apunkt/nyx
1
0
Fork 0
mirror of https://github.com/elicpeter/nyx.git synced 2026-06-18 20:15:14 +02:00
Code Issues Projects Releases Packages Wiki Activity

Release/0.5.0 (#35)

Browse source 
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures

* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests

* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements

* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles

* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing

* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling

* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures

* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration

* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests

* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic

* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection

* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements

* feat: Enable auth-state analysis by default and update relevant tests in benchmark config

* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test

* docs: update CHANGELOG.md

* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers

* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers

* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse

* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation

* feat: Refactor function parameters and constants for improved clarity and maintainability

* refactor: Reorder module imports and improve formatting for consistency

* refactor: Fix formatting erorrs

* refactor: Fix clippy warnings

* refactor: Fix fmt warnings (again)

* chore: Update dependencies and improve feature configuration

* Add comprehensive tests for undertested modules (#36) (COPILOT)

* Add comprehensive tests for undertested modules

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083

* Add comprehensive tests for ext, project, walk, and errors modules

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* chore: Update dependencies and improve feature configuration

* fix: formatting errors in new tests

* chore: Update license list in about.toml

* chore: made functions input inline

* chore: updated cfg graph to take up the full page

* chore: add Prettier configuration and update code formatting

* Add frontend test suite with Vitest (111 tests) (#37)

* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7

* ci: add frontend test step to CI workflow

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* chore: simplify array initialization in test files for consistency

* ran typecheck

* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage

* feat: update routing in AppLayout and improve empty state message in ExplorerPage

* feat: enhance scan progress tracking with additional metrics and stages

* feat: update license information and add license check script

* feat: implement cross-file symbolic execution with callee body persistence

* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering

* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions

* feat: enhance resource tracking with proxy method summaries and improve finding extraction

* feat: add terminal function exit detection for accurate resource leak analysis

* feat: add warnings for loops and functions without bodies to improve error recovery

* feat: update lambda expression handling to ensure proper function classification and control flow

* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling

* feat: add inline return taint analysis and regression tests for improved security checks

* feat: add engine version management and migration handling for database schema updates

* feat: enhance first_call_ident to skip nested function bodies and add regression tests

* feat: enhance callee name resolution with two-segment normalization and disambiguation

* feat: add cross-file context flags and debug assertions for taint analysis

* feat: refactor taint analysis structure to unify context handling and improve clarity

* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests

* docs: updated CHANGELOG.md

* fmt: formatting fixes

* fix: fixed frontend formatting and lint warnings

* fix: optimized ci

* fix: optimized ci

* Add comprehensive multi-file test coverage to Nyx (#38)

* Initial checklist for multi-file test suite expansion

Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage

Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* deleted root repo

* rebuilt to test for regressions

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>

* feat: enhance import alias resolution and taint tracking

* feat: implement security hardening with CSRF protection and path validation

* feat: add support for import alias bindings in Python, PHP, and Rust

* feat: enhance CFG analysis modes and improve code readability

* feat: add detection for parameterized SQL queries to enhance security

* feat: add safe internal redirect handling and enhance session destroy validation

* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads

* feat: enhance taint detection by adding support for inline source member expressions in call arguments

* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments

* feat: add support for Throw statement in control flow and error handling

* feat: add debug and echo endpoints with potential information leakage

* feat: implement internal redirect suppression and enhance taint detection

* feat: implement module alias tracking for dynamic dispatch in JS/TS

* feat: add authorization analysis module with Express support

* feat: add authorization analysis module with Express support

* feat: add tests for admin guard requirements and clean checks in authorization analysis

* feat: integrate Koa and Fastify frameworks into authorization analysis

* feat: add Flask and Django support to authorization analysis module

* feat: add support for Rails and Sinatra frameworks in authorization analysis

* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis

* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis

* feat: add support for Rails and Sinatra in authorization analysis

* chore: add .DS_Store to .gitignore

* refactor: simplify conditional checks and improve readability in multiple files

* refactor: update usage of Option methods for improved clarity and consistency

* refactor: improve code readability by simplifying conditional checks and formatting

* refactor: improve code formatting and readability by simplifying conditional checks

* refactor: simplify conditional checks and improve readability in multiple files

* refactor: simplify conditional checks in axum.rs for improved readability

* feat: add CodeQL analysis configuration for enhanced security scanning

* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)

* chore: start test coverage improvement work

Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* test: add comprehensive tests for src/output.rs SARIF builder

Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* refactor: improve code formatting and readability in output.rs

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>

* refactor: improve code formatting and readability in output.rs

* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* refactor: enhance triage file path handling with improved error management and validation

* refactor: updated func summaries for richer detail

* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries

* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution

* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls

* refactor: implement new Flask routes for safe and unsafe shell command execution

* refactor: separate receiver handling in SSA operations and enhance taint propagation

* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments

* refactor: implement auth decorator extraction and classification for multiple languages

* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation

* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic

* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior

* refactor: standardize default struct initialization across multiple files

* feat: add scripts for formatting checks and auto-fixes with test summaries

* refactor: simplify character splitting and enhance namespace qualifier handling

* refactor: improve documentation clarity and enhance code readability in resolver logic

* refactor: replace default struct initialization with explicit field assignments for clarity

* feat: enhance anonymous function naming by deriving context-based bindings

* refactor: streamline match expressions for improved readability and performance

* refactor: streamline match expressions for improved readability and performance

* refactor: replace loop with while let for improved clarity and performance

* feat: add SSA constant propagation support to analysis context for improved accuracy

* feat: add SSA constant propagation support to analysis context for improved accuracy

* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis

* feat: add static map analysis for command injection suppression and type safety

* refactor: simplify match statements and reduce line breaks for improved readability

* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution

Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.

Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.

Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.

Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.

Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding

Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet.  SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.

Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.

Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`.  `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters.  Dedup key extended with the primary location
so multi-site events aren't collapsed back together.

Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
  != ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
  non-empty `file_rel` — the cap-only → None translation upstream
  guarantees this.

Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved.  A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.

build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.

Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing).  All 1566 lib
tests + integration tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(output): phase 3/5 consume primary sink location in diag + SARIF

When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.

Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
  resolved back to an absolute path via a shared resolve_file_rel
  helper. Empty file_rel (single-file scans where namespace == "")
  resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
  SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
  file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
  locations[0] already reflects the primary sink position via the
  updated diag line/col.

Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.

Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
  the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
  inside the closure).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(bench): phase 4/5 validate primary sink attribution across corpus

Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.

Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
  Case. When present, score_location_level additionally requires at
  least one flow_step in the finding's evidence trace to fall within
  ±2 of the call-site range. When absent, the check is skipped —
  fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
  now-primary Diag.line post-phase-3).

Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
  transform::wrap call site (a cross-file propagator, not a sink);
  line 9 is Command::new, the real sink. The ±2 tolerance happened to
  mask this stale attribution but it was semantically wrong — phase 4
  is the right time to correct it. Also adds expected_call_site_lines
  [8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
  This fixture's sink (Command::new inside run_cmd at line 5) was the
  motivating case for phases 1-3; adding the call-site assertion
  guards against regression to caller-line attribution.

New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
  takes two tainted params and invokes two Command sinks on
  consecutive lines. Locks in that primary line lands inside the
  helper (lines 5-6), not at the caller (line 12). Notes document
  that SinkSite is currently one-per-callee so both findings today
  collapse onto the first sink; expected_sink_lines=[5,6] and
  expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
  004): sink os.system lives in helper.py (cross-file), caller in
  app.py reads env source and calls run_cmd. Verifies phase 3's
  cross-file primary attribution: Diag.path = helper.py, Diag.line =
  5, with app.py:7 recorded in flow_steps as a Call step.

Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
  pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
  TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
  F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
  264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test

Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body.  Asserts the
resulting Finding.primary_location is exactly that triple.

The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file.  This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.

Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).

Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor: clean up formatting and improve readability in multiple files

* refactor: simplify type definition for deduplication key in findings

* test(harness): add must_not_match expectation for FP regression guards

Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules

* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking

* feat: update switch statement handling to improve control flow analysis

* feat: implement promisify alias handling for JS/TS to enhance taint tracking

* feat: enhance taint tracking by refining expectation handling and adding mode filtering

* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters

* feat: update taint tracking rules to enforce full mode matching and improve flow analysis

* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis

* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding

* feat: refine framework detection and update expectation handling for Echo and Sinatra

* feat: implement max_count for taint tracking expectations and deduplicate findings

* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files

* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity

* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files

* feat: add structural invariant checks for SSA bodies

* feat: ensure deterministic phi emission order using BTreeSet

* feat: enhance handling of terminators to ensure authoritative flow through successor edges

* feat: enhance Goto terminator handling to ensure all successors are marked executable

* feat: refactor code for improved readability and organization

* feat: simplify predicate checks and enhance readability in SSA handling

* feat: implement per-file parse timeout and enhance file size handling

* feat: migrate analysis engine toggles from environment variables to configuration file

* feat: remove unnecessary whitespace in hostile_input_tests.rs

* feat: remove unnecessary whitespace in hostile_input_tests.rs

* feat: update dependencies and enhance documentation on language maturity

* feat: enhance security headers and improve request body limits

* feat: implement sink capability bits for deduplication and enhance evidence tagging

* feat: implement dynamic activation handling for gated sinks and enhance validation logic

* feat: enhance configuration documentation and clarify inline analysis cache behavior

* feat: implement panic recovery during analysis to continue scans past errors

* feat: add expectations configuration for taint analysis and performance metrics

* feat: enhance error handling and logging during file reading and mutex locking

* feat: add cross-file body loading tests and plumbing for CF-1 phase

* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures

* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality

* feat: enhance classification span handling in CFG and AST for improved source attribution

* feat: add new Express routes for handling user input and telemetry data

* feat: implement ternary expression handling in CFG with diamond structure for JS/TS

* feat: implement Phase CF-3 abstract-domain transfer channels in summaries

* feat: add support for string-prefix transfer in cross-file calls and update tests

* docs: reduce RESULTS.md doc size

* feat: implement Phase CF-4 per-return-path summary decomposition with tests

* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization

* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests

* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests

* refactor: update comments and documentation for clarity and consistency

* style: format code for consistency and readability

* refactor: simplify verdict handling and improve edge checking logic

* refactor: optimize path and identifier collection by avoiding unnecessary cloning

* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults

* refactor: update documentation and improve clarity in configuration files

* refactor: update documentation and improve clarity in configuration files

* feat: add JS/TS pass-2 convergence tests and expectations configuration

* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic

* feat: implement Phase 7 deduplication and alternative path linking for taint findings

* feat: implement structural DFS index for anonymous functions and update naming conventions

* feat: add Phase 8 regression tests for container-element taint in JS and Python

* feat: add engine-depth profiles and explain-engine option for CLI

* feat: update expectations and add new README fixtures for multi-file scan regression

* feat: implement Phase 11 callback-alias and factory patterns with regression tests

* feat: implement Terminator::Switch for multi-way dispatch and add regression tests

* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants

* refactor: extract cfg and ssa_transfer to submodules

* refactor: cargo fmt

* refactor: remove unnecessary blank line in cfg_tests.rs

* refactor: remove unnecessary planning file

* chore: update Rust version to 1.88 and bump dependencies in Cargo files

* feat: enhance triage UI with new layout and controls, update README for clarity

* feat: enhance triage UI with new layout and controls, update README for clarity

* chore: remove outdated section from README for version 0.5.0

* docs: improve clarity and consistency in README content

* chore: add "GPL-3.0-or-later" to license options in about.toml

* chore: update license handling in about.toml and check-licenses.mjs

* style: format code for improved readability in TriagePage component

* style: format code for improved readability in TriagePage component

* chore: enhance license handling and improve body_id scoping in seed lookup

* feat: introduce owner and parent body IDs for enhanced seed scoping

* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating

* feat: add Undef SSA operation for improved control-flow handling

* style: improve code formatting for consistency and readability in multiple files

* feat: add 16-function chain SCC across multiple files for enhanced analysis

* style: simplify code formatting for improved readability in multiple files

* fix: update CapHitReason default implementation and improve README clarity

* docs: enhance README with detailed explanations of taint analysis and limitations

* docs: refine README for clarity and consistency in taint analysis section

* style: improve code formatting for better readability in NewScanModal and scans

* fix: update cargo-about command to use --offline for deterministic license generation

* fix: update cargo-about command to use --offline for deterministic license generation

* ci: add step to prime cargo registry cache for deterministic license generation

* feat: add support for non-sink collections in authorization analysis

* feat: enhance authorization checks with row-level ownership equality and binding tracking

* feat: implement self-scoped user handling and enhance ownership checks

* refactor: simplify assertions and formatting in authorization analysis tests

* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure

* docs: update AI disclosure section for clarity and conciseness

* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure

* feat: enhance authorization analysis with SSA-derived variable type classification

* feat: implement auth_finding_to_diag function for enhanced security diagnostics

* feat: add args_value_refs to CallSite struct for enhanced argument tracking

* feat: add args_value_refs to CallSite struct for enhanced argument tracking

* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag

* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks

* feat: enhance error message handling in cli_validation_tests for better Windows compatibility

* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration

* feat: enhance release build process with SBOM generation and SLSA provenance

* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries

* feat: introduce PathFact handling for path safety checks and rejection logic

* feat: introduce PathFact handling for path safety checks and rejection logic

* feat: update benchmark data and enhance path sanitization logic with new safety checks

* feat: document AI assistance in frontend UI development and human review process

* feat: add return path facts for enhanced path safety checks and update documentation

* chore: update release date for version 0.5.0 in CHANGELOG.md

* chore: clean up ci.yml by removing outdated comments and clarifying steps

* feat: implement cross-language path sanitizers and validators for enhanced security

* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks

* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases

* refactor: simplify conditional formatting and improve code readability in executor and lower modules

* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues

* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers

* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers

* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests

* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs

---------

Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Eli Peter 2026-04-25 17:59:11 -04:00 • committed by GitHub
parent c4ce08b452
commit 41128177d2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2144 changed files with 201812 additions and 8927 deletions
Download patch file Download diff file Expand all files Collapse all files

