nyx/docs/rules/c.md

C Rules

Nyx detects C vulnerabilities through AST patterns (banned functions, format strings) and taint analysis (user input → shell execution, buffer overflow sinks).

Taint Sources

Function	Capability	Source Kind
getenv	all	EnvironmentConfig
fgets, scanf, fscanf, gets, read	all	UserInput

Taint Sinks

Function	Required Capability
system, popen, exec* family	SHELL_ESCAPE
sprintf, strcpy, strcat	HTML_ESCAPE
printf, fprintf	FMT_STRING
fopen, open	FILE_IO

---

AST Pattern Rules

Memory Safety (Banned Functions)

Rule ID	Severity	Tier	Description
c.memory.gets	High	A	gets() — no bounds checking, always exploitable
c.memory.strcpy	High	A	strcpy() — no bounds checking on destination buffer
c.memory.strcat	High	A	strcat() — no bounds checking on destination buffer
c.memory.sprintf	High	A	sprintf() — no length limit on output buffer
c.memory.scanf_percent_s	High	A	scanf("%s") — unbounded string read
c.memory.printf_no_fmt	High	B	printf(var) — format-string vulnerability (non-literal first arg)

Command Execution

Rule ID	Severity	Tier	Description
c.cmdi.system	High	A	system() — shell command execution
c.cmdi.popen	Medium	A	popen() — shell command execution with pipe

---

Examples

c.memory.gets — Banned function

Vulnerable:

char buf[64];
gets(buf);  // No bounds checking — buffer overflow

Safe alternative:

char buf[64];
fgets(buf, sizeof(buf), stdin);

c.memory.printf_no_fmt — Format string

Vulnerable:

char *user_input = get_input();
printf(user_input);  // Format string vulnerability

Safe alternative:

char *user_input = get_input();
printf("%s", user_input);

c.cmdi.system — Shell execution

Vulnerable:

char cmd[256];
snprintf(cmd, sizeof(cmd), "ls %s", user_dir);
system(cmd);  // Command injection if user_dir contains shell metacharacters

Safe alternative:

// Use execvp with explicit argument array
char *args[] = {"ls", user_dir, NULL};
execvp("ls", args);