apunkt/nyx

mirror of https://github.com/elicpeter/nyx.git synced 2026-06-09 19:45:13 +02:00

* feat: Add const_bound_vars tracking to prevent false positives in ownership checks

* feat: Introduce field interner and typed bounded vars for enhanced type tracking

* feat: Add typed_call_receivers and typed_bounded_dto_fields for enhanced type tracking

* feat: Centralize method name extraction with bare_method_name helper

* feat: Implement Phase-6 hierarchy fan-out for runtime virtual dispatch

* feat: Enhance C++ taint tracking with additional container operations and inline method resolution

* feat: Introduce field-sensitive points-to analysis for enhanced resource tracking

* feat: Implement Pointer-Phase 6 subscript handling for enhanced container analysis

* test: Add comprehensive tests for JavaScript control flow constructs and lattice operations

* docs: Update advanced analysis documentation with field-sensitive points-to and hierarchy fan-out details

* test: Add comprehensive tests for lattice algebra laws and SSA edge cases

* feat: Add destructured session user handling and safe user ID access patterns

* feat: Implement row-population reverse-walk for enhanced authorization checks

* feat: Enhance authorization checks with local alias chain for self-actor types

* feat: Introduce ActiveRecord query safety checks and enhance snippet extraction

* feat: Implement chained method call inner-gate rebinding for SSRF prevention

* feat: Add observability and error modules, enhance debug functionality, and implement theme context

* feat: Remove Auth Analysis page and update navigation to redirect to Explorer

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Reset path-safe-suppressed spans before lowering to maintain analysis integrity

* fix(ssa): ungate debug_assert_bfs_ordering for release-tests build

The helper at src/ssa/lower.rs was gated `#[cfg(debug_assertions)]` while
the unit test at the bottom of the file was gated only `#[cfg(test)]`.
Since `cfg(test)` is set in release builds with `--tests` but
`cfg(debug_assertions)` is not, `cargo build --release --tests` failed
with E0425. Removing the gate fixes the build; the body is `debug_assert!`
only, so the helper is free in release. Also drop the gate at the call
site to avoid a `dead_code` warning when the lib is built without
`--tests`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(closure-capture): flip JS/TS fixtures to required-finding

The JS and TS closure-capture fixtures pinned the old broken behaviour
via `forbidden_findings: [{ "id_prefix": "taint-" }]`. The engine now
correctly traces taint through the closure boundary (env source captured
by an arrow function, sunk via `child_process.exec` inside the body), so
the formerly-forbidden finding is a true positive.

Match the Python sibling's shape — `required_findings` with
`id_prefix` + `min_count` plus a small `noise_budget` — and rewrite the
companion READMEs and the phase8_fragility_tests doc-comments from
"known gap" to "regression guard".

Verified:
- cargo test --release --test phase8_fragility_tests → 8/8 pass
- cargo test --release --lib bfs_assertion → pass
- corpus benchmark F1 = 0.9976 (TP=205, FP=1, FN=0) — unchanged

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat: Add OWASP mapping and baseline mutation hooks for enhanced security analysis

* feat: Introduce health module and enhance health score computation with calibration tests

* feat: Add expectations configuration and cleanup .gitignore for log files

* feat: Implement theme selection and enhance settings panel for triage sync

* feat: Suppress false positives for strcpy calls with literal sources in AST

* feat: Update analyse_function_ssa to return body CFG for accurate analysis

* feat: Add bug report and feature request templates for improved issue tracking

* feat: removed dev scripts

* feat: update README.md for clarity and consistency in fixture descriptions

* feat: removed dev docs

* feat: clean up error handling and UI elements for improved user experience

* feat: adjust button sizes in HeaderBar for better UI consistency

* feat: enhance taint analysis with additional context for sanitizer and taint findings

* cargo fmt

* prettier

* refactor: simplify conditional checks and improve code readability in AST and screenshot capture scripts

* feat: add script to frame PNG screenshots with brand gradient

* feat: add fuzzing support with new targets and CI workflows

* refactor: streamline match expressions and improve formatting in CLI and output handling

* feat: enhance configuration display with detailed output options

* feat: stage demo configuration for improved CLI screenshot output

* feat: expose merge_configs function for user-configurable settings

* refactor: simplify code structure and improve readability in config handling

* refactor: improve descriptions for vulnerability patterns in various languages

* feat: update MIT License section with additional usage details and copyright information

* feat: update screenshots

* refactor: update build process and paths for frontend assets

* feat: add cross-file taint fuzzing target and supporting dictionary

* refactor: clean up formatting and comments in fuzz configuration and example files

* refactor: remove outdated comments and clean up CI configuration files

* chore: update changelog dates and improve formatting in documentation

* refactor: update Cargo.toml and CI configuration for improved packaging and build process

* refactor: enhance quote-stripping logic to prevent panics and add regression tests

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-29 00:58:38 -04:00

4.3 KiB

Raw Blame History

scripts

Local helpers for repo-wide checks and a couple of one-off tools.

Script	What it does
`fix.sh`	Apply all auto-fixes (clippy, fmt, eslint, prettier), then run tests.
`check.sh`	Verify only (no fixes). Mirrors the GitHub Actions CI workflow.
`cached-cargo-test.sh`	Wrap `cargo test` with a source-hash cache; concurrent invocations of the same args share one run.
`capture-screenshots.mjs`	Capture the README stills and demo GIF from a running `nyx serve`. Needs Playwright and ffmpeg.
`frame-screenshots.py`	Wrap a PNG in the brand purple gradient. Called by `capture-screenshots.mjs` as its final phase, but can be run standalone.

Fixers stream their output (so you can see what changed); tests run quietly and only show output if they fail. Both scripts print a green/red summary at the end and exit non-zero if any step failed.

Usage

./scripts/fix.sh                # fix everything + run tests
./scripts/fix.sh --no-tests     # just apply fixes
./scripts/fix.sh --rust-only    # skip frontend
./scripts/fix.sh --frontend-only

./scripts/check.sh              # verify everything (CI-equivalent)
./scripts/check.sh --rust-only

Scripts can be run from any directory; they resolve the repo root from their own location.

Cached cargo test

Wraps cargo test. The first run executes normally and records its output keyed by a hash of the source tree. Later runs with the same args and an unchanged tree return the cached output. Concurrent callers share a single cargo run via a mkdir lock.

./scripts/cached-cargo-test.sh --lib
./scripts/cached-cargo-test.sh --tests
FORCE_CARGO=1 ./scripts/cached-cargo-test.sh --lib   # bypass cache

Use it for full-suite invocations. Narrow per-test runs (cargo test some_function) are fast on their own and just clutter the cache.

Capture screenshots

Regenerates assets/screenshots/*.png and assets/screenshots/demo.gif for the README and docs/. Requires Playwright, ffmpeg, and Python 3 with Pillow on PATH, plus a running nyx serve on $NYX_URL (default http://127.0.0.1:9876). The served scan root must have no prior scans.

node scripts/capture-screenshots.mjs --stills   # only PNGs
node scripts/capture-screenshots.mjs --gif      # only the GIF
node scripts/capture-screenshots.mjs --all      # both

The script writes a synthetic demo to $SCAN_ROOT (default /tmp/nyx-demo-app). V1 has four endpoints and produces a 5-hop CMDi taint flow that the GIF drills into. After scan #1 the script overwrites the demo with V2 (just that one flow) and runs scan #2 via the API, so the overview trend chart shows findings going down.

Stills are captured in two phases:

After scan #1 (more findings): serve-findings-list.png, serve-finding-detail.png.
After scan #2 (trend established): serve-overview.png, serve-triage.png, serve-explorer.png, serve-scans.png, serve-scan-detail.png, serve-rules.png, serve-config.png.

Then frame-screenshots.py runs over every captured PNG and wraps it in the brand purple gradient (1800x1113 outer, 1600x992 inner, 12px rounded corners, top-left #8a5bf5 to bottom-right #4d1d97). Finally, docs/serve-overview.png is copied to the top-level overview.png because that is the path the README references.

GIF storyboard:

Empty dashboard with the "Run your first scan" prompt.
Click Start Scan in the header bar to open the modal.
Confirm in the modal and wait for the scan to finish.
Back to the overview, scroll down through the cards, scroll back.
Click Findings in the sidebar.
Click the 5-hop taint row.
On the finding detail, expand Evidence, Analysis Notes, and Confidence Reasoning.
Open the triage status dropdown and dismiss it.
Navigate to /debug/call-graph for the closing visual.

To frame an existing PNG without re-capturing:

python3 scripts/frame-screenshots.py path/to/foo.png [...]

Run with no args to re-frame every PNG under assets/screenshots/.

4.3 KiB Raw Blame History

scripts

Usage

Cached cargo test

Capture screenshots

4.3 KiB

Raw Blame History