mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-06 19:35:13 +02:00
1bbe4b1cfb
* chore: Exclude CLAUDE.md from Cargo.toml * feat: add callgraph module and integrate into main analysis flow * feat: enhance CLI with new severity filtering and analysis modes * feat: update CHANGELOG with recent enhancements and fixes to severity filtering and output handling * feat: implement state-model dataflow analysis for resource lifecycle and auth state * feat: enhance diagnostic output formatting and add evidence structure * feat: implement attack surface ranking for diagnostics with scoring and sorting * feat: add comprehensive documentation for installation, usage, and rules reference * feat: add multiple language support for command execution and evaluation endpoints * feat: implement inline suppression for findings using `nyx:ignore` comments * feat: add confidence levels to AST patterns and update output structure * feat: implement low-noise prioritization system with category filtering, rollup grouping, and configurable budgets * feat: bump version to 0.4.0 and update changelog with new features and improvements * feat: add dead code allowances to various functions in mod.rs and real_world_tests.rs
133 lines
4.5 KiB
Rust
133 lines
4.5 KiB
Rust
use crate::labels::{Cap, DataLabel, Kind, LabelRule, ParamConfig};
|
|
use phf::{Map, phf_map};
|
|
|
|
pub static RULES: &[LabelRule] = &[
|
|
// ─────────── Sources ───────────
|
|
// Note: PHP `$` prefix is stripped by collect_idents, so match without `$`.
|
|
LabelRule {
|
|
matchers: &[
|
|
"$_GET",
|
|
"_GET",
|
|
"$_POST",
|
|
"_POST",
|
|
"$_REQUEST",
|
|
"_REQUEST",
|
|
"$_COOKIE",
|
|
"_COOKIE",
|
|
"$_FILES",
|
|
"_FILES",
|
|
"$_SERVER",
|
|
"_SERVER",
|
|
"$_ENV",
|
|
"_ENV",
|
|
],
|
|
label: DataLabel::Source(Cap::all()),
|
|
},
|
|
LabelRule {
|
|
matchers: &["file_get_contents", "fread"],
|
|
label: DataLabel::Source(Cap::all()),
|
|
},
|
|
// ───────── Sanitizers ──────────
|
|
LabelRule {
|
|
matchers: &["htmlspecialchars", "htmlentities"],
|
|
label: DataLabel::Sanitizer(Cap::HTML_ESCAPE),
|
|
},
|
|
LabelRule {
|
|
matchers: &["escapeshellarg", "escapeshellcmd"],
|
|
label: DataLabel::Sanitizer(Cap::SHELL_ESCAPE),
|
|
},
|
|
LabelRule {
|
|
matchers: &["basename"],
|
|
label: DataLabel::Sanitizer(Cap::FILE_IO),
|
|
},
|
|
// ─────────── Sinks ─────────────
|
|
LabelRule {
|
|
matchers: &[
|
|
"system",
|
|
"exec",
|
|
"passthru",
|
|
"shell_exec",
|
|
"proc_open",
|
|
"popen",
|
|
],
|
|
label: DataLabel::Sink(Cap::SHELL_ESCAPE),
|
|
},
|
|
LabelRule {
|
|
matchers: &["eval", "assert"],
|
|
label: DataLabel::Sink(Cap::SHELL_ESCAPE),
|
|
},
|
|
LabelRule {
|
|
matchers: &["include", "include_once", "require", "require_once"],
|
|
label: DataLabel::Sink(Cap::FILE_IO),
|
|
},
|
|
LabelRule {
|
|
matchers: &["unserialize"],
|
|
label: DataLabel::Sink(Cap::SHELL_ESCAPE),
|
|
},
|
|
LabelRule {
|
|
matchers: &["move_uploaded_file", "copy", "file_put_contents", "fwrite"],
|
|
label: DataLabel::Sink(Cap::FILE_IO),
|
|
},
|
|
LabelRule {
|
|
matchers: &["echo", "print"],
|
|
label: DataLabel::Sink(Cap::HTML_ESCAPE),
|
|
},
|
|
LabelRule {
|
|
matchers: &["mysqli_query", "pg_query", "query"],
|
|
label: DataLabel::Sink(Cap::SHELL_ESCAPE),
|
|
},
|
|
];
|
|
|
|
pub static KINDS: Map<&'static str, Kind> = phf_map! {
|
|
// control-flow
|
|
"if_statement" => Kind::If,
|
|
"while_statement" => Kind::While,
|
|
"for_statement" => Kind::For,
|
|
"foreach_statement" => Kind::For,
|
|
"do_statement" => Kind::While,
|
|
|
|
"return_statement" => Kind::Return,
|
|
"throw_expression" => Kind::Return,
|
|
"break_statement" => Kind::Break,
|
|
"continue_statement" => Kind::Continue,
|
|
|
|
// structure
|
|
"program" => Kind::SourceFile,
|
|
"compound_statement" => Kind::Block,
|
|
"else_clause" => Kind::Block,
|
|
"else_if_clause" => Kind::Block,
|
|
"function_definition" => Kind::Function,
|
|
"method_declaration" => Kind::Function,
|
|
"switch_statement" => Kind::Block,
|
|
"switch_block" => Kind::Block,
|
|
"case_statement" => Kind::Block,
|
|
"default_statement" => Kind::Block,
|
|
"try_statement" => Kind::Block,
|
|
"catch_clause" => Kind::Block,
|
|
"finally_clause" => Kind::Block,
|
|
"colon_block" => Kind::Block,
|
|
"class_declaration" => Kind::Block,
|
|
|
|
// data-flow
|
|
"function_call_expression" => Kind::CallFn,
|
|
"member_call_expression" => Kind::CallMethod,
|
|
"assignment_expression" => Kind::Assignment,
|
|
"expression_statement" => Kind::CallWrapper,
|
|
|
|
// trivia
|
|
"comment" => Kind::Trivia,
|
|
";" => Kind::Trivia, "," => Kind::Trivia,
|
|
"(" => Kind::Trivia, ")" => Kind::Trivia,
|
|
"{" => Kind::Trivia, "}" => Kind::Trivia,
|
|
"\n" => Kind::Trivia,
|
|
"php_tag" => Kind::Trivia,
|
|
"namespace_definition" => Kind::Trivia,
|
|
"namespace_use_declaration" => Kind::Trivia,
|
|
};
|
|
|
|
pub static PARAM_CONFIG: ParamConfig = ParamConfig {
|
|
params_field: "parameters",
|
|
param_node_kinds: &["simple_parameter", "variadic_parameter"],
|
|
self_param_kinds: &[],
|
|
ident_fields: &["name"],
|
|
};
|