mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-06 19:35:13 +02:00
f96a89e7c1
* feat: Enhance control flow analysis with function summaries and taint analysis * feat: Update taint analysis to utilize function summaries for enhanced tracking * Refactor `walk.rs` batch processing and override handling: - Renamed `Batcher` to `BatchSender` for clarity. - Added `BatchSender::new` constructor for cleaner initialization. - Simplified batch size management in `BatchSender`. - Extracted `build_overrides` function for reusable override construction. - Improved error handling and validation in override building. - Enhanced performance with directory and file type filtering in `walk`. * Improve logging and streamline directory walk process: - Added detailed `tracing` logs for debugging batch flushes, override construction, and walk initialization/completion. - Optimized and simplified `filter_entry` logic for directory and file type filters. - Improved metadata checks and max file size enforcement during the scan. * Refactor and optimize taint tracking, label rules, and directory walk process: - Replaced `DefaultHasher` with `blake3::Hasher` for improved taint hashing. - Enhanced sorting and hashing logic in `taint.rs` for consistency and efficiency. - Removed unused `set_hash` function and redundant imports across files. - Improved batch sender logic in `walk.rs`, renaming key components for clarity. - Unified `spawn_senders` and `spawn_file_walker` with thread handling and channel tuple return. - Expanded label rules with additional matchers for sources, sanitizers, and sinks. - Deprecated `dump_cfg` and specific logging utilities in `cfg.rs` for code cleanup. * fix: fixed let chains error in walk.rs * fix: updated dependencies * fix: updated dependencies * chore: Remove standard error in scan.rs * feat: Introduce function summaries for enhanced taint and control flow analysis * feat: Enhance taint analysis with interop support and function summaries * feat: Add configuration analysis module and enhance matcher rules * feat: Add arity column to function_summaries and handle schema migration * fix: fixed clippy &PathBuf warnings * chore: Update dependencies and versioning in Cargo files * docs: Update README to enhance clarity and detail on features and analysis modes * chore: Update CHANGELOG for version 0.2.0 with new features, changes, and fixes * docs: Update SECURITY.md to clarify version support status --------- Co-authored-by: elipeter <eli.peter@es.fcm.travel>
75 lines
1.9 KiB
Go
75 lines
1.9 KiB
Go
package main
|
|
|
|
import (
|
|
"database/sql"
|
|
"fmt"
|
|
"log"
|
|
"os"
|
|
"os/exec"
|
|
)
|
|
|
|
// ───── Database initialization ─────
|
|
|
|
// InitDB opens a database connection using credentials from environment.
|
|
// VULN: os.Getenv flows into db.Exec for schema setup
|
|
func InitDB() (*sql.DB, error) {
|
|
dsn := os.Getenv("DATABASE_DSN")
|
|
db, err := sql.Open("postgres", dsn)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
// Run schema setup from env
|
|
schema := os.Getenv("SCHEMA_SQL")
|
|
_, err = db.Exec(schema)
|
|
if err != nil {
|
|
log.Printf("schema setup failed: %v", err)
|
|
}
|
|
|
|
return db, nil
|
|
}
|
|
|
|
// ───── Data export ─────
|
|
|
|
// ExportTable dumps a table to CSV using pg_dump.
|
|
// VULN: os.Getenv flows into exec.Command (command injection)
|
|
func ExportTable(tableName string) error {
|
|
dbURL := os.Getenv("DATABASE_URL")
|
|
dumpCmd := fmt.Sprintf("pg_dump --table=%s --format=csv %s", tableName, dbURL)
|
|
out, err := exec.Command("sh", "-c", dumpCmd).Output()
|
|
if err != nil {
|
|
return fmt.Errorf("export failed: %w", err)
|
|
}
|
|
log.Printf("Exported %d bytes", len(out))
|
|
return nil
|
|
}
|
|
|
|
// ───── Audit logging ─────
|
|
|
|
// LogAuditEvent writes an audit record using env-driven SQL.
|
|
// VULN: os.Getenv flows into db.Exec
|
|
func LogAuditEvent(db *sql.DB, event string) error {
|
|
tableName := os.Getenv("AUDIT_TABLE")
|
|
query := fmt.Sprintf("INSERT INTO %s (event, ts) VALUES ('%s', NOW())", tableName, event)
|
|
_, err := db.Exec(query)
|
|
return err
|
|
}
|
|
|
|
// ───── Health check ─────
|
|
|
|
// CheckDependencies pings all external services.
|
|
// VULN: os.Getenv flows into exec.Command
|
|
func CheckDependencies() error {
|
|
endpoints := []string{
|
|
os.Getenv("REDIS_HOST"),
|
|
os.Getenv("KAFKA_HOST"),
|
|
os.Getenv("ELASTICSEARCH_HOST"),
|
|
}
|
|
for _, ep := range endpoints {
|
|
cmd := exec.Command("nc", "-z", ep, "6379")
|
|
if err := cmd.Run(); err != nil {
|
|
return fmt.Errorf("dependency %s unreachable: %w", ep, err)
|
|
}
|
|
}
|
|
return nil
|
|
}
|