mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-09 19:45:13 +02:00
* feat: Add const_bound_vars tracking to prevent false positives in ownership checks
* feat: Introduce field interner and typed bounded vars for enhanced type tracking
* feat: Add typed_call_receivers and typed_bounded_dto_fields for enhanced type tracking
* feat: Centralize method name extraction with bare_method_name helper
* feat: Implement Phase-6 hierarchy fan-out for runtime virtual dispatch
* feat: Enhance C++ taint tracking with additional container operations and inline method resolution
* feat: Introduce field-sensitive points-to analysis for enhanced resource tracking
* feat: Implement Pointer-Phase 6 subscript handling for enhanced container analysis
* test: Add comprehensive tests for JavaScript control flow constructs and lattice operations
* docs: Update advanced analysis documentation with field-sensitive points-to and hierarchy fan-out details
* test: Add comprehensive tests for lattice algebra laws and SSA edge cases
* feat: Add destructured session user handling and safe user ID access patterns
* feat: Implement row-population reverse-walk for enhanced authorization checks
* feat: Enhance authorization checks with local alias chain for self-actor types
* feat: Introduce ActiveRecord query safety checks and enhance snippet extraction
* feat: Implement chained method call inner-gate rebinding for SSRF prevention
* feat: Add observability and error modules, enhance debug functionality, and implement theme context
* feat: Remove Auth Analysis page and update navigation to redirect to Explorer
* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor
* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor
* feat: Reset path-safe-suppressed spans before lowering to maintain analysis integrity
* fix(ssa): ungate debug_assert_bfs_ordering for release-tests build
The helper at src/ssa/lower.rs was gated `#[cfg(debug_assertions)]` while
the unit test at the bottom of the file was gated only `#[cfg(test)]`.
Since `cfg(test)` is set in release builds with `--tests` but
`cfg(debug_assertions)` is not, `cargo build --release --tests` failed
with E0425. Removing the gate fixes the build; the body is `debug_assert!`
only, so the helper is free in release. Also drop the gate at the call
site to avoid a `dead_code` warning when the lib is built without
`--tests`.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* test(closure-capture): flip JS/TS fixtures to required-finding
The JS and TS closure-capture fixtures pinned the old broken behaviour
via `forbidden_findings: [{ "id_prefix": "taint-" }]`. The engine now
correctly traces taint through the closure boundary (env source captured
by an arrow function, sunk via `child_process.exec` inside the body), so
the formerly-forbidden finding is a true positive.
Match the Python sibling's shape — `required_findings` with
`id_prefix` + `min_count` plus a small `noise_budget` — and rewrite the
companion READMEs and the phase8_fragility_tests doc-comments from
"known gap" to "regression guard".
Verified:
- cargo test --release --test phase8_fragility_tests → 8/8 pass
- cargo test --release --lib bfs_assertion → pass
- corpus benchmark F1 = 0.9976 (TP=205, FP=1, FN=0) — unchanged
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat: Add OWASP mapping and baseline mutation hooks for enhanced security analysis
* feat: Introduce health module and enhance health score computation with calibration tests
* feat: Add expectations configuration and cleanup .gitignore for log files
* feat: Implement theme selection and enhance settings panel for triage sync
* feat: Suppress false positives for strcpy calls with literal sources in AST
