: introduce PathFact handling for path safety checks and rejection logic * feat: introduce PathFact handling for path safety checks and rejection logic * feat: update benchmark data and enhance path sanitization logic with new safety checks * feat: document AI assistance in frontend UI development and human review process * feat: add return path facts for enhanced path safety checks and update documentation * chore: update release date for version 0.5.0 in CHANGELOG.md * chore: clean up ci.yml by removing outdated comments and clarifying steps * feat: implement cross-language path sanitizers and validators for enhanced security * feat: enhance SSA value usage tracking by including block terminators and improve path safety checks * feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases * refactor: simplify conditional formatting and improve code readability in executor and lower modules * feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues * feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers * feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers * feat: add transform classifiers for Java, Go, and Ruby with corresponding tests * refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs --------- Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Eli Peter
GitHub
parent
c4ce08b452
commit
41128177d2
2144 changed files with 201812 additions and 8927 deletions
|
|
@ -1,10 +1,20 @@
|
|||
#![allow(clippy::collapsible_if)]
|
||||
|
||||
use super::dominators::{self, dominates};
|
||||
use super::rules;
|
||||
use super::{AnalysisContext, CfgAnalysis, CfgFinding, Confidence, is_entry_point_func};
|
||||
use super::{
|
||||
AnalysisContext, BodyConstFacts, CfgAnalysis, CfgFinding, Confidence, is_entry_point_func,
|
||||
};
|
||||
use crate::callgraph::callee_leaf_name;
|
||||
use crate::cfg::StmtKind;
|
||||
use crate::labels::{Cap, DataLabel, RuntimeLabelRule};
|
||||
use crate::patterns::Severity;
|
||||
use crate::ssa::const_prop::ConstLattice;
|
||||
use crate::ssa::type_facts::TypeFactResult;
|
||||
use crate::ssa::{SsaOp, SsaValue};
|
||||
use crate::taint::path_state::{PredicateKind, classify_condition};
|
||||
use petgraph::graph::NodeIndex;
|
||||
use std::collections::HashSet;
|
||||
|
||||
pub struct UnguardedSink;
|
||||
|
||||
|
|
@ -12,52 +22,566 @@ pub struct UnguardedSink;
|
|||
/// variable flows). Extends the inline callee-part check by tracing one hop
|
||||
/// through the CFG: if a used variable is defined by a node that itself has
|
||||
/// empty `uses` and no Source label, the definition is treated as a constant
|
||||
/// binding (e.g. `let cmd = "git"; Command::new(cmd)`).
|
||||
/// binding (e.g. `let cmd = "git"; Command::new(cmd)`). When SSA
|
||||
/// [`BodyConstFacts`] are available, falls back to walking the sink's
|
||||
/// `SsaOp::Call` operands and consulting `OptimizeResult.const_values` for
|
||||
/// any operand the syntactic trace can't classify (e.g. a chained method-call
|
||||
/// receiver recorded as a compound identifier rather than a named binding).
|
||||
fn is_all_args_constant(ctx: &AnalysisContext, sink: NodeIndex) -> bool {
|
||||
// Fast path: syntactic literal detection from CFG construction.
|
||||
// Strictly weaker than the one-hop trace below — serves as an
|
||||
// optimization for the common case of inline literal arguments.
|
||||
if ctx.cfg[sink].all_args_literal {
|
||||
return true;
|
||||
}
|
||||
let sink_info = &ctx.cfg[sink];
|
||||
let callee_desc = sink_info.callee.as_deref().unwrap_or("");
|
||||
let callee_parts: Vec<&str> = callee_desc.split(['.', ':']).collect();
|
||||
let sink_func = sink_info.enclosing_func.as_deref();
|
||||
let callee_desc = sink_info.call.callee.as_deref().unwrap_or("");
|
||||
// Split callee description into parts and strip parenthesized arg portions.
|
||||
// e.g. `exec.Command("echo", "health-ok").Run` → ["exec", "Command", "Run"]
|
||||
let callee_parts: Vec<&str> = callee_desc
|
||||
.split(['.', ':'])
|
||||
.map(|p| p.split('(').next().unwrap_or(p))
|
||||
.collect();
|
||||
// When the callee was overridden by an inner call (e.g. `db.query` inside
|
||||
// `Promise.all([db.query(...)])`), the outer callee's parts (e.g. "Promise",
|
||||
// "all") also belong to the callee machinery, not to arguments.
|
||||
let outer_parts: Vec<&str> = sink_info
|
||||
.call
|
||||
.outer_callee
|
||||
.as_deref()
|
||||
.map(|oc| {
|
||||
oc.split(['.', ':'])
|
||||
.map(|p| p.split('(').next().unwrap_or(p))
|
||||
.collect()
|
||||
})
|
||||
.unwrap_or_default();
|
||||
let sink_func = sink_info.ast.enclosing_func.as_deref();
|
||||
|
||||
sink_info.uses.iter().all(|u| {
|
||||
// Part of the callee name itself → constant
|
||||
if callee_parts.contains(&u.as_str()) {
|
||||
sink_info.taint.uses.iter().all(|u| {
|
||||
// Part of the callee name itself → not an argument, skip
|
||||
// Check both individual parts and the full dotted callee path
|
||||
if callee_parts.contains(&u.as_str())
|
||||
|| u == callee_desc
|
||||
|| outer_parts.contains(&u.as_str())
|
||||
{
|
||||
return true;
|
||||
}
|
||||
// One-hop trace: find the defining node in the same function
|
||||
for idx in ctx.cfg.node_indices() {
|
||||
let info = &ctx.cfg[idx];
|
||||
if info.enclosing_func.as_deref() != sink_func {
|
||||
if info.ast.enclosing_func.as_deref() != sink_func {
|
||||
continue;
|
||||
}
|
||||
if info.defines.as_deref() == Some(u.as_str()) {
|
||||
if info.taint.defines.as_deref() == Some(u.as_str()) {
|
||||
// If the defining node has no uses (pure constant) and is not
|
||||
// a Source, the variable is constant.
