apunkt/nyx
1
0
Fork 0
mirror of https://github.com/elicpeter/nyx.git synced 2026-06-15 20:05:13 +02:00
Code Issues Projects Releases Packages Wiki Activity

Prerelease cleanup (#46)

Browse source 
* feat: Add const_bound_vars tracking to prevent false positives in ownership checks

* feat: Introduce field interner and typed bounded vars for enhanced type tracking

* feat: Add typed_call_receivers and typed_bounded_dto_fields for enhanced type tracking

* feat: Centralize method name extraction with bare_method_name helper

* feat: Implement Phase-6 hierarchy fan-out for runtime virtual dispatch

* feat: Enhance C++ taint tracking with additional container operations and inline method resolution

* feat: Introduce field-sensitive points-to analysis for enhanced resource tracking

* feat: Implement Pointer-Phase 6 subscript handling for enhanced container analysis

* test: Add comprehensive tests for JavaScript control flow constructs and lattice operations

* docs: Update advanced analysis documentation with field-sensitive points-to and hierarchy fan-out details

* test: Add comprehensive tests for lattice algebra laws and SSA edge cases

* feat: Add destructured session user handling and safe user ID access patterns

* feat: Implement row-population reverse-walk for enhanced authorization checks

* feat: Enhance authorization checks with local alias chain for self-actor types

* feat: Introduce ActiveRecord query safety checks and enhance snippet extraction

* feat: Implement chained method call inner-gate rebinding for SSRF prevention

* feat: Add observability and error modules, enhance debug functionality, and implement theme context

* feat: Remove Auth Analysis page and update navigation to redirect to Explorer

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Reset path-safe-suppressed spans before lowering to maintain analysis integrity

* fix(ssa): ungate debug_assert_bfs_ordering for release-tests build

The helper at src/ssa/lower.rs was gated `#[cfg(debug_assertions)]` while
the unit test at the bottom of the file was gated only `#[cfg(test)]`.
Since `cfg(test)` is set in release builds with `--tests` but
`cfg(debug_assertions)` is not, `cargo build --release --tests` failed
with E0425. Removing the gate fixes the build; the body is `debug_assert!`
only, so the helper is free in release. Also drop the gate at the call
site to avoid a `dead_code` warning when the lib is built without
`--tests`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(closure-capture): flip JS/TS fixtures to required-finding

The JS and TS closure-capture fixtures pinned the old broken behaviour
via `forbidden_findings: [{ "id_prefix": "taint-" }]`. The engine now
correctly traces taint through the closure boundary (env source captured
by an arrow function, sunk via `child_process.exec` inside the body), so
the formerly-forbidden finding is a true positive.

Match the Python sibling's shape — `required_findings` with
`id_prefix` + `min_count` plus a small `noise_budget` — and rewrite the
companion READMEs and the phase8_fragility_tests doc-comments from
"known gap" to "regression guard".

Verified:
- cargo test --release --test phase8_fragility_tests → 8/8 pass
- cargo test --release --lib bfs_assertion → pass
- corpus benchmark F1 = 0.9976 (TP=205, FP=1, FN=0) — unchanged

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat: Add OWASP mapping and baseline mutation hooks for enhanced security analysis

* feat: Introduce health module and enhance health score computation with calibration tests

* feat: Add expectations configuration and cleanup .gitignore for log files

* feat: Implement theme selection and enhance settings panel for triage sync

* feat: Suppress false positives for strcpy calls with literal sources in AST

* feat: Update analyse_function_ssa to return body CFG for accurate analysis

* feat: Add bug report and feature request templates for improved issue tracking

* feat: removed dev scripts

* feat: update README.md for clarity and consistency in fixture descriptions

* feat: removed dev docs

* feat: clean up error handling and UI elements for improved user experience

* feat: adjust button sizes in HeaderBar for better UI consistency

* feat: enhance taint analysis with additional context for sanitizer and taint findings

* cargo fmt

* prettier

* refactor: simplify conditional checks and improve code readability in AST and screenshot capture scripts

* feat: add script to frame PNG screenshots with brand gradient

* feat: add fuzzing support with new targets and CI workflows

* refactor: streamline match expressions and improve formatting in CLI and output handling

* feat: enhance configuration display with detailed output options

* feat: stage demo configuration for improved CLI screenshot output

* feat: expose merge_configs function for user-configurable settings

* refactor: simplify code structure and improve readability in config handling

* refactor: improve descriptions for vulnerability patterns in various languages

* feat: update MIT License section with additional usage details and copyright information

* feat: update screenshots

* refactor: update build process and paths for frontend assets

* feat: add cross-file taint fuzzing target and supporting dictionary

* refactor: clean up formatting and comments in fuzz configuration and example files

* refactor: remove outdated comments and clean up CI configuration files

* chore: update changelog dates and improve formatting in documentation

* refactor: update Cargo.toml and CI configuration for improved packaging and build process

* refactor: enhance quote-stripping logic to prevent panics and add regression tests

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Eli Peter 2026-04-29 00:58:38 -04:00 • committed by GitHub
parent 79c29b394d
commit 82f18184b1
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
348 changed files with 48731 additions and 2925 deletions
Download patch file Download diff file Expand all files Collapse all files

