apunkt/nyx
1
0
Fork 0
mirror of https://github.com/elicpeter/nyx.git synced 2026-06-09 19:45:13 +02:00
Code Issues Projects Releases Packages Wiki Activity

Precision pass on auth and resource analysis (#63)

Browse source
This commit is contained in:
Eli Peter 2026-05-03 13:51:46 -04:00 • committed by GitHub
parent 064801a3a4
commit c7c5e0f3a1
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
62 changed files with 4248 additions and 138 deletions
Download patch file Download diff file Expand all files Collapse all files

29
CHANGELOG.md
View file

@ -4,6 +4,35 @@ All notable changes to Nyx are documented here. The format is based on [Keep a C
## [Unreleased]
## [0.6.1] - 2026-05-03
A precision pass on auth and resource analysis plus three fresh CVE corpus pairs, plus a UTF-8 slice panic in the path abstract domain. Closes ~1900 Go auth FPs on gitea-shaped helpers, the mastodon/diaspora private-callback Ruby controller pattern, and a phantom-taint outbreak from JS/TS / Java lambda shorthand in jest-style nested test callbacks.
### Added
- Java JDBC raw-SQL sinks. `Statement.execute`, `Statement.executeBatch`, and `Statement.executeLargeUpdate` modeled as `SQL_QUERY` sinks, classified via type-qualified resolution (`DatabaseConnection.execute`) so bare `execute` (Runnable, Executor, HttpClient) does not over-fire. `conn.createStatement()` and `conn.prepareCall()` now infer return type `DatabaseConnection`, so the JDBC chain `Statement s = conn.createStatement(); s.execute(q)` types `s` correctly. Closes GHSA-h8cj-hpmg-636v (Appsmith FilterDataServiceCE.dropTable). Vulnerable + patched Java fixtures added.
- Java/Kotlin `Pattern.matcher(value).matches()` chain recognised as a `ValidationCall` allowlist. Receiver of `.matcher(` must contain `regex` or `pattern`. Validation target is the `.matcher()` argument, not the bare `.matches()` receiver. Branch narrowing applies the `validated_must` to the input variable on the surviving branch. Same GHSA as above (`FILTER_TEMP_TABLE_NAME_PATTERN.matcher(tableName).matches()`).
- Per-parameter SSA summary probe now receives `BodyMeta.param_types`, so `extract_ssa_func_summary` runs a local `analyze_types_with_param_types` pass before extraction. Helper bodies whose sinks resolve only via type-qualified callees (e.g. `DatabaseConnection.execute` for JDBC `Statement.execute`) no longer drop the sink during cross-function summary extraction. Fixes the Appsmith helper `executeDbQuery(query)` that routed SQL through `statement.execute(query)`.
- Short-circuit branch condition CFG nodes now mirror `condition_vars` into `taint.uses`, so `apply_branch_predicates` interns the variable for short-circuit-decomposed validators (`if (x == null || !regex.matcher(x).matches()) throw`). Without this, the per-disjunct cond nodes built via `build_condition_chain` silently no-opped and `x` never reached `validated_must` on the surviving branch.
- Go `goqu.L(s)` and `goqu.Lit(s)` raw-SQL literal builders modeled as `SQL_QUERY` sinks. Safe siblings (`goqu.I` identifier, `goqu.C` column, `goqu.T` table, `goqu.V` parameterised value, `goqu.SUM`, `goqu.COUNT`, …) stay unlabeled. Gin source list extended with the array-returning siblings of the existing scalar helpers: `c.QueryArray`, `c.GetQueryArray`, `c.PostFormArray`, `c.GetPostFormArray`. Closes CVE-2026-41422 (daptin: `c.QueryArray("column")` → `goqu.L(project)` with the loop variable lifted through `for _, project := range columns`). Vulnerable + patched Go corpus pair under `tests/benchmark/cve_corpus/go/CVE-2026-41422/`.
- Go `for ident := range iter` def-use lifting. The `range_clause` child of `for_statement` is now consulted when `left`/`right` aren't direct fields of the `for` node, so taint from the iterable reaches the loop binding. Required for the daptin CVE shape above.
- Rust format-string named-argument lifting (`format!("...{x}...")`, stable since 1.58). Identifiers captured by `{name}` / `{name:fmt-spec}` are pulled into the call's `uses` for known format-style macros: `format`, `print`/`println`, `eprint`/`eprintln`, `write`/`writeln`, `panic`, `format_args`, `assert`/`debug_assert`, `todo`, `unimplemented`, `unreachable`, plus log-crate severity macros (`info`, `warn`, `error`, `debug`, `trace`). Recursive descent through one or two layers of expression wrapping (`format!("{x}").to_owned()`, RHS chained method calls). Without this, taint stopped at the macro boundary. `let q = format!("...{x}...")` carried no `x` because the identifier lives in format-string bytes rather than as a separate AST argument node. Mirrors the Python f-string lifter.
- Rust CVE corpus extended. CVE-2023-42456, CVE-2024-32884, CVE-2025-53549 vulnerable + patched fixtures under `tests/benchmark/cve_corpus/rust/`.
- Java lambda shorthand recognised by `extract_param_meta`. `lambda_expression`'s `parameters` field as a bare `identifier` (`cmd -> …`) or as an `inferred_parameters` wrapper around identifiers (`(a, b) -> …`) was not matching the formal_parameter / spread_parameter kinds in `PARAM_CONFIG`, so the lambda appeared parameterless and the SSA pipeline treated its formals as closure captures. Mirrors the JS/TS arrow shorthand path.
### Fixed
- Panic on non-ASCII input to `has_first_char_absolute_check` in the path abstract domain. The 32-byte search window around `[0]` was sliced as `&clause[lo..hi]` (str), which panicked when `hi` landed inside a multi-byte UTF-8 char (e.g. the em dash `—`, bytes 34..37). Switched to `&bytes[lo..hi]` with `windows()` byte-pattern checks; all needles are ASCII so the searches are equivalent. Surfaced by `cargo fuzz` (`scan_bytes` target, `.c` extension path, embedded `—` in a comment near `s[0] == '/'`). Regression test added.
### Fixed (false positives)
- Go `unit_has_user_input_evidence` framework-request-name allow-list narrowed for Go. `ctx`, `context`, `info`, `body`, `path`, `payload`, `dto`, `form`, `query` are no longer treated as user-input indicators on Go: in Go these are `context.Context` (cancellation/value-bag from the stdlib) or struct-pointer payload params (`info *PackageInfo`, `opts *FooOptions`), not request bindings. Go HTTP frameworks bind the request to per-framework typed params (`r *http.Request`, `c *gin.Context`, `c echo.Context`, `c *fiber.Ctx`); these arrive at the gate via `RouteHandler` kind or the type-aware param filter below. Stdlib `req` / `request` (the `*http.Request` convention) preserved. Other languages keep the broader allow-list.
- Go param collection drops `ctx context.Context` and `ctx context.CancelFunc` parameters entirely rather than seeding their names into `unit.params`. Tree-sitter-go's `parameter_declaration` exposes `name` and `type` as named fields; descend only into `name` so type-segment identifiers don't pollute the param-name set (`info *PackageInfo` no longer contributes `PackageInfo`). Together with the allow-list narrowing above, closes ~1900 `go.auth.missing_ownership_check` findings on gitea backend helpers whose only "user-input evidence" was the ubiquitous `ctx context.Context` first param.
- Ruby controller method visibility + filter-callback gate. Methods marked `private` (bare `private` directive, targeted `private :foo, :bar`, or `protected`) and Rails filter callback targets (`before_action`, `after_action`, `around_action`, their `prepend_*` / `append_*` / `skip_*` siblings, and the legacy `*_filter` aliases) are no longer emitted as `Function` units. Visibility tracking is class-body source-order with two directive forms (bare toggles default visibility, targeted explicitly marks named methods). Block-form filters (`before_action do … end`) carry no symbol arg and are correctly ignored. Closes mastodon / diaspora `rb.auth.missing_ownership_check` flood on `set_X` row-fetch helpers used as `before_action` callbacks.
- Field-LHS resource acquires no longer counted as local resource leaks at the `apply_assignment` site. `e->name = (char *)e + sizeof(*e)` (sub-buffer alias inside a returned struct) and `mem->buf = ptr` (local-into-field ownership transfer) now mark the RHS local `MOVED` and stop tracking the field as a separately OPEN resource. The parent struct owns the field's lifecycle. Cross-language (distinct from the Go-only `apply_call` field-LHS gate, which is restricted because JS/TS class-field acquires `this.fd = fs.openSync(...)` are the documented expected leak pattern in that path). Closes curl `entry_new` and equivalent C/C++ shapes in openssl / postgres.
- Empty-formals SSA lowering signal. `lower_to_ssa_with_params` now sets `with_params=true` even when `formal_params` is empty, so an arrow `() => {…}` is treated as "explicitly zero formals" rather than "no formals info". External vars in a zero-formal arrow are now correctly tagged as synthetic closure captures, so the JS/TS / Java auto-seed pass cannot mistake a bubbled-up free var (e.g. `userId` lifted from a nested jest test callback) for a real handler formal. Closes 934 phantom taint findings on the outline test suite (`describe("…", () => { test("…", () => { server.post(…) }) })`-shaped fixtures).
- Rust integer-typed values now suppress `Cap::FILE_IO` at the abstract-domain leaf gate (previously HTML_ESCAPE only). An integer's decimal representation is digits with optional leading `-`, never path metacharacters (`/`, `\`, `.`); magnitude is irrelevant. Closes the sudo-rs RUSTSEC-2023-0069 patched FP `let uid: u32 = user.parse()?; path.push(uid.to_string())`.
## [0.6.0] - 2026-05-02
A focused release that splits data-exfiltration off from SSRF and ships sinks for outbound HTTP request bodies across all 10 languages, with calibration tuned so plain user input echoed back upstream does not fire.

2
Cargo.lock generated
View file

@ -1134,7 +1134,7 @@ dependencies = [
[[package]]
name = "nyx-scanner"
version = "0.6.0"
version = "0.6.1"
dependencies = [
"assert_cmd",
"axum",

2
Cargo.toml
View file

@ -1,6 +1,6 @@
[package]
name = "nyx-scanner"
version = "0.6.0"
version = "0.6.1"
edition = "2024"
rust-version = "1.88"
description = "A multi-language static analysis tool for detecting security vulnerabilities"

7
README.md
View file

@ -74,7 +74,7 @@ Forward cross-file taint runs in every profile. Symex and the demand-driven back
### GitHub Action
```yaml
- uses: elicpeter/nyx@v0.6.0
- uses: elicpeter/nyx@v0.6.1
with:
format: sarif
fail-on: MEDIUM
@ -142,10 +142,12 @@ The corpus also holds a small set of vulnerable/patched pairs extracted from pub
| [CVE-2022-30323](https://nvd.nist.gov/vuln/detail/CVE-2022-30323) | hashicorp/go-getter | Go | Command injection |
| [CVE-2024-31450](https://nvd.nist.gov/vuln/detail/CVE-2024-31450) | owncast | Go | Path traversal |
| [CVE-2023-3188](https://nvd.nist.gov/vuln/detail/CVE-2023-3188) | owncast | Go | SSRF |
| [CVE-2026-41422](https://github.com/daptin/daptin/security/advisories/GHSA-rw2c-8rfq-gwfv) | daptin | Go | SQL injection |
| [CVE-2015-7501](https://nvd.nist.gov/vuln/detail/CVE-2015-7501) | Apache Commons Collections | Java | Deserialization |
| [CVE-2017-12629](https://nvd.nist.gov/vuln/detail/CVE-2017-12629) | Apache Solr | Java | Command injection |
| [CVE-2022-1471](https://nvd.nist.gov/vuln/detail/CVE-2022-1471) | SnakeYAML | Java | Deserialization |
| [CVE-2022-42889](https://nvd.nist.gov/vuln/detail/CVE-2022-42889) | Apache Commons Text | Java | Code execution |
| [GHSA-h8cj-hpmg-636v](https://github.com/advisories/GHSA-h8cj-hpmg-636v) | Appsmith | Java | SQL injection |
| [CVE-2013-0156](https://nvd.nist.gov/vuln/detail/CVE-2013-0156) | Ruby on Rails | Ruby | Deserialization |
| [CVE-2020-8130](https://nvd.nist.gov/vuln/detail/CVE-2020-8130) | Rake | Ruby | Command injection |
| [CVE-2021-21288](https://nvd.nist.gov/vuln/detail/CVE-2021-21288) | CarrierWave | Ruby | SSRF |
@ -155,6 +157,9 @@ The corpus also holds a small set of vulnerable/patched pairs extracted from pub
| [CVE-2018-20997](https://nvd.nist.gov/vuln/detail/CVE-2018-20997) | tar-rs | Rust | Path traversal |
| [CVE-2022-36113](https://nvd.nist.gov/vuln/detail/CVE-2022-36113) | cargo | Rust | Path traversal |
| [CVE-2024-24576](https://nvd.nist.gov/vuln/detail/CVE-2024-24576) | Rust stdlib | Rust | Command injection |
| [CVE-2023-42456](https://rustsec.org/advisories/RUSTSEC-2023-0069.html) | sudo-rs | Rust | Path traversal |
| [CVE-2024-32884](https://rustsec.org/advisories/RUSTSEC-2024-0335.html) | gitoxide | Rust | Command injection |
| [CVE-2025-53549](https://rustsec.org/advisories/RUSTSEC-2025-0043.html) | matrix-rust-sdk | Rust | SQL injection |
| [CVE-2016-3714](https://nvd.nist.gov/vuln/detail/CVE-2016-3714) | ImageMagick (ImageTragick) | C | Command injection |
| [CVE-2019-18634](https://nvd.nist.gov/vuln/detail/CVE-2019-18634) | sudo (pwfeedback) | C | Memory safety |
| [CVE-2019-13132](https://nvd.nist.gov/vuln/detail/CVE-2019-13132) | ZeroMQ libzmq | C++ | Memory safety |

2
THIRDPARTY-LICENSES.html
View file

@ -4768,7 +4768,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
<h3 id="GPL-3.0">GNU General Public License v3.0 only</h3>
<h4>Used by:</h4>
<ul class="license-used-by">
<li><a href=" https://github.com/elicpeter/nyx ">nyx-scanner 0.6.0</a></li>
<li><a href=" https://github.com/elicpeter/nyx ">nyx-scanner 0.6.1</a></li>
</ul>
<pre class="license-text">
GNU GENERAL PUBLIC LICENSE

4
frontend/package-lock.json generated
View file

@ -1,12 +1,12 @@
{
"name": "nyx-frontend",
"version": "0.5.0",
"version": "0.6.1",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "nyx-frontend",
"version": "0.5.0",
"version": "0.6.1",
"license": "GPL-3.0-or-later",
"dependencies": {
"@tanstack/react-query": "^5.100.6",

2
frontend/package.json
View file

@ -1,7 +1,7 @@
{
"name": "nyx-frontend",
"private": true,
"version": "0.6.0",
"version": "0.6.1",
"license": "GPL-3.0-or-later",
"type": "module",
"scripts": {

2
fuzz/Cargo.lock generated
View file

@ -1023,7 +1023,7 @@ dependencies = [
[[package]]
name = "nyx-scanner"
version = "0.6.0"
version = "0.6.1"
dependencies = [
"axum",
"bitflags",

26
src/abstract_interp/path_domain.rs
View file

@ -585,13 +585,13 @@ fn has_first_char_absolute_check(clause: &str) -> bool {
if bytes[i] == b'[' && bytes[i + 1] == b'0' && bytes[i + 2] == b']' {
let lo = i.saturating_sub(32);
let hi = (i + 3 + 32).min(bytes.len());
let window = &clause[lo..hi];
if (window.contains("==") || window.contains("!="))
&& (window.contains("'/'")
|| window.contains("'\\\\'")
|| window.contains("\"/\"")
|| window.contains("\"\\\\\""))
{
let window = &bytes[lo..hi];
let has_op = window.windows(2).any(|w| w == b"==" || w == b"!=");
let has_lit = window.windows(3).any(|w| w == b"'/'")
|| window.windows(4).any(|w| w == b"'\\\\'")
|| window.windows(3).any(|w| w == b"\"/\"")
|| window.windows(4).any(|w| w == b"\"\\\\\"");
if has_op && has_lit {
return true;
}
}
@ -1569,6 +1569,18 @@ mod tests {
);
// Negative: subscript but no equality op
assert_eq!(classify_path_rejection_atom("s[0]"), PathRejection::None);
// Regression: multibyte char inside the 32-byte search window must not
// panic on a non-char-boundary slice (fuzz crash repro).
let s = format!("{}s[0] == '/'", "—".repeat(20));
assert_eq!(
classify_path_rejection_atom(&s),
PathRejection::AbsoluteSlash
);
let s2 = format!("s[0] == '/'{}", "—".repeat(20));
assert_eq!(
classify_path_rejection_atom(&s2),
PathRejection::AbsoluteSlash
);
}
#[test]

133
src/auth_analysis/checks.rs
View file

@ -16,12 +16,15 @@ pub struct AuthFinding {
pub fn run_checks(model: &AuthorizationModel, rules: &AuthAnalysisRules) -> Vec<AuthFinding> {
let mut findings = Vec::new();
let web_signal = model.lang_web_framework_signal;
let lang = model.lang.as_str();
findings.extend(check_admin_routes(model, rules));
findings.extend(check_ownership_gaps(model, rules, web_signal));
findings.extend(check_partial_batch_authorization(model, rules, web_signal));
findings.extend(check_stale_authorization(model, rules, web_signal));
findings.extend(check_ownership_gaps(model, rules, web_signal, lang));
findings.extend(check_partial_batch_authorization(
model, rules, web_signal, lang,
));
findings.extend(check_stale_authorization(model, rules, web_signal, lang));
findings.extend(check_token_override_without_validation(
model, rules, web_signal,
model, rules, web_signal, lang,
));
findings.sort_by(|a, b| a.span.cmp(&b.span).then_with(|| a.rule_id.cmp(&b.rule_id)));
findings.dedup_by(|a, b| a.span == b.span && a.rule_id == b.rule_id);
@ -70,11 +73,12 @@ fn check_ownership_gaps(
model: &AuthorizationModel,
rules: &AuthAnalysisRules,
web_signal: Option<bool>,
lang: &str,
) -> Vec<AuthFinding> {
let mut findings = Vec::new();
for unit in &model.units {
if !unit_has_user_input_evidence(unit, web_signal) {
if !unit_has_user_input_evidence(unit, web_signal, lang) {
continue;
}
for op in &unit.operations {
@ -123,11 +127,12 @@ fn check_partial_batch_authorization(
model: &AuthorizationModel,
rules: &AuthAnalysisRules,
web_signal: Option<bool>,
lang: &str,
) -> Vec<AuthFinding> {
let mut findings = Vec::new();
for unit in &model.units {
if !unit_has_user_input_evidence(unit, web_signal) {
if !unit_has_user_input_evidence(unit, web_signal, lang) {
continue;
}
for op in &unit.operations {
@ -178,11 +183,12 @@ fn check_stale_authorization(
model: &AuthorizationModel,
rules: &AuthAnalysisRules,
web_signal: Option<bool>,
lang: &str,
) -> Vec<AuthFinding> {
let mut findings = Vec::new();
for unit in &model.units {
if !unit_has_user_input_evidence(unit, web_signal) {
if !unit_has_user_input_evidence(unit, web_signal, lang) {
continue;
}
for op in unit.operations.iter().filter(|operation| {
@ -226,6 +232,7 @@ fn check_token_override_without_validation(
model: &AuthorizationModel,
rules: &AuthAnalysisRules,
web_signal: Option<bool>,
lang: &str,
) -> Vec<AuthFinding> {
let mut findings = Vec::new();
@ -239,7 +246,7 @@ fn check_token_override_without_validation(
// call shape happens to look token-y (`account.token = …;
// account.save()`). Gate on positive user-input evidence so
// these pure backend units are never claimed as a token flow.
if !unit_has_user_input_evidence(unit, web_signal) {
if !unit_has_user_input_evidence(unit, web_signal, lang) {
continue;
}
let Some(token_lookup) = unit
@ -938,7 +945,7 @@ fn is_id_like_name(name: &str) -> bool {
/// pure utility helpers fail all three conditions and are skipped ,
/// they cannot, by construction, be the entry point of an
/// authentication-bearing flow.
fn unit_has_user_input_evidence(unit: &AnalysisUnit, web_signal: Option<bool>) -> bool {
fn unit_has_user_input_evidence(unit: &AnalysisUnit, web_signal: Option<bool>, lang: &str) -> bool {
if unit.kind == AnalysisUnitKind::RouteHandler {
return true;
}
@ -960,7 +967,9 @@ fn unit_has_user_input_evidence(unit: &AnalysisUnit, web_signal: Option<bool>) -
if !unit.context_inputs.is_empty() {
return true;
}
unit.params.iter().any(|p| is_external_input_param_name(p))
unit.params
.iter()
.any(|p| is_external_input_param_name_for_lang(p, lang))
}
/// Parameter-name heuristic: does this name carry external/user input
@ -974,7 +983,33 @@ fn unit_has_user_input_evidence(unit: &AnalysisUnit, web_signal: Option<bool>) -
/// Used by `unit_has_user_input_evidence` to recognise helper
/// functions that, while not registered as route handlers, are
/// clearly invoked with caller-supplied identifiers or request data.
#[cfg(test)]
fn is_external_input_param_name(name: &str) -> bool {
is_external_input_param_name_for_lang(name, "")
}
/// Lang-aware variant of [`is_external_input_param_name`]. When `lang`
/// names a language whose framework conventions don't use the generic
/// typed-extractor names from the JS/TS/Python ecosystems, the
/// framework-name allow-list is narrowed accordingly.
///
/// Currently narrowed for Go. In Go the names `ctx` / `context` /
/// `info` / `body` / `path` / `payload` / `dto` / `form` / `query` are
/// not framework-request indicators — they're, respectively,
/// `context.Context` (cancellation/value-bag from the stdlib) and a
/// menagerie of struct-pointer payload params (`info *PackageInfo`,
/// `opts *FooOptions`). Go's actual HTTP frameworks bind the request
/// to a per-framework typed param (`r *http.Request`, `c *gin.Context`,
/// `c echo.Context`, `c *fiber.Ctx`, `ctx *context.APIContext`); these
/// arrive at the gate via `kind == RouteHandler` (set by the route
/// extractor) or via the type-aware param filter in
/// `extract::common::collect_param_names` (which keeps `ctx` only when
/// its type is **not** the stdlib `context.Context`).
///
/// Real-repo trigger: `/Users/elipeter/oss/gitea` ─ ~1900
/// `go.auth.missing_ownership_check` findings on backend helpers whose
/// only "user-input evidence" was a `ctx context.Context` param name.
fn is_external_input_param_name_for_lang(name: &str, lang: &str) -> bool {
// Pytest / unittest.mock convention: parameters injected by
// `@mock.patch(...)` decorators are universally named
// `mock_<thing>` (`mock_project_id`, `mock_session`,
@ -1011,6 +1046,13 @@ fn is_external_input_param_name(name: &str) -> bool {
// matching on the name is a reliable proxy for the typed
// extractor binding. Bare `c` is too common (incidental local
// variable) to include without an additional type signal.
if matches!(lang, "go") {
// Go's allow-list: only `req` / `request` (the stdlib
// `*http.Request` convention). All other names from the
// generic allow-list have language-specific meanings in Go
// that aren't user-input ─ see fn doc-comment above.
return matches!(lower.as_str(), "req" | "request");
}
matches!(
lower.as_str(),
"req"
@ -1361,23 +1403,23 @@ mod tests {
// Function with no params and no context_inputs (Celery task
// shape), must NOT count as user-input-bearing.
let mut unit = empty_unit();
assert!(!unit_has_user_input_evidence(&unit, None));
assert!(!unit_has_user_input_evidence(&unit, None, ""));
// Adding internal-typed params (apps, schema_editor, Django
// migration RunPython callback shape) keeps the gate closed.
unit.params.push("apps".into());
unit.params.push("schema_editor".into());
assert!(!unit_has_user_input_evidence(&unit, None));
assert!(!unit_has_user_input_evidence(&unit, None, ""));
// pytest hook shape: (config, items), gate stays closed.
let mut unit = empty_unit();
unit.params.push("config".into());
unit.params.push("items".into());
assert!(!unit_has_user_input_evidence(&unit, None));
assert!(!unit_has_user_input_evidence(&unit, None, ""));
// Adding an id-like param flips the gate open.
unit.params.push("doc_id".into());
assert!(unit_has_user_input_evidence(&unit, None));
assert!(unit_has_user_input_evidence(&unit, None, ""));
// Token-named param flips the gate open (Express helper
// `acceptInvitation(token, currentUser, roleOverride)`).
@ -1385,23 +1427,23 @@ mod tests {
unit.params.push("token".into());
unit.params.push("currentUser".into());
unit.params.push("roleOverride".into());
assert!(unit_has_user_input_evidence(&unit, None));
assert!(unit_has_user_input_evidence(&unit, None, ""));
// Framework request-name param flips the gate open
// (Django/Flask `def view(request, project_id):`).
let mut unit = empty_unit();
unit.params.push("request".into());
assert!(unit_has_user_input_evidence(&unit, None));
assert!(unit_has_user_input_evidence(&unit, None, ""));
// Axum/Actix typed-extractor convention name flips it open.
let mut unit = empty_unit();
unit.params.push("path".into());
assert!(unit_has_user_input_evidence(&unit, None));
assert!(unit_has_user_input_evidence(&unit, None, ""));
// RouteHandler kind always wins, regardless of params.
let mut unit = empty_unit();
unit.kind = AnalysisUnitKind::RouteHandler;
assert!(unit_has_user_input_evidence(&unit, None));
assert!(unit_has_user_input_evidence(&unit, None, ""));
}
/// Web-framework signal `Some(false)` (project's manifest was
@ -1422,9 +1464,9 @@ mod tests {
// every desktop helper.
let mut unit = empty_unit();
unit.params.push("session_id".into());
assert!(unit_has_user_input_evidence(&unit, None));
assert!(unit_has_user_input_evidence(&unit, Some(true)));
assert!(!unit_has_user_input_evidence(&unit, Some(false)));
assert!(unit_has_user_input_evidence(&unit, None, ""));
assert!(unit_has_user_input_evidence(&unit, Some(true), ""));
assert!(!unit_has_user_input_evidence(&unit, Some(false), ""));
// Step 1 (RouteHandler) still wins regardless of the gate.
// RouteHandler kind is set by framework extractors (axum /
@ -1432,7 +1474,7 @@ mod tests {
// robust enough to bypass the project-level gate even when
// the manifest doesn't name the framework.
unit.kind = AnalysisUnitKind::RouteHandler;
assert!(unit_has_user_input_evidence(&unit, Some(false)));
assert!(unit_has_user_input_evidence(&unit, Some(false), ""));
// context_inputs arm: bare `session.foo` on a debug-session
// handle (not an auth session) lands in `context_inputs` via
@ -1448,9 +1490,9 @@ mod tests {
index: None,
span: (0, 0),
});
assert!(unit_has_user_input_evidence(&unit, None));
assert!(unit_has_user_input_evidence(&unit, Some(true)));
assert!(!unit_has_user_input_evidence(&unit, Some(false)));
assert!(unit_has_user_input_evidence(&unit, None, ""));
assert!(unit_has_user_input_evidence(&unit, Some(true), ""));
assert!(!unit_has_user_input_evidence(&unit, Some(false), ""));
}
/// `is_external_input_param_name` covers id-, token-, and
@ -1499,6 +1541,47 @@ mod tests {
assert!(!is_external_input_param_name("mocked_token"));
}
/// Go-specific narrowing of the framework-request-name allow-list.
