nyx/frontend/src/pages/debug/PointerViewerPage.tsx
Eli Peter 82f18184b1
Prerelease cleanup (#46)
* feat: Add const_bound_vars tracking to prevent false positives in ownership checks

* feat: Introduce field interner and typed bounded vars for enhanced type tracking

* feat: Add typed_call_receivers and typed_bounded_dto_fields for enhanced type tracking

* feat: Centralize method name extraction with bare_method_name helper

* feat: Implement Phase-6 hierarchy fan-out for runtime virtual dispatch

* feat: Enhance C++ taint tracking with additional container operations and inline method resolution

* feat: Introduce field-sensitive points-to analysis for enhanced resource tracking

* feat: Implement Pointer-Phase 6 subscript handling for enhanced container analysis

* test: Add comprehensive tests for JavaScript control flow constructs and lattice operations

* docs: Update advanced analysis documentation with field-sensitive points-to and hierarchy fan-out details

* test: Add comprehensive tests for lattice algebra laws and SSA edge cases

* feat: Add destructured session user handling and safe user ID access patterns

* feat: Implement row-population reverse-walk for enhanced authorization checks

* feat: Enhance authorization checks with local alias chain for self-actor types

* feat: Introduce ActiveRecord query safety checks and enhance snippet extraction

* feat: Implement chained method call inner-gate rebinding for SSRF prevention

* feat: Add observability and error modules, enhance debug functionality, and implement theme context

* feat: Remove Auth Analysis page and update navigation to redirect to Explorer

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor

* feat: Reset path-safe-suppressed spans before lowering to maintain analysis integrity

* fix(ssa): ungate debug_assert_bfs_ordering for release-tests build

The helper at src/ssa/lower.rs was gated `#[cfg(debug_assertions)]` while
the unit test at the bottom of the file was gated only `#[cfg(test)]`.
Since `cfg(test)` is set in release builds with `--tests` but
`cfg(debug_assertions)` is not, `cargo build --release --tests` failed
with E0425. Removing the gate fixes the build; the body is `debug_assert!`
only, so the helper is free in release. Also drop the gate at the call
site to avoid a `dead_code` warning when the lib is built without
`--tests`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(closure-capture): flip JS/TS fixtures to required-finding

The JS and TS closure-capture fixtures pinned the old broken behaviour
via `forbidden_findings: [{ "id_prefix": "taint-" }]`. The engine now
correctly traces taint through the closure boundary (env source captured
by an arrow function, sunk via `child_process.exec` inside the body), so
the formerly-forbidden finding is a true positive.

Match the Python sibling's shape — `required_findings` with
`id_prefix` + `min_count` plus a small `noise_budget` — and rewrite the
companion READMEs and the phase8_fragility_tests doc-comments from
"known gap" to "regression guard".

Verified:
- cargo test --release --test phase8_fragility_tests → 8/8 pass
- cargo test --release --lib bfs_assertion → pass
- corpus benchmark F1 = 0.9976 (TP=205, FP=1, FN=0) — unchanged

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat: Add OWASP mapping and baseline mutation hooks for enhanced security analysis

* feat: Introduce health module and enhance health score computation with calibration tests

* feat: Add expectations configuration and cleanup .gitignore for log files

* feat: Implement theme selection and enhance settings panel for triage sync

* feat: Suppress false positives for strcpy calls with literal sources in AST

* feat: Update analyse_function_ssa to return body CFG for accurate analysis

* feat: Add bug report and feature request templates for improved issue tracking

* feat: removed dev scripts

* feat: update README.md for clarity and consistency in fixture descriptions

* feat: removed dev docs

* feat: clean up error handling and UI elements for improved user experience

* feat: adjust button sizes in HeaderBar for better UI consistency

* feat: enhance taint analysis with additional context for sanitizer and taint findings

* cargo fmt

* prettier

* refactor: simplify conditional checks and improve code readability in AST and screenshot capture scripts

* feat: add script to frame PNG screenshots with brand gradient

* feat: add fuzzing support with new targets and CI workflows

* refactor: streamline match expressions and improve formatting in CLI and output handling

* feat: enhance configuration display with detailed output options

* feat: stage demo configuration for improved CLI screenshot output

* feat: expose merge_configs function for user-configurable settings

* refactor: simplify code structure and improve readability in config handling

* refactor: improve descriptions for vulnerability patterns in various languages

* feat: update MIT License section with additional usage details and copyright information

* feat: update screenshots

* refactor: update build process and paths for frontend assets

* feat: add cross-file taint fuzzing target and supporting dictionary

* refactor: clean up formatting and comments in fuzz configuration and example files

* refactor: remove outdated comments and clean up CI configuration files

* chore: update changelog dates and improve formatting in documentation

* refactor: update Cargo.toml and CI configuration for improved packaging and build process

* refactor: enhance quote-stripping logic to prevent panics and add regression tests

