apunkt/nyx
1
0
Fork 0
mirror of https://github.com/elicpeter/nyx.git synced 2026-06-24 20:28:06 +02:00
Code Issues Projects Releases Packages Wiki Activity

Added Cap::DATA_EXFIL and taint fp and fn fixes on real repos (#59)

Browse source 
* feat: Enhance data exfiltration detection with source sensitivity gating for cookies and headers

* feat: Implement cross-file data exfiltration detection with parameter-specific gate filters

* feat: Add calibration tests and refine DATA_EXFIL severity scoring logic

* feat: Introduce per-detector configuration for data exfiltration suppression

* feat: Enhance DATA_EXFIL findings with destination field tracking in diagnostics and SARIF output

* feat: Add tainted body and URL handling for data exfiltration detection

* feat: Add integration tests and fixtures for DATA_EXFIL and SSRF detection in Go

* feat: Add Java integration tests and fixtures for DATA_EXFIL detection across multiple HTTP clients

* feat: Add synthetic externals handling for closure-captured variables in SSA

* feat: Implement closure-based suppression for resource leak findings

* feat: Add regression guards for shell-injection and taint propagation in for-of destructure patterns

* feat: Implement constructor cap narrowing for data exfiltration detection in HTTP request builders

* feat: Add gated sinks for data exfiltration detection in C and C++ using curl_easy_setopt

* feat: Implement DATA_EXFIL cap parity for backwards analysis and add integration tests

* feat: Add data exfiltration sinks for various languages and enhance documentation

* refactor: Simplify formatting and improve readability in various files

* refactor: Improve readability by simplifying conditional statements and adding clippy linting

* docs: Update CHANGELOG and comments for data exfiltration features and configuration

* docs: Clarify configuration instructions for data exfiltration trusted destinations

* docs: Enhance comments for evidence routing logic in data exfiltration
This commit is contained in:
Eli Peter 2026-05-01 10:59:52 -04:00 • committed by GitHub
parent a438886217
commit 58f1794a4e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
189 changed files with 8421 additions and 383 deletions
Download patch file Download diff file Expand all files Collapse all files

28
tests/benchmark_test.rs
View file

@ -697,6 +697,34 @@ fn benchmark_evaluation() {
"Rule-level F1 {:.3} fell below threshold 0.920 (baseline 0.970)",
rule.f1,
);
// ── Per-class floors ────────────────────────────────────────────
// DATA_EXFIL: 13 TP fixtures across 8 languages. Baseline at the
// 0.5.x → next-minor ship is P=1.000 R=1.000 F1=1.000 with 6 paired
// safe fixtures (sensitivity-gate, sanitizer-wrap) holding FP=0 on
// the data_exfil-class noise budget. Floor at 0.85 absorbs a one-
// case regression (~0.077 on 13 cases) while still catching a
// structural break. When you land a durable improvement, tighten
// this floor; do not relax it to paper over a regression.
if let Some(de) = results.by_vuln_class.get("data_exfil") {
assert!(
de.f1 >= 0.85,
"data_exfil rule-level F1 {:.3} fell below threshold 0.85 (baseline 1.000)",
de.f1,
);
assert!(
de.recall >= 0.85,
"data_exfil rule-level recall {:.3} fell below threshold 0.85 (baseline 1.000)",
de.recall,
);
assert!(
de.precision >= 0.85,
"data_exfil rule-level precision {:.3} fell below threshold 0.85 (baseline 1.000)",
de.precision,
);
} else {
panic!("data_exfil class missing from by_vuln_class breakdown");
}
}
// ── Confidence-threshold scoring ─────────────────────────────────────