1422
src/summary/mod.rs
View file

File diff suppressed because it is too large Load diff

338
src/summary/points_to.rs Normal file
View file

@ -0,0 +1,338 @@
//! Parameter-granularity points-to summaries.
//!
//! Captures the subset of intra-procedural alias behaviour that matters
//! at cross-file call sites: which parameters' heap/field writes are
//! observable to the caller through *another* parameter's alias, and
//! which parameters flow identity to the return value.
//!
//! ## Scope
//!
//! This is **intentionally not** a whole-program points-to analysis.
//! Nyx already has bounded intra-procedural heap tracking
//! ([`crate::ssa::heap`]); this module bridges the cross-file cliff by recording
//! a small, bounded alias graph between parameter positions and the return
//! value, then replaying it at summary-resolution time.
//!
//! ## Edge model
//!
//! Edges are directed `AliasEdge { source, target, kind }`:
//!
//! * `Source(Param(i)) → Target(Param(j))` — the callee stores data
//! derived from parameter `i` into a field/element of parameter `j`.
//! Mutation is observable to the caller through its argument for `j`.
//! * `Source(Param(i)) → Target(Return)` — the return value aliases
//! parameter `i`'s heap identity. Adds heap-level precision on top of
//! the coarser [`TaintTransform::Identity`] view already carried in
//! [`crate::summary::ssa_summary::SsaFuncSummary::param_to_return`].
//!
//! `MustAlias` is intentionally omitted — the ROI on
//! must-alias inference for cross-file summaries is low, and the soundness
//! story for `MayAlias`-only application is straightforward ("take the
//! union").
//!
//! ## Bound and overflow policy
//!
//! Edge count is capped at [`MAX_ALIAS_EDGES`]. When a callee's alias
//! graph exceeds the cap the summary records `overflow = true` and
//! callers treat the function as "any tainted parameter may spread to
//! every other parameter and to the return" — the conservative
//! greatest-lower-bound over the alias lattice.
use serde::{Deserialize, Serialize};
use smallvec::SmallVec;
/// Identity of one endpoint in an alias edge.
///
/// Parameters are identified by their 0-based positional index as reported
/// by [`crate::ssa::ir::SsaOp::Param`]; the implicit receiver (`self`/`this`)
/// is handled outside this table and is deliberately not representable here.
/// `Return` denotes the function's return SSA value — one per function, so
/// no further qualifier is needed.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize)]
pub enum AliasPosition {
/// Positional parameter, 0-based. Receiver is excluded.
Param(u32),
/// The function's return value (union of every `Terminator::Return`).
Return,
}
/// Strength of an alias edge. Only [`AliasKind::MayAlias`] is emitted
/// — the analysis over-approximates identity-level aliasing rather than
/// proving must-alias. The variant is kept as an enum so a future
/// extension that distinguishes the two can slot in without migrating
/// on-disk data.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize)]
pub enum AliasKind {
/// Under some execution, the two positions may reference the same
/// heap object. Callers applying the edge take the *union* of
/// points-to / taint at the source into the target.
MayAlias,
}
/// A single directed alias edge.
///
/// `(source, target)` are order-sensitive: data flows from `source` to
/// `target` at the callee. Callers apply each edge by reading their
/// argument / return abstraction for `source` and propagating into
/// `target`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
pub struct AliasEdge {
pub source: AliasPosition,
pub target: AliasPosition,
pub kind: AliasKind,
}
/// Maximum edges retained per [`PointsToSummary`].
///
/// Chosen so typical callees (≤ 4 parameters, one return, a handful of
/// field writes) fit without approximation while pathological graphs
/// still terminate the analysis in bounded time. Overflow triggers the
/// [`PointsToSummary::overflow`] fallback instead of silently dropping
/// edges, so callers can reason about soundness.
pub const MAX_ALIAS_EDGES: usize = 8;
/// Parameter-granularity alias summary persisted in
/// [`crate::summary::ssa_summary::SsaFuncSummary`].
///
/// The summary is empty by default — functions without any parameter /
/// return aliasing (pure transformers, sinks that consume but don't
/// mutate their arguments) carry no edges and cost nothing on disk.
///
/// When the callee's alias graph exceeds [`MAX_ALIAS_EDGES`], extraction
/// sets [`overflow = true`](Self::overflow) and callers must treat every
/// parameter as reaching every other parameter and the return. This is
/// the conservative fallback for bounded alias analysis.
#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
pub struct PointsToSummary {
/// Bounded edge list, deduped by `(source, target, kind)`. The
/// [`serde(default)`] attribute lets summaries pre-dating points-to
/// tracking deserialise cleanly (no edges).
#[serde(default, skip_serializing_if = "SmallVec::is_empty")]
pub edges: SmallVec<[AliasEdge; 4]>,
/// Conservative fallback flag — set when extraction hit
/// [`MAX_ALIAS_EDGES`] and refused to drop any edge silently. When
/// `true`, callers treat the callee as "every parameter may alias
/// every other parameter and the return value".
#[serde(default, skip_serializing_if = "core::ops::Not::not")]
pub overflow: bool,
/// At least one return path produces a *fresh* container allocation —
/// a container literal (`[]`, `{}`) or a known container constructor
/// call (`new Map()`, `list()`, …) that does not trace back to any