* feat: Update analyse_function_ssa to return body CFG for accurate analysis
* feat: Add bug report and feature request templates for improved issue tracking
* feat: removed dev scripts
* feat: update README.md for clarity and consistency in fixture descriptions
* feat: removed dev docs
* feat: clean up error handling and UI elements for improved user experience
* feat: adjust button sizes in HeaderBar for better UI consistency
* feat: enhance taint analysis with additional context for sanitizer and taint findings
* cargo fmt
* prettier
* refactor: simplify conditional checks and improve code readability in AST and screenshot capture scripts
* feat: add script to frame PNG screenshots with brand gradient
* feat: add fuzzing support with new targets and CI workflows
* refactor: streamline match expressions and improve formatting in CLI and output handling
* feat: enhance configuration display with detailed output options
* feat: stage demo configuration for improved CLI screenshot output
* feat: expose merge_configs function for user-configurable settings
* refactor: simplify code structure and improve readability in config handling
* refactor: improve descriptions for vulnerability patterns in various languages
* feat: update MIT License section with additional usage details and copyright information
* feat: update screenshots
* refactor: update build process and paths for frontend assets
* feat: add cross-file taint fuzzing target and supporting dictionary
* refactor: clean up formatting and comments in fuzz configuration and example files
* refactor: remove outdated comments and clean up CI configuration files
* chore: update changelog dates and improve formatting in documentation
* refactor: update Cargo.toml and CI configuration for improved packaging and build process
* refactor: enhance quote-stripping logic to prevent panics and add regression tests
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
184 lines
6.1 KiB
Rust
184 lines
6.1 KiB
Rust
use criterion::{Criterion, criterion_group, criterion_main};
|
|
use nyx_scanner::utils::Config;
|
|
use nyx_scanner::utils::config::AnalysisMode;
|
|
use std::path::Path;
|
|
|
|
const FIXTURES: &str = "benches/fixtures";
|
|
|
|
fn bench_ast_only_scan(c: &mut Criterion) {
|
|
let fixtures = Path::new(FIXTURES).canonicalize().expect("fixtures dir");
|
|
let mut cfg = Config::default();
|
|
cfg.scanner.mode = AnalysisMode::Ast;
|
|
cfg.performance.worker_threads = Some(1);
|
|
cfg.performance.channel_multiplier = 1;
|
|
cfg.performance.batch_size = 64;
|
|
|
|
c.bench_function("ast_only_scan", |b| {
|
|
b.iter(|| {
|
|
let (rx, handle) = nyx_scanner::walk::spawn_file_walker(&fixtures, &cfg);
|
|
if let Err(err) = handle.join() {
|
|
panic!("walker panicked: {err:#?}");
|
|
}
|
|
let paths: Vec<_> = rx.into_iter().flatten().collect();
|
|
let mut diags = Vec::new();
|
|
for path in &paths {
|
|
if let Ok(mut d) =
|
|
nyx_scanner::ast::run_rules_on_file(path, &cfg, None, Some(&fixtures))
|
|
{
|
|
diags.append(&mut d);
|
|
}
|
|
}
|
|
diags
|
|
});
|
|
});
|
|
}
|
|
|
|
fn bench_full_scan(c: &mut Criterion) {
|
|
let fixtures = Path::new(FIXTURES).canonicalize().expect("fixtures dir");
|
|
let mut cfg = Config::default();
|
|
cfg.scanner.mode = AnalysisMode::Full;
|
|
cfg.performance.worker_threads = Some(1);
|
|
cfg.performance.channel_multiplier = 1;
|
|
cfg.performance.batch_size = 64;
|
|
|
|
c.bench_function("full_scan", |b| {
|
|
b.iter(|| {
|
|
let (rx, handle) = nyx_scanner::walk::spawn_file_walker(&fixtures, &cfg);
|
|
if let Err(err) = handle.join() {
|
|
panic!("walker panicked: {err:#?}");
|
|
}
|
|
let paths: Vec<_> = rx.into_iter().flatten().collect();
|
|
|
|
// Pass 1: extract summaries
|
|
let mut all_sums = Vec::new();
|
|
for path in &paths {
|
