mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-09 19:45:13 +02:00
82f18184b1
* feat: Add const_bound_vars tracking to prevent false positives in ownership checks
* feat: Introduce field interner and typed bounded vars for enhanced type tracking
* feat: Add typed_call_receivers and typed_bounded_dto_fields for enhanced type tracking
* feat: Centralize method name extraction with bare_method_name helper
* feat: Implement Phase-6 hierarchy fan-out for runtime virtual dispatch
* feat: Enhance C++ taint tracking with additional container operations and inline method resolution
* feat: Introduce field-sensitive points-to analysis for enhanced resource tracking
* feat: Implement Pointer-Phase 6 subscript handling for enhanced container analysis
* test: Add comprehensive tests for JavaScript control flow constructs and lattice operations
* docs: Update advanced analysis documentation with field-sensitive points-to and hierarchy fan-out details
* test: Add comprehensive tests for lattice algebra laws and SSA edge cases
* feat: Add destructured session user handling and safe user ID access patterns
* feat: Implement row-population reverse-walk for enhanced authorization checks
* feat: Enhance authorization checks with local alias chain for self-actor types
* feat: Introduce ActiveRecord query safety checks and enhance snippet extraction
* feat: Implement chained method call inner-gate rebinding for SSRF prevention
* feat: Add observability and error modules, enhance debug functionality, and implement theme context
* feat: Remove Auth Analysis page and update navigation to redirect to Explorer
* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor
* feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor
* feat: Reset path-safe-suppressed spans before lowering to maintain analysis integrity
* fix(ssa): ungate debug_assert_bfs_ordering for release-tests build
The helper at src/ssa/lower.rs was gated `#[cfg(debug_assertions)]` while
the unit test at the bottom of the file was gated only `#[cfg(test)]`.
Since `cfg(test)` is set in release builds with `--tests` but
`cfg(debug_assertions)` is not, `cargo build --release --tests` failed
with E0425. Removing the gate fixes the build; the body is `debug_assert!`
only, so the helper is free in release. Also drop the gate at the call
site to avoid a `dead_code` warning when the lib is built without
`--tests`.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* test(closure-capture): flip JS/TS fixtures to required-finding
The JS and TS closure-capture fixtures pinned the old broken behaviour
via `forbidden_findings: [{ "id_prefix": "taint-" }]`. The engine now
correctly traces taint through the closure boundary (env source captured
by an arrow function, sunk via `child_process.exec` inside the body), so
the formerly-forbidden finding is a true positive.
Match the Python sibling's shape — `required_findings` with
`id_prefix` + `min_count` plus a small `noise_budget` — and rewrite the
companion READMEs and the phase8_fragility_tests doc-comments from
"known gap" to "regression guard".
Verified:
- cargo test --release --test phase8_fragility_tests → 8/8 pass
- cargo test --release --lib bfs_assertion → pass
- corpus benchmark F1 = 0.9976 (TP=205, FP=1, FN=0) — unchanged
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat: Add OWASP mapping and baseline mutation hooks for enhanced security analysis
* feat: Introduce health module and enhance health score computation with calibration tests
* feat: Add expectations configuration and cleanup .gitignore for log files
* feat: Implement theme selection and enhance settings panel for triage sync
* feat: Suppress false positives for strcpy calls with literal sources in AST
* feat: Update analyse_function_ssa to return body CFG for accurate analysis
* feat: Add bug report and feature request templates for improved issue tracking
* feat: removed dev scripts
* feat: update README.md for clarity and consistency in fixture descriptions
* feat: removed dev docs
* feat: clean up error handling and UI elements for improved user experience
* feat: adjust button sizes in HeaderBar for better UI consistency
* feat: enhance taint analysis with additional context for sanitizer and taint findings
* cargo fmt
* prettier
* refactor: simplify conditional checks and improve code readability in AST and screenshot capture scripts
* feat: add script to frame PNG screenshots with brand gradient
* feat: add fuzzing support with new targets and CI workflows
* refactor: streamline match expressions and improve formatting in CLI and output handling
* feat: enhance configuration display with detailed output options
* feat: stage demo configuration for improved CLI screenshot output
* feat: expose merge_configs function for user-configurable settings
* refactor: simplify code structure and improve readability in config handling
* refactor: improve descriptions for vulnerability patterns in various languages
* feat: update MIT License section with additional usage details and copyright information
* feat: update screenshots