/// parameter. When this is `true` the caller synthesises a fresh
/// [`crate::ssa::heap::HeapObjectId`] keyed on the call's SSA value
/// and seeds it into `dynamic_pts`, so later container operations on
/// the call result (e.g. `bag[0]`, `fillBag(bag, …)`) can find a heap
/// cell to read from or store into.
///
/// Closes the factory-pattern cross-file gap — `const bag = makeBag()`
/// followed by `fillBag(bag, env)` and `exec(bag[0])` — by giving the
/// caller's heap analysis a stable identity to attach stores to.
/// Combines freely with `Param(i) → Return` edges: a mixed-return
/// function (one branch returns a param, another returns a fresh
/// allocation) emits both and the caller joins the two points-to
/// sets.
#[serde(default, skip_serializing_if = "core::ops::Not::not")]
pub returns_fresh_alloc: bool,
}
impl PointsToSummary {
/// Empty summary — no aliasing, no overflow. Equivalent to
/// [`Self::default`] but explicit at call sites.
pub fn empty() -> Self {
Self::default()
}
/// Whether this summary adds any information over the default "no
/// aliasing" interpretation. Used by extraction to decide whether
/// the field should be persisted or left empty.
pub fn is_empty(&self) -> bool {
self.edges.is_empty() && !self.overflow && !self.returns_fresh_alloc
}
/// Insert an edge, preserving dedup and the bounded-size invariant.
///
/// Returns `true` when the edge was added, `false` when it was a
/// duplicate or when the cap triggered an overflow. The caller can
/// ignore the return — the summary always remains in a valid state.
pub fn insert(&mut self, source: AliasPosition, target: AliasPosition, kind: AliasKind) {
if self.overflow {
return;
}
let edge = AliasEdge {
source,
target,
kind,
};
if self.edges.contains(&edge) {
return;
}
if self.edges.len() >= MAX_ALIAS_EDGES {
self.overflow = true;
// Keep the existing edge list — a consumer that still reads
// the vector gets a strict *subset* of the sound over-
// approximation conveyed by `overflow`. Correctness is
// owned by the overflow flag; the residual edges are purely
// diagnostic.
return;
}
self.edges.push(edge);
}
/// Union two summaries, merging edges and OR-ing the overflow /
/// fresh-alloc flags. Respects the [`MAX_ALIAS_EDGES`] cap via the
/// same overflow promotion used by [`Self::insert`].
pub fn merge(&mut self, other: &Self) {
self.returns_fresh_alloc |= other.returns_fresh_alloc;
if other.overflow {
self.overflow = true;
return;
}
for edge in &other.edges {
self.insert(edge.source, edge.target, edge.kind);
}
}
/// Parameter indices referenced by any edge in this summary. Used by
/// [`crate::summary::ssa_summary_fits_arity`] to confirm the summary
/// does not reference a parameter beyond the key's declared arity
/// (which would indicate a synthetic-param mis-attribution in
/// extraction).
pub fn max_param_index(&self) -> Option<u32> {
let mut max: Option<u32> = None;
for edge in &self.edges {
if let AliasPosition::Param(i) = edge.source {
max = Some(max.map_or(i, |m| m.max(i)));
}
if let AliasPosition::Param(i) = edge.target {
max = Some(max.map_or(i, |m| m.max(i)));
}
}
max
}
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn empty_summary_is_noop() {
let s = PointsToSummary::empty();
assert!(s.is_empty());
assert!(!s.overflow);
assert_eq!(s.edges.len(), 0);
}
#[test]
fn insert_dedups() {
let mut s = PointsToSummary::empty();
s.insert(
AliasPosition::Param(0),
AliasPosition::Param(1),
AliasKind::MayAlias,
);
s.insert(
AliasPosition::Param(0),
AliasPosition::Param(1),
AliasKind::MayAlias,
);
assert_eq!(s.edges.len(), 1);
}
#[test]
fn insert_overflows_at_cap() {
let mut s = PointsToSummary::empty();
for i in 0..(MAX_ALIAS_EDGES as u32) {
s.insert(
AliasPosition::Param(i),
AliasPosition::Return,
AliasKind::MayAlias,
);
}
assert_eq!(s.edges.len(), MAX_ALIAS_EDGES);
assert!(!s.overflow);
s.insert(
AliasPosition::Param(99),
AliasPosition::Return,
AliasKind::MayAlias,
);
assert!(s.overflow);
assert_eq!(s.edges.len(), MAX_ALIAS_EDGES);
}
#[test]
fn merge_propagates_overflow() {
let mut a = PointsToSummary::empty();
let mut b = PointsToSummary::empty();
b.overflow = true;
a.merge(&b);
assert!(a.overflow);
}
#[test]
fn max_param_index_tracks_both_endpoints() {
let mut s = PointsToSummary::empty();
s.insert(
AliasPosition::Param(0),
AliasPosition::Param(3),
AliasKind::MayAlias,
);
s.insert(
AliasPosition::Param(1),
AliasPosition::Return,
AliasKind::MayAlias,
);
assert_eq!(s.max_param_index(), Some(3));
}
#[test]
fn serde_round_trip_is_stable() {
let mut s = PointsToSummary::empty();
s.insert(
AliasPosition::Param(0),
AliasPosition::Param(1),
AliasKind::MayAlias,
);
s.insert(
AliasPosition::Param(2),
AliasPosition::Return,
AliasKind::MayAlias,
);
let json = serde_json::to_string(&s).unwrap();
let back: PointsToSummary = serde_json::from_str(&json).unwrap();
assert_eq!(s, back);
}
#[test]
fn serde_default_decodes_empty_object() {
let back: PointsToSummary = serde_json::from_str("{}").unwrap();
assert!(back.is_empty());
}
#[test]
fn returns_fresh_alloc_is_not_empty() {
let mut s = PointsToSummary::empty();
assert!(s.is_empty());
s.returns_fresh_alloc = true;
assert!(!s.is_empty());
}
#[test]
fn merge_propagates_fresh_alloc_flag() {
let mut a = PointsToSummary::empty();
let mut b = PointsToSummary::empty();
b.returns_fresh_alloc = true;
a.merge(&b);
assert!(a.returns_fresh_alloc);
}
#[test]
fn returns_fresh_alloc_roundtrips() {
let mut s = PointsToSummary::empty();
s.returns_fresh_alloc = true;
let json = serde_json::to_string(&s).unwrap();
let back: PointsToSummary = serde_json::from_str(&json).unwrap();
assert!(back.returns_fresh_alloc);
assert_eq!(s, back);
}
}

