apunkt/nyx
1
0
Fork 0
mirror of https://github.com/elicpeter/nyx.git synced 2026-06-30 20:39:39 +02:00
Code Issues Projects Releases Packages Wiki Activity

docs: update inline references and improve XSS detection in Java servlet writers, refactor matchers for clarity and extend sanitizer support

Browse source
This commit is contained in:
elipeter 2026-06-03 11:32:30 -05:00
parent c2cd6f009e
commit eb4332edb5
56 changed files with 339 additions and 144 deletions
Download patch file Download diff file Expand all files Collapse all files

10
tests/fixtures/real_world/java/taint/catch_param_sink.expect.json vendored
View file

@ -9,15 +9,7 @@
"must_match": true,
"line_range": [5, 12],
"evidence_contains": [],
"notes": "catch(Exception e) binds e as tainted; e flows to println sink via catch parameter"
},
{
"rule_id": "java.xss.getwriter_print",
"severity": "MEDIUM",
"must_match": true,
"line_range": [10, 10],
"evidence_contains": [],
"notes": "response.getWriter().println() in catch block — AST pattern detects potential XSS via error response"
"notes": "catch(Exception e) binds e as tainted; e flows to response.getWriter().println at line 10 — reflected XSS via error response. Replaces the retired java.xss.getwriter_print AST pattern: reflected XSS is now a taint sink (Sink(Cap::HTML_ESCAPE)), so this is taint-confirmed rather than flagged on every writer call."
}
]
}

10
tests/fixtures/real_world/java/taint/try_catch_sqli.expect.json vendored
View file

@ -19,21 +19,13 @@
"evidence_contains": [],
"notes": "AST pattern detects executeQuery with string concatenation — SQL injection"
},
{
"rule_id": "java.xss.getwriter_print",
"severity": "MEDIUM",
"must_match": true,
"line_range": [12, 12],
"evidence_contains": [],
"notes": "response.getWriter().println() with user input — reflected XSS via error response"
},
{
"rule_id": "taint-unsanitised-flow",
"severity": "HIGH",
"must_match": true,
"line_range": [7, 12],
"evidence_contains": [],
"notes": "request.getParameter flows to response.getWriter().println — user input reflected in error response"
"notes": "request.getParameter flows to response.getWriter().println at line 12 — user input reflected in error response. Replaces the retired java.xss.getwriter_print AST pattern: reflected XSS is now a taint sink (Sink(Cap::HTML_ESCAPE)), taint-confirmed rather than flagged on every writer call."
}
]
}