///
/// Go has no framework convention that uses the generic
/// typed-extractor names from JS/TS/Python (`info`, `path`,
/// `payload`, `body`, `dto`, `form`, `query`). In Go these are
/// either struct-pointer payload params (`info *PackageInfo`),
/// stdlib types (`ctx context.Context`), or local variables.
/// The Go HTTP frameworks bind the request via per-framework typed
/// params (`r *http.Request`, `c *gin.Context`, `c echo.Context`,
/// `ctx *context.APIContext`), arriving at the gate via
/// RouteHandler kind. Real-repo trigger:
/// `/Users/elipeter/oss/gitea` ─ ~1900 helpers passing the gate
/// solely on `ctx context.Context`.
#[test]
fn external_input_param_name_for_go_narrows_allowlist() {
use super::is_external_input_param_name_for_lang as f;
// ID-shaped + token-shaped names always fire (cross-language).
assert!(f("user_id", "go"));
assert!(f("repoID", "go"));
assert!(f("access_token", "go"));
// Stdlib `r *http.Request` convention preserved.
assert!(f("req", "go"));
assert!(f("request", "go"));
// Names that Go does NOT use as a request indicator.
assert!(!f("ctx", "go"));
assert!(!f("context", "go"));
assert!(!f("info", "go"));
assert!(!f("body", "go"));
assert!(!f("path", "go"));
assert!(!f("payload", "go"));
assert!(!f("dto", "go"));
assert!(!f("form", "go"));
assert!(!f("query", "go"));
// Same names DO fire for non-Go languages (Express / NestJS /
// FastAPI / Axum extractor conventions).
assert!(f("ctx", "javascript"));
assert!(f("body", "typescript"));
assert!(f("path", "rust"));
assert!(f("payload", "python"));
}
/// Row-fetch exemption.
///
/// Row var declared at line 10; auth check naming the row appears

570
src/auth_analysis/extract/common.rs
View file

@ -104,7 +104,7 @@ fn collect_top_level_from_node(
}
}
}
"program" | "source_file" | "module" | "class" | "class_declaration" | "class_body"
"program" | "source_file" | "module" | "class_declaration" | "class_body"
| "body_statement" => {
for idx in 0..node.named_child_count() {
let Some(child) = node.named_child(idx as u32) else {
@ -113,10 +113,252 @@ fn collect_top_level_from_node(
collect_top_level_from_node(child, bytes, rules, model, file_meta);
}
}
// Ruby `class Foo; ... end`. Gate method descent through the
// visibility / callback-target filter so private helpers and
// `before_action :foo`-style callback targets are not emitted
// as `Function` units (the upstream cause of
// `rb.auth.missing_ownership_check` FPs on `set_X` row-fetch
// helpers in mastodon / diaspora controllers). Non-method
// class-body children (nested `class` / `module` /
// `singleton_method`) still recurse normally.
"class" => {
let body = node.child_by_field_name("body");
let visibility = body
.map(|b| ruby_method_visibility(b, bytes))
.unwrap_or_default();
let callbacks = body
.map(|b| ruby_callback_target_names(b, bytes))
.unwrap_or_default();
for idx in 0..node.named_child_count() {
let Some(child) = node.named_child(idx as u32) else {
continue;
};
if Some(child) == body {
for body_idx in 0..child.named_child_count() {
let Some(grand) = child.named_child(body_idx as u32) else {
continue;
};
if grand.kind() == "method" {
let name = function_name(grand, bytes).unwrap_or_default();
if !name.is_empty()
&& ruby_method_is_callback_or_private(
&name,
&visibility,
&callbacks,
)
{
continue;
}
}
collect_top_level_from_node(grand, bytes, rules, model, file_meta);
}
} else {
collect_top_level_from_node(child, bytes, rules, model, file_meta);
}
}
}
_ => {}
}
}
#[derive(Copy, Clone, Eq, PartialEq, Debug)]
pub enum RubyVisibility {
Public,
Protected,
Private,
}
/// Walk a Ruby class body in source order and attribute each method
/// definition's visibility, mirroring Ruby's `private` / `protected` /
/// `public` directive semantics.
///
/// Two directive forms are recognised:
/// 1. **Bare** (`private`). Tree-sitter parses these as a top-level
/// `(identifier "private")` sibling. Toggles default visibility
/// for every subsequent method.
/// 2. **Targeted** (`private :foo, :bar`). Parsed as
/// `(call method:identifier arguments:argument_list ...)`.
/// Explicitly marks the named methods; does not change default.
pub fn ruby_method_visibility(
body: Node<'_>,
bytes: &[u8],
) -> std::collections::HashMap<String, RubyVisibility> {
use crate::auth_analysis::config::matches_name;
use std::collections::HashMap;
let mut map: HashMap<String, RubyVisibility> = HashMap::new();
let mut current = RubyVisibility::Public;
for child in named_children(body) {
match child.kind() {
"identifier" => {
if let Some(vis) = ruby_visibility_for_directive(text(child, bytes).trim()) {
current = vis;
}
}
"call" => {
let callee_full = call_name(child, bytes);
let callee = bare_method_name(&callee_full);
let Some(target_vis) = ruby_visibility_for_directive(callee) else {
continue;
};
let arguments = child.child_by_field_name("arguments");
let args: Vec<Node<'_>> = arguments
.map(|node| named_children(node))
.unwrap_or_default();
if args.is_empty() {
current = target_vis;
continue;
}
let mut targeted_any = false;
for arg in args {
for name in ruby_symbol_names(arg, bytes) {
if name.is_empty() {
continue;
}
map.insert(name, target_vis);
targeted_any = true;
}
if arg.kind() == "method"
&& let Some(name_node) = arg.child_by_field_name("name")
{
let name = text(name_node, bytes);
if !name.is_empty() {
map.insert(name, target_vis);
targeted_any = true;
}
}
}
if !targeted_any {
current = target_vis;
}
let _ = matches_name;
}
"method" => {
if let Some(name_node) = child.child_by_field_name("name") {
let name = text(name_node, bytes);
if !name.is_empty() {
map.insert(name, current);
}
}
}
_ => {}
}
}
map
}
fn ruby_visibility_for_directive(name: &str) -> Option<RubyVisibility> {
match name {
"private" => Some(RubyVisibility::Private),
"protected" => Some(RubyVisibility::Protected),
"public" => Some(RubyVisibility::Public),
_ => None,
}
}
/// Collect names of methods registered as Rails filter callbacks
/// (`before_action`, `after_action`, `around_action`, with their
/// `prepend_*` / `append_*` / `skip_*` siblings, plus the legacy
/// `*_filter` aliases). Such methods may be public but are invoked
/// only as part of an action's request cycle, never as standalone
/// routes — so emitting them as units produces spurious
/// `missing_ownership_check` flags on the helper body's row fetches.
pub fn ruby_callback_target_names(
body: Node<'_>,
bytes: &[u8],
) -> std::collections::HashSet<String> {
use std::collections::HashSet;
let mut targets: HashSet<String> = HashSet::new();
for child in named_children(body) {
if child.kind() != "call" {
continue;
}
let callee_full = call_name(child, bytes);
let callee = bare_method_name(&callee_full);
if !ruby_is_filter_callback_directive(callee) {
continue;
}
let Some(arguments) = child.child_by_field_name("arguments") else {
continue;
};
for arg in named_children(arguments) {
if arg.kind() == "pair" {
continue;
}
for name in ruby_symbol_names(arg, bytes) {
if name.is_empty() {
continue;
}
targets.insert(name);
}
}
}
targets
}
fn ruby_is_filter_callback_directive(name: &str) -> bool {
matches!(
name,
"before_action"
| "after_action"
| "around_action"
| "prepend_before_action"
| "prepend_after_action"
| "prepend_around_action"
| "append_before_action"
| "append_after_action"
| "append_around_action"
| "skip_before_action"
| "skip_after_action"
| "skip_around_action"
| "before_filter"
| "after_filter"
| "around_filter"
| "prepend_before_filter"
| "prepend_after_filter"
| "prepend_around_filter"
| "append_before_filter"
| "append_after_filter"
| "append_around_filter"
| "skip_before_filter"
| "skip_after_filter"
| "skip_around_filter"
)
}
fn ruby_symbol_names(node: Node<'_>, bytes: &[u8]) -> Vec<String> {
match node.kind() {
"simple_symbol" | "hash_key_symbol" | "identifier" | "string" => {
vec![
strip_quotes(&text(node, bytes))
.trim_start_matches(':')
.to_string(),
]
}
"array" => named_children(node)
.into_iter()
.flat_map(|child| ruby_symbol_names(child, bytes))
.collect(),
_ => Vec::new(),
}
}
pub fn ruby_method_is_callback_or_private(
name: &str,
visibility: &std::collections::HashMap<String, RubyVisibility>,
callbacks: &std::collections::HashSet<String>,
) -> bool {
let vis = visibility
.get(name)
.copied()
.unwrap_or(RubyVisibility::Public);
if vis != RubyVisibility::Public {
return true;
}
callbacks.contains(name)
}
fn function_unit_from_var_declarator(
node: Node<'_>,
bytes: &[u8],
@ -3184,6 +3426,52 @@ fn collect_param_names(
out.push(name);
}
}
// Go `parameter_declaration` / `variadic_parameter_declaration`:
// tree-sitter-go shape exposes `name` (one or more identifiers)
// and `type` (the param's static type) as named fields. C/C++
// also use `parameter_declaration` but with a `declarator`
// field instead of `name`, so the `name`-field gate
// distinguishes Go from C/C++ shapes without language plumbing.
//
// Two engine improvements at this site, both Go-specific:
//
// 1. Drop the entire param when its type is a known
// non-user-input stdlib type. The dominant case is
// `ctx context.Context`, the canonical first param of
// nearly every Go function (cancellation / deadline /
// value-bag, NOT an HTTP request). Without this gate the
// bare param name `ctx` matches the framework-request-name
// allow-list in `is_external_input_param_name`, opening
// `unit_has_user_input_evidence` on every internal helper.
// 2. Descend only into the `name` field so type-segment
// identifiers don't pollute the param-name set. Without
// this scope, `info *PackageInfo` contributes both `info`
// and `PackageInfo` to `unit.params`; `path *Path` would
// contribute `path` and `Path`, etc. Mirrors the Rust
// `parameter` arm below.
//
// Real-repo trigger: `/Users/elipeter/oss/gitea` ─ ~1900
// `go.auth.missing_ownership_check` findings on backend
// helpers whose only "user-input evidence" was the ubiquitous
// `ctx context.Context` first param.
"parameter_declaration" | "variadic_parameter_declaration"
if node.child_by_field_name("name").is_some() =>
{
if let Some(type_node) = node.child_by_field_name("type")
&& is_go_non_user_input_type(type_node, bytes)
{
return;
}
let mut cursor = node.walk();
for child in node.children_by_field_name("name", &mut cursor) {
if child.kind() == "identifier" {
let name = text(child, bytes);
if !name.is_empty() && !out.contains(&name) {
out.push(name);
}
}
}
}
// Rust `parameter` node: descend ONLY into the `pattern` field so
// type-segment identifiers don't pollute the param-name set.
// Without this scope, `dst: &std::path::Path` contributes `std`,
@ -3294,6 +3582,48 @@ fn collect_param_names(
}
}
/// Recognise Go parameter types that are categorically not user-input
/// bearing. Used by the Go arm of [`collect_param_names`] to drop the
/// param entirely (rather than push its name into `unit.params` and
/// trip the framework-request-name allow-list in
/// `is_external_input_param_name`).
///
/// Conservative: only matches the stdlib `context.Context` /
/// `context.CancelFunc` interface idioms. These are the dominant
/// cluster ─ ~1900 findings on `/Users/elipeter/oss/gitea` ─ and there
/// is no shape under which they carry user input.
///
/// Implementation note: tree-sitter-go's `qualified_type` exposes
/// `package` (identifier) and `name` (type_identifier) as named fields.
/// Pointer-wrapping is rare for these (they're already interfaces) but
/// is handled defensively by descending through `pointer_type`.
fn is_go_non_user_input_type(type_node: Node<'_>, bytes: &[u8]) -> bool {
let mut node = type_node;
// Strip a single layer of pointer indirection if present.
if node.kind() == "pointer_type" {
if let Some(inner) = node.child_by_field_name("type") {
node = inner;
} else if let Some(inner) = node.named_child(0) {
node = inner;
}
}
if node.kind() != "qualified_type" {
return false;
}
let pkg = node
.child_by_field_name("package")
.map(|n| text(n, bytes))
.unwrap_or_default();
let name = node
.child_by_field_name("name")
.map(|n| text(n, bytes))
.unwrap_or_default();
matches!(
(pkg.as_str(), name.as_str()),
("context", "Context") | ("context", "CancelFunc")
)
}
/// Ascii-lowered id-shape predicate used by the Python typed-param
/// fallback in `collect_param_names`. Mirrors
/// `auth_analysis::checks::is_id_like_name` (cannot share that fn
@ -4451,4 +4781,242 @@ mod tests {
assert!(params.contains(&"b".to_string()), "got {:?}", params);
assert!(!params.contains(&"u32".to_string()), "got {:?}", params);
}
/// Go's stdlib `context.Context` is the canonical first-param of
/// most functions but is NOT user input ─ it carries deadline /
/// cancellation / value-bag, never an HTTP request. The Go arm of
/// `collect_param_names` drops the param entirely when its type is
/// `context.Context` so the bare name `ctx` doesn't trip the
/// framework-request-name allow-list.
///
/// Real-repo motivation:
/// `/Users/elipeter/oss/gitea/services/packages/packages.go::AddFileToExistingPackage`
/// and ~1900 sibling helpers passed
/// `unit_has_user_input_evidence` solely on this param.
#[test]
fn collect_param_names_go_drops_context_context_param() {
use super::function_params;
let mut parser = tree_sitter::Parser::new();
parser
.set_language(&tree_sitter::Language::from(tree_sitter_go::LANGUAGE))
.unwrap();
let src = b"package x\nfunc GetPackage(ctx context.Context, info *PackageInfo) {}\n";
let tree = parser.parse(src.as_slice(), None).unwrap();
let func = (0..tree.root_node().named_child_count())
.filter_map(|i| tree.root_node().named_child(i as u32))
.find(|n| n.kind() == "function_declaration")
.expect("file should have a function_declaration");
let params = function_params(func, src);
assert!(
!params.contains(&"ctx".to_string()),
"ctx context.Context must be dropped: got {:?}",
params
);
assert!(
!params.contains(&"context".to_string()) && !params.contains(&"Context".to_string()),
"type-segment idents must not leak: got {:?}",
params
);
assert!(
params.contains(&"info".to_string()),
"non-context typed params keep their name: got {:?}",
params
);
assert!(
!params.contains(&"PackageInfo".to_string()),
"type-segment idents must not leak from non-context params either: got {:?}",
params
);
}
/// Per-framework `*context.APIContext` (gitea), `*gin.Context`,
/// `iris.Context`, `*fiber.Ctx` and similar ARE user input ─ the
/// type-aware filter must NOT drop these. The non-stdlib package
/// name distinguishes them from the stdlib `context.Context`.
#[test]
fn collect_param_names_go_keeps_framework_context_param() {
use super::function_params;
let mut parser = tree_sitter::Parser::new();
parser
.set_language(&tree_sitter::Language::from(tree_sitter_go::LANGUAGE))
.unwrap();
let src = b"package x\nfunc Handle(ctx *context.APIContext) {}\n";
let tree = parser.parse(src.as_slice(), None).unwrap();
let func = (0..tree.root_node().named_child_count())
.filter_map(|i| tree.root_node().named_child(i as u32))
.find(|n| n.kind() == "function_declaration")
.expect("file should have a function_declaration");
let params = function_params(func, src);
assert!(
params.contains(&"ctx".to_string()),
"framework-bearing ctx must survive: got {:?}",
params
);
}
/// Multiple-name single-type Go declarations (`a, b int`) must
/// surface every name.
#[test]
fn collect_param_names_go_multi_name_param_decl() {
use super::function_params;
let mut parser = tree_sitter::Parser::new();
parser
.set_language(&tree_sitter::Language::from(tree_sitter_go::LANGUAGE))
.unwrap();
let src = b"package x\nfunc Add(a, b int, ctx context.Context) {}\n";
let tree = parser.parse(src.as_slice(), None).unwrap();
let func = (0..tree.root_node().named_child_count())
.filter_map(|i| tree.root_node().named_child(i as u32))
.find(|n| n.kind() == "function_declaration")
.expect("file should have a function_declaration");
let params = function_params(func, src);
assert!(params.contains(&"a".to_string()), "got {:?}", params);
assert!(params.contains(&"b".to_string()), "got {:?}", params);
assert!(!params.contains(&"ctx".to_string()), "got {:?}", params);
assert!(!params.contains(&"int".to_string()), "got {:?}", params);
}
mod ruby_visibility_and_callbacks {
use super::super::{
RubyVisibility, ruby_callback_target_names, ruby_method_is_callback_or_private,
ruby_method_visibility,
};
use tree_sitter::{Node, Parser, Tree};
fn parse(src: &str) -> (Tree, Vec<u8>) {
let mut parser = Parser::new();
parser
.set_language(&tree_sitter::Language::from(tree_sitter_ruby::LANGUAGE))
.unwrap();
let bytes = src.as_bytes().to_vec();
let tree = parser.parse(bytes.as_slice(), None).expect("parse");
(tree, bytes)
}
fn find_class_body<'a>(node: Node<'a>) -> Option<Node<'a>> {
if node.kind() == "class" {
return node.child_by_field_name("body");
}
for idx in 0..node.named_child_count() {
let Some(child) = node.named_child(idx as u32) else {
continue;
};
if let Some(body) = find_class_body(child) {
return Some(body);
}
}
None
}
#[test]
fn bare_private_directive_marks_subsequent_methods_private() {
let src = "class C\n def public_a; end\n private\n def helper_b; end\n def helper_c; end\nend\n";
let (tree, bytes) = parse(src);
let body = find_class_body(tree.root_node()).expect("body");
let vis = ruby_method_visibility(body, &bytes);
assert_eq!(vis.get("public_a").copied(), Some(RubyVisibility::Public));
assert_eq!(vis.get("helper_b").copied(), Some(RubyVisibility::Private));
assert_eq!(vis.get("helper_c").copied(), Some(RubyVisibility::Private));
}
#[test]
fn targeted_private_marks_only_named_methods() {
let src = "class C\n def a; end\n def b; end\n def c; end\n private :a, :c\nend\n";
let (tree, bytes) = parse(src);
let body = find_class_body(tree.root_node()).expect("body");
let vis = ruby_method_visibility(body, &bytes);
assert_eq!(vis.get("a").copied(), Some(RubyVisibility::Private));
assert_eq!(vis.get("b").copied(), Some(RubyVisibility::Public));
assert_eq!(vis.get("c").copied(), Some(RubyVisibility::Private));
}
#[test]
fn public_directive_re_opens_visibility() {
let src = "class C\n private\n def a; end\n public\n def b; end\nend\n";
let (tree, bytes) = parse(src);
let body = find_class_body(tree.root_node()).expect("body");
let vis = ruby_method_visibility(body, &bytes);
assert_eq!(vis.get("a").copied(), Some(RubyVisibility::Private));
assert_eq!(vis.get("b").copied(), Some(RubyVisibility::Public));
}
#[test]
fn protected_directive_recognised() {
let src = "class C\n protected\n def helper; end\nend\n";
let (tree, bytes) = parse(src);
let body = find_class_body(tree.root_node()).expect("body");
let vis = ruby_method_visibility(body, &bytes);
assert_eq!(vis.get("helper").copied(), Some(RubyVisibility::Protected));
}
#[test]
fn before_action_collects_callback_target_names() {
let src = "class C\n before_action :set_account\n before_action :set_user, only: [:show, :update]\n def show; end\n def set_account; end\n def set_user; end\nend\n";
let (tree, bytes) = parse(src);
let body = find_class_body(tree.root_node()).expect("body");
let callbacks = ruby_callback_target_names(body, &bytes);
assert!(callbacks.contains("set_account"));
assert!(callbacks.contains("set_user"));
// `only:` / `except:` keys must not pollute the target set.
assert!(!callbacks.contains("show"));
assert!(!callbacks.contains("update"));
assert!(!callbacks.contains("only"));
}
#[test]
fn before_action_block_form_yields_no_targets() {
// Block form `before_action do ... end` carries no symbol arg.
let src =
"class C\n before_action do\n require_login\n end\n def show; end\nend\n";
let (tree, bytes) = parse(src);
let body = find_class_body(tree.root_node()).expect("body");
let callbacks = ruby_callback_target_names(body, &bytes);
assert!(callbacks.is_empty(), "got {:?}", callbacks);
}
#[test]
fn skip_before_action_target_collected() {
let src = "class C\n skip_before_action :authenticate_user!, only: [:index]\n def index; end\nend\n";
let (tree, bytes) = parse(src);
let body = find_class_body(tree.root_node()).expect("body");
let callbacks = ruby_callback_target_names(body, &bytes);
assert!(callbacks.contains("authenticate_user!"));
}
#[test]
fn legacy_before_filter_alias_collected() {
let src = "class C\n before_filter :legacy_helper\n def legacy_helper; end\nend\n";
let (tree, bytes) = parse(src);
let body = find_class_body(tree.root_node()).expect("body");
let callbacks = ruby_callback_target_names(body, &bytes);
assert!(callbacks.contains("legacy_helper"));
}
#[test]
fn callback_target_or_private_predicate_combines_layers() {
// Private method → suppressed.
// Public callback target → suppressed.
// Public non-callback method → kept.
let src = "class C\n before_action :set_account\n def show; end\n def set_account; end\n private\n def helper; end\nend\n";
let (tree, bytes) = parse(src);
let body = find_class_body(tree.root_node()).expect("body");
let visibility = ruby_method_visibility(body, &bytes);
let callbacks = ruby_callback_target_names(body, &bytes);
assert!(!ruby_method_is_callback_or_private(
"show",
&visibility,
&callbacks
));
assert!(ruby_method_is_callback_or_private(
"set_account",
&visibility,
&callbacks
));
assert!(ruby_method_is_callback_or_private(
"helper",
&visibility,
&callbacks
));
}
}
}

11
src/auth_analysis/extract/mod.rs
View file

@ -53,11 +53,18 @@ pub fn extract_authorization_model(
&actix_web::ActixWebExtractor,
&rocket::RocketExtractor,
];
let mut model = AuthorizationModel::default();
let mut model = AuthorizationModel {
lang: lang.to_string(),
..Default::default()
};
for extractor in extractors {
if extractor.supports(lang, framework_ctx) {
model.extend(extractor.extract(tree, bytes, path, rules));
let mut other = extractor.extract(tree, bytes, path, rules);
// Preserve the canonical `lang` set above; sub-extractors
// build their own default-initialised models with empty lang.
other.lang = model.lang.clone();
model.extend(other);
}
}

19
src/auth_analysis/extract/rails.rs
View file

@ -1,7 +1,8 @@
use super::AuthExtractor;
use super::common::{
auth_check_from_call_site, build_function_unit, call_name, call_site_from_node, function_name,
named_children, span, text,
named_children, ruby_callback_target_names, ruby_method_is_callback_or_private,
ruby_method_visibility, span, text,
};
use crate::auth_analysis::config::{AuthAnalysisRules, matches_name, strip_quotes};
use crate::auth_analysis::model::{
@ -102,6 +103,19 @@ fn maybe_collect_controller(
);
let controller_segment = underscore_segment(class_name.trim_end_matches("Controller"));
let filter_directives = class_filter_directives(body, bytes);
// Rails routes only dispatch to public instance methods that are
// not registered as filter callbacks. Private / protected helpers
// and methods named in `before_action :foo` / `after_action :bar`
// run as part of an action's request cycle but are never
// independently routable, so emitting them as RouteHandler units
// produces FPs (e.g. `set_account` in
// `mastodon/app/controllers/admin/accounts_controller.rb` does
// `Account.find(params[:id])` inside a `private` block, with the
// actual `authorize @account` check living in the public action
// that triggers the callback). Skip them here; the action units
// remain under analysis with their own auth context.
let visibility = ruby_method_visibility(body, bytes);
let callback_targets = ruby_callback_target_names(body, bytes);
let controller_name = format!(
"{}{}",
if controller_namespace.is_empty() {
@ -122,6 +136,9 @@ fn maybe_collect_controller(
if action_name.is_empty() || action_name.ends_with('=') {
continue;
}
if ruby_method_is_callback_or_private(&action_name, &visibility, &callback_targets) {
continue;
}
let unit_idx = model.units.len();
let route_name = format!("{controller_name}#{action_name}");

5
src/auth_analysis/model.rs
View file

@ -362,6 +362,11 @@ pub struct AuthorizationModel {
///
/// Currently set only for Rust by `extract_authorization_model`.
pub lang_web_framework_signal: Option<bool>,
/// Source language of the file the model was built from. Used by
/// `unit_has_user_input_evidence` to apply per-language narrowing
/// of the framework-request-name allow-list. Empty string when no
/// language was supplied (single-file unit-test paths).
pub lang: String,
}
impl AuthorizationModel {

147
src/cfg/cfg_tests.rs
View file

@ -1390,6 +1390,116 @@ fn rust_nested_use_as_alias() {
assert_eq!(b.original, "Read");
}
/// `format!("{x}")` uses x even though x is captured via the format
/// string's named-argument syntax rather than as a separate AST
/// argument. Without this lift, taint stops at the macro boundary
/// for any caller whose format string reads a tainted variable by
/// name (matrix-rust-sdk CVE-2025-53549, log!() / println!() across
/// most Rust 1.58+ codebases).