|
||||
if info.uses.is_empty() && !matches!(info.label, Some(DataLabel::Source(_))) {
|
||||
if info.taint.uses.is_empty()
|
||||
&& !info
|
||||
.taint
|
||||
.labels
|
||||
.iter()
|
||||
.any(|l| matches!(l, DataLabel::Source(_)))
|
||||
{
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
false
|
||||
}) || ssa_all_sink_operands_constant(ctx, sink, callee_desc, &callee_parts, &outer_parts)
|
||||
}
|
||||
|
||||
/// SSA-backed fallback for `is_all_args_constant`. Looks up the sink CFG
|
||||
/// node in `cfg_node_map`, expects an `SsaOp::Call`, and checks that every
|
||||
/// operand (positional args and receiver) either names a callee fragment or
|
||||
/// resolves to a concrete `ConstLattice` literal.
|
||||
fn ssa_all_sink_operands_constant(
|
||||
ctx: &AnalysisContext,
|
||||
sink: NodeIndex,
|
||||
callee_desc: &str,
|
||||
callee_parts: &[&str],
|
||||
outer_parts: &[&str],
|
||||
) -> bool {
|
||||
let Some(facts) = ctx.body_const_facts else {
|
||||
return false;
|
||||
};
|
||||
let Some(&sink_val) = facts.ssa.cfg_node_map.get(&sink) else {
|
||||
return false;
|
||||
};
|
||||
let Some(inst) = find_inst(&facts.ssa, sink_val) else {
|
||||
return false;
|
||||
};
|
||||
let SsaOp::Call { args, receiver, .. } = &inst.op else {
|
||||
return false;
|
||||
};
|
||||
|
||||
let operand_const = |v: SsaValue| -> bool {
|
||||
ssa_operand_constant(v, facts, callee_desc, callee_parts, outer_parts)
|
||||
};
|
||||
let args_ok = args
|
||||
.iter()
|
||||
.all(|group| group.iter().all(|v| operand_const(*v)));
|
||||
let receiver_ok = receiver.is_none_or(operand_const);
|
||||
args_ok && receiver_ok
|
||||
}
|
||||
|
||||
/// SSA-backed reassign-aware safety probe: every operand of the sink
|
||||
/// resolves to a constant, callee fragment, OR a function parameter that
|
||||
/// is not itself a Source. Used at the cfg-unguarded-sink site under
|
||||
/// `!has_taint` — the taint engine has already proved no source-tainted
|
||||
/// data reaches the sink, so a non-source Param at operand position is
|
||||
/// inert payload-wise (e.g. HTTP writer in `Fprintf(w, "<h1>", "Guest")`).
|
||||
///
|
||||
/// Gated on the function body actually exhibiting the reassign-to-constant
|
||||
/// signature — at least one named SSA def whose RHS is a literal Const
|
||||
/// (`name = "Guest"`). In a thin wrapper without a same-block named
|
||||
/// const assignment (`fn wrap(p) { sink(p) }`, or C `popen(buf, "r")` where
|
||||
/// `buf` is filled in-place by `sprintf` with no Const Assign on `buf`),
|
||||
/// the bare Param at operand position IS the payload and the suppression's
|
||||
/// rationale does not apply — `cfg-unguarded-sink` must still fire.
|
||||
fn ssa_all_sink_operands_const_or_param(ctx: &AnalysisContext, sink: NodeIndex) -> bool {
|
||||
let Some(facts) = ctx.body_const_facts else {
|
||||
return false;
|
||||
};
|
||||
let Some(&sink_val) = facts.ssa.cfg_node_map.get(&sink) else {
|
||||
return false;
|
||||
};
|
||||
let Some(inst) = find_inst(&facts.ssa, sink_val) else {
|
||||
return false;
|
||||
};
|
||||
let SsaOp::Call { args, receiver, .. } = &inst.op else {
|
||||
return false;
|
||||
};
|
||||
|
||||
if !func_body_has_named_const_assign(facts) {
|
||||
return false;
|
||||
}
|
||||
|
||||
let operand_safe = |v: SsaValue| -> bool { ssa_operand_const_or_param(v, facts, ctx.cfg) };
|
||||
let args_ok = args
|
||||
.iter()
|
||||
.all(|group| group.iter().all(|v| operand_safe(*v)));
|
||||
let receiver_ok = receiver.is_none_or(operand_safe);
|
||||
args_ok && receiver_ok
|
||||
}
|
||||
|
||||
/// Return true if the SSA body contains a *named* variable whose definition
|
||||
/// is a constant — the SSA signature of an explicit `name = "literal"`
|
||||
/// reassignment. Used as the gate for the broader operand-Param suppression:
|
||||
/// the suppression's purpose is the reassign-to-constant idiom, which by
|
||||
/// definition has at least one named const assignment. In a thin wrapper
|
||||
/// (`fn wrap(p) { sink(p) }` or `popen(buf, "r")` where `buf` is filled by
|
||||
/// `sprintf`), no such named const assignment exists and the suppression's
|
||||
/// rationale doesn't apply — so the bare-Param structural finding fires.
|
||||
fn func_body_has_named_const_assign(facts: &BodyConstFacts) -> bool {
|
||||
for block in &facts.ssa.blocks {
|
||||
for inst in &block.body {
|
||||
if inst.var_name.is_none() {
|
||||
continue;
|
||||
}
|
||||
let rhs_const = match &inst.op {
|
||||
SsaOp::Const(_) => true,
|
||||
SsaOp::Assign(vals) => vals.iter().all(|v| {
|
||||
matches!(
|
||||
facts.const_values.get(v),
|
||||
Some(
|
||||
ConstLattice::Str(_)
|
||||
| ConstLattice::Int(_)
|
||||
| ConstLattice::Bool(_)
|
||||
| ConstLattice::Null
|
||||
)
|
||||
)
|
||||
}),
|
||||
_ => false,
|
||||
};
|
||||
if rhs_const {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
false
|
||||
}
|
||||
|
||||
/// Variant of [`ssa_operand_constant`] that also accepts non-Source Params.
|
||||
/// Stricter than `ssa_operand_constant` on Source (always false) but
|
||||
/// looser on bare Params (always true unless they are Source-labeled).
