mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-09 19:45:13 +02:00
1bbe4b1cfb
* chore: Exclude CLAUDE.md from Cargo.toml * feat: add callgraph module and integrate into main analysis flow * feat: enhance CLI with new severity filtering and analysis modes * feat: update CHANGELOG with recent enhancements and fixes to severity filtering and output handling * feat: implement state-model dataflow analysis for resource lifecycle and auth state * feat: enhance diagnostic output formatting and add evidence structure * feat: implement attack surface ranking for diagnostics with scoring and sorting * feat: add comprehensive documentation for installation, usage, and rules reference * feat: add multiple language support for command execution and evaluation endpoints * feat: implement inline suppression for findings using `nyx:ignore` comments * feat: add confidence levels to AST patterns and update output structure * feat: implement low-noise prioritization system with category filtering, rollup grouping, and configurable budgets * feat: bump version to 0.4.0 and update changelog with new features and improvements * feat: add dead code allowances to various functions in mod.rs and real_world_tests.rs
51 lines
1,005 B
Python
51 lines
1,005 B
Python
# Positive fixture: each snippet should trigger the named pattern.
|
|
|
|
import os
|
|
import subprocess
|
|
import pickle
|
|
import yaml
|
|
import hashlib
|
|
|
|
# py.code_exec.eval
|
|
def trigger_eval(data):
|
|
result = eval(data)
|
|
|
|
# py.code_exec.exec
|
|
def trigger_exec(code):
|
|
exec(code)
|
|
|
|
# py.code_exec.compile
|
|
def trigger_compile(code):
|
|
co = compile(code, "<string>", "exec")
|
|
|
|
# py.cmdi.os_system
|
|
def trigger_os_system(cmd):
|
|
os.system(cmd)
|
|
|
|
# py.cmdi.os_popen
|
|
def trigger_os_popen(cmd):
|
|
os.popen(cmd)
|
|
|
|
# py.cmdi.subprocess_shell
|
|
def trigger_subprocess_shell(cmd):
|
|
subprocess.run(cmd, shell=True)
|
|
|
|
# py.deser.pickle_loads
|
|
def trigger_pickle(data):
|
|
obj = pickle.loads(data)
|
|
|
|
# py.deser.yaml_load
|
|
def trigger_yaml(data):
|
|
obj = yaml.load(data)
|
|
|
|
# py.sqli.execute_format
|
|
def trigger_sql_concat(cursor, user):
|
|
cursor.execute("SELECT * FROM users WHERE name = '" + user + "'")
|
|
|
|
# py.crypto.md5
|
|
def trigger_md5(data):
|
|
hashlib.md5(data)
|
|
|
|
# py.crypto.sha1
|
|
def trigger_sha1(data):
|
|
hashlib.sha1(data)
|