#[test]
fn rust_format_macro_named_arg_lifted_into_uses() {
let src = b"fn f() { let x = 1; let y = format!(\"v={x}\"); }";
let ts_lang = Language::from(tree_sitter_rust::LANGUAGE);
let (cfg, _entry) = parse_and_build(src, "rust", ts_lang);
let mut found = false;
for n in cfg.node_indices() {
let info = &cfg[n];
if info.taint.defines.as_deref() == Some("y") {
assert!(
info.taint.uses.iter().any(|u| u == "x"),
"expected `x` in uses for `let y = format!(\"v={{x}}\")`; got {:?}",
info.taint.uses
);
found = true;
}
}
assert!(found, "no node found defining `y`");
}
#[test]
fn rust_format_macro_named_arg_with_format_spec() {
let src = b"fn f() { let x = 1; let y = format!(\"{x:?}\"); }";
let ts_lang = Language::from(tree_sitter_rust::LANGUAGE);
let (cfg, _entry) = parse_and_build(src, "rust", ts_lang);
let mut found = false;
for n in cfg.node_indices() {
let info = &cfg[n];
if info.taint.defines.as_deref() == Some("y") {
assert!(
info.taint.uses.iter().any(|u| u == "x"),
"expected `x` lifted past `{{x:?}}` format spec; got {:?}",
info.taint.uses
);
found = true;
}
}
assert!(found, "no node found defining `y`");
}
#[test]
fn rust_format_macro_escaped_braces_not_lifted() {
// `{{` and `}}` are escapes for literal `{` / `}`, NOT named
// argument captures. No identifier should be lifted from the
// sequence between them.
let src = b"fn f() { let q = format!(\"{{x}}\"); }";
let ts_lang = Language::from(tree_sitter_rust::LANGUAGE);
let (cfg, _entry) = parse_and_build(src, "rust", ts_lang);
for n in cfg.node_indices() {
let info = &cfg[n];
if info.taint.defines.as_deref() == Some("q") {
assert!(
!info.taint.uses.iter().any(|u| u == "x"),
"must not lift `x` from escaped `{{{{x}}}}`; got {:?}",
info.taint.uses
);
}
}
}
#[test]
fn rust_format_macro_positional_index_not_lifted() {
// Positional placeholders like `{0}` reference args by position,
// not by name. Don't accidentally treat a digit as an identifier.
let src = b"fn f() { let a = 1; let q = format!(\"{0}\", a); }";
let ts_lang = Language::from(tree_sitter_rust::LANGUAGE);
let (cfg, _entry) = parse_and_build(src, "rust", ts_lang);
for n in cfg.node_indices() {
let info = &cfg[n];
if info.taint.defines.as_deref() == Some("q") {
assert!(
!info.taint.uses.iter().any(|u| u == "0"),
"must not lift digit-only positional placeholder; got {:?}",
info.taint.uses
);
assert!(
info.taint.uses.iter().any(|u| u == "a"),
"expected `a` in uses (positional arg) for `format!(\"{{0}}\", a)`; got {:?}",
info.taint.uses
);
}
}
}
#[test]
fn rust_println_macro_named_arg_lifted() {
let src = b"fn f() { let user = String::from(\"x\"); println!(\"hi {user}\"); }";
let ts_lang = Language::from(tree_sitter_rust::LANGUAGE);
let (cfg, _entry) = parse_and_build(src, "rust", ts_lang);
let mut found = false;
for n in cfg.node_indices() {
let info = &cfg[n];
if info.call.callee.as_deref() == Some("println") {
assert!(
info.taint.uses.iter().any(|u| u == "user"),
"expected `user` lifted into println! uses; got {:?}",
info.taint.uses
);
found = true;
}
}
assert!(found, "no println! macro_invocation node found");
}
#[test]
fn go_no_import_bindings() {
let src = b"package main\nimport alias \"fmt\"\n";
@ -2798,6 +2908,43 @@ fn go_for_loop_back_edge() {
assert_loop_with_back_edge(&cfg, "go for");
}
/// Pins the structural fix in `def_use` Kind::For arm for Go's
/// `for ident, ident := range iter` shape. Tree-sitter wraps the binding
/// pattern + iterable in a `range_clause` child of the `for_statement`
/// (rather than direct `left`/`right` fields like Python / JS). Without
/// this, the loop binding never becomes a CFG def and taint from the
/// iterable cannot reach uses of the binding inside the loop body.
/// Original gap: CVE-2026-41422 (daptin) goqu.L SQL injection.
#[test]
fn go_for_range_loop_binding_is_defined() {
let src = b"package p\nfunc f(xs []string) { for _, p := range xs { use(p) } }";
let ts_lang = Language::from(tree_sitter_go::LANGUAGE);
let (cfg, _) = parse_and_build(src, "go", ts_lang);
let loop_node = cfg
.node_indices()
.find(|&n| matches!(cfg[n].kind, StmtKind::Loop))
.expect("for-range loop should produce a Loop header");
let info = &cfg[loop_node];
let all_defs: Vec<&str> = info
.taint
.defines
.iter()
.map(String::as_str)
.chain(info.taint.extra_defines.iter().map(String::as_str))
.collect();
assert!(
all_defs.contains(&"p"),
"loop binding `p` should appear in defines/extra_defines, got {:?}",
all_defs
);
assert!(
info.taint.uses.iter().any(|u| u == "xs"),
"iterable `xs` should appear in uses, got {:?}",
info.taint.uses
);
}
#[test]
fn ruby_while_back_edge() {
let src = b"def f\n while cond\n body\n end\nend\n";

16
src/cfg/conditions.rs
View file

@ -83,6 +83,18 @@ pub(super) fn push_condition_node<'a>(
let text = text_of(cond_ast, code)
.map(|t| truncate_at_char_boundary(&t, MAX_CONDITION_TEXT_LEN).to_string());
let span = (cond_ast.start_byte(), cond_ast.end_byte());
// Mirror condition variables into `taint.uses` so the per-body
// `SymbolInterner::from_cfg` pass interns them. Without this,
// `apply_branch_predicates` (which calls `interner.get(var)` to
// look up a Symbol id) silently no-ops on short-circuit branch
// condition nodes — they have no `taint.uses` even though
// `condition_vars` carries the variable names. Surfaced by
// GHSA-h8cj-hpmg-636v: a `||`-decomposed validator like
// `if (x == null || !regex.matcher(x).matches()) throw;` failed
// to mark `x` as `validated_must` on the surviving branch
// because the per-disjunct cond nodes (built via
// `build_condition_chain`) didn't populate `taint.uses`.
let uses_for_taint: Vec<String> = vars.clone();
g.add_node(NodeInfo {
kind: StmtKind::If,
ast: AstMeta {
@ -92,6 +104,10 @@ pub(super) fn push_condition_node<'a>(
condition_text: text,
condition_vars: vars,
condition_negated: negated,
taint: crate::cfg::TaintMeta {
uses: uses_for_taint,
..Default::default()
},
..Default::default()
})
}

193
src/cfg/literals.rs
View file

@ -1151,6 +1151,170 @@ pub(super) fn check_inner_call_args(node: Node, code: &[u8]) -> bool {
true
}
/// Extract identifiers captured by Rust format-string named-argument syntax
/// (`format!("…{name}…")`, stable since 1.58) from a `macro_invocation`
/// node. Returns the identifier names referenced by `{name}` /
/// `{name:fmt-spec}` patterns inside the first `string_literal` child of
/// the macro's `token_tree`.
///
/// Without this lifting, `let q = format!("...{x}...")` carries no `x` in
/// its `uses` because `x` lives in the format string's bytes rather than
/// as a separate AST argument node, so taint stops at the macro
/// boundary. Mirrors the Python f-string interpolation lifting in
/// `patterns/python.rs`.
///
/// Conservative recognition: only fires for known format-style macros
/// (`format`, `print`/`println`, `eprint`/`eprintln`, `write`/`writeln`,
/// `panic`, `format_args`, `assert`/`debug_assert`, the common `log`
/// crate severity macros). Empty for any non-Rust call node, any other
/// macro, or a token_tree whose first string is not present.
pub(super) fn extract_rust_format_macro_named_idents(call_node: Node, code: &[u8]) -> Vec<String> {
if call_node.kind() != "macro_invocation" {
return Vec::new();
}
let Some(macro_node) = call_node.child_by_field_name("macro") else {
return Vec::new();
};
let Some(macro_text) = text_of(macro_node, code) else {
return Vec::new();
};
let leaf = macro_text
.rsplit("::")
.next()
.unwrap_or(macro_text.as_str());
if !is_rust_format_style_macro(leaf) {
return Vec::new();
}
let tt = match call_node.child_by_field_name("token_tree") {
Some(t) => t,
None => {
let mut cursor = call_node.walk();
match call_node
.children(&mut cursor)
.find(|c| c.kind() == "token_tree")
{
Some(t) => t,
None => return Vec::new(),
}
}
};
let mut cursor = tt.walk();
let fmt_lit = match tt
.children(&mut cursor)
.find(|c| matches!(c.kind(), "string_literal" | "raw_string_literal"))
{
Some(n) => n,
None => return Vec::new(),
};
let raw = match text_of(fmt_lit, code) {
Some(s) => s,
None => return Vec::new(),
};
let content = strip_literal_quotes(&raw, fmt_lit, code).unwrap_or_else(|| raw.clone());
parse_rust_format_named_idents(&content)
}
/// Walk `n` and any descendants, accumulating named-format-arg idents from
/// every Rust `macro_invocation` reachable through structural expression
/// children (calls, fields, await, references, blocks, ...). Lets the
/// def-use collectors lift `format!("...{x}...")` named args through one
/// or two levels of expression wrapping (e.g.
/// `let q = format!("{x}").to_owned();` or RHS chained method calls).
pub(super) fn extract_rust_format_macro_named_idents_in(n: Node, code: &[u8]) -> Vec<String> {
let mut out = Vec::new();
collect_format_macro_idents_recursive(n, code, &mut out, 0);
out
}
fn collect_format_macro_idents_recursive(n: Node, code: &[u8], out: &mut Vec<String>, depth: u32) {
if depth > 6 {
return;
}
if n.kind() == "macro_invocation" {
for ident in extract_rust_format_macro_named_idents(n, code) {
out.push(ident);
}
}
let mut cursor = n.walk();
for child in n.children(&mut cursor) {
collect_format_macro_idents_recursive(child, code, out, depth + 1);
}
}
fn is_rust_format_style_macro(name: &str) -> bool {
matches!(
name,
"format"
| "print"
| "println"
| "eprint"
| "eprintln"
| "write"
| "writeln"
| "panic"
| "format_args"
| "assert"
| "debug_assert"
| "todo"
| "unimplemented"
| "unreachable"
| "info"
| "warn"
| "error"
| "debug"
| "trace"
)
}
fn parse_rust_format_named_idents(s: &str) -> Vec<String> {
let bytes = s.as_bytes();
let mut out: Vec<String> = Vec::new();
let mut i = 0;
while i < bytes.len() {
let b = bytes[i];
if b == b'{' {
if i + 1 < bytes.len() && bytes[i + 1] == b'{' {
i += 2;
continue;
}
let start = i + 1;
let mut j = start;
while j < bytes.len() && bytes[j] != b'}' && bytes[j] != b':' {
j += 1;
}
let ident_bytes = &bytes[start..j];
if is_valid_rust_format_ident(ident_bytes) {
if let Ok(name) = std::str::from_utf8(ident_bytes) {
out.push(name.to_string());
}
}
while j < bytes.len() && bytes[j] != b'}' {
j += 1;
}
i = j + 1;
} else if b == b'}' && i + 1 < bytes.len() && bytes[i + 1] == b'}' {
i += 2;
} else {
i += 1;
}
}
out
}
fn is_valid_rust_format_ident(b: &[u8]) -> bool {
if b.is_empty() {
return false;
}
let first = b[0];
if !(first.is_ascii_alphabetic() || first == b'_') {
return false;
}
if b.iter().all(|c| c.is_ascii_digit()) {
return false;
}
b.iter().all(|c| c.is_ascii_alphanumeric() || *c == b'_')
}
/// Extract per-argument identifiers from a call node's argument list.
/// Returns one `Vec<String>` per argument (in parameter-position order).
/// Returns empty if argument list can't be found or contains spread/keyword args.
@ -1663,6 +1827,11 @@ pub(super) fn def_use(
collect_idents_with_paths(val, code, &mut idents, &mut paths);
uses.extend(paths);
uses.extend(idents);
// Rust format-string named-arg capture: `let q =
// format!("...{x}...")` reads `x`, but `x` lives in
// the format-string bytes, not as a separate AST
// argument node, so collect_idents misses it.
uses.extend(extract_rust_format_macro_named_idents_in(val, code));
}
} else {
// Try nested declarator pattern (JS/TS `lexical_declaration` → `variable_declarator`,
@ -1716,6 +1885,7 @@ pub(super) fn def_use(
collect_idents_with_paths(val_node, code, &mut idents, &mut paths);
uses.extend(paths);
uses.extend(idents);
uses.extend(extract_rust_format_macro_named_idents_in(val_node, code));
}
}
}
@ -1728,6 +1898,7 @@ pub(super) fn def_use(
collect_idents_with_paths(ast, code, &mut idents, &mut paths);
uses.extend(paths);
uses.extend(idents);
uses.extend(extract_rust_format_macro_named_idents_in(ast, code));
}
}
(defs, uses, extra_defs)
@ -1750,6 +1921,7 @@ pub(super) fn def_use(
collect_idents_with_paths(rhs, code, &mut idents, &mut paths);
uses.extend(paths);
uses.extend(idents);
uses.extend(extract_rust_format_macro_named_idents_in(rhs, code));
}
(defs, uses, vec![])
}
@ -1801,9 +1973,26 @@ pub(super) fn def_use(
// `initializer`/`condition`/`increment`), so this path falls through
// to the default-collecting behaviour for those, preserving today's
// semantics.
//
// Go's `for ident := range iter` shape places the binding pattern
// and iterable on a `range_clause` child of the `for_statement`
// rather than as direct fields. Without the range_clause lookup
// below, taint from the iterable never reaches the loop binding
// (CVE-2026-41422 daptin: `c.QueryArray("col")` loop var `project`
// flows into `goqu.L(project)` SQL_QUERY sink).
Kind::For => {
let left = ast.child_by_field_name("left");
let right = ast.child_by_field_name("right");
let mut left = ast.child_by_field_name("left");
let mut right = ast.child_by_field_name("right");
if left.is_none() && right.is_none() {
let mut cursor = ast.walk();
for child in ast.children(&mut cursor) {
if child.kind() == "range_clause" {
left = child.child_by_field_name("left");
right = child.child_by_field_name("right");
break;
}
}
}
if left.is_none() && right.is_none() {
// C-style for, defer to default ident collection.
let mut idents = Vec::new();

30
src/cfg/params.rs
View file

@ -69,6 +69,36 @@ pub(super) fn extract_param_meta<'a>(
}
return out;
};
// Java lambda shorthand: tree-sitter-java exposes the `parameters` field
// on `lambda_expression` as either a single bare identifier (`cmd -> …`)
// or an `inferred_parameters` wrapper around identifiers (`(a, b) -> …`).
// Neither shape matches the formal_parameter / spread_parameter kinds in
// PARAM_CONFIG, so the per-child loop below would otherwise see no
// params and the lambda would appear parameterless. Without this, the
// SSA pipeline treats the lambda binding as a free / closure-captured
// variable, defeating the JS/TS / Java auto-seed distinction between
// real handler-param formals and bubbled-up captures. Mirrors the JS/TS
// arrow shorthand handled above.
if func_node.kind() == "lambda_expression" {
if params.kind() == "identifier" {
if let Some(name) = text_of(params, code) {
out.push((name, None, Vec::new()));
return out;
}
} else if params.kind() == "inferred_parameters" {
let mut cursor = params.walk();
for child in params.named_children(&mut cursor) {
if child.kind() == "identifier" {
if let Some(name) = text_of(child, code) {
out.push((name, None, Vec::new()));
}
}
}
if !out.is_empty() {
return out;
}
}
}
let mut cursor = params.walk();
for child in params.children(&mut cursor) {
// Self/this parameter (e.g. Rust's `self_parameter`)

28
src/labels/go.rs
View file

@ -68,7 +68,23 @@ pub static RULES: &[LabelRule] = &[
case_sensitive: false,
},
LabelRule {
matchers: &["db.Query", "db.Exec", "db.QueryRow", "db.Prepare"],
matchers: &[
"db.Query",
"db.Exec",
"db.QueryRow",
"db.Prepare",
// goqu raw SQL literal builders: `goqu.L(s)` and the alias
// `goqu.Lit(s)` insert `s` verbatim into the generated SQL with no
// parameterisation. CVE-2026-41422 (daptin) loops a user-controlled
// `c.QueryArray("column")` value into `goqu.L(project)` to allow
// arbitrary SELECT subqueries. Modelled by name — `goqu.L` is the
// documented escape hatch for raw SQL. The safe siblings
// `goqu.I` (identifier), `goqu.C` (column), `goqu.T` (table),
// `goqu.V` (parameterised value), and the typed function
// constructors (`goqu.COUNT`, `goqu.SUM`, …) are not sinks.
"goqu.L",
"goqu.Lit",
],
label: DataLabel::Sink(Cap::SQL_QUERY),
case_sensitive: false,
},
@ -538,6 +554,16 @@ pub fn framework_rules(ctx: &FrameworkContext) -> Vec<RuntimeLabelRule> {
"c.Cookie".into(),
"c.BindJSON".into(),
"c.ShouldBindJSON".into(),
// Array-returning sibling helpers. `c.QueryArray("k")` returns
// every value of repeated query param `k`; `c.PostFormArray`
// and `c.GetQueryArray` / `c.GetPostFormArray` are the
// documented `[]string` counterparts of the scalar methods
// above. CVE-2026-41422 (daptin) reads `c.QueryArray("column")`
// and loops directly into a SQL_QUERY sink.
"c.QueryArray".into(),
"c.GetQueryArray".into(),
"c.PostFormArray".into(),
"c.GetPostFormArray".into(),
],
label: DataLabel::Source(Cap::all()),
case_sensitive: false,

15
src/labels/java.rs
View file

@ -103,6 +103,21 @@ pub static RULES: &[LabelRule] = &[
label: DataLabel::Sink(Cap::SQL_QUERY),
case_sensitive: false,
},
// JDBC `Statement.execute(String)` / `executeBatch` / `executeLargeUpdate`.
// Bare `execute` over-fires (Runnable.run callbacks, Executor.execute,
// HttpClient.execute), so these only fire via type-qualified resolution
// when the receiver's TypeKind is DatabaseConnection (the kind both
// `Connection` and `Statement` map to in `class_name_to_type_kind`).
// Surfaced by GHSA-h8cj-hpmg-636v (Appsmith FilterDataServiceCE.dropTable).
LabelRule {
matchers: &[
"DatabaseConnection.execute",
"DatabaseConnection.executeBatch",
"DatabaseConnection.executeLargeUpdate",
],
label: DataLabel::Sink(Cap::SQL_QUERY),
case_sensitive: true,
},
LabelRule {
matchers: &["Class.forName"],
label: DataLabel::Sink(Cap::CODE_EXEC),

24
src/labels/mod.rs
View file

@ -1626,6 +1626,30 @@ mod tests {
assert_eq!(result, Some(DataLabel::Sink(Cap::FILE_IO)));
}
// CVE Hunt Session 6 (Go CVE-2026-41422 daptin SQL injection): goqu's
// raw SQL literal builders `goqu.L(s)` / `goqu.Lit(s)` insert `s`
// verbatim into the generated query. Modeled by name as SQL_QUERY
// sinks; the safe siblings `goqu.I` (identifier), `goqu.C`, `goqu.T`,
// `goqu.V`, `goqu.SUM`, `goqu.COUNT`, etc. are typed and stay
// unlabeled.
#[test]
fn classify_go_goqu_l_is_sql_query_sink() {
let result = classify("go", "goqu.L", None);
assert_eq!(result, Some(DataLabel::Sink(Cap::SQL_QUERY)));
}
#[test]
fn classify_go_goqu_lit_is_sql_query_sink() {
let result = classify("go", "goqu.Lit", None);
assert_eq!(result, Some(DataLabel::Sink(Cap::SQL_QUERY)));
}
#[test]
fn classify_go_goqu_i_is_not_sink() {
let result = classify("go", "goqu.I", None);
assert_eq!(result, None);
}
// CVE Hunt Session 2 (Go CVE-2023-3188 Owncast SSRF):
// `http.DefaultClient.Get/Post/Head/Do/PostForm` is the idiomatic Go
// SSRF sink shape (`http.DefaultClient` is the package-level shared

104
src/ssa/lower.rs
View file

@ -130,7 +130,7 @@ pub fn lower_to_ssa(
scope: Option<&str>,
scope_all: bool,
) -> Result<SsaBody, SsaError> {
lower_to_ssa_inner(cfg, entry, scope, scope_all, false, &[])
lower_to_ssa_inner(cfg, entry, scope, scope_all, false, &[], false)
}
/// Like `lower_to_ssa` but with formal parameter names supplied in declaration
@ -144,7 +144,17 @@ pub fn lower_to_ssa_with_params(
scope_all: bool,
formal_params: &[String],
) -> Result<SsaBody, SsaError> {
lower_to_ssa_inner(cfg, entry, scope, scope_all, false, formal_params)
// `with_params=true` signals "callers supplied an explicit formal list,
// even if empty" (e.g. arrow `() => {…}` has zero formals). This lets
// the synthetic-externals classifier distinguish "no formals info" from
// "explicit empty formals" — closure captures of an arrow with empty
// formals are still synthetic, not formals. Bug surfaced on outline's
// jest test files: free vars bubbled up from nested arrow callbacks
// (`body`, `userId`, `server.post`) became Params at the outer arrow's
// entry, and the JS/TS auto-seed treated `userId` as a real handler
// formal, producing 934 phantom taint findings. See
// `taint/ssa_transfer/mod.rs::auto_seed_handler_params`.
lower_to_ssa_inner(cfg, entry, scope, scope_all, false, formal_params, true)
}
/// Like `lower_to_ssa` but with `scope_nop`: when true, all nodes are included
@ -156,7 +166,7 @@ pub fn lower_to_ssa_scoped_nop(
entry: NodeIndex,
scope: Option<&str>,
) -> Result<SsaBody, SsaError> {
lower_to_ssa_inner(cfg, entry, scope, false, true, &[])
lower_to_ssa_inner(cfg, entry, scope, false, true, &[], false)
}
fn lower_to_ssa_inner(
@ -166,6 +176,7 @@ fn lower_to_ssa_inner(
scope_all: bool,
scope_nop: bool,
formal_params: &[String],
with_params: bool,
) -> Result<SsaBody, SsaError> {
if cfg.node_count() == 0 {
return Err(SsaError::EmptyCfg);
@ -256,6 +267,7 @@ fn lower_to_ssa_inner(
&filtered_edges,
&external_vars,
formal_params,
with_params,
&nop_nodes,
);
@ -936,6 +948,7 @@ fn rename_variables(
filtered_edges: &[(NodeIndex, NodeIndex, EdgeKind)],
external_vars: &[String],
formal_params: &[String],
with_params: bool,
nop_nodes: &HashSet<NodeIndex>,
) -> (
Vec<SsaBlock>,
@ -1698,18 +1711,21 @@ fn rename_variables(
// handler-name auto-seed in particular) can avoid treating closure
// captures as if they were parameters of the function under analysis.
//
// **Conservative behaviour when `formal_params` is empty.** Several
// call sites (`lower_to_ssa`, `lower_to_ssa_scoped_nop`) don't supply
// formal parameter names; in that case we cannot distinguish formals
// from free vars structurally, so we leave `synthetic_externals` empty
// and the auto-seed pass keeps its pre-fix behaviour of treating every
// `Param` op as a candidate. Only callers that pass a non-empty
// `formal_params` slice (`lower_to_ssa_with_params`, used by the
// findings pipeline's per-function lowering) opt into the
// closure-capture distinction.
// **Conservative behaviour when the caller didn't supply formal-param
// info.** Several call sites (`lower_to_ssa`, `lower_to_ssa_scoped_nop`)
// don't supply formal parameter names; in that case we cannot distinguish
// formals from free vars structurally, so we leave `synthetic_externals`
// empty and the auto-seed pass keeps its pre-fix behaviour of treating
// every `Param` op as a candidate. Callers that opt in via
// `lower_to_ssa_with_params` set `with_params=true`, signalling that
// `formal_params` is the authoritative formal list — even when empty
// (arrow `() => {…}`). In that case every external becomes synthetic
// unless it appears in `formal_params`, so the auto-seed pass cannot
// mistake a bubbled-up free var (like `userId` lifted from a nested
// jest test callback) for a formal of the outer body.
let mut synthetic_externals: HashSet<SsaValue> = HashSet::new();
let formal_set: HashSet<&str> = formal_params.iter().map(|s| s.as_str()).collect();
let track_synthetic = !formal_params.is_empty();
let track_synthetic = with_params;
if !external_vars.is_empty() {
let entry_cfg_node = blocks_nodes[0][0];
let mut synthetic_body = Vec::with_capacity(external_vars.len());
@ -3904,6 +3920,68 @@ mod tests {
);
}
/// REGRESSION: when the body takes a real handler-named formal
/// (`userId`), that formal must NOT end up in
/// `synthetic_externals` — the JS/TS / Java auto-seed pass relies
/// on this distinction to seed only real formals as
/// `Source(UserInput)` and skip closure captures. Companion
/// integration coverage for the empty-formals shape (arrow
/// `() => {…}` lifting bubbled-up free vars as synthetic) lives
/// in `tests/fixtures/fp_guards/framework_jest_test_callback_arrow/`
/// — that fixture exercises the full CFG construction path which
/// this unit test cannot reproduce in isolation.
#[test]
fn arrow_with_handler_formal_keeps_param_non_synthetic() {
let mut cfg: Cfg = Graph::new();
let entry = cfg.add_node(NodeInfo {
ast: crate::cfg::AstMeta {
enclosing_func: Some("lookup".into()),
..Default::default()
},
..make_node(StmtKind::Entry)
});
let use_node = cfg.add_node(NodeInfo {
taint: TaintMeta {
uses: vec!["userId".into()],
..Default::default()
},
ast: crate::cfg::AstMeta {
enclosing_func: Some("lookup".into()),
..Default::default()
},
..make_node(StmtKind::Seq)
});
let exit = cfg.add_node(NodeInfo {
ast: crate::cfg::AstMeta {
enclosing_func: Some("lookup".into()),
..Default::default()
},
..make_node(StmtKind::Exit)
});
cfg.add_edge(entry, use_node, EdgeKind::Seq);
cfg.add_edge(use_node, exit, EdgeKind::Seq);
let formals = vec!["userId".to_string()];
let body = lower_to_ssa_with_params(&cfg, entry, Some("lookup"), false, &formals)
.expect("SSA lowering should succeed");
let user_id_param = body
.blocks
.first()
.and_then(|b| {
b.body.iter().find(|inst| {
matches!(inst.op, SsaOp::Param { .. })
&& inst.var_name.as_deref() == Some("userId")
})
})
.expect("userId Param should be present");
assert!(
!body.synthetic_externals.contains(&user_id_param.value),
"real formal `userId` must not be marked synthetic; \
synthetic_externals={:?}",
body.synthetic_externals,
);
}
/// W1: a plain non-dotted assignment (`x = 1`) records nothing
/// in `field_writes`. Strict-additive: existing behaviour is
/// unchanged for non-field-write shapes.

8
src/ssa/type_facts.rs
View file

@ -249,6 +249,14 @@ pub(crate) fn constructor_type(lang: Lang, callee: &str) -> Option<TypeKind> {
"OkHttpClient" | "WebClient" | "RestTemplate" => Some(TypeKind::HttpClient),
"getConnection" => Some(TypeKind::DatabaseConnection),
"MongoClient" => Some(TypeKind::DatabaseConnection),
// JDBC `conn.createStatement()` / `conn.prepareCall()` produce a
// `Statement` / `CallableStatement` whose `.execute(sql)` is a
// first-class SQL sink. Mapped to `DatabaseConnection` so the
// type-qualified label `DatabaseConnection.execute` (in
// `labels/java.rs`) fires for `s.execute(query)` calls without
// widening the bare `execute` matcher. Surfaced by
// GHSA-h8cj-hpmg-636v (Appsmith FilterDataServiceCE.dropTable).
