Prerelease cleanup (#46)

* feat: Add const_bound_vars tracking to prevent false positives in ownership checks

* feat: Introduce field interner and typed bounded vars for enhanced type tracking

* feat: Add typed_call_receivers and typed_bounded_dto_fields for enhanced type tracking

* feat: Centralize method name extraction with bare_method_name helper

* feat: Implement Phase-6 hierarchy fan-out for runtime virtual dispatch

* feat: Enhance C++ taint tracking with additional container operations and inline method resolution

* feat: Introduce field-sensitive points-to analysis for enhanced resource tracking

* feat: Implement Pointer-Phase 6 subscript handling for enhanced container analysis

* test: Add comprehensive tests for JavaScript control flow constructs and lattice operations

* docs: Update advanced analysis documentation with field-sensitive points-to and hierarchy fan-out details

* test: Add comprehensive tests for lattice algebra laws and SSA edge cases

* feat: Add destructured session user handling and safe user ID access patterns

* feat: Implement row-population reverse-walk for enhanced authorization checks

* feat: Enhance authorization checks with local alias chain for self-actor types

* feat: Introduce ActiveRecord query safety checks and enhance snippet extraction

* feat: Implement chained method call inner-gate rebinding for SSRF prevention

* feat: Add observability and error modules, enhance debug functionality, and implement theme context

* feat: Remove Auth Analysis page and update navigation to redirect to Explorer

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Reset path-safe-suppressed spans before lowering to maintain analysis integrity

* fix(ssa): ungate debug_assert_bfs_ordering for release-tests build

The helper at src/ssa/lower.rs was gated `#[cfg(debug_assertions)]` while
the unit test at the bottom of the file was gated only `#[cfg(test)]`.
Since `cfg(test)` is set in release builds with `--tests` but
`cfg(debug_assertions)` is not, `cargo build --release --tests` failed
with E0425. Removing the gate fixes the build; the body is `debug_assert!`
only, so the helper is free in release. Also drop the gate at the call
site to avoid a `dead_code` warning when the lib is built without
`--tests`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(closure-capture): flip JS/TS fixtures to required-finding

The JS and TS closure-capture fixtures pinned the old broken behaviour
via `forbidden_findings: [{ "id_prefix": "taint-" }]`. The engine now
correctly traces taint through the closure boundary (env source captured
by an arrow function, sunk via `child_process.exec` inside the body), so
the formerly-forbidden finding is a true positive.

Match the Python sibling's shape — `required_findings` with
`id_prefix` + `min_count` plus a small `noise_budget` — and rewrite the
companion READMEs and the phase8_fragility_tests doc-comments from
"known gap" to "regression guard".

Verified:
- cargo test --release --test phase8_fragility_tests → 8/8 pass
- cargo test --release --lib bfs_assertion → pass
- corpus benchmark F1 = 0.9976 (TP=205, FP=1, FN=0) — unchanged

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat: Add OWASP mapping and baseline mutation hooks for enhanced security analysis

* feat: Introduce health module and enhance health score computation with calibration tests

* feat: Add expectations configuration and cleanup .gitignore for log files

* feat: Implement theme selection and enhance settings panel for triage sync

* feat: Suppress false positives for strcpy calls with literal sources in AST

* feat: Update analyse_function_ssa to return body CFG for accurate analysis

* feat: Add bug report and feature request templates for improved issue tracking

* feat: removed dev scripts

* feat: update README.md for clarity and consistency in fixture descriptions

* feat: removed dev docs

* feat: clean up error handling and UI elements for improved user experience

* feat: adjust button sizes in HeaderBar for better UI consistency

* feat: enhance taint analysis with additional context for sanitizer and taint findings

* cargo fmt

* prettier

* refactor: simplify conditional checks and improve code readability in AST and screenshot capture scripts

* feat: add script to frame PNG screenshots with brand gradient

* feat: add fuzzing support with new targets and CI workflows

* refactor: streamline match expressions and improve formatting in CLI and output handling

* feat: enhance configuration display with detailed output options

* feat: stage demo configuration for improved CLI screenshot output

* feat: expose merge_configs function for user-configurable settings

* refactor: simplify code structure and improve readability in config handling

* refactor: improve descriptions for vulnerability patterns in various languages

* feat: update MIT License section with additional usage details and copyright information

* feat: update screenshots

* refactor: update build process and paths for frontend assets

* feat: add cross-file taint fuzzing target and supporting dictionary

* refactor: clean up formatting and comments in fuzz configuration and example files