|
if let Ok(sums) = nyx_scanner::ast::extract_summaries_from_file(path, &cfg) {
|
|
all_sums.extend(sums);
|
|
}
|
|
}
|
|
let root_str = fixtures.to_string_lossy();
|
|
let global = nyx_scanner::summary::merge_summaries(all_sums, Some(&root_str));
|
|
|
|
// Pass 2: full analysis
|
|
let mut diags = Vec::new();
|
|
for path in &paths {
|
|
if let Ok(mut d) =
|
|
nyx_scanner::ast::run_rules_on_file(path, &cfg, Some(&global), Some(&fixtures))
|
|
{
|
|
diags.append(&mut d);
|
|
}
|
|
}
|
|
diags
|
|
});
|
|
});
|
|
}
|
|
|
|
fn bench_full_scan_with_state(c: &mut Criterion) {
|
|
let fixtures = Path::new(FIXTURES).canonicalize().expect("fixtures dir");
|
|
let mut cfg = Config::default();
|
|
cfg.scanner.mode = AnalysisMode::Full;
|
|
cfg.scanner.enable_state_analysis = true;
|
|
cfg.performance.worker_threads = Some(1);
|
|
cfg.performance.channel_multiplier = 1;
|
|
cfg.performance.batch_size = 64;
|
|
|
|
c.bench_function("full_scan_with_state", |b| {
|
|
b.iter(|| {
|
|
let (rx, handle) = nyx_scanner::walk::spawn_file_walker(&fixtures, &cfg);
|
|
if let Err(err) = handle.join() {
|
|
panic!("walker panicked: {err:#?}");
|
|
}
|
|
let paths: Vec<_> = rx.into_iter().flatten().collect();
|
|
|
|
// Pass 1: extract summaries
|
|
let mut all_sums = Vec::new();
|
|
for path in &paths {
|
|
if let Ok(sums) = nyx_scanner::ast::extract_summaries_from_file(path, &cfg) {
|
|
all_sums.extend(sums);
|
|
}
|
|
}
|
|
let root_str = fixtures.to_string_lossy();
|
|
let global = nyx_scanner::summary::merge_summaries(all_sums, Some(&root_str));
|
|
|
|
// Pass 2: full analysis with state
|
|
let mut diags = Vec::new();
|
|
for path in &paths {
|
|
if let Ok(mut d) =
|
|
nyx_scanner::ast::run_rules_on_file(path, &cfg, Some(&global), Some(&fixtures))
|
|
{
|
|
diags.append(&mut d);
|
|
}
|
|
}
|
|
diags
|
|
});
|
|
});
|
|
}
|
|
|
|
fn bench_single_file_parse_and_cfg(c: &mut Criterion) {
|
|
let fixture = Path::new(FIXTURES).join("sample.rs");
|
|
let fixture = fixture.canonicalize().expect("sample.rs fixture");
|
|
let cfg = Config::default();
|
|
|
|
c.bench_function("single_file_parse_cfg", |b| {
|
|
b.iter(|| {
|
|
nyx_scanner::ast::extract_summaries_from_file(&fixture, &cfg)
|
|
.expect("extract summaries")
|
|
});
|
|
});
|
|
}
|
|
|
|
fn bench_state_analysis_only(c: &mut Criterion) {
|
|
let fixture = Path::new(FIXTURES)
|
|
.join("state_bench.c")
|
|
.canonicalize()
|
|
.expect("state_bench.c fixture");
|
|
let mut cfg = Config::default();
|
|
cfg.scanner.mode = AnalysisMode::Full;
|
|
cfg.scanner.enable_state_analysis = true;
|
|
|
|
// Parse and build CFG once (outside benchmark loop)
|
|
let (file_cfg, lang) = nyx_scanner::ast::build_cfg_for_file(&fixture, &cfg)
|
|
.expect("build cfg")
|
|
.expect("supported language");
|
|
let source_bytes = std::fs::read(&fixture).expect("read fixture");
|
|
let top = file_cfg.toplevel();
|
|
|
|
c.bench_function("state_analysis_only", |b| {
|
|
b.iter(|| {
|
|
nyx_scanner::state::run_state_analysis(
|
|
&top.graph,
|
|
top.entry,
|
|
lang,
|
|
&source_bytes,
|
|
&file_cfg.summaries,
|
|
None,
|
|
true,
|
|
&[],
|
|
&[],
|
|
&std::collections::HashSet::new(),
|
|
None,
|
|
)
|
|
});
|
|
});
|
|
}
|
|
|
|
fn bench_classify(c: &mut Criterion) {
|
|
c.bench_function("classify_hit", |b| {
|
|
b.iter(|| nyx_scanner::labels::classify("rust", "std::env::var", None));
|
|
});
|
|
|
|
c.bench_function("classify_miss", |b| {
|
|
b.iter(|| nyx_scanner::labels::classify("rust", "some_random_function", None));
|
|
});
|
|
}
|
|
|
|
criterion_group!(
|
|
benches,
|
|
bench_ast_only_scan,
|
|
bench_full_scan,
|
|
bench_full_scan_with_state,
|
|
bench_single_file_parse_and_cfg,
|
|
bench_state_analysis_only,
|
|
bench_classify,
|
|
);
|
|
criterion_main!(benches);
|