"createStatement" | "prepareCall" => Some(TypeKind::DatabaseConnection),
"FileInputStream" | "FileOutputStream" | "FileReader" | "FileWriter"
| "BufferedReader" | "BufferedWriter" => Some(TypeKind::FileHandle),
"getWriter" | "getOutputStream" => Some(TypeKind::HttpResponse),

139
src/state/transfer.rs
View file

@ -718,6 +718,52 @@ impl DefaultTransfer<'_> {
if let Some(ref def) = info.taint.defines
&& let Some(def_sym) = self.get_sym(info, def)
{
// SAFE-FOR-FIELD-LHS: when the LHS is a member expression
// (struct field / object property), do NOT track the field as
// a separate resource — the parent struct/object owns the
// field's lifecycle and the local function body cannot
// observe whether/when the parent's destructor (or paired
// Stop()/dispose() method on the parent) releases the
// underlying storage. Still mark the RHS as MOVED so the
// local-leak analysis treats the assignment as ownership
// transfer to the parent, not as a continuing local handle.
//
// Two real-repo shapes this closes (curl, openssl, postgres):
//
// (i) Sub-buffer alias inside a returned struct:
// e = curlx_calloc(...);
// e->name = (char *)e + sizeof(*e); // sub-buffer alias
// return e;
// Without this gate, e's OPEN transferred to e->name, e went
// MOVED, and e->name surfaced as "never closed".
//
// (ii) Local-into-field ownership transfer:
// ptr = malloc(...);
// mem->buf = ptr; // ownership now lives in *mem
// Without this gate, ptr was MOVED to mem->buf, but mem->buf
// then leaked at exit because *mem's lifecycle is owned by
// the caller. With this gate, ptr is MOVED (transfer
// acknowledged) and mem->buf is not separately tracked.
//
// Multi-language: applies to all languages. This is distinct
// from the `apply_call` field-LHS gate (Go-only because the
// documented TS/JS class-field acquire
// `this.fd = fs.openSync(...)` IS the expected leak pattern
// in tests/fixtures/.../typescript/state/resource_class.ts —
// that path remains untouched here because RHS-is-a-call
// routes through `apply_call`, not `apply_assignment`).
if def.contains('.') || def.contains("->") {
for used in &info.taint.uses {
if let Some(use_sym) = self.get_sym(info, used) {
let lc = state.resource.get(use_sym);
if lc.contains(ResourceLifecycle::OPEN) {
state.resource.set(use_sym, ResourceLifecycle::MOVED);
return;
}
}
}
return;
}
// If the RHS is a tracked resource, transfer its state
for used in &info.taint.uses {
if let Some(use_sym) = self.get_sym(info, used) {
@ -1063,6 +1109,99 @@ mod tests {
assert!(!is_guard_like("open_file"));
}
/// SAFE-FOR-FIELD-LHS gate: when an assignment writes a tracked
/// resource into a struct field (`def` contains `.` or `->`), the
/// RHS local must be marked MOVED (ownership transferred to the
/// parent struct) and the field must NOT be tracked as a separate
/// OPEN resource. Pins the curl/dynhds.c::entry_new shape.
#[test]
fn field_lhs_assignment_moves_rhs_and_does_not_track_field() {
let mut interner = SymbolInterner::new();
let sym_e = interner.intern("e");
let sym_field = interner.intern("e->name");
let transfer = DefaultTransfer {
lang: Lang::C,
resource_pairs: rules::resource_pairs(Lang::C),
interner: &interner,
resource_method_summaries: &[],
ptr_proxy_hints: None,
};
let mut state = ProductState::initial();
state.resource.set(sym_e, ResourceLifecycle::OPEN);
// `e->name = e` (sub-buffer alias): defines = "e->name", uses = ["e"].
let info = NodeInfo {
kind: StmtKind::Seq,
ast: AstMeta {
span: (0, 10),
..Default::default()
},
taint: TaintMeta {
defines: Some("e->name".into()),
uses: vec!["e".into()],
..Default::default()
},
..Default::default()
};
let (state, events) = transfer.apply(NodeIndex::new(0), &info, None, state);
assert!(events.is_empty());
assert_eq!(
state.resource.get(sym_e),
ResourceLifecycle::MOVED,
"RHS local should transfer to MOVED (ownership handed to parent struct)"
);
assert_eq!(
state.resource.get(sym_field),
ResourceLifecycle::empty(),
"field-LHS must NOT be seeded as a separately-tracked OPEN resource"
);
}
/// Recall guard for the field-LHS gate: a plain local-to-local
/// assignment (no field on the LHS) must still transfer the OPEN
/// state to the new alias and mark the source MOVED, preserving
/// existing local-leak detection.
#[test]
fn local_to_local_assignment_still_transfers_open() {
let mut interner = SymbolInterner::new();
let sym_buf = interner.intern("buf");
let sym_cursor = interner.intern("cursor");
let transfer = DefaultTransfer {
lang: Lang::C,
resource_pairs: rules::resource_pairs(Lang::C),
interner: &interner,
resource_method_summaries: &[],
ptr_proxy_hints: None,
};
let mut state = ProductState::initial();
state.resource.set(sym_buf, ResourceLifecycle::OPEN);
// `cursor = buf`: plain alias, no field.
let info = NodeInfo {
kind: StmtKind::Seq,
ast: AstMeta {
span: (0, 10),
..Default::default()
},
taint: TaintMeta {
defines: Some("cursor".into()),
uses: vec!["buf".into()],
..Default::default()
},
..Default::default()
};
let (state, events) = transfer.apply(NodeIndex::new(0), &info, None, state);
assert!(events.is_empty());
assert_eq!(state.resource.get(sym_buf), ResourceLifecycle::MOVED);
assert_eq!(state.resource.get(sym_cursor), ResourceLifecycle::OPEN);
}
#[test]
fn is_simple_truth_check_recognises_bare_identifier() {
let make = |text: &str, vars: Vec<&str>| NodeInfo {

13
src/taint/mod.rs
View file

@ -1480,6 +1480,7 @@ pub(crate) fn extract_intra_file_ssa_summaries(
None,
Some(&formal_params),
None,
None,
);
// Only store if the summary has observable effects. With
@ -1610,6 +1611,11 @@ pub(crate) fn lower_all_functions_from_bodies(
} else {
None
};
let param_types_ref = if !body.meta.param_types.is_empty() {
Some(body.meta.param_types.as_slice())
} else {
None
};
let summary = ssa_transfer::extract_ssa_func_summary(
&func_ssa,
&body.graph,
@ -1623,6 +1629,7 @@ pub(crate) fn lower_all_functions_from_bodies(
locator,
Some(formal_params),
formal_destructured,
param_types_ref,
);
// Always insert the summary, even when all fields are empty/default.
@ -1860,6 +1867,11 @@ fn rerun_extraction_with_augmented_summaries(
} else {
None
};
let param_types_ref = if !body.meta.param_types.is_empty() {
Some(body.meta.param_types.as_slice())
} else {
None
};
let new_summary = ssa_transfer::extract_ssa_func_summary_full(
&callee.ssa,
parent_cfg,
@ -1874,6 +1886,7 @@ fn rerun_extraction_with_augmented_summaries(
Some(&body.meta.params),
Some(&augmented_snapshot),
formal_destructured,
param_types_ref,
);
// OR-merge sink-only fields into the existing summary.

95
src/taint/path_state.rs
View file

@ -308,6 +308,24 @@ pub fn classify_condition(text: &str) -> PredicateKind {
return PredicateKind::AllowlistCheck;
}
// ── Java/Kotlin Pattern.matcher().matches() chain (before TypeCheck) ─
//
// Recognise `<re>.matcher(value).matches()` as a regex allowlist
// validator, not a TypeCheck. The receiver of `.matcher(` must
// contain `regex` or `pattern` so we don't widen to arbitrary
// `obj.matcher(x).matches()` calls. Surfaced by GHSA-h8cj-hpmg-636v
// (Appsmith FILTER_TEMP_TABLE_NAME_PATTERN.matcher(tableName).matches()).
// Matched here (before the generic `.matches(` TypeCheck branch
// below) so the chain doesn't silently fall into TypeCheck.
if let Some(matcher_pos) = lower.find(".matcher(")
&& lower[matcher_pos..].contains(".matches(")
{
let receiver = &lower[..matcher_pos];
if receiver.contains("regex") || receiver.contains("pattern") {
return PredicateKind::ValidationCall;
}
}
// ── Type-check guards ──────────────────────────────────────────────
if lower.contains("typeof ")
|| lower.contains("isinstance(")
@ -395,6 +413,24 @@ pub fn classify_condition(text: &str) -> PredicateKind {
}
}
// Java idiom `<PATTERN>.matcher(value).matches()` — the regex
// allowlist on Java/Kotlin is a two-step chain (`Pattern.matcher`
// returns a `Matcher`, `.matches()` is the boolean predicate).
// The bare callee here is `matches` (no args), so the
// single-call recogniser above doesn't fire. Lock on the
// chain shape and require the receiver of `.matcher(` to carry
// a regex / pattern marker so we don't widen to `.matcher(` on
// arbitrary types. Surfaced by GHSA-h8cj-hpmg-636v
// (Appsmith FILTER_TEMP_TABLE_NAME_PATTERN.matcher(tableName).matches()).
if bare == "matches"
&& let Some(matcher_pos) = lower.find(".matcher(")
{
let receiver = &lower[..matcher_pos];
if receiver.contains("regex") || receiver.contains("pattern") {
return PredicateKind::ValidationCall;
}
}
// Sanitizer
if bare.contains("sanitiz") || bare.contains("escape") || bare.contains("encode") {
return PredicateKind::SanitizerCall;
@ -648,6 +684,25 @@ fn extract_validation_target(text: &str) -> Option<String> {
let trimmed = trimmed.trim_start_matches(['(', '!', ' ', '\t']);
let trimmed = trimmed.strip_prefix("not ").unwrap_or(trimmed).trim();
// Java/Kotlin chain `<re>.matcher(value).matches()`: the validated
// target is the inner `.matcher()` argument, not the bare `.matches()`
// receiver. Locked on the same regex/pattern receiver gate as the
// classifier (GHSA-h8cj-hpmg-636v).
if trimmed.to_ascii_lowercase().contains(".matches(")
&& let Some(matcher_pos) = trimmed.find(".matcher(")
{
let receiver_lower = trimmed[..matcher_pos].to_ascii_lowercase();
if receiver_lower.contains("regex") || receiver_lower.contains("pattern") {
let args_start = matcher_pos + ".matcher(".len();
if let Some(first_arg) = first_call_arg(&trimmed[args_start..]) {
let first_arg = first_arg.strip_prefix('&').unwrap_or(first_arg).trim();
if !first_arg.is_empty() && is_identifier(first_arg) {
return Some(first_arg.to_string());
}
}
}
}
// Find the first `(` which separates callee from args
let paren_pos = trimmed.find('(')?;
let callee_part = &trimmed[..paren_pos];
@ -1559,3 +1614,43 @@ mod tests {
assert!(is_bounded_length_check("x.len() <= 256"));
}
}
#[cfg(test)]
mod ghsa_h8cj_hpmg_636v_tests {
use super::*;
#[test]
fn java_pattern_matcher_chain_classifies_as_validation() {
let kind =
classify_condition("FILTER_TEMP_TABLE_NAME_PATTERN.matcher(tableName).matches()");
assert_eq!(
kind,
PredicateKind::ValidationCall,
"matcher().matches() chain on PATTERN-named receiver should be ValidationCall"
);
}
#[test]
fn java_pattern_matcher_chain_target_is_matcher_arg() {
let (kind, target) = classify_condition_with_target(
"FILTER_TEMP_TABLE_NAME_PATTERN.matcher(tableName).matches()",
);
assert_eq!(kind, PredicateKind::ValidationCall);
assert_eq!(target.as_deref(), Some("tableName"));
}
#[test]
fn java_negated_pattern_matcher_chain_target_is_matcher_arg() {
let (kind, target) = classify_condition_with_target(
"!FILTER_TEMP_TABLE_NAME_PATTERN.matcher(tableName).matches()",
);
assert_eq!(kind, PredicateKind::ValidationCall);
assert_eq!(target.as_deref(), Some("tableName"));
}
#[test]
fn java_pattern_matcher_chain_non_pattern_receiver_is_not_validation() {
// Precision guard: only fires when receiver name has regex/pattern marker.
let kind = classify_condition("obj.matcher(x).matches()");
assert!(
kind != PredicateKind::ValidationCall,
"no regex marker should not trigger validation"
);
}
}

59
src/taint/ssa_transfer/mod.rs
View file

@ -8077,13 +8077,17 @@ fn is_abstract_safe_for_sink(
return true;
}
// HTML_ESCAPE type-only gate: an integer's decimal representation is
// always digits (with optional leading `-`), which never contain HTML
// metacharacters (`<`, `>`, `"`, `'`, `&`, `/`, `:`) in either text or
// attribute context. The interval bound is irrelevant here, a large
// magnitude doesn't introduce metachars, so HTML_ESCAPE uses a
// type-only leaf check rather than the SQL/FILE/SHELL dual gate below.
if sink_caps.intersects(Cap::HTML_ESCAPE) {
// HTML_ESCAPE / FILE_IO type-only gate: an integer's decimal
// representation is always digits (with optional leading `-`), which
// never contain HTML metacharacters (`<`, `>`, `"`, `'`, `&`, `/`,
// `:`) nor path metacharacters (`/`, `\`, `.`). Magnitude is
// irrelevant — a large value doesn't introduce metachars, so both
// sink classes use a type-only leaf check rather than the SQL/SHELL
// dual gate below. Closes the sudo-rs RUSTSEC-2023-0069 patched FP
// where `let uid: u32 = user.parse()?; path.push(uid.to_string())`
// was flagged as a path-traversal FILE_IO sink despite the SSA
// value being unambiguously typed as a numeric uid.
if sink_caps.intersects(Cap::HTML_ESCAPE | Cap::FILE_IO) {
if let Some(tf) = type_facts {
let leaves = trace_tainted_leaf_values(inst, state, ssa, cfg);
if !leaves.is_empty() && leaves.iter().all(|v| tf.is_int(*v)) {
@ -8092,14 +8096,15 @@ fn is_abstract_safe_for_sink(
}
}
// Dual gate: SQL_QUERY / FILE_IO / SHELL_ESCAPE with proven Int type AND
// bounded interval. Both conditions required: type proves the value IS
// an integer (not a string that happened to parse), interval proves it's
// Dual gate: SQL_QUERY / SHELL_ESCAPE with proven Int type AND bounded
// interval. Both conditions required: type proves the value IS an
// integer (not a string that happened to parse), interval proves it's
// bounded (not arbitrary). Traces through Assign chains so
// "const_string + tainted_int" is caught. SHELL_ESCAPE is included
// because a bounded integer's decimal representation can't contain shell
// metacharacters.
if sink_caps.intersects(Cap::SQL_QUERY | Cap::FILE_IO | Cap::SHELL_ESCAPE) {
// "const_string + tainted_int" is caught. SQL_QUERY keeps the bound
// requirement because RUSTSEC-2024-0363-style binary-protocol overflow
// requires a 4 GiB+ payload; SHELL_ESCAPE keeps it because a
// multi-line decimal can still trip newline-sensitive shell parsing.
if sink_caps.intersects(Cap::SQL_QUERY | Cap::SHELL_ESCAPE) {
if let Some(tf) = type_facts {
let leaves = trace_tainted_leaf_values(inst, state, ssa, cfg);
if !leaves.is_empty()
@ -8212,10 +8217,13 @@ fn is_call_abstract_safe(
}
}
// HTML_ESCAPE type-only gate (same as non-Call path): digits never
// contain HTML metacharacters regardless of magnitude, so an integer
// payload is safe for an HTML sink without requiring a bounded interval.
if sink_caps.intersects(Cap::HTML_ESCAPE) {
// HTML_ESCAPE / FILE_IO type-only gate (same as non-Call path): digits
// never contain HTML metacharacters or path-traversal metacharacters
// regardless of magnitude, so an integer payload is safe for these
// sink classes without requiring a bounded interval. Closes the
// RUSTSEC-2023-0069 patched FP for cross-function summary-resolved
// path sinks like `open_for_user(uid)`.
if sink_caps.intersects(Cap::HTML_ESCAPE | Cap::FILE_IO) {
if let Some(tf) = type_facts {
let leaves = trace_tainted_leaf_values(inst, state, ssa, cfg);
if !leaves.is_empty() && leaves.iter().all(|v| tf.is_int(*v)) {
@ -8224,8 +8232,10 @@ fn is_call_abstract_safe(
}
}
// Dual gate for Call sinks (same as non-Call path)
if sink_caps.intersects(Cap::SQL_QUERY | Cap::FILE_IO | Cap::SHELL_ESCAPE) {
// Dual gate for Call sinks: SQL_QUERY / SHELL_ESCAPE keep the bounded-
// interval requirement (see is_abstract_safe_for_sink for the
// rationale).
if sink_caps.intersects(Cap::SQL_QUERY | Cap::SHELL_ESCAPE) {
if let Some(tf) = type_facts {
let leaves = trace_tainted_leaf_values(inst, state, ssa, cfg);
if !leaves.is_empty()
@ -8368,6 +8378,15 @@ fn trace_single_leaf(
leaves.push(v);
}
}
SsaOp::Call { callee, .. } if crate::ssa::type_facts::is_int_producing_callee(callee) => {
// Int-producing conversion (`str.parse::<u32>()`, `Atoi`,
// `parseInt`, ...). Tracing past the Call would land on the
// String-typed source and defeat the type-only HTML/FILE_IO
// suppression below — but the Call's *result* is unambiguously
// numeric, so the value itself is the right leaf. Mirrors the
// is_numeric_length_access stop-leaf at the top of this fn.
leaves.push(v);
}
SsaOp::Call { args, .. } => {
// For a Call whose node is not itself a Source (so the Call
// introduces no fresh attacker-controlled taint), trace through

34
src/taint/ssa_transfer/summary_extract.rs
View file

@ -20,6 +20,7 @@ use super::{
use crate::cfg::{BodyId, Cfg, FuncSummaries};
use crate::labels::{Cap, SourceKind};
use crate::ssa::ir::{SsaBody, SsaOp, SsaValue, Terminator};
use crate::ssa::type_facts::{TypeFactResult, TypeKind, analyze_types_with_param_types};
use crate::summary::GlobalSummaries;
use crate::symbol::Lang;
use crate::taint::domain::{TaintOrigin, VarTaint};
@ -51,6 +52,7 @@ pub fn extract_ssa_func_summary(
locator: Option<&crate::summary::SinkSiteLocator<'_>>,
formal_param_names: Option<&[String]>,
formal_destructured_fields: Option<&[Vec<String>]>,
param_types: Option<&[Option<TypeKind>]>,
) -> crate::summary::ssa_summary::SsaFuncSummary {
extract_ssa_func_summary_full(
ssa,
@ -66,6 +68,7 @@ pub fn extract_ssa_func_summary(
formal_param_names,
None,
formal_destructured_fields,
param_types,
)
}
@ -104,7 +107,34 @@ pub fn extract_ssa_func_summary_full(
// taint flow through sibling bindings is visible to summary
// extraction (CVE-2026-25544 / @payloadcms/drizzle SQLi).
formal_destructured_fields: Option<&[Vec<String>]>,
// BodyMeta.param_types parallel-vec. When supplied, drives a local
// `analyze_types_with_param_types` pass so the per-parameter probe's
// `SsaTaintTransfer.type_facts` is populated. Without this, helper
// bodies whose sinks are recognised only via type-qualified callee
// resolution (`receiver_type.label_prefix() + "." + method`, e.g.
// `DatabaseConnection.execute` for JDBC `Statement.execute`) silently
// drop the sink during summary extraction even though the same
// callee is correctly classified by the post-optimise transfer in
// `transfer_inst`. Surfaced by GHSA-h8cj-hpmg-636v (Appsmith
// FilterDataServiceCE.dropTable: helper `executeDbQuery(query)`
// routes the SQL string through `statement.execute(query)` whose
// SQL_QUERY caps were invisible to the param-1 probe). `None` for
// legacy / test paths preserves prior behaviour.
param_types: Option<&[Option<TypeKind>]>,
) -> crate::summary::ssa_summary::SsaFuncSummary {
// Pre-compute type facts on the un-optimised SSA body so the per-param
// probe can resolve sinks that depend on receiver-type inference.
// Empty const_values: this runs *before* the optimiser, so const-prop
// refinements aren't available yet, but the pass-1 instruction-shape
// typing (Source/Param/Call→constructor_type) and the second-pass
// Assign/Phi propagation are sufficient for the JDBC chain
// `Statement s = conn.createStatement(); s.execute(q);` to type `s`
// as `DatabaseConnection`.
let local_type_facts: Option<TypeFactResult> = param_types.map(|pt| {
let empty_consts: HashMap<SsaValue, crate::ssa::const_prop::ConstLattice> = HashMap::new();
analyze_types_with_param_types(ssa, cfg, &empty_consts, Some(lang), pt)
});
let local_type_facts_ref: Option<&TypeFactResult> = local_type_facts.as_ref();
use crate::summary::SinkSite;
use crate::summary::ssa_summary::{SsaFuncSummary, TaintTransform};
@ -215,7 +245,7 @@ pub fn extract_ssa_func_summary_full(
param_seed: None,
receiver_seed: None,
const_values: None,
type_facts: None,
type_facts: local_type_facts_ref,
ssa_summaries,
extra_labels: None,
base_aliases: None,
@ -761,7 +791,7 @@ pub fn extract_ssa_func_summary_full(
param_seed: None,
receiver_seed: None,
const_values: None,
type_facts: None,
type_facts: local_type_facts_ref,
ssa_summaries,
extra_labels: None,
base_aliases: None,

4
src/taint/tests.rs
View file

@ -4332,6 +4332,7 @@ fn ssa_summary_identity_propagation() {
None,
None,
None,
None,
);
assert!(
!summary.param_to_return.is_empty(),
@ -4396,6 +4397,7 @@ fn ssa_summary_sanitizer_strips_bits() {
None,
None,
None,
None,
);
// Sanitizer should strip some bits
for (_, transform) in &summary.param_to_return {
@ -4453,6 +4455,7 @@ fn ssa_summary_source_adds_bits() {
None,
None,
None,
None,
);
assert!(
!summary.source_caps.is_empty(),
@ -4510,6 +4513,7 @@ fn ssa_summary_param_to_sink() {
None,
None,
None,
None,
);
assert!(
!summary.param_to_sink.is_empty(),

6
tests/benchmark/RESULTS.md
View file

@ -30,10 +30,12 @@ Real disclosed CVEs reduced to minimal reproducers, vulnerable + patched pair pe
| CVE-2022-30323 | Go | hashicorp/go-getter | MPL-2.0 | CMDI | detected |
| CVE-2023-3188 | Go | owncast | MIT | SSRF | detected |
| CVE-2024-31450 | Go | owncast | MIT | path_traversal | detected |
| CVE-2026-41422 | Go | daptin | LGPL-3.0 | sql_injection | detected |
| CVE-2015-7501 | Java | Apache Commons Collections | Apache-2.0 | Deserialization | detected |
| CVE-2017-12629 | Java | Apache Solr | Apache-2.0 | CMDI | detected |
| CVE-2022-1471 | Java | SnakeYAML | Apache-2.0 | Deserialization | detected |
| CVE-2022-42889 | Java | Apache Commons Text | Apache-2.0 | code_exec | detected |
| GHSA-h8cj-hpmg-636v | Java | Appsmith | Apache-2.0 | sql_injection | detected |
| CVE-2013-0156 | Ruby | Ruby on Rails | MIT | Deserialization | detected |
| CVE-2020-8130 | Ruby | Rake | MIT | CMDI | detected |
| CVE-2021-21288 | Ruby | CarrierWave | MIT | SSRF | detected |
@ -42,7 +44,10 @@ Real disclosed CVEs reduced to minimal reproducers, vulnerable + patched pair pe
| CVE-2018-15133 | PHP | Laravel | MIT | Deserialization | detected |
| CVE-2018-20997 | Rust | tar-rs | MIT OR Apache-2.0 | path_traversal | detected |
| CVE-2022-36113 | Rust | cargo | MIT OR Apache-2.0 | path_traversal | detected |
| CVE-2023-42456 | Rust | sudo-rs | Apache-2.0 | path_traversal | detected |
| CVE-2024-24576 | Rust | Rust stdlib | MIT OR Apache-2.0 | CMDI | detected |
| CVE-2024-32884 | Rust | gitoxide | Apache-2.0 OR MIT | CMDI | detected |
| CVE-2025-53549 | Rust | matrix-rust-sdk | Apache-2.0 | SQL Injection | detected |
| CVE-2016-3714 | C | ImageMagick (ImageTragick) | ImageMagick License | CMDI | detected |
| CVE-2019-18634 | C | sudo (pwfeedback) | ISC | memory_safety | detected |
| CVE-2019-13132 | C++ | ZeroMQ libzmq | MPL-2.0 | memory_safety | detected |
@ -72,6 +77,7 @@ Most recent first. Metrics are rule-level on the corpus size at that point.
| Date | Change | Corpus | P | R | F1 |
|------------|------------------------------------------------------------------------------|--------|-------|-------|-------|
| 2026-05-03 | Go for-range loop binding now defined from `range_clause` child of `for_statement` (was: tree-sitter wraps the binding/iterable on a child node; only direct `left`/`right` fields were consulted, so taint never reached the loop binding). gin sources extended to `c.QueryArray` / `c.GetQueryArray` / `c.PostFormArray` / `c.GetPostFormArray`. goqu raw SQL literal builders `goqu.L` / `goqu.Lit` recognised as SQL_QUERY sinks. CVE-2026-41422 (daptin aggregate API) detected | 521 | 1.000 | 1.000 | 1.000 |
| 2026-05-02 | TS regex-allowlist `<*regex*>.test(value)` / `<*pattern*>.test(value)` recognised as ValidationCall whose target is the first arg (overrides default receiver-as-target); conservative on receiver names so non-regex `*.test()` callees stay Unknown. CVE-2026-25544 (Payload drizzle SQL injection) lands in corpus disabled — needs validated-flow propagation through SSA derivation / helper-summary returns | 499 | 1.000 | 1.000 | 1.000 |
| 2026-05-02 | JS arrow `assignment_pattern` default-param extraction + JS object-literal kwarg fallback for gated sinks + double-call (`f()(x)`) chained-inner rebinding; lodash `_.template` modeled as gated CODE_EXEC sink suppressed by `{ evaluate: false }`; CVE-2023-22621 (Strapi SSTI) detected | 494 | — | — | — |
| 2026-05-02 | `strings.ReplaceAll` recognised as CMDi sanitiser in chain-wrapper / call-site-replace shapes; clears `go-safe-009` (last open corpus FP); aggregate rule-level reaches P=R=F1=1.000 | 492 | 1.000 | 1.000 | 1.000 |

59
tests/benchmark/corpus/c/safe/safe_struct_field_subbuffer_alloc.c Normal file
View file

@ -0,0 +1,59 @@
/*
* c-safe-realrepo-001 — distilled from curl/lib/dynhds.c::entry_new
* (and a similar shape in dozens of other curl/openssl/postgres/git
* functions). Pattern: a constructor allocates a parent struct then
* assigns sub-buffer pointers (or transfers local-allocated buffers)
* into struct fields, finally returning the parent. The parent's
* lifecycle is owned by the caller; the engine should not flag
* `e->name`, `mem->buf`, etc., as "never closed".
