From 832533a8cdcfd6af6529fb7424a7324317c74960 Mon Sep 17 00:00:00 2001 From: Eli Peter <54954007+elicpeter@users.noreply.github.com> Date: Wed, 29 Apr 2026 02:57:57 -0400 Subject: [PATCH] Fix fn and bump frontend packages (#57) * chore(deps): update frontend dependencies to latest versions * fix: update reconnectTimer type and adjust tsconfig paths for consistency * fix: add toast to dependencies in FindingsPage component * fix: add toast to dependencies in FindingsPage component * fix: update language maturity metrics and improve Go validation handling * fix: update CHANGELOG with recent enhancements and dependency bumps * fix: format reconnectTimer initialization for improved readability --- CHANGELOG.md | 16 + README.md | 5 +- THIRDPARTY-LICENSES.html | 2 +- docs/language-maturity.md | 28 +- frontend/package-lock.json | 2005 ++++++++++---------------- frontend/package.json | 20 +- frontend/src/contexts/SSEContext.tsx | 4 +- frontend/src/pages/FindingsPage.tsx | 2 +- frontend/tsconfig.json | 3 +- frontend/tsconfig.tsbuildinfo | 2 +- src/cfg/literals.rs | 67 +- src/cfg/mod.rs | 34 +- src/taint/ssa_transfer/mod.rs | 255 +++- tests/benchmark/RESULTS.md | 3 +- tests/benchmark/results/latest.json | 98 +- 15 files changed, 1210 insertions(+), 1334 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index fb6a1551..e7e84fd2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -33,6 +33,12 @@ The biggest release since launch. The taint engine was rebuilt on top of an SSA - Cross-file SCC fixed-point. Mutually recursive functions across files now reach a joint convergence. - Demand-driven backwards analysis (off by default) annotates findings with cutoff diagnostics. - Direction-aware engine notes (`UnderReport`, `OverReport`, `Bail`) flow into confidence scoring, ranking, and the new `--require-converged` strict mode. +- Synthetic field-write inheritance: `u.Path = "/foo"` no longer drops taint carried by other fields of `u`. Fixes Owncast CVE-2023-3188 (SSRF). +- Phantom-Param-aware field suppression skips method/function references that share a base name with a tainted variable. +- Validation err-check narrowing for the two-statement Go idiom `_, err := strconv.Atoi(input); if err != nil { return }` — `input` is marked validated on the surviving `err == nil` branch. +- Go: `strings.Replace` / `strings.ReplaceAll` recognised as a sanitizer when the OLD literal contains a known-dangerous payload (shell metachars, path-traversal, HTML, SQL) and the NEW literal does not reintroduce one. +- Go: literal-strip cap detection extended to shell metachars (`;`, `|`, `&`, `$`, backtick) and SQL metachars (`'`, `"`, `--`). +- Go: `interpreted_string_literal` / `raw_string_literal` handled in tree-sitter so const-string arg extraction works for Go's double-quoted and backtick forms. ### Symbolic Execution @@ -54,6 +60,12 @@ The biggest release since launch. The taint engine was rebuilt on top of an SSA - C/C++ taint depth: output-parameter source propagation, implicit definitions for uninitialized declarations. - Negative test corpus (30 fixtures) and a 262-case benchmark with CI gates on rule-level Precision/Recall/F1. +### Detection metrics + +- Aggregate rule-level F1 reaches **0.998** (P=0.995, R=1.000). All real-CVE fixtures fire; only one open FP (`go-safe-009`). +- Go: 98.0% F1 on the 53-case corpus (1 FP / 0 FNs). +- CVE-2023-3188 (owncast SSRF) now detects. + ### CLI & Output - `nyx serve`: local web UI on `localhost` only (refuses non-loopback binds). @@ -89,6 +101,10 @@ The biggest release since launch. The taint engine was rebuilt on top of an SSA - Triage UI with database-backed decisions (true positive, false positive, deferred, suppressed) and `.nyx/triage.json` round-trip. - Scan history, rules management, and finding detail panels with evidence and flow visualization. - Vitest browser-side test suite wired into CI. +- Bumped to React 19, Vite 8, TypeScript 6.0, ESLint 10, `@vitejs/plugin-react` 6, with aligned `@types/react*`. +- `SSEContext`: typed `reconnectTimer` ref as `ReturnType | undefined` to satisfy TS 6's stricter `useRef` overloads. +- `FindingsPage`: included `toast` in `useCallback` deps to avoid stale-closure warnings. +- `tsconfig.json`: dropped `baseUrl`, using a relative `./src/*` path mapping instead. ### Removed diff --git a/README.md b/README.md index a1e2b018..61887c5a 100644 --- a/README.md +++ b/README.md @@ -123,7 +123,7 @@ All 10 languages parse via tree-sitter and run through the full pipeline, but ru | **Beta** | Java, PHP, Ruby, Rust, Go | 94.1% to 100% | Yes, with light FP triage | | **Preview** | C, C++ | 100% on synthetic corpus | No. STL container flow, builder chains, and inline class member functions are tracked, but deep pointer aliasing and function pointers are not. Pair with clang-tidy or Clang Static Analyzer | -Aggregate rule-level F1: 99.3% (P=0.991, R=0.995). The single open FN is `cve-go-2023-3188-vulnerable` (owncast SSRF); the two open FPs (`go-safe-007`, `go-safe-009`) also sit on the Go side. Per-dimension detail and known blind spots live on the [Language maturity page](https://elicpeter.github.io/nyx/language-maturity.html). +Aggregate rule-level F1: 99.8% (P=0.995, R=1.000). All real-CVE fixtures fire; the single open FP is `go-safe-009`. Per-dimension detail and known blind spots live on the [Language maturity page](https://elicpeter.github.io/nyx/language-maturity.html). ### Validated against real CVEs @@ -138,6 +138,7 @@ The corpus also holds a small set of vulnerable/patched pairs extracted from pub | [CVE-2023-26159](https://nvd.nist.gov/vuln/detail/CVE-2023-26159) | follow-redirects | TypeScript | SSRF | | [CVE-2022-30323](https://nvd.nist.gov/vuln/detail/CVE-2022-30323) | hashicorp/go-getter | Go | Command injection | | [CVE-2024-31450](https://nvd.nist.gov/vuln/detail/CVE-2024-31450) | owncast | Go | Path traversal | +| [CVE-2023-3188](https://nvd.nist.gov/vuln/detail/CVE-2023-3188) | owncast | Go | SSRF | | [CVE-2015-7501](https://nvd.nist.gov/vuln/detail/CVE-2015-7501) | Apache Commons Collections | Java | Deserialization | | [CVE-2017-12629](https://nvd.nist.gov/vuln/detail/CVE-2017-12629) | Apache Solr | Java | Command injection | | [CVE-2013-0156](https://nvd.nist.gov/vuln/detail/CVE-2013-0156) | Ruby on Rails | Ruby | Deserialization | @@ -149,8 +150,6 @@ The corpus also holds a small set of vulnerable/patched pairs extracted from pub | [CVE-2019-13132](https://nvd.nist.gov/vuln/detail/CVE-2019-13132) | ZeroMQ libzmq | C++ | Memory safety | | [CVE-2022-1941](https://nvd.nist.gov/vuln/detail/CVE-2022-1941) | Protocol Buffers | C++ | Memory safety | -`cve-go-2023-3188-vulnerable` (owncast SSRF) ships in the corpus too but is currently a known FN; it will move into the table once the engine fires on it. - Fixtures live under [`tests/benchmark/cve_corpus/`](tests/benchmark/cve_corpus/) with upstream attribution headers. --- diff --git a/THIRDPARTY-LICENSES.html b/THIRDPARTY-LICENSES.html index ed3ef23a..2f9eae1f 100644 --- a/THIRDPARTY-LICENSES.html +++ b/THIRDPARTY-LICENSES.html @@ -4336,7 +4336,7 @@ limitations under the License.