455
src/summary/ssa_summary.rs Normal file
View file

@ -0,0 +1,455 @@
use crate::abstract_interp::{AbstractTransfer, AbstractValue, PathFact};
use crate::labels::Cap;
use crate::ssa::type_facts::TypeKind;
use crate::summary::SinkSite;
use crate::summary::points_to::PointsToSummary;
use serde::{Deserialize, Serialize};
use smallvec::SmallVec;
/// Per-parameter taint transform describing how taint flows through a function.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub enum TaintTransform {
/// Parameter flows to return value unchanged.
Identity,
/// Parameter flows to return minus sanitizer bits.
StripBits(Cap),
/// Return value gains additional source bits regardless of input.
AddBits(Cap),
}
/// Maximum [`ReturnPathTransform`] entries retained per parameter.
///
/// Most functions have one or two return paths; eight is a generous bound
/// that still keeps per-summary memory O(1). Beyond the cap, extraction
/// joins the overflow into a single Top-predicate entry so the caller-side
/// application always sees a bounded vector.
pub const MAX_RETURN_PATHS: usize = 8;
/// A single return-path entry in a per-parameter summary.
///
/// Per-return-path decomposition preserves callee-internal path splits that
/// the aggregate [`TaintTransform`] would erase. Each entry records the
/// path predicate under which this return is reached, the behavioural
/// transform on that path, and (optionally) an abstract-domain contribution.
///
/// Callers carry their own path-state at the call site and apply only
/// entries whose predicate is consistent with the caller's validated set;
/// the remainder are skipped. Applicable entries are joined to produce
/// the effective transform at the call site.
///
/// When a callee has a single return path, `param_return_paths` stays empty
/// and the caller falls back to `param_to_return`'s union view.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct ReturnPathTransform {
/// Behavioural kind on this path (Identity / StripBits / AddBits).
pub transform: TaintTransform,
/// Deterministic hash of the path-predicate gate at this return.
///
/// `0` is reserved for "no predicate gate" — a return reached under
/// no known predicate. Two return blocks whose path predicates are
/// observationally equivalent hash to the same value and are joined.
pub path_predicate_hash: u64,
/// `PredicateSummary::known_true` bits that must hold on every path
/// into this return. Encoded using [`crate::taint::domain::predicate_kind_bit`]:
/// bit 0 = NullCheck, 1 = EmptyCheck, 2 = ErrorCheck.
pub known_true: u8,
/// `PredicateSummary::known_false` bits at this return (same encoding
/// as [`Self::known_true`]).
pub known_false: u8,
/// Abstract contribution for this return path, when non-Top.
///
/// Callers combine this with their own abstract fact on the call
/// site's argument using `AbstractValue::meet` to recover bounds that
/// survive a specific return.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub abstract_contribution: Option<AbstractValue>,
}
impl ReturnPathTransform {
/// Dedup key combining the semantic fields of a path entry. Two entries
/// with the same `(path_predicate_hash, transform, known_true, known_false)`
/// describe the same behaviour on paths gated by the same predicate and
/// can collapse without losing information. `abstract_contribution` is
/// deliberately ignored — the dedup path joins the two entries'
/// abstract facts rather than dropping one.
pub fn dedup_key(&self) -> (u64, &TaintTransform, u8, u8) {
(
self.path_predicate_hash,
&self.transform,
self.known_true,
self.known_false,
)
}
}
/// Merge `incoming` into `existing`, deduping by
/// [`ReturnPathTransform::dedup_key`] and joining abstract contributions on
/// collision. Caps the final vector at [`MAX_RETURN_PATHS`]; overflow is
/// conservatively joined into a single Top-predicate entry.
pub fn merge_return_paths(
existing: &mut SmallVec<[ReturnPathTransform; 2]>,
incoming: &[ReturnPathTransform],
) {
for new_entry in incoming {
let key = new_entry.dedup_key();
if let Some(slot) = existing.iter_mut().find(|e| e.dedup_key() == key) {
slot.abstract_contribution = match (
slot.abstract_contribution.take(),
&new_entry.abstract_contribution,
) {
(Some(a), Some(b)) => Some(a.join(b)),
(Some(a), None) => Some(a),
(None, Some(b)) => Some(b.clone()),
(None, None) => None,
};
} else {
existing.push(new_entry.clone());
}
}
if existing.len() > MAX_RETURN_PATHS {
let mut joined = ReturnPathTransform {
transform: TaintTransform::Identity,
path_predicate_hash: 0,
known_true: 0,
known_false: 0,
abstract_contribution: None,
};
let mut strip_bits = Cap::all();
let mut add_bits = Cap::empty();
let mut saw_add = false;
let mut abs: Option<AbstractValue> = None;
let mut known_true = u8::MAX;
let mut known_false = u8::MAX;
for e in existing.iter() {
match &e.transform {
TaintTransform::Identity => {
// Identity strips nothing; join intersects to empty.
strip_bits = Cap::empty();
}
TaintTransform::StripBits(bits) => strip_bits &= *bits,
TaintTransform::AddBits(bits) => {
add_bits |= *bits;
saw_add = true;
}
}
known_true &= e.known_true;
known_false &= e.known_false;
abs = match (abs, &e.abstract_contribution) {
(None, None) => None,
(Some(a), None) => Some(a),
(None, Some(b)) => Some(b.clone()),
(Some(a), Some(b)) => Some(a.join(b)),
};
}
joined.transform = if saw_add {
TaintTransform::AddBits(add_bits)
} else if strip_bits.is_empty() {
TaintTransform::Identity
} else {
TaintTransform::StripBits(strip_bits)
};
joined.known_true = known_true;
joined.known_false = known_false;
joined.abstract_contribution = abs;
existing.clear();
existing.push(joined);
}
}
/// Precise per-parameter SSA-derived function summary.
///
/// Produced by running SSA taint analysis with each parameter individually
/// seeded, then observing which caps survive to return/sink positions.
/// This is more precise than the legacy `FuncSummary` bitmask approach
/// because it can express per-parameter transforms (e.g., "param 0 flows
/// to return but loses HTML_ESCAPE bits").
#[derive(Debug, Clone, Default, PartialEq, Serialize, Deserialize)]
pub struct SsaFuncSummary {