|
||||
fn ssa_operand_const_or_param(
|
||||
root: SsaValue,
|
||||
facts: &BodyConstFacts,
|
||||
cfg: &crate::cfg::Cfg,
|
||||
) -> bool {
|
||||
let mut visited: HashSet<SsaValue> = HashSet::new();
|
||||
let mut stack = vec![root];
|
||||
while let Some(v) = stack.pop() {
|
||||
if !visited.insert(v) {
|
||||
continue;
|
||||
}
|
||||
match facts.const_values.get(&v) {
|
||||
Some(ConstLattice::Str(_))
|
||||
| Some(ConstLattice::Int(_))
|
||||
| Some(ConstLattice::Bool(_))
|
||||
| Some(ConstLattice::Null) => continue,
|
||||
_ => {}
|
||||
}
|
||||
let Some(inst) = find_inst(&facts.ssa, v) else {
|
||||
return false;
|
||||
};
|
||||
// CFG-node-level Source label: when an SSA `Call` corresponds to a
|
||||
// Source-labeled CFG node (e.g. `env::var(...)` whose callee
|
||||
// matches a `LabelRule` Source matcher), the call's result is
|
||||
// tainted user input — refuse, regardless of how the SSA
|
||||
// happened to lower. Catches the `SsaOp::Call` lowering of
|
||||
// labeled Source functions, which the `SsaOp::Source` arm only
|
||||
// sees for callee-less pure sources like PHP `$_GET`.
|
||||
let cfg_node = inst.cfg_node;
|
||||
if cfg
|
||||
.node_weight(cfg_node)
|
||||
.map(|info| {
|
||||
info.taint
|
||||
.labels
|
||||
.iter()
|
||||
.any(|l| matches!(l, DataLabel::Source(_)))
|
||||
})
|
||||
.unwrap_or(false)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
match &inst.op {
|
||||
SsaOp::Const(_) => {}
|
||||
SsaOp::Assign(vals) => stack.extend(vals.iter().copied()),
|
||||
SsaOp::Phi(ops) => stack.extend(ops.iter().map(|(_, v)| *v)),
|
||||
SsaOp::Call { args, receiver, .. } => {
|
||||
for group in args {
|
||||
stack.extend(group.iter().copied());
|
||||
}
|
||||
if let Some(r) = receiver {
|
||||
stack.push(*r);
|
||||
}
|
||||
}
|
||||
SsaOp::Param { .. } | SsaOp::SelfParam | SsaOp::CatchParam => {
|
||||
// Bare parameters are accepted: at the call site the
|
||||
// taint engine has already concluded no source data
|
||||
// reaches this sink (`!has_taint` gate). A Param that
|
||||
// is not source-tainted contributes only its caller-
|
||||
// bound value, which the gate above already filtered.
|
||||
}
|
||||
SsaOp::Source => return false,
|
||||
SsaOp::Nop | SsaOp::Undef => {}
|
||||
}
|
||||
}
|
||||
true
|
||||
}
|
||||
|
||||
/// Return true if this SSA operand is a compile-time-known literal, a callee
|
||||
/// fragment pseudo-use (not a real runtime value), or transitively composed
|
||||
/// of such operands. Returns false for sources, parameters with non-callee
|
||||
/// names, `Varying` const-prop facts, and any unresolved definition.
|
||||
fn ssa_operand_constant(
|
||||
root: SsaValue,
|
||||
facts: &BodyConstFacts,
|
||||
callee_desc: &str,
|
||||
callee_parts: &[&str],
|
||||
outer_parts: &[&str],
|
||||
) -> bool {
|
||||
let mut visited: HashSet<SsaValue> = HashSet::new();
|
||||
let mut stack = vec![root];
|
||||
while let Some(v) = stack.pop() {
|
||||
if !visited.insert(v) {
|
||||
continue;
|
||||
}
|
||||
match facts.const_values.get(&v) {
|
||||
Some(ConstLattice::Str(_))
|
||||
| Some(ConstLattice::Int(_))
|
||||
| Some(ConstLattice::Bool(_))
|
||||
| Some(ConstLattice::Null) => continue,
|
||||
Some(ConstLattice::Varying) => {
|
||||
// Fall through: a Varying lattice entry may still correspond
|
||||
// to a callee-fragment pseudo-name that the SSA models as a
|
||||
// Param. The per-op check below filters those out.
|
||||
}
|
||||
_ => {}
|
||||
}
|
||||
let Some(inst) = find_inst(&facts.ssa, v) else {
|
||||
return false;
|
||||
};
|
||||
match &inst.op {
|
||||
SsaOp::Const(_) => {}
|
||||
SsaOp::Assign(vals) => stack.extend(vals.iter().copied()),
|
||||
SsaOp::Phi(ops) => stack.extend(ops.iter().map(|(_, v)| *v)),
|
||||
SsaOp::Call { args, receiver, .. } => {
|
||||
for group in args {
|
||||
stack.extend(group.iter().copied());
|
||||
}
|
||||
if let Some(r) = receiver {
|
||||
stack.push(*r);
|
||||
}
|
||||
}
|
||||
SsaOp::Param { .. } | SsaOp::SelfParam | SsaOp::CatchParam | SsaOp::Source => {
|
||||
// Only acceptable when the param's `var_name` is a callee
|
||||
// fragment — i.e. an identifier that only appears because
|
||||
// the CFG recorded name components of the dotted/chained
|
||||
// callee as uses. Real parameters and sources are dynamic.
|
||||
let name = inst.var_name.as_deref().unwrap_or("");
|
||||
if matches!(inst.op, SsaOp::Source) {
|
||||
return false;
|
||||
}
|
||||
if !is_callee_fragment(name, callee_desc, callee_parts, outer_parts) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
SsaOp::Nop => {}
|
||||
// Undef is a non-user, non-dynamic sentinel — treat like Const
|
||||
// (no additional operands to trace).
|
||||
SsaOp::Undef => {}
|
||||
}
|
||||
}
|
||||
true
|
||||
}
|
||||
|
||||
fn is_callee_fragment(
|
||||
name: &str,
|
||||
callee_desc: &str,
|
||||
callee_parts: &[&str],
|
||||
outer_parts: &[&str],
|
||||
) -> bool {
|
||||
if name.is_empty() {
|
||||
return true;
|
||||
}
|
||||
if callee_parts.contains(&name) || outer_parts.contains(&name) || name == callee_desc {
|
||||
return true;
|
||||
}
|
||||
// Chained-receiver prefix: the name is a strict prefix of `callee_desc`
|
||||
// terminating at a `.` or `::` boundary (e.g. name =
|
||||
// `Command::new("sh").arg("-c").arg(cmd)` for callee_desc ending in
|
||||
// `.status().unwrap`). These are the outer callee's receiver chain,
|
||||
// not user-supplied arguments.
