mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-12 19:55:14 +02:00
* feat: Add const_bound_vars tracking to prevent false positives in ownership checks
* feat: Introduce field interner and typed bounded vars for enhanced type tracking
* feat: Add typed_call_receivers and typed_bounded_dto_fields for enhanced type tracking
* feat: Centralize method name extraction with bare_method_name helper
* feat: Implement Phase-6 hierarchy fan-out for runtime virtual dispatch
* feat: Enhance C++ taint tracking with additional container operations and inline method resolution
* feat: Introduce field-sensitive points-to analysis for enhanced resource tracking
* feat: Implement Pointer-Phase 6 subscript handling for enhanced container analysis
* test: Add comprehensive tests for JavaScript control flow constructs and lattice operations
* docs: Update advanced analysis documentation with field-sensitive points-to and hierarchy fan-out details
* test: Add comprehensive tests for lattice algebra laws and SSA edge cases
* feat: Add destructured session user handling and safe user ID access patterns
* feat: Implement row-population reverse-walk for enhanced authorization checks
* feat: Enhance authorization checks with local alias chain for self-actor types
* feat: Introduce ActiveRecord query safety checks and enhance snippet extraction
* feat: Implement chained method call inner-gate rebinding for SSRF prevention
* feat: Add observability and error modules, enhance debug functionality, and implement theme context
* feat: Remove Auth Analysis page and update navigation to redirect to Explorer
* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor
* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor
* feat: Reset path-safe-suppressed spans before lowering to maintain analysis integrity
* fix(ssa): ungate debug_assert_bfs_ordering for release-tests build
The helper at src/ssa/lower.rs was gated `#[cfg(debug_assertions)]` while
the unit test at the bottom of the file was gated only `#[cfg(test)]`.
Since `cfg(test)` is set in release builds with `--tests` but
`cfg(debug_assertions)` is not, `cargo build --release --tests` failed
with E0425. Removing the gate fixes the build; the body is `debug_assert!`
only, so the helper is free in release. Also drop the gate at the call
site to avoid a `dead_code` warning when the lib is built without
`--tests`.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* test(closure-capture): flip JS/TS fixtures to required-finding
The JS and TS closure-capture fixtures pinned the old broken behaviour
via `forbidden_findings: [{ "id_prefix": "taint-" }]`. The engine now
correctly traces taint through the closure boundary (env source captured
by an arrow function, sunk via `child_process.exec` inside the body), so
the formerly-forbidden finding is a true positive.
Match the Python sibling's shape — `required_findings` with
`id_prefix` + `min_count` plus a small `noise_budget` — and rewrite the
companion READMEs and the phase8_fragility_tests doc-comments from
"known gap" to "regression guard".
Verified:
- cargo test --release --test phase8_fragility_tests → 8/8 pass
- cargo test --release --lib bfs_assertion → pass
- corpus benchmark F1 = 0.9976 (TP=205, FP=1, FN=0) — unchanged
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat: Add OWASP mapping and baseline mutation hooks for enhanced security analysis
* feat: Introduce health module and enhance health score computation with calibration tests
* feat: Add expectations configuration and cleanup .gitignore for log files
* feat: Implement theme selection and enhance settings panel for triage sync
* feat: Suppress false positives for strcpy calls with literal sources in AST
* feat: Update analyse_function_ssa to return body CFG for accurate analysis
* feat: Add bug report and feature request templates for improved issue tracking
* feat: removed dev scripts
