mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-09 19:45:13 +02:00
* feat: Add const_bound_vars tracking to prevent false positives in ownership checks
* feat: Introduce field interner and typed bounded vars for enhanced type tracking
* feat: Add typed_call_receivers and typed_bounded_dto_fields for enhanced type tracking
* feat: Centralize method name extraction with bare_method_name helper
* feat: Implement Phase-6 hierarchy fan-out for runtime virtual dispatch
* feat: Enhance C++ taint tracking with additional container operations and inline method resolution
* feat: Introduce field-sensitive points-to analysis for enhanced resource tracking
* feat: Implement Pointer-Phase 6 subscript handling for enhanced container analysis
* test: Add comprehensive tests for JavaScript control flow constructs and lattice operations
* docs: Update advanced analysis documentation with field-sensitive points-to and hierarchy fan-out details
* test: Add comprehensive tests for lattice algebra laws and SSA edge cases
* feat: Add destructured session user handling and safe user ID access patterns
* feat: Implement row-population reverse-walk for enhanced authorization checks
* feat: Enhance authorization checks with local alias chain for self-actor types
* feat: Introduce ActiveRecord query safety checks and enhance snippet extraction
* feat: Implement chained method call inner-gate rebinding for SSRF prevention
* feat: Add observability and error modules, enhance debug functionality, and implement theme context
* feat: Remove Auth Analysis page and update navigation to redirect to Explorer
* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor
* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor
* feat: Reset path-safe-suppressed spans before lowering to maintain analysis integrity
* fix(ssa): ungate debug_assert_bfs_ordering for release-tests build
The helper at src/ssa/lower.rs was gated `#[cfg(debug_assertions)]` while
the unit test at the bottom of the file was gated only `#[cfg(test)]`.
Since `cfg(test)` is set in release builds with `--tests` but
`cfg(debug_assertions)` is not, `cargo build --release --tests` failed
with E0425. Removing the gate fixes the build; the body is `debug_assert!`
only, so the helper is free in release. Also drop the gate at the call
site to avoid a `dead_code` warning when the lib is built without
`--tests`.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* test(closure-capture): flip JS/TS fixtures to required-finding
The JS and TS closure-capture fixtures pinned the old broken behaviour
via `forbidden_findings: [{ "id_prefix": "taint-" }]`. The engine now
correctly traces taint through the closure boundary (env source captured
by an arrow function, sunk via `child_process.exec` inside the body), so
the formerly-forbidden finding is a true positive.
Match the Python sibling's shape — `required_findings` with
`id_prefix` + `min_count` plus a small `noise_budget` — and rewrite the
companion READMEs and the phase8_fragility_tests doc-comments from
"known gap" to "regression guard".
Verified:
- cargo test --release --test phase8_fragility_tests → 8/8 pass
- cargo test --release --lib bfs_assertion → pass
- corpus benchmark F1 = 0.9976 (TP=205, FP=1, FN=0) — unchanged
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat: Add OWASP mapping and baseline mutation hooks for enhanced security analysis
* feat: Introduce health module and enhance health score computation with calibration tests
* feat: Add expectations configuration and cleanup .gitignore for log files
* feat: Implement theme selection and enhance settings panel for triage sync
* feat: Suppress false positives for strcpy calls with literal sources in AST
* feat: Update analyse_function_ssa to return body CFG for accurate analysis
* feat: Add bug report and feature request templates for improved issue tracking
* feat: removed dev scripts
* feat: update README.md for clarity and consistency in fixture descriptions
* feat: removed dev docs
* feat: clean up error handling and UI elements for improved user experience
* feat: adjust button sizes in HeaderBar for better UI consistency
* feat: enhance taint analysis with additional context for sanitizer and taint findings
* cargo fmt
* prettier
* refactor: simplify conditional checks and improve code readability in AST and screenshot capture scripts
* feat: add script to frame PNG screenshots with brand gradient
* feat: add fuzzing support with new targets and CI workflows
* refactor: streamline match expressions and improve formatting in CLI and output handling
* feat: enhance configuration display with detailed output options
* feat: stage demo configuration for improved CLI screenshot output
* feat: expose merge_configs function for user-configurable settings
* refactor: simplify code structure and improve readability in config handling
* refactor: improve descriptions for vulnerability patterns in various languages
* feat: update MIT License section with additional usage details and copyright information
* feat: update screenshots
* refactor: update build process and paths for frontend assets
* feat: add cross-file taint fuzzing target and supporting dictionary
* refactor: clean up formatting and comments in fuzz configuration and example files
* refactor: remove outdated comments and clean up CI configuration files
* chore: update changelog dates and improve formatting in documentation
* refactor: update Cargo.toml and CI configuration for improved packaging and build process
* refactor: enhance quote-stripping logic to prevent panics and add regression tests
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
182 lines
5.5 KiB
Rust
182 lines
5.5 KiB
Rust
//! Unified error type for HTTP route handlers.
|
|
//!
|
|
//! All routes should return [`ApiResult<T>`] (an alias for `Result<T, ApiError>`).
|
|
//! `ApiError` serializes as `{ "error": "<human msg>", "code": "<machine code>",
|
|
//! "detail"?: ... }` and carries the HTTP status code through `IntoResponse`.
|
|
|
|
use axum::Json;
|
|
use axum::http::StatusCode;
|
|
use axum::response::{IntoResponse, Response};
|
|
use serde::Serialize;
|
|
use serde_json::Value;
|
|
|
|
/// Machine-readable error codes. Stable strings the frontend can branch on.
|
|
#[derive(Debug, Clone, Copy)]
|
|
pub enum ApiCode {
|
|
BadRequest,
|
|
Forbidden,
|
|
NotFound,
|
|
Conflict,
|
|
PayloadTooLarge,
|
|
Unprocessable,
|
|
Internal,
|
|
ServiceUnavailable,
|
|
}
|
|
|
|
impl ApiCode {
|
|
fn as_str(self) -> &'static str {
|
|
match self {
|
|
ApiCode::BadRequest => "bad_request",
|
|
ApiCode::Forbidden => "forbidden",
|
|
ApiCode::NotFound => "not_found",
|
|
ApiCode::Conflict => "conflict",
|
|
ApiCode::PayloadTooLarge => "payload_too_large",
|
|
ApiCode::Unprocessable => "unprocessable",
|
|
ApiCode::Internal => "internal",
|
|
ApiCode::ServiceUnavailable => "service_unavailable",
|
|
}
|
|
}
|
|
|
|
fn status(self) -> StatusCode {
|
|
match self {
|
|
ApiCode::BadRequest => StatusCode::BAD_REQUEST,
|
|
ApiCode::Forbidden => StatusCode::FORBIDDEN,
|
|
ApiCode::NotFound => StatusCode::NOT_FOUND,
|
|
ApiCode::Conflict => StatusCode::CONFLICT,
|
|
ApiCode::PayloadTooLarge => StatusCode::PAYLOAD_TOO_LARGE,
|
|
ApiCode::Unprocessable => StatusCode::UNPROCESSABLE_ENTITY,
|
|
ApiCode::Internal => StatusCode::INTERNAL_SERVER_ERROR,
|
|
ApiCode::ServiceUnavailable => StatusCode::SERVICE_UNAVAILABLE,
|
|
}
|
|
}
|
|
}
|
|
|
|
#[derive(Debug)]
|
|
pub struct ApiError {
|
|
code: ApiCode,
|
|
message: String,
|
|
detail: Option<Value>,
|
|
}
|
|
|
|
impl ApiError {
|
|
pub fn new(code: ApiCode, message: impl Into<String>) -> Self {
|
|
Self {
|
|
code,
|
|
message: message.into(),
|
|
detail: None,
|
|
}
|
|
}
|
|
|
|
pub fn with_detail(mut self, detail: Value) -> Self {
|
|
self.detail = Some(detail);
|
|
self
|
|
}
|
|
|
|
pub fn bad_request(msg: impl Into<String>) -> Self {
|
|
Self::new(ApiCode::BadRequest, msg)
|
|
}
|
|
pub fn forbidden(msg: impl Into<String>) -> Self {
|
|
Self::new(ApiCode::Forbidden, msg)
|
|
}
|
|
pub fn not_found(msg: impl Into<String>) -> Self {
|
|
Self::new(ApiCode::NotFound, msg)
|
|
}
|
|
pub fn conflict(msg: impl Into<String>) -> Self {
|
|
Self::new(ApiCode::Conflict, msg)
|
|
}
|
|
pub fn unprocessable(msg: impl Into<String>) -> Self {
|
|
Self::new(ApiCode::Unprocessable, msg)
|
|
}
|
|
pub fn internal(msg: impl Into<String>) -> Self {
|
|
Self::new(ApiCode::Internal, msg)
|
|
}
|
|
pub fn service_unavailable(msg: impl Into<String>) -> Self {
|
|
Self::new(ApiCode::ServiceUnavailable, msg)
|
|
}
|
|
}
|
|
|
|
#[derive(Serialize)]
|
|
struct ApiErrorBody<'a> {
|
|
error: &'a str,
|
|
code: &'a str,
|
|
#[serde(skip_serializing_if = "Option::is_none")]
|
|
detail: Option<&'a Value>,
|
|
}
|
|
|
|
impl IntoResponse for ApiError {
|
|
fn into_response(self) -> Response {
|
|
let body = ApiErrorBody {
|
|
error: &self.message,
|
|
code: self.code.as_str(),
|
|
detail: self.detail.as_ref(),
|
|
};
|
|
(
|
|
self.code.status(),
|
|
Json(serde_json::to_value(&body).unwrap()),
|
|
)
|
|
.into_response()
|
|
}
|
|
}
|
|
|
|
impl From<StatusCode> for ApiError {
|
|
fn from(status: StatusCode) -> Self {
|
|
let code = match status {
|
|
StatusCode::BAD_REQUEST => ApiCode::BadRequest,
|
|
StatusCode::FORBIDDEN => ApiCode::Forbidden,
|
|
StatusCode::NOT_FOUND => ApiCode::NotFound,
|
|
StatusCode::CONFLICT => ApiCode::Conflict,
|
|
StatusCode::PAYLOAD_TOO_LARGE => ApiCode::PayloadTooLarge,
|
|
StatusCode::UNPROCESSABLE_ENTITY => ApiCode::Unprocessable,
|
|
StatusCode::SERVICE_UNAVAILABLE => ApiCode::ServiceUnavailable,
|
|
_ => ApiCode::Internal,
|
|
};
|
|
Self::new(
|
|
code,
|
|
status.canonical_reason().unwrap_or("error").to_string(),
|
|
)
|
|
}
|
|
}
|
|
|
|
impl From<std::io::Error> for ApiError {
|
|
fn from(err: std::io::Error) -> Self {
|
|
Self::internal(err.to_string())
|
|
}
|
|
}
|
|
|
|
impl From<serde_json::Error> for ApiError {
|
|
fn from(err: serde_json::Error) -> Self {
|
|
Self::bad_request(format!("invalid JSON: {err}"))
|
|
}
|
|
}
|
|
|
|
pub type ApiResult<T> = Result<T, ApiError>;
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
use axum::body::to_bytes;
|
|
|
|
#[tokio::test]
|
|
async fn serializes_with_error_code_detail() {
|
|
let err = ApiError::not_found("scan not found").with_detail(serde_json::json!({"id":"x"}));
|
|
let resp = err.into_response();
|
|
assert_eq!(resp.status(), StatusCode::NOT_FOUND);
|
|
let body = to_bytes(resp.into_body(), 8 * 1024).await.unwrap();
|
|
let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
|
|
assert_eq!(v["error"], "scan not found");
|
|
assert_eq!(v["code"], "not_found");
|
|
assert_eq!(v["detail"]["id"], "x");
|
|
}
|
|
|
|
#[test]
|
|
fn omits_detail_when_absent() {
|
|
let err = ApiError::bad_request("bad input");
|
|
let body = ApiErrorBody {
|
|
error: &err.message,
|
|
code: err.code.as_str(),
|
|
detail: err.detail.as_ref(),
|
|
};
|
|
let s = serde_json::to_string(&body).unwrap();
|
|
assert!(!s.contains("detail"), "expected no detail key, got {s}");
|
|
}
|
|
}
|