apunkt/nyx
1
0
Fork 0
mirror of https://github.com/elicpeter/nyx.git synced 2026-06-12 19:55:14 +02:00
Code Issues Projects Releases Packages Wiki Activity

Release/0.5.0 (#35)

Browse source 
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures

* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests

* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements

* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles

* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing

* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling

* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures

* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration

* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests

* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic

* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection

* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements

* feat: Enable auth-state analysis by default and update relevant tests in benchmark config

* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test

* docs: update CHANGELOG.md

* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers

* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers

* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse

* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation

* feat: Refactor function parameters and constants for improved clarity and maintainability

* refactor: Reorder module imports and improve formatting for consistency

* refactor: Fix formatting erorrs

* refactor: Fix clippy warnings

* refactor: Fix fmt warnings (again)

* chore: Update dependencies and improve feature configuration

* Add comprehensive tests for undertested modules (#36) (COPILOT)

* Add comprehensive tests for undertested modules

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083

* Add comprehensive tests for ext, project, walk, and errors modules

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* chore: Update dependencies and improve feature configuration

* fix: formatting errors in new tests

* chore: Update license list in about.toml

* chore: made functions input inline

* chore: updated cfg graph to take up the full page

* chore: add Prettier configuration and update code formatting

* Add frontend test suite with Vitest (111 tests) (#37)

* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7

* ci: add frontend test step to CI workflow

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* chore: simplify array initialization in test files for consistency

* ran typecheck

* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage

* feat: update routing in AppLayout and improve empty state message in ExplorerPage

* feat: enhance scan progress tracking with additional metrics and stages

* feat: update license information and add license check script

* feat: implement cross-file symbolic execution with callee body persistence

* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering

* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions

* feat: enhance resource tracking with proxy method summaries and improve finding extraction

* feat: add terminal function exit detection for accurate resource leak analysis

* feat: add warnings for loops and functions without bodies to improve error recovery

* feat: update lambda expression handling to ensure proper function classification and control flow

* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling

* feat: add inline return taint analysis and regression tests for improved security checks

* feat: add engine version management and migration handling for database schema updates

* feat: enhance first_call_ident to skip nested function bodies and add regression tests

* feat: enhance callee name resolution with two-segment normalization and disambiguation

* feat: add cross-file context flags and debug assertions for taint analysis

* feat: refactor taint analysis structure to unify context handling and improve clarity

* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests

* docs: updated CHANGELOG.md

* fmt: formatting fixes

* fix: fixed frontend formatting and lint warnings

* fix: optimized ci

* fix: optimized ci

* Add comprehensive multi-file test coverage to Nyx (#38)

* Initial checklist for multi-file test suite expansion

Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage

Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* deleted root repo

* rebuilt to test for regressions

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>

* feat: enhance import alias resolution and taint tracking

* feat: implement security hardening with CSRF protection and path validation

* feat: add support for import alias bindings in Python, PHP, and Rust

* feat: enhance CFG analysis modes and improve code readability

* feat: add detection for parameterized SQL queries to enhance security

* feat: add safe internal redirect handling and enhance session destroy validation

* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads

* feat: enhance taint detection by adding support for inline source member expressions in call arguments

* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments

* feat: add support for Throw statement in control flow and error handling

* feat: add debug and echo endpoints with potential information leakage

* feat: implement internal redirect suppression and enhance taint detection

* feat: implement module alias tracking for dynamic dispatch in JS/TS

* feat: add authorization analysis module with Express support

* feat: add authorization analysis module with Express support

* feat: add tests for admin guard requirements and clean checks in authorization analysis

* feat: integrate Koa and Fastify frameworks into authorization analysis

* feat: add Flask and Django support to authorization analysis module

* feat: add support for Rails and Sinatra frameworks in authorization analysis

* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis

* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis

* feat: add support for Rails and Sinatra in authorization analysis

* chore: add .DS_Store to .gitignore

* refactor: simplify conditional checks and improve readability in multiple files

* refactor: update usage of Option methods for improved clarity and consistency

* refactor: improve code readability by simplifying conditional checks and formatting

* refactor: improve code formatting and readability by simplifying conditional checks

* refactor: simplify conditional checks and improve readability in multiple files

* refactor: simplify conditional checks in axum.rs for improved readability

* feat: add CodeQL analysis configuration for enhanced security scanning

* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)

* chore: start test coverage improvement work

Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* test: add comprehensive tests for src/output.rs SARIF builder

Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* refactor: improve code formatting and readability in output.rs

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>

* refactor: improve code formatting and readability in output.rs

* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* refactor: enhance triage file path handling with improved error management and validation

* refactor: updated func summaries for richer detail

* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries

* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution

* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls

* refactor: implement new Flask routes for safe and unsafe shell command execution

* refactor: separate receiver handling in SSA operations and enhance taint propagation

* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments

* refactor: implement auth decorator extraction and classification for multiple languages

* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation

* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic

* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior

* refactor: standardize default struct initialization across multiple files

* feat: add scripts for formatting checks and auto-fixes with test summaries

* refactor: simplify character splitting and enhance namespace qualifier handling

* refactor: improve documentation clarity and enhance code readability in resolver logic

* refactor: replace default struct initialization with explicit field assignments for clarity

* feat: enhance anonymous function naming by deriving context-based bindings

* refactor: streamline match expressions for improved readability and performance

* refactor: streamline match expressions for improved readability and performance

* refactor: replace loop with while let for improved clarity and performance

* feat: add SSA constant propagation support to analysis context for improved accuracy

* feat: add SSA constant propagation support to analysis context for improved accuracy

* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis

* feat: add static map analysis for command injection suppression and type safety

* refactor: simplify match statements and reduce line breaks for improved readability

* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution

Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.

Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.

Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.

Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.

Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding

Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet.  SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.

Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.

Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`.  `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters.  Dedup key extended with the primary location
so multi-site events aren't collapsed back together.

Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
  != ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
  non-empty `file_rel` — the cap-only → None translation upstream
  guarantees this.

Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved.  A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.

build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.

Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing).  All 1566 lib
tests + integration tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(output): phase 3/5 consume primary sink location in diag + SARIF

When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.

Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
  resolved back to an absolute path via a shared resolve_file_rel
  helper. Empty file_rel (single-file scans where namespace == "")
  resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
  SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
  file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
  locations[0] already reflects the primary sink position via the
  updated diag line/col.

Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.

Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
  the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
  inside the closure).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(bench): phase 4/5 validate primary sink attribution across corpus

Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.

Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
  Case. When present, score_location_level additionally requires at
  least one flow_step in the finding's evidence trace to fall within
  ±2 of the call-site range. When absent, the check is skipped —
  fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
  now-primary Diag.line post-phase-3).

Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
  transform::wrap call site (a cross-file propagator, not a sink);
  line 9 is Command::new, the real sink. The ±2 tolerance happened to
  mask this stale attribution but it was semantically wrong — phase 4
  is the right time to correct it. Also adds expected_call_site_lines
  [8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
  This fixture's sink (Command::new inside run_cmd at line 5) was the
  motivating case for phases 1-3; adding the call-site assertion
  guards against regression to caller-line attribution.

New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
  takes two tainted params and invokes two Command sinks on
  consecutive lines. Locks in that primary line lands inside the
  helper (lines 5-6), not at the caller (line 12). Notes document
  that SinkSite is currently one-per-callee so both findings today
  collapse onto the first sink; expected_sink_lines=[5,6] and
  expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
  004): sink os.system lives in helper.py (cross-file), caller in
  app.py reads env source and calls run_cmd. Verifies phase 3's
  cross-file primary attribution: Diag.path = helper.py, Diag.line =
  5, with app.py:7 recorded in flow_steps as a Call step.

Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
  pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
  TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
  F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
  264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test

Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body.  Asserts the
resulting Finding.primary_location is exactly that triple.

The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file.  This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.

Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).

Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor: clean up formatting and improve readability in multiple files

* refactor: simplify type definition for deduplication key in findings

* test(harness): add must_not_match expectation for FP regression guards

Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules

* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking

* feat: update switch statement handling to improve control flow analysis

* feat: implement promisify alias handling for JS/TS to enhance taint tracking

* feat: enhance taint tracking by refining expectation handling and adding mode filtering

* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters

* feat: update taint tracking rules to enforce full mode matching and improve flow analysis

* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis

* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding

* feat: refine framework detection and update expectation handling for Echo and Sinatra

* feat: implement max_count for taint tracking expectations and deduplicate findings

* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files

* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity

* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files

* feat: add structural invariant checks for SSA bodies

* feat: ensure deterministic phi emission order using BTreeSet

* feat: enhance handling of terminators to ensure authoritative flow through successor edges

* feat: enhance Goto terminator handling to ensure all successors are marked executable

* feat: refactor code for improved readability and organization

* feat: simplify predicate checks and enhance readability in SSA handling

* feat: implement per-file parse timeout and enhance file size handling

* feat: migrate analysis engine toggles from environment variables to configuration file

* feat: remove unnecessary whitespace in hostile_input_tests.rs

* feat: remove unnecessary whitespace in hostile_input_tests.rs

* feat: update dependencies and enhance documentation on language maturity

* feat: enhance security headers and improve request body limits

* feat: implement sink capability bits for deduplication and enhance evidence tagging

* feat: implement dynamic activation handling for gated sinks and enhance validation logic

* feat: enhance configuration documentation and clarify inline analysis cache behavior

* feat: implement panic recovery during analysis to continue scans past errors

* feat: add expectations configuration for taint analysis and performance metrics

* feat: enhance error handling and logging during file reading and mutex locking

* feat: add cross-file body loading tests and plumbing for CF-1 phase

* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures

* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality

* feat: enhance classification span handling in CFG and AST for improved source attribution

* feat: add new Express routes for handling user input and telemetry data

* feat: implement ternary expression handling in CFG with diamond structure for JS/TS

* feat: implement Phase CF-3 abstract-domain transfer channels in summaries

* feat: add support for string-prefix transfer in cross-file calls and update tests

* docs: reduce RESULTS.md doc size

* feat: implement Phase CF-4 per-return-path summary decomposition with tests

* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization

* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests

* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests

* refactor: update comments and documentation for clarity and consistency

* style: format code for consistency and readability

* refactor: simplify verdict handling and improve edge checking logic

* refactor: optimize path and identifier collection by avoiding unnecessary cloning

* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults

* refactor: update documentation and improve clarity in configuration files

* refactor: update documentation and improve clarity in configuration files

* feat: add JS/TS pass-2 convergence tests and expectations configuration

* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic

* feat: implement Phase 7 deduplication and alternative path linking for taint findings

* feat: implement structural DFS index for anonymous functions and update naming conventions

* feat: add Phase 8 regression tests for container-element taint in JS and Python

* feat: add engine-depth profiles and explain-engine option for CLI

* feat: update expectations and add new README fixtures for multi-file scan regression

* feat: implement Phase 11 callback-alias and factory patterns with regression tests

* feat: implement Terminator::Switch for multi-way dispatch and add regression tests

* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants

* refactor: extract cfg and ssa_transfer to submodules

* refactor: cargo fmt

* refactor: remove unnecessary blank line in cfg_tests.rs

* refactor: remove unnecessary planning file

* chore: update Rust version to 1.88 and bump dependencies in Cargo files

* feat: enhance triage UI with new layout and controls, update README for clarity

* feat: enhance triage UI with new layout and controls, update README for clarity

* chore: remove outdated section from README for version 0.5.0

* docs: improve clarity and consistency in README content

* chore: add "GPL-3.0-or-later" to license options in about.toml

* chore: update license handling in about.toml and check-licenses.mjs

* style: format code for improved readability in TriagePage component

* style: format code for improved readability in TriagePage component

* chore: enhance license handling and improve body_id scoping in seed lookup

* feat: introduce owner and parent body IDs for enhanced seed scoping

* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating

* feat: add Undef SSA operation for improved control-flow handling

* style: improve code formatting for consistency and readability in multiple files

* feat: add 16-function chain SCC across multiple files for enhanced analysis

* style: simplify code formatting for improved readability in multiple files

* fix: update CapHitReason default implementation and improve README clarity

* docs: enhance README with detailed explanations of taint analysis and limitations

* docs: refine README for clarity and consistency in taint analysis section

* style: improve code formatting for better readability in NewScanModal and scans

* fix: update cargo-about command to use --offline for deterministic license generation

* fix: update cargo-about command to use --offline for deterministic license generation

* ci: add step to prime cargo registry cache for deterministic license generation

* feat: add support for non-sink collections in authorization analysis

* feat: enhance authorization checks with row-level ownership equality and binding tracking

* feat: implement self-scoped user handling and enhance ownership checks

* refactor: simplify assertions and formatting in authorization analysis tests

* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure

* docs: update AI disclosure section for clarity and conciseness

* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure

* feat: enhance authorization analysis with SSA-derived variable type classification

* feat: implement auth_finding_to_diag function for enhanced security diagnostics

* feat: add args_value_refs to CallSite struct for enhanced argument tracking

* feat: add args_value_refs to CallSite struct for enhanced argument tracking

* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag

* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks

* feat: enhance error message handling in cli_validation_tests for better Windows compatibility

* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration

* feat: enhance release build process with SBOM generation and SLSA provenance

* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries

* feat: introduce PathFact handling for path safety checks and rejection logic

* feat: introduce PathFact handling for path safety checks and rejection logic

* feat: update benchmark data and enhance path sanitization logic with new safety checks

* feat: document AI assistance in frontend UI development and human review process