|
||||
if callee_desc.len() > name.len() && callee_desc.starts_with(name) {
|
||||
let rest = &callee_desc[name.len()..];
|
||||
if rest.starts_with('.') || rest.starts_with("::") {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
false
|
||||
}
|
||||
|
||||
fn find_inst(ssa: &crate::ssa::SsaBody, v: SsaValue) -> Option<&crate::ssa::SsaInst> {
|
||||
let def = ssa.value_defs.get(v.0 as usize)?;
|
||||
let block = ssa.blocks.get(def.block.0 as usize)?;
|
||||
block
|
||||
.phis
|
||||
.iter()
|
||||
.chain(block.body.iter())
|
||||
.find(|inst| inst.value == v)
|
||||
}
|
||||
|
||||
/// Check whether every operand SSA value of the sink's Call instruction is
|
||||
/// proven by type-fact analysis to be non-injectable for `sink_caps`.
|
||||
///
|
||||
/// Used to suppress `cfg-unguarded-sink` when all arguments are typed safe
|
||||
/// (e.g. Rust `port: u16` flowing into `Command::new(…).arg(port.to_string())`).
|
||||
/// Returns `false` when any required fact is missing so the structural finding
|
||||
/// is preserved whenever typing is ambiguous.
|
||||
fn sink_args_typed_safe(ctx: &AnalysisContext, sink: NodeIndex, sink_caps: Cap) -> bool {
|
||||
let Some(facts) = ctx.body_const_facts else {
|
||||
return false;
|
||||
};
|
||||
let Some(type_facts) = ctx.type_facts else {
|
||||
return false;
|
||||
};
|
||||
let Some(&sink_val) = facts.ssa.cfg_node_map.get(&sink) else {
|
||||
return false;
|
||||
};
|
||||
let Some(inst) = find_inst(&facts.ssa, sink_val) else {
|
||||
return false;
|
||||
};
|
||||
let SsaOp::Call { args, receiver, .. } = &inst.op else {
|
||||
return false;
|
||||
};
|
||||
|
||||
// Chained Rust/JS calls record the whole dotted path as a single Call node.
|
||||
// Its SSA operands include pseudo-uses for every identifier segment of the
|
||||
// callee (e.g. `Command`, `new`, `arg`, `status`, `unwrap`) plus string
|
||||
// literal arguments to intermediate calls. Filter those out so the
|
||||
// is-Int check runs only against real argument values.
|
||||
let sink_info = &ctx.cfg[sink];
|
||||
let callee_desc = sink_info.call.callee.as_deref().unwrap_or("");
|
||||
let callee_parts: Vec<&str> = callee_desc
|
||||
.split(['.', ':'])
|
||||
.map(|p| p.split('(').next().unwrap_or(p))
|
||||
.collect();
|
||||
let outer_parts: Vec<&str> = sink_info
|
||||
.call
|
||||
.outer_callee
|
||||
.as_deref()
|
||||
.map(|oc| {
|
||||
oc.split(['.', ':'])
|
||||
.map(|p| p.split('(').next().unwrap_or(p))
|
||||
.collect()
|
||||
})
|
||||
.unwrap_or_default();
|
||||
|
||||
let is_real_arg = |v: SsaValue| -> bool {
|
||||
let Some(def) = find_inst(&facts.ssa, v) else {
|
||||
return true;
|
||||
};
|
||||
// Callee-fragment pseudo-uses appear as `Param { .. }` with a
|
||||
// var_name that is a segment of the callee text. SelfParam and
|
||||
// CatchParam cover `self`/exception bindings that cannot be the
|
||||
// implicit callee chain.
|
||||
match &def.op {
|
||||
SsaOp::Param { .. } => {
|
||||
let name = def.var_name.as_deref().unwrap_or("");
|
||||
!is_callee_fragment(name, callee_desc, &callee_parts, &outer_parts)
|
||||
}
|
||||
// Constant string literals used as inline args (e.g. `"listener"`,
|
||||
// `"-c"`) are not user-controlled — treat as non-real for the
|
||||
// "all int-typed" test so they don't block suppression.
|
||||
SsaOp::Const(_) => false,
|
||||
_ => true,
|
||||
}
|
||||
};
|
||||
|
||||
let mut values: Vec<SsaValue> = Vec::new();
|
||||
if let Some(r) = receiver {
|
||||
if is_real_arg(*r) {
|
||||
values.push(*r);
|
||||
}
|
||||
}
|
||||
for group in args {
|
||||
for v in group.iter() {
|
||||
if is_real_arg(*v) {
|
||||
values.push(*v);
|
||||
}
|
||||
}
|
||||
}
|
||||
type_facts_suppress(&values, sink_caps, type_facts)
|
||||
}
|
||||
|
||||
/// Thin wrapper around [`crate::ssa::type_facts::is_type_safe_for_sink`] kept
|
||||
/// local so the unit tests here can exercise the exact predicate used at the
|
||||
/// `cfg-unguarded-sink` emission site.
|
||||
fn type_facts_suppress(values: &[SsaValue], sink_caps: Cap, type_facts: &TypeFactResult) -> bool {
|
||||
crate::ssa::type_facts::is_type_safe_for_sink(values, sink_caps, type_facts)
|
||||
}
|
||||
|
||||
/// Suppress a `cfg-unguarded-sink` finding when every real argument SSA
|
||||
/// value resolves to a finite set of metacharacter-free literals, as proved
|
||||
/// by the static-map analysis. Runs in lock-step with the SSA taint
|
||||
/// suppression so both findings paths agree on when a provably-bounded
|
||||
/// lookup idiom (e.g. `map.get(x).unwrap_or("safe")` over literal inserts)
|
||||
/// should clear a command-injection sink.
|
||||
///
|
||||
/// Only fires for `Cap::SHELL_ESCAPE` — SQL / path suppression from this
|
||||
/// domain would require stronger reasoning (literal keys can still carry
|
||||
/// SQL tokens if the inserts themselves contain them).
