apunkt/nyx
1
0
Fork 0
mirror of https://github.com/elicpeter/nyx.git synced 2026-07-15 21:11:02 +02:00
Code Issues Projects Releases Packages Wiki Activity

Release/0.5.0 (#35)

Browse source 
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures

* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests

* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements

* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles

* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing

* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling

* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures

* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration

* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests

* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic

* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection

* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements

* feat: Enable auth-state analysis by default and update relevant tests in benchmark config

* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test

* docs: update CHANGELOG.md

* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers

* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers

* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse

* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation

* feat: Refactor function parameters and constants for improved clarity and maintainability

* refactor: Reorder module imports and improve formatting for consistency

* refactor: Fix formatting erorrs

* refactor: Fix clippy warnings

* refactor: Fix fmt warnings (again)

* chore: Update dependencies and improve feature configuration

* Add comprehensive tests for undertested modules (#36) (COPILOT)

* Add comprehensive tests for undertested modules

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083

* Add comprehensive tests for ext, project, walk, and errors modules

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* chore: Update dependencies and improve feature configuration

* fix: formatting errors in new tests

* chore: Update license list in about.toml

* chore: made functions input inline

* chore: updated cfg graph to take up the full page

* chore: add Prettier configuration and update code formatting

* Add frontend test suite with Vitest (111 tests) (#37)

* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7

* ci: add frontend test step to CI workflow

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* chore: simplify array initialization in test files for consistency

* ran typecheck

* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage

* feat: update routing in AppLayout and improve empty state message in ExplorerPage

* feat: enhance scan progress tracking with additional metrics and stages

* feat: update license information and add license check script

* feat: implement cross-file symbolic execution with callee body persistence

* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering

* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions

* feat: enhance resource tracking with proxy method summaries and improve finding extraction

* feat: add terminal function exit detection for accurate resource leak analysis

* feat: add warnings for loops and functions without bodies to improve error recovery

* feat: update lambda expression handling to ensure proper function classification and control flow

* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling

* feat: add inline return taint analysis and regression tests for improved security checks

* feat: add engine version management and migration handling for database schema updates

* feat: enhance first_call_ident to skip nested function bodies and add regression tests

* feat: enhance callee name resolution with two-segment normalization and disambiguation

* feat: add cross-file context flags and debug assertions for taint analysis

* feat: refactor taint analysis structure to unify context handling and improve clarity

* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests

* docs: updated CHANGELOG.md

* fmt: formatting fixes

* fix: fixed frontend formatting and lint warnings

* fix: optimized ci

* fix: optimized ci

* Add comprehensive multi-file test coverage to Nyx (#38)

* Initial checklist for multi-file test suite expansion

Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage

Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* deleted root repo

* rebuilt to test for regressions

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>

* feat: enhance import alias resolution and taint tracking

* feat: implement security hardening with CSRF protection and path validation

* feat: add support for import alias bindings in Python, PHP, and Rust

* feat: enhance CFG analysis modes and improve code readability

* feat: add detection for parameterized SQL queries to enhance security

* feat: add safe internal redirect handling and enhance session destroy validation

* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads

* feat: enhance taint detection by adding support for inline source member expressions in call arguments

* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments

* feat: add support for Throw statement in control flow and error handling

* feat: add debug and echo endpoints with potential information leakage

* feat: implement internal redirect suppression and enhance taint detection

* feat: implement module alias tracking for dynamic dispatch in JS/TS

* feat: add authorization analysis module with Express support

* feat: add authorization analysis module with Express support

* feat: add tests for admin guard requirements and clean checks in authorization analysis

* feat: integrate Koa and Fastify frameworks into authorization analysis

* feat: add Flask and Django support to authorization analysis module

* feat: add support for Rails and Sinatra frameworks in authorization analysis

* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis

* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis

* feat: add support for Rails and Sinatra in authorization analysis

* chore: add .DS_Store to .gitignore

* refactor: simplify conditional checks and improve readability in multiple files

* refactor: update usage of Option methods for improved clarity and consistency

* refactor: improve code readability by simplifying conditional checks and formatting

* refactor: improve code formatting and readability by simplifying conditional checks

* refactor: simplify conditional checks and improve readability in multiple files

* refactor: simplify conditional checks in axum.rs for improved readability

* feat: add CodeQL analysis configuration for enhanced security scanning

* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)

* chore: start test coverage improvement work

Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* test: add comprehensive tests for src/output.rs SARIF builder

Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* refactor: improve code formatting and readability in output.rs

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>

* refactor: improve code formatting and readability in output.rs

* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* refactor: enhance triage file path handling with improved error management and validation

* refactor: updated func summaries for richer detail

* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries

* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution

* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls

* refactor: implement new Flask routes for safe and unsafe shell command execution

* refactor: separate receiver handling in SSA operations and enhance taint propagation

* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments

* refactor: implement auth decorator extraction and classification for multiple languages

* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation

* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic

* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior

* refactor: standardize default struct initialization across multiple files

* feat: add scripts for formatting checks and auto-fixes with test summaries

* refactor: simplify character splitting and enhance namespace qualifier handling

* refactor: improve documentation clarity and enhance code readability in resolver logic

* refactor: replace default struct initialization with explicit field assignments for clarity

* feat: enhance anonymous function naming by deriving context-based bindings

* refactor: streamline match expressions for improved readability and performance

* refactor: streamline match expressions for improved readability and performance

* refactor: replace loop with while let for improved clarity and performance

* feat: add SSA constant propagation support to analysis context for improved accuracy

* feat: add SSA constant propagation support to analysis context for improved accuracy

* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis

* feat: add static map analysis for command injection suppression and type safety

* refactor: simplify match statements and reduce line breaks for improved readability

* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution

Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.

Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.

Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.

Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.

Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding

Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet.  SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.

Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.

Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`.  `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters.  Dedup key extended with the primary location
so multi-site events aren't collapsed back together.

Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
  != ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
  non-empty `file_rel` — the cap-only → None translation upstream
  guarantees this.

Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved.  A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.

build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.

Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing).  All 1566 lib
tests + integration tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(output): phase 3/5 consume primary sink location in diag + SARIF

When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.

Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
  resolved back to an absolute path via a shared resolve_file_rel
  helper. Empty file_rel (single-file scans where namespace == "")
  resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
  SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
  file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
  locations[0] already reflects the primary sink position via the
  updated diag line/col.

Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.

Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
  the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
  inside the closure).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(bench): phase 4/5 validate primary sink attribution across corpus

Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.

Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
  Case. When present, score_location_level additionally requires at
  least one flow_step in the finding's evidence trace to fall within
  ±2 of the call-site range. When absent, the check is skipped —
  fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
  now-primary Diag.line post-phase-3).

Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
  transform::wrap call site (a cross-file propagator, not a sink);
  line 9 is Command::new, the real sink. The ±2 tolerance happened to
  mask this stale attribution but it was semantically wrong — phase 4
  is the right time to correct it. Also adds expected_call_site_lines
  [8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
  This fixture's sink (Command::new inside run_cmd at line 5) was the
  motivating case for phases 1-3; adding the call-site assertion
  guards against regression to caller-line attribution.

New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
  takes two tainted params and invokes two Command sinks on
  consecutive lines. Locks in that primary line lands inside the
  helper (lines 5-6), not at the caller (line 12). Notes document
  that SinkSite is currently one-per-callee so both findings today
  collapse onto the first sink; expected_sink_lines=[5,6] and
  expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
  004): sink os.system lives in helper.py (cross-file), caller in
  app.py reads env source and calls run_cmd. Verifies phase 3's
  cross-file primary attribution: Diag.path = helper.py, Diag.line =
  5, with app.py:7 recorded in flow_steps as a Call step.

Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
  pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
  TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
  F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
  264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test

Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body.  Asserts the
resulting Finding.primary_location is exactly that triple.

The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file.  This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.

Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).

Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor: clean up formatting and improve readability in multiple files

* refactor: simplify type definition for deduplication key in findings

* test(harness): add must_not_match expectation for FP regression guards

Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules

* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking

* feat: update switch statement handling to improve control flow analysis

* feat: implement promisify alias handling for JS/TS to enhance taint tracking

* feat: enhance taint tracking by refining expectation handling and adding mode filtering

* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters

* feat: update taint tracking rules to enforce full mode matching and improve flow analysis

* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis

* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding

* feat: refine framework detection and update expectation handling for Echo and Sinatra

* feat: implement max_count for taint tracking expectations and deduplicate findings

* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files

* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity

* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files

* feat: add structural invariant checks for SSA bodies

* feat: ensure deterministic phi emission order using BTreeSet

* feat: enhance handling of terminators to ensure authoritative flow through successor edges

* feat: enhance Goto terminator handling to ensure all successors are marked executable

* feat: refactor code for improved readability and organization

* feat: simplify predicate checks and enhance readability in SSA handling

* feat: implement per-file parse timeout and enhance file size handling

* feat: migrate analysis engine toggles from environment variables to configuration file

* feat: remove unnecessary whitespace in hostile_input_tests.rs

* feat: remove unnecessary whitespace in hostile_input_tests.rs

* feat: update dependencies and enhance documentation on language maturity

* feat: enhance security headers and improve request body limits

* feat: implement sink capability bits for deduplication and enhance evidence tagging

* feat: implement dynamic activation handling for gated sinks and enhance validation logic

* feat: enhance configuration documentation and clarify inline analysis cache behavior

* feat: implement panic recovery during analysis to continue scans past errors

* feat: add expectations configuration for taint analysis and performance metrics

* feat: enhance error handling and logging during file reading and mutex locking

* feat: add cross-file body loading tests and plumbing for CF-1 phase

* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures

* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality

* feat: enhance classification span handling in CFG and AST for improved source attribution

* feat: add new Express routes for handling user input and telemetry data

* feat: implement ternary expression handling in CFG with diamond structure for JS/TS

* feat: implement Phase CF-3 abstract-domain transfer channels in summaries

* feat: add support for string-prefix transfer in cross-file calls and update tests

* docs: reduce RESULTS.md doc size

* feat: implement Phase CF-4 per-return-path summary decomposition with tests

* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization

* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests

* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests

* refactor: update comments and documentation for clarity and consistency

* style: format code for consistency and readability

* refactor: simplify verdict handling and improve edge checking logic

* refactor: optimize path and identifier collection by avoiding unnecessary cloning

* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults

* refactor: update documentation and improve clarity in configuration files

* refactor: update documentation and improve clarity in configuration files

* feat: add JS/TS pass-2 convergence tests and expectations configuration

* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic

* feat: implement Phase 7 deduplication and alternative path linking for taint findings

* feat: implement structural DFS index for anonymous functions and update naming conventions

* feat: add Phase 8 regression tests for container-element taint in JS and Python

* feat: add engine-depth profiles and explain-engine option for CLI

* feat: update expectations and add new README fixtures for multi-file scan regression

* feat: implement Phase 11 callback-alias and factory patterns with regression tests

* feat: implement Terminator::Switch for multi-way dispatch and add regression tests

* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants

* refactor: extract cfg and ssa_transfer to submodules

* refactor: cargo fmt

* refactor: remove unnecessary blank line in cfg_tests.rs

* refactor: remove unnecessary planning file

* chore: update Rust version to 1.88 and bump dependencies in Cargo files

* feat: enhance triage UI with new layout and controls, update README for clarity

* feat: enhance triage UI with new layout and controls, update README for clarity

* chore: remove outdated section from README for version 0.5.0

* docs: improve clarity and consistency in README content

* chore: add "GPL-3.0-or-later" to license options in about.toml

* chore: update license handling in about.toml and check-licenses.mjs

* style: format code for improved readability in TriagePage component

* style: format code for improved readability in TriagePage component

* chore: enhance license handling and improve body_id scoping in seed lookup

* feat: introduce owner and parent body IDs for enhanced seed scoping

* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating

* feat: add Undef SSA operation for improved control-flow handling

* style: improve code formatting for consistency and readability in multiple files

* feat: add 16-function chain SCC across multiple files for enhanced analysis

* style: simplify code formatting for improved readability in multiple files

* fix: update CapHitReason default implementation and improve README clarity

* docs: enhance README with detailed explanations of taint analysis and limitations

* docs: refine README for clarity and consistency in taint analysis section

* style: improve code formatting for better readability in NewScanModal and scans

* fix: update cargo-about command to use --offline for deterministic license generation

* fix: update cargo-about command to use --offline for deterministic license generation

* ci: add step to prime cargo registry cache for deterministic license generation

* feat: add support for non-sink collections in authorization analysis

* feat: enhance authorization checks with row-level ownership equality and binding tracking

* feat: implement self-scoped user handling and enhance ownership checks

* refactor: simplify assertions and formatting in authorization analysis tests

* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure

* docs: update AI disclosure section for clarity and conciseness

* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure

* feat: enhance authorization analysis with SSA-derived variable type classification

* feat: implement auth_finding_to_diag function for enhanced security diagnostics

* feat: add args_value_refs to CallSite struct for enhanced argument tracking

* feat: add args_value_refs to CallSite struct for enhanced argument tracking

* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag

* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks

* feat: enhance error message handling in cli_validation_tests for better Windows compatibility

* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration

* feat: enhance release build process with SBOM generation and SLSA provenance

* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries

* feat: introduce PathFact handling for path safety checks and rejection logic

* feat: introduce PathFact handling for path safety checks and rejection logic

* feat: update benchmark data and enhance path sanitization logic with new safety checks

* feat: document AI assistance in frontend UI development and human review process

* feat: add return path facts for enhanced path safety checks and update documentation

* chore: update release date for version 0.5.0 in CHANGELOG.md

* chore: clean up ci.yml by removing outdated comments and clarifying steps

* feat: implement cross-language path sanitizers and validators for enhanced security

* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks

* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases

* refactor: simplify conditional formatting and improve code readability in executor and lower modules

* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues

* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers

* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers

* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests

* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs

---------

Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Eli Peter 2026-04-25 17:59:11 -04:00 • committed by GitHub
parent c4ce08b452
commit 41128177d2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2144 changed files with 201812 additions and 8927 deletions
Download patch file Download diff file Expand all files Collapse all files

19
tests/fixtures/auth_analysis/actix_admin_route_clean.rs vendored Normal file
View file

@ -0,0 +1,19 @@
use actix_web::web;
struct AdminUser;
fn require_admin() {}
async fn archive_projects(_admin: AdminUser) {
admin_audit_service::publish();
}
fn routes() {
web::resource("/admin/projects/archive")
.wrap(require_admin)
.route(web::post().to(archive_projects));
}
mod admin_audit_service {
pub fn publish() {}
}

28
tests/fixtures/auth_analysis/actix_scoped_write_missing.rs vendored Normal file
View file

@ -0,0 +1,28 @@
use actix_web::web;
struct CurrentUser;
struct UpdateProject {
owner_id: String,
}
fn require_login() {}
async fn update_project(
_user: CurrentUser,
path: web::Path<String>,
payload: web::Json<UpdateProject>,
) {
let project_id = path.into_inner();
project_service::update(project_id, payload.owner_id.clone());
}
fn routes() {
web::resource("/projects/{project_id}")
.wrap(require_login)
.route(web::put().to(update_project));
}
mod project_service {
pub fn update<T, U>(_project_id: T, _owner_id: U) {}
}

7
tests/fixtures/auth_analysis/admin_route_clean.js vendored Normal file
View file

@ -0,0 +1,7 @@
const express = require("express");
const router = express.Router();
const requireAdmin = require("./auth").requireAdmin;
router.get("/admin/dashboard", requireAdmin, async (req, res) => {
res.render("admin/dashboard");
});

8
tests/fixtures/auth_analysis/admin_route_missing.js vendored Normal file
View file

@ -0,0 +1,8 @@
const express = require("express");
const router = express.Router();
const requireLogin = require("./auth").requireLogin;
router.post("/admin/users/:id/role", requireLogin, async (req, res) => {
await adminService.updateUserRole(req.params.id, req.body.role);
res.json({ ok: true });
});

19
tests/fixtures/auth_analysis/axum_admin_route_clean.rs vendored Normal file
View file

@ -0,0 +1,19 @@
use axum::{Router, middleware, routing::get};
struct AdminUser;
fn require_admin() {}
async fn admin_audit_log(_admin: AdminUser) {
admin_audit_service::publish();
}
fn router() -> Router {
Router::new()
.layer(middleware::from_fn(require_admin))
.route("/admin/audits", get(admin_audit_log))
}
mod admin_audit_service {
pub fn publish() {}
}

19
tests/fixtures/auth_analysis/axum_admin_route_missing.rs vendored Normal file
View file

@ -0,0 +1,19 @@
use axum::{Router, middleware, routing::get};
struct CurrentUser;
fn require_login() {}
async fn admin_audit_log(_user: CurrentUser) {
admin_audit_service::publish();
}
fn router() -> Router {
Router::new()
.layer(middleware::from_fn(require_login))
.route("/admin/audits", get(admin_audit_log))
}
mod admin_audit_service {
pub fn publish() {}
}

25
tests/fixtures/auth_analysis/axum_partial_batch.rs vendored Normal file
View file

@ -0,0 +1,25 @@
use axum::{Json, Router, routing::post};
struct CurrentUser {
user_id: String,
}
struct BulkArchive {
project_ids: Vec<String>,
}
fn require_membership<T, U>(_project_id: T, _actor_id: U) {}
async fn bulk_archive_projects(user: CurrentUser, Json(body): Json<BulkArchive>) {
let project_ids = body.project_ids;
require_membership(project_ids[0], user.user_id);
project_service::delete(project_ids);
}
fn router() -> Router {
Router::new().route("/projects/bulk-archive", post(bulk_archive_projects))
}
mod project_service {
pub fn delete<T>(_project_ids: T) {}
}

33
tests/fixtures/auth_analysis/cross_file_helper_authz.rs vendored Normal file
View file

@ -0,0 +1,33 @@
// Target: authorization happens inside `require_owner`, which
// delegates to `require_group_member` (a configured authorization
// check name). The handler in `cross_file_helper_handler.rs`
// delegates ownership validation to this helper — cross-file helper
// lifting should recognise the call as an auth check covering the
// supplied `row`.
struct Db;
impl Db {
fn get(&self, _id: i64) -> i64 {
0
}
}
mod authz {
pub async fn require_group_member(
_db: &super::Db,
_row_id: i64,
_user_id: i64,
) -> Result<(), ()> {
Ok(())
}
}
/// Ownership / group-membership guard. Delegates to the configured
/// authorization check `require_group_member`, passing `row_id` as
/// the resource id and `user_id` as the actor id. The single-file
/// extractor produces an `AuthCheckSummary` with param 1 (`row_id`)
/// marked as `Membership`-checked.
pub async fn require_owner(db: &Db, row_id: i64, user_id: i64) -> Result<(), ()> {
authz::require_group_member(db, row_id, user_id).await?;
let _ = db.get(row_id);
Ok(())
}

52
tests/fixtures/auth_analysis/cross_file_helper_handler.rs vendored Normal file
View file

@ -0,0 +1,52 @@
// Target: handler in this file delegates ownership checking to a
// helper declared in a sibling file
// (`cross_file_helper_authz.rs`). The ownership guard lives in
// `require_owner` over there; this handler only calls the guard
// before mutating.
//
// Without cross-file helper lifting the scanner would flag
// `db.update(..)` as `rs.auth.missing_ownership_check` because
// single-file lifting cannot see the helper's body. With cross-file
// lifting the guard covers `row_id` and the finding disappears.
struct Ctx;
struct Req;
struct Db;
impl Db {
fn update(&self, _s: &str, _a: &[i64]) {}
}
struct User {
id: i64,
}
mod auth {
pub async fn require_auth(
_r: &super::Req,
_c: &super::Ctx,
) -> Result<super::User, ()> {
Ok(super::User { id: 1 })
}
}
pub async fn handle_update_row(
req: Req,
ctx: Ctx,
row_id: i64,
new_title: String,
) -> Result<String, ()> {
let user = auth::require_auth(&req, &ctx).await?;
let db = Db;
// Ownership check via the cross-file helper
// (`cross_file_helper_authz.rs::require_owner`). After cross-file
// helper-summary lifting this synthesises an AuthCheck at the
// call site covering `row_id`, so the downstream mutation is
// NOT flagged as missing_ownership_check.
require_owner(&db, row_id, user.id).await?;
let _ = new_title;
db.update(
"UPDATE rows SET title = ?1 WHERE id = ?2",
&[row_id],
);
Ok("ok".into())
}

8
tests/fixtures/auth_analysis/dashboard_self_listing.js vendored Normal file
View file

@ -0,0 +1,8 @@
const express = require("express");
const router = express.Router();
const requireLogin = require("./auth").requireLogin;
router.get("/dashboard", requireLogin, async (req, res) => {
const workspaces = await workspaceModel.listForUser(req.session.user.id);
res.json({ workspaces });
});

45
tests/fixtures/auth_analysis/db_connection_type_inferred.rs vendored Normal file
View file

@ -0,0 +1,45 @@
// Regression fixture: `let conn = rusqlite::Connection::open(..).unwrap();`
// produces a `DatabaseConnection` via SSA `constructor_type` (through
// `peel_identity_suffix`, which strips `.unwrap()` before matching). The
// handler then calls `conn.execute(..)`, a callee name that appears in
// neither `mutation_indicator_names` nor `read_indicator_names` for Rust —
// name-based classification returns `None`, so the ownership gate
// already cannot flag the call. The type-map refinement should *still*
// leave the call unflagged (the type map produces `DbMutation`, but
// there is no scoped subject on the operation, so the ownership check
// does not fire either way). This fixture is therefore a
// non-regression witness: adding SSA-type classification must not
// introduce a false positive.
struct Ctx;
struct Req;
struct User {
id: i64,
}
mod rusqlite {
pub struct Connection;
impl Connection {
pub fn open(_path: &str) -> Result<Self, ()> {
Ok(Connection)
}
pub fn execute(&self, _sql: &str, _params: &[i64]) -> Result<(), ()> {
Ok(())
}
}
}
mod auth {
pub async fn require_auth(_r: &super::Req, _c: &super::Ctx) -> Result<super::User, ()> {
Ok(super::User { id: 1 })
}
}
pub async fn handle_log_event(req: Req, ctx: Ctx) -> Result<String, ()> {
let user = auth::require_auth(&req, &ctx).await?;
// `conn` is DatabaseConnection-typed via SSA. No scoped foreign id
// flows into `execute`, so the ownership gate has nothing to flag.
let conn = rusqlite::Connection::open("app.db").unwrap();
let _ = conn.execute("INSERT INTO audit (actor) VALUES (?1)", &[user.id]);
Ok("ok".into())
}

7
tests/fixtures/auth_analysis/debug_session_missing.js vendored Normal file
View file

@ -0,0 +1,7 @@
const express = require("express");
const router = express.Router();
const requireLogin = require("./auth").requireLogin;
router.get("/debug/session", requireLogin, async (req, res) => {
res.json(adminService.buildDebugPayload(req));
});

11
tests/fixtures/auth_analysis/delegated_service_read.js vendored Normal file
View file

@ -0,0 +1,11 @@
const express = require("express");
const router = express.Router();
const requireLogin = require("./auth").requireLogin;
router.get("/projects/:id", requireLogin, async (req, res) => {
const data = await projectService.getProjectPageData(
req.session.user.id,
req.params.id,
);
res.json({ data });
});

36
tests/fixtures/auth_analysis/django_cbv_admin_clean.py vendored Normal file
View file

@ -0,0 +1,36 @@
from django.urls import path
class LoginRequiredMixin:
pass
class PermissionRequiredMixin:
pass
class View:
@classmethod
def as_view(cls):
return cls
class AdminService:
def update_user_role(self, user_id, role):
return None
admin_service = AdminService()
class AdminRoleView(LoginRequiredMixin, PermissionRequiredMixin, View):
permission_required = "auth.change_user"
def post(self, request, user_id):
admin_service.update_user_role(user_id, request.POST["role"])
return None
urlpatterns = [
path("admin/users/<int:user_id>/role/", AdminRoleView.as_view()),
]

26
tests/fixtures/auth_analysis/django_cbv_scoped_write_missing.py vendored Normal file
View file

@ -0,0 +1,26 @@
from django.urls import path
class View:
@classmethod
def as_view(cls):
return cls
class ProjectStore:
def update_state(self, project_id, state):
return None
project_store = ProjectStore()
class ProjectStateView(View):
def post(self, request, project_id):
project_store.update_state(project_id, request.POST["state"])
return None
urlpatterns = [
path("projects/<int:project_id>/state/", ProjectStateView.as_view()),
]

25
tests/fixtures/auth_analysis/django_partial_batch.py vendored Normal file
View file

@ -0,0 +1,25 @@
from django.urls import path
class ProjectStore:
def archive(self, ids):
return None
project_store = ProjectStore()
def check_membership(user_id, project_id):
return True
def bulk_archive(request):
ids = request.POST["ids"]
check_membership(request.user.id, ids[0])
project_store.archive(ids)
return None
urlpatterns = [
path("projects/archive/", bulk_archive),
]

18
tests/fixtures/auth_analysis/django_scoped_read_missing.py vendored Normal file
View file

@ -0,0 +1,18 @@
from django.urls import path
class ProjectStore:
def fetch(self, project_id):
return project_id
project_store = ProjectStore()
def load_project(request, project_id):
return project_store.fetch(project_id)
urlpatterns = [
path("projects/<int:project_id>/", load_project),
]

22
tests/fixtures/auth_analysis/django_stale_session_mutation.py vendored Normal file
View file

@ -0,0 +1,22 @@
from django.urls import path
class WorkspaceStore:
def update_role(self, workspace_id, role):
return None
workspace_store = WorkspaceStore()
def update_workspace_role(request):
workspace_store.update_role(
request.session["workspace_id"],
request.POST["role"],
)
return None
urlpatterns = [
path("workspaces/current/role/", update_workspace_role),
]

27
tests/fixtures/auth_analysis/django_token_missing_expiry.py vendored Normal file
View file

@ -0,0 +1,27 @@
class InvitationManager:
def get(self, **kwargs):
return kwargs
class Invitation:
objects = InvitationManager()
class WorkspaceStore:
def add_membership(self, workspace_id, user_id, role):
return None
workspace_store = WorkspaceStore()
def accept_invitation(request, token, role_override):
invitation = Invitation.objects.get(token=token)
if invitation.email == request.user.email:
return workspace_store.add_membership(
invitation.workspace_id,
request.user.id,
role_override or invitation.requested_role,
)
return None

31
tests/fixtures/auth_analysis/django_token_missing_recipient.py vendored Normal file
View file

@ -0,0 +1,31 @@
class InvitationManager:
def get(self, **kwargs):
return kwargs
class Invitation:
objects = InvitationManager()
class WorkspaceStore:
def add_membership(self, workspace_id, user_id, role):
return None
def now():
return 100
workspace_store = WorkspaceStore()
def accept_invitation(token, current_user):
invitation = Invitation.objects.get(token=token)
if invitation.expires_at > now():
return workspace_store.add_membership(
invitation.workspace_id,
current_user.id,
invitation.requested_role,
)
return None

27
tests/fixtures/auth_analysis/django_view_admin_clean.py vendored Normal file
View file

@ -0,0 +1,27 @@
from django.urls import path
def permission_required(permission_name):
def decorate(fn):
return fn
return decorate
class AdminService:
def update_user_role(self, user_id, role):
return None
admin_service = AdminService()
@permission_required("auth.change_user")
def update_user_role(request, user_id):
admin_service.update_user_role(user_id, request.POST["role"])
return None
urlpatterns = [
path("admin/users/<int:user_id>/role/", update_user_role),
]

24
tests/fixtures/auth_analysis/django_view_admin_missing.py vendored Normal file
View file

@ -0,0 +1,24 @@
from django.urls import path
def login_required(fn):
return fn
class AdminService:
def update_user_role(self, user_id, role):
return None
admin_service = AdminService()
@login_required
def update_user_role(request, user_id):
admin_service.update_user_role(user_id, request.POST["role"])
return None
urlpatterns = [
path("admin/users/<int:user_id>/role/", update_user_role),
]

11
tests/fixtures/auth_analysis/echo_admin_route_clean.go vendored Normal file
View file

@ -0,0 +1,11 @@
package authanalysis
func registerEchoAdmin(e *echo.Echo) {
admin := e.Group("/admin", requireLogin)
admin.Use(requireAdmin)
admin.POST("/reports/publish", publishReport)
}
func publishReport(c echo.Context) error {
return reportService.Publish()
}

11
tests/fixtures/auth_analysis/echo_partial_batch.go vendored Normal file
View file

@ -0,0 +1,11 @@
package authanalysis
func registerBulkRoutes(e *echo.Echo) {
e.POST("/projects/bulk-archive", bulkArchiveProjects, requireLogin)
}
func bulkArchiveProjects(c echo.Context) error {
projectIDs := []string{"p1", "p2"}
requireMembership(projectIDs[0], c.Get("userID"))
return projectService.Delete(projectIDs)
}

9
tests/fixtures/auth_analysis/echo_token_missing_recipient.go vendored Normal file
View file

@ -0,0 +1,9 @@
package authanalysis
func acceptInvitation(c echo.Context) error {
invitation := invitationService.FindByToken(c.QueryParam("token"))
if invitation.ExpiresAt != nil {
return membershipService.Accept(invitation.WorkspaceID)
}
return nil
}

12
tests/fixtures/auth_analysis/fastify_admin_route_clean.js vendored Normal file
View file

@ -0,0 +1,12 @@
const fastify = require("fastify")();
const requireLogin = require("./auth").requireLogin;
const requireAdmin = require("./auth").requireAdmin;
fastify.get("/admin/dashboard", {
preHandler: [requireLogin, requireAdmin],
handler: async function dashboard(request, reply) {
reply.send(await adminService.getDashboard(request.user.id));
},
});
module.exports = { fastify };

13
tests/fixtures/auth_analysis/fastify_admin_route_missing.js vendored Normal file
View file

@ -0,0 +1,13 @@
const fastify = require("fastify")();
const requireLogin = require("./auth").requireLogin;
fastify.post(
"/admin/users/:id/role",
{ preHandler: requireLogin },
async function updateUserRole(request, reply) {
await adminService.updateUserRole(request.params.id, request.body.role);
reply.send({ ok: true });
},
);
module.exports = { fastify };

19
tests/fixtures/auth_analysis/fastify_route_registration_noise.js vendored Normal file
View file

@ -0,0 +1,19 @@
const fastify = require("fastify")();
const requireAuth = require("./auth").requireAuth;
fastify.addHook("preHandler", requireAuth);
fastify.register(async function projectPlugin(instance) {
instance.decorate("requireWorkspace", requireAuth);
});
fastify.route({
method: "GET",
url: "/me/projects",
preHandler: requireAuth,
handler: async function listProjects(request, reply) {
const projects = await projectService.listForUser(request.user.id);
reply.send({ projects });
},
});
module.exports = { fastify };

22
tests/fixtures/auth_analysis/fastify_scoped_write_clean.js vendored Normal file
View file

@ -0,0 +1,22 @@
const fastify = require("fastify")();
const requireAuth = require("./auth").requireAuth;
fastify.route({
method: "POST",
url: "/projects/:projectId/state",
onRequest: requireAuth,
handler: updateProjectState,
});
async function updateProjectState(request, reply) {
const allowed = await checkOwnership(request.user.id, request.params.projectId);
if (!allowed) {
reply.code(403).send({ error: "forbidden" });
return;
}
const project = await projectModel.updateState(request.params.projectId, request.body);
reply.send({ project });
}
module.exports = { fastify, updateProjectState };

16
tests/fixtures/auth_analysis/fastify_scoped_write_missing.js vendored Normal file
View file

@ -0,0 +1,16 @@
const fastify = require("fastify")();
const requireAuth = require("./auth").requireAuth;
fastify.route({
method: "POST",
url: "/projects/:projectId/state",
preValidation: requireAuth,
handler: updateProjectState,
});
async function updateProjectState(request, reply) {
const project = await projectModel.updateState(request.params.projectId, request.body);
reply.send({ project });
}
module.exports = { fastify, updateProjectState };

22
tests/fixtures/auth_analysis/flask_admin_route_clean.py vendored Normal file
View file

@ -0,0 +1,22 @@
from flask import Flask, request
app = Flask(__name__)
def admin_required(fn):
return fn
class AdminService:
def update_user_role(self, user_id, role):
return None
admin_service = AdminService()
@app.post("/admin/users/<int:user_id>/role")
@admin_required
def update_user_role(user_id):
admin_service.update_user_role(user_id, request.json["role"])
return {"ok": True}

22
tests/fixtures/auth_analysis/flask_admin_route_missing.py vendored Normal file
View file

@ -0,0 +1,22 @@
from flask import Flask, request
app = Flask(__name__)
def login_required(fn):
return fn
class AdminService:
def update_user_role(self, user_id, role):
return None
admin_service = AdminService()
@app.post("/admin/users/<int:user_id>/role")
@login_required
def update_user_role(user_id):
admin_service.update_user_role(user_id, request.json["role"])
return {"ok": True}

17
tests/fixtures/auth_analysis/flask_scoped_write_missing.py vendored Normal file
View file

@ -0,0 +1,17 @@
from flask import Flask, request
app = Flask(__name__)
class ProjectStore:
def update_state(self, project_id, payload):
return None
project_store = ProjectStore()
@app.post("/projects/<int:project_id>/state")
def update_project_state(project_id):
project_store.update_state(project_id, request.json["state"])
return {"ok": True}

28
tests/fixtures/auth_analysis/flask_token_clean.py vendored Normal file
View file

@ -0,0 +1,28 @@
def now():
return 100
class InvitationStore:
def find_by_token(self, token):
return token
class WorkspaceStore:
def add_membership(self, workspace_id, user_id, role):
return None
invitation_store = InvitationStore()
workspace_store = WorkspaceStore()
def accept_invitation(token, current_user):
invitation = invitation_store.find_by_token(token)
if invitation.expires_at > now() and invitation.email == current_user.email:
return workspace_store.add_membership(
invitation.workspace_id,
current_user.id,
invitation.requested_role,
)
return None

10
tests/fixtures/auth_analysis/gin_admin_route_missing.go vendored Normal file
View file

@ -0,0 +1,10 @@
package authanalysis
func registerAdminRoutes(router *gin.Engine) {
admin := router.Group("/admin", requireLogin)
admin.POST("/projects/:projectID/archive", archiveProject)
}
func archiveProject(c *gin.Context) {
adminAuditService.Publish()
}

11
tests/fixtures/auth_analysis/gin_scoped_write_clean.go vendored Normal file
View file

@ -0,0 +1,11 @@
package authanalysis
func registerProjectRoutes(router *gin.Engine) {
router.PUT("/projects/:projectID", updateProject)
}
func updateProject(c *gin.Context) {
projectID := c.Param("projectID")
requireOwnership(projectID, c.MustGet("userID"))
projectStore.Update(projectID, c.PostForm("name"))
}

6
tests/fixtures/auth_analysis/gin_stale_session_mutation.go vendored Normal file
View file

@ -0,0 +1,6 @@
package authanalysis
func reopenProject(c *gin.Context) {
session := sessionState{}
projectStore.Update(session.CurrentWorkspaceID, c.Param("projectID"))
}

31
tests/fixtures/auth_analysis/hashmap_local_noise.rs vendored Normal file
View file

@ -0,0 +1,31 @@
use std::collections::{HashMap, HashSet};
struct Ctx;
struct Req;
struct User {
id: i64,
}
mod auth {
pub async fn require_auth(_r: &super::Req, _c: &super::Ctx) -> Result<super::User, ()> {
Ok(super::User { id: 1 })
}
}
pub async fn handle_list_peer_docs(req: Req, ctx: Ctx) -> Result<String, ()> {
let user = auth::require_auth(&req, &ctx).await?;
let doc_ids: Vec<i64> = vec![1, 2, 3];
// Pure in-memory bookkeeping — no authorization decision here.
let mut counts: HashMap<i64, usize> = HashMap::new();
let mut seen: HashSet<i64> = HashSet::new();
for doc_id in &doc_ids {
counts.insert(*doc_id, 0);
seen.insert(*doc_id);
if seen.contains(doc_id) {
counts.get(doc_id);
}
}
let _ = user;
Ok(format!("{} {}", counts.len(), seen.len()))
}

43
tests/fixtures/auth_analysis/helper_no_auth_lift.rs vendored Normal file
View file

@ -0,0 +1,43 @@
// B4 regression guard: `format_target` does NOT auth-check
// `group_id` — it just constructs a string from it. The helper-lift
// pass must not synthesise a covering AuthCheck on the handler's call
// site, so the subsequent `db.exec("INSERT INTO comments …", &[group_id])`
// MUST still flag.
struct Ctx;
struct Req;
struct User {
id: i64,
}
struct Db;
impl Db {
fn insert(&self, _s: &str, _a: &[i64]) {}
}
mod auth {
pub async fn require_auth(_r: &super::Req, _c: &super::Ctx) -> Result<super::User, ()> {
Ok(super::User { id: 1 })
}
}
fn format_target(group_id: i64, suffix: &str) -> String {
// No auth check here — pure formatting.
format!("group:{}{}", group_id, suffix)
}
pub async fn handle_post_comment(
req: Req,
ctx: Ctx,
group_id: i64,
body: String,
) -> Result<String, ()> {
let _user = auth::require_auth(&req, &ctx).await?;
let db = Db;
// No auth check on `group_id` anywhere in this file.
let _label = format_target(group_id, "/x");
let _ = body;
db.insert(
"INSERT INTO comments (group_id, body) VALUES (?1, ?2)",
&[group_id],
);
Ok("ok".into())
}

18
tests/fixtures/auth_analysis/helper_scoped_params.rs vendored Normal file
View file

@ -0,0 +1,18 @@
use std::collections::HashSet;
// Library-style helper. Authorization is the caller's responsibility.
// The `result.insert` / `result.contains` calls below are pure
// in-memory work on a locally-constructed HashSet and must not be
// flagged as authorization-relevant Read/Mutation operations.
// Helper-summary lifting covers cross-procedural scoped-id flows
// separately; the DB layer is intentionally excluded here.
pub async fn get_peer_ids(user_id: i64, other_ids: &[i64]) -> HashSet<i64> {
let mut result: HashSet<i64> = HashSet::new();
for &other_id in other_ids {
if !result.contains(&other_id) {
result.insert(other_id);
}
}
let _ = user_id;
result
}

9
tests/fixtures/auth_analysis/koa_admin_route_clean.js vendored Normal file
View file

@ -0,0 +1,9 @@
const Router = require("@koa/router");
const koaRouter = new Router();
const requireAdmin = require("./auth").requireAdmin;
koaRouter.get("/admin/dashboard", requireAdmin, async (ctx) => {
ctx.body = await adminService.getDashboard(ctx.state.user.id);
});
module.exports = { koaRouter };

10
tests/fixtures/auth_analysis/koa_admin_route_missing.js vendored Normal file
View file

@ -0,0 +1,10 @@
const Router = require("@koa/router");
const koaRouter = new Router();
const requireLogin = require("./auth").requireLogin;
koaRouter.post("/admin/users/:id/role", requireLogin, async (ctx) => {
await adminService.updateUserRole(ctx.params.id, ctx.request.body.role);
ctx.body = { ok: true };
});
module.exports = { koaRouter };

13
tests/fixtures/auth_analysis/koa_route_registration_noise.js vendored Normal file
View file

@ -0,0 +1,13 @@
const Router = require("@koa/router");
const koaRouter = new Router();
const requireLogin = require("./auth").requireLogin;
koaRouter.use(requireLogin);
koaRouter.use("/workspace", requireLogin);
koaRouter.get("/profile", requireLogin, async (ctx) => {
const user = await userModel.findById(ctx.state.user.id);
ctx.body = { user };
});
module.exports = { koaRouter };

17
tests/fixtures/auth_analysis/koa_scoped_read_clean.js vendored Normal file
View file

@ -0,0 +1,17 @@
const Router = require("@koa/router");
const koaRouter = new Router();
const requireLogin = require("./auth").requireLogin;
koaRouter.get("/projects/:projectId", requireLogin, getProject);
async function getProject(ctx) {
const allowed = await checkOwnership(ctx.state.user.id, ctx.params.projectId);
if (!allowed) {
ctx.throw(403);
}
const project = await projectModel.findById(ctx.params.projectId);
ctx.body = { project };
}
module.exports = { koaRouter, getProject };

12
tests/fixtures/auth_analysis/koa_scoped_read_missing.js vendored Normal file
View file

@ -0,0 +1,12 @@
const Router = require("@koa/router");
const koaRouter = new Router();
const requireLogin = require("./auth").requireLogin;
koaRouter.get("/projects/:projectId", requireLogin, getProject);
async function getProject(ctx) {
const project = await projectModel.findById(ctx.params.projectId);
ctx.body = { project };
}
module.exports = { koaRouter, getProject };

6
tests/fixtures/auth_analysis/membership_helper.js vendored Normal file
View file

@ -0,0 +1,6 @@
async function hasWorkspaceMembership(userId, workspaceId) {
const memberships = await workspaceModel.listForUser(userId);
return memberships.some((workspace) => workspace.id === Number(workspaceId));
}
module.exports = { hasWorkspaceMembership };

6
tests/fixtures/auth_analysis/partial_batch.js vendored Normal file
View file

@ -0,0 +1,6 @@
async function bulkArchive(userId, ids) {
await checkMembership(userId, ids[0]);
return projectModel.archiveByIds(ids);
}
module.exports = { bulkArchive };

5
tests/fixtures/auth_analysis/partial_batch_full_check_clean.js vendored Normal file
View file

@ -0,0 +1,5 @@
async function bulkArchiveProjects(userId, ids) {
await checkMembership(userId, ids);
await checkMembership(userId, ids[0]);
return projectModel.archiveByIds(ids);
}

9
tests/fixtures/auth_analysis/rails_admin_route_clean.rb vendored Normal file
View file

@ -0,0 +1,9 @@
module Admin
class UsersController < ApplicationController
before_action :require_admin!, only: [:update]
def update
AdminRoleService.update!(params[:id], params[:role])
end
end
end

9
tests/fixtures/auth_analysis/rails_admin_route_missing.rb vendored Normal file
View file

@ -0,0 +1,9 @@
module Admin
class UsersController < ApplicationController
before_action :require_login
def update
AdminRoleService.update!(params[:id], params[:role])
end
end
end

8
tests/fixtures/auth_analysis/rails_clean_before_action.rb vendored Normal file
View file

@ -0,0 +1,8 @@
class ProjectsController < ApplicationController
before_action :require_login
def show
require_membership!(params[:id], current_user)
Project.find(params[:id])
end
end

7
tests/fixtures/auth_analysis/rails_partial_batch.rb vendored Normal file
View file

@ -0,0 +1,7 @@
class ProjectsController < ApplicationController
def archive
ids = params[:ids]
require_membership!(ids[0], current_user)
ProjectArchive.archive(ids)
end
end

8
tests/fixtures/auth_analysis/rails_scoped_write_missing.rb vendored Normal file
View file

@ -0,0 +1,8 @@
class ProjectsController < ApplicationController
before_action :require_login
def update
project = Project.find(params[:id])
project.update!(state: params[:state])
end
end

5
tests/fixtures/auth_analysis/rails_stale_session_mutation.rb vendored Normal file
View file

@ -0,0 +1,5 @@
class WorkspacesController < ApplicationController
def rotate_key
WorkspaceGrant.update!(session[:workspace_id], params[:role])
end
end

13
tests/fixtures/auth_analysis/rails_token_clean.rb vendored Normal file
View file

@ -0,0 +1,13 @@
class InvitationsController < ApplicationController
def accept
invitation = Invitation.find_by(token: params[:token])
if invitation.expires_at > Time.current &&
invitation.recipient_email == current_user.email
Membership.create!(
workspace_id: invitation.workspace_id,
role: invitation.role,
email: invitation.recipient_email
)
end
end
end

11
tests/fixtures/auth_analysis/rails_token_missing_expiry.rb vendored Normal file
View file

@ -0,0 +1,11 @@
class InvitationsController < ApplicationController
def accept
invitation = Invitation.find_by(token: params[:token])
if invitation.recipient_email == current_user.email
Membership.create!(
workspace_id: invitation.workspace_id,
role: params[:role] || invitation.role
)
end
end
end

10
tests/fixtures/auth_analysis/related_membership_check.js vendored Normal file
View file

@ -0,0 +1,10 @@
async function getProjectArtifacts(userId, project) {
const allowed = await hasWorkspaceMembership(userId, project.workspace_id);
if (!allowed) {
throw new Error("not allowed");
}
return noteModel.listByProject(project.id);
}
module.exports = { getProjectArtifacts };

10
tests/fixtures/auth_analysis/rocket_admin_route_clean.rs vendored Normal file
View file

@ -0,0 +1,10 @@
struct AdminUser;
#[get("/admin/audits")]
fn admin_audits(_admin: AdminUser) {
admin_audit_service::publish();
}
mod admin_audit_service {
pub fn publish() {}
}

12
tests/fixtures/auth_analysis/rocket_stale_session_mutation.rs vendored Normal file
View file

@ -0,0 +1,12 @@
struct SessionUser {
project_id: String,
}
#[post("/projects/archive")]
fn archive_project(session: SessionUser) {
project_service::archive(session.project_id);
}
mod project_service {
pub fn archive<T>(_project_id: T) {}
}

27
tests/fixtures/auth_analysis/rocket_token_missing_recipient.rs vendored Normal file
View file

@ -0,0 +1,27 @@
struct AcceptInvite {
email: String,
}
struct Json<T>(T);
struct Invitation {
email: Option<String>,
}
#[post("/invites/<token>/accept", data = "<body>")]
fn accept_invite(token: String, body: Json<AcceptInvite>) {
let invitation = invitation_store::find_by_token(token);
invitation_service::accept(invitation.email.or(Some(body.0.email)));
}
mod invitation_store {
use super::Invitation;
pub fn find_by_token<T>(_token: T) -> Invitation {
Invitation { email: None }
}
}
mod invitation_service {
pub fn accept<T>(_email: T) {}
}

48
tests/fixtures/auth_analysis/row_ownership_equality.rs vendored Normal file
View file

@ -0,0 +1,48 @@
struct Ctx;
struct Req;
struct User {
id: i64,
}
struct Db;
impl Db {
fn query_one(&self, _s: &str, _a: &[i64]) -> Row {
Row
}
}
struct Row;
impl Row {
fn get_i64(&self, _c: &str) -> i64 {
0
}
}
mod auth {
pub async fn require_auth(_r: &super::Req, _c: &super::Ctx) -> Result<super::User, ()> {
Ok(super::User { id: 1 })
}
}
mod realtime {
pub fn publish_to_group(_g: i64, _m: &str) {}
}
fn json_err(_msg: &str, _code: u16) -> Result<String, ()> {
Err(())
}
pub async fn handle_delete_doc(req: Req, ctx: Ctx, doc_id: i64) -> Result<String, ()> {
let user = auth::require_auth(&req, &ctx).await?;
let db = Db;
let existing = db.query_one(
"SELECT user_id, group_id FROM docs WHERE id = ?1",
&[doc_id],
);
let owner_id = existing.get_i64("user_id");
if owner_id != user.id {
return json_err("cannot delete another user's doc", 403);
}
// By construction, the row belongs to `user` — so any id read from it is authorized.
let group_id = existing.get_i64("group_id");
realtime::publish_to_group(group_id, "doc_deleted");
Ok("ok".into())
}

42
tests/fixtures/auth_analysis/row_ownership_no_early_exit.rs vendored Normal file
View file

@ -0,0 +1,42 @@
struct Ctx;
struct Req;
struct User {
id: i64,
}
struct Db;
impl Db {
fn query_one(&self, _s: &str, _a: &[i64]) -> Row {
Row
}
fn exec(&self, _s: &str, _a: &[i64]) {}
}
struct Row;
impl Row {
fn get_i64(&self, _c: &str) -> i64 {
0
}
}
mod auth {
pub async fn require_auth(_r: &super::Req, _c: &super::Ctx) -> Result<super::User, ()> {
Ok(super::User { id: 1 })
}
}
pub async fn handle_update_doc(req: Req, ctx: Ctx, doc_id: i64) -> Result<String, ()> {
let user = auth::require_auth(&req, &ctx).await?;
let db = Db;
let existing = db.query_one(
"SELECT user_id, group_id FROM docs WHERE id = ?1",
&[doc_id],
);
let owner_id = existing.get_i64("user_id");
// Equality compared but no early exit — the check has no effect.
if owner_id != user.id {
// missing return
println!("not your doc (but proceeding anyway)");
}
db.exec("UPDATE docs SET updated = 1 WHERE id = ?1", &[doc_id]);
Ok("ok".into())
}

8
tests/fixtures/auth_analysis/scoped_read_missing.js vendored Normal file
View file

@ -0,0 +1,8 @@
const express = require("express");
const router = express.Router();
const requireLogin = require("./auth").requireLogin;
router.get("/projects/:id", requireLogin, async (req, res) => {
const project = await projectModel.findById(req.params.id);
res.json({ project });
});

8
tests/fixtures/auth_analysis/scoped_write_missing.js vendored Normal file
View file

@ -0,0 +1,8 @@
const express = require("express");
const router = express.Router();
const requireLogin = require("./auth").requireLogin;
router.post("/projects/:id/state", requireLogin, async (req, res) => {
const project = await projectModel.updateState(req.params.id, req.body);
res.json({ project });
});

8
tests/fixtures/auth_analysis/self_profile_read.js vendored Normal file
View file

@ -0,0 +1,8 @@
const express = require("express");
const router = express.Router();
const requireLogin = require("./auth").requireLogin;
router.get("/profile", requireLogin, async (req, res) => {
const user = await userModel.findById(req.session.user.id);
res.json({ user });
});

11
tests/fixtures/auth_analysis/self_profile_update.js vendored Normal file
View file

@ -0,0 +1,11 @@
const express = require("express");
const router = express.Router();
const requireLogin = require("./auth").requireLogin;
router.post("/profile", requireLogin, async (req, res) => {
await userModel.updateProfile(req.session.user.id, {
bio: req.body.bio,
themeConfig: req.body.themeConfig,
});
res.json({ ok: true });
});

21
tests/fixtures/auth_analysis/self_scoped_user.rs vendored Normal file
View file

@ -0,0 +1,21 @@
use std::collections::HashSet;
struct Ctx; struct Req; struct User { id: i64 } struct Db;
mod auth { pub async fn require_auth(_r: &super::Req, _c: &super::Ctx) -> Result<super::User, ()> { Ok(super::User{id:1}) } }
// The handler's `get_peer_ids(&db, user.id)` call below must not be
// flagged. `user` is bound from `auth::require_auth(..)` so `user.id`
// is the caller's own id — the call is self-referential, not a foreign
// scoped id. The library-style helper below is a pass-through so its
// body contains no DB sinks (the internal `user_id` → DB flow is a
// separate pattern covered by helper-summary lifting).
async fn get_peer_ids(_db: &Db, _user_id: i64) -> HashSet<i64> {
HashSet::new()
}
pub async fn handle_list_peers(req: Req, ctx: Ctx) -> Result<String, ()> {
let user = auth::require_auth(&req, &ctx).await?;
let db = Db;
let peers = get_peer_ids(&db, user.id).await;
Ok(format!("{}", peers.len()))
}

5
tests/fixtures/auth_analysis/service_missing_context.js vendored Normal file
View file

@ -0,0 +1,5 @@
async function updateProject(projectId, payload) {
return projectModel.updateProject(projectId, payload);
}
module.exports = { updateProject };

6
tests/fixtures/auth_analysis/service_with_check.js vendored Normal file
View file

@ -0,0 +1,6 @@
async function updateProject(projectId, payload, currentUser) {
await checkOwnership(currentUser.id, projectId);
return projectModel.updateProject(projectId, payload);
}
module.exports = { updateProject };

7
tests/fixtures/auth_analysis/sinatra_admin_route_clean.rb vendored Normal file
View file

@ -0,0 +1,7 @@
before do
require_admin!
end
post "/admin/users/:id/role" do
AdminRoleService.update!(params[:id], params[:role])
end

7
tests/fixtures/auth_analysis/sinatra_admin_route_missing.rb vendored Normal file
View file

@ -0,0 +1,7 @@
before do
require_login!
end
post "/admin/users/:id/role" do
AdminRoleService.update!(params[:id], params[:role])
end

8
tests/fixtures/auth_analysis/sinatra_scoped_read_clean.rb vendored Normal file
View file

@ -0,0 +1,8 @@
before do
require_login!
end
get "/projects/:id" do
require_membership!(params[:id], current_user)
Project.find(params[:id])
end

7
tests/fixtures/auth_analysis/sinatra_scoped_read_missing.rb vendored Normal file
View file

@ -0,0 +1,7 @@
before do
require_login!
end
get "/projects/:id" do
Project.find(params[:id])
end

12
tests/fixtures/auth_analysis/sinatra_token_missing_recipient.rb vendored Normal file
View file

@ -0,0 +1,12 @@
before do
require_login!
end
post "/invitations/accept" do
invitation = Invitation.find_by(token: params[:token])
halt 403 if invitation.expires_at < Time.now
Membership.create!(
email: params[:email] || invitation.email,
workspace_id: invitation.workspace_id
)
end

9
tests/fixtures/auth_analysis/spring_admin_route_clean.java vendored Normal file
View file

@ -0,0 +1,9 @@
@RestController
@RequestMapping("/admin/projects")
class SecureAdminProjectsController {
@PostMapping("/publish")
@PreAuthorize("hasRole('ADMIN')")
public void publishProject() {
adminAuditService.publish();
}
}

9
tests/fixtures/auth_analysis/spring_admin_route_missing.java vendored Normal file
View file

@ -0,0 +1,9 @@
@RestController
@RequestMapping("/admin/projects")
class AdminProjectsController {
@PostMapping("/publish")
@PreAuthorize("isAuthenticated()")
public void publishProject() {
adminAuditService.publish();
}
}

8
tests/fixtures/auth_analysis/spring_scoped_read_missing.java vendored Normal file
View file

@ -0,0 +1,8 @@
@RestController
@RequestMapping("/projects")
class ProjectsController {
@GetMapping("/{projectId}")
public Project showProject(String projectId) {
return projectService.find(projectId);
}
}

63
tests/fixtures/auth_analysis/sql_join_acl.rs vendored Normal file
View file

@ -0,0 +1,63 @@
// target: authorization is enforced at the SQL layer via a JOIN
// against an ACL table (`group_members`) with a WHERE clause that pins
// the row to the current user (`gm.user_id = ?1` bound to `user.id`).
// Every returned row is membership-gated by construction, so downstream
// uses of the row's columns (`group_id` here) are authorized — the
// `realtime::publish_to_group` call MUST NOT be flagged as missing an
// ownership check after B3.
struct Ctx;
struct Req;
struct User {
id: i64,
}
struct Db;
impl Db {
fn prepare(&self, _s: &str) -> Query {
Query
}
}
struct Query;
impl Query {
fn bind(&self, _v: i64) -> Self {
Query
}
fn all(&self) -> Vec<Row> {
vec![]
}
}
struct Row;
impl Row {
fn get(&self, _c: &str) -> i64 {
0
}
}
mod auth {
pub async fn require_auth(_r: &super::Req, _c: &super::Ctx) -> Result<super::User, ()> {
Ok(super::User { id: 1 })
}
}
mod realtime {
pub fn publish_to_group(_g: i64, _m: &str) {}
}
pub async fn handle_list_group_docs(req: Req, ctx: Ctx) -> Result<String, ()> {
let user = auth::require_auth(&req, &ctx).await?;
let db = Db;
let rows = db
.prepare(
"SELECT d.id, d.group_id, d.title \
FROM docs d \
JOIN group_members gm ON gm.group_id = d.group_id \
WHERE gm.user_id = ?1 \
ORDER BY d.updated_at DESC",
)
.bind(user.id)
.all();
for row in rows {
let group_id: i64 = row.get("group_id");
realtime::publish_to_group(group_id, "doc_listed");
}
Ok("ok".into())
}

61
tests/fixtures/auth_analysis/sql_no_acl_join_flags.rs vendored Normal file
View file

@ -0,0 +1,61 @@
// B3 regression guard: the SELECT JOINs through `audit_log` (NOT in
// the configured ACL list) and the WHERE clause pins on
// `al.user_id = ?1`. The audit-log row's user is the audit subject,
// not the doc owner — so this query does NOT prove caller ownership
// of the returned `doc_id`. The downstream realtime publish MUST
// still flag for a missing ownership check after B3.
struct Ctx;
struct Req;
struct User {
id: i64,
}
struct Db;
impl Db {
fn prepare(&self, _s: &str) -> Query {
Query
}
}
struct Query;
impl Query {
fn bind(&self, _v: i64) -> Self {
Query
}
fn all(&self) -> Vec<Row> {
vec![]
}
}
struct Row;
impl Row {
fn get(&self, _c: &str) -> i64 {
0
}
}
mod auth {
pub async fn require_auth(_r: &super::Req, _c: &super::Ctx) -> Result<super::User, ()> {
Ok(super::User { id: 1 })
}
}
mod realtime {
pub fn publish_to_group(_g: i64, _m: &str) {}
}
pub async fn handle_audit_view(req: Req, ctx: Ctx) -> Result<String, ()> {
let user = auth::require_auth(&req, &ctx).await?;
let db = Db;
let rows = db
.prepare(
"SELECT d.id, d.group_id \
FROM docs d \
JOIN audit_log al ON al.doc_id = d.id \
WHERE al.user_id = ?1",
)
.bind(user.id)
.all();
for row in rows {
let group_id: i64 = row.get("group_id");
realtime::publish_to_group(group_id, "audited");
}
Ok("ok".into())
}

7
tests/fixtures/auth_analysis/stale_session_mutation.js vendored Normal file
View file

@ -0,0 +1,7 @@
async function confirmPublish(req) {
return projectModel.updateState(req.session.publishProjectId, {
visibility: "public",
});
}
module.exports = { confirmPublish };

8
tests/fixtures/auth_analysis/support_impersonation_missing.js vendored Normal file
View file

@ -0,0 +1,8 @@
const express = require("express");
const router = express.Router();
const requireLogin = require("./auth").requireLogin;
router.post("/support/impersonate", requireLogin, async (req, res) => {
await authService.startImpersonation(req, req.body.email);
res.json({ ok: true });
});

8
tests/fixtures/auth_analysis/token_clean.js vendored Normal file
View file

@ -0,0 +1,8 @@
async function acceptInvitation(token, currentUser) {
const invitation = await invitationModel.findByToken(token);
if (Date.now() < invitation.expires_at && invitation.email === currentUser.email) {
return workspaceModel.addMembership(invitation.workspace_id, currentUser.id, invitation.requested_role);
}
}
module.exports = { acceptInvitation };

8
tests/fixtures/auth_analysis/token_missing_expiry.js vendored Normal file
View file

@ -0,0 +1,8 @@
async function acceptInvitation(token, currentUser) {
const invitation = await invitationModel.findByToken(token);
if (invitation.email === currentUser.email) {
return workspaceModel.addMembership(invitation.workspace_id, currentUser.id, invitation.requested_role);
}
}
module.exports = { acceptInvitation };

8
tests/fixtures/auth_analysis/token_missing_recipient.js vendored Normal file
View file

@ -0,0 +1,8 @@
async function acceptInvitation(token, currentUser) {
const invitation = await invitationModel.findByToken(token);
if (Date.now() < invitation.expires_at) {
return workspaceModel.addMembership(invitation.workspace_id, currentUser.id, invitation.requested_role);
}
}
module.exports = { acceptInvitation };

8
tests/fixtures/auth_analysis/token_role_override.js vendored Normal file
View file

@ -0,0 +1,8 @@
async function acceptInvitation(token, currentUser, roleOverride) {
const invitation = await invitationModel.findByToken(token);
if (Date.now() < invitation.expires_at && invitation.email === currentUser.email) {
return workspaceModel.addMembership(invitation.workspace_id, currentUser.id, roleOverride || invitation.requested_role);
}
}
module.exports = { acceptInvitation };

8
tests/fixtures/auth_analysis/token_workspace_override.js vendored Normal file
View file

@ -0,0 +1,8 @@
async function acceptInvitation(token, currentUser, requestedWorkspaceId) {
const invitation = await invitationModel.findByToken(token);
if (Date.now() < invitation.expires_at && invitation.email === currentUser.email) {
return workspaceModel.addMembership(requestedWorkspaceId || invitation.workspace_id, currentUser.id, invitation.requested_role);
}
}
module.exports = { acceptInvitation };

59
tests/fixtures/auth_analysis/transitive_helper.rs vendored Normal file
View file

@ -0,0 +1,59 @@
// target: authorization happens inside `validate_target`, which
// internally calls `authz::require_membership` against the same
// `group_id` the handler subsequently mutates. The current rule cannot
// see this transitively — B4 lifts per-function auth-check summaries
// (which positional params are auth-checked) so the handler-level call
// to `validate_target(&db, group_id, user.id)` is recognised as an
// auth check covering `group_id`. Result: `db.exec(..)` MUST NOT flag
// after B4 lands.
struct Ctx;
struct Req;
struct User {
id: i64,
}
struct Db;
impl Db {
fn insert(&self, _s: &str, _a: &[i64]) {}
}
mod auth {
pub async fn require_auth(_r: &super::Req, _c: &super::Ctx) -> Result<super::User, ()> {
Ok(super::User { id: 1 })
}
}
mod authz {
pub async fn require_membership(
_db: &super::Db,
_group: i64,
_user: i64,
) -> Result<(), ()> {
Ok(())
}
}
async fn validate_target(db: &Db, group_id: i64, user_id: i64) -> Result<(), ()> {
// Helper encapsulates the ownership check.
authz::require_membership(db, group_id, user_id).await?;
Ok(())
}
pub async fn handle_create_comment(
req: Req,
ctx: Ctx,
group_id: i64,
body: String,
) -> Result<String, ()> {
let user = auth::require_auth(&req, &ctx).await?;
let db = Db;
// Authorization happens inside validate_target — helper-summary
// lifting propagates the per-param auth check so this covers
// `group_id`.
validate_target(&db, group_id, user.id).await?;
let _ = body;
db.insert(
"INSERT INTO comments (group_id, body) VALUES (?1, ?2)",
&[group_id],
);
Ok("ok".into())
}

15
tests/fixtures/auth_analysis/true_positive_missing_check.rs vendored Normal file
View file

@ -0,0 +1,15 @@
struct Ctx; struct Req; struct User { id: i64 } struct Db;
impl Db { fn exec(&self, _s: &str, _a: &[i64]) {} }
mod auth { pub async fn require_auth(_r: &super::Req, _c: &super::Ctx) -> Result<super::User, ()> { Ok(super::User{id:1}) } }
mod realtime { pub fn publish_to_group(_g: i64, _m: &str) {} }
pub async fn handle_delete_any_doc(req: Req, ctx: Ctx, doc_id: i64, group_id: i64) -> Result<String, ()> {
let _user = auth::require_auth(&req, &ctx).await?;
let db = Db;
// BUG: no ownership/membership check on group_id or doc_id.
// User might not be a member of `group_id` and might not own `doc_id`.
db.exec("DELETE FROM docs WHERE id = ?1", &[doc_id]);
realtime::publish_to_group(group_id, "doc_deleted");
Ok("ok".into())
}

8
tests/fixtures/auth_analysis/typed_admin_route_missing.ts vendored Normal file
View file

@ -0,0 +1,8 @@
const express = require("express");
const router = express.Router();
const requireLogin = require("./auth").requireLogin;
router.post("/admin/projects/:id/archive", requireLogin, async (req, res) => {
await adminAuditService.publish(req.params.id);
res.json({ ok: true });
});

8
tests/fixtures/auth_analysis/workspace_job_missing.js vendored Normal file
View file

@ -0,0 +1,8 @@
const express = require("express");
const router = express.Router();
const requireLogin = require("./auth").requireLogin;
router.post("/jobs/run-digest", requireLogin, async (req, res) => {
const digest = await digestService.runWorkspaceDigest(Number(req.body.workspaceId), req.body.kind);
res.json({ digest });
});