* refactor: remove outdated comments and clean up CI configuration files

* chore: update changelog dates and improve formatting in documentation

* refactor: update Cargo.toml and CI configuration for improved packaging and build process

* refactor: enhance quote-stripping logic to prevent panics and add regression tests

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fuzz/Cargo.toml

@@ -0,0 +1,33 @@
+[package]
+name = "nyx-fuzz"
+version = "0.0.0"
+edition = "2024"
+publish = false
+
+[package.metadata]
+cargo-fuzz = true
+
+[dependencies]
+libfuzzer-sys = "0.4"
+nyx-scanner = { path = ".." }
+
+[[bin]]
+name = "scan_bytes"
+path = "fuzz_targets/scan_bytes.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "extract_summaries"
+path = "fuzz_targets/extract_summaries.rs"
+test = false
+doc = false
+bench = false
+
+[[bin]]
+name = "cross_file_taint"
+path = "fuzz_targets/cross_file_taint.rs"
+test = false
+doc = false
+bench = false

fuzz/dict/all.dict

@@ -0,0 +1,253 @@
+# libFuzzer dictionary for the Nyx fuzz targets.
+#
+# Each entry is a quoted string libFuzzer can splice into mutations. We bias
+# toward tokens that unlock new tree-sitter / CFG / taint paths across the
+# 10 supported languages, plus the synthetic helper names registered by
+# `cross_file_taint` so call-site mutations resolve against `GlobalSummaries`
+# instead of bouncing off as unknown calls.
+#
+# Format: one entry per line, `name="..."` or `"..."`. Lines starting with
+# `#` are comments. C-style escapes (`\xNN`, `\n`, `\\`, `\"`) are honored.
+
+# ── Punctuation / structural tokens ────────────────────────────────────
+"{"
+"}"
+"("
+")"
+"["
+"]"
+";"
+","
+"."
+"::"
+"->"
+"=>"
+":="
+":"
+"="
+"=="
+"!="
+"<="
+">="
+"&&"
+"||"
+"+"
+"-"
+"*"
+"/"
+"%"
+"<"
+">"
+"!"
+"&"
+"|"
+"^"
+"~"
+"?"
+"#"
+"@"
+
+# ── Cross-language keywords ────────────────────────────────────────────
+"if"
+"else"
+"elif"
+"while"
+"for"
+"do"
+"return"
+"break"
+"continue"
+"switch"
+"case"
+"default"
+"true"
+"false"
+"null"
+"nil"
+"None"
+"undefined"
+"void"
+"int"
+"float"
+"double"
+"char"
+"bool"
+"string"
+"var"
+"let"
+"const"
+"static"
+"public"
+"private"
+"protected"
+"new"
+"this"
+"self"
+"super"
+"class"
+"struct"
+"enum"
+"interface"
+"trait"
+"impl"
+"module"
+"package"
+"import"
+"from"
+"use"
+"as"
+"function"
+"def"
+"fn"
+"func"
+"sub"
+"end"
+"begin"
+"try"
+"catch"
+"except"
+"finally"
+"raise"
+"throw"
+"throws"
+"async"
+"await"
+"yield"
+"lambda"
+"match"
+"with"
+"in"
+"of"
+"is"
+"not"
+"and"
+"or"
+
+# ── Common literals / format strings ───────────────────────────────────
+"\"\""
+"\"x\""
+"\"%s\""
+"\"%d\""
+"\"%v\""
+"\"{}\""
+"`x`"
+"'x'"
+"0"
+"1"
+"-1"
+"0x0"
+"0xff"
+
+# ── Security-flavored function names (sources, sinks, sanitizers) ──────
+"exec"
+"eval"
+"system"
+"popen"
+"shell_exec"
+"passthru"
+"spawn"
+"execSync"
+"execFile"
+"Runtime.getRuntime"
+"Process"
+"Command"
+"query"
+"execute"
+"executeQuery"
+"prepare"
+"raw_query"
+"mysql_query"
+"mysqli_query"
+"pg_query"
+"sqlite_query"
+"unserialize"
+"pickle.loads"
+"yaml.load"
+"json.loads"
+"readObject"
+"deserialize"
+"escape"
+"escapeshellarg"
+"escapeshellcmd"
+"htmlspecialchars"
+"htmlentities"
+"escape_html"
+"sanitize"
+"strip_tags"
+"prepareStatement"
+"PreparedStatement"
+"parseFromString"
+"setAttribute"
+"innerHTML"
+"document.write"
+"window.location"
+"location.href"
+
+# ── Sources (taint origins) ────────────────────────────────────────────
+"req.body"
+"req.query"
+"req.params"
+"request.GET"
+"request.POST"
+"request.args"
+"request.form"
+"$_GET"
+"$_POST"
+"$_REQUEST"
+"$_COOKIE"
+"params"
+"argv"
+"stdin"
+"getenv"
+"env::var"
+"os.environ"
+"ENV"
+"Console.ReadLine"
+"input"
+"raw_input"
+"fgets"
+"scanf"
+"gets"
+"http.Get"
+"http.Post"
+"reqwest::get"
+"fetch"
+"axios.get"
+"file_get_contents"
+"readFileSync"
+
+# ── Common injection payload markers ───────────────────────────────────
+"<script>"
+"</script>"
+"javascript:"
+"onerror="
+"onload="
+"' OR '1'='1"
+"'; DROP TABLE"
+"UNION SELECT"
+"--"
+"/*"
+"*/"
+"../"
+"..\\\\"
+"/etc/passwd"
+"file://"
+"http://169.254.169.254"
+"ldap://"
+
+# ── Synthetic helpers used by `cross_file_taint` ───────────────────────
+"nyx_taint_source"
+"nyx_sanitize"
+"nyx_dangerous_sink"
+"nyx_pass_through"
+
+# ── Tricky parser edge cases ───────────────────────────────────────────
+"\"\\xff\\xff\""
+"\"\\u0000\""
+"\"\\n\\r\\t\""
+"\"\\xc3\\x28\""
+"<?php"
+"?>"
+"<?xml"
+"#!/bin/sh"
+"\"\\\\\""