|
||||
fn sink_args_static_map_safe(ctx: &AnalysisContext, sink: NodeIndex, sink_caps: Cap) -> bool {
|
||||
if !sink_caps.intersects(Cap::SHELL_ESCAPE) {
|
||||
return false;
|
||||
}
|
||||
let Some(facts) = ctx.body_const_facts else {
|
||||
return false;
|
||||
};
|
||||
let Some(&sink_val) = facts.ssa.cfg_node_map.get(&sink) else {
|
||||
return false;
|
||||
};
|
||||
let Some(inst) = find_inst(&facts.ssa, sink_val) else {
|
||||
return false;
|
||||
};
|
||||
let SsaOp::Call { args, receiver, .. } = &inst.op else {
|
||||
return false;
|
||||
};
|
||||
|
||||
let sm =
|
||||
crate::ssa::static_map::analyze(&facts.ssa, ctx.cfg, Some(ctx.lang), &facts.const_values);
|
||||
if sm.is_empty() {
|
||||
return false;
|
||||
}
|
||||
|
||||
// Skip callee-fragment pseudo-uses the same way `sink_args_typed_safe`
|
||||
// does so only real runtime arg values participate in the check.
|
||||
let sink_info = &ctx.cfg[sink];
|
||||
let callee_desc = sink_info.call.callee.as_deref().unwrap_or("");
|
||||
let callee_parts: Vec<&str> = callee_desc
|
||||
.split(['.', ':'])
|
||||
.map(|p| p.split('(').next().unwrap_or(p))
|
||||
.collect();
|
||||
let outer_parts: Vec<&str> = sink_info
|
||||
.call
|
||||
.outer_callee
|
||||
.as_deref()
|
||||
.map(|oc| {
|
||||
oc.split(['.', ':'])
|
||||
.map(|p| p.split('(').next().unwrap_or(p))
|
||||
.collect()
|
||||
})
|
||||
.unwrap_or_default();
|
||||
|
||||
let is_real_arg = |v: SsaValue| -> bool {
|
||||
let Some(def) = find_inst(&facts.ssa, v) else {
|
||||
return true;
|
||||
};
|
||||
match &def.op {
|
||||
SsaOp::Param { .. } => {
|
||||
let name = def.var_name.as_deref().unwrap_or("");
|
||||
!is_callee_fragment(name, callee_desc, &callee_parts, &outer_parts)
|
||||
}
|
||||
SsaOp::Const(_) => false,
|
||||
_ => true,
|
||||
}
|
||||
};
|
||||
|
||||
let mut values: Vec<SsaValue> = Vec::new();
|
||||
if let Some(r) = receiver {
|
||||
if is_real_arg(*r) {
|
||||
values.push(*r);
|
||||
}
|
||||
}
|
||||
for group in args {
|
||||
for v in group.iter() {
|
||||
if is_real_arg(*v) {
|
||||
values.push(*v);
|
||||
}
|
||||
}
|
||||
}
|
||||
if values.is_empty() {
|
||||
return false;
|
||||
}
|
||||
values.iter().all(|v| match sm.finite_string_values.get(v) {
|
||||
Some(set) if !set.is_empty() => set
|
||||
.iter()
|
||||
.all(|s| crate::abstract_interp::string_domain::is_shell_safe_literal(s)),
|
||||
_ => false,
|
||||
})
|
||||
}
|
||||
|
||||
/// Check if a callee matches any of the runtime label rules that are sanitizers.
|
||||
fn match_config_sanitizer(callee: &str, extra: &[RuntimeLabelRule]) -> Option<Cap> {
|
||||
let callee_lower = callee.to_ascii_lowercase();
|
||||
// Lazily compute lowercased callee only when a case-insensitive rule is hit.
|
||||
let mut callee_lower: Option<String> = None;
|
||||
|
||||
for rule in extra {
|
||||
let cap = match rule.label {
|
||||
DataLabel::Sanitizer(c) => c,
|
||||
_ => continue,
|
||||
};
|
||||
for m in &rule.matchers {
|
||||
let ml = m.to_ascii_lowercase();
|
||||
if ml.ends_with('_') {
|
||||
if callee_lower.starts_with(&ml) {
|
||||
if rule.case_sensitive {
|
||||
if m.ends_with('_') {
|
||||
if callee.starts_with(m.as_str()) {
|
||||
return Some(cap);
|
||||
}
|
||||
} else if callee.ends_with(m.as_str()) {
|
||||
return Some(cap);
|
||||
}
|
||||
} else {
|
||||
let cl = callee_lower.get_or_insert_with(|| callee.to_ascii_lowercase());
|
||||
let ml = m.to_ascii_lowercase();
|
||||
if ml.ends_with('_') {
|
||||
if cl.starts_with(&ml) {
|
||||
return Some(cap);
|
||||
}
|
||||
} else if cl.ends_with(&ml) {
|
||||
return Some(cap);
|
||||
}
|
||||
} else if callee_lower.ends_with(&ml) {
|
||||
return Some(cap);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -75,10 +599,55 @@ fn find_guard_nodes(ctx: &AnalysisContext) -> Vec<(NodeIndex, Cap)> {
|
|||
|
||||
for idx in ctx.cfg.node_indices() {
|
||||
let info = &ctx.cfg[idx];
|
||||
|
||||
// If-condition guards: allowlist checks, type checks, validation
|
||||
// calls, shell-metachar rejections, and bounded-length checks in
|
||||
// branch conditions act as guards for downstream sinks.
|
||||
if info.kind == StmtKind::If {
|
||||
if let Some(cond_text) = &info.condition_text {
|
||||
let kind = classify_condition(cond_text);
|
||||
if matches!(
|
||||
kind,
|
||||
PredicateKind::AllowlistCheck
|
||||
| PredicateKind::TypeCheck
|
||||
| PredicateKind::ValidationCall
|
||||
) {
|
||||
result.push((idx, Cap::all()));
|
||||
} else if matches!(
|
||||
kind,
|
||||
PredicateKind::ShellMetaValidated | PredicateKind::BoundedLength
|
||||
) {
|
||||
// Shell-metachar rejection and bounded-length checks only
|
||||
// guard shell-family sinks. Keep scope tight so unrelated
|
||||
// sinks (SQL, XSS) aren't silenced when a shell gate
|
||||
// happens to sit upstream.