/// Per-parameter flows to return value: (param_index, transform).
pub param_to_return: Vec<(usize, TaintTransform)>,
/// Per-parameter flows to internal sinks: each entry binds a parameter
/// index to one or more [`SinkSite`]s inside this function's body.
///
/// Carrying the callee's sink source-location through the summary
/// enables primary sink-location attribution: cross-file findings
/// attribute the finding to the actual dangerous instruction rather
/// than to the call site. Each `SinkSite` records the bits (`cap`) it
/// contributes, so consumers deriving a coarse `Cap` union across all
/// sites for a given parameter remain behavior-compatible.
#[serde(default)]
pub param_to_sink: Vec<(usize, SmallVec<[SinkSite; 1]>)>,
/// Source caps introduced regardless of parameters (e.g., function reads env).
pub source_caps: Cap,
/// Per-parameter flows to specific internal sink argument positions:
/// (caller_param_index, sink_arg_position, sink_caps).
#[serde(default)]
pub param_to_sink_param: Vec<(usize, usize, Cap)>,
/// Parameter indices whose container identity flows to the return value
/// (e.g., function returns the same container it received as input).
///
/// Populated by
/// [`crate::taint::ssa_transfer::summary_extract::extract_container_flow_summary`]
/// and applied at cross-file call sites to propagate the caller's
/// points-to set for that argument onto the call's return SSA value.
#[serde(default)]
pub param_container_to_return: Vec<usize>,
/// `(src_param, container_param)` pairs: `src_param`'s taint is stored
/// into `container_param`'s container contents inside this function
/// (e.g., `fn storeInto(value, arr) { arr.push(value); }` → `[(0, 1)]`).
///
/// Populated by
/// [`crate::taint::ssa_transfer::summary_extract::extract_container_flow_summary`]
/// and applied at cross-file call sites by writing the caller's taint on
/// the `src_param` argument into the heap objects pointed to by the
/// `container_param` argument.
#[serde(default)]
pub param_to_container_store: Vec<(usize, usize)>,
/// Inferred return type of the function, when determinable from constructor
/// calls or type annotations. Enables cross-file type-qualified resolution.
#[serde(default)]
pub return_type: Option<TypeKind>,
/// Abstract domain fact for the return value.
/// When present, callers can use this to seed the return SSA value's
/// abstract state for cross-procedural interval/string analysis.
#[serde(default)]
pub return_abstract: Option<AbstractValue>,
/// Internal source taint flows to a call of parameter N with these caps.
/// Detects callback patterns like `fn apply(f: F) { let x = source(); f(x); }`
/// where the function invokes a callback parameter with tainted data.
#[serde(default)]
pub source_to_callback: Vec<(usize, Cap)>,
/// How receiver (`self`/`this`) taint flows to the return value.
/// `None` when receiver taint does not reach the return. Matches the
/// semantics of `param_to_return`'s `TaintTransform` for positional params.
#[serde(default)]
pub receiver_to_return: Option<TaintTransform>,
/// Caps that the receiver's taint reaches in internal sinks.
/// Empty when the receiver is not used as a sink payload inside the body.
#[serde(default)]
pub receiver_to_sink: Cap,
/// Per-parameter abstract-domain transfer channels.
///
/// Each entry `(param_index, transfer)` describes how a caller-known
/// abstract value at that parameter maps to the function's return
/// abstract value. At cross-file call sites the caller applies each
/// transfer to the corresponding argument's abstract state and joins
/// the results (then `meet`s with [`Self::return_abstract`]) to
/// synthesise the return abstract value — recovering interval bounds
/// and string prefixes that would otherwise be lost to the summary's
/// Top-seeded baseline.
///
/// Empty when no parameter carries useful abstract flow. Individual
/// entries are omitted when their transfer is "top" (no knowledge),
/// so on-disk size grows only when the callee really does propagate
/// abstract values.
#[serde(default, skip_serializing_if = "Vec::is_empty")]
pub abstract_transfer: Vec<(usize, AbstractTransfer)>,
/// Per-parameter return-path decomposition.
///
/// When non-empty, supplies finer-grained per-path data than
/// [`Self::param_to_return`]. Each parameter maps to up to
/// [`MAX_RETURN_PATHS`] [`ReturnPathTransform`] entries, one per
/// distinct path-predicate gate. Callers consult their own predicate
/// state at the call site and apply only entries whose predicate is
/// consistent with the caller's validated set, joining the applicable
/// set into the effective call-site transform.
///
/// Empty when the callee has a single return path — the aggregate
/// [`param_to_return`] is already precise — or when extraction
/// could not derive per-return state (e.g. early-exit probes).
#[serde(default, skip_serializing_if = "Vec::is_empty")]
pub param_return_paths: Vec<(usize, SmallVec<[ReturnPathTransform; 2]>)>,
/// Parameter-granularity points-to summary.
///
/// Records bounded alias edges between parameter positions and the
/// return value, so summary-path cross-file resolution can spread
/// taint through object mutations that do not flow via the return.
/// Empty (the default) for functions whose parameters do not alias
/// each other or the return value.
#[serde(default, skip_serializing_if = "PointsToSummary::is_empty")]
pub points_to: PointsToSummary,
/// Per-return-path abstract [`PathFact`] decomposition.
///
/// When non-empty, supplies per-predicate-gate facts finer than the
/// aggregate `return_abstract.path` (which is the join over all
/// return blocks and loses narrowing on any block whose rv is Top).
/// Each entry records the fact on one distinct predicate gate and,
/// when the rv is a structural one-arg variant constructor, the
/// inner fact so match-arm-sensitive callers can pick the arm-
/// specific fact.
///
/// Empty for callees whose return blocks produce no non-Top fact,
/// or whose single return path makes the aggregate already precise.
/// Cross-file callers that cannot pick a specific path fall back to
/// joining the entries — equivalent to the pre-decomposition