* feat: add return path facts for enhanced path safety checks and update documentation

* chore: update release date for version 0.5.0 in CHANGELOG.md

* chore: clean up ci.yml by removing outdated comments and clarifying steps

* feat: implement cross-language path sanitizers and validators for enhanced security

* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks

* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases

* refactor: simplify conditional formatting and improve code readability in executor and lower modules

* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues

* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers

* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers

* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests

* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs

---------

Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Eli Peter 2026-04-25 17:59:11 -04:00 • committed by GitHub
parent c4ce08b452
commit 41128177d2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2144 changed files with 201812 additions and 8927 deletions
Download patch file Download diff file Expand all files Collapse all files

272
src/utils/analysis_options.rs Normal file
View file

@ -0,0 +1,272 @@
//! Analysis-engine options: stable, serializable toggles that control which
//! analysis passes run inside the scanner.
//!
//! These are the release-grade knobs that used to live as ad-hoc `NYX_*`
//! environment variables (`NYX_CONSTRAINT`, `NYX_ABSTRACT_INTERP`, `NYX_SYMEX`,
//! `NYX_CROSS_FILE_SYMEX`, `NYX_SYMEX_INTERPROC`, `NYX_CONTEXT_SENSITIVE`,
//! `NYX_PARSE_TIMEOUT_MS`, `NYX_SMT`). They are now a single struct loaded
//! from the `[analysis.engine]` section of `nyx.conf` and overridable by CLI
//! flags.
//!
//! Engine code calls [`current`] to read the active options. Before a scan
//! begins, the CLI entry point installs a resolved [`AnalysisOptions`] via
//! [`install`]. Library consumers that never call `install` get
//! [`AnalysisOptions::default`], which is the documented release default.
//!
//! The legacy `NYX_*` variables still read **only** when no runtime has been
//! installed and serve as a last-resort override for library users; running
//! the `nyx` binary always goes through the configured runtime.
use serde::{Deserialize, Serialize};
use std::sync::RwLock;
/// Default parse timeout (milliseconds). See [`AnalysisOptions::parse_timeout_ms`].
pub const DEFAULT_PARSE_TIMEOUT_MS: u64 = 10_000;
/// Default upper bound on the number of taint origins tracked per lattice
/// value. Raised from the historical `4` to `32` so realistic codebases
/// with wide joins (many param sources, deep helper chains) no longer
/// silently drop origin attribution. Tunable via
/// [`AnalysisOptions::max_origins`] — see
/// `src/taint/ssa_transfer/state.rs::effective_max_origins`.
pub const DEFAULT_MAX_ORIGINS: u32 = 32;
/// Minimum permitted `max_origins` value. A cap of `0` would make origin
/// tracking impossible (every merge would truncate); the test override
/// still accepts `0` through its own path, but runtime config clamps to
/// at least `1` so production scans always carry *some* provenance.
pub const MIN_MAX_ORIGINS: u32 = 1;
/// Default upper bound on the number of abstract heap objects tracked per
/// intra-procedural points-to set. Set to `32` — high enough that
/// realistic factory/builder/DI patterns (routine 10–30 allocation sites
/// aliased into one variable) stay precise, low enough to keep
/// `HeapState` join/clone cost bounded in the worklist. Tunable via
/// [`AnalysisOptions::max_pointsto`] — see
/// `src/ssa/heap.rs::effective_max_pointsto`.
pub const DEFAULT_MAX_POINTSTO: u32 = 32;
/// Minimum permitted `max_pointsto` value. A cap of `0` would make
/// points-to tracking impossible; runtime config clamps to at least `1`.
pub const MIN_MAX_POINTSTO: u32 = 1;
/// Options for the symbolic-execution pipeline.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(default)]
pub struct SymexOptions {
/// Run the symex pass at all. When `false`, findings get no
/// `symbolic` verdict and cross-file body extraction is skipped.
pub enabled: bool,
/// Persist and consult cross-file SSA bodies so symex can model
/// callees defined in other files.
pub cross_file: bool,
/// Dive into intra-file callee bodies during symex (k ≥ 2 via the
/// interprocedural frame stack).
pub interprocedural: bool,
/// Use the SMT backend when available. Only meaningful when nyx is
/// compiled with the `smt` feature; silently ignored otherwise.
pub smt: bool,
}
impl Default for SymexOptions {
fn default() -> Self {
Self {
enabled: true,
cross_file: true,
interprocedural: true,
smt: true,
}
}
}
/// Stable configuration for the analysis engine.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(default)]
pub struct AnalysisOptions {
/// Path-constraint solving. Prunes infeasible paths from the taint
/// worklist and records unsat contexts in findings.
pub constraint_solving: bool,
/// Abstract interpretation: interval/string/bit domains carried through
/// the SSA worklist and used to suppress provably safe sinks.
pub abstract_interpretation: bool,
/// k=1 context-sensitive inlining for intra-file callees.
pub context_sensitive: bool,
/// Symbolic-execution pipeline.
pub symex: SymexOptions,
/// Demand-driven backwards taint analysis from sinks.
///
/// When enabled, after forward pass 2 completes, a backwards walk runs
/// from each sink's tainted SSA operands to corroborate or rule out the
/// forward finding. Corroborated findings get a `backwards-confirmed`
/// note; flows the backward walk proves infeasible get a
/// `backwards-infeasible` note that caps confidence. Defaults off.
pub backwards_analysis: bool,
/// Per-file tree-sitter parse timeout in milliseconds. `0` disables the
/// cap entirely (not recommended outside of controlled benchmarks).
pub parse_timeout_ms: u64,
/// Maximum taint origins retained per lattice value.
///
/// Controls both [`crate::taint::domain::VarTaint::origins`] and
/// the equivalent per-object bound inside the heap state. When a
/// merge would exceed this bound, origins are dropped deterministically
/// (sorted by source location) and an
/// [`crate::engine_notes::EngineNote::OriginsTruncated`] note is
/// recorded on the affected finding. Raising this reduces the
/// chance of silent under-reporting at the cost of slightly wider
/// lattice values. See [`DEFAULT_MAX_ORIGINS`].
pub max_origins: u32,
/// Maximum abstract heap objects retained per intra-procedural
/// points-to set.
///
/// When an allocation-site union would exceed this bound, the
/// largest-keyed heap objects are dropped and an
/// [`crate::engine_notes::EngineNote::PointsToTruncated`] note is
/// recorded. Taint flows that should have reached the dropped
/// objects via this aliasing path are lost (under-report). Raise
/// for factory-heavy codebases where truncation is observed; lower
/// only when points-to width is a measured bottleneck. See
/// [`DEFAULT_MAX_POINTSTO`].
pub max_pointsto: u32,
}
impl Default for AnalysisOptions {
fn default() -> Self {
Self {
constraint_solving: true,
abstract_interpretation: true,
context_sensitive: true,
symex: SymexOptions::default(),
backwards_analysis: false,
parse_timeout_ms: DEFAULT_PARSE_TIMEOUT_MS,
max_origins: DEFAULT_MAX_ORIGINS,
max_pointsto: DEFAULT_MAX_POINTSTO,
}
}
}
/// Process-wide installed options. Accessors fall back to
/// [`AnalysisOptions::default`] (with env-var overrides for backward
/// compatibility) until a caller installs a value.
///
/// A `RwLock` is used rather than a `OnceLock` so that long-lived callers
/// (notably `nyx serve`, which resolves the engine profile per scan
/// request) can replace the installed options between scans via
/// [`reinstall`]. Within a single scan run, engine toggles must not
/// change mid-flight — the caller is responsible for that invariant
/// (`JobManager`'s single-scan guarantee provides it in the server).
static RUNTIME: RwLock<Option<AnalysisOptions>> = RwLock::new(None);
/// Install the process-wide analysis options, first-wins. Subsequent
/// calls are a no-op and return `false`, matching the semantics the CLI
/// entry point relies on (one install per process lifetime for non-serve
/// commands). Servers that resolve options per request should use
/// [`reinstall`] instead.
pub fn install(opts: AnalysisOptions) -> bool {
let mut guard = RUNTIME.write().expect("analysis options RwLock poisoned");
if guard.is_some() {
return false;
}
*guard = Some(opts);
true
}
/// Replace the installed options unconditionally. Intended for the HTTP
/// server's scan thread, which re-resolves the engine profile from each
/// incoming request; `install`'s first-wins semantics would otherwise
/// pin the first scan's choice for the lifetime of the server. Callers
/// must ensure no scan is concurrently reading `current()` — in practice
/// this means calling `reinstall` before the scan's rayon pool starts.
pub fn reinstall(opts: AnalysisOptions) {
*RUNTIME.write().expect("analysis options RwLock poisoned") = Some(opts);
}
/// Read the active options. Returns the installed runtime when present,
/// otherwise defaults merged with env-var fallbacks (legacy path).
pub fn current() -> AnalysisOptions {
if let Some(rt) = *RUNTIME.read().expect("analysis options RwLock poisoned") {
return rt;
}
// Legacy env-var fallback: applies only when no runtime has been
// installed (primarily for library consumers and old tests). Logged
// at debug level so CI/test output isn't spammed.
AnalysisOptions {
constraint_solving: env_bool_default("NYX_CONSTRAINT", true),
abstract_interpretation: env_bool_default("NYX_ABSTRACT_INTERP", true),
context_sensitive: env_bool_default("NYX_CONTEXT_SENSITIVE", true),
symex: SymexOptions {
enabled: env_bool_default("NYX_SYMEX", true),
cross_file: env_bool_default("NYX_CROSS_FILE_SYMEX", true),
interprocedural: env_bool_default("NYX_SYMEX_INTERPROC", true),
smt: env_bool_default("NYX_SMT", true),
},
backwards_analysis: env_bool_default("NYX_BACKWARDS", false),
parse_timeout_ms: env_u64_default("NYX_PARSE_TIMEOUT_MS", DEFAULT_PARSE_TIMEOUT_MS),
max_origins: env_u32_default("NYX_MAX_ORIGINS", DEFAULT_MAX_ORIGINS).max(MIN_MAX_ORIGINS),
max_pointsto: env_u32_default("NYX_MAX_POINTSTO", DEFAULT_MAX_POINTSTO)
.max(MIN_MAX_POINTSTO),
}
}
fn env_bool_default(key: &str, default: bool) -> bool {
match std::env::var(key) {
Ok(v) => !(v == "0" || v.eq_ignore_ascii_case("false")),
Err(_) => default,
}
}
fn env_u64_default(key: &str, default: u64) -> u64 {
match std::env::var(key) {
Ok(v) => v.parse::<u64>().unwrap_or(default),
Err(_) => default,
}
}
fn env_u32_default(key: &str, default: u32) -> u32 {
match std::env::var(key) {
Ok(v) => v.parse::<u32>().unwrap_or(default),
Err(_) => default,
}
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn defaults_match_documented() {
let opts = AnalysisOptions::default();
assert!(opts.constraint_solving);
assert!(opts.abstract_interpretation);
assert!(opts.context_sensitive);
assert!(opts.symex.enabled);
assert!(opts.symex.cross_file);
assert!(opts.symex.interprocedural);
assert!(opts.symex.smt);
assert!(!opts.backwards_analysis, "backwards analysis defaults off");
assert_eq!(opts.parse_timeout_ms, DEFAULT_PARSE_TIMEOUT_MS);
assert_eq!(opts.max_origins, DEFAULT_MAX_ORIGINS);
assert_eq!(opts.max_pointsto, DEFAULT_MAX_POINTSTO);
}
#[test]
fn toml_roundtrip() {
let opts = AnalysisOptions {
constraint_solving: false,
abstract_interpretation: true,
context_sensitive: false,
symex: SymexOptions {
enabled: true,
cross_file: false,
interprocedural: true,
smt: false,
},
backwards_analysis: true,
parse_timeout_ms: 5_000,
max_origins: 64,
max_pointsto: 48,
};
let s = toml::to_string(&opts).unwrap();
let back: AnalysisOptions = toml::from_str(&s).unwrap();
assert_eq!(opts, back);
}
}