*
* Engine fix (depth: structural — apply_assignment field-LHS gate):
* src/state/transfer.rs::apply_assignment skips ownership transfer
* when `defines` is a member expression (`.` or `->`). The RHS is
* marked MOVED so the local-leak analysis treats the assignment as
* ownership transfer to the parent struct, while the field itself
* is not separately tracked.
*/
#include <stdlib.h>
#include <string.h>
struct dynhds_entry {
char *name;
size_t namelen;
char *value;
size_t valuelen;
};
/* Sub-buffer-alias shape: e->name aliases into e itself. */
struct dynhds_entry *entry_new(const char *name, size_t namelen,
const char *value, size_t valuelen) {
struct dynhds_entry *e;
char *p;
e = calloc(1, sizeof(*e) + namelen + valuelen + 2);
if (!e)
return NULL;
e->name = p = (char *)e + sizeof(*e);
memcpy(p, name, namelen);
e->namelen = namelen;
e->value = p += namelen + 1;
memcpy(p, value, valuelen);
e->valuelen = valuelen;
return e; /* caller frees the whole entry, sub-buffers go with it */
}
struct mem {
char *buf;
size_t len;
};
/* Local-into-field ownership transfer shape: ptr is local, then handed
* to mem->buf. After the assignment, *mem owns the buffer; foo()
* returns *mem to the caller. */
struct mem *foo(struct mem *m, size_t n) {
char *ptr = malloc(n);
m->buf = ptr; /* ownership now lives in *m, not in `ptr` */
m->len = n;
return m;
}

21
tests/benchmark/corpus/c/safe/vuln_local_leak_no_field_assign.c Normal file
View file

@ -0,0 +1,21 @@
/*
* c-vuln-realrepo-001 — vulnerable counterpart to
* safe_struct_field_subbuffer_alloc.c. Confirms the field-LHS gate in
* apply_assignment did NOT over-suppress: a plain local-to-local
* assignment (no field on the LHS) must still flag the leak when the
* resource never reaches a release call or out-parameter.
*
* Pattern: malloc → local alias copy → no free, no return.
*/
#include <stdlib.h>
#include <string.h>
void leaky_helper(size_t n) {
char *buf = malloc(n);
if (!buf)
return;
char *cursor = buf; /* alias copy — both still local handles */
memset(cursor, 0, n);
/* deliberately no free(buf) and no out-param transfer — leak */
}

34
tests/benchmark/corpus/go/auth/vuln_apicontext_findbyid.go Normal file
View file

@ -0,0 +1,34 @@
package main
// Real-repo precision (2026-05-03): recall guard for the 2026-05-03
// type-aware Go param filter.
//
// Even after `ctx context.Context` is dropped from `unit.params`, an
// id-shaped param (`id string`) keeps the unit on the hook ─
// `is_external_input_param_name` recognises id-shapes ahead of the
// framework-name allow-list. This fixture asserts that the type-aware
// filter doesn't over-suppress: a helper that takes the canonical
// `(ctx, id)` shape and consumes `id` at a bare-receiver data-layer
// sink must still fire `go.auth.missing_ownership_check`.
import "context"
type Repo struct{}
func (r *Repo) Find(id string) interface{} { return nil }
func (r *Repo) Save(id string, val string) {}
// `ctx context.Context` is dropped by the type-aware Go param filter
// (stdlib non-user-input). `id string` survives ─ id-shape opens the
// gate. `repo.Find(id)` is a bare-identifier read indicator with no
// preceding ownership check. Rule must fire.
func GetByID(ctx context.Context, repo *Repo, id string) interface{} {
_ = ctx
return repo.Find(id)
}
// Mutation counterpart.
func UpdateByID(ctx context.Context, repo *Repo, id string, val string) {
_ = ctx
repo.Save(id, val)
}

62
tests/benchmark/corpus/go/safe/safe_ctx_context_helper.go Normal file
View file

@ -0,0 +1,62 @@
package main
// Real-repo precision (2026-05-03): distilled from
// /Users/elipeter/oss/gitea/services/packages/packages.go::AddFileToExistingPackage
// and ~1900 sibling helpers across gitea, hugo, minio, harbor.
//
// Pattern: a backend service helper takes the canonical Go first-param
// `ctx context.Context` (stdlib cancellation / deadline / value-bag,
// NOT an HTTP request) and an internally-typed payload struct. The
// helper itself is not a route handler ─ routes live one layer up
// where `ctx *context.APIContext` (gitea-specific) carries the
// request. Without the type-aware Go param filter, the bare param
// name `ctx` matched the framework-request-name allow-list in
// `is_external_input_param_name`, opening
// `unit_has_user_input_evidence` on every helper and firing
// `go.auth.missing_ownership_check` on every internal id-shaped sink.
//
// Engine fix (2026-05-03): two-layer Go narrowing.
// * Layer 1 (structural, src/auth_analysis/extract/common.rs):
// `parameter_declaration` arm drops the entire param when its
// type is the stdlib `context.Context` / `context.CancelFunc`.
// Type-segment idents (e.g. `PackageInfo` from `*PackageInfo`)
// are also no longer leaked.
// * Layer 2 (classifier, src/auth_analysis/checks.rs):
// `is_external_input_param_name_for_lang` narrows Go's allow-list
// to `req` / `request` only ─ Go has no framework convention that
// uses the generic typed-extractor names from JS/TS/Python.
import (
"context"
"errors"
)
type PackageInfo struct{ ID int64 }
// `AddFileToExistingPackage` is a backend helper, never reachable
// directly from the network. Its only "user-input evidence" was the
// stdlib `ctx context.Context` ─ a cancellation primitive. The
// type-aware filter drops the param.
func AddFileToExistingPackage(ctx context.Context, info *PackageInfo) (*PackageInfo, error) {
if info == nil {
return nil, errors.New("nil")
}
return getByID(ctx, info.ID)
}
// `getByID` is invoked with `info.ID` from the caller. Both params
// are dropped at the type-aware filter (`ctx context.Context`) or
// surface only as a numeric type whose name doesn't trip the gate.
func getByID(ctx context.Context, id int64) (*PackageInfo, error) {
_ = ctx
return &PackageInfo{ID: id}, nil
}
// CLI command shape used by gitea/cmd: `ctx context.Context` plus a
// urfave/cli command argument. Pure admin entry-point, no HTTP path.
type cliCommand struct{}
func runRepoSyncReleases(ctx context.Context, _ *cliCommand) error {
_ = ctx
return nil
}

22
tests/benchmark/corpus/go/safe/safe_sqli_for_range_allowlist.go Normal file
View file

@ -0,0 +1,22 @@
// Synthetic safe counterpart to sqli_for_range.go.
// Same for-range shape, but the loop binding is gated through an allowlist
// before reaching the sink, and the sink uses goqu.I (typed identifier
// constructor) rather than goqu.L (raw SQL literal).
package main
import (
"github.com/doug-martin/goqu/v9"
"net/http"
)
var allowedColumns = map[string]bool{"id": true, "name": true}
func safeHandler(r *http.Request, db *goqu.SelectDataset) {
cols := r.URL.Query()["col"]
for _, p := range cols {
if !allowedColumns[p] {
continue
}
_ = goqu.I(p)
}
}

19
tests/benchmark/corpus/go/sqli/sqli_for_range.go Normal file
View file

@ -0,0 +1,19 @@
// Synthetic regression fixture for the Go for-range taint propagation fix.
// Pins: a tainted iterable in `for _, p := range x` taints the loop binding `p`,
// so a SQL_QUERY sink reading `p` fires. The structural invariant is in
// `src/cfg/literals.rs::def_use` Kind::For arm — Go's `range_clause` child
// is consulted when direct `left`/`right` fields are absent.
// Original gap surfaced via CVE-2026-41422 (daptin) goqu.L injection.
package main
import (
"github.com/doug-martin/goqu/v9"
"net/http"
)
func handler(r *http.Request, db *goqu.SelectDataset) {
cols := r.URL.Query()["col"]
for _, p := range cols {
_ = goqu.L(p)
}
}

45
tests/benchmark/corpus/java/safe/safe_statement_execute_pattern_validated.java Normal file
View file

@ -0,0 +1,45 @@
// Regression guard for GHSA-h8cj-hpmg-636v patched-form recognition:
// the Java `Pattern.matcher(value).matches()` chain is recognised as a
// regex allowlist validator (in `src/taint/path_state.rs`), AND the
// short-circuit cond chain (`x == null || x.isBlank() || !p.matcher(x).matches()`)
// preserves the validation through the implicit-return path so the
// helper-summary `validated_params_to_return` lift suppresses the
// downstream `Statement.execute(query)` SQL_QUERY sink.
//
// Pins that the patched form does NOT fire `taint-unsanitised-flow`.
import java.sql.Connection;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.regex.Pattern;
import javax.servlet.http.HttpServletRequest;
class FilterServicePatched {
private static final Pattern FILTER_TEMP_TABLE_NAME_PATTERN = Pattern.compile("^tbl_[A-Z]{16}$");
private Connection connection;
public void drop(HttpServletRequest req) {
String tableName = req.getParameter("tableName");
dropTable(tableName);
}
public void dropTable(String tableName) {
validateFilterTempTableName(tableName);
String dropTableQuery = "DROP TABLE " + tableName + ";";
executeDbQuery(dropTableQuery);
}
private static void validateFilterTempTableName(String tableName) {
if (tableName == null || tableName.isBlank()
|| !FILTER_TEMP_TABLE_NAME_PATTERN.matcher(tableName).matches()) {
throw new IllegalArgumentException("Invalid filter temporary table name");
}
}
private void executeDbQuery(String query) {
try (Statement statement = connection.createStatement()) {
statement.execute(query);
} catch (SQLException e) {
throw new RuntimeException(e.getMessage());
}
}
}

41
tests/benchmark/corpus/java/sqli/sqli_statement_execute_chained.java Normal file
View file

@ -0,0 +1,41 @@
// Regression guard for GHSA-h8cj-hpmg-636v engine fixes:
// 1. createStatement → DatabaseConnection in Java constructor_type
// (`src/ssa/type_facts.rs`).
// 2. DatabaseConnection.execute as SQL_QUERY sink in Java labels
// (`src/labels/java.rs`).
// 3. Helper-summary type-facts threading through extract_ssa_func_summary
// (`src/taint/ssa_transfer/summary_extract.rs`).
// 4. push_condition_node populating taint.uses so short-circuit cond
// branches intern their condition variables for branch narrowing
// (`src/cfg/conditions.rs`).
//
// Pins that an Appsmith-style SQLi via `Statement.execute(query)` through
// a cross-function helper detects. Same flow shape as the real CVE
// fixture but reduced to one file with no patched/safe sibling — the
// safe counterpart lives at safe_statement_execute_pattern_validated.java.
import java.sql.Connection;
import java.sql.SQLException;
import java.sql.Statement;
import javax.servlet.http.HttpServletRequest;
class FilterServiceVulnerable {
private Connection connection;
public void drop(HttpServletRequest req) {
String tableName = req.getParameter("tableName");
dropTable(tableName);
}
public void dropTable(String tableName) {
String dropTableQuery = "DROP TABLE " + tableName + ";";
executeDbQuery(dropTableQuery);
}
private void executeDbQuery(String query) {
try (Statement statement = connection.createStatement()) {
statement.execute(query);
} catch (SQLException e) {
throw new RuntimeException(e.getMessage());
}
}
}

24
tests/benchmark/corpus/javascript/safe/safe_jest_test_callback_no_handler.js Normal file
View file

@ -0,0 +1,24 @@
// JS counterpart of ts-safe-022.
const { server } = require("./harness");
const { buildUser, buildTeam } = require("./factories");
describe("#comments.list", () => {
it("should require auth", async () => {
const res = await server.post("/api/comments.list");
const body = await res.json();
expect(res.status).toEqual(401);
});
it("should list comments", async () => {
const team = await buildTeam();
const user = await buildUser({ teamId: team.id });
const res = await server.post("/api/comments.list", {
body: {
token: user.getJwtToken(),
id: user.id,
},
});
const body = await res.json();
expect(res.status).toEqual(200);
});
});

35
tests/benchmark/corpus/ruby/safe/safe_rails_callback_helper_no_private.rb Normal file
View file

@ -0,0 +1,35 @@
# Real-repo precision fixture — sister of
# `safe_rails_private_callback_helper.rb`. Some Rails controllers
# (and many older codebases) name `set_X` / `find_X` helpers WITHOUT
# the canonical `private` directive. The helpers are still invoked
# only as `before_action` callbacks, never as routes — Rails will
# happily dispatch to a "public" method shaped like an action, but a
# method named in `before_action :name` is a callback target by
# convention.
#
# Pre-fix: the helper showed up as a RouteHandler with
# `Account.find(params[:id])` flagged as missing ownership.
# Post-fix: callback-target name suppression skips the helper unit
# even when no `private` directive is present.
class WidgetsController < ApplicationController
before_action :authenticate_user!
before_action :set_widget, only: [:show, :update]
def show
authorize @widget, :show?
render json: @widget
end
def update
authorize @widget, :update?
@widget.update!(widget_params)
end
def set_widget
@widget = Widget.find(params[:id])
end
def widget_params
params.require(:widget).permit(:title, :body)
end
end

44
tests/benchmark/corpus/ruby/safe/safe_rails_private_callback_helper.rb Normal file
View file

@ -0,0 +1,44 @@
# Real-repo precision fixture distilled from
# mastodon/app/controllers/admin/accounts_controller.rb#set_account
# (and 100+ sibling controllers). Rails canonical pattern: the
# controller registers a `before_action :set_X` whose target is a
# private helper that does the row-fetch. Per-record authorization
# (e.g. `authorize @account, :show?`) lives in the public action that
# triggers the callback, not in the callback itself.
#
# Pre-fix: `set_account` was emitted as a RouteHandler unit and
# `Account.find(params[:id])` was flagged as missing ownership.
# Post-fix: the Rails extractor skips private methods AND methods
# named in `before_action`/`after_action` directives, so no unit is
# created for the helper. The public action `show` carries the
# authorize check and is itself a route, but its body has no
# sensitive read operation, so no auth-rule finding is produced.
class AccountsController < ApplicationController
before_action :authenticate_user!
before_action :set_account, only: [:show, :update, :destroy]
def show
authorize @account, :show?
render json: @account
end
def update
authorize @account, :update?
@account.update!(account_params)
end
def destroy
authorize @account, :destroy?
@account.destroy!
end
private
def set_account
@account = Account.find(params[:id])
end
def account_params
params.require(:account).permit(:display_name, :note)
end
end

25
tests/benchmark/corpus/rust/safe/safe_format_string_sanitized.rs Normal file
View file

@ -0,0 +1,25 @@
use std::env;
use std::process::Command;
fn sanitize_shell(raw: &str) -> Option<String> {
if raw.chars().any(|c| matches!(c, ';' | '|' | '&' | '$' | '`')) {
None
} else {
Some(raw.to_string())
}
}
fn main() {
let raw = env::var("ARG").unwrap();
let safe = match sanitize_shell(&raw) {
Some(s) => s,
None => return,
};
// Named-arg format: `{safe}` reads `safe`, but the value has been
// routed through sanitize_shell so the shell-escape sink should
// not fire. Regression guard for the format-string named-arg
// lifting fix: once {safe} is recognised as an arg, the sanitiser
// chain still has to suppress the resulting flow.
let cmd = format!("echo {safe}");
Command::new("sh").arg("-c").arg(&cmd).status().unwrap();
}

20
tests/benchmark/corpus/rust/safe/safe_parsed_uid_path.rs Normal file
View file

@ -0,0 +1,20 @@
use std::env;
use std::fs::File;
use std::io;
use std::path::PathBuf;
fn open_for_user(user: u32) -> io::Result<File> {
let mut path = PathBuf::from("/var/run/sudo-rs/ts");
path.push(user.to_string());
File::open(&path)
}
fn main() -> io::Result<()> {
let user = env::var("USER").unwrap();
let uid: u32 = match user.parse() {
Ok(n) => n,
Err(_) => return Ok(()),
};
let _ = open_for_user(uid)?;
Ok(())
}

26
tests/benchmark/corpus/rust/sqli/sqli_format_named_arg.rs Normal file
View file

@ -0,0 +1,26 @@
use std::env;
mod rusqlite {
pub struct Connection;
pub struct PreparedStmt;
impl Connection {
pub fn open(_path: &str) -> Result<Connection, String> {
Ok(Connection)
}
pub fn prepare(&self, _sql: &str) -> Result<PreparedStmt, String> {
Ok(PreparedStmt)
}
}
}
fn main() -> Result<(), String> {
let user = env::var("USERNAME").unwrap();
let conn = rusqlite::Connection::open("app.db").unwrap();
// Rust 1.58+ named-arg capture: `{user}` reads the local
// tainted variable directly. Without format-string-named-arg
// lifting, taint would stop at the macro boundary and miss the
// SQL injection. Regression guard for that engine fix.
let query = format!("SELECT * FROM accounts WHERE name = '{user}'");
conn.prepare(&query)?;
Ok(())
}

45
tests/benchmark/corpus/typescript/safe/safe_jest_test_callback_no_handler.ts Normal file
View file

@ -0,0 +1,45 @@
// FP-guard regression for the jest-test-callback shape that 934'd outline:
// nested arrow callbacks (`it("...", async () => { const body = ... })`)
// passed to `it()` / `describe()` capture free vars (`body`, `userId`,
// `server`). Those free vars bubble up to the OUTER arrow's body as
// `taint.uses` of the `it(...)` call and become synthetic `Param`s in the
// SSA for the outer arrow. Before the fix, the auto-seed pass treated
// every `Param` whose `var_name` matched a handler-name like `userId` /
// `cmd` as a real formal param of the outer arrow and seeded it as a
// `Source(UserInput)`, producing phantom `taint-unsanitised-flow`
// findings at every sink reachable from the outer arrow's body (e.g.
// `server.post`, `res.json`).
//
// The fix makes `lower_to_ssa_with_params` (the per-function lowering)
// always treat externals not in the supplied `formal_params` as
// synthetic / closure-captured, even when the formal list is empty
// (arrow `() => {…}`). See `src/ssa/lower.rs::lower_to_ssa_inner`
// `with_params` flag.
declare const server: { post: (url: string, body?: any) => Promise<any> };
declare function describe(name: string, fn: () => void): void;
declare function it(name: string, fn: () => Promise<void>): void;
declare function expect(x: any): any;
declare function buildTeam(): Promise<any>;
declare function buildUser(x: any): Promise<any>;
describe("#comments.list", () => {
it("should require auth", async () => {
const res = await server.post("/api/comments.list");
const body = await res.json();
expect(res.status).toEqual(401);
});
it("should list comments", async () => {
const team = await buildTeam();
const user = await buildUser({ teamId: team.id });
const res = await server.post("/api/comments.list", {
body: {
token: user.getJwtToken(),
id: user.id,
},
});
const body = await res.json();
expect(res.status).toEqual(200);
});
});

9
tests/benchmark/corpus/typescript/sqli/sqli_arrow_handler_param.ts Normal file
View file

@ -0,0 +1,9 @@
// Counterpart to ts-safe-022: an arrow with a REAL handler param named
// `userId` MUST still auto-seed and trigger taint flow into the sink.
// Pins the auto-seed positive path so the FP fix does not over-suppress.
declare const db: { exec: (sql: string) => any };
export const lookupUser = (userId: string) => {
return db.exec(`SELECT * FROM users WHERE id = '${userId}'`);
};

61
tests/benchmark/cve_corpus/go/CVE-2026-41422/patched.go Normal file
View file

@ -0,0 +1,61 @@
// Nyx CVE benchmark fixture.
// CVE: CVE-2026-41422
// GHSA: GHSA-rw2c-8rfq-gwfv
// Project: daptin (daptin/daptin)
// License: LGPL-3.0
// Advisory: https://github.com/daptin/daptin/security/advisories/GHSA-rw2c-8rfq-gwfv
// Patched: 7212c3a — server/resource/resource_aggregate.go:112-373 (parseAggExpr)
//
// Patched-fix simplification: upstream replaced `goqu.L(project)` with a
// 260-line `parseAggExpr` that performs structural expression parsing,
// schema-based column validation, and aggregate-function allowlist lookup.
// We inline the allowlist + safe-constructor structure verbatim from
// upstream's `aggregateFuncs` map (line 117-127) and `parseAggExpr`
// allowlist branch (line 230-244), and drop `goqu.L` entirely in favor of
// `goqu.I` (typed identifier) and the typed `goqu.COUNT/SUM/...` builders.
// The user-controlled value is gated through map-key lookup: any input that
// isn't a documented aggregate function or known column name is rejected.
//
// Trims: same scaffold as vulnerable; the parsing of `funcname(col)` is
// left out (only the allowlisted bare-column / aggregate path retained).
package main
import (
"github.com/doug-martin/goqu/v9"
"github.com/doug-martin/goqu/v9/exp"
"github.com/gin-gonic/gin"
)
// aggregateFuncs maps aggregate function names to their safe goqu typed constructors.
// Exact map key lookup — no pattern matching.
var aggregateFuncs = map[string]func(interface{}) exp.SQLFunctionExpression{
"count": func(col interface{}) exp.SQLFunctionExpression { return goqu.COUNT(col) },
"sum": func(col interface{}) exp.SQLFunctionExpression { return goqu.SUM(col) },
"min": func(col interface{}) exp.SQLFunctionExpression { return goqu.MIN(col) },
"max": func(col interface{}) exp.SQLFunctionExpression { return goqu.MAX(col) },
"avg": func(col interface{}) exp.SQLFunctionExpression { return goqu.AVG(col) },
}
var allowedColumns = map[string]bool{
"id": true, "name": true, "email": true, "created_at": true,
}
func aggregateHandler(c *gin.Context) {
projections := c.QueryArray("column")
projectionsAdded := make([]interface{}, 0)
for _, project := range projections {
if fn, ok := aggregateFuncs[project]; ok {
projectionsAdded = append(projectionsAdded, fn(goqu.Star()))
continue
}
if !allowedColumns[project] {
c.AbortWithStatus(400)
return
}
projectionsAdded = append(projectionsAdded, goqu.I(project))
}
_ = projectionsAdded
}

56
tests/benchmark/cve_corpus/go/CVE-2026-41422/vulnerable.go Normal file
View file

@ -0,0 +1,56 @@
// Nyx CVE benchmark fixture.
// CVE: CVE-2026-41422
// GHSA: GHSA-rw2c-8rfq-gwfv
// Project: daptin (daptin/daptin)
// License: LGPL-3.0
// Advisory: https://github.com/daptin/daptin/security/advisories/GHSA-rw2c-8rfq-gwfv
// Vulnerable: 5d8e5fb (parent of fix) — server/jsmodel_handler.go:101 +
// server/resource/resource_aggregate.go:132-151
//
// SQL injection: HTTP `column` query parameter is read with
// `c.QueryArray("column")` and looped into `goqu.L(project)`, which inserts
// raw SQL literals into the generated query (no parameterization).
// `goqu.L(...)` is a raw SQL literal expression builder — any user-controlled
// argument allows arbitrary SELECT subqueries.
//
// Trims: handler permission check (lines 77-82), POST/Bind branch (lines 85-92),
// transaction setup (lines 65-75), filter parsing (lines 167-200+), join
// processing, and the rest of resource_aggregate.go (170+ lines below
// line 151). Only the source statement and the loop-into-`goqu.L` sink
// are kept verbatim.
package main
import (
"strings"
"github.com/doug-martin/goqu/v9"
"github.com/gin-gonic/gin"
)
func aggregateHandler(c *gin.Context) {
projections := c.QueryArray("column")
requestedGroupBys := c.QueryArray("group")
projectionsAdded := make([]interface{}, 0)
for i, project := range projections {
if project == "count" {
projections[i] = "count(*) as count"
projectionsAdded = append(projectionsAdded, goqu.L("count(*)").As("count"))
} else {
if strings.Index(project, " as ") > -1 {
parts := strings.Split(project, " as ")
projectionsAdded = append(projectionsAdded, goqu.L(parts[0]).As(parts[1]))
} else {
projectionsAdded = append(projectionsAdded, goqu.L(project))
}
}
}
for _, group := range requestedGroupBys {
projectionsAdded = append(projectionsAdded, goqu.L(group))
}
_ = projectionsAdded
}

81
tests/benchmark/cve_corpus/java/GHSA-h8cj-hpmg-636v/patched.java Normal file
View file

@ -0,0 +1,81 @@
// Nyx CVE benchmark fixture (patched).
// CVE: GHSA-h8cj-hpmg-636v
// Project: appsmith (appsmithorg/appsmith)
// License: Apache-2.0
// Advisory: https://github.com/advisories/GHSA-h8cj-hpmg-636v
// Patched: c8023ba4b3b54204ff3309c9e5c33664ad15ba32
// app/server/appsmith-interfaces/src/main/java/com/appsmith/external/services/ce/FilterDataServiceCE.java:60-65,632-647
//
// Patched dropTable() now calls validateFilterTempTableName(tableName)
// before constructing the SQL string. The validator rejects any input
// that does not match `^tbl_[A-Z]{16}$`, the exact shape produced by
// FilterDataServiceCE.generateTable() (`tbl_` + 16 random uppercase
// alphabetics). Anything caller-supplied that is not a real generated
// table name throws and SQL never runs.
//
// Trims:
// - same as vulnerable.java (imports / generateTable scaffolding /
// connection-cache helpers).
// - AppsmithPluginException replaced with java.lang.IllegalArgumentException
// to keep the fixture self-contained; the upstream throw still rejects
// the request before it can reach SQL.
// - StringUtils.isBlank() inlined as `tableName == null || tableName.isBlank()`
// to keep the regex-allowlist as the load-bearing sanitiser without
// pulling in commons-lang3.
//
// Patched-fix simplification: the entry-point Servlet controller and
// the dropTable + executeDbQuery code are kept verbatim from the
// surrounding upstream context; the validator + Pattern.compile are
// copied byte-for-byte from the patched commit.
package com.appsmith.external.services.ce;
import java.sql.Connection;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.regex.Pattern;
import javax.servlet.http.HttpServletRequest;
class FilterController {
private final FilterDataServiceCE service = new FilterDataServiceCE();
public void drop(HttpServletRequest req) {
String tableName = req.getParameter("tableName");
service.dropTable(tableName);
}
}
class FilterDataServiceCE {
/**
* Names produced by {@link #generateTable(Map)}: {@code tbl_} plus 16 alphabetic characters (see
* {@link RandomStringUtils#randomAlphabetic(int)} + uppercase). Used to reject untrusted input in dynamic SQL.