|
||||
result.push((idx, Cap::SHELL_ESCAPE | Cap::CODE_EXEC));
|
||||
} else {
|
||||
// Path-traversal rejection guard. When the condition
|
||||
// matches a path-rejection idiom recognised by
|
||||
// `classify_path_rejection_axes` (`strstr(p, "..")`
|
||||
// / `.contains("..")` / `strings.Contains(p, "..")`
|
||||
// / `p[0] == '/'` / `path.is_absolute()` / etc.),
|
||||
// it acts as a guard for FILE_IO sinks. Catches
|
||||
// the C/C++ `if (strstr(p, "..") != NULL)` shape
|
||||
// whose `!= NULL` wrapper otherwise falls through
|
||||
// to NullCheck classification and never registers
|
||||
// as a guard. Scope kept to FILE_IO so unrelated
|
||||
// sinks aren't silenced.
|
||||
let axes = crate::abstract_interp::path_domain::classify_path_rejection_axes(
|
||||
cond_text,
|
||||
);
|
||||
if !axes.is_empty() {
|
||||
result.push((idx, Cap::FILE_IO));
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if info.kind != StmtKind::Call {
|
||||
continue;
|
||||
}
|
||||
if let Some(callee) = &info.callee {
|
||||
if let Some(callee) = &info.call.callee {
|
||||
// Check config sanitizer rules first
|
||||
if let Some(cap) = match_config_sanitizer(callee, config_rules) {
|
||||
result.push((idx, cap));
|
||||
|
|
@ -116,10 +685,10 @@ fn taint_confirms_sink(ctx: &AnalysisContext, sink: NodeIndex) -> bool {
|
|||
/// Source node in the same function (via simple def-use chain).
|
||||
fn sink_arg_is_source_derived(ctx: &AnalysisContext, sink: NodeIndex) -> bool {
|
||||
let sink_info = &ctx.cfg[sink];
|
||||
let sink_func = sink_info.enclosing_func.as_deref();
|
||||
let sink_func = sink_info.ast.enclosing_func.as_deref();
|
||||
|
||||
// Collect all variables the sink reads
|
||||
let sink_uses = &sink_info.uses;
|
||||
let sink_uses = &sink_info.taint.uses;
|
||||
if sink_uses.is_empty() {
|
||||
return false;
|
||||
}
|
||||
|
|
@ -128,14 +697,19 @@ fn sink_arg_is_source_derived(ctx: &AnalysisContext, sink: NodeIndex) -> bool {
|
|||
// one of the variables the sink uses.
|
||||
for idx in ctx.cfg.node_indices() {
|
||||
let info = &ctx.cfg[idx];
|
||||
if info.enclosing_func.as_deref() != sink_func {
|
||||
if info.ast.enclosing_func.as_deref() != sink_func {
|
||||
continue;
|
||||
}
|
||||
if !matches!(info.label, Some(DataLabel::Source(_))) {
|
||||
if !info
|
||||
.taint
|
||||
.labels
|
||||
.iter()
|
||||
.any(|l| matches!(l, DataLabel::Source(_)))
|
||||
{
|
||||
continue;
|
||||
}
|
||||
// Source node defines a variable that the sink reads → source-derived
|
||||
if let Some(def) = &info.defines
|
||||
if let Some(def) = &info.taint.defines
|
||||
&& sink_uses.iter().any(|u| u == def)
|
||||
{
|
||||
return true;
|
||||
|
|
@ -148,9 +722,9 @@ fn sink_arg_is_source_derived(ctx: &AnalysisContext, sink: NodeIndex) -> bool {
|
|||
/// (i.e. this function is a thin wrapper around the sink).
|
||||
fn sink_arg_is_parameter_only(ctx: &AnalysisContext, sink: NodeIndex) -> bool {
|
||||
let sink_info = &ctx.cfg[sink];
|
||||
let sink_func = sink_info.enclosing_func.as_deref();
|
||||
let sink_func = sink_info.ast.enclosing_func.as_deref();
|
||||
|
||||
let sink_uses = &sink_info.uses;
|
||||
let sink_uses = &sink_info.taint.uses;
|
||||
if sink_uses.is_empty() {
|
||||
// No identifiable arguments — could be a constant call like Command::new("ls")
|
||||
return true; // treat as non-dangerous (constant arg)
|
||||
|
|
@ -162,7 +736,7 @@ fn sink_arg_is_parameter_only(ctx: &AnalysisContext, sink: NodeIndex) -> bool {
|
|||
.values()
|
||||
.filter(|s| {
|
||||
// Match by function entry being in the same function
|
||||
ctx.cfg[s.entry].enclosing_func.as_deref() == sink_func
|
||||
ctx.cfg[s.entry].ast.enclosing_func.as_deref() == sink_func
|
||||
})
|
||||
.flat_map(|s| s.param_names.iter().map(|p| p.as_str()))
|
||||
.collect();
|
||||
|
|
@ -175,10 +749,60 @@ fn sink_arg_is_parameter_only(ctx: &AnalysisContext, sink: NodeIndex) -> bool {
|
|||
sink_uses.iter().all(|u| param_names.contains(&u.as_str()))
|
||||
}
|
||||
|
||||
/// Check if the source bytes at a given span contain a redirect call whose
|
||||
/// argument starts with a path prefix (`/...`), indicating a server-relative
|
||||
/// path rather than an attacker-controlled URL.
|
||||
///
|
||||
/// Reused by both `cfg-unguarded-sink` suppression and taint finding filtering.
|
||||
pub(crate) fn has_redirect_path_prefix(source_bytes: &[u8], span: (usize, usize)) -> bool {
|
||||
let (start, end) = span;
|
||||
if start >= source_bytes.len() || end > source_bytes.len() {
|
||||
return false;
|
||||
}
|
||||
let text = &source_bytes[start..end];
|
||||
// Search for the argument portion after the first '('
|
||||
if let Some(paren_pos) = text.iter().position(|&b| b == b'(') {
|
||||
let after_paren = &text[paren_pos + 1..];
|
||||
let trimmed = after_paren
|
||||
.iter()
|
||||
.skip_while(|&&b| b == b' ' || b == b'\n' || b == b'\t')
|
||||
.copied()
|
||||
.collect::<Vec<_>>();
|
||||
// Template literal: `/ ...