1134
src/utils/config.rs
View file

File diff suppressed because it is too large Load diff

75
src/utils/ext.rs
View file

@ -10,6 +10,7 @@ pub fn lowercase_ext(path: &std::path::Path) -> Option<&'static str> {
"ts" | "TSX" | "tsx" => Some("ts"),
"js" => Some("js"),
"rb" | "RB" => Some("rb"),
"ejs" | "EJS" => Some("ejs"),
_ => None,
})
}
@ -33,3 +34,77 @@ fn lowercase_ext_recognises_known_extensions() {
);
}
}
#[test]
fn lowercase_ext_all_supported_extensions() {
use std::path::Path;
let cases: &[(&str, &str)] = &[
("main.rs", "rs"),
("main.RS", "rs"),
("util.c", "c"),
("util.cpp", "cpp"),
("util.c++", "cpp"),
("App.java", "java"),
("server.go", "go"),
("index.php", "php"),
("script.py", "py"),
("script.PY", "py"),
("app.ts", "ts"),
("app.tsx", "ts"),
("app.TSX", "ts"),
("bundle.js", "js"),
("app.rb", "rb"),
("app.RB", "rb"),
];
for (file, expected) in cases {
assert_eq!(
lowercase_ext(Path::new(file)),
Some(*expected),
"file: {file}"
);
}
}
#[test]
fn lowercase_ext_unsupported_extensions_return_none() {
use std::path::Path;
let unsupported = [
"style.css",
"index.html",
"data.json",
"README.md",
"lock.lock",
"image.png",
];
for file in unsupported {
assert_eq!(lowercase_ext(Path::new(file)), None, "file: {file}");
}
}
#[test]
fn lowercase_ext_path_without_extension_returns_none() {
use std::path::Path;
assert_eq!(lowercase_ext(Path::new("Makefile")), None);
assert_eq!(lowercase_ext(Path::new("README")), None);
assert_eq!(lowercase_ext(Path::new("")), None);
}
#[test]
fn lowercase_ext_uses_final_extension_only() {
use std::path::Path;
// A file named "archive.tar.gz" has extension "gz", not "tar"
assert_eq!(lowercase_ext(Path::new("archive.tar.gz")), None);
// "backup.rs.bak" has extension "bak"
assert_eq!(lowercase_ext(Path::new("backup.rs.bak")), None);
}
#[test]
fn lowercase_ext_works_with_directory_prefixes() {
use std::path::Path;
assert_eq!(lowercase_ext(Path::new("src/main.rs")), Some("rs"));
assert_eq!(
lowercase_ext(Path::new("/absolute/path/to/app.py")),
Some("py")
);
assert_eq!(lowercase_ext(Path::new("a/b/c/d.js")), Some("js"));
}