*/
private static final Pattern FILTER_TEMP_TABLE_NAME_PATTERN = Pattern.compile("^tbl_[A-Z]{16}$");
public void dropTable(String tableName) {
validateFilterTempTableName(tableName);
String dropTableQuery = "DROP TABLE " + tableName + ";";
executeDbQuery(dropTableQuery);
}
private static void validateFilterTempTableName(String tableName) {
if (tableName == null || tableName.isBlank()
|| !FILTER_TEMP_TABLE_NAME_PATTERN.matcher(tableName).matches()) {
throw new IllegalArgumentException("Invalid filter temporary table name");
}
}
/** Long-lived field; upstream caches the H2 connection across calls. */
private Connection connection;
private void executeDbQuery(String query) {
try (Statement statement = connection.createStatement()) {
statement.execute(query);
} catch (SQLException e) {
throw new RuntimeException(e.getMessage());
}
}
}

67
tests/benchmark/cve_corpus/java/GHSA-h8cj-hpmg-636v/vulnerable.java Normal file
View file

@ -0,0 +1,67 @@
// Nyx CVE benchmark fixture.
// CVE: GHSA-h8cj-hpmg-636v
// Project: appsmith (appsmithorg/appsmith)
// License: Apache-2.0
// Advisory: https://github.com/advisories/GHSA-h8cj-hpmg-636v
// Vulnerable: b142de499faa31b8391bc8dba40daa9519ebac1e
// app/server/appsmith-interfaces/src/main/java/com/appsmith/external/services/ce/FilterDataServiceCE.java:509-519,625-630
//
// FilterDataServiceCE exposes dropTable(String) which concatenates the
// caller-supplied table name into a "DROP TABLE …;" statement and runs
// it on the in-memory H2 connection via Statement.execute. The advisory
// confirms a reachable code path passes user input through to this
// helper, giving an attacker primary SQL injection on the H2 filter db.
//
// Trims:
// - imports for AppsmithPlugin / Jackson / commons-lang3 / log4j /
// SerializationUtils that the dropTable + executeDbQuery slice does
// not touch (lines 1-40 of upstream).
// - the ~900 lines of generateTable / generateSchema / generateLogicalQuery
// / insertReadyData / select-result helpers around the dropTable site,
// none of which the attacker reaches.
// - the H2 connection-cache and DriverManager.getConnection setup; the
// fixture stubs checkAndGetConnection() since the SQLi is in the call
// to Statement.execute and not the connection bootstrap.
// - the actual REST controller that reaches dropTable() lives in a
// separate file in upstream and routes through several plugin layers.
// The fixture stands in a minimal Servlet-style entry point
// (HttpServletRequest.getParameter) to model the user-input source;
// the load-bearing dropTable + executeDbQuery code below is verbatim
// from upstream.
package com.appsmith.external.services.ce;
import java.sql.Connection;
import java.sql.SQLException;
import java.sql.Statement;
import javax.servlet.http.HttpServletRequest;
class FilterController {
private final FilterDataServiceCE service = new FilterDataServiceCE();
public void drop(HttpServletRequest req) {
String tableName = req.getParameter("tableName");
service.dropTable(tableName);
}
}
class FilterDataServiceCE {
/** Long-lived field; upstream caches the H2 connection across calls. */
private Connection connection;
public void dropTable(String tableName) {
String dropTableQuery = "DROP TABLE " + tableName + ";";
executeDbQuery(dropTableQuery);
}
private void executeDbQuery(String query) {
try (Statement statement = connection.createStatement()) {
statement.execute(query);
} catch (SQLException e) {
throw new RuntimeException(e.getMessage());
}
}
}

41
tests/benchmark/cve_corpus/rust/CVE-2023-42456/patched.rs Normal file
View file

@ -0,0 +1,41 @@
// Nyx CVE benchmark fixture (patched counterpart).
//
// CVE: CVE-2023-42456
// Advisory: https://rustsec.org/advisories/RUSTSEC-2023-0069.html
// Project: sudo-rs, fix in 0.2.1
// License: Apache-2.0
// Patched: bfdbda22968e3de43fa8246cab1681cfd5d5493d src/system/timestamp.rs:46-51
//
// Patched variant: open_for_user now takes the numeric uid (UserId)
// instead of the &str username, and pushes uid.to_string() onto the
// session-directory path. Because UserId is u32, the resulting
// component is purely decimal digits and cannot contain `..` or `/`.
// Mirrors the upstream fix in 0.2.1 (path.push(user.to_string())).
use std::env;
use std::fs::File;
use std::io;
use std::path::PathBuf;
const BASE_PATH: &str = "/var/run/sudo-rs/ts";
type UserId = u32;
fn open_for_user(user: UserId) -> io::Result<File> {
let mut path = PathBuf::from(BASE_PATH);
path.push(user.to_string());
File::open(&path)
}
fn main() -> io::Result<()> {
let user = env::var("USER").unwrap();
// Patched: parse the username to a numeric uid before letting it
// anywhere near the session-directory PathBuf. A non-numeric
// username is rejected outright, so traversal characters never
// reach path.push.
let uid: UserId = match user.parse() {
Ok(n) => n,
Err(_) => return Ok(()),
};
let _ = open_for_user(uid)?;
Ok(())
}

45
tests/benchmark/cve_corpus/rust/CVE-2023-42456/vulnerable.rs Normal file
View file

@ -0,0 +1,45 @@
// Nyx CVE benchmark fixture.
//
// CVE: CVE-2023-42456
// Advisory: https://rustsec.org/advisories/RUSTSEC-2023-0069.html
// GHSA: GHSA-2r3c-m6v7-9354
// Project: sudo-rs (trifectatechfoundation/sudo-rs)
// License: Apache-2.0
// Vulnerable: 90984061fdb58a3139bcf3bfc9e50119a8b2fb57 src/system/timestamp.rs:46-50
//
// sudo-rs <= 0.2.0 stored per-user session records under
// /var/run/sudo-rs/ts/<username>. Usernames in /etc/passwd are not
// validated for path-separator or `.` characters, so a local attacker
// who can create a user named `../../bin/cp` and run `sudo -K` made
// SessionRecordFile::open_for_user concatenate the username into the
// session-directory path and corrupt files anywhere the sudo process
// can write. Fixed in 0.2.1 by switching the lookup key from username
// to numeric uid.
//
// Trims: SessionRecordFile struct fields, FILE_VERSION/MAGIC_NUM
// constants, the rest of the impl methods, secure_open_cookie_file
// helper. The load-bearing block (open_for_user signature, BASE_PATH
// PathBuf, path.push(user), File::open as the sink) is verbatim apart
// from secure_open_cookie_file -> File::open and the Self type
// abbreviation.
use std::env;
use std::fs::File;
use std::io;
use std::path::PathBuf;
const BASE_PATH: &str = "/var/run/sudo-rs/ts";
fn open_for_user(user: &str) -> io::Result<File> {
let mut path = PathBuf::from(BASE_PATH);
path.push(user);
File::open(&path)
}
fn main() -> io::Result<()> {
// Source: the current OS username, as sudo-rs reads it via
// resolve_current_user(). Modelled here as env::var so the
// single-file benchmark harness sees the flow.
let user = env::var("USER").unwrap();
let _ = open_for_user(&user)?;
Ok(())
}

85
tests/benchmark/cve_corpus/rust/CVE-2024-32884/patched.rs Normal file
View file

@ -0,0 +1,85 @@
// Nyx CVE benchmark fixture (patched counterpart).
//
// CVE: CVE-2024-32884
// Advisory: https://rustsec.org/advisories/RUSTSEC-2024-0335.html
// Project: gitoxide, fix in gix-transport 0.42.0 / gix 0.62.0
// License: Apache-2.0 OR MIT
// Patched: c53bbd265005c7eedc316205b217e137e2b9896e
// gix-transport/src/client/blocking_io/ssh/program_kind.rs:53-78
// gix-url/src/lib.rs:131-186
//
// Patched variant: the host (and the user component, when present)
// is filtered through a sanitize_shell helper that mirrors the
// upstream Url::host_argument_safe semantics — it rejects any value
// whose first byte is `-`, so an attacker cannot smuggle an option
// flag (`-Fattackerconfig`, `-E…`) into the ssh argv.
//
// Patched-fix simplification: upstream leaves the user@host branch
// unchanged on the assumption that the URL parser already encodes
// argument-relevant characters in usernames. The fixture applies
// the same first-byte guard to BOTH branches because the load-bearing
// security pattern Nyx must recognise is "no host or user component
// reaches argv unless its first byte is provably not `-`". The
// stricter form just makes the regression guard tight. Sanitizer
// helper named `sanitize_shell` so it matches Nyx's existing
// SHELL_ESCAPE sanitizer rule (the `sanitize_shell` prefix).
use std::env;
use std::process::Command;
mod gix_url {
pub struct Url {
pub host: Option<String>,
pub user: Option<String>,
}
impl Url {
pub fn parse(raw: &str) -> Option<Url> {
let after = raw.strip_prefix("ssh://")?;
let (user_host, _) = after.split_once('/').unwrap_or((after, ""));
let (user, host) = match user_host.split_once('@') {
Some((u, h)) => (Some(u.to_string()), h.to_string()),
None => (None, user_host.to_string()),
};
Some(Url { host: Some(host), user })
}
pub fn host(&self) -> Option<&str> {
self.host.as_deref()
}
pub fn user(&self) -> Option<&str> {
self.user.as_deref()
}
}
}
/// Mirrors gix-url's host_argument_safe / path_argument_safe: any
/// component whose first byte is `-` is rejected before it can reach
/// ssh's argv.
fn sanitize_shell(raw: &str) -> Option<String> {
if raw.is_empty() || raw.starts_with('-') {
None
} else {
Some(raw.to_string())
}
}
fn main() -> std::io::Result<()> {
let raw = env::var("GIT_REMOTE_URL").unwrap();
let url = gix_url::Url::parse(&raw).unwrap();
let raw_host = url.host().expect("present in ssh urls");
let host = match sanitize_shell(raw_host) {
Some(h) => h,
None => return Ok(()),
};
let host_as_ssh_arg: String = match url.user() {
Some(raw_user) => {
let user = match sanitize_shell(raw_user) {
Some(u) => u,
None => return Ok(()),
};
format!("{user}@{host}")
}
None => host,
};
Command::new("ssh").arg(&host_as_ssh_arg).output().map(|_| ())
}

78
tests/benchmark/cve_corpus/rust/CVE-2024-32884/vulnerable.rs Normal file
View file

@ -0,0 +1,78 @@
// Nyx CVE benchmark fixture.
//
// CVE: CVE-2024-32884
// Advisory: https://rustsec.org/advisories/RUSTSEC-2024-0335.html
// GHSA: GHSA-98p4-xjmm-8mfh
// Project: gitoxide (GitoxideLabs/gitoxide)
// License: Apache-2.0 OR MIT
// Vulnerable: 7d6df7793a8a0fe26a7eccb8c01f1a4a3081c93f
// gix-transport/src/client/blocking_io/ssh/program_kind.rs:31-66
//
// gix-transport < 0.42.0 (and gix < 0.62.0) built the ssh-program
// invocation by calling `format!("{user}@{host}")` (or `host.into()`
// when no user was set) and passing the result as a positional
// argument to `Command::new("ssh").arg(...)`. URLs allow hosts and
// usernames that begin with `-`, so a malicious clone URL like
// `ssh://-Fattackerconfig@host/path` smuggled `-F attackerconfig`
// onto the ssh CLI, letting the attacker swap in an arbitrary ssh
// config (and therefore arbitrary ProxyCommand). Fixed in 0.42.0 by
// routing host through host_argument_safe(), which rejects values
// starting with `-`.
//
// Trims: ProgramKind enum + Ssh/Simple/Other branches, dispatch on
// desired_version, ssh_cmd Vec<String> assembly, prepare/CommandPrep
// builder, the protocol-version handling and the `-o`/`-G` plumbing.
// The ProgramKind::prepare_invocation method body is inlined into
// main so the cross-function summary (ssh_invoke param 0 → SHELL_ESCAPE
// sink) doesn't get in the way of the load-bearing pattern. The
// verbatim load-bearing block (url.host().expect, the
// format!("{user}@{host}") fallback that flows the unsanitised host
// into the ssh argv, and the Command::new("ssh").arg sink) is
// preserved character-for-character.
use std::env;
use std::process::Command;
mod gix_url {
pub struct Url {
pub host: Option<String>,
pub user: Option<String>,
}
impl Url {
pub fn parse(raw: &str) -> Option<Url> {
let after = raw.strip_prefix("ssh://")?;
let (user_host, _) = after.split_once('/').unwrap_or((after, ""));
let (user, host) = match user_host.split_once('@') {
Some((u, h)) => (Some(u.to_string()), h.to_string()),
None => (None, user_host.to_string()),
};
Some(Url { host: Some(host), user })
}
pub fn host(&self) -> Option<&str> {
self.host.as_deref()
}
pub fn user(&self) -> Option<&str> {
self.user.as_deref()
}
}
}
fn main() -> std::io::Result<()> {
// Source: clone URL controlled by the caller, modelled here as
// env::var so the single-file benchmark harness sees the flow.
// In real usage this would arrive via a CLI argument or a
// submodule URL embedded in `.gitmodules`.
let raw = env::var("GIT_REMOTE_URL").unwrap();
let url = gix_url::Url::parse(&raw).unwrap();
let host = url.host().expect("present in ssh urls");
let host_as_ssh_arg = match url.user() {
Some(user) => format!("{user}@{host}"),
None => host.to_owned(),
};
// Sink: host_as_ssh_arg flows directly into ssh's argv. When
// url.host() begins with `-`, ssh treats it as an option (e.g.
// `-Fattackerconfig`), letting the attacker control the ssh
// configuration applied to the connection.
Command::new("ssh").arg(&host_as_ssh_arg).output().map(|_| ())
}

81
tests/benchmark/cve_corpus/rust/CVE-2025-53549/patched.rs Normal file
View file

@ -0,0 +1,81 @@
// Nyx CVE benchmark fixture (patched counterpart).
//
// CVE: CVE-2025-53549
// Advisory: https://rustsec.org/advisories/RUSTSEC-2025-0043.html
// Project: matrix-rust-sdk, fix in matrix-sdk 0.13.0
// License: Apache-2.0
// Patched: d0c01006e4808db5eb96ad5c496416f284d8bd3c
// crates/matrix-sdk-sqlite/src/event_cache_store.rs:1158-1208
//
// Patched variant: the relation-type filters are emitted as bound `?`
// placeholders (one per filter, joined into the IN-list via the
// repeat_vars helper) and passed through params_from_iter to the
// prepared statement. The query string itself contains no
// attacker-controlled bytes.
//
// Patched-fix simplification: upstream chains the bound parameters
// with the literal hashed_linked_chunk_id / event_id / hashed_room_id
// triple via params_from_iter; the fixture binds only the filters
// because the literal triple isn't load-bearing for the taint flow.
// The shape Nyx must recognise — every filter element reaching the
// sink as a bound parameter rather than format!()-spliced bytes — is
// preserved verbatim. Same scaffolding flattening as the vulnerable
// fixture (Connection::open in place of with_transaction; flow inlined
// into main). Upstream computes the IN-list placeholders dynamically
// via repeat_vars(filters.len()); the fixture uses a fixed-arity
// literal "?, ?, ?, ?, ?" so Nyx's coarse string-taint model does not
// see filters.len() flowing into the format-string named-arg position.
// Either form is safe in practice — neither places attacker bytes in
// the SQL — and the load-bearing decision (binding via
// params_from_iter rather than splicing) is unchanged.
use std::env;
mod rusqlite {
pub struct Connection;
pub struct PreparedStmt;
impl Connection {
pub fn open(_path: &str) -> Result<Connection, String> {
Ok(Connection)
}
pub fn prepare(&self, _sql: &str) -> Result<PreparedStmt, String> {
Ok(PreparedStmt)
}
}
impl PreparedStmt {
pub fn query_map<P, F>(&self, _params: P, _f: F) -> Result<(), String>
where
F: Fn(&[u8]),
{
Ok(())
}
}
}
fn compute_filters_string(input: Option<&str>) -> Option<Vec<String>> {
input.map(|s| s.split(',').map(|f| f.to_string()).collect())
}
fn params_from_iter<I: IntoIterator<Item = String>>(it: I) -> Vec<String> {
it.into_iter().collect()
}
fn main() -> Result<(), String> {
let filters: Option<String> = env::var("REL_TYPES").ok();
let conn = rusqlite::Connection::open("events.db").unwrap();
if let Some(filters) = compute_filters_string(filters.as_deref()) {
let query = "SELECT events.content, event_chunks.chunk_id, event_chunks.position
FROM events
LEFT JOIN event_chunks ON events.event_id = event_chunks.event_id AND event_chunks.linked_chunk_id = ?
WHERE relates_to = ? AND room_id = ? AND rel_type IN (?, ?, ?, ?, ?)";
// Patched: filter bytes never reach the SQL string; they're
// bound through params_from_iter to `?` placeholders.
let parameters = params_from_iter(filters.into_iter());
let stmt = conn.prepare(query)?;
stmt.query_map(parameters, |_| ())?;
}
Ok(())
}

85
tests/benchmark/cve_corpus/rust/CVE-2025-53549/vulnerable.rs Normal file
View file

@ -0,0 +1,85 @@
// Nyx CVE benchmark fixture.
//
// CVE: CVE-2025-53549
// Advisory: https://rustsec.org/advisories/RUSTSEC-2025-0043.html
// GHSA: GHSA-275g-g844-73jh
// Project: matrix-rust-sdk (matrix-org/matrix-rust-sdk)
// License: Apache-2.0
// Vulnerable: dc98bf7633534f9b6a668959156b1249ec3c181e
// crates/matrix-sdk-sqlite/src/event_cache_store.rs:1156-1182
//
// matrix-sdk-sqlite 0.11/0.12 SqliteEventCacheStore::find_event_with_
// relations interpolated relation-type filter strings into the WHERE
// clause via format!() with hand-rolled `"f"` quoting. Each filter
// originated from an unauthenticated room member's relation-type list,
// so a peer that controlled the relation type could escape the quote,
// inject arbitrary SQL into the prepared statement, and read or
// corrupt the event cache. Fixed in 0.13.0 by switching to bound
// `?` placeholders + params_from_iter.
//
// Trims: SqliteEventCacheStore impl + acquire/with_transaction wrapper,
// the get_rows/collect_results closures, decode_value/Position/Event
// helpers, the unrelated `else` branch with the safe non-filter query.
//
// Patched-fix simplification: upstream issues prepare on a rusqlite::
// Transaction obtained via conn.with_transaction(); here we flatten to
// Connection::open(...).prepare(...) so DatabaseConnection.prepare sink
// resolution sees the receiver type. The vulnerable flow is inlined
// into `main` rather than carried by a SqliteEventCacheStore method,
// also flattening upstream's `let filter_query = if let Some(...) = ...
// { format!(...) } else { ... }` if-let-as-value into a `let mut x = "";
// if let Some(...) = ... { x = format!(...) }` mut-then-assign because
// Nyx's current SSA lowering doesn't propagate taint through Rust
// if-else expressions used as values. The verbatim load-bearing block
// (the inner format!(r#""{f}""#) per-filter quoting + the join + the
// outer format!("...{filter_query}") + the prepare(&query) sink) is
// preserved character-for-character.
use std::env;
mod rusqlite {
pub struct Connection;
pub struct PreparedStmt;
impl Connection {
pub fn open(_path: &str) -> Result<Connection, String> {
Ok(Connection)
}
pub fn prepare(&self, _sql: &str) -> Result<PreparedStmt, String> {
Ok(PreparedStmt)
}
}
}
fn compute_filters_string(input: Option<&str>) -> Option<Vec<String>> {
input.map(|s| s.split(',').map(|f| f.to_string()).collect())
}
fn main() -> Result<(), String> {
// Source: relation-type filter list controlled by a remote room
// member, modelled here as env::var so the single-file benchmark
// harness sees the flow.
let filters: Option<String> = env::var("REL_TYPES").ok();
let conn = rusqlite::Connection::open("events.db").unwrap();
let mut filter_query: String = "".to_owned();
if let Some(filters) = compute_filters_string(filters.as_deref()) {
filter_query = format!(
" AND rel_type IN ({})",
filters
.into_iter()
.map(|f| format!(r#""{f}""#))
.collect::<Vec<_>>()
.join(", ")
);
}
let query = format!(
"SELECT events.content, event_chunks.chunk_id, event_chunks.position
FROM events
LEFT JOIN event_chunks ON events.event_id = event_chunks.event_id AND event_chunks.linked_chunk_id = ?
WHERE relates_to = ? AND room_id = ? {filter_query}"
);
conn.prepare(&query)?;
Ok(())
}

777
tests/benchmark/ground_truth.json
View file

@ -3,7 +3,7 @@
"metadata": {
"description": "Nyx benchmark ground truth",
"created": "2026-03-20",
"corpus_size": 507
"corpus_size": 533
},
"cases": [
{
@ -1949,6 +1949,72 @@
"disabled": false,
"notes": "SQL injection via string concat in db.QueryRow()"
},
{
"case_id": "go-sqli-004",
"file": "go/sqli/sqli_for_range.go",
"language": "go",
"is_vulnerable": true,
"vuln_class": "sqli",
"cwe": "CWE-89",
"provenance": "synthetic",
"equivalence_tier": "exact",
"match_mode": "rule_match",
"expected_rule_ids": [
"taint-unsanitised-flow"
],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [],
"expected_severity": "MEDIUM",
"expected_category": "Security",
"expected_sink_lines": [
[
17,
17
]
],
"expected_source_lines": [
[
15,
15
]
],
"tags": [
"sqli",
"goqu",
"for-range"
],
"disabled": false,
"notes": "CVE-Hunt session 6 regression guard: Go for-range loop binding inherits taint from iterable; goqu.L(p) is SQL_QUERY sink. Pins src/cfg/literals.rs def_use Kind::For range_clause arm + src/labels/go.rs goqu.L sink."
},
{
"case_id": "go-sqli-safe-001",
"file": "go/safe/safe_sqli_for_range_allowlist.go",
"language": "go",
"is_vulnerable": false,
"vuln_class": "safe",
"cwe": "N/A",
"provenance": "synthetic",
"equivalence_tier": "exact",
"match_mode": "rule_match",
"expected_rule_ids": [],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [
"taint-unsanitised-flow"
],
"expected_severity": null,
"expected_category": "Security",
"expected_sink_lines": [],
"expected_source_lines": [],
"tags": [
"sqli",
"goqu",
"for-range",
"safe",
"negative"
],
"disabled": false,
"notes": "CVE-Hunt session 6 negative pair: same for-range shape as go-sqli-004 but binding is allowlisted before reaching goqu.I (typed identifier, not raw SQL)."
},
{
"case_id": "go-cmdi-001",
"file": "go/cmdi/cmdi_direct.go",
@ -3468,7 +3534,7 @@
"ssrf"
],
"disabled": false,
"notes": "SSRF via OpenURI.open_uri() with user-controlled URL — canonical low-level URI fetcher; CarrierWave / Paperclip / similar gems route SSRF-vulnerable downloads through it"
"notes": "SSRF via OpenURI.open_uri() with user-controlled URL \u2014 canonical low-level URI fetcher; CarrierWave / Paperclip / similar gems route SSRF-vulnerable downloads through it"
},
{
"case_id": "js-ssrf-safe-001",
@ -4124,7 +4190,7 @@
"path-traversal"
],
"disabled": false,
"notes": "Path traversal via cross-fn helper that wraps File.read inside YAML.safe_load (the `outer(File.read(x))` shape used in real Ruby helpers — rswag CVE-2023-38337 chain). Regression guard for the inner-call fallback fix in src/cfg/mod.rs::push_node so a wrapper around an FILE_IO sink continues to surface in summary extraction."
"notes": "Path traversal via cross-fn helper that wraps File.read inside YAML.safe_load (the `outer(File.read(x))` shape used in real Ruby helpers \u2014 rswag CVE-2023-38337 chain). Regression guard for the inner-call fallback fix in src/cfg/mod.rs::push_node so a wrapper around an FILE_IO sink continues to surface in summary extraction."
},
{
"case_id": "ruby-sqli-001",
@ -4505,6 +4571,74 @@
"disabled": false,
"notes": "prepareStatement sanitizes SQL input \u2014 should produce no SQL taint finding"
},
{
"case_id": "java-sqli-stmt-execute-002",
"file": "java/sqli/sqli_statement_execute_chained.java",
"language": "java",
"is_vulnerable": true,
"vuln_class": "sqli",
"cwe": "CWE-89",
"provenance": "synthetic",
"equivalence_tier": "exact",
"match_mode": "rule_match",
"expected_rule_ids": [
"taint-unsanitised-flow"
],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [],
"expected_severity": "HIGH",
"expected_category": "Security",
"expected_sink_lines": [
[
36,
36
]
],
"expected_source_lines": [
[
25,
25
]
],
"tags": [
"statement",
"execute",
"createStatement",
"string-concat",
"ghsa-h8cj"
],
"disabled": false,
"notes": "Regression guard for GHSA-h8cj-hpmg-636v engine fixes: createStatement is typed as DatabaseConnection; Statement.execute(query) resolves as SQL_QUERY sink via DatabaseConnection.execute label; helper-summary type-facts threading carries the sink across the executeDbQuery boundary."
},
{
"case_id": "java-safe-stmt-execute-validated",
"file": "java/safe/safe_statement_execute_pattern_validated.java",
"language": "java",
"is_vulnerable": false,
"vuln_class": "safe",
"cwe": "",
"provenance": "synthetic",
"equivalence_tier": "exact",
"match_mode": "rule_match",
"expected_rule_ids": [],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [
"taint-unsanitised-flow"
],
"expected_severity": null,
"expected_category": null,
"expected_sink_lines": [],
"expected_source_lines": [],
"tags": [
"Pattern",
"matcher",
"matches",
"validator",
"ghsa-h8cj"
],
"disabled": false,
"notes": "Regression guard for GHSA-h8cj-hpmg-636v patched form: Pattern.matcher(value).matches() chain on a PATTERN-named receiver classifies as ValidationCall, short-circuit `||` cond chain preserves validated_must to the implicit return, and helper-summary validated_params_to_return suppresses the SQL_QUERY sink at the caller."
},
{
"case_id": "go-safe-atoi-001",
"file": "go/safe/safe_strconv_atoi.go",
@ -7203,6 +7337,32 @@
"disabled": false,
"notes": "Shell-metachar rejection is not a SQL sanitizer; SQL injection must still fire"
},
{
"case_id": "rs-sqli-format-named-arg",
"file": "rust/sqli/sqli_format_named_arg.rs",
"language": "rust",
"is_vulnerable": true,
"vuln_class": "sqli",
"cwe": "CWE-89",
"provenance": "synthetic",
"equivalence_tier": "exact",
"match_mode": "rule_match",
"expected_rule_ids": [
"taint-unsanitised-flow"
],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [],
"expected_severity": "MEDIUM",
"expected_category": "Security",
"expected_sink_lines": null,
"expected_source_lines": null,
"tags": [
"sqli",
"format-named-arg"
],
"disabled": false,
"notes": "Named-arg `{user}` capture in format!() interpolates env::var into a SQL query without sanitisation. Regression guard for the format-string named-arg lifting fix (CVE-2025-53549 motivated)."
},
{
"case_id": "rs-cmdi-005",
"file": "rust/cmdi/cmdi_format_macro.rs",
@ -7711,6 +7871,55 @@
"disabled": false,
"notes": "Input parsed to u16 before use as Command arg \u2014 type-narrowed"
},
{
"case_id": "rs-safe-fileio-int-uid",
"file": "rust/safe/safe_parsed_uid_path.rs",
"language": "rust",
"is_vulnerable": false,
"vuln_class": "safe",
"cwe": "CWE-22",
"provenance": "synthetic",
"equivalence_tier": "exact",
"match_mode": "rule_match",
"expected_rule_ids": [],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [],
"expected_severity": null,
"expected_category": null,
"expected_sink_lines": null,
"expected_source_lines": null,
"tags": [
"type-parse",
"u32",
"fileio-suppress"
],
"disabled": false,
"notes": "Tainted username parsed to u32 (uid) before use as PathBuf component \u2014 digits cannot contain `..` or `/`, so the FILE_IO sink suppresses on type alone. Regression guard for the type-only FILE_IO suppression and int-producing-callee leaf-stop."
},
{
"case_id": "rs-safe-format-named-arg-sanitized",
"file": "rust/safe/safe_format_string_sanitized.rs",
"language": "rust",
"is_vulnerable": false,
"vuln_class": "safe",
"cwe": "CWE-78",
"provenance": "synthetic",
"equivalence_tier": "exact",
"match_mode": "rule_match",
"expected_rule_ids": [],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [],
"expected_severity": null,
"expected_category": null,
"expected_sink_lines": null,
"expected_source_lines": null,
"tags": [
"format-named-arg",
"sanitized"
],
"disabled": false,
"notes": "Named-arg `{safe}` reads sanitized value; sanitize_shell strips shell metachars before format!() interpolation reaches Command::new. Regression guard that named-arg lifting still respects sanitiser-dominated flows."
},
{
"case_id": "rs-safe-012",
"file": "rust/safe/safe_path_contains_dotdot.rs",
@ -10720,6 +10929,76 @@
"disabled": false,
"notes": "CVE-2024-31450 patched counterpart: `filepath.IsLocal(targetPath)` early-return. Regression guard."
},
{
"case_id": "cve-go-2026-41422-vulnerable",
"file": "cve_corpus/go/CVE-2026-41422/vulnerable.go",
"language": "go",
"is_vulnerable": true,
"vuln_class": "sqli",
"cwe": "CWE-89",
"provenance": "real_cve",
"equivalence_tier": "exact",
"match_mode": "rule_match",
"expected_rule_ids": [
"taint-unsanitised-flow"
],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [],
"expected_severity": "MEDIUM",
"expected_category": "Security",
"expected_sink_lines": [
[
46,
46
]
],
"expected_source_lines": [
[
32,
32
]
],
"tags": [
"cve",
"daptin",
"sqli",
"goqu",
"for-range",
"gin"
],
"disabled": false,
"notes": "CVE-2026-41422 / GHSA-rw2c-8rfq-gwfv: daptin /aggregate/:typename endpoint loops `c.QueryArray(\"column\")` into `goqu.L(project)` (raw SQL literal builder). Fixed in v0.11.4 by replacing goqu.L with parseAggExpr (allowlist + typed goqu.I/COUNT/SUM constructors)."
},
{
"case_id": "cve-go-2026-41422-patched",
"file": "cve_corpus/go/CVE-2026-41422/patched.go",
"language": "go",
"is_vulnerable": false,
"vuln_class": "safe",
"cwe": "N/A",
"provenance": "real_cve",
"equivalence_tier": "exact",
"match_mode": "file_presence",
"expected_rule_ids": [],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [
"taint-unsanitised-flow"
],
"expected_severity": null,
"expected_category": "Security",
"expected_sink_lines": [],
"expected_source_lines": [],
"tags": [
"cve",
"daptin",
"sqli",
"goqu",
"patched",
"negative"
],
"disabled": false,
"notes": "CVE-2026-41422 patched counterpart: aggregate function allowlist + typed goqu.I/COUNT/SUM constructors. Regression guard."
},
{
"case_id": "go-ssrf-004",
"file": "go/ssrf/ssrf_default_client_get.go",
@ -11389,6 +11668,73 @@
"disabled": false,
"notes": "CVE-2022-42889 patched counterpart: substitutor built directly with `new StringSubstitutor()` so the lookup map is empty; ${...} pass-through. No script/dns/url evaluation."
},
{
"case_id": "cve-java-ghsa-h8cj-hpmg-636v-vulnerable",
"file": "cve_corpus/java/GHSA-h8cj-hpmg-636v/vulnerable.java",
"language": "java",
"is_vulnerable": true,
"vuln_class": "sqli",
"cwe": "CWE-89",
"provenance": "real_cve",
"equivalence_tier": "exact",
"match_mode": "rule_match",
"expected_rule_ids": [
"taint-unsanitised-flow"
],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [],
"expected_severity": "HIGH",
"expected_category": "Security",
"expected_sink_lines": [
[
62,
62
]
],
"expected_source_lines": [
[
43,
43
]
],
"tags": [
"cve",
"appsmith",
"sqli",
"vulnerable"
],
"disabled": false,
"notes": "GHSA-h8cj-hpmg-636v / Appsmith FilterDataServiceCE.dropTable: tableName from a request flows through `\"DROP TABLE \" + tableName + \";\"` and `executeDbQuery(query)` to `Statement.execute(query)` on the in-memory H2 filter db. Apache-2.0"
},
{
"case_id": "cve-java-ghsa-h8cj-hpmg-636v-patched",
"file": "cve_corpus/java/GHSA-h8cj-hpmg-636v/patched.java",
"language": "java",
"is_vulnerable": false,
"vuln_class": "safe",
"cwe": "N/A",
"provenance": "real_cve",
"equivalence_tier": "exact",
"match_mode": "file_presence",
"expected_rule_ids": [],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [
"taint-unsanitised-flow"
],
"expected_severity": null,
"expected_category": "Security",
"expected_sink_lines": [],
"expected_source_lines": [],
"tags": [
"cve",
"appsmith",
"sqli",
"patched",
"negative"
],
"disabled": false,
"notes": "GHSA-h8cj-hpmg-636v patched counterpart: dropTable now calls validateFilterTempTableName(tableName) which rejects any value that does not match `^tbl_[A-Z]{16}$` via FILTER_TEMP_TABLE_NAME_PATTERN.matcher(tableName).matches(). Regression guard that Nyx recognises the Java Pattern.matcher(value).matches() chain as a regex-allowlist validator and that the helper-summary `validated_params_to_return` lift suppresses the SQL_QUERY flow at the call site."
},
{
"case_id": "rs-auth-001",
"file": "rust/auth/actix_scoped_write_missing.rs",
@ -12088,6 +12434,171 @@
"disabled": false,
"notes": "CVE-2024-24576 patched counterpart: cmd.exe-aware allowlist filters argv before reaching update.bat. Regression guard that Nyx does not refire on the fix."
},
{
"case_id": "cve-rs-2023-42456-vulnerable",
"file": "cve_corpus/rust/CVE-2023-42456/vulnerable.rs",
"language": "rust",
"is_vulnerable": true,
"vuln_class": "path_traversal",
"cwe": "CWE-22",
"provenance": "real_cve",
"equivalence_tier": "exact",
"match_mode": "rule_match",
"expected_rule_ids": [
"taint-unsanitised-flow"
],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [],
"expected_severity": "MEDIUM",
"expected_category": "Security",
"expected_sink_lines": null,
"expected_source_lines": null,
"tags": [
"cve",
"sudo-rs",
"path-traversal"
],
"disabled": false,
"notes": "CVE-2023-42456 / RUSTSEC-2023-0069: sudo-rs SessionRecordFile::open_for_user pushed an untrusted username into a PathBuf, letting a local attacker with a `../../bin/cp`-style username corrupt files. Apache-2.0"
},
{
"case_id": "cve-rs-2023-42456-patched",
"file": "cve_corpus/rust/CVE-2023-42456/patched.rs",
"language": "rust",
"is_vulnerable": false,
"vuln_class": "safe",
"cwe": "N/A",
"provenance": "real_cve",
"equivalence_tier": "exact",
"match_mode": "file_presence",
"expected_rule_ids": [],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [
"taint-unsanitised-flow"
],
"expected_severity": null,
"expected_category": "Security",
"expected_sink_lines": [],
"expected_source_lines": [],
"tags": [
"cve",
"sudo-rs",
"patched",
"negative"
],
"disabled": false,
"notes": "CVE-2023-42456 patched counterpart: open_for_user takes UserId (u32) instead of &str, so the path component is provably digits-only and cannot contain `..` or `/`. Regression guard for the type-only FILE_IO suppression."
},
{
"case_id": "cve-rs-2024-32884-vulnerable",
"file": "cve_corpus/rust/CVE-2024-32884/vulnerable.rs",
"language": "rust",
"is_vulnerable": true,
"vuln_class": "cmdi",
"cwe": "CWE-78",
"provenance": "real_cve",
"equivalence_tier": "exact",
"match_mode": "rule_match",
"expected_rule_ids": [
"taint-unsanitised-flow"
],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [],
"expected_severity": "MEDIUM",
"expected_category": "Security",
"expected_sink_lines": null,
"expected_source_lines": null,
"tags": [
"cve",
"gitoxide",
"ssh-option-smuggling"
],
"disabled": false,
"notes": "CVE-2024-32884 / RUSTSEC-2024-0335: gix-transport SSH program invocation built `format!(\"{user}@{host}\")` and fed the result to ssh's argv, so a `ssh://-Fattackerconfig@host/path` URL smuggled `-F` onto ssh's CLI. Apache-2.0 OR MIT"
},
{
"case_id": "cve-rs-2024-32884-patched",
"file": "cve_corpus/rust/CVE-2024-32884/patched.rs",
"language": "rust",
"is_vulnerable": false,
"vuln_class": "safe",
"cwe": "N/A",
"provenance": "real_cve",
"equivalence_tier": "exact",
"match_mode": "file_presence",
"expected_rule_ids": [],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [
"taint-unsanitised-flow"
],
"expected_severity": null,
"expected_category": "Security",
"expected_sink_lines": [],
"expected_source_lines": [],
"tags": [
"cve",
"gitoxide",
"patched",
"negative"
],
"disabled": false,
"notes": "CVE-2024-32884 patched counterpart: sanitize_shell rejects host/user components beginning with `-` before they reach ssh's argv (mirrors gix-url::host_argument_safe). Regression guard."
},
{
"case_id": "cve-rs-2025-53549-vulnerable",
"file": "cve_corpus/rust/CVE-2025-53549/vulnerable.rs",
"language": "rust",
"is_vulnerable": true,
"vuln_class": "sql_injection",
"cwe": "CWE-89",
"provenance": "real_cve",
"equivalence_tier": "exact",
"match_mode": "rule_match",
"expected_rule_ids": [
"taint-unsanitised-flow"
],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [],
"expected_severity": "MEDIUM",
"expected_category": "Security",
"expected_sink_lines": null,
"expected_source_lines": null,
"tags": [
"cve",
"matrix-rust-sdk",
"sql-injection"
],
"disabled": false,
"notes": "CVE-2025-53549 / RUSTSEC-2025-0043: matrix-sdk-sqlite SqliteEventCacheStore::find_event_with_relations interpolated relation-type filter strings into a format!()'d SQL query via hand-rolled `\"f\"` quoting, letting any room member inject SQL through the relation type. Apache-2.0"
},
{
"case_id": "cve-rs-2025-53549-patched",
"file": "cve_corpus/rust/CVE-2025-53549/patched.rs",
"language": "rust",
"is_vulnerable": false,
"vuln_class": "safe",
"cwe": "N/A",
"provenance": "real_cve",
"equivalence_tier": "exact",
"match_mode": "file_presence",
"expected_rule_ids": [],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [
"taint-unsanitised-flow"
],
"expected_severity": null,
"expected_category": "Security",
"expected_sink_lines": [],
"expected_source_lines": [],
"tags": [
"cve",
"matrix-rust-sdk",
"patched",
"negative"
],
"disabled": false,
"notes": "CVE-2025-53549 patched counterpart: filters bind through params_from_iter to `?` placeholders rather than format!()-spliced bytes. Regression guard."
},
{
"case_id": "py-safe-014",
"file": "python/safe/safe_direct_path_sanitizer.py",
@ -12691,7 +13202,7 @@
"cache-key"
],
"disabled": false,
"notes": "md5() / sha1() pervasively used for non-cryptographic purposes — ETag generation, cache-key / array-index hashing, dedup fingerprints, content-addressed identifier derivation. Layer F suppression recognises the consuming context (variable LHS, member-access LHS, subscript LHS, array element key, lookup-verb argument, return-from-method, hash-as-index) and refuses to fire. Distilled from nextcloud apps/dav CalDavBackend, contactsinteraction Card, Files/Cache, theming Util / CommonThemeTrait, encryption KeyManager; phpmyadmin src/Controllers/Database/StructureController, Controllers/Table/{RelationController, SearchController, ZoomSearchController}, src/Display/Results, Database/MultiTableQuery, Favorites/RecentFavoriteTables."
"notes": "md5() / sha1() pervasively used for non-cryptographic purposes \u2014 ETag generation, cache-key / array-index hashing, dedup fingerprints, content-addressed identifier derivation. Layer F suppression recognises the consuming context (variable LHS, member-access LHS, subscript LHS, array element key, lookup-verb argument, return-from-method, hash-as-index) and refuses to fire. Distilled from nextcloud apps/dav CalDavBackend, contactsinteraction Card, Files/Cache, theming Util / CommonThemeTrait, encryption KeyManager; phpmyadmin src/Controllers/Database/StructureController, Controllers/Table/{RelationController, SearchController, ZoomSearchController}, src/Display/Results, Database/MultiTableQuery, Favorites/RecentFavoriteTables."
},
{
"case_id": "php-crypto-001",
@ -12856,6 +13367,64 @@
"disabled": false,
"notes": "Postgres `datetime.c::EncodeDateTime` shape \u2014 sprintf with literal format string containing only width/precision-bounded specifiers. Layer D suppression."
},
{
"case_id": "c-safe-realrepo-019",
"file": "c/safe/safe_struct_field_subbuffer_alloc.c",
"language": "c",
"is_vulnerable": false,
"vuln_class": "safe",
"cwe": "N/A",
"provenance": "real-repo-precision-2026-05-03",
"equivalence_tier": "exact",
"match_mode": "rule_match",
"expected_rule_ids": [],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [
"state-resource-leak",
"state-resource-leak-possible",
"cfg-resource-leak"
],
"expected_severity": null,
"expected_category": "Security",
"expected_sink_lines": [],
"expected_source_lines": [],
"tags": [
"resource-lifecycle",
"negative",
"real-repo-precision-2026-05-03"
],
"disabled": false,
"notes": "curl/lib/dynhds.c::entry_new shape \u2014 sub-buffer alias `e->name = (char*)e + sizeof(*e)` and local-into-field ownership transfer `m->buf = ptr`. Field-LHS in apply_assignment moves the RHS to MOVED but does not seed the field as a separately-tracked resource. Engine fix: src/state/transfer.rs::apply_assignment SAFE-FOR-FIELD-LHS gate. Closes the dominant `state-resource-leak` FP cluster on curl/openssl/postgres/git (~165 findings across 6 repos)."
},
{
"case_id": "c-vuln-realrepo-019",
"file": "c/safe/vuln_local_leak_no_field_assign.c",
"language": "c",
"is_vulnerable": true,
"vuln_class": "resource",
"cwe": "CWE-401",
"provenance": "real-repo-precision-2026-05-03",
"equivalence_tier": "exact",
"match_mode": "rule_match",
"expected_rule_ids": [
"state-resource-leak"
],
"allowed_alternative_rule_ids": [
"cfg-resource-leak"
],
"forbidden_rule_ids": [],
"expected_severity": null,
"expected_category": "Security",
"expected_sink_lines": [],
"expected_source_lines": [],
"tags": [
"resource-lifecycle",
"leak",
"real-repo-precision-2026-05-03"
],
"disabled": false,
"notes": "Recall guard for the apply_assignment field-LHS gate. Plain local-to-local alias copy (`char *cursor = buf;`) without field-LHS must still flag a leak when the resource never reaches a release call or out-parameter."
},
{
"case_id": "cpp-safe-014",
"file": "cpp/safe/safe_direct_path_sanitizer.cpp",
@ -13237,6 +13806,94 @@
"disabled": false,
"notes": "Validated-flow propagation through helper chains. `sanitize` validates its first parameter via a regex allowlist; `buildQuery` interpolates the sanitised result into a SQL fragment; the handler hands the fragment to `db.execute`. Pinned by `SsaFuncSummary::validated_params_to_return` + `propagate_validated_params_to_return` (CVE-2026-25544 deep fix)."
},
{
"case_id": "ts-safe-022",
"file": "typescript/safe/safe_jest_test_callback_no_handler.ts",
"language": "typescript",
"is_vulnerable": false,
"vuln_class": "safe",
"cwe": "N/A",
"provenance": "synthetic",
"equivalence_tier": "exact",
"match_mode": "file_presence",
"expected_rule_ids": [],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [
"taint-unsanitised-flow"
],
"expected_severity": null,
"expected_category": "Security",
"expected_sink_lines": [],
"expected_source_lines": [],
"tags": [
"jest",
"arrow-no-formals",
"closure-capture",
"auto-seed-precision",
"real-repo-precision-2026-05-03"
],
"disabled": false,
"notes": "Jest-style nested arrow callbacks (`describe('…', () => { it('…', async () => { const body = await res.json(); … }) })`) bubble inner-scope free vars (`body`, `userId`, `server.post`) up to the outer arrow as synthetic Params. Before the fix, JS/TS auto-seed treated every Param whose var_name matched a handler-name (`userId`) as a real formal of the outer arrow and seeded it as `Source(UserInput)`, producing 934 phantom `taint-unsanitised-flow` findings on outline alone. Engine fix: `lower_to_ssa_with_params` now signals `with_params=true` to `lower_to_ssa_inner`, which makes the synthetic-externals classifier always exclude formals (even when the formal list is empty, e.g. arrow `() => {…}`) — bubbled-up free vars become synthetic and the auto-seed pass skips them. Distilled from /Users/elipeter/oss/outline/server/routes/api/comments/comments.test.ts."
},
{
"case_id": "ts-sqli-realrepo-arrow-002",
"file": "typescript/sqli/sqli_arrow_handler_param.ts",
"language": "typescript",
"is_vulnerable": true,
"vuln_class": "sqli",
"cwe": "CWE-89",
"provenance": "synthetic",
"equivalence_tier": "analogue",
"match_mode": "rule_match",
"expected_rule_ids": [
"taint-unsanitised-flow"
],
"allowed_alternative_rule_ids": [
"cfg-unguarded-sink"
],
"forbidden_rule_ids": [],
"expected_severity": null,
"expected_category": "Security",
"expected_sink_lines": [[8, 8]],
"expected_source_lines": [[7, 7]],
"tags": [
"sqli",
"arrow-handler",
"auto-seed-positive",
"real-repo-precision-2026-05-03"
],
"disabled": false,
"notes": "Arrow with REAL handler-named formal (`userId`) MUST still auto-seed and trigger taint flow into `db.exec(\"… ${userId}\")`. Pins the auto-seed positive path so the FP fix in ts-safe-022 does not over-suppress real handlers."
},
{
"case_id": "js-safe-jest-callback-001",
"file": "javascript/safe/safe_jest_test_callback_no_handler.js",
"language": "javascript",
"is_vulnerable": false,
"vuln_class": "safe",
"cwe": "N/A",
"provenance": "synthetic",
"equivalence_tier": "exact",
"match_mode": "file_presence",
"expected_rule_ids": [],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [
"taint-unsanitised-flow"
],
"expected_severity": null,
"expected_category": "Security",
"expected_sink_lines": [],
"expected_source_lines": [],
"tags": [
"jest",
"arrow-no-formals",
"closure-capture",
"auto-seed-precision",
"real-repo-precision-2026-05-03"
],
"disabled": false,
"notes": "JavaScript counterpart of ts-safe-022. Same Jest-style nested arrow callback shape, ensures the auto-seed precision fix applies to .js files too (auto_seed_handler_params is on for both Lang::JavaScript and Lang::TypeScript)."
},
{
"case_id": "py-auth-decorator-001",
"file": "python/safe/safe_login_required_decorator.py",
@ -14297,6 +14954,60 @@
"disabled": false,
"notes": "Vulnerable counterpart pinning the chained-call suppression: bare-identifier receivers (`repo.Find(id)` / `repo.Save(id, val)`) are still classified as canonical data-layer sinks and must continue firing the ownership check."
},
{
"case_id": "go-safe-realrepo-018",
"file": "go/safe/safe_ctx_context_helper.go",
"language": "go",
"is_vulnerable": false,
"vuln_class": "safe",
"cwe": "N/A",
"provenance": "synthetic",
"equivalence_tier": "exact",
"match_mode": "rule_match",
"expected_rule_ids": [],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [
"go.auth.missing_ownership_check"
],
"expected_severity": "NONE",
"expected_category": "N/A",
"expected_sink_lines": [],
"expected_source_lines": [],
"tags": [
"auth",
"negative",
"real-repo-precision-2026-05-03"
],
"disabled": false,
"notes": "Distilled from gitea/services/packages/packages.go::AddFileToExistingPackage. Layer-1 type-aware Go param filter drops ctx context.Context, plus Layer-2 narrowing of the Go framework-request-name allow-list closes the ~1900 missing_ownership_check FP cluster on backend helpers."
},
{
"case_id": "go-auth-realrepo-002",
"file": "go/auth/vuln_apicontext_findbyid.go",
"language": "go",
"is_vulnerable": true,
"vuln_class": "auth",
"cwe": "CWE-639",
"provenance": "synthetic",
"equivalence_tier": "exact",
"match_mode": "rule_match",
"expected_rule_ids": [
"go.auth.missing_ownership_check"
],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [],
"expected_severity": "MEDIUM",
"expected_category": "Security",
"expected_sink_lines": [],
"expected_source_lines": [],
"tags": [
"auth",
"positive",
"real-repo-precision-2026-05-03"
],
"disabled": false,
"notes": "Recall guard for the 2026-05-03 type-aware Go param filter. Even after ctx context.Context is dropped from unit.params, an id-shaped param keeps the unit on the hook (id-shape recognised before the framework-name allow-list)."
},
{
"case_id": "py-auth-realrepo-001",
"file": "python/safe/safe_django_migration_token.py",
@ -15045,6 +15756,62 @@
"disabled": false,
"notes": "Counterpart to safe_post_fetch_ownership_check \u2014 same controller shape but the per-record permission check is omitted, so the row-fetch exemption does not fire. Engine must keep flagging this even though the safe-shape fixtures train the exemption on the same Issue.find(params[:id]) pattern."
},
{
"case_id": "ruby-safe-rails-private-callback-helper-001",
"file": "ruby/safe/safe_rails_private_callback_helper.rb",
"language": "ruby",
"is_vulnerable": false,
"vuln_class": "safe",
"cwe": "",
"provenance": "real-repo-precision-2026-05-03",
"equivalence_tier": "exact",
"match_mode": "rule_match",
"expected_rule_ids": [],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [
"rb.auth.missing_ownership_check"
],
"expected_severity": null,
"expected_category": null,
"expected_sink_lines": [],
"expected_source_lines": [],
"tags": [
"rails",
"auth",
"private-callback-helper",
"real-repo-precision"
],
"disabled": false,
"notes": "Mastodon-shape: `set_account` private helper invoked via `before_action :set_account`. Rails extractor + collect_top_level_units now skip private + callback-target methods so the row fetch in the helper is not flagged as a missing-ownership unit; the public action that triggers the callback owns the auth context."
},
{
"case_id": "ruby-safe-rails-callback-helper-no-private-001",
"file": "ruby/safe/safe_rails_callback_helper_no_private.rb",
"language": "ruby",
"is_vulnerable": false,
"vuln_class": "safe",
"cwe": "",
"provenance": "real-repo-precision-2026-05-03",
"equivalence_tier": "exact",
"match_mode": "rule_match",
"expected_rule_ids": [],
"allowed_alternative_rule_ids": [],
"forbidden_rule_ids": [
"rb.auth.missing_ownership_check"
],
"expected_severity": null,
"expected_category": null,
"expected_sink_lines": [],
"expected_source_lines": [],
"tags": [
"rails",
"auth",
"callback-target-no-private",
"real-repo-precision"
],
"disabled": false,
"notes": "Sister fixture to safe_rails_private_callback_helper \u2014 the `set_widget` helper carries no `private` directive but is registered via `before_action :set_widget`. Callback-target name suppression alone (independent of visibility) must skip the helper unit."
},
{
"case_id": "java-safe-realrepo-keycloak-001",
"file": "java/safe/SafeJpaParameterizedExecute.java",
@ -15894,7 +16661,7 @@
"real-repo-precision-2026-05-02"
],
"disabled": false,
"notes": "Distilled from sentry api/helpers/environments.py::get_environments and api/endpoints/organization_releases.py::_filter_releases_by_query. `<entity>.id` for a unit param named after a scope-bearing domain entity (organization, project, ...) is the ownership scope inherited from the caller, not a user-controlled target. Pinned by is_caller_scope_entity_subject in src/auth_analysis/checks.rs. Also exercises the keyword_argument-key fix in extract_value_refs (Environment.objects.filter(organization_id=...) — the kwarg key `organization_id` is the ORM column name, not a subject)."
"notes": "Distilled from sentry api/helpers/environments.py::get_environments and api/endpoints/organization_releases.py::_filter_releases_by_query. `<entity>.id` for a unit param named after a scope-bearing domain entity (organization, project, ...) is the ownership scope inherited from the caller, not a user-controlled target. Pinned by is_caller_scope_entity_subject in src/auth_analysis/checks.rs. Also exercises the keyword_argument-key fix in extract_value_refs (Environment.objects.filter(organization_id=...) \u2014 the kwarg key `organization_id` is the ORM column name, not a subject)."