* feat: update README.md for clarity and consistency in fixture descriptions
* feat: removed dev docs
* feat: clean up error handling and UI elements for improved user experience
* feat: adjust button sizes in HeaderBar for better UI consistency
* feat: enhance taint analysis with additional context for sanitizer and taint findings
* cargo fmt
* prettier
* refactor: simplify conditional checks and improve code readability in AST and screenshot capture scripts
* feat: add script to frame PNG screenshots with brand gradient
* feat: add fuzzing support with new targets and CI workflows
* refactor: streamline match expressions and improve formatting in CLI and output handling
* feat: enhance configuration display with detailed output options
* feat: stage demo configuration for improved CLI screenshot output
* feat: expose merge_configs function for user-configurable settings
* refactor: simplify code structure and improve readability in config handling
* refactor: improve descriptions for vulnerability patterns in various languages
* feat: update MIT License section with additional usage details and copyright information
* feat: update screenshots
* refactor: update build process and paths for frontend assets
* feat: add cross-file taint fuzzing target and supporting dictionary
* refactor: clean up formatting and comments in fuzz configuration and example files
* refactor: remove outdated comments and clean up CI configuration files
* chore: update changelog dates and improve formatting in documentation
* refactor: update Cargo.toml and CI configuration for improved packaging and build process
* refactor: enhance quote-stripping logic to prevent panics and add regression tests
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
200 lines
5.3 KiB
TypeScript
200 lines
5.3 KiB
TypeScript
import { useMemo } from 'react';
|
||
import { useDebugPointer } from '../../api/queries/debug';
|
||
import { ApiError } from '../../api/client';
|
||
import { EmptyState } from '../../components/ui/EmptyState';
|
||
import { ErrorState } from '../../components/ui/ErrorState';
|
||
import { LoadingState } from '../../components/ui/LoadingState';
|
||
import type {
|
||
PointerLocationView,
|
||
PointerValueView,
|
||
PointerFieldEntryView,
|
||
} from '../../api/types';
|
||
|
||
interface PointerAnalysisPanelProps {
|
||
file: string;
|
||
functionName: string;
|
||
}
|
||
|
||
export function PointerAnalysisPanel({
|
||
file,
|
||
functionName,
|
||
}: PointerAnalysisPanelProps) {
|
||
const { data, isLoading, error } = useDebugPointer(file, functionName);
|
||
|
||
if (isLoading) {
|
||
return <LoadingState message="Loading points-to facts..." />;
|
||
}
|
||
if (error) {
|
||
if (error instanceof ApiError && error.status === 404) {
|
||
return (
|
||
<EmptyState message="Pointer analysis is not available for the selected function." />
|
||
);
|
||
}
|
||
return <ErrorState message="Failed to load pointer analysis." />;
|
||
}
|
||
if (
|
||
!data ||
|
||
(data.values.length === 0 &&
|
||
data.field_reads.length === 0 &&
|
||
data.field_writes.length === 0)
|
||
) {
|
||
return (
|
||
<EmptyState message="No points-to facts were derived for this function. Pointer analysis flags up parameters, allocation sites, and field projections; functions that only manipulate scalars will appear empty." />
|
||
);
|
||
}
|
||
|
||
return (
|
||
<div className="abstract-interp-viewer">
|
||
<div className="abstract-block">
|
||
<div className="abstract-block-header">
|
||
<h3 style={{ margin: 0 }}>Per-Value Points-To</h3>
|
||
<span className="text-secondary">
|
||
{data.values.length} value
|
||
{data.values.length === 1 ? '' : 's'} · {data.location_count}{' '}
|
||
location
|
||
{data.location_count === 1 ? '' : 's'}
|
||
</span>
|
||
</div>
|
||
{data.values.length === 0 ? (
|
||
<p className="abstract-empty">
|
||
All SSA values point to nothing tracked.