fuzz/fuzz_targets/cross_file_taint.rs

@@ -0,0 +1,146 @@
+#![no_main]
+
+// Cross-file resolution path: drives `run_rules_on_bytes` with a
+// pre-seeded `GlobalSummaries` so the SSA/taint engine actually
+// exercises `resolve_callee` against external summaries instead of
+// short-circuiting on `None` like `scan_bytes` does. The synthetic
+// summaries register one source / sanitizer / sink / pass-through
+// helper per language under fixed names, so libFuzzer mutations that
+// produce calls to those names hit the cross-file merge + resolution
+// paths (`GlobalSummaries::insert`, `by_lang_name` / `by_lang_qualified`
+// lookups, `ssa_by_key` precedence). The dictionary committed alongside
+// this target lists those names so libFuzzer biases towards them.
+
+use libfuzzer_sys::fuzz_target;
+use nyx_scanner::ast::run_rules_on_bytes;
+use nyx_scanner::labels::Cap;
+use nyx_scanner::summary::{FuncSummary, GlobalSummaries};
+use nyx_scanner::symbol::{FuncKey, Lang};
+use nyx_scanner::utils::config::Config;
+use std::path::Path;
+use std::sync::OnceLock;
+
+const EXTENSIONS: &[&str] = &[
+    "rs", "js", "ts", "py", "go", "java", "rb", "php", "c", "cpp",
+];
+
+const LANGS: &[Lang] = &[
+    Lang::Rust,
+    Lang::JavaScript,
+    Lang::TypeScript,
+    Lang::Python,
+    Lang::Go,
+    Lang::Java,
+    Lang::Ruby,
+    Lang::Php,
+    Lang::C,
+    Lang::Cpp,
+];
+
+// Helper names registered in `GlobalSummaries`. The dictionary file
+// (`fuzz/dict/all.dict`) lists these so libFuzzer mutations bias
+// toward producing calls that resolve to them.
+const SYNTHETIC_HELPERS: &[(&str, HelperRole)] = &[
+    ("nyx_taint_source", HelperRole::Source),
+    ("nyx_sanitize", HelperRole::Sanitizer),
+    ("nyx_dangerous_sink", HelperRole::Sink),
+    ("nyx_pass_through", HelperRole::PassThrough),
+];
+
+#[derive(Clone, Copy)]
+enum HelperRole {
+    Source,
+    Sanitizer,
+    Sink,
+    PassThrough,
+}
+
+fn build_global_summaries() -> GlobalSummaries {
+    let mut g = GlobalSummaries::new();
+    for &lang in LANGS {
+        for &(name, role) in SYNTHETIC_HELPERS {
+            let arity = match role {
+                HelperRole::Source => 0,
+                HelperRole::Sanitizer | HelperRole::Sink | HelperRole::PassThrough => 1,
+            };
+            let key = FuncKey {
+                lang,
+                namespace: format!("nyx_synthetic_{}.{}", lang.as_str(), default_ext(lang)),
+                name: name.into(),
+                arity: Some(arity),
+                ..Default::default()
+            };
+            let summary = match role {
+                HelperRole::Source => FuncSummary {
+                    name: name.into(),
+                    file_path: key.namespace.clone(),
+                    lang: lang.as_str().into(),
+                    param_count: 0,
+                    param_names: vec![],
+                    source_caps: Cap::all().bits(),
+                    ..Default::default()
+                },
+                HelperRole::Sanitizer => FuncSummary {
+                    name: name.into(),