5
src/utils/mod.rs
View file

@ -1,7 +1,10 @@
pub mod analysis_options;
pub mod config;
pub(crate) mod ext;
pub mod path;
pub mod project;
pub(crate) mod query_cache;
pub use analysis_options::{AnalysisOptions, SymexOptions};
pub use config::Config;
pub use project::get_project_info;
pub use project::{detect_frameworks, get_project_info};

235
src/utils/path.rs Normal file
View file

@ -0,0 +1,235 @@
use std::fs::{self, File};
use std::io::{self, BufReader, Read};
use std::path::{Path, PathBuf};
pub const DEFAULT_UI_MAX_FILE_BYTES: u64 = 5 * 1024 * 1024;
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum RepoPathError {
InvalidPath,
NotFound,
OutsideRoot,
NotFile,
NotDirectory,
TooLarge,
InvalidText,
Io,
}
#[derive(Debug, Clone)]
pub struct ResolvedRepoPath {
pub root: PathBuf,
pub canonical: PathBuf,
pub relative: String,
}
#[derive(Debug, Clone)]
pub struct OpenedTextFile {
pub resolved: ResolvedRepoPath,
pub content: String,
}
fn contains_parent_traversal(path: &str) -> bool {
Path::new(path)
.components()
.any(|component| matches!(component, std::path::Component::ParentDir))
}
fn io_error_kind(err: &io::Error) -> RepoPathError {
match err.kind() {
io::ErrorKind::NotFound => RepoPathError::NotFound,
_ => RepoPathError::Io,
}
}
pub fn canonicalize_root(scan_root: &Path) -> Result<PathBuf, RepoPathError> {
fs::canonicalize(scan_root).map_err(|err| io_error_kind(&err))
}
pub fn resolve_repo_path(
scan_root: &Path,
requested: &str,
) -> Result<ResolvedRepoPath, RepoPathError> {
if requested.is_empty() || contains_parent_traversal(requested) {
return Err(RepoPathError::InvalidPath);
}
let root = canonicalize_root(scan_root)?;
let requested_path = Path::new(requested);
let target = if requested_path.is_absolute() {
requested_path.to_path_buf()
} else {
root.join(requested_path)
};
let canonical = fs::canonicalize(&target).map_err(|err| io_error_kind(&err))?;
if !canonical.starts_with(&root) {
return Err(RepoPathError::OutsideRoot);
}
let relative = canonical
.strip_prefix(&root)
.unwrap_or(Path::new(""))
.to_string_lossy()
.trim_start_matches(std::path::MAIN_SEPARATOR)
.to_string();
Ok(ResolvedRepoPath {
root,
canonical,
relative,
})
}
pub fn resolve_repo_dir(
scan_root: &Path,
requested: Option<&str>,
) -> Result<ResolvedRepoPath, RepoPathError> {
let resolved = match requested {
Some(path) if !path.is_empty() => resolve_repo_path(scan_root, path)?,
_ => {
let root = canonicalize_root(scan_root)?;
ResolvedRepoPath {
relative: String::new(),
canonical: root.clone(),
root,
}
}
};
let metadata = fs::metadata(&resolved.canonical).map_err(|err| io_error_kind(&err))?;
if !metadata.file_type().is_dir() {
return Err(RepoPathError::NotDirectory);
}
Ok(resolved)
}
pub fn open_repo_text_file(
scan_root: &Path,
requested: &str,
max_bytes: u64,
) -> Result<OpenedTextFile, RepoPathError> {
let resolved = resolve_repo_path(scan_root, requested)?;
let metadata = fs::metadata(&resolved.canonical).map_err(|err| io_error_kind(&err))?;
if !metadata.file_type().is_file() {
return Err(RepoPathError::NotFile);
}
if metadata.len() > max_bytes {
return Err(RepoPathError::TooLarge);
}
let file = File::open(&resolved.canonical).map_err(|err| io_error_kind(&err))?;
let mut reader = BufReader::new(file);
let mut content = String::new();
reader
.read_to_string(&mut content)
.map_err(|err| match err.kind() {
io::ErrorKind::InvalidData => RepoPathError::InvalidText,
_ => RepoPathError::Io,
})?;
Ok(OpenedTextFile { resolved, content })
}
pub fn path_stays_within_root(scan_root: &Path, path: &Path) -> Result<bool, RepoPathError> {
let root = canonicalize_root(scan_root)?;
let canonical = fs::canonicalize(path).map_err(|err| io_error_kind(&err))?;
Ok(canonical.starts_with(&root))
}
#[cfg(test)]
mod tests {
use super::*;
use std::fs;
#[test]
fn resolve_repo_path_accepts_relative_paths() {
let dir = tempfile::tempdir().unwrap();
let file = dir.path().join("src").join("main.rs");
fs::create_dir_all(file.parent().unwrap()).unwrap();
fs::write(&file, "fn main() {}").unwrap();
let resolved = resolve_repo_path(dir.path(), "src/main.rs").unwrap();
assert_eq!(resolved.relative, "src/main.rs");
assert_eq!(resolved.canonical, fs::canonicalize(file).unwrap());
}
#[test]
fn resolve_repo_path_accepts_absolute_paths_inside_root() {
let dir = tempfile::tempdir().unwrap();
let file = dir.path().join("main.rs");
fs::write(&file, "fn main() {}").unwrap();
let resolved = resolve_repo_path(dir.path(), file.to_string_lossy().as_ref()).unwrap();
assert_eq!(resolved.relative, "main.rs");
}
#[test]
fn resolve_repo_path_rejects_parent_traversal() {
let dir = tempfile::tempdir().unwrap();
let err = resolve_repo_path(dir.path(), "../secret").unwrap_err();
assert_eq!(err, RepoPathError::InvalidPath);
}
#[test]
fn resolve_repo_path_rejects_absolute_paths_outside_root() {
let dir = tempfile::tempdir().unwrap();
let outside = tempfile::NamedTempFile::new().unwrap();
let err =
resolve_repo_path(dir.path(), outside.path().to_string_lossy().as_ref()).unwrap_err();
assert_eq!(err, RepoPathError::OutsideRoot);
}
#[cfg(unix)]
#[test]
fn resolve_repo_path_rejects_symlink_escape() {
use std::os::unix::fs::symlink;
let dir = tempfile::tempdir().unwrap();
let outside = tempfile::tempdir().unwrap();
let outside_file = outside.path().join("secret.txt");
fs::write(&outside_file, "secret").unwrap();
let link = dir.path().join("escape.txt");
symlink(&outside_file, &link).unwrap();
let err = resolve_repo_path(dir.path(), "escape.txt").unwrap_err();
assert_eq!(err, RepoPathError::OutsideRoot);
}
#[test]
fn open_repo_text_file_rejects_directories() {
let dir = tempfile::tempdir().unwrap();
let err = open_repo_text_file(dir.path(), ".", DEFAULT_UI_MAX_FILE_BYTES).unwrap_err();
assert_eq!(err, RepoPathError::NotFile);
}
#[cfg(unix)]
#[test]
fn open_repo_text_file_rejects_unix_sockets() {
use std::os::unix::net::UnixListener;
let dir = tempfile::tempdir().unwrap();
let socket_path = dir.path().join("scanner.sock");
let Ok(_listener) = UnixListener::bind(&socket_path) else {
return;
};
let err =
open_repo_text_file(dir.path(), "scanner.sock", DEFAULT_UI_MAX_FILE_BYTES).unwrap_err();
assert_eq!(err, RepoPathError::NotFile);
}
#[test]
fn open_repo_text_file_rejects_oversized_files() {
let dir = tempfile::tempdir().unwrap();
let file = dir.path().join("big.txt");
fs::write(&file, "123456").unwrap();
let err = open_repo_text_file(dir.path(), "big.txt", 5).unwrap_err();
assert_eq!(err, RepoPathError::TooLarge);
}
}