30
src/patterns/javascript.rs
View file

@ -12,7 +12,7 @@ pub const PATTERNS: &[Pattern] = &[
// ── Tier A: Code execution ─────────────────────────────────────────
Pattern {
id: "js.code_exec.eval",
description: "eval() — dynamic code execution",
description: "eval() runs dynamic code",
query: r#"(call_expression
function: (identifier) @id (#eq? @id "eval"))
@vuln"#,
@ -23,7 +23,7 @@ pub const PATTERNS: &[Pattern] = &[
},
Pattern {
id: "js.code_exec.new_function",
description: "new Function() constructor — eval equivalent",
description: "new Function() constructor is equivalent to eval",
query: r#"(new_expression
constructor: (identifier) @id (#eq? @id "Function"))
@vuln"#,
@ -34,7 +34,7 @@ pub const PATTERNS: &[Pattern] = &[
},
Pattern {
id: "js.code_exec.settimeout_string",
description: "setTimeout/setInterval with string argument — implicit eval",
description: "setTimeout/setInterval with a string argument runs implicit eval",
query: r#"(call_expression
function: (identifier) @id (#match? @id "^(setTimeout|setInterval)$")
arguments: (arguments (string) @code))
@ -47,7 +47,7 @@ pub const PATTERNS: &[Pattern] = &[
// ── Tier A: XSS sinks ──────────────────────────────────────────────
Pattern {
id: "js.xss.document_write",
description: "document.write() — XSS sink",
description: "document.write() is an XSS sink",
query: r#"(call_expression
function: (member_expression
object: (identifier) @obj (#eq? @obj "document")
@ -60,7 +60,7 @@ pub const PATTERNS: &[Pattern] = &[
},
Pattern {
id: "js.xss.outer_html",
description: "Assignment to .outerHTML — XSS sink",
description: "Assignment to .outerHTML is an XSS sink",
query: r#"(assignment_expression
left: (member_expression
property: (property_identifier) @prop (#eq? @prop "outerHTML")))
@ -72,7 +72,7 @@ pub const PATTERNS: &[Pattern] = &[
},
Pattern {
id: "js.xss.insert_adjacent_html",
description: "insertAdjacentHTML() — XSS sink",
description: "insertAdjacentHTML() is an XSS sink",
query: r#"(call_expression
function: (member_expression
property: (property_identifier) @prop (#eq? @prop "insertAdjacentHTML")))
@ -85,7 +85,7 @@ pub const PATTERNS: &[Pattern] = &[
// ── Tier A: Prototype pollution ────────────────────────────────────
Pattern {
id: "js.prototype.proto_assignment",
description: "Assignment to __proto__ — prototype pollution",
description: "Assignment to __proto__ causes prototype pollution",
query: r#"(assignment_expression
left: (member_expression
property: (property_identifier) @prop (#eq? @prop "__proto__")))
@ -97,7 +97,7 @@ pub const PATTERNS: &[Pattern] = &[
},
Pattern {
id: "js.prototype.extend_object",
description: "Assignment to Object.prototype — prototype mutation",
description: "Assignment to Object.prototype mutates the prototype",
query: r#"(assignment_expression
left: (member_expression
object: (member_expression
@ -126,7 +126,7 @@ pub const PATTERNS: &[Pattern] = &[
},
Pattern {
id: "js.crypto.weak_hash_import",
description: "Direct md5()/sha1() call — weak hash from imported package",
description: "Direct md5()/sha1() call uses a weak hash from an imported package",
query: r#"(call_expression
function: (identifier) @id (#match? @id "^(md5|sha1)$"))
@vuln"#,
@ -137,7 +137,7 @@ pub const PATTERNS: &[Pattern] = &[
},
Pattern {
id: "js.crypto.math_random",
description: "Math.random() — not cryptographically secure",
description: "Math.random() is not cryptographically secure",
query: r#"(call_expression
function: (member_expression
object: (identifier) @obj (#eq? @obj "Math")
@ -165,7 +165,7 @@ pub const PATTERNS: &[Pattern] = &[
// ── Tier A: Open redirect ──────────────────────────────────────────
Pattern {
id: "js.xss.location_assign",
description: "Assignment to location/location.href — open redirect",
description: "Assignment to location/location.href is an open-redirect sink",
query: r#"(assignment_expression
left: (member_expression
object: (identifier) @obj (#match? @obj "^(window|location|document)$")
@ -207,7 +207,7 @@ pub const PATTERNS: &[Pattern] = &[
// ── Tier A: Insecure session / cookie configuration ─────────────────
Pattern {
id: "js.config.insecure_session_httponly",
description: "Session cookie with httpOnly: false — allows XSS-based session theft",
description: "Session cookie with httpOnly: false allows XSS-based session theft",
query: r#"(pair
key: (property_identifier) @key (#eq? @key "httpOnly")
value: (false) @val)
@ -219,7 +219,7 @@ pub const PATTERNS: &[Pattern] = &[
},
Pattern {
id: "js.config.insecure_session_secure",
description: "Session cookie with secure: false — cookie sent over plain HTTP",
description: "Session cookie with secure: false sends the cookie over plain HTTP",
query: r#"(pair
key: (property_identifier) @key (#eq? @key "secure")
value: (false) @val)
@ -276,7 +276,7 @@ pub const PATTERNS: &[Pattern] = &[
// ── Tier A: Verbose error response ────────────────────────────────
Pattern {
id: "js.config.verbose_error_response",
description: "Error object passed to response renderer — may leak stack traces to users",
description: "Error object passed to response renderer can leak stack traces to users",
query: r#"(call_expression
function: (member_expression
property: (property_identifier) @method
@ -295,7 +295,7 @@ pub const PATTERNS: &[Pattern] = &[
// ── Tier B: CORS dynamic origin reflection ────────────────────────
Pattern {
id: "js.config.cors_dynamic_origin",
description: "CORS Access-Control-Allow-Origin set to dynamic value — may reflect arbitrary origins",
description: "CORS Access-Control-Allow-Origin set to a dynamic value can reflect arbitrary origins",
query: r#"(call_expression
function: (member_expression
property: (property_identifier) @method (#eq? @method "setHeader"))