+                    file_path: key.namespace.clone(),
+                    lang: lang.as_str().into(),
+                    param_count: 1,
+                    param_names: vec!["input".into()],
+                    sanitizer_caps: Cap::all().bits(),
+                    propagating_params: vec![0],
+                    ..Default::default()
+                },
+                HelperRole::Sink => FuncSummary {
+                    name: name.into(),
+                    file_path: key.namespace.clone(),
+                    lang: lang.as_str().into(),
+                    param_count: 1,
+                    param_names: vec!["input".into()],
+                    sink_caps: Cap::all().bits(),
+                    tainted_sink_params: vec![0],
+                    ..Default::default()
+                },
+                HelperRole::PassThrough => FuncSummary {
+                    name: name.into(),
+                    file_path: key.namespace.clone(),
+                    lang: lang.as_str().into(),
+                    param_count: 1,
+                    param_names: vec!["input".into()],
+                    propagating_params: vec![0],
+                    ..Default::default()
+                },
+            };
+            g.insert(key, summary);
+        }
+    }
+    g
+}
+
+fn default_ext(lang: Lang) -> &'static str {
+    match lang {
+        Lang::Rust => "rs",
+        Lang::JavaScript => "js",
+        Lang::TypeScript => "ts",
+        Lang::Python => "py",
+        Lang::Go => "go",
+        Lang::Java => "java",
+        Lang::Ruby => "rb",
+        Lang::Php => "php",
+        Lang::C => "c",
+        Lang::Cpp => "cpp",
+    }
+}
+
+static GLOBAL: OnceLock<GlobalSummaries> = OnceLock::new();
+
+fuzz_target!(|data: &[u8]| {
+    if data.is_empty() {
+        return;
+    }
+    let ext = EXTENSIONS[(data[0] as usize) % EXTENSIONS.len()];
+    let path_buf = format!("fuzz_input.{ext}");
+    let path = Path::new(&path_buf);
+    let cfg = Config::default();
+    let summaries = GLOBAL.get_or_init(build_global_summaries);
+    let _ = run_rules_on_bytes(&data[1..], path, &cfg, Some(summaries), None);
+});

fuzz/fuzz_targets/extract_summaries.rs

@@ -0,0 +1,25 @@
+#![no_main]
+
+// Pass-1 of the two-pass scanner: parse + summary extraction only,
+// without taint, rules, or cross-file resolution. Smaller surface than
+// `scan_bytes`, so libFuzzer converges on parse / lowering bugs faster
+// when they exist.
+use libfuzzer_sys::fuzz_target;
+use nyx_scanner::ast::extract_summaries_from_bytes;
+use nyx_scanner::utils::config::Config;
+use std::path::Path;
+
+const EXTENSIONS: &[&str] = &[
+    "rs", "js", "ts", "py", "go", "java", "rb", "php", "c", "cpp",
+];
+
+fuzz_target!(|data: &[u8]| {
+    if data.is_empty() {
+        return;
+    }
+    let ext = EXTENSIONS[(data[0] as usize) % EXTENSIONS.len()];
+    let path_buf = format!("fuzz_input.{ext}");
+    let path = Path::new(&path_buf);
+    let cfg = Config::default();
+    let _ = extract_summaries_from_bytes(&data[1..], path, &cfg);
+});