|
||
</p>
|
||
) : (
|
||
<PointerValueTable values={data.values} locations={data.locations} />
|
||
)}
|
||
</div>
|
||
|
||
{data.field_reads.length > 0 && (
|
||
<FieldEntriesBlock
|
||
title="Field Reads"
|
||
entries={data.field_reads}
|
||
emptyHint="(no parameter field reads recorded)"
|
||
/>
|
||
)}
|
||
|
||
{data.field_writes.length > 0 && (
|
||
<FieldEntriesBlock
|
||
title="Field Writes"
|
||
entries={data.field_writes}
|
||
emptyHint="(no parameter field writes recorded)"
|
||
/>
|
||
)}
|
||
</div>
|
||
);
|
||
}
|
||
|
||
function PointerValueTable({
|
||
values,
|
||
locations,
|
||
}: {
|
||
values: PointerValueView[];
|
||
locations: PointerLocationView[];
|
||
}) {
|
||
const locById = useMemo(() => {
|
||
const map = new Map<number, PointerLocationView>();
|
||
for (const loc of locations) map.set(loc.id, loc);
|
||
return map;
|
||
}, [locations]);
|
||
|
||
return (
|
||
<table className="abstract-table">
|
||
<thead>
|
||
<tr>
|
||
<th>Value</th>
|
||
<th>Name</th>
|
||
<th>Points-To</th>
|
||
</tr>
|
||
</thead>
|
||
<tbody>
|
||
{values.map((v) => (
|
||
<tr key={v.ssa_value}>
|
||
<td className="mono">v{v.ssa_value}</td>
|
||
<td className="mono">{v.var_name ?? '-'}</td>
|
||
<td>
|
||
{v.is_top ? (
|
||
<span
|
||
className="cap-badge cap-badge-sink"
|
||
title="Over-approximation"
|
||
>
|
||
⊤ (top)
|
||
</span>
|
||
) : (
|
||
v.points_to.map((id) => (
|
||
<LocationChip key={id} loc={locById.get(id)} />
|
||
))
|
||
)}
|
||
</td>
|
||
</tr>
|
||
))}
|
||
</tbody>
|
||
</table>
|
||
);
|
||
}
|
||
|
||
function LocationChip({ loc }: { loc?: PointerLocationView }) {
|
||
if (!loc) {
|
||
return (
|
||
<span className="cap-badge" title="Unknown location id">
|
||
?
|
||
</span>
|
||
);
|
||
}
|
||
const className =
|
||
loc.kind === 'Top'
|
||
? 'cap-badge cap-badge-sink'
|
||
: loc.kind === 'Field'
|
||
? 'cap-badge cap-badge-sanitizer'
|
||
: 'cap-badge cap-badge-source';
|
||
return (
|
||
<span
|
||
className={className}
|
||
title={`${loc.kind} (loc#${loc.id})`}
|
||
style={{ marginRight: 4 }}
|
||
>
|
||
{loc.display}
|
||
</span>
|
||
);
|
||
}
|
||
|
||
function FieldEntriesBlock({
|
||
title,
|
||
entries,
|
||
emptyHint,
|
||
}: {
|
||
title: string;
|
||
entries: PointerFieldEntryView[];
|
||
emptyHint: string;
|
||
}) {
|
||
return (
|
||
<div className="abstract-block">
|
||
<div className="abstract-block-header">
|
||
<h3 style={{ margin: 0 }}>{title}</h3>
|
||
<span className="text-secondary">
|
||
{entries.length} entr{entries.length === 1 ? 'y' : 'ies'}
|
||
</span>
|
||
</div>
|
||
{entries.length === 0 ? (
|
||
<p className="abstract-empty">{emptyHint}</p>
|
||
) : (
|
||
<table className="abstract-table">
|
||
<thead>
|
||
<tr>
|
||
<th>Target</th>
|
||
<th>Field</th>
|
||
</tr>
|
||
</thead>
|
||
<tbody>
|
||
{entries.map((e, i) => (
|
||
<tr key={`${e.param_index ?? 'self'}-${e.field}-${i}`}>
|
||
<td className="mono">
|
||
{e.param_index === null ? 'self' : `param[${e.param_index}]`}
|
||
</td>
|
||
<td className="mono">{e.field}</td>
|
||
</tr>
|
||
))}
|
||
</tbody>
|
||
</table>
|
||
)}
|
||
</div>
|
||
);
|
||
}
|