|
||||
if trimmed.starts_with(b"`/") {
|
||||
return true;
|
||||
}
|
||||
// String literal: "/ ... or '/ ...
|
||||
if trimmed.starts_with(b"\"/") || trimmed.starts_with(b"'/") {
|
||||
return true;
|
||||
}
|
||||
}
|
||||
false
|
||||
}
|
||||
|
||||
/// Check if this sink is an internal redirect — a `res.redirect` (SSRF sink)
|
||||
/// whose argument is a template literal or string starting with `/`, indicating
|
||||
/// a server-relative path rather than an attacker-controlled URL.
|
||||
fn is_internal_redirect(ctx: &AnalysisContext, sink: NodeIndex, sink_caps: Cap) -> bool {
|
||||
if !sink_caps.contains(Cap::SSRF) {
|
||||
return false;
|
||||
}
|
||||
let sink_info = &ctx.cfg[sink];
|
||||
let callee = match &sink_info.call.callee {
|
||||
Some(c) => c.as_str(),
|
||||
None => return false,
|
||||
};
|
||||
// Only applies to redirect calls
|
||||
if !callee.ends_with("redirect") && !callee.ends_with("Redirect") {
|
||||
return false;
|
||||
}
|
||||
has_redirect_path_prefix(ctx.source_bytes, sink_info.ast.span)
|
||||
}
|
||||
|
||||
/// Check if the enclosing function qualifies as an entrypoint.
|
||||
fn sink_in_entrypoint(ctx: &AnalysisContext, sink: NodeIndex) -> bool {
|
||||
let sink_info = &ctx.cfg[sink];
|
||||
if let Some(func_name) = &sink_info.enclosing_func {
|
||||
if let Some(func_name) = &sink_info.ast.enclosing_func {
|
||||
is_entry_point_func(func_name, ctx.lang)
|
||||
} else {
|
||||
false
|
||||
|
|
@ -199,17 +823,23 @@ impl CfgAnalysis for UnguardedSink {
|
|||
|
||||
for sink in &sink_nodes {
|
||||
let sink_info = &ctx.cfg[*sink];
|
||||
let sink_caps = match sink_info.label {
|
||||
Some(DataLabel::Sink(caps)) => caps,
|
||||
_ => continue,
|
||||
};
|
||||
let sink_caps = sink_info.taint.labels.iter().fold(Cap::empty(), |acc, l| {
|
||||
if let DataLabel::Sink(caps) = l {
|
||||
acc | *caps
|
||||
} else {
|
||||
acc
|
||||
}
|
||||
});
|
||||
if sink_caps.is_empty() {
|
||||
continue;
|
||||
}
|
||||
|
||||
let sink_func = sink_info.enclosing_func.as_deref();
|
||||
let sink_func = sink_info.ast.enclosing_func.as_deref();
|
||||
|
||||
// Check: does any applicable guard dominate this sink?
|
||||
// Guards must be in the same function to be relevant.
|
||||
let is_guarded = guard_nodes.iter().any(|(guard_idx, guard_caps)| {
|
||||
let guard_func = ctx.cfg[*guard_idx].enclosing_func.as_deref();
|
||||
let guard_func = ctx.cfg[*guard_idx].ast.enclosing_func.as_deref();
|
||||
(*guard_caps & sink_caps) != Cap::empty()
|
||||
&& guard_func == sink_func
|
||||
&& dominates(&doms, *guard_idx, *sink)
|
||||
|
|
@ -217,21 +847,37 @@ impl CfgAnalysis for UnguardedSink {
|
|||
|
||||
// Also check if an inline sanitizer dominates this sink (same function).
|
||||
let has_sanitizer = ctx.cfg.node_indices().any(|idx| {
|
||||
let node_func = ctx.cfg[idx].enclosing_func.as_deref();
|
||||
if let Some(DataLabel::Sanitizer(san_caps)) = ctx.cfg[idx].label {
|
||||
(san_caps & sink_caps) != Cap::empty()
|
||||
&& node_func == sink_func
|
||||
&& dominates(&doms, idx, *sink)
|
||||
let node_func = ctx.cfg[idx].ast.enclosing_func.as_deref();
|
||||
ctx.cfg[idx].taint.labels.iter().any(|l| {
|
||||
if let DataLabel::Sanitizer(san_caps) = l {
|
||||
(*san_caps & sink_caps) != Cap::empty()
|
||||
&& node_func == sink_func
|
||||
&& dominates(&doms, idx, *sink)
|
||||
} else {
|
||||
false
|
||||
}
|
||||
})
|
||||
});
|
||||
|
||||
// Interprocedural sanitizer: check if any arg_callee resolves to a
|
||||
// function with sanitizer caps that cover this sink's caps.
|
||||
let has_interprocedural_sanitizer = sink_info.arg_callees.iter().any(|mc| {
|
||||
if let Some(callee) = mc {
|
||||
let leaf = callee_leaf_name(callee);
|
||||
// Check local function summaries
|
||||
ctx.func_summaries.iter().any(|(k, s)| {
|
||||
k.name == leaf && (s.sanitizer_caps & sink_caps) != Cap::empty()
|
||||
})
|
||||
} else {
|
||||
false
|
||||
}
|
||||
});
|
||||
|
||||
if is_guarded || has_sanitizer {
|
||||
if is_guarded || has_sanitizer || has_interprocedural_sanitizer {
|
||||
continue;
|
||||
}
|
||||
|
||||
let callee_desc = sink_info.callee.as_deref().unwrap_or("(unknown sink)");
|
||||
let callee_desc = sink_info.call.callee.as_deref().unwrap_or("(unknown sink)");
|
||||
|
||||
// ── Severity classification ───────────────────────────────
|
||||
//
|
||||
|
|
@ -244,7 +890,53 @@ impl CfgAnalysis for UnguardedSink {
|
|||
|
||||
// If sink args are all constants (including one-hop constant bindings)
|
||||
// and taint didn't confirm, this is a false positive — skip it.