},
{
"case_id": "py-auth-realrepo-009",

567
tests/benchmark/results/latest.json
View file

@ -1,7 +1,7 @@
{
"benchmark_version": "1.0",
"timestamp": "2026-05-03T01:35:18Z",
"scanner_version": "0.6.0",
"timestamp": "2026-05-03T17:00:35Z",
"scanner_version": "0.6.1",
"scanner_config": {
"analysis_mode": "Full",
"taint_enabled": true,
@ -9,9 +9,9 @@
"state_analysis_enabled": true,
"worker_threads": 1
},
"ground_truth_hash": "sha256:8b8b31820b3a2cd0a28ded8109370093132a11074bf28b9c373192d271ee9f09",
"corpus_size": 507,
"cases_run": 506,
"ground_truth_hash": "sha256:1d6ed97196d3ff0844320a79ac607983245dd73af5455bcf77f6ac6a212c5e45",
"corpus_size": 533,
"cases_run": 532,
"cases_skipped": 1,
"outcomes": [
{
@ -489,6 +489,21 @@
"security_finding_count": 0,
"non_security_finding_count": 0
},
{
"case_id": "c-safe-realrepo-019",
"file": "c/safe/safe_struct_field_subbuffer_alloc.c",
"language": "c",
"vuln_class": "safe",
"is_vulnerable": false,
"outcome_file_level": "TN",
"outcome_rule_level": "TN",
"outcome_location_level": null,
"matched_rule_ids": [],
"unexpected_rule_ids": [],
"all_finding_ids": [],
"security_finding_count": 0,
"non_security_finding_count": 0
},
{
"case_id": "c-ssrf-001",
"file": "c/ssrf/ssrf_curl.c",
@ -508,6 +523,27 @@
"security_finding_count": 1,
"non_security_finding_count": 0
},
{
"case_id": "c-vuln-realrepo-019",
"file": "c/safe/vuln_local_leak_no_field_assign.c",
"language": "c",
"vuln_class": "resource",
"is_vulnerable": true,
"outcome_file_level": "TP",
"outcome_rule_level": "TP",
"outcome_location_level": null,
"matched_rule_ids": [
"state-resource-leak",
"cfg-resource-leak"
],
"unexpected_rule_ids": [],
"all_finding_ids": [
"state-resource-leak",
"cfg-resource-leak"
],
"security_finding_count": 2,
"non_security_finding_count": 0
},
{
"case_id": "cpp-buf-001",
"file": "cpp/buffer_overflow/buffer_sprintf.cpp",
@ -1299,6 +1335,46 @@
"security_finding_count": 1,
"non_security_finding_count": 0
},
{
"case_id": "cve-go-2026-41422-patched",
"file": "cve_corpus/go/CVE-2026-41422/patched.go",
"language": "go",
"vuln_class": "safe",
"is_vulnerable": false,
"outcome_file_level": "TN",
"outcome_rule_level": "TN",
"outcome_location_level": null,
"matched_rule_ids": [],
"unexpected_rule_ids": [],
"all_finding_ids": [],
"security_finding_count": 0,
"non_security_finding_count": 0
},
{
"case_id": "cve-go-2026-41422-vulnerable",
"file": "cve_corpus/go/CVE-2026-41422/vulnerable.go",
"language": "go",
"vuln_class": "sqli",
"is_vulnerable": true,
"outcome_file_level": "TP",
"outcome_rule_level": "TP",
"outcome_location_level": "TP",
"matched_rule_ids": [
"taint-unsanitised-flow (source 35:22)",
"taint-unsanitised-flow (source 35:22)",
"taint-unsanitised-flow (source 35:22)",
"taint-unsanitised-flow (source 35:22)"
],
"unexpected_rule_ids": [],
"all_finding_ids": [
"taint-unsanitised-flow (source 35:22)",
"taint-unsanitised-flow (source 35:22)",
"taint-unsanitised-flow (source 35:22)",
"taint-unsanitised-flow (source 35:22)"
],
"security_finding_count": 4,
"non_security_finding_count": 0
},
{
"case_id": "cve-java-2015-7501-patched",
"file": "cve_corpus/java/CVE-2015-7501/patched.java",
@ -1442,6 +1518,40 @@
"security_finding_count": 1,
"non_security_finding_count": 0
},
{
"case_id": "cve-java-ghsa-h8cj-hpmg-636v-patched",
"file": "cve_corpus/java/GHSA-h8cj-hpmg-636v/patched.java",
"language": "java",
"vuln_class": "safe",
"is_vulnerable": false,
"outcome_file_level": "TN",
"outcome_rule_level": "TN",
"outcome_location_level": null,
"matched_rule_ids": [],
"unexpected_rule_ids": [],
"all_finding_ids": [],
"security_finding_count": 0,
"non_security_finding_count": 0
},
{
"case_id": "cve-java-ghsa-h8cj-hpmg-636v-vulnerable",
"file": "cve_corpus/java/GHSA-h8cj-hpmg-636v/vulnerable.java",
"language": "java",
"vuln_class": "sqli",
"is_vulnerable": true,
"outcome_file_level": "TP",
"outcome_rule_level": "TP",
"outcome_location_level": "FN",
"matched_rule_ids": [
"taint-unsanitised-flow (source 43:28)"
],
"unexpected_rule_ids": [],
"all_finding_ids": [
"taint-unsanitised-flow (source 43:28)"
],
"security_finding_count": 1,
"non_security_finding_count": 0
},
{
"case_id": "cve-js-2019-14939-patched",
"file": "cve_corpus/javascript/CVE-2019-14939/patched.js",
@ -1975,6 +2085,43 @@
"security_finding_count": 1,
"non_security_finding_count": 1
},
{
"case_id": "cve-rs-2023-42456-patched",
"file": "cve_corpus/rust/CVE-2023-42456/patched.rs",
"language": "rust",
"vuln_class": "safe",
"is_vulnerable": false,
"outcome_file_level": "TN",
"outcome_rule_level": "TN",
"outcome_location_level": null,
"matched_rule_ids": [],
"unexpected_rule_ids": [],
"all_finding_ids": [
"rs.quality.unwrap"
],
"security_finding_count": 0,
"non_security_finding_count": 1
},
{
"case_id": "cve-rs-2023-42456-vulnerable",
"file": "cve_corpus/rust/CVE-2023-42456/vulnerable.rs",
"language": "rust",
"vuln_class": "path_traversal",
"is_vulnerable": true,
"outcome_file_level": "TP",
"outcome_rule_level": "TP",
"outcome_location_level": null,
"matched_rule_ids": [
"taint-unsanitised-flow (source 42:16)"
],
"unexpected_rule_ids": [],
"all_finding_ids": [
"rs.quality.unwrap",
"taint-unsanitised-flow (source 42:16)"
],
"security_finding_count": 1,
"non_security_finding_count": 1
},
{
"case_id": "cve-rs-2024-24576-patched",
"file": "cve_corpus/rust/CVE-2024-24576/patched.rs",
@ -2014,6 +2161,84 @@
"security_finding_count": 1,
"non_security_finding_count": 2
},
{
"case_id": "cve-rs-2024-32884-patched",
"file": "cve_corpus/rust/CVE-2024-32884/patched.rs",
"language": "rust",
"vuln_class": "safe",
"is_vulnerable": false,
"outcome_file_level": "TN",
"outcome_rule_level": "TN",
"outcome_location_level": null,
"matched_rule_ids": [],
"unexpected_rule_ids": [],
"all_finding_ids": [
"rs.quality.unwrap",
"rs.quality.unwrap",
"rs.quality.expect"
],
"security_finding_count": 0,
"non_security_finding_count": 3
},
{
"case_id": "cve-rs-2024-32884-vulnerable",
"file": "cve_corpus/rust/CVE-2024-32884/vulnerable.rs",
"language": "rust",
"vuln_class": "cmdi",
"is_vulnerable": true,
"outcome_file_level": "TP",
"outcome_rule_level": "TP",
"outcome_location_level": null,
"matched_rule_ids": [
"taint-unsanitised-flow (source 64:15)"
],
"unexpected_rule_ids": [],
"all_finding_ids": [
"rs.quality.unwrap",
"rs.quality.unwrap",
"rs.quality.expect",
"taint-unsanitised-flow (source 64:15)"
],
"security_finding_count": 1,
"non_security_finding_count": 3
},
{
"case_id": "cve-rs-2025-53549-patched",
"file": "cve_corpus/rust/CVE-2025-53549/patched.rs",
"language": "rust",
"vuln_class": "safe",
"is_vulnerable": false,
"outcome_file_level": "TN",
"outcome_rule_level": "TN",
"outcome_location_level": null,
"matched_rule_ids": [],
"unexpected_rule_ids": [],
"all_finding_ids": [
"rs.quality.unwrap"
],
"security_finding_count": 0,
"non_security_finding_count": 1
},
{
"case_id": "cve-rs-2025-53549-vulnerable",
"file": "cve_corpus/rust/CVE-2025-53549/vulnerable.rs",
"language": "rust",
"vuln_class": "sql_injection",
"is_vulnerable": true,
"outcome_file_level": "TP",
"outcome_rule_level": "TP",
"outcome_location_level": null,
"matched_rule_ids": [
"taint-unsanitised-flow (source 64:36)"
],
"unexpected_rule_ids": [],
"all_finding_ids": [
"rs.quality.unwrap",
"taint-unsanitised-flow (source 64:36)"
],
"security_finding_count": 1,
"non_security_finding_count": 1
},
{
"case_id": "cve-ts-2023-26159-patched",
"file": "cve_corpus/typescript/CVE-2023-26159/patched.ts",
@ -2139,6 +2364,27 @@
"security_finding_count": 2,
"non_security_finding_count": 0
},
{
"case_id": "go-auth-realrepo-002",
"file": "go/auth/vuln_apicontext_findbyid.go",
"language": "go",
"vuln_class": "auth",
"is_vulnerable": true,
"outcome_file_level": "TP",
"outcome_rule_level": "TP",
"outcome_location_level": null,
"matched_rule_ids": [
"go.auth.missing_ownership_check",
"go.auth.missing_ownership_check"
],
"unexpected_rule_ids": [],
"all_finding_ids": [
"go.auth.missing_ownership_check",
"go.auth.missing_ownership_check"
],
"security_finding_count": 2,
"non_security_finding_count": 0
},
{
"case_id": "go-cmdi-001",
"file": "go/cmdi/cmdi_direct.go",
@ -2823,6 +3069,21 @@
"security_finding_count": 0,
"non_security_finding_count": 0
},
{
"case_id": "go-safe-realrepo-018",
"file": "go/safe/safe_ctx_context_helper.go",
"language": "go",
"vuln_class": "safe",
"is_vulnerable": false,
"outcome_file_level": "TN",
"outcome_rule_level": "TN",
"outcome_location_level": null,
"matched_rule_ids": [],
"unexpected_rule_ids": [],
"all_finding_ids": [],
"security_finding_count": 0,
"non_security_finding_count": 0
},
{
"case_id": "go-sqli-001",
"file": "go/sqli/sqli_concat.go",
@ -2896,6 +3157,40 @@
"security_finding_count": 4,
"non_security_finding_count": 0
},
{
"case_id": "go-sqli-004",
"file": "go/sqli/sqli_for_range.go",
"language": "go",
"vuln_class": "sqli",
"is_vulnerable": true,
"outcome_file_level": "TP",
"outcome_rule_level": "TP",
"outcome_location_level": "TP",
"matched_rule_ids": [
"taint-unsanitised-flow (source 15:10)"
],
"unexpected_rule_ids": [],
"all_finding_ids": [
"taint-unsanitised-flow (source 15:10)"
],
"security_finding_count": 1,
"non_security_finding_count": 0
},
{
"case_id": "go-sqli-safe-001",
"file": "go/safe/safe_sqli_for_range_allowlist.go",
"language": "go",
"vuln_class": "safe",
"is_vulnerable": false,
"outcome_file_level": "TN",
"outcome_rule_level": "TN",
"outcome_location_level": null,
"matched_rule_ids": [],
"unexpected_rule_ids": [],
"all_finding_ids": [],
"security_finding_count": 0,
"non_security_finding_count": 0
},
{
"case_id": "go-ssrf-001",
"file": "go/ssrf/ssrf_http_get.go",
@ -3516,6 +3811,21 @@
"security_finding_count": 0,
"non_security_finding_count": 0
},
{
"case_id": "java-safe-stmt-execute-validated",
"file": "java/safe/safe_statement_execute_pattern_validated.java",
"language": "java",
"vuln_class": "safe",
"is_vulnerable": false,
"outcome_file_level": "TN",
"outcome_rule_level": "TN",
"outcome_location_level": null,
"matched_rule_ids": [],
"unexpected_rule_ids": [],
"all_finding_ids": [],
"security_finding_count": 0,
"non_security_finding_count": 0
},
{
"case_id": "java-sqli-001",
"file": "java/sqli/SqliConcat.java",
@ -3615,6 +3925,25 @@
"security_finding_count": 6,
"non_security_finding_count": 0
},
{
"case_id": "java-sqli-stmt-execute-002",
"file": "java/sqli/sqli_statement_execute_chained.java",
"language": "java",
"vuln_class": "sqli",
"is_vulnerable": true,
"outcome_file_level": "TP",
"outcome_rule_level": "TP",
"outcome_location_level": "FN",
"matched_rule_ids": [
"taint-unsanitised-flow (source 25:28)"
],
"unexpected_rule_ids": [],
"all_finding_ids": [
"taint-unsanitised-flow (source 25:28)"
],
"security_finding_count": 1,
"non_security_finding_count": 0
},
{
"case_id": "java-ssrf-001",
"file": "java/ssrf/SsrfRequest.java",
@ -4171,6 +4500,21 @@
"security_finding_count": 0,
"non_security_finding_count": 0
},
{
"case_id": "js-safe-jest-callback-001",
"file": "javascript/safe/safe_jest_test_callback_no_handler.js",
"language": "javascript",
"vuln_class": "safe",
"is_vulnerable": false,
"outcome_file_level": "TN",
"outcome_rule_level": "TN",
"outcome_location_level": null,
"matched_rule_ids": [],
"unexpected_rule_ids": [],
"all_finding_ids": [],
"security_finding_count": 0,
"non_security_finding_count": 0
},
{
"case_id": "js-safe-parseInt-001",
"file": "javascript/safe/safe_parseInt.js",
@ -7366,6 +7710,41 @@
"security_finding_count": 0,
"non_security_finding_count": 2
},
{
"case_id": "rs-safe-fileio-int-uid",
"file": "rust/safe/safe_parsed_uid_path.rs",
"language": "rust",
"vuln_class": "safe",
"is_vulnerable": false,
"outcome_file_level": "TN",
"outcome_rule_level": "TN",
"outcome_location_level": null,
"matched_rule_ids": [],
"unexpected_rule_ids": [],
"all_finding_ids": [
"rs.quality.unwrap"
],
"security_finding_count": 0,
"non_security_finding_count": 1
},
{
"case_id": "rs-safe-format-named-arg-sanitized",
"file": "rust/safe/safe_format_string_sanitized.rs",
"language": "rust",
"vuln_class": "safe",
"is_vulnerable": false,
"outcome_file_level": "TN",
"outcome_rule_level": "TN",
"outcome_location_level": null,
"matched_rule_ids": [],
"unexpected_rule_ids": [],
"all_finding_ids": [
"rs.quality.unwrap",
"rs.quality.unwrap"
],
"security_finding_count": 0,
"non_security_finding_count": 2
},
{
"case_id": "rs-sqli-001",
"file": "rust/sqli/sqli_rusqlite_format.rs",
@ -7410,6 +7789,27 @@
"security_finding_count": 1,
"non_security_finding_count": 3
},
{
"case_id": "rs-sqli-format-named-arg",
"file": "rust/sqli/sqli_format_named_arg.rs",
"language": "rust",
"vuln_class": "sqli",
"is_vulnerable": true,
"outcome_file_level": "TP",
"outcome_rule_level": "TP",
"outcome_location_level": null,
"matched_rule_ids": [
"taint-unsanitised-flow (source 17:16)"
],
"unexpected_rule_ids": [],
"all_finding_ids": [
"rs.quality.unwrap",
"rs.quality.unwrap",
"taint-unsanitised-flow (source 17:16)"
],
"security_finding_count": 1,
"non_security_finding_count": 2
},
{
"case_id": "rs-ssrf-001",
"file": "rust/ssrf/ssrf_reqwest.rs",
@ -7852,6 +8252,36 @@
"security_finding_count": 0,
"non_security_finding_count": 0
},
{
"case_id": "ruby-safe-rails-callback-helper-no-private-001",
"file": "ruby/safe/safe_rails_callback_helper_no_private.rb",
"language": "ruby",
"vuln_class": "safe",
"is_vulnerable": false,
"outcome_file_level": "TN",
"outcome_rule_level": "TN",
"outcome_location_level": null,
"matched_rule_ids": [],
"unexpected_rule_ids": [],
"all_finding_ids": [],
"security_finding_count": 0,
"non_security_finding_count": 0
},
{
"case_id": "ruby-safe-rails-private-callback-helper-001",
"file": "ruby/safe/safe_rails_private_callback_helper.rb",
"language": "ruby",
"vuln_class": "safe",
"is_vulnerable": false,
"outcome_file_level": "TN",
"outcome_rule_level": "TN",
"outcome_location_level": null,
"matched_rule_ids": [],
"unexpected_rule_ids": [],
"all_finding_ids": [],
"security_finding_count": 0,
"non_security_finding_count": 0
},
{
"case_id": "ruby-safe-strong-params-001",
"file": "ruby/safe/safe_strong_params.rb",
@ -8739,6 +9169,26 @@
"security_finding_count": 0,
"non_security_finding_count": 0
},
{
"case_id": "ts-safe-022",
"file": "typescript/safe/safe_jest_test_callback_no_handler.ts",
"language": "typescript",
"vuln_class": "safe",
"is_vulnerable": false,
"outcome_file_level": "TN",
"outcome_rule_level": "TN",
"outcome_location_level": null,
"matched_rule_ids": [],
"unexpected_rule_ids": [],
"all_finding_ids": [
"ts.quality.any_annotation",
"ts.quality.any_annotation",
"ts.quality.any_annotation",
"ts.quality.any_annotation"
],
"security_finding_count": 0,
"non_security_finding_count": 4
},
{
"case_id": "ts-secrets-001",
"file": "typescript/secrets/fallback_secret.ts",
@ -8822,6 +9272,25 @@
"security_finding_count": 2,
"non_security_finding_count": 3
},
{
"case_id": "ts-sqli-realrepo-arrow-002",
"file": "typescript/sqli/sqli_arrow_handler_param.ts",
"language": "typescript",
"vuln_class": "sqli",
"is_vulnerable": true,
"outcome_file_level": "TP",
"outcome_rule_level": "TP",
"outcome_location_level": "TP",
"matched_rule_ids": [
"taint-unsanitised-flow (source 7:27)"
],
"unexpected_rule_ids": [],
"all_finding_ids": [
"taint-unsanitised-flow (source 7:27)"
],
"security_finding_count": 1,
"non_security_finding_count": 0
},
{
"case_id": "ts-ssrf-001",
"file": "typescript/ssrf/ssrf_axios_user_url.ts",
@ -9043,29 +9512,29 @@
}
],
"aggregate_file_level": {
"tp": 250,
"tp": 261,
"fp": 0,
"fn_": 0,
"tn": 256,
"tn": 271,
"precision": 1.0,
"recall": 1.0,
"f1": 1.0
},
"aggregate_rule_level": {
"tp": 250,
"tp": 261,
"fp": 0,
"fn_": 0,
"tn": 256,
"tn": 271,
"precision": 1.0,
"recall": 1.0,
"f1": 1.0
},
"by_language": {
"c": {
"tp": 16,
"tp": 17,
"fp": 0,
"fn_": 0,
"tn": 16,
"tn": 17,
"precision": 1.0,
"recall": 1.0,
"f1": 1.0
@ -9080,19 +9549,19 @@
"f1": 1.0
},
"go": {
"tp": 27,
"tp": 30,
"fp": 0,
"fn_": 0,
"tn": 32,
"tn": 35,
"precision": 1.0,
"recall": 1.0,
"f1": 1.0
},
"java": {
"tp": 21,
"tp": 23,
"fp": 0,
"fn_": 0,
"tn": 20,
"tn": 22,
"precision": 1.0,
"recall": 1.0,
"f1": 1.0
@ -9101,7 +9570,7 @@
"tp": 23,
"fp": 0,
"fn_": 0,
"tn": 29,
"tn": 30,
"precision": 1.0,
"recall": 1.0,
"f1": 1.0
@ -9128,25 +9597,25 @@
"tp": 24,
"fp": 0,
"fn_": 0,
"tn": 24,
"tn": 26,
"precision": 1.0,
"recall": 1.0,
"f1": 1.0
},
"rust": {
"tp": 37,
"tp": 41,
"fp": 0,
"fn_": 0,
"tn": 41,
"tn": 46,
"precision": 1.0,
"recall": 1.0,
"f1": 1.0
},
"typescript": {
"tp": 35,
"tp": 36,
"fp": 0,
"fn_": 0,
"tn": 26,
"tn": 27,
"precision": 1.0,
"recall": 1.0,
"f1": 1.0
@ -9154,7 +9623,7 @@
},
"by_vuln_class": {
"auth": {
"tp": 19,
"tp": 20,
"fp": 0,
"fn_": 0,
"tn": 0,
@ -9172,7 +9641,7 @@
"f1": 1.0
},
"cmdi": {
"tp": 57,
"tp": 58,
"fp": 0,
"fn_": 0,
"tn": 0,
@ -9262,7 +9731,7 @@
"f1": 1.0
},
"path_traversal": {
"tp": 27,
"tp": 28,
"fp": 0,
"fn_": 0,
"tn": 0,
@ -9280,7 +9749,7 @@
"f1": 1.0
},
"resource": {
"tp": 1,
"tp": 2,
"fp": 0,
"fn_": 0,
"tn": 0,
@ -9292,7 +9761,7 @@
"tp": 0,
"fp": 0,
"fn_": 0,
"tn": 256,
"tn": 271,
"precision": 1.0,
"recall": 1.0,
"f1": 1.0
@ -9307,7 +9776,7 @@
"f1": 1.0
},
"sql_injection": {
"tp": 1,
"tp": 2,
"fp": 0,
"fn_": 0,
"tn": 0,
@ -9316,7 +9785,7 @@
"f1": 1.0
},
"sqli": {
"tp": 31,
"tp": 37,
"fp": 0,
"fn_": 0,
"tn": 0,
@ -9345,31 +9814,31 @@
},
"by_confidence": {
">=High": {
"tp": 81,
"fp": 105,
"fn_": 169,
"tn": 151,
"precision": 0.43548387096774194,
"recall": 0.324,
"f1": 0.37155963302752293
"tp": 88,
"fp": 100,
"fn_": 173,
"tn": 171,
"precision": 0.46808510638297873,
"recall": 0.3371647509578544,
"f1": 0.3919821826280624
},
">=Low": {
"tp": 87,
"fp": 124,
"fn_": 163,
"tn": 132,
"precision": 0.41232227488151657,
"recall": 0.348,
"f1": 0.3774403470715834
"tp": 90,
"fp": 120,
"fn_": 171,
"tn": 151,
"precision": 0.42857142857142855,
"recall": 0.3448275862068966,
"f1": 0.3821656050955414
},
">=Medium": {
"tp": 87,
"fp": 118,
"fn_": 163,
"tn": 138,
"precision": 0.424390243902439,
"recall": 0.348,
"f1": 0.3824175824175824
"tp": 90,
"fp": 116,
"fn_": 171,
"tn": 155,
"precision": 0.4368932038834951,
"recall": 0.3448275862068966,
"f1": 0.38543897216274087
}
}
}

61
tests/fixtures/fp_guards/framework_jest_test_callback_arrow/comments.test.ts vendored Normal file
View file

@ -0,0 +1,61 @@
// FP-guard: jest test files use nested arrow callbacks
// (`describe('...', () => { it('...', async () => { ... }) })`). The
// inner arrow's locals (`body`, `userId`, `server.post`) bubble up to
// the outer arrow as synthetic Params via the call's `taint.uses`.
// Before the fix, JS/TS auto-seed treated every Param whose var_name
// matched a handler-name (e.g. `userId`) as a real formal of the outer
// arrow and seeded it as `Source(UserInput)`, producing phantom
// `taint-unsanitised-flow` findings at every reachable sink. The fix
// makes `lower_to_ssa_with_params` always treat externals not in the
// (possibly empty) `formal_params` list as synthetic / closure
// captures, so the auto-seed pass skips them.
//
// Distilled from /Users/elipeter/oss/outline/server/routes/api/comments/comments.test.ts
// (934 phantom `taint-unsanitised-flow` findings before the fix).
interface FetchResponse {
status: number;
json: () => Promise<unknown>;
}
interface FetchOpts {
body?: unknown;
}
interface TestServer {
post: (url: string, opts?: FetchOpts) => Promise<FetchResponse>;
}
interface TestUser {
id: string;
teamId: string;
getJwtToken: () => string;
}
interface TestTeam {
id: string;
}
declare const server: TestServer;
declare function describe(name: string, fn: () => void): void;
declare function it(name: string, fn: () => Promise<void>): void;
declare function expect<T>(x: T): { toEqual: (other: T) => void };
declare function buildTeam(): Promise<TestTeam>;
declare function buildUser(x: { teamId: string }): Promise<TestUser>;
describe("#comments.list", () => {
it("should require auth", async () => {
const res = await server.post("/api/comments.list");
const body = await res.json();
expect(res.status).toEqual(401);
});
it("should list comments", async () => {
const team = await buildTeam();
const user = await buildUser({ teamId: team.id });
const res = await server.post("/api/comments.list", {
body: {
token: user.getJwtToken(),
id: user.id,
},
});
const body = await res.json();
expect(res.status).toEqual(200);
});
});

16
tests/fixtures/fp_guards/framework_jest_test_callback_arrow/expectations.json vendored Normal file
View file

@ -0,0 +1,16 @@
{
"required_findings": [],
"forbidden_findings": [
{ "id_prefix": "taint-unsanitised-flow" }
],
"noise_budget": {
"max_total_findings": 3,
"max_high_findings": 0
},
"performance_expectations": {
"max_ms_no_index": 1500,
"max_ms_index_cold": 2000,
"max_ms_index_warm": 800,
"ci_mode": "lenient"
}
}

3
tests/fixtures/go_server/expectations.json vendored
View file

@ -1,8 +1,7 @@
{
"required_findings": [
{ "id_prefix": "taint-unsanitised-flow", "min_count": 4 },
{ "id_prefix": "go.cmdi.exec_command", "min_count": 3 },
{ "id_prefix": "cfg-unguarded-sink", "min_count": 1 }
{ "id_prefix": "go.cmdi.exec_command", "min_count": 3 }
],
"forbidden_findings": [],
"noise_budget": {

22
tests/integration_tests.rs
View file

@ -959,6 +959,28 @@ fn fp_guard_framework_strapi_db_query_chain() {
validate_expectations(&diags, &dir);
}
/// FP guard: jest-style nested arrow callbacks
/// (`describe('...', () => { it('...', async () => { ... }) })`) bubble
/// inner-scope free vars (`body`, `userId`, `server.post`) up to the
/// outer arrow as synthetic Params. Before the fix, JS/TS auto-seed
/// treated every Param whose var_name matched a handler-name (e.g.
/// `userId` via the `user*` camelCase rule) as a real formal of the
/// outer arrow and seeded it as `Source(UserInput)`, producing 934
/// phantom `taint-unsanitised-flow` findings on outline alone (the
/// dominant cluster in the JS/TS slice baseline). Engine fix:
/// `lower_to_ssa_with_params` signals `with_params=true` to
/// `lower_to_ssa_inner`, which makes the synthetic-externals
/// classifier always exclude formals (even when the formal list is
/// empty, e.g. arrow `() => {…}`); bubbled-up free vars become
/// synthetic and the auto-seed pass skips them. Distilled from
/// `outline/server/routes/api/comments/comments.test.ts`.
#[test]
fn fp_guard_framework_jest_test_callback_arrow() {
let dir = fixture_path("fp_guards/framework_jest_test_callback_arrow");
let diags = scan_fixture_dir(&dir, AnalysisMode::Full);
validate_expectations(&diags, &dir);
}
/// FP guard, composer / PSR-4 autoloader closure includes a parameter.
/// Pinned from a 32-finding cluster in nextcloud's vendored
/// `composer/composer/ClassLoader.php` plus three further methods