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-29 00:58:38 -04:00

200 lines
5.3 KiB
TypeScript
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

import { useMemo } from 'react';
import { useDebugPointer } from '../../api/queries/debug';
import { ApiError } from '../../api/client';
import { EmptyState } from '../../components/ui/EmptyState';
import { ErrorState } from '../../components/ui/ErrorState';
import { LoadingState } from '../../components/ui/LoadingState';
import type {
PointerLocationView,
PointerValueView,
PointerFieldEntryView,
} from '../../api/types';
interface PointerAnalysisPanelProps {
file: string;
functionName: string;
}
export function PointerAnalysisPanel({
file,
functionName,
}: PointerAnalysisPanelProps) {
const { data, isLoading, error } = useDebugPointer(file, functionName);
if (isLoading) {
return <LoadingState message="Loading points-to facts..." />;
}
if (error) {
if (error instanceof ApiError && error.status === 404) {
return (
<EmptyState message="Pointer analysis is not available for the selected function." />
);
}
return <ErrorState message="Failed to load pointer analysis." />;
}
if (
!data ||
(data.values.length === 0 &&
data.field_reads.length === 0 &&
data.field_writes.length === 0)
) {
return (
<EmptyState message="No points-to facts were derived for this function. Pointer analysis flags up parameters, allocation sites, and field projections; functions that only manipulate scalars will appear empty." />
);
}
return (
<div className="abstract-interp-viewer">
<div className="abstract-block">
<div className="abstract-block-header">
<h3 style={{ margin: 0 }}>Per-Value Points-To</h3>
<span className="text-secondary">
{data.values.length} value
{data.values.length === 1 ? '' : 's'} · {data.location_count}{' '}
location
{data.location_count === 1 ? '' : 's'}
</span>
</div>
{data.values.length === 0 ? (
<p className="abstract-empty">
All SSA values point to nothing tracked.
</p>
) : (
<PointerValueTable values={data.values} locations={data.locations} />
)}
</div>
{data.field_reads.length > 0 && (
<FieldEntriesBlock
title="Field Reads"
entries={data.field_reads}
emptyHint="(no parameter field reads recorded)"
/>
)}
{data.field_writes.length > 0 && (
<FieldEntriesBlock
title="Field Writes"
entries={data.field_writes}
emptyHint="(no parameter field writes recorded)"
/>
)}
</div>
);
}
function PointerValueTable({
values,
locations,
}: {
values: PointerValueView[];
locations: PointerLocationView[];
}) {
const locById = useMemo(() => {
const map = new Map<number, PointerLocationView>();
for (const loc of locations) map.set(loc.id, loc);
return map;
}, [locations]);
return (
<table className="abstract-table">
<thead>
<tr>
<th>Value</th>
<th>Name</th>
<th>Points-To</th>
</tr>
</thead>
<tbody>
{values.map((v) => (
<tr key={v.ssa_value}>
<td className="mono">v{v.ssa_value}</td>
<td className="mono">{v.var_name ?? '-'}</td>
<td>
{v.is_top ? (
<span
className="cap-badge cap-badge-sink"
title="Over-approximation"
>
(top)
</span>
) : (
v.points_to.map((id) => (
<LocationChip key={id} loc={locById.get(id)} />
))
)}
</td>
</tr>
))}
</tbody>
</table>
);
}
function LocationChip({ loc }: { loc?: PointerLocationView }) {
if (!loc) {
return (
<span className="cap-badge" title="Unknown location id">
?
</span>
);
}
const className =
loc.kind === 'Top'
? 'cap-badge cap-badge-sink'
: loc.kind === 'Field'
? 'cap-badge cap-badge-sanitizer'
: 'cap-badge cap-badge-source';
return (
<span
className={className}
title={`${loc.kind} (loc#${loc.id})`}
style={{ marginRight: 4 }}
>
{loc.display}
</span>
);
}
function FieldEntriesBlock({
title,
entries,
emptyHint,
}: {
title: string;
entries: PointerFieldEntryView[];
emptyHint: string;
}) {
return (
<div className="abstract-block">
<div className="abstract-block-header">
<h3 style={{ margin: 0 }}>{title}</h3>
<span className="text-secondary">
{entries.length} entr{entries.length === 1 ? 'y' : 'ies'}
</span>
</div>
{entries.length === 0 ? (
<p className="abstract-empty">{emptyHint}</p>
) : (
<table className="abstract-table">
<thead>
<tr>
<th>Target</th>
<th>Field</th>
</tr>
</thead>
<tbody>
{entries.map((e, i) => (
<tr key={`${e.param_index ?? 'self'}-${e.field}-${i}`}>
<td className="mono">
{e.param_index === null ? 'self' : `param[${e.param_index}]`}
</td>
<td className="mono">{e.field}</td>
</tr>
))}
</tbody>
</table>
)}
</div>
);
}