/// behaviour.
#[serde(default, skip_serializing_if = "SmallVec::is_empty")]
pub return_path_facts: SmallVec<[PathFactReturnEntry; 2]>,
}
/// A per-return-path [`PathFact`] entry.
///
/// `SsaFuncSummary.param_return_paths` decomposes taint transforms by
/// predicate hash; `PathFactReturnEntry` records the matching decomposition
/// for the abstract [`PathFact`] on the return SSA value. Each entry keys
/// on the same `predicate_hash` so the two vectors can be joined at the
/// call site.
///
/// `variant_inner_fact` captures the *inner* fact when the return value on
/// this path is a recognised one-argument variant constructor (e.g.
/// `Some(s)` / `Ok(s)`). Callers that destructure the call result via a
/// `match` or `if let` use the inner fact in the matching arm instead of
/// the outer wrapper's fact. `None` when the return rv is not a variant
/// wrapper.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct PathFactReturnEntry {
/// Deterministic hash of the predicate gate at this return block.
/// `0` = unguarded return. Shares the same hash space as
/// [`ReturnPathTransform::path_predicate_hash`] so the two tables
/// align per-path.
pub predicate_hash: u64,
/// `PredicateSummary::known_true` bits that hold on every path into
/// this return (same encoding as
/// [`ReturnPathTransform::known_true`]).
pub known_true: u8,
/// `PredicateSummary::known_false` bits at this return.
pub known_false: u8,
/// The return value's [`PathFact`] on this path.
pub path_fact: PathFact,
/// Inner [`PathFact`] when the rv on this path is a one-arg variant
/// constructor; [`None`] otherwise. Match-arm-sensitive callers
/// consume this in the variant-binding arm.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub variant_inner_fact: Option<PathFact>,
}
impl PathFactReturnEntry {
/// Dedup key. Two entries with identical `(predicate_hash,
/// path_fact, variant_inner_fact)` describe the same abstract return
/// under the same predicate gate and collapse losslessly.
pub fn dedup_key(&self) -> (u64, &PathFact, Option<&PathFact>) {
(
self.predicate_hash,
&self.path_fact,
self.variant_inner_fact.as_ref(),
)
}
}
/// Maximum per-summary [`PathFactReturnEntry`] count.
///
/// Mirrors [`MAX_RETURN_PATHS`]: a return-heavy callee pays bounded space
/// while still preserving the typical 2-4 path decomposition.
pub const MAX_PATH_FACT_RETURN_ENTRIES: usize = 8;
/// Merge `incoming` into `existing`, deduping by
/// [`PathFactReturnEntry::dedup_key`]. Entries whose
/// `predicate_hash` matches but whose facts differ are joined
/// (component-wise fact join) so the resulting entry over-approximates
/// both paths. Caps the result at
/// [`MAX_PATH_FACT_RETURN_ENTRIES`]; overflow collapses into a single
/// Top-predicate entry whose fact is the join of all dropped entries'
/// facts.
pub fn merge_path_fact_return_paths(
existing: &mut SmallVec<[PathFactReturnEntry; 2]>,
incoming: &[PathFactReturnEntry],
) {
for new_entry in incoming {
if let Some(slot) = existing
.iter_mut()
.find(|e| e.predicate_hash == new_entry.predicate_hash)
{
// Same predicate gate: join facts (component-wise over-approximation).
slot.path_fact = slot.path_fact.join(&new_entry.path_fact);
slot.variant_inner_fact = match (
slot.variant_inner_fact.take(),
&new_entry.variant_inner_fact,
) {
(Some(a), Some(b)) => Some(a.join(b)),
(Some(a), None) => Some(a),
(None, Some(b)) => Some(b.clone()),
(None, None) => None,
};
// Intersect known_true / known_false: only bits proved on
// every path into this predicate gate survive.
slot.known_true &= new_entry.known_true;
slot.known_false &= new_entry.known_false;
} else {
existing.push(new_entry.clone());
}
}
if existing.len() > MAX_PATH_FACT_RETURN_ENTRIES {
let mut joined_fact = PathFact::bottom();
let mut joined_inner: Option<PathFact> = None;
let mut kt = u8::MAX;
let mut kf = u8::MAX;
for e in existing.iter() {
joined_fact = joined_fact.join(&e.path_fact);
joined_inner = match (joined_inner, &e.variant_inner_fact) {
(None, None) => None,
(Some(a), None) => Some(a),
(None, Some(b)) => Some(b.clone()),
(Some(a), Some(b)) => Some(a.join(b)),
};
kt &= e.known_true;
kf &= e.known_false;
}
existing.clear();
existing.push(PathFactReturnEntry {
predicate_hash: 0,
known_true: kt,
known_false: kf,
path_fact: joined_fact,
variant_inner_fact: joined_inner,
});
}
}
/// Union-merge two `param_return_paths` lists keyed by parameter
/// index. Each parameter keeps its own deduped [`ReturnPathTransform`] list,
/// joining abstract contributions on collision and enforcing the
/// [`MAX_RETURN_PATHS`] cap. Used by merge paths that combine summaries
/// across iterations or files (SSA summaries are currently last-writer-wins
/// in `GlobalSummaries`, but this helper is the entry point future union
/// paths should call so per-path semantics stay centralised).
pub fn union_param_return_paths(
existing: &mut Vec<(usize, SmallVec<[ReturnPathTransform; 2]>)>,
incoming: &[(usize, SmallVec<[ReturnPathTransform; 2]>)],
) {
for (idx, paths) in incoming {
if let Some((_, slot)) = existing.iter_mut().find(|(i, _)| *i == *idx) {
merge_return_paths(slot, paths);
} else {
let mut fresh: SmallVec<[ReturnPathTransform; 2]> = SmallVec::new();
merge_return_paths(&mut fresh, paths);
existing.push((*idx, fresh));
}
}
}
impl SsaFuncSummary {
/// Per-parameter union of [`Cap`] bits across every [`SinkSite`] recorded
/// for that parameter.
///
/// Returns one `(param_index, caps)` pair per distinct parameter, with
/// `caps` being the bitwise OR of every site's own `cap`. This is the
/// backward-compatible view that pre-`SinkSite` consumers (resolver,
/// taint engine) still rely on.
pub fn param_to_sink_caps(&self) -> Vec<(usize, Cap)> {
self.param_to_sink
.iter()
.map(|(idx, sites)| {
let caps = sites.iter().fold(Cap::empty(), |acc, s| acc | s.cap);
(*idx, caps)
})
.collect()
}
/// Total [`Cap`] bits reached across every parameter's recorded sink sites.
pub fn total_param_sink_caps(&self) -> Cap {
self.param_to_sink
.iter()
.flat_map(|(_, sites)| sites.iter())
.fold(Cap::empty(), |acc, s| acc | s.cap)
}
}

3413
src/summary/tests.rs
View file

File diff suppressed because it is too large Load diff