|
||||
if is_all_args_constant(ctx, *sink) && !has_taint && !source_derived {
|
||||
if is_all_args_constant(ctx, *sink) && !has_taint {
|
||||
continue;
|
||||
}
|
||||
|
||||
// SSA latest-def suppression: when the taint engine has already
|
||||
// proved no source-tainted data reaches this sink (`!has_taint`)
|
||||
// and every SSA operand resolves to a constant, callee-fragment
|
||||
// pseudo-name, OR a function parameter that is not a Source —
|
||||
// the sink's actual arguments cannot carry an injection payload.
|
||||
// Catches the reassign-to-constant idiom (`name := req.x; name =
|
||||
// "Guest"; sink(name)`) where the latest SSA def is a literal
|
||||
// and a non-payload parameter (e.g. an HTTP writer / receiver)
|
||||
// is the only other operand. The simpler `is_all_args_constant`
|
||||
// check above rejects that mixed shape because it forbids real
|
||||
// parameters in operand position.
|
||||
if !has_taint && ssa_all_sink_operands_const_or_param(ctx, *sink) {
|
||||
continue;
|
||||
}
|
||||
|
||||
// Type-aware suppression: when all SSA operand values of the sink
|
||||
// are proven to carry non-injectable types (e.g. integers parsed
|
||||
// from a raw source), the arguments cannot form a payload for
|
||||
// SHELL/SQL/FILE sinks. Skip the structural finding — the taint
|
||||
// engine already covers the source→sink flow via type-aware
|
||||
// suppression. Unknown-typed or mixed operands fall through.
|
||||
if !has_taint && sink_args_typed_safe(ctx, *sink, sink_caps) {
|
||||
continue;
|
||||
}
|
||||
|
||||
// Static-map suppression: the SSA value flowing into the sink is
|
||||
// proved by the static-HashMap-lookup idiom detector to be a
|
||||
// finite set of literals free of shell metacharacters. Mirrors
|
||||
// the SSA-taint finite-domain suppression so both paths agree.
|
||||
if !has_taint && sink_args_static_map_safe(ctx, *sink, sink_caps) {
|
||||
continue;
|
||||
}
|
||||
|
||||
// Parameterized SQL queries: arg 0 is a string literal with
|
||||
// placeholders ($1, ?, %s, :name) and a params argument exists.
|
||||
// These are safe by construction — the driver handles escaping.
|
||||
if sink_info.parameterized_query {
|
||||
continue;
|
||||
}
|
||||
|
||||
// Internal redirects: res.redirect(`/path/...`) with a path-prefix
|
||||
// argument are server-relative — not attacker-controlled URLs.
|
||||
if is_internal_redirect(ctx, *sink, sink_caps) {
|
||||
continue;
|
||||
}
|
||||
|
||||
|
|
@ -252,19 +944,45 @@ impl CfgAnalysis for UnguardedSink {
|
|||
let in_entrypoint = sink_in_entrypoint(ctx, *sink);
|
||||
|
||||
let (severity, confidence) = if has_taint || source_derived {
|
||||
// Taint-confirmed or directly source-derived → HIGH
|
||||
(Severity::High, Confidence::High)
|
||||
} else if param_only && !in_entrypoint {
|
||||
// Wrapper function consuming only parameters → LOW
|
||||
// Wrapper function with param-only args — zero signal. Suppress.
|
||||
continue;
|
||||
} else if !ctx.taint_active {
|
||||
// AST-only / cfg-only mode — preserve as LOW (unchanged)
|
||||
(Severity::Low, Confidence::Low)
|
||||
} else if !ctx.taint_active && !source_derived {
|
||||
// CFG-only mode without taint confirmation → LOW
|
||||
(Severity::Low, Confidence::Low)
|
||||
} else if in_entrypoint && !param_only {
|
||||
// Entrypoint with non-parameter args but no taint confirmation → MEDIUM
|
||||
(Severity::Medium, Confidence::Medium)
|
||||
} else {
|
||||
// Generic structural finding → MEDIUM
|
||||
// taint_active=true but found nothing.
|
||||
// Keep high-risk sinks (SHELL_ESCAPE, CODE_EXEC, SQL_QUERY, DESERIALIZE)
|
||||
// as structural backup. Suppress low-risk sinks (FILE_IO, SSRF, etc.).
|
||||
let high_risk =
|
||||
Cap::SHELL_ESCAPE | Cap::CODE_EXEC | Cap::SQL_QUERY | Cap::DESERIALIZE;
|
||||
if (sink_caps & high_risk).is_empty() {
|
||||
continue; // FILE_IO, SSRF, FMT_STRING etc. without taint → noise
|
||||
}
|
||||
// If the function containing the sink has no Source-labeled
|
||||
// nodes AND no parameters (through which taint could flow
|
||||
// from callers), taint ran and found nothing because there
|
||||
// is nothing to find. Suppress — the structural finding
|
||||
// is noise.
|
||||
let sink_func = sink_info.ast.enclosing_func.as_deref();
|
||||
let has_sources = ctx.cfg.node_indices().any(|n| {
|
||||
let info = &ctx.cfg[n];
|
||||
info.ast.enclosing_func.as_deref() == sink_func
|
||||
&& info
|
||||
.taint
|
||||
.labels
|
||||
.iter()
|
||||
.any(|l| matches!(l, DataLabel::Source(_)))
|
||||
});
|
||||
let has_params = ctx.func_summaries.values().any(|s| {
|
||||
s.entry.index() < ctx.cfg.node_count()
|
||||
&& ctx.cfg[s.entry].ast.enclosing_func.as_deref() == sink_func
|
||||
&& !s.param_names.is_empty()
|
||||
});
|
||||
if !has_sources && !has_params {
|
||||
continue; // No sources or params in scope → noise
|
||||
}
|
||||
(Severity::Medium, Confidence::Medium)
|
||||
};
|
||||
|
||||
|
|
@ -273,7 +991,7 @@ impl CfgAnalysis for UnguardedSink {
|
|||
title: "Unguarded sink".to_string(),
|
||||
severity,
|
||||
confidence,
|
||||
span: sink_info.span,
|
||||
span: sink_info.ast.span,
|
||||
message: format!("Sink `{callee_desc}` has no dominating guard or sanitizer"),
|
||||
evidence: vec![*sink],
|
||||
score: None,
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue