apunkt/nyx
1
0
Fork 0
mirror of https://github.com/elicpeter/nyx.git synced 2026-06-24 20:28:06 +02:00
Code Issues Projects Releases Packages Wiki Activity

Release/0.5.0 (#35)

Browse source 
* feat: Introduce function-scoped variable interning for state analysis with new tests and fixtures

* feat: Add Phase 26 symbolic execution enhancements with bitwise operator support, abstract interpretation refinements, and new taint analysis tests

* feat: Refine state analysis to handle factory-pattern resource returns with mixed-path tests and leak detection enhancements

* feat: Add Phase 27 debug views with symbolic execution, abstract interpretation, SSA, and call graph viewers; integrate with debug layout and styles

* feat: Add Phase 31 type-qualified symbolic resolution with receiver-based callee disambiguation and testing

* feat: Extend symbolic execution with state iteration, enhanced debug views, and debounced input handling

* feat: Add Phase 13 resource and auth pattern extensions with new tests and fixtures

* feat: Introduce CFG debug graph renderer with compact mode, toolbar, and DAG layout integration

* feat: Add Phase 28 encoding and decoding transform modeling with structural symex enhancements and new taint analysis tests

* feat: Extend abstract interpretation with type facts and constant value tracking in debug views and server logic

* feat: Add linear path handling and witness extraction to symbolic execution with Phase 28 transform mismatch detection

* feat: Refine Go auth and sanitizer handling with enhanced rules, state updates, and benchmark improvements

* feat: Enable auth-state analysis by default and update relevant tests in benchmark config

* test: Update state_tests to reflect default enablement of auth-state analysis and add auth suppression test

* docs: update CHANGELOG.md

* feat: Introduce per-index taint tracking in `HeapState` with `HeapSlot`, overflow handling, and revised SSA transfers

* feat: Introduce C/C++ language labels and refine heap state tracking in SSA transfers

* feat: Implement per-index array slot tracking in symbolic heap with overflow collapse

* feat: Add implicit definition handling for uninitialized declarations in SSA value allocation

* feat: Refactor function parameters and constants for improved clarity and maintainability

* refactor: Reorder module imports and improve formatting for consistency

* refactor: Fix formatting erorrs

* refactor: Fix clippy warnings

* refactor: Fix fmt warnings (again)

* chore: Update dependencies and improve feature configuration

* Add comprehensive tests for undertested modules (#36) (COPILOT)

* Add comprehensive tests for undertested modules

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083

* Add comprehensive tests for ext, project, walk, and errors modules

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/f3fc877e-f386-49ba-9793-fc93d3805083

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* chore: Update dependencies and improve feature configuration

* fix: formatting errors in new tests

* chore: Update license list in about.toml

* chore: made functions input inline

* chore: updated cfg graph to take up the full page

* chore: add Prettier configuration and update code formatting

* Add frontend test suite with Vitest (111 tests) (#37)

* Add Vitest test suite for frontend - 111 tests across utils, components, hooks, and graph utilities

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/7cf0dba2-ecff-4740-ba4d-92717e74a0b7

* ci: add frontend test step to CI workflow

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/5bc0ac9f-0a32-4d03-9cb7-7a15aea53fca

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* chore: simplify array initialization in test files for consistency

* ran typecheck

* feat: add AnalysisWorkspace component and integrate it into CfgViewerPage

* feat: update routing in AppLayout and improve empty state message in ExplorerPage

* feat: enhance scan progress tracking with additional metrics and stages

* feat: update license information and add license check script

* feat: implement cross-file symbolic execution with callee body persistence

* feat: replace dagre graphs with Graphology + ELK + Sigma for more advanced call stack and cfg rendering

* feat: ensure CFG function view is scoped to the selected function, preventing bleed into sibling functions

* feat: enhance resource tracking with proxy method summaries and improve finding extraction

* feat: add terminal function exit detection for accurate resource leak analysis

* feat: add warnings for loops and functions without bodies to improve error recovery

* feat: update lambda expression handling to ensure proper function classification and control flow

* feat: remove bounded formatting/string ops and add JSON.parse sanitizer for improved data handling

* feat: add inline return taint analysis and regression tests for improved security checks

* feat: add engine version management and migration handling for database schema updates

* feat: enhance first_call_ident to skip nested function bodies and add regression tests

* feat: enhance callee name resolution with two-segment normalization and disambiguation

* feat: add cross-file context flags and debug assertions for taint analysis

* feat: refactor taint analysis structure to unify context handling and improve clarity

* feat: enhance dead code elimination to preserve Sink, Source, and Sanitizer labels with new tests

* docs: updated CHANGELOG.md

* fmt: formatting fixes

* fix: fixed frontend formatting and lint warnings

* fix: optimized ci

* fix: optimized ci

* Add comprehensive multi-file test coverage to Nyx (#38)

* Initial checklist for multi-file test suite expansion

Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* Add 12 new multi-file test fixtures with TP/TN/near-miss coverage

Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/e550cb88-9767-4442-94d4-101bf5bb0e23

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* deleted root repo

* rebuilt to test for regressions

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>

* feat: enhance import alias resolution and taint tracking

* feat: implement security hardening with CSRF protection and path validation

* feat: add support for import alias bindings in Python, PHP, and Rust

* feat: enhance CFG analysis modes and improve code readability

* feat: add detection for parameterized SQL queries to enhance security

* feat: add safe internal redirect handling and enhance session destroy validation

* feat: implement security improvements by addressing vulnerabilities in execAsync, session management, and file downloads

* feat: enhance taint detection by adding support for inline source member expressions in call arguments

* feat: implement pre-emission of Source nodes for inline source member expressions in call arguments

* feat: add support for Throw statement in control flow and error handling

* feat: add debug and echo endpoints with potential information leakage

* feat: implement internal redirect suppression and enhance taint detection

* feat: implement module alias tracking for dynamic dispatch in JS/TS

* feat: add authorization analysis module with Express support

* feat: add authorization analysis module with Express support

* feat: add tests for admin guard requirements and clean checks in authorization analysis

* feat: integrate Koa and Fastify frameworks into authorization analysis

* feat: add Flask and Django support to authorization analysis module

* feat: add support for Rails and Sinatra frameworks in authorization analysis

* feat: add support for Axum, ActixWeb, and Rocket frameworks in authorization analysis

* feat: add support for ActixWeb, Axum, and Rocket frameworks in authorization analysis

* feat: add support for Rails and Sinatra in authorization analysis

* chore: add .DS_Store to .gitignore

* refactor: simplify conditional checks and improve readability in multiple files

* refactor: update usage of Option methods for improved clarity and consistency

* refactor: improve code readability by simplifying conditional checks and formatting

* refactor: improve code formatting and readability by simplifying conditional checks

* refactor: simplify conditional checks and improve readability in multiple files

* refactor: simplify conditional checks in axum.rs for improved readability

* feat: add CodeQL analysis configuration for enhanced security scanning

* test: add comprehensive tests for `src/output.rs` SARIF builder (#39)

* chore: start test coverage improvement work

Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* test: add comprehensive tests for src/output.rs SARIF builder

Agent-Logs-Url: https://github.com/elicpeter/nyx/sessions/cd7ff398-134e-4728-a5e7-0353a0744423

Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>

* refactor: improve code formatting and readability in output.rs

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: elicpeter <54954007+elicpeter@users.noreply.github.com>
Co-authored-by: elipeter <elicpeter@gmail.com>

* refactor: improve code formatting and readability in output.rs

* Potential fix for code scanning alert no. 210: Uncontrolled data used in path expression

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* Potential fix for code scanning alert no. 211: Uncontrolled data used in path expression

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

* refactor: enhance triage file path handling with improved error management and validation

* refactor: updated func summaries for richer detail

* refactor: update SSA summary extraction to use canonical FuncKey for distinct entries

* refactor: enhance callee metadata structure to support arity, receiver, and qualifier for better overload resolution

* refactor: add support for keyword arguments in function calls and enhance receiver extraction for method-style calls

* refactor: implement new Flask routes for safe and unsafe shell command execution

* refactor: separate receiver handling in SSA operations and enhance taint propagation

* refactor: improve arity handling by using arg_uses for positional argument count and enhance witness scoring for tainted arguments

* refactor: implement auth decorator extraction and classification for multiple languages

* refactor: enhance Rust module path resolution and use map handling for cross-file disambiguation

* refactor: introduce CalleeQuery struct for structured callee resolution and enhance resolver logic

* refactor: implement same-file identity collision handling for `runTask` to ensure correct resolver behavior

* refactor: standardize default struct initialization across multiple files

* feat: add scripts for formatting checks and auto-fixes with test summaries

* refactor: simplify character splitting and enhance namespace qualifier handling

* refactor: improve documentation clarity and enhance code readability in resolver logic

* refactor: replace default struct initialization with explicit field assignments for clarity

* feat: enhance anonymous function naming by deriving context-based bindings

* refactor: streamline match expressions for improved readability and performance

* refactor: streamline match expressions for improved readability and performance

* refactor: replace loop with while let for improved clarity and performance

* feat: add SSA constant propagation support to analysis context for improved accuracy

* feat: add SSA constant propagation support to analysis context for improved accuracy

* feat: implement shell metacharacter validation and bounded-length checks in Rust analysis

* feat: add static map analysis for command injection suppression and type safety

* refactor: simplify match statements and reduce line breaks for improved readability

* feat(summary): phase 1/5 SinkSite data model for primary sink-location attribution

Introduce SinkSite (file_rel, line, col, snippet, cap) carrying the
primary sink source-location through function summaries. Swap
SsaFuncSummary.param_to_sink and FuncSummary.param_to_sink from a coarse
Cap map to a deduped SmallVec<[SinkSite; 1]> per parameter, with a
backward-compatible cap_sites() helper and serde defaults so pre-phase-1
on-disk rows continue to deserialise cleanly.

Extraction: SinkSiteLocator bundles the tree/bytes/file_rel needed by
extract_ssa_func_summary; ParsedFile::extract_ssa_artifacts wires the
locator in for the persisted pass-1 path, while pass-2 intra-file
transient summaries fall back to cap-only sites (behavior unchanged).
Merge: GlobalSummaries::insert now unions sink sites with
(file_rel, line, col, cap) dedup via shared union_param_sink_sites
helper.

Database: JSON-serialised summary columns carry the new shape
automatically; no schema change needed.

Phase 2 will consume SinkSite in build_taint_diag() to overwrite the
caller-site Finding.line with the callee's sink line when resolved via
summary. Phase 1 keeps behavior unchanged: scanning
tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs still produces the
same (wrong) line 10 finding.

Adds round-trip tests covering SinkSite solo, SsaFuncSummary with sink
sites, legacy-JSON default handling for both summary types, and merge
dedup.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* feat(taint): phase 2/5 thread SinkSite into SsaTaintEvent and Finding

Plumb Phase 1's SinkSite through the event pipeline into Findings,
no output change yet.  SsaTaintEvent gains `primary_sink_site:
Option<SinkSite>`; when the main or callback sink-emission path has
non-empty `param_to_sink_sites`, filter to sites whose
`(line != 0) && (cap ∩ sink_caps != ∅)` and emit one event per
distinct site — the multi-primary collapse keeps each downstream
Finding single-primary.

Resolution: ResolvedSummary and SinkInfo gain mirror
`param_to_sink_sites` fields, populated from `SsaFuncSummary.param_to_sink`
(SSA + callback paths) and `FuncSummary.param_to_sink` (global paths).
Label, local-summary, and interop resolution paths leave the field
empty — they only ever had cap-level info to begin with.

Finding: new `primary_location: Option<SinkLocation>` with
`file_rel/line/col`.  `ssa_events_to_findings` maps
`event.primary_sink_site` → `Finding.primary_location`, filtering
cap-only sites (`line == 0`) to `None` so the (0,0) sentinel never
leaks to formatters.  Dedup key extended with the primary location
so multi-site events aren't collapsed back together.

Invariants (debug_assert!):
* every SinkSite reaching emission has `line != 0 && cap ∩ sink_caps
  != ∅` — enforced by the pick_primary_sink_sites* filters;
* every populated Finding.primary_location has `line != 0` AND
  non-empty `file_rel` — the cap-only → None translation upstream
  guarantees this.

Deliberately independent of `uses_summary`: that flag tracks whether
the *taint chain* used a summary, whereas primary attribution
requires only that the *sink* itself was summary-resolved.  A local
source reaching a cross-file sink produces `uses_summary=false`
alongside a populated primary_location — documented on
Finding.primary_location, covered by
`cross_file_sink_finding_carries_primary_location`.

build_taint_diag, SARIF/JSON/explanation formatters, and the
benchmark scorer remain untouched: finding.line still comes from
`cfg_graph[finding.sink]`, so cmdi_indirect.rs still reports line 10
and the benchmark's rs-cmdi-003 row still shows FN in the LOC column.

Tests: `cross_file_sink_finding_carries_primary_location` (proves
plumbing via a synthetic FuncSummary carrying a SinkSite at 42:5) and
`cross_file_sink_cap_only_site_leaves_primary_location_none`
(regression guard against cap-only sites surfacing).  All 1566 lib
tests + integration tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(output): phase 3/5 consume primary sink location in diag + SARIF

When a finding's primary_location (populated in phase 2 from a callee
summary's SinkSite) names the dangerous instruction inside a callee
body, attribute the diagnostic line to that location instead of the
caller's call site. The call site is demoted to a Call step in
flow_steps, and a synthetic Sink step at the primary location is
appended so analysts still see the full trace.

Changes:
- Add scan_root parameter to build_taint_diag so file_rel can be
  resolved back to an absolute path via a shared resolve_file_rel
  helper. Empty file_rel (single-file scans where namespace == "")
  resolves to the file under analysis.
- Extend SinkLocation with snippet, carried from the upstream
  SinkSite so the formatter needs no second file read.
- Relax the ssa_events_to_findings debug_assert to allow empty
  file_rel, which is valid when scan root equals the file itself.
- SARIF: emit data-flow as codeFlows[0].threadFlows[0].locations[];
  locations[0] already reflects the primary sink position via the
  updated diag line/col.

Acceptance: scan on tests/benchmark/corpus/rust/cmdi/cmdi_indirect.rs
now reports line 5 (Command::new) as the primary sink, with the call
site at line 10 visible in flow_steps.

Two expect.json fixtures updated (must_match line_range widened):
- javascript/taint/context_sensitive_call: 12-14 -> 7-14 (line 8 is
  the real sink inside run()).
- rust/cfg/closure_async: 10-10 -> 10-11 (line 11 is Command::new
  inside the closure).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(bench): phase 4/5 validate primary sink attribution across corpus

Extend the benchmark scorer and ground truth to lock in phase 3's
primary-location behavior, and add fixtures that exercise the new
capability end-to-end.

Scorer (tests/benchmark_test.rs):
- Add optional `expected_call_site_lines: Option<Vec<[usize; 2]>>` on
  Case. When present, score_location_level additionally requires at
  least one flow_step in the finding's evidence trace to fall within
  ±2 of the call-site range. When absent, the check is skipped —
  fully forward-compatible with existing fixtures.
- Retain ±2 tolerance on expected_sink_lines (compared against the
  now-primary Diag.line post-phase-3).

Ground truth edits:
- rs-cmdi-cross-001: expected_sink_lines [8,8] -> [9,9]. Line 8 is the
  transform::wrap call site (a cross-file propagator, not a sink);
  line 9 is Command::new, the real sink. The ±2 tolerance happened to
  mask this stale attribution but it was semantically wrong — phase 4
  is the right time to correct it. Also adds expected_call_site_lines
  [8,8] so the new field is exercised on an existing cross-file case.
- rs-cmdi-003: adds expected_call_site_lines [10,10] (run_cmd call).
  This fixture's sink (Command::new inside run_cmd at line 5) was the
  motivating case for phases 1-3; adding the call-site assertion
  guards against regression to caller-line attribution.

New fixtures:
- rust/cmdi/cmdi_indirect_multisink.rs (rs-cmdi-009): helper run_both
  takes two tainted params and invokes two Command sinks on
  consecutive lines. Locks in that primary line lands inside the
  helper (lines 5-6), not at the caller (line 12). Notes document
  that SinkSite is currently one-per-callee so both findings today
  collapse onto the first sink; expected_sink_lines=[5,6] and
  expected_call_site_lines=[12,12] stay valid either way.
- python/cmdi/cross_indirect_sink/{app.py,helper.py} (py-cmdi-cross-
  004): sink os.system lives in helper.py (cross-file), caller in
  app.py reads env source and calls run_cmd. Verifies phase 3's
  cross-file primary attribution: Diag.path = helper.py, Diag.line =
  5, with app.py:7 recorded in flow_steps as a Call step.

Acceptance:
- `cargo test --test benchmark_test -- --ignored --nocapture` passes.
- rs-cmdi-003 is TP/TP/TP (the target flip FN->TP at LOC). All
  pre-existing TP/TP/TP fixtures remain TP/TP/TP; 2 new fixtures are
  TP/TP/TP.
- Aggregate rule-level: TP=158 FP=10 FN=1 TN=97, P=0.940 R=0.994
  F1=0.966 on the 266-case corpus (was TP=156 FP=10 FN=1 TN=97 on
  264 pre-phase-4, delta is the +2 new cases both resolving TP).
- Full `cargo test` green (1566 lib tests + all integration tests).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(taint): phase 5/5 lock Finding.primary_location contract via regression test

Add a regression test in src/taint/ssa_transfer.rs that wires up a synthetic
SsaFuncSummary with a SinkSite at other.rs:42:10 and drives the three
emission stages (pick_primary_sink_sites → emit_ssa_taint_events →
ssa_events_to_findings) against a minimal caller SSA body.  Asserts the
resulting Finding.primary_location is exactly that triple.

The existing integration tests in src/taint/tests.rs cover the coarse
FuncSummary path end-to-end through analyse_file.  This test locks in the
lower-level SSA-side plumbing so a future refactor that silently drops the
site between pick → emit → findings fails here rather than only at the
benchmark layer.

Also refreshes tests/benchmark/results/latest.json (timestamp only; rs-cmdi-003
remains TP/TP/TP and the aggregate P/R/F1 are unchanged from phase 4).

Closes the primary sink-location attribution feature (phases 1-5/5):
* Phase 1 — SinkSite data model on summaries.
* Phase 2 — SinkSite threaded into SsaTaintEvent and Finding.
* Phase 3 — diag + SARIF consume primary_location.
* Phase 4 — benchmark validates primary_call_site_lines across corpus.
* Phase 5 — regression test locks the event→finding contract.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor: clean up formatting and improve readability in multiple files

* refactor: simplify type definition for deduplication key in findings

* test(harness): add must_not_match expectation for FP regression guards

Extends ExpectedFinding with must_not_match field that asserts a
diagnostic must NOT fire — presence is a hard failure. Non-consuming
scan so it coexists with must_match entries on the same rule_id.
Adds forbidden_violations accumulator and updates summary line.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(regression): update expectations to ensure must_not_match for various taint and resource leak rules

* feat: implement auto-seeding for JS/TS handler parameters to enhance taint tracking

* feat: update switch statement handling to improve control flow analysis

* feat: implement promisify alias handling for JS/TS to enhance taint tracking

* feat: enhance taint tracking by refining expectation handling and adding mode filtering

* feat: refine SQL handling in stream processing and enhance auto-seeding for handler parameters

* feat: update taint tracking rules to enforce full mode matching and improve flow analysis

* feat: enhance Ruby subshell handling to improve taint tracking and flow analysis

* feat: update xss_response expectations to refine taint flow analysis and enhance regression guarding

* feat: refine framework detection and update expectation handling for Echo and Sinatra

* feat: implement max_count for taint tracking expectations and deduplicate findings

* feat: add strict_unexpected handling for taint-unsanitised-flow in expectation files

* feat: enhance deduplication of taint-unsanitised-flow findings by collapsing based on line and severity

* feat: add strict_unexpected handling for taint-unsanitised-flow in multiple expectation files

* feat: add structural invariant checks for SSA bodies

* feat: ensure deterministic phi emission order using BTreeSet

* feat: enhance handling of terminators to ensure authoritative flow through successor edges

* feat: enhance Goto terminator handling to ensure all successors are marked executable

* feat: refactor code for improved readability and organization

* feat: simplify predicate checks and enhance readability in SSA handling

* feat: implement per-file parse timeout and enhance file size handling

* feat: migrate analysis engine toggles from environment variables to configuration file

* feat: remove unnecessary whitespace in hostile_input_tests.rs

* feat: remove unnecessary whitespace in hostile_input_tests.rs

* feat: update dependencies and enhance documentation on language maturity

* feat: enhance security headers and improve request body limits

* feat: implement sink capability bits for deduplication and enhance evidence tagging

* feat: implement dynamic activation handling for gated sinks and enhance validation logic

* feat: enhance configuration documentation and clarify inline analysis cache behavior

* feat: implement panic recovery during analysis to continue scans past errors

* feat: add expectations configuration for taint analysis and performance metrics

* feat: enhance error handling and logging during file reading and mutex locking

* feat: add cross-file body loading tests and plumbing for CF-1 phase

* feat: implement cross-file k=1 context-sensitive inline taint analysis with new tests and fixtures

* feat: implement indexed-scan parity in cross-file inline analysis with new dropdown and copy functionality

* feat: enhance classification span handling in CFG and AST for improved source attribution

* feat: add new Express routes for handling user input and telemetry data

* feat: implement ternary expression handling in CFG with diamond structure for JS/TS

* feat: implement Phase CF-3 abstract-domain transfer channels in summaries

* feat: add support for string-prefix transfer in cross-file calls and update tests

* docs: reduce RESULTS.md doc size

* feat: implement Phase CF-4 per-return-path summary decomposition with tests

* feat: update parameter handling in pass1 and refactor SsaFuncSummary initialization

* feat: implement Phase CF-5 for cross-file SCC joint fixed-point convergence with new flags and tests

* feat: implement Phase CF-6 with parameter-granularity points-to summaries and associated tests

* refactor: update comments and documentation for clarity and consistency

* style: format code for consistency and readability

* refactor: simplify verdict handling and improve edge checking logic

* refactor: optimize path and identifier collection by avoiding unnecessary cloning

* chore: update Cargo.toml for Rust version 1.85 and add ignored files; modify CHANGELOG and README for clarity on state analysis defaults

* refactor: update documentation and improve clarity in configuration files

* refactor: update documentation and improve clarity in configuration files

* feat: add JS/TS pass-2 convergence tests and expectations configuration

* feat: add Phase 5 regression tests for inline cache origin attribution and update related logic

* feat: implement Phase 7 deduplication and alternative path linking for taint findings

* feat: implement structural DFS index for anonymous functions and update naming conventions

* feat: add Phase 8 regression tests for container-element taint in JS and Python

* feat: add engine-depth profiles and explain-engine option for CLI

* feat: update expectations and add new README fixtures for multi-file scan regression

* feat: implement Phase 11 callback-alias and factory patterns with regression tests

* feat: implement Terminator::Switch for multi-way dispatch and add regression tests

* feat: add real-CVE benchmark fixtures for CVE-2023-48022, CVE-2019-14939, and CVE-2023-26159 with corresponding patched variants

* refactor: extract cfg and ssa_transfer to submodules

* refactor: cargo fmt

* refactor: remove unnecessary blank line in cfg_tests.rs

* refactor: remove unnecessary planning file

* chore: update Rust version to 1.88 and bump dependencies in Cargo files

* feat: enhance triage UI with new layout and controls, update README for clarity

* feat: enhance triage UI with new layout and controls, update README for clarity

* chore: remove outdated section from README for version 0.5.0

* docs: improve clarity and consistency in README content

* chore: add "GPL-3.0-or-later" to license options in about.toml

* chore: update license handling in about.toml and check-licenses.mjs

* style: format code for improved readability in TriagePage component

* style: format code for improved readability in TriagePage component

* chore: enhance license handling and improve body_id scoping in seed lookup

* feat: introduce owner and parent body IDs for enhanced seed scoping

* feat: implement direction-aware engine provenance with new CLI flag for strict CI gating

* feat: add Undef SSA operation for improved control-flow handling

* style: improve code formatting for consistency and readability in multiple files

* feat: add 16-function chain SCC across multiple files for enhanced analysis

* style: simplify code formatting for improved readability in multiple files

* fix: update CapHitReason default implementation and improve README clarity

* docs: enhance README with detailed explanations of taint analysis and limitations

* docs: refine README for clarity and consistency in taint analysis section

* style: improve code formatting for better readability in NewScanModal and scans

* fix: update cargo-about command to use --offline for deterministic license generation

* fix: update cargo-about command to use --offline for deterministic license generation

* ci: add step to prime cargo registry cache for deterministic license generation

* feat: add support for non-sink collections in authorization analysis

* feat: enhance authorization checks with row-level ownership equality and binding tracking

* feat: implement self-scoped user handling and enhance ownership checks

* refactor: simplify assertions and formatting in authorization analysis tests

* fix: normalize line endings in THIRDPARTY-LICENSES.html generation and update README with AI disclosure

* docs: update AI disclosure section for clarity and conciseness

* feat: add AI Contribution Policy and update contributing guidelines for AI assistance disclosure

* feat: enhance authorization analysis with SSA-derived variable type classification

* feat: implement auth_finding_to_diag function for enhanced security diagnostics

* feat: add args_value_refs to CallSite struct for enhanced argument tracking

* feat: add args_value_refs to CallSite struct for enhanced argument tracking

* feat: add direction-aware engine provenance with LossDirection classification and new CLI flag

* feat: simplify strip_cap_from_call_args call by removing unnecessary line breaks

* feat: enhance error message handling in cli_validation_tests for better Windows compatibility

* feat: optimize release profile settings in Cargo.toml and update CodeQL configuration

* feat: enhance release build process with SBOM generation and SLSA provenance

* feat: update actions/checkout and actions/setup-node to v6, enhance CLI options, and improve auth-check summaries

* feat: introduce PathFact handling for path safety checks and rejection logic

* feat: introduce PathFact handling for path safety checks and rejection logic

* feat: update benchmark data and enhance path sanitization logic with new safety checks

* feat: document AI assistance in frontend UI development and human review process

* feat: add return path facts for enhanced path safety checks and update documentation

* chore: update release date for version 0.5.0 in CHANGELOG.md

* chore: clean up ci.yml by removing outdated comments and clarifying steps

* feat: implement cross-language path sanitizers and validators for enhanced security

* feat: enhance SSA value usage tracking by including block terminators and improve path safety checks

* feat: enhance switch statement handling by adding per-case path constraints and support for exclusive cases

* refactor: simplify conditional formatting and improve code readability in executor and lower modules

* feat: add vulnerable examples for various languages demonstrating authentication and sanitization issues

* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers

* feat: enhance actor context recognition for self-actor identifiers and add support for global non-sink receivers

* feat: add transform classifiers for Java, Go, and Ruby with corresponding tests

* refactor: clarify comments on reassign-to-constant idiom and sink behavior in guards.rs

---------

Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Eli Peter 2026-04-25 17:59:11 -04:00 • committed by GitHub
parent c4ce08b452
commit 41128177d2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2144 changed files with 201812 additions and 8927 deletions
Download patch file Download diff file Expand all files Collapse all files

17
tests/fixtures/real_world/javascript/cfg/async_await_flow.expect.json vendored
View file

@ -13,13 +13,13 @@
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": false,
"must_match": true,
"line_range": [
5,
9
],
"evidence_contains": [],
"notes": "execAsync is a promisified wrapper; scanner cannot trace through util.promisify to recognize it as a sink"
"notes": "userCmd (auto-seeded user* handler param) flows to execAsync — promisify binding + hardcoded execAsync matcher fire CMD_INJECT"
},
{
"rule_id": "taint-unsanitised-flow",
@ -30,7 +30,7 @@
19
],
"evidence_contains": [],
"notes": "fetch response flows to child_process.exec but fetch is not a recognized source"
"notes": "fetch response flows to child_process.exec but fetch is not modeled as a source of external data (future work: dual-label fetch)"
},
{
"rule_id": "cfg-unguarded-sink",
@ -42,6 +42,17 @@
],
"evidence_contains": [],
"notes": "child_process.exec called without validation of data.command"
},
{
"rule_id": "cfg-unguarded-sink",
"severity": "MEDIUM",
"must_match": false,
"line_range": [
3,
3
],
"evidence_contains": [],
"notes": "structural: cfg-unguarded-sink on high-risk sink at line 3 \u2014 taint active but no confirmed flow"
}
]
}

11
tests/fixtures/real_world/javascript/cfg/callback_nesting.expect.json vendored
View file

@ -31,6 +31,17 @@
],
"evidence_contains": [],
"notes": "child_process.exec receives unchecked file contents"
},
{
"rule_id": "cfg-unguarded-sink",
"severity": "MEDIUM",
"must_match": false,
"line_range": [
5,
5
],
"evidence_contains": [],
"notes": "structural: cfg-unguarded-sink on high-risk sink at line 5 \u2014 taint active but no confirmed flow"
}
]
}

18
tests/fixtures/real_world/javascript/cfg/switch_fallthrough.expect.json vendored
View file

@ -24,24 +24,24 @@
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": false,
"must_match": true,
"line_range": [
4,
8
],
"evidence_contains": [],
"notes": "userInput is a function param, not a recognized source; requires interprocedural analysis"
"notes": "userInput flows to eval via handler param-as-source heuristic"
},
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": false,
"must_match": true,
"line_range": [
10,
14
],
"evidence_contains": [],
"notes": "userInput flows to child_process.execSync but userInput is a param, not a recognized source"
"notes": "userInput flows to child_process.execSync via handler param-as-source heuristic; reachable via switch case 'exec' dispatch"
},
{
"rule_id": "cfg-error-fallthrough",
@ -53,6 +53,16 @@
],
"evidence_contains": [],
"notes": "Missing break after exec case causes fallthrough to safe case"
},
{
"rule_id": "cfg-unreachable-sink",
"severity": "MEDIUM",
"must_not_match": true,
"line_range": [
12,
12
],
"notes": "Regression guard: child_process.execSync in exec case is reachable via switch dispatch — cfg-unreachable-sink must NOT fire here"
}
]
}

21
tests/fixtures/real_world/javascript/cfg/try_catch_finally.expect.json vendored
View file

@ -20,6 +20,27 @@
],
"evidence_contains": [],
"notes": "fd leaks when throw fires at line 22 before closeSync at line 24; scanner may not track fd lifecycle in JS"
},
{
"rule_id": "state-resource-leak",
"severity": "MEDIUM",
"must_not_match": true,
"line_range": [
6,
6
],
"notes": "fd IS properly closed in finally block at line 13 — state-resource-leak must NOT fire (regression guard for finally tracking)"
},
{
"rule_id": "state-resource-leak-possible",
"severity": "LOW",
"must_match": false,
"line_range": [
6,
6
],
"evidence_contains": [],
"notes": "noise: state-resource-leak-possible fires because close is inside `if (fd !== undefined)` conditional; conservative may-leak signal is actually reasonable"
}
]
}

11
tests/fixtures/real_world/javascript/mixed/express_auth_cmdi.expect.json vendored
View file

@ -55,6 +55,17 @@
],
"evidence_contains": [],
"notes": "child_process.exec called without input validation guard"
},
{
"rule_id": "cfg-unguarded-sink",
"severity": "MEDIUM",
"must_match": false,
"line_range": [
18,
18
],
"evidence_contains": [],
"notes": "structural: cfg-unguarded-sink on high-risk sink at line 18 \u2014 taint active but no confirmed flow"
}
]
}

11
tests/fixtures/real_world/javascript/mixed/taint_through_state.expect.json vendored
View file

@ -44,6 +44,17 @@
],
"evidence_contains": [],
"notes": "fd from fs.openSync leaks when early return fires at line 13; scanner may not track JS fd lifecycle"
},
{
"rule_id": "cfg-unguarded-sink",
"severity": "MEDIUM",
"must_match": false,
"line_range": [
19,
19
],
"evidence_contains": [],
"notes": "structural: cfg-unguarded-sink on high-risk sink at line 19 \u2014 taint active but no confirmed flow"
}
]
}

23
tests/fixtures/real_world/javascript/safe/safe_parameterized_pg.expect.json vendored Normal file
View file

@ -0,0 +1,23 @@
{
"description": "Safe parameterized PostgreSQL query — tainted data in bind array with $1 placeholder",
"tags": ["taint", "sqli", "pg", "safe"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": false,
"line_range": [3, 9],
"evidence_contains": [],
"notes": "userId flows into bind parameter array, not into the SQL string — should not fire"
},
{
"rule_id": "cfg-unguarded-sink",
"severity": null,
"must_match": false,
"line_range": [3, 9],
"evidence_contains": [],
"notes": "Parameterized query should suppress cfg-unguarded-sink as well"
}
]
}

9
tests/fixtures/real_world/javascript/safe/safe_parameterized_pg.js vendored Normal file
View file

@ -0,0 +1,9 @@
const { Client } = require('pg');
async function getUser(req, res) {
const userId = req.query.id;
const client = new Client();
await client.connect();
const result = await client.query("SELECT * FROM users WHERE id = $1", [userId]);
res.json(result.rows);
}

15
tests/fixtures/real_world/javascript/safe/safe_parameterized_query.expect.json vendored Normal file
View file

@ -0,0 +1,15 @@
{
"description": "Safe parameterized query — tainted data in bind array, not in SQL string",
"tags": ["taint", "sqli", "mysql", "safe"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": false,
"line_range": [3, 8],
"evidence_contains": [],
"notes": "userId is passed as a bind parameter, not concatenated into the query string — should not fire"
}
]
}

9
tests/fixtures/real_world/javascript/safe/safe_parameterized_query.js vendored Normal file
View file

@ -0,0 +1,9 @@
const mysql = require('mysql');
function getUserSafe(req, res) {
const userId = req.query.id;
const connection = mysql.createConnection({host: 'localhost'});
connection.query('SELECT * FROM users WHERE id = ?', [userId], function(err, results) {
res.json(results);
});
}

63
tests/fixtures/real_world/javascript/safe/safe_parameterized_variants.expect.json vendored Normal file
View file

@ -0,0 +1,63 @@
{
"description": "Parameterized SQL queries across multiple drivers and placeholder styles — all safe",
"tags": ["taint", "sqli", "mysql", "pg", "safe", "parameterized"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": false,
"line_range": [5, 11],
"evidence_contains": [],
"notes": "MySQL ? placeholder — parameterized, should not fire"
},
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": false,
"line_range": [14, 21],
"evidence_contains": [],
"notes": "PG $1/$2 placeholders — parameterized, should not fire"
},
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": false,
"line_range": [24, 29],
"evidence_contains": [],
"notes": "pool.query with $1 — parameterized, should not fire"
},
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": false,
"line_range": [32, 35],
"evidence_contains": [],
"notes": "db.execute with ? — parameterized, should not fire"
},
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": false,
"line_range": [38, 43],
"evidence_contains": [],
"notes": "Template literal with ? (no interpolation) — parameterized, should not fire"
},
{
"rule_id": "cfg-unguarded-sink",
"severity": null,
"must_match": false,
"line_range": [1, 44],
"evidence_contains": [],
"notes": "No cfg-unguarded-sink should fire for any parameterized query"
},
{
"rule_id": "state-resource-leak",
"severity": null,
"must_match": false,
"line_range": [1, 44],
"evidence_contains": [],
"notes": "noise: resource leak unrelated to SQL injection"
}
]
}

43
tests/fixtures/real_world/javascript/safe/safe_parameterized_variants.js vendored Normal file
View file

@ -0,0 +1,43 @@
const mysql = require('mysql');
const { Client, Pool } = require('pg');
// MySQL ? placeholder with connection.query
function mysqlSafe(req, res) {
const id = req.query.id;
const connection = mysql.createConnection({host: 'localhost'});
connection.query('SELECT * FROM users WHERE id = ?', [id], function(err, rows) {
res.json(rows);
});
}
// PostgreSQL $1/$2 placeholders with client.query
async function pgClientSafe(req, res) {
const name = req.query.name;
const age = req.query.age;
const client = new Client();
const result = await client.query('SELECT * FROM users WHERE name = $1 AND age = $2', [name, age]);
res.json(result.rows);
}
// Pool.query with $1 placeholder
async function pgPoolSafe(req, res) {
const id = req.params.id;
const pool = new Pool();
const result = await pool.query('SELECT email FROM users WHERE id = $1', [id]);
res.json(result.rows);
}
// db.execute with ? placeholder
function dbExecuteSafe(req, res) {
const username = req.body.username;
db.execute('INSERT INTO logs (username) VALUES (?)', [username]);
res.sendStatus(200);
}
// Template literal (no interpolation) with ? placeholder
function templateLiteralSafe(req, res) {
const id = req.query.id;
connection.query(`SELECT * FROM products WHERE id = ?`, [id], function(err, rows) {
res.json(rows);
});
}

4
tests/fixtures/real_world/javascript/state/db_connection.expect.json vendored
View file

@ -13,13 +13,13 @@
{
"rule_id": "state-resource-leak",
"severity": null,
"must_match": false,
"must_match": true,
"line_range": [
2,
11
],
"evidence_contains": [],
"notes": "mysql.createConnection without conn.end(); scanner may not track mysql connection lifecycle"
"notes": "mysql.createConnection without conn.end(); resource-pair rules include mysql.createConnection acquire and .end release"
}
]
}

14
tests/fixtures/real_world/javascript/state/event_listener_leak.expect.json vendored
View file

@ -9,17 +9,5 @@
"modes": [
"full"
],
"expected": [
{
"rule_id": "state-resource-leak",
"severity": null,
"must_match": false,
"line_range": [
3,
14
],
"evidence_contains": [],
"notes": "Socket connections accumulate in array without close/error handlers; scanner likely cannot track event listener patterns"
}
]
"expected": []
}

4
tests/fixtures/real_world/javascript/state/fd_leak.expect.json vendored
View file

@ -13,13 +13,13 @@
{
"rule_id": "state-resource-leak",
"severity": null,
"must_match": false,
"must_match": true,
"line_range": [
2,
10
],
"evidence_contains": [],
"notes": "fd from fs.openSync is never closed in readAndProcess; scanner may not track JS fd lifecycle"
"notes": "fd from fs.openSync is never closed in readAndProcess"
}
]
}

4
tests/fixtures/real_world/javascript/state/handle_reuse.expect.json vendored
View file

@ -14,7 +14,7 @@
{
"rule_id": "state-double-close",
"severity": null,
"must_match": false,
"must_match": true,
"line_range": [
2,
8
@ -25,7 +25,7 @@
{
"rule_id": "state-use-after-close",
"severity": null,
"must_match": false,
"must_match": true,
"line_range": [
8,
15

15
tests/fixtures/real_world/javascript/taint/alias_no_sanitize_unsafe.expect.json vendored Normal file
View file

@ -0,0 +1,15 @@
{
"description": "Regression guard: taint flows through alias without sanitization. alias = obj means alias.data carries obj.data taint to res.send.",
"tags": ["taint", "alias", "xss"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [4, 8],
"evidence_contains": [],
"notes": "req.query.input flows through obj.data → alias.data → res.send — XSS without sanitization"
}
]
}

9
tests/fixtures/real_world/javascript/taint/alias_no_sanitize_unsafe.js vendored Normal file
View file

@ -0,0 +1,9 @@
var express = require('express');
var app = express();
app.get('/unsafe', function(req, res) {
var obj = {};
obj.data = req.query.input;
var alias = obj;
res.send(alias.data);
});

13
tests/fixtures/real_world/javascript/taint/alias_sanitize_propagation.expect.json vendored Normal file
View file

@ -0,0 +1,13 @@
{
"description": "Alias-aware sanitization: obj and alias share the same object. Sanitizing alias.data via DOMPurify should also suppress obj.data at res.send.",
"tags": ["taint", "alias", "sanitization", "xss"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"must_not_match": true,
"line_range": [6, 9],
"notes": "alias.data is sanitized by DOMPurify, and alias is a must-alias of obj — obj.data must NOT fire (regression guard)"
}
]
}

10
tests/fixtures/real_world/javascript/taint/alias_sanitize_propagation.js vendored Normal file
View file

@ -0,0 +1,10 @@
var express = require('express');
var app = express();
app.get('/alias', function(req, res) {
var obj = {};
obj.data = req.query.input;
var alias = obj;
alias.data = DOMPurify.sanitize(alias.data);
res.send(obj.data);
});

15
tests/fixtures/real_world/javascript/taint/array_push_safe.expect.json vendored Normal file
View file

@ -0,0 +1,15 @@
{
"description": "No XSS: only constants pushed into array then joined into HTML",
"tags": [
"taint",
"xss",
"express",
"array",
"container",
"safe"
],
"modes": [
"full"
],
"expected": []
}

9
tests/fixtures/real_world/javascript/taint/array_push_safe.js vendored Normal file
View file

@ -0,0 +1,9 @@
var express = require('express');
var app = express();
app.get('/safe', function(req, res) {
var items = [];
items.push("safe_constant");
items.push("another_constant");
res.send('<ul>' + items.join('') + '</ul>');
});

26
tests/fixtures/real_world/javascript/taint/array_push_taint.expect.json vendored Normal file
View file

@ -0,0 +1,26 @@
{
"description": "XSS through array operations: req.query.item pushed into array then joined into HTML",
"tags": [
"taint",
"xss",
"express",
"array",
"container"
],
"modes": [
"full"
],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [
3,
8
],
"evidence_contains": [],
"notes": "array push + join taint tracked via container propagation"
}
]
}

8
tests/fixtures/real_world/javascript/taint/array_push_taint.js vendored Normal file
View file

@ -0,0 +1,8 @@
var express = require('express');
var app = express();
app.get('/collect', function(req, res) {
var items = [];
items.push(req.query.item);
res.send('<ul>' + items.join('') + '</ul>');
});

13
tests/fixtures/real_world/javascript/taint/axios_post_body_safe.expect.json vendored Normal file
View file

@ -0,0 +1,13 @@
{
"description": "axios.post(url, data) with a fixed URL and tainted data — data is the request body, not the destination. Must not fire as SSRF.",
"tags": ["taint", "ssrf", "axios", "destination-aware", "regression-fp"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"must_not_match": true,
"line_range": [6, 10],
"notes": "axios.post fixed URL + tainted body/data — destination fixed, not SSRF."
}
]
}

11
tests/fixtures/real_world/javascript/taint/axios_post_body_safe.js vendored Normal file
View file

@ -0,0 +1,11 @@
var express = require('express');
var axios = require('axios');
var app = express();
// axios.post(url, data[, config]) — arg 0 is the URL, arg 1 is the request
// body. Attacker-controlled data in arg 1 flowing to a fixed URL is not SSRF.
app.post('/ingest', function(req, res) {
var record = req.body.record;
axios.post('https://internal-ingest.example.com/v1/events', record);
res.status(204).end();
});

15
tests/fixtures/real_world/javascript/taint/axios_post_url_fires.expect.json vendored Normal file
View file

@ -0,0 +1,15 @@
{
"description": "axios.post(taintedUrl, fixedData) — destination URL is attacker-controlled. Must fire SSRF.",
"tags": ["taint", "ssrf", "axios", "destination-aware"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [6, 10],
"evidence_contains": [],
"notes": "req.query.target → axios.post(target, ...) — tainted destination."
}
]
}

11
tests/fixtures/real_world/javascript/taint/axios_post_url_fires.js vendored Normal file
View file

@ -0,0 +1,11 @@
var express = require('express');
var axios = require('axios');
var app = express();
// Positive case: the URL argument is attacker-controlled.
// axios.post(taintedUrl, fixedPayload) — SSRF must fire on arg 0.
app.post('/proxy', function(req, res) {
var target = req.query.target;
axios.post(target, { event: 'ping' });
res.status(204).end();
});

26
tests/fixtures/real_world/javascript/taint/callback_return_taint.expect.json vendored Normal file
View file

@ -0,0 +1,26 @@
{
"description": "Path traversal: req.query.file flows into fs.readFile filename argument",
"tags": [
"taint",
"path-traversal",
"express",
"fs",
"callback"
],
"modes": [
"full"
],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [
4,
10
],
"evidence_contains": [],
"notes": "req.query.file flows directly into fs.readFile as filename argument (path traversal)"
}
]
}

10
tests/fixtures/real_world/javascript/taint/callback_return_taint.js vendored Normal file
View file

@ -0,0 +1,10 @@
var express = require('express');
var app = express();
var fs = require('fs');
app.get('/read', function(req, res) {
var filename = req.query.file;
fs.readFile(filename, function(err, data) {
res.send(data);
});
});

36
tests/fixtures/real_world/javascript/taint/callback_sink_tracking.expect.json vendored Normal file
View file

@ -0,0 +1,36 @@
{
"description": "Callback tracking: child_process.exec passed as callback to apply(), tainted data flows through.",
"tags": [
"taint",
"callback",
"context-sensitivity",
"cmd-injection"
],
"modes": [
"full"
],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [
11,
14
],
"evidence_contains": [],
"notes": "req.query.cmd flows through apply() where child_process.exec is invoked as callback — command injection"
},
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": false,
"line_range": [
12,
14
],
"evidence_contains": [],
"notes": "Additional flow path: tainted data through apply() return to res.send"
}
]
}

15
tests/fixtures/real_world/javascript/taint/callback_sink_tracking.js vendored Normal file
View file

@ -0,0 +1,15 @@
// Callback tracking: function passed as argument should be resolved at call site.
// apply(data, dangerous_fn) — dangerous_fn is called with tainted data inside apply.
var child_process = require('child_process');
var express = require('express');
var app = express();
function apply(data, fn) {
return fn(data);
}
app.get('/cmd', function(req, res) {
var input = req.query.cmd;
var result = apply(input, child_process.exec);
res.send(result);
});

15
tests/fixtures/real_world/javascript/taint/catch_param_sink.expect.json vendored Normal file
View file

@ -0,0 +1,15 @@
{
"description": "Catch parameter is conservatively tainted: e flows to res.send — XSS",
"tags": ["taint", "xss", "try-catch", "catch-param"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [4, 10],
"evidence_contains": [],
"notes": "catch(e) binds e as tainted; e flows to res.send — XSS via catch parameter"
}
]
}

10
tests/fixtures/real_world/javascript/taint/catch_param_sink.js vendored Normal file
View file

@ -0,0 +1,10 @@
var express = require('express');
var app = express();
app.get('/catch-param-xss', function(req, res) {
try {
JSON.parse(req.query.data);
} catch (e) {
res.send('<h1>Error: ' + e + '</h1>');
}
});

15
tests/fixtures/real_world/javascript/taint/chained_promise_xss.expect.json vendored Normal file
View file

@ -0,0 +1,15 @@
{
"description": "SSRF via req.query.id flowing into fetch through string concatenation in a .then() chain.",
"tags": ["taint", "ssrf", "express", "fetch", "promise"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [3, 12],
"evidence_contains": [],
"notes": "req.query.id flows into fetch via string concat — SSRF"
}
]
}

11
tests/fixtures/real_world/javascript/taint/chained_promise_xss.js vendored Normal file
View file

@ -0,0 +1,11 @@
var express = require('express');
var app = express();
app.get('/data', function(req, res) {
var id = req.query.id;
fetch('/api/' + id).then(function(response) {
return response.json();
}).then(function(data) {
res.send('<div>' + data.name + '</div>');
});
});

22
tests/fixtures/real_world/javascript/taint/closure_captured_var.expect.json vendored Normal file
View file

@ -0,0 +1,22 @@
{
"description": "Closure captures tainted outer var; closure invoked in same scope reaches eval sink",
"tags": ["taint", "closure", "code-exec", "express"],
"modes": ["full"],
"strict_unexpected": ["taint-unsanitised-flow"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"must_match": true,
"line_range": [7, 9],
"evidence_contains": [],
"notes": "req.query.q captured by inner fn and flows to eval(q) inside captured closure"
},
{
"rule_id": "taint-unsanitised-flow",
"must_match": true,
"line_range": [9, 9],
"evidence_contains": [],
"notes": "outer fn() invocation at line 9 re-reports the flow via inline callee analysis — tainted capture reaches eval in body"
}
]
}

11
tests/fixtures/real_world/javascript/taint/closure_captured_var.js vendored Normal file
View file

@ -0,0 +1,11 @@
// Closure captures a tainted outer var and is called later in same scope.
// Expected: sink triggers on req.query.q → eval inside closure.
var express = require('express');
var app = express();
app.get('/a', function(req, res) {
var q = req.query.q; // source
var fn = function() { eval(q); }; // closure captures q
fn(); // invoke captured closure
res.send('ok');
});

22
tests/fixtures/real_world/javascript/taint/closure_member_assignment.expect.json vendored Normal file
View file

@ -0,0 +1,22 @@
{
"description": "Anonymous fn assigned to object member, then invoked via the member — property-name derived binding must let the closure participate in capture-based taint",
"tags": ["taint", "closure", "member-assignment", "code-exec"],
"modes": ["full"],
"strict_unexpected": ["taint-unsanitised-flow"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"must_match": true,
"line_range": [8, 10],
"evidence_contains": [],
"notes": "handlers.run = function(){eval(q)} then handlers.run() reaches eval(q)"
},
{
"rule_id": "taint-unsanitised-flow",
"must_match": true,
"line_range": [10, 10],
"evidence_contains": [],
"notes": "handlers.run() call at line 10 re-reports the flow via inline callee analysis — tainted capture reaches eval in body"
}
]
}

12
tests/fixtures/real_world/javascript/taint/closure_member_assignment.js vendored Normal file
View file

@ -0,0 +1,12 @@
// Arrow function assigned to object property (NOT a declaration).
// An assignment_expression parents the arrow_function — possible blind spot.
var express = require('express');
var app = express();
var handlers = {};
app.get('/a', function(req, res) {
var q = req.query.q;
handlers.run = function() { eval(q); }; // assignment-expression path
handlers.run();
res.send('ok');
});

22
tests/fixtures/real_world/javascript/taint/cmdi_express.expect.json vendored
View file

@ -30,6 +30,28 @@
],
"evidence_contains": [],
"notes": "Safe version still fires because .replace is not a recognized sanitizer for SHELL_ESCAPE cap"
},
{
"rule_id": "cfg-unguarded-sink",
"severity": "MEDIUM",
"must_match": false,
"line_range": [
5,
5
],
"evidence_contains": [],
"notes": "structural: cfg-unguarded-sink on high-risk sink at line 5 \u2014 taint active but no confirmed flow"
},
{
"rule_id": "cfg-unguarded-sink",
"severity": "MEDIUM",
"must_match": false,
"line_range": [
12,
12
],
"evidence_contains": [],
"notes": "structural: cfg-unguarded-sink on high-risk sink at line 12 \u2014 taint active but no confirmed flow"
}
]
}

26
tests/fixtures/real_world/javascript/taint/container_direct_sink.expect.json vendored Normal file
View file

@ -0,0 +1,26 @@
{
"description": "Command injection through container: tainted input pushed into array then joined and exec'd",
"tags": [
"taint",
"cmdi",
"express",
"array",
"container"
],
"modes": [
"full"
],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [
5,
9
],
"evidence_contains": [],
"notes": "container load at sink: commands.join produces tainted string passed to exec"
}
]
}

9
tests/fixtures/real_world/javascript/taint/container_direct_sink.js vendored Normal file
View file

@ -0,0 +1,9 @@
var express = require('express');
var child_process = require('child_process');
var app = express();
app.get('/direct', function(req, res) {
var commands = [];
commands.push(req.query.cmd);
child_process.exec(commands.join(' '));
});

28
tests/fixtures/real_world/javascript/taint/container_index_dynamic_fallback.expect.json vendored Normal file
View file

@ -0,0 +1,28 @@
{
"description": "XSS: dynamic index into tainted Map falls back to coarse Elements — taint conservatively flows to sink",
"tags": [
"taint",
"xss",
"express",
"container",
"heap",
"index",
"fallback"
],
"modes": [
"full"
],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [
6,
12
],
"evidence_contains": [],
"notes": "dynamic index falls back to Elements, which unions with all indexed taint"
}
]
}

12
tests/fixtures/real_world/javascript/taint/container_index_dynamic_fallback.js vendored Normal file
View file

@ -0,0 +1,12 @@
var express = require('express');
var app = express();
// Test: dynamic (non-constant) index falls back to Elements.
// Should conservatively report taint since the index is unknown.
app.get('/dyn', function(req, res) {
var m = new Map();
m.set(0, req.query.input);
var idx = parseInt(req.query.idx);
var val = m.get(idx);
res.send(val); // dynamic index → Elements → sees taint — SHOULD flag
});

27
tests/fixtures/real_world/javascript/taint/container_index_load_precision.expect.json vendored Normal file
View file

@ -0,0 +1,27 @@
{
"description": "XSS: taint loaded from Map index 0 flows to sink — per-index precision retains the finding for the tainted slot",
"tags": [
"taint",
"xss",
"express",
"container",
"heap",
"index"
],
"modes": [
"full"
],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [
6,
12
],
"evidence_contains": [],
"notes": "per-index precision: m.get(0) should load taint stored at index 0"
}
]
}

12
tests/fixtures/real_world/javascript/taint/container_index_load_precision.js vendored Normal file
View file

@ -0,0 +1,12 @@
var express = require('express');
var app = express();
// Test: constant-index load precision.
// Only the tainted index should flow to the sink.
app.get('/idx', function(req, res) {
var m = new Map();
m.set(0, req.query.input);
m.set(1, "safe");
var y = m.get(0);
res.send(y); // index 0 is tainted — SHOULD flag
});

16
tests/fixtures/real_world/javascript/taint/container_index_store_isolation.expect.json vendored Normal file
View file

@ -0,0 +1,16 @@
{
"description": "No XSS: taint stored at Map index 0 does not pollute index 1 when both indices are constant",
"tags": [
"taint",
"xss",
"express",
"container",
"heap",
"index",
"negative"
],
"modes": [
"full"
],
"expected": []
}

11
tests/fixtures/real_world/javascript/taint/container_index_store_isolation.js vendored Normal file
View file

@ -0,0 +1,11 @@
var express = require('express');
var app = express();
// Test: constant-index store isolation.
// Taint stored at index 0 should not pollute index 1.
app.get('/idx', function(req, res) {
var m = new Map();
m.set(0, req.query.input);
m.set(1, "safe_value");
res.send(m.get(1)); // index 1 is safe — should NOT flag
});

24
tests/fixtures/real_world/javascript/taint/context_sensitive_call.expect.json vendored Normal file
View file

@ -0,0 +1,24 @@
{
"description": "Context-sensitive analysis: run() called with tainted input produces finding; run() called with constant does not.",
"tags": [
"taint",
"context-sensitivity",
"cmd-injection"
],
"modes": [
"full"
],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [
7,
14
],
"evidence_contains": [],
"notes": "req.query.cmd flows through run() to child_process.exec — command injection; primary location points at line 8 (callee-internal sink), call site at line 13"
}
]
}

15
tests/fixtures/real_world/javascript/taint/context_sensitive_call.js vendored Normal file
View file

@ -0,0 +1,15 @@
// Context-sensitive analysis: same function called with tainted and safe args.
// With context sensitivity, only the tainted call site should produce a finding.
var child_process = require('child_process');
var express = require('express');
var app = express();
function run(cmd) {
child_process.exec(cmd);
}
app.get('/a', function(req, res) {
var userCmd = req.query.cmd;
run(userCmd); // TAINTED: req.query.cmd flows to exec via run()
run("echo hello"); // SAFE: constant string, no real vulnerability
});

14
tests/fixtures/real_world/javascript/taint/deep_nested_closure.expect.json vendored Normal file
View file

@ -0,0 +1,14 @@
{
"description": "Three-level nested callbacks (setTimeout/setImmediate/process.nextTick); innermost sinks a capture from the outermost scope",
"tags": ["taint", "closure", "nested", "code-exec"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"must_match": true,
"line_range": [6, 10],
"evidence_contains": [],
"notes": "tainted q from outermost scope flows through three levels of nested closures into eval"
}
]
}

15
tests/fixtures/real_world/javascript/taint/deep_nested_closure.js vendored Normal file
View file

@ -0,0 +1,15 @@
// Three-level nested closures; innermost sinks a capture from the outermost.
var express = require('express');
var app = express();
app.get('/a', function(req, res) {
var q = req.query.q;
setTimeout(function() {
setImmediate(function() {
process.nextTick(function() {
eval(q); // sink on 3-level-captured source
});
});
}, 10);
res.send('ok');
});

15
tests/fixtures/real_world/javascript/taint/destructure_object_taint.expect.json vendored Normal file
View file

@ -0,0 +1,15 @@
{
"description": "Object destructuring from tainted source — each binding carries source taint.",
"tags": ["taint", "xss", "destructuring"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [4, 6],
"evidence_contains": [],
"notes": "var { name, age } = req.query — destructured binding name flows to res.send"
}
]
}

7
tests/fixtures/real_world/javascript/taint/destructure_object_taint.js vendored Normal file
View file

@ -0,0 +1,7 @@
var express = require('express');
var app = express();
app.get('/destruct', function(req, res) {
var { name, age } = req.query;
res.send(name);
});

13
tests/fixtures/real_world/javascript/taint/destructure_sanitized_safe.expect.json vendored Normal file
View file

@ -0,0 +1,13 @@
{
"description": "Destructuring a sanitized value — bindings should not carry taint.",
"tags": ["taint", "xss", "destructuring", "sanitizer"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"must_not_match": true,
"line_range": [5, 8],
"notes": "DOMPurify.sanitize applied before destructuring — bindings are safe (regression guard)"
}
]
}

9
tests/fixtures/real_world/javascript/taint/destructure_sanitized_safe.js vendored Normal file
View file

@ -0,0 +1,9 @@
var express = require('express');
var DOMPurify = require('dompurify');
var app = express();
app.get('/destruct-safe', function(req, res) {
var input = DOMPurify.sanitize(req.query.name);
var { length } = input;
res.send(length);
});

15
tests/fixtures/real_world/javascript/taint/destructuring_taint.expect.json vendored Normal file
View file

@ -0,0 +1,15 @@
{
"description": "Multiple field reads from source — each req.query.field independently taints its binding.",
"tags": ["taint", "xss", "field-access"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [5, 8],
"evidence_contains": [],
"notes": "req.query.age (second field read) should be tainted and flow to res.send"
}
]
}

9
tests/fixtures/real_world/javascript/taint/destructuring_taint.js vendored Normal file
View file

@ -0,0 +1,9 @@
var express = require('express');
var app = express();
// Two separate field reads — tests that each source.field independently taints
app.get('/multi-field', function(req, res) {
var name = req.query.name;
var age = req.query.age;
res.send(age);
});

37
tests/fixtures/real_world/javascript/taint/dom_xss.expect.json vendored Normal file
View file

@ -0,0 +1,37 @@
{
"description": "DOM XSS via location.search flowing into document.write. DOMPurify.sanitize strips HTML_ESCAPE cap.",
"tags": ["taint", "xss", "dom", "document.write"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [1, 4],
"evidence_contains": [],
"notes": "location.search flows into document.write via string concatenation — DOM XSS"
},
{
"rule_id": "taint-unsanitised-flow",
"must_not_match": true,
"line_range": [6, 7],
"notes": "DOMPurify.sanitize strips HTML_ESCAPE cap so document.write must NOT fire (regression guard)"
},
{
"rule_id": "js.xss.document_write",
"severity": "MEDIUM",
"must_match": true,
"line_range": [4, 4],
"evidence_contains": [],
"notes": "AST pattern detects document.write with unsanitized input — DOM XSS"
},
{
"rule_id": "js.xss.document_write",
"severity": "MEDIUM",
"must_match": false,
"line_range": [7, 7],
"evidence_contains": [],
"notes": "noise: document.write after DOMPurify.sanitize — AST pattern cannot track sanitization (Layer B suppression still relies on taint signal)"
}
]
}

7
tests/fixtures/real_world/javascript/taint/dom_xss.js vendored Normal file
View file

@ -0,0 +1,7 @@
var params = new URLSearchParams(location.search);
var input = params.get('name');
document.write('<h1>Hello ' + input + '</h1>');
var clean = DOMPurify.sanitize(input);
document.write('<h1>Hello ' + clean + '</h1>');

15
tests/fixtures/real_world/javascript/taint/equality_narrowing_propagates.expect.json vendored Normal file
View file

@ -0,0 +1,15 @@
{
"description": "Negative control for equality-with-constant narrowing: the boolean result of `input === 'admin'` is not tainted, but the original `input` variable is still directly concatenated into the res.send sink. Taint MUST still flow to the sink.",
"tags": ["taint", "xss", "express", "equality-narrowing"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [4, 8],
"evidence_contains": [],
"notes": "req.query.name flows directly into res.send via string concat; the adjacent equality check should not narrow this path"
}
]
}

8
tests/fixtures/real_world/javascript/taint/equality_narrowing_propagates.js vendored Normal file
View file

@ -0,0 +1,8 @@
var express = require('express');
var app = express();
app.get('/display', function(req, res) {
var input = req.query.name;
var isAdmin = input === 'admin';
res.send('<p>' + input + '</p>');
});

15
tests/fixtures/real_world/javascript/taint/equality_narrowing_safe.expect.json vendored Normal file
View file

@ -0,0 +1,15 @@
{
"description": "Equality-with-constant narrowing: req.query.pathname compared against string literals produces a boolean; the ternary selects between two static HTML strings, so the innerHTML/res.send receives only attacker-independent content. Should NOT fire taint-unsanitised-flow.",
"tags": ["taint", "xss", "express", "equality-narrowing"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": false,
"line_range": [4, 11],
"evidence_contains": [],
"notes": "boolean result of `pathname === '/login'` carries no taint; ternary branches are static literals; banner is clean at res.send"
}
]
}

12
tests/fixtures/real_world/javascript/taint/equality_narrowing_safe.js vendored Normal file
View file

@ -0,0 +1,12 @@
var express = require('express');
var app = express();
app.get('/banner', function(req, res) {
var pathname = req.query.pathname;
var isLoginPage = pathname === '/login'
|| pathname === '/login.html';
var banner = isLoginPage
? '<div class="banner-compact">Please log in</div>'
: '<div class="banner-full">Welcome back</div>';
res.send(banner);
});

37
tests/fixtures/real_world/javascript/taint/eval_user_input.expect.json vendored
View file

@ -9,6 +9,9 @@
"modes": [
"full"
],
"strict_unexpected": [
"taint-unsanitised-flow"
],
"expected": [
{
"rule_id": "js.code_exec.eval",
@ -31,6 +34,40 @@
],
"evidence_contains": [],
"notes": "req.query.expr flows directly into eval() which is a SHELL_ESCAPE sink"
},
{
"rule_id": "taint-unsanitised-flow",
"severity": "HIGH",
"must_match": false,
"line_range": [
7,
7
],
"evidence_contains": [],
"notes": "noise: req.query.expr flows to res.json — returning computed result is standard API behavior, not XSS"
},
{
"rule_id": "taint-unsanitised-flow",
"severity": "HIGH",
"must_match": true,
"max_count": 1,
"line_range": [
16,
16
],
"evidence_contains": [],
"notes": "Known noise: taint flow to res.json in safe handler — parseFloat sanitizes input, but scanner does not model it. Exactly one finding after dedup; cross-handler two-level-solve leak collapses into this one."
},
{
"rule_id": "cfg-unguarded-sink",
"severity": "MEDIUM",
"must_match": false,
"line_range": [
4,
4
],
"evidence_contains": [],
"notes": "structural: cfg-unguarded-sink on high-risk sink at line 4 — taint active but no confirmed flow"
}
]
}

23
tests/fixtures/real_world/javascript/taint/express_redirect.expect.json vendored Normal file
View file

@ -0,0 +1,23 @@
{
"description": "Open redirect via req.query flowing into res.redirect. encodeURIComponent strips URL_ENCODE but SSRF cap remains.",
"tags": ["taint", "redirect", "express", "open-redirect"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [3, 7],
"evidence_contains": [],
"notes": "req.query.url flows directly into res.redirect — open redirect"
},
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [9, 13],
"evidence_contains": [],
"notes": "encodeURIComponent strips URL_ENCODE cap but res.redirect requires SSRF cap — still fires"
}
]
}

13
tests/fixtures/real_world/javascript/taint/express_redirect.js vendored Normal file
View file

@ -0,0 +1,13 @@
var express = require('express');
var app = express();
app.get('/go', function(req, res) {
var url = req.query.url;
res.redirect(url);
});
app.get('/go-encoded', function(req, res) {
var url = req.query.url;
var encoded = encodeURIComponent(url);
res.redirect(encoded);
});

21
tests/fixtures/real_world/javascript/taint/express_xss.expect.json vendored Normal file
View file

@ -0,0 +1,21 @@
{
"description": "XSS via req.query flowing into res.send. DOMPurify.sanitize strips HTML_ESCAPE cap.",
"tags": ["taint", "xss", "express", "res.send"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [3, 7],
"evidence_contains": [],
"notes": "req.query.name flows directly into res.send via string concatenation — XSS"
},
{
"rule_id": "taint-unsanitised-flow",
"must_not_match": true,
"line_range": [9, 13],
"notes": "DOMPurify.sanitize strips HTML_ESCAPE cap so res.send must NOT fire (regression guard)"
}
]
}

13
tests/fixtures/real_world/javascript/taint/express_xss.js vendored Normal file
View file

@ -0,0 +1,13 @@
var express = require('express');
var app = express();
app.get('/greet', function(req, res) {
var name = req.query.name;
res.send('<h1>Hello ' + name + '</h1>');
});
app.get('/greet-safe', function(req, res) {
var name = req.query.name;
var clean = DOMPurify.sanitize(name);
res.send('<h1>Hello ' + clean + '</h1>');
});

15
tests/fixtures/real_world/javascript/taint/feasible_range_check.expect.json vendored Normal file
View file

@ -0,0 +1,15 @@
{
"description": "Feasible nested range: n > 0 AND n < 100 is satisfiable. The eval MUST produce a finding — regression guard against over-pruning.",
"tags": ["taint", "constraint", "feasible", "regression-guard"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [5, 11],
"evidence_contains": [],
"notes": "req.query.x flows to eval — feasible path, must not be pruned"
}
]
}

13
tests/fixtures/real_world/javascript/taint/feasible_range_check.js vendored Normal file
View file

@ -0,0 +1,13 @@
var express = require('express');
var app = express();
app.get('/calc', function(req, res) {
var input = req.query.x;
var n = parseInt(input, 10);
if (n > 0) {
if (n < 100) {
// Feasible: 0 < n < 100 — must NOT be pruned
eval(input);
}
}
});

15
tests/fixtures/real_world/javascript/taint/fetch_object_url_tainted_fires.expect.json vendored Normal file
View file

@ -0,0 +1,15 @@
{
"description": "fetch({url: taintedUrl, body: fixed}) — destination-aware object-literal case. url is tainted, must fire.",
"tags": ["taint", "ssrf", "fetch", "destination-aware", "object-config"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [6, 14],
"evidence_contains": [],
"notes": "req.query.target → fetch({url: target, ...}) — tainted destination field under object-literal shape."
}
]
}

15
tests/fixtures/real_world/javascript/taint/fetch_object_url_tainted_fires.js vendored Normal file
View file

@ -0,0 +1,15 @@
var express = require('express');
var app = express();
// Positive case: fetch accepts a Request-like object whose `url`
// field carries the destination. When `url` is attacker-controlled, SSRF
// must fire even though `body` (non-destination) is fixed.
app.get('/proxy', function(req, res) {
var target = req.query.target;
fetch({
url: target,
method: 'POST',
body: '{}',
});
res.status(204).end();
});

13
tests/fixtures/real_world/javascript/taint/fetch_tainted_body_safe.expect.json vendored Normal file
View file

@ -0,0 +1,13 @@
{
"description": "fetch() request body carries attacker-controlled content but the destination URL is fixed. Under the destination-aware SSRF gate, only taint reaching the URL (arg 0 / object `url` field) activates — body taint must be silenced.",
"tags": ["taint", "ssrf", "fetch", "destination-aware", "regression-fp"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"must_not_match": true,
"line_range": [7, 14],
"notes": "fetch('/api/telemetry', {body: payload}) — arg 0 is a fixed string, body taint must not fire as SSRF."
}
]
}

15
tests/fixtures/real_world/javascript/taint/fetch_tainted_body_safe.js vendored Normal file
View file

@ -0,0 +1,15 @@
var express = require('express');
var app = express();
// Taint flows into the fetch *body* (telemetry payload) with a fixed,
// attacker-independent URL. SSRF semantics require attacker control over
// the destination — a tainted body does not constitute SSRF. Nyx must
// silence this case after the fetch-as-destination-gate narrowing.
app.post('/telemetry', function(req, res) {
var payload = req.body.message;
fetch('/api/telemetry', {
method: 'POST',
body: payload,
});
res.status(204).end();
});

13
tests/fixtures/real_world/javascript/taint/field_overwrite_safe.expect.json vendored Normal file
View file

@ -0,0 +1,13 @@
{
"description": "Field taint killed by constant overwrite — no finding expected.",
"tags": ["taint", "field-access", "safe"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"must_not_match": true,
"line_range": [4, 9],
"notes": "obj.data overwritten with constant before sink — taint killed (regression guard)"
}
]
}