fuzz/fuzz_targets/scan_bytes.rs

@@ -0,0 +1,25 @@
+#![no_main]
+
+use libfuzzer_sys::fuzz_target;
+use nyx_scanner::ast::run_rules_on_bytes;
+use nyx_scanner::utils::config::Config;
+use std::path::Path;
+
+// One extension per supported tree-sitter grammar. The first input byte
+// picks which language path the parser takes; the rest is fed in as
+// source. Splitting this way lets a single corpus exercise all 10
+// language frontends without separate fuzz targets.
+const EXTENSIONS: &[&str] = &[
+    "rs", "js", "ts", "py", "go", "java", "rb", "php", "c", "cpp",
+];
+
+fuzz_target!(|data: &[u8]| {
+    if data.is_empty() {
+        return;
+    }
+    let ext = EXTENSIONS[(data[0] as usize) % EXTENSIONS.len()];
+    let path_buf = format!("fuzz_input.{ext}");
+    let path = Path::new(&path_buf);
+    let cfg = Config::default();
+    let _ = run_rules_on_bytes(&data[1..], path, &cfg, None, None);
+});

fuzz/seed_corpus/cross_file_taint/xfile_c.c

@@ -0,0 +1,8 @@
+#include <stdio.h>
+int main(void) {
+    char *x = nyx_taint_source();
+    nyx_dangerous_sink(x);
+    char *y = nyx_sanitize(nyx_taint_source());
+    nyx_dangerous_sink(y);
+    return 0;
+}

fuzz/seed_corpus/cross_file_taint/xfile_cpp.cpp

@@ -0,0 +1,8 @@
+#include <string>
+int main() {
+    std::string x = nyx_taint_source();
+    nyx_dangerous_sink(x);
+    std::string y = nyx_sanitize(nyx_taint_source());
+    nyx_dangerous_sink(y);
+    return 0;
+}

fuzz/seed_corpus/cross_file_taint/xfile_go.go

@@ -0,0 +1,8 @@
+package main
+
+func main() {
+    x := nyx_taint_source()
+    nyx_dangerous_sink(x)
+    y := nyx_sanitize(nyx_taint_source())
+    nyx_dangerous_sink(y)
+}

fuzz/seed_corpus/cross_file_taint/xfile_java.java

@@ -0,0 +1,8 @@
+public class Main {
+    public static void main(String[] args) {
+        String x = nyx_taint_source();
+        nyx_dangerous_sink(x);
+        String y = nyx_sanitize(nyx_taint_source());
+        nyx_dangerous_sink(y);
+    }
+}

fuzz/seed_corpus/cross_file_taint/xfile_javascript.js

@@ -0,0 +1,7 @@
+function main() {
+    let x = nyx_taint_source();
+    nyx_dangerous_sink(x);
+    let y = nyx_pass_through(nyx_taint_source());
+    nyx_dangerous_sink(nyx_sanitize(y));
+}
+main();

fuzz/seed_corpus/cross_file_taint/xfile_php.php

@@ -0,0 +1,8 @@
+<?php
+function main() {
+    $x = nyx_taint_source();
+    nyx_dangerous_sink($x);
+    $y = nyx_sanitize(nyx_taint_source());
+    nyx_dangerous_sink($y);
+}
+main();

fuzz/seed_corpus/cross_file_taint/xfile_python.py

@@ -0,0 +1,7 @@
+def main():
+    x = nyx_taint_source()
+    nyx_dangerous_sink(x)
+    y = nyx_pass_through(nyx_taint_source())
+    nyx_dangerous_sink(nyx_sanitize(y))
+
+main()

fuzz/seed_corpus/cross_file_taint/xfile_ruby.rb

@@ -0,0 +1,7 @@
+def main
+  x = nyx_taint_source
+  nyx_dangerous_sink(x)
+  y = nyx_sanitize(nyx_taint_source)
+  nyx_dangerous_sink(y)
+end
+main

fuzz/seed_corpus/cross_file_taint/xfile_rust.rs

@@ -0,0 +1,7 @@
+fn main() {
+    let x = nyx_taint_source();
+    nyx_dangerous_sink(x);
+    let y = nyx_taint_source();
+    let z = nyx_sanitize(y);
+    nyx_dangerous_sink(z);
+}

fuzz/seed_corpus/cross_file_taint/xfile_typescript.ts

@@ -0,0 +1,7 @@
+function main(): void {
+    const x: string = nyx_taint_source();
+    nyx_dangerous_sink(x);
+    const y: string = nyx_sanitize(nyx_taint_source());
+    nyx_dangerous_sink(y);
+}
+main();