461
src/utils/project.rs
View file

@ -1,4 +1,8 @@
#![allow(clippy::collapsible_if)]
use crate::errors::{NyxError, NyxResult};
use std::fs;
use std::io::Read;
use std::path::{Path, PathBuf};
/// Determine `<project-name, path/to/<project>.sqlite>`.
@ -29,6 +33,206 @@ pub fn sanitize_project_name(name: &str) -> String {
.join("_")
}
/// A web framework detected from project manifests.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub enum DetectedFramework {
Express,
Koa,
Fastify,
React,
Flask,
Django,
Spring,
Gin,
Echo,
Laravel,
Rails,
Sinatra,
ActixWeb,
Rocket,
Axum,
}
/// Frameworks detected in the project root.
#[derive(Debug, Clone, Default)]
pub struct FrameworkContext {
pub frameworks: Vec<DetectedFramework>,
}
impl FrameworkContext {
pub fn has(&self, fw: DetectedFramework) -> bool {
self.frameworks.contains(&fw)
}
}
/// Maximum bytes to read from each manifest file.
const MANIFEST_READ_LIMIT: usize = 64 * 1024;
/// Read up to `MANIFEST_READ_LIMIT` bytes from a file.
fn read_bounded(path: &Path) -> Option<String> {
let file = fs::File::open(path).ok()?;
let mut reader = std::io::BufReader::new(file).take(MANIFEST_READ_LIMIT as u64);
let mut out = String::new();
reader.read_to_string(&mut out).ok()?;
Some(out)
}
/// Scan file source bytes for import statements referencing known web
/// frameworks. Used to augment the project-level [`FrameworkContext`] with
/// per-file signals, so that single-file scans (no package.json / go.mod /
/// Gemfile nearby) still trigger framework-conditional rules.
///
/// Intentionally a coarse byte-level substring check against the quoted module
/// specifier (e.g. `'fastify'`, `"github.com/labstack/echo/v4"`,
/// `'sinatra'`). Only the first 8 KiB of the file are inspected — imports /
/// requires live at the top. Returns an empty list for languages without a
/// framework detection policy here.
pub fn detect_in_file_frameworks(bytes: &[u8], lang_slug: &str) -> Vec<DetectedFramework> {
let head_len = bytes.len().min(8 * 1024);
let head = match std::str::from_utf8(&bytes[..head_len]) {
Ok(s) => s,
Err(_) => return Vec::new(),
};
let matches_module = |name: &str| {
// Quoted single or double, as appears in `from 'fastify'` /
// `require("fastify")` / `import('fastify')` / `require 'sinatra'`.
head.contains(&format!("'{name}'")) || head.contains(&format!("\"{name}\""))
};
let mut fws = Vec::new();
match lang_slug {
"javascript" | "typescript" | "js" | "ts" => {
if matches_module("fastify") {
fws.push(DetectedFramework::Fastify);
}
if matches_module("express") {
fws.push(DetectedFramework::Express);
}
if matches_module("koa")
|| matches_module("@koa/router")
|| matches_module("koa-router")
{
fws.push(DetectedFramework::Koa);
}
}
"go" => {
// Go imports are quoted module paths. Match a distinctive prefix
// so any major version (`/v3`, `/v4`, …) still detects.
if head.contains("\"github.com/labstack/echo") {
fws.push(DetectedFramework::Echo);
}
if head.contains("\"github.com/gin-gonic/gin\"") {
fws.push(DetectedFramework::Gin);
}
}
"ruby" | "rb" => {
// Ruby requires: `require 'sinatra'` or `require 'sinatra/base'`.
if matches_module("sinatra") || matches_module("sinatra/base") {
fws.push(DetectedFramework::Sinatra);
}
// Rails apps don't always `require 'rails'` directly (they load
// via config/boot.rb), but when they do, surface it.
if matches_module("rails") || matches_module("rails/all") {
fws.push(DetectedFramework::Rails);
}
}
_ => {}
}
fws
}
/// Detect frameworks from manifest files in the project root.
pub fn detect_frameworks(root: &Path) -> FrameworkContext {
let mut fws = Vec::new();
// ── Node.js (package.json) ──
if let Some(content) = read_bounded(&root.join("package.json")) {
// Crude substring search in the "dependencies" block area.
// Good enough for detection — no JSON parsing overhead.
if content.contains("\"express\"") {
fws.push(DetectedFramework::Express);
}
if (content.contains("\"koa\"")
|| content.contains("\"@koa/router\"")
|| content.contains("\"koa-router\""))
&& !fws.contains(&DetectedFramework::Koa)
{
fws.push(DetectedFramework::Koa);
}
if content.contains("\"fastify\"") && !fws.contains(&DetectedFramework::Fastify) {
fws.push(DetectedFramework::Fastify);
}
if content.contains("\"react\"") {
fws.push(DetectedFramework::React);
}
}
// ── Python ──
for name in &["requirements.txt", "Pipfile", "pyproject.toml"] {
if let Some(content) = read_bounded(&root.join(name)) {
let lower = content.to_ascii_lowercase();
if lower.contains("flask") && !fws.contains(&DetectedFramework::Flask) {
fws.push(DetectedFramework::Flask);
}
if lower.contains("django") && !fws.contains(&DetectedFramework::Django) {
fws.push(DetectedFramework::Django);
}
}
}
// ── Java (Maven / Gradle) ──
for name in &["pom.xml", "build.gradle", "build.gradle.kts"] {
if let Some(content) = read_bounded(&root.join(name)) {
if (content.contains("spring-boot") || content.contains("spring-web"))
&& !fws.contains(&DetectedFramework::Spring)
{
fws.push(DetectedFramework::Spring);
}
}
}
// ── Go (go.mod) ──
if let Some(content) = read_bounded(&root.join("go.mod")) {
if content.contains("gin-gonic/gin") {
fws.push(DetectedFramework::Gin);
}
if content.contains("labstack/echo") {
fws.push(DetectedFramework::Echo);
}
}
// ── PHP (composer.json) ──
if let Some(content) = read_bounded(&root.join("composer.json")) {
if content.contains("laravel/framework") {
fws.push(DetectedFramework::Laravel);
}
}
// ── Ruby (Gemfile) ──
if let Some(content) = read_bounded(&root.join("Gemfile")) {
if content.contains("'rails'") || content.contains("\"rails\"") {
fws.push(DetectedFramework::Rails);
}
if content.contains("'sinatra'") || content.contains("\"sinatra\"") {
fws.push(DetectedFramework::Sinatra);
}
}
// ── Rust (Cargo.toml) ──
if let Some(content) = read_bounded(&root.join("Cargo.toml")) {
if content.contains("actix-web") {
fws.push(DetectedFramework::ActixWeb);
}
if content.contains("rocket") && !fws.contains(&DetectedFramework::Rocket) {
fws.push(DetectedFramework::Rocket);
}
if content.contains("axum") {
fws.push(DetectedFramework::Axum);
}
}
FrameworkContext { frameworks: fws }
}
#[test]
fn sanitize_project_name_is_idempotent_and_lossless_enough() {
let samples = [
@ -60,3 +264,260 @@ fn get_project_info_uses_sanitized_name_in_sqlite_path() {
assert_eq!(project_name, "Example Project");
assert_eq!(db_path, root.join("example_project.sqlite"));
}
#[test]
fn detect_frameworks_from_package_json() {
let tmp = tempfile::tempdir().unwrap();
let root = tmp.path();
fs::write(
root.join("package.json"),
r#"{"dependencies": {"express": "^4.18.0", "koa": "^2.15.0", "fastify": "^4.0.0", "react": "^18.0.0"}}"#,
)
.unwrap();
let ctx = detect_frameworks(root);
assert!(ctx.has(DetectedFramework::Express));
assert!(ctx.has(DetectedFramework::Koa));
assert!(ctx.has(DetectedFramework::Fastify));
assert!(ctx.has(DetectedFramework::React));
assert!(!ctx.has(DetectedFramework::Flask));
}
#[test]
fn detect_frameworks_empty_dir() {
let tmp = tempfile::tempdir().unwrap();
let ctx = detect_frameworks(tmp.path());
