mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-06 19:35:13 +02:00
19b578c5c4
* chore: Exclude CLAUDE.md from Cargo.toml * feat: Add configurable analysis rules and CLI commands for custom sanitizers and terminators * feat: Enhance resource management and analysis efficiency - Implemented parallel summary merging in `scan_filesystem` using rayon for improved performance. - Introduced `GlobalSummaries::merge()` for efficient merging of summaries. - Optimized file reading and hashing to eliminate redundant I/O operations. - Added `should_scan_with_hash()` and `upsert_file_with_hash()` methods to streamline file processing. - Enhanced taint analysis with in-place mutations to reduce memory allocations. - Updated resource acquisition patterns to exclude false positives for `freopen` and wrapper functions. * feat: Implement severity downgrade for findings in non-production paths and add source kind inference * feat: Update versioning information in SECURITY.md for new stable line * feat: Update categories in Cargo.toml to include parser-implementations and text-processing * feat: Update dependencies in Cargo.lock for improved compatibility and performance * feat: Update dependencies in Cargo.lock and Cargo.toml for improved compatibility
73 lines
2.4 KiB
Rust
73 lines
2.4 KiB
Rust
use crate::labels::{Cap, DataLabel, Kind, LabelRule, ParamConfig};
|
|
use phf::{Map, phf_map};
|
|
|
|
pub static RULES: &[LabelRule] = &[
|
|
// ─────────── Sources ───────────
|
|
LabelRule {
|
|
matchers: &["getenv"],
|
|
label: DataLabel::Source(Cap::all()),
|
|
},
|
|
LabelRule {
|
|
matchers: &["fgets", "scanf", "fscanf", "gets", "read"],
|
|
label: DataLabel::Source(Cap::all()),
|
|
},
|
|
// ───────── Sanitizers ──────────
|
|
LabelRule {
|
|
matchers: &["sanitize_"],
|
|
label: DataLabel::Sanitizer(Cap::HTML_ESCAPE),
|
|
},
|
|
// ─────────── Sinks ─────────────
|
|
LabelRule {
|
|
matchers: &[
|
|
"system", "popen", "exec", "execl", "execlp", "execle", "execve", "execvp",
|
|
],
|
|
label: DataLabel::Sink(Cap::SHELL_ESCAPE),
|
|
},
|
|
LabelRule {
|
|
matchers: &["sprintf", "strcpy", "strcat"],
|
|
label: DataLabel::Sink(Cap::HTML_ESCAPE),
|
|
},
|
|
LabelRule {
|
|
matchers: &["printf", "fprintf"],
|
|
label: DataLabel::Sink(Cap::FMT_STRING),
|
|
},
|
|
];
|
|
|
|
pub static KINDS: Map<&'static str, Kind> = phf_map! {
|
|
// control-flow
|
|
"if_statement" => Kind::If,
|
|
"while_statement" => Kind::While,
|
|
"for_statement" => Kind::For,
|
|
"do_statement" => Kind::While,
|
|
|
|
"return_statement" => Kind::Return,
|
|
"break_statement" => Kind::Break,
|
|
"continue_statement" => Kind::Continue,
|
|
|
|
// structure
|
|
"translation_unit" => Kind::SourceFile,
|
|
"compound_statement" => Kind::Block,
|
|
"function_definition" => Kind::Function,
|
|
|
|
// data-flow
|
|
"call_expression" => Kind::CallFn,
|
|
"assignment_expression" => Kind::Assignment,
|
|
"declaration" => Kind::CallWrapper,
|
|
"expression_statement" => Kind::CallWrapper,
|
|
|
|
// trivia
|
|
"comment" => Kind::Trivia,
|
|
";" => Kind::Trivia, "," => Kind::Trivia,
|
|
"(" => Kind::Trivia, ")" => Kind::Trivia,
|
|
"{" => Kind::Trivia, "}" => Kind::Trivia,
|
|
"\n" => Kind::Trivia,
|
|
"preproc_include" => Kind::Trivia,
|
|
"preproc_def" => Kind::Trivia,
|
|
};
|
|
|
|
pub static PARAM_CONFIG: ParamConfig = ParamConfig {
|
|
params_field: "parameters",
|
|
param_node_kinds: &["parameter_declaration"],
|
|
self_param_kinds: &[],
|
|
ident_fields: &["declarator", "name"],
|
|
};
|