9
tests/fixtures/real_world/javascript/taint/field_overwrite_safe.js vendored Normal file
View file

@ -0,0 +1,9 @@
var express = require('express');
var app = express();
app.get('/safe', function(req, res) {
var obj = {};
obj.data = req.query.input;
obj.data = "safe";
res.send(obj.data);
});

15
tests/fixtures/real_world/javascript/taint/field_partial_taint.expect.json vendored Normal file
View file

@ -0,0 +1,15 @@
{
"description": "Partial field taint: last field write is tainted — synthetic base update carries taint to base.",
"tags": ["taint", "xss", "field-access", "synthetic-base-update"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [4, 8],
"evidence_contains": [],
"notes": "obj.danger = req.query.input is the last field write, so the synthetic base update for obj carries taint; res.send(obj) should fire"
}
]
}

9
tests/fixtures/real_world/javascript/taint/field_partial_taint.js vendored Normal file
View file

@ -0,0 +1,9 @@
var express = require('express');
var app = express();
app.get('/partial', function(req, res) {
var obj = {};
obj.safe = "constant";
obj.danger = req.query.input;
res.send(obj);
});

13
tests/fixtures/real_world/javascript/taint/field_safe_overwrite_base_tainted.expect.json vendored Normal file
View file

@ -0,0 +1,13 @@
{
"description": "Safe field overwrite on tainted base: reading obj.safe after obj.safe='constant' should NOT fire even though base obj was tainted",
"tags": ["taint", "field-access", "false-positive-fix"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"must_not_match": true,
"line_range": [4, 8],
"notes": "obj.safe overwritten with constant; field-aware suppression must prevent base ident bleed (regression guard)"
}
]
}

8
tests/fixtures/real_world/javascript/taint/field_safe_overwrite_base_tainted.js vendored Normal file
View file

@ -0,0 +1,8 @@
var express = require('express');
var app = express();
app.get('/field-safe', function(req, res) {
var obj = req.query;
obj.safe = "constant";
res.send(obj.safe);
});

15
tests/fixtures/real_world/javascript/taint/field_taint_propagation.expect.json vendored Normal file
View file

@ -0,0 +1,15 @@
{
"description": "Field write from source (req.query.input) flows through field read (obj.data) to sink (res.send).",
"tags": ["taint", "xss", "field-access"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [4, 8],
"evidence_contains": [],
"notes": "obj.data = req.query.input flows to res.send(obj.data) — XSS via field propagation"
}
]
}

8
tests/fixtures/real_world/javascript/taint/field_taint_propagation.js vendored Normal file
View file

@ -0,0 +1,8 @@
var express = require('express');
var app = express();
app.get('/field', function(req, res) {
var obj = {};
obj.data = req.query.input;
res.send(obj.data);
});

15
tests/fixtures/real_world/javascript/taint/field_write_base_sink.expect.json vendored Normal file
View file

@ -0,0 +1,15 @@
{
"description": "Field write taints base object — obj.data = source(); sink(obj) should fire.",
"tags": ["taint", "xss", "field-access"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [4, 7],
"evidence_contains": [],
"notes": "obj.data = req.query.input taints obj via synthetic base update; res.send(obj) should detect tainted base"
}
]
}

8
tests/fixtures/real_world/javascript/taint/field_write_base_sink.js vendored Normal file
View file

@ -0,0 +1,8 @@
var express = require('express');
var app = express();
app.get('/field-base', function(req, res) {
var obj = {};
obj.data = req.query.input;
res.send(obj);
});

26
tests/fixtures/real_world/javascript/taint/global_var_taint.expect.json vendored Normal file
View file

@ -0,0 +1,26 @@
{
"description": "XSS through global variable: tainted input stored in global var in one handler, rendered in another",
"tags": [
"taint",
"xss",
"express",
"global-variable",
"cross-handler"
],
"modes": [
"full"
],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": false,
"line_range": [
4,
12
],
"evidence_contains": [],
"notes": "cross-handler global variable taint requires inter-handler analysis; must_match false"
}
]
}

12
tests/fixtures/real_world/javascript/taint/global_var_taint.js vendored Normal file
View file

@ -0,0 +1,12 @@
var express = require('express');
var app = express();
var lastInput = '';
app.get('/save', function(req, res) {
lastInput = req.query.data;
res.send('saved');
});
app.get('/display', function(req, res) {
res.send('<p>' + lastInput + '</p>');
});

13
tests/fixtures/real_world/javascript/taint/got_post_body_safe.expect.json vendored Normal file
View file

@ -0,0 +1,13 @@
{
"description": "got({url: fixed, json: tainted}) — destination-aware gate restricts SSRF taint checks to url/prefixUrl fields. json field taint must not fire.",
"tags": ["taint", "ssrf", "got", "destination-aware", "regression-fp", "object-config"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"must_not_match": true,
"line_range": [9, 16],
"notes": "got() object config with fixed URL + tainted json payload — body-field taint silenced."
}
]
}

17
tests/fixtures/real_world/javascript/taint/got_post_body_safe.js vendored Normal file
View file

@ -0,0 +1,17 @@
var express = require('express');
var got = require('got');
var app = express();
// got({url, json, body, headers, prefixUrl}) — destination-bearing fields are
// `url` / `prefixUrl`. Body-ish fields (`json`, `body`, `headers`) are NOT
// destination. Under the destination-aware gate a tainted `json` field must
// not fire SSRF when `url` is fixed.
app.post('/ingest', function(req, res) {
var record = req.body.record;
got({
method: 'POST',
url: 'https://internal-ingest.example.com/v1/events',
json: record,
});
res.status(204).end();
});

15
tests/fixtures/real_world/javascript/taint/got_tainted_url_fires.expect.json vendored Normal file
View file

@ -0,0 +1,15 @@
{
"description": "got({url: taintedUrl}) — destination field is attacker-controlled. Must fire SSRF.",
"tags": ["taint", "ssrf", "got", "destination-aware", "object-config"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [5, 11],
"evidence_contains": [],
"notes": "req.query.target → got({url: target, ...}) — tainted destination field."
}
]
}

13
tests/fixtures/real_world/javascript/taint/got_tainted_url_fires.js vendored Normal file
View file

@ -0,0 +1,13 @@
var express = require('express');
var got = require('got');
var app = express();
// got({url: taintedUrl, ...}) — attacker controls the destination field.
app.get('/proxy', function(req, res) {
var target = req.query.target;
got({
url: target,
headers: { 'User-Agent': 'nyx-test' },
});
res.status(204).end();
});

6
tests/fixtures/real_world/javascript/taint/header_extract_shift.expect.json vendored Normal file
View file

@ -0,0 +1,6 @@
{
"description": "(header >> 4) & 0x0F extracts a 4-bit field [0, 15]. Chained bitwise operations with final mask produce proven-bounded integer, suppressing SQL injection.",
"tags": ["taint", "sqli", "bitwise", "shift", "abstract-interp"],
"modes": ["full"],
"expected": []
}

11
tests/fixtures/real_world/javascript/taint/header_extract_shift.js vendored Normal file
View file

@ -0,0 +1,11 @@
var express = require('express');
var mysql = require('mysql');
var app = express();
var connection = mysql.createConnection({host: 'localhost'});
app.get('/field', function(req, res) {
var header = req.query.h;
var shifted = header >> 4;
var field = shifted & 0x0F;
connection.query("SELECT * FROM t WHERE field=" + field);
});

28
tests/fixtures/real_world/javascript/taint/heap_alias_taint.expect.json vendored Normal file
View file

@ -0,0 +1,28 @@
{
"description": "XSS through container alias: a and b share the same array, taint pushed via a flows out via b",
"tags": [
"taint",
"xss",
"express",
"array",
"container",
"alias",
"heap"
],
"modes": [
"full"
],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"severity": null,
"must_match": true,
"line_range": [
4,
9
],
"evidence_contains": [],
"notes": "heap identity: b = a makes both point to same HeapObject, push through a visible via load through b"
}
]
}

9
tests/fixtures/real_world/javascript/taint/heap_alias_taint.js vendored Normal file
View file

@ -0,0 +1,9 @@
var express = require('express');
var app = express();
app.get('/heap', function(req, res) {
var a = [];
var b = a;
a.push(req.query.input);
res.send(b.join(''));
});

17
tests/fixtures/real_world/javascript/taint/heap_reassign_safe.expect.json vendored Normal file
View file

@ -0,0 +1,17 @@
{
"description": "No XSS: reassignment separates container identity. b points to old array, a points to new empty array",
"tags": [
"taint",
"xss",
"express",
"array",
"container",
"alias",
"heap",
"safe"
],
"modes": [
"full"
],
"expected": []
}

10
tests/fixtures/real_world/javascript/taint/heap_reassign_safe.js vendored Normal file
View file

@ -0,0 +1,10 @@
var express = require('express');
var app = express();
app.get('/reassign', function(req, res) {
var a = [];
var b = a;
a = [];
b.push(req.query.input);
res.send(a.join(''));
});

13
tests/fixtures/real_world/javascript/taint/http_request_tainted_host_fires.expect.json vendored Normal file
View file

@ -0,0 +1,13 @@
{
"description": "http.request({host: taintedHost, path: fixed}) — attacker-controlled destination. Must fire SSRF.",
"tags": ["taint", "ssrf", "http.request", "destination-aware", "object-config"],
"modes": ["full"],
"expected": [
{
"rule_id": "taint-unsanitised-flow",
"must_match": true,
"line_range": [7, 16],
"notes": "req.query.host → http.request({host: target, ...}) — tainted destination field."
}
]
}

17
tests/fixtures/real_world/javascript/taint/http_request_tainted_host_fires.js vendored Normal file
View file

@ -0,0 +1,17 @@
var express = require('express');
var http = require('http');
var app = express();
// http.request(options, cb) — options.host / options.hostname / options.path
// are destination-bearing fields. Attacker-controlled host must fire SSRF.
app.get('/proxy', function(req, res) {
var target = req.query.host;
var options = {
host: target,
path: '/status',
method: 'GET',
};
var r = http.request(options);
r.end();
res.status(204).end();
});

Some files were not shown because too many files have changed in this diff Show more