assert!(ctx.frameworks.is_empty());
}
#[test]
fn detect_frameworks_gemfile_rails() {
let tmp = tempfile::tempdir().unwrap();
let root = tmp.path();
fs::write(root.join("Gemfile"), "gem 'rails', '~> 7.0'\ngem 'puma'\n").unwrap();
let ctx = detect_frameworks(root);
assert!(ctx.has(DetectedFramework::Rails));
assert!(!ctx.has(DetectedFramework::Sinatra));
}
#[test]
fn detect_frameworks_gemfile_sinatra() {
let tmp = tempfile::tempdir().unwrap();
let root = tmp.path();
fs::write(root.join("Gemfile"), "gem 'sinatra'\ngem 'puma'\n").unwrap();
let ctx = detect_frameworks(root);
assert!(ctx.has(DetectedFramework::Sinatra));
assert!(!ctx.has(DetectedFramework::Rails));
}
#[test]
fn detect_frameworks_python_flask_from_requirements() {
let tmp = tempfile::tempdir().unwrap();
let root = tmp.path();
fs::write(
root.join("requirements.txt"),
"Flask==2.3.0\nrequests>=2.28\n",
)
.unwrap();
let ctx = detect_frameworks(root);
assert!(ctx.has(DetectedFramework::Flask));
assert!(!ctx.has(DetectedFramework::Django));
}
#[test]
fn detect_frameworks_python_django_from_pyproject() {
let tmp = tempfile::tempdir().unwrap();
let root = tmp.path();
fs::write(
root.join("pyproject.toml"),
"[project]\nname = \"myapp\"\ndependencies = [\"django>=4.0\"]\n",
)
.unwrap();
let ctx = detect_frameworks(root);
assert!(ctx.has(DetectedFramework::Django));
assert!(!ctx.has(DetectedFramework::Flask));
}
#[test]
fn detect_frameworks_go_mod_gin() {
let tmp = tempfile::tempdir().unwrap();
let root = tmp.path();
fs::write(
root.join("go.mod"),
"module example.com/app\n\nrequire (\n\tgithub.com/gin-gonic/gin v1.9.0\n)\n",
)
.unwrap();
let ctx = detect_frameworks(root);
assert!(ctx.has(DetectedFramework::Gin));
assert!(!ctx.has(DetectedFramework::Echo));
}
#[test]
fn detect_frameworks_go_mod_echo() {
let tmp = tempfile::tempdir().unwrap();
let root = tmp.path();
fs::write(
root.join("go.mod"),
"module example.com/app\n\nrequire (\n\tgithub.com/labstack/echo/v4 v4.11.0\n)\n",
)
.unwrap();
let ctx = detect_frameworks(root);
assert!(ctx.has(DetectedFramework::Echo));
assert!(!ctx.has(DetectedFramework::Gin));
}
#[test]
fn detect_frameworks_java_spring_from_pom_xml() {
let tmp = tempfile::tempdir().unwrap();
let root = tmp.path();
fs::write(
root.join("pom.xml"),
"<project>\n <dependencies>\n <dependency>\n <groupId>org.springframework.boot</groupId>\n <artifactId>spring-boot-starter-web</artifactId>\n </dependency>\n </dependencies>\n</project>\n",
)
.unwrap();
let ctx = detect_frameworks(root);
assert!(ctx.has(DetectedFramework::Spring));
}
#[test]
fn detect_frameworks_java_spring_from_build_gradle() {
let tmp = tempfile::tempdir().unwrap();
let root = tmp.path();
fs::write(
root.join("build.gradle"),
"plugins {\n id 'org.springframework.boot' version '3.1.0'\n}\ndependencies {\n implementation 'org.springframework.boot:spring-web:3.1.0'\n}\n",
)
.unwrap();
let ctx = detect_frameworks(root);
assert!(ctx.has(DetectedFramework::Spring));
}
#[test]
fn detect_frameworks_php_laravel_from_composer_json() {
let tmp = tempfile::tempdir().unwrap();
let root = tmp.path();
fs::write(
root.join("composer.json"),
r#"{"require": {"laravel/framework": "^10.0", "php": "^8.1"}}"#,
)
.unwrap();
let ctx = detect_frameworks(root);
assert!(ctx.has(DetectedFramework::Laravel));
}
#[test]
fn detect_frameworks_rust_axum_from_cargo_toml() {
let tmp = tempfile::tempdir().unwrap();
let root = tmp.path();
fs::write(
root.join("Cargo.toml"),
"[dependencies]\naxum = \"0.7\"\ntokio = { version = \"1\", features = [\"full\"] }\n",
)
.unwrap();
let ctx = detect_frameworks(root);
assert!(ctx.has(DetectedFramework::Axum));
assert!(!ctx.has(DetectedFramework::ActixWeb));
assert!(!ctx.has(DetectedFramework::Rocket));
}
#[test]
fn detect_frameworks_rust_actix_web_from_cargo_toml() {
let tmp = tempfile::tempdir().unwrap();
let root = tmp.path();
fs::write(
root.join("Cargo.toml"),
"[dependencies]\nactix-web = \"4\"\n",
)
.unwrap();
let ctx = detect_frameworks(root);
assert!(ctx.has(DetectedFramework::ActixWeb));
}
#[test]
fn detect_frameworks_multiple_in_same_project() {
let tmp = tempfile::tempdir().unwrap();
let root = tmp.path();
// A project using both Express and React
fs::write(
root.join("package.json"),
r#"{"dependencies": {"express": "^4", "@koa/router": "^12", "fastify": "^4", "react": "^18"}}"#,
)
.unwrap();
let ctx = detect_frameworks(root);
assert!(ctx.has(DetectedFramework::Express));
assert!(ctx.has(DetectedFramework::Koa));
assert!(ctx.has(DetectedFramework::Fastify));
assert!(ctx.has(DetectedFramework::React));
assert_eq!(ctx.frameworks.len(), 4);
}
#[test]
fn sanitize_project_name_numeric_and_special() {
assert_eq!(sanitize_project_name("project123"), "project123");
assert_eq!(sanitize_project_name("123"), "123");
assert_eq!(sanitize_project_name("a.b.c"), "a_b_c");
// hyphens are preserved as-is (only underscores are collapsed)
assert_eq!(sanitize_project_name("a--b"), "a--b");
// Leading/trailing underscores from replacements get collapsed
assert_eq!(sanitize_project_name("__init__"), "init");
}
#[test]
fn get_project_info_returns_error_for_root_path() {
let tmp = tempfile::tempdir().unwrap();
// A path that ends with "/" (root) has no file_name
let result = get_project_info(std::path::Path::new("/"), tmp.path());
assert!(result.is_err());
}
#[test]
fn framework_context_has_is_false_for_absent_framework() {
let ctx = FrameworkContext::default();
assert!(!ctx.has(DetectedFramework::Express));
assert!(!ctx.has(DetectedFramework::Flask));
assert!(!ctx.has(DetectedFramework::Spring));
}
#[test]
fn detect_in_file_frameworks_go_echo() {
let src = b"package main\nimport (\n\t\"net/http\"\n\t\"github.com/labstack/echo/v4\"\n)\nfunc x() {}\n";
let fws = detect_in_file_frameworks(src, "go");
assert!(fws.contains(&DetectedFramework::Echo));
assert!(!fws.contains(&DetectedFramework::Gin));
}
#[test]
fn detect_in_file_frameworks_go_gin() {
let src = b"package main\nimport \"github.com/gin-gonic/gin\"\n";
let fws = detect_in_file_frameworks(src, "go");
assert!(fws.contains(&DetectedFramework::Gin));
assert!(!fws.contains(&DetectedFramework::Echo));
}
#[test]
fn detect_in_file_frameworks_ruby_sinatra() {
let src = b"require 'sinatra'\nget '/' do\n 'hi'\nend\n";
let fws = detect_in_file_frameworks(src, "ruby");
assert!(fws.contains(&DetectedFramework::Sinatra));
assert!(!fws.contains(&DetectedFramework::Rails));
}
#[test]
fn detect_in_file_frameworks_ruby_sinatra_base() {
let src = b"require \"sinatra/base\"\nclass App < Sinatra::Base; end\n";
let fws = detect_in_file_frameworks(src, "ruby");
assert!(fws.contains(&DetectedFramework::Sinatra));
}
#[test]
fn detect_in_file_frameworks_plain_go_no_framework() {
let src = b"package main\nimport \"fmt\"\nfunc main() { fmt.Println(\"hi\") }\n";
let fws = detect_in_file_frameworks(src, "go");
assert!(fws.is_empty());
}
#[test]
fn detect_in_file_frameworks_plain_ruby_no_framework() {
let src = b"require 'json'\nputs JSON.parse('{}')\n";
let fws = detect_in_file_frameworks(src, "ruby");
assert!(fws.is_empty());
}

12
src/utils/query_cache.rs
View file

@ -17,9 +17,17 @@ static CACHE: LazyLock<RwLock<HashMap<&'static str, QuerySet>>> =
/// Return **one shared Arc** to the per-language query set.
/// Cloning the `Arc` is O(1) and the underlying Vec lives for the
/// lifetime of the process.
///
/// Malformed tree-sitter queries do not panic: each invalid pattern is
/// dropped via `filter_map` with a warn-level log, and the remaining
/// patterns for the language are cached normally. A language with an
/// all-malformed pattern slice yields an empty cache entry.
///
/// Lock poisoning on the shared cache is recovered transparently — a
/// panic in another thread must not brick pattern loading process-wide.
pub fn for_lang(lang: &'static str, ts_lang: Language) -> std::sync::Arc<Vec<CompiledQuery>> {
// fast path
if let Some(v) = CACHE.read().unwrap().get(lang) {
if let Some(v) = CACHE.read().unwrap_or_else(|p| p.into_inner()).get(lang) {
return v.clone();
}
@ -41,6 +49,6 @@ pub fn for_lang(lang: &'static str, ts_lang: Language) -> std::sync::Arc<Vec<Com
let compiled = std::sync::Arc::new(compiled);
let mut w = CACHE.write().unwrap();
let mut w = CACHE.write().unwrap_or_else(|p| p.into_inner());
w.entry(lang).or_insert_with(|| compiled.clone()).clone()
}