* refactor: update build process and paths for frontend assets
* feat: add cross-file taint fuzzing target and supporting dictionary
* refactor: clean up formatting and comments in fuzz configuration and example files
* refactor: remove outdated comments and clean up CI configuration files
* chore: update changelog dates and improve formatting in documentation
* refactor: update Cargo.toml and CI configuration for improved packaging and build process
* refactor: enhance quote-stripping logic to prevent panics and add regression tests
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
||
|---|---|---|
| .. | ||
| alias_no_sanitize_unsafe.expect.json | ||
| alias_no_sanitize_unsafe.js | ||
| alias_sanitize_propagation.expect.json | ||
| alias_sanitize_propagation.js | ||
| array_push_safe.expect.json | ||
| array_push_safe.js | ||
| array_push_taint.expect.json | ||
| array_push_taint.js | ||
| axios_post_body_safe.expect.json | ||
| axios_post_body_safe.js | ||
| axios_post_url_fires.expect.json | ||
| axios_post_url_fires.js | ||
| callback_return_taint.expect.json | ||
| callback_return_taint.js | ||
| callback_sink_tracking.expect.json | ||
| callback_sink_tracking.js | ||
| catch_param_sink.expect.json | ||
| catch_param_sink.js | ||
| chained_promise_xss.expect.json | ||
| chained_promise_xss.js | ||
| closure_captured_var.expect.json | ||
| closure_captured_var.js | ||
| closure_member_assignment.expect.json | ||
| closure_member_assignment.js | ||
| cmdi_express.expect.json | ||
| cmdi_express.js | ||
| container_direct_sink.expect.json | ||
| container_direct_sink.js | ||
| container_index_dynamic_fallback.expect.json | ||
| container_index_dynamic_fallback.js | ||
| container_index_load_precision.expect.json | ||
| container_index_load_precision.js | ||
| container_index_store_isolation.expect.json | ||
| container_index_store_isolation.js | ||
| context_sensitive_call.expect.json | ||
| context_sensitive_call.js | ||
| deep_nested_closure.expect.json | ||
| deep_nested_closure.js | ||
| destructure_object_taint.expect.json | ||
| destructure_object_taint.js | ||
| destructure_sanitized_safe.expect.json | ||
| destructure_sanitized_safe.js | ||
| destructuring_taint.expect.json | ||
| destructuring_taint.js | ||
| dom_xss.expect.json | ||
| dom_xss.js | ||
| equality_narrowing_propagates.expect.json | ||
| equality_narrowing_propagates.js | ||
| equality_narrowing_safe.expect.json | ||
| equality_narrowing_safe.js | ||
| eval_user_input.expect.json | ||
| eval_user_input.js | ||
| express_redirect.expect.json | ||
| express_redirect.js | ||
| express_xss.expect.json | ||
| express_xss.js | ||
| feasible_range_check.expect.json | ||
| feasible_range_check.js | ||
| fetch_object_url_tainted_fires.expect.json | ||
| fetch_object_url_tainted_fires.js | ||
| fetch_tainted_body_safe.expect.json | ||
| fetch_tainted_body_safe.js | ||
| field_overwrite_safe.expect.json | ||
| field_overwrite_safe.js | ||
| field_partial_taint.expect.json | ||
| field_partial_taint.js | ||
| field_safe_overwrite_base_tainted.expect.json | ||
| field_safe_overwrite_base_tainted.js | ||
| field_taint_propagation.expect.json | ||
| field_taint_propagation.js | ||
| field_write_base_sink.expect.json | ||
| field_write_base_sink.js | ||
| global_var_taint.expect.json | ||
| global_var_taint.js | ||
| got_post_body_safe.expect.json | ||
| got_post_body_safe.js | ||
| got_tainted_url_fires.expect.json | ||
| got_tainted_url_fires.js | ||
| header_extract_shift.expect.json | ||
| header_extract_shift.js | ||
| heap_alias_taint.expect.json | ||
| heap_alias_taint.js | ||
| heap_reassign_safe.expect.json | ||
| heap_reassign_safe.js | ||
| http_request_tainted_host_fires.expect.json | ||
| http_request_tainted_host_fires.js | ||
| iife_tainted.expect.json | ||
| iife_tainted.js | ||
| infeasible_equality_check.expect.json | ||
| infeasible_equality_check.js | ||
| infeasible_range_check.expect.json | ||
| infeasible_range_check.js | ||
| infeasible_relational_check.expect.json | ||
| infeasible_relational_check.js | ||
| inline_return_mixed.expect.json | ||
| inline_return_mixed.js | ||
| inline_return_no_leak.expect.json | ||
| inline_return_no_leak.js | ||
| inline_return_passthrough.expect.json | ||
| inline_return_passthrough.js | ||
| internal_redirect_safe.expect.json | ||
| internal_redirect_safe.js | ||
| interproc_container_return.expect.json | ||
| interproc_container_return.js | ||
| interproc_container_store.expect.json | ||
| interproc_container_store.js | ||
| interproc_new_container_safe.expect.json | ||
| interproc_new_container_safe.js | ||
| length_in_template_safe.expect.json | ||
| length_in_template_safe.js | ||
| local_escape_html_safe.expect.json | ||
| local_escape_html_safe.js | ||
| loop_counter_widening.expect.json | ||
| loop_counter_widening.js | ||
| method_chain_taint.expect.json | ||
| method_chain_taint.js | ||
| multi_source_single_sink.expect.json | ||
| multi_source_single_sink.js | ||
| nested_callback_taint.expect.json | ||
| nested_callback_taint.js | ||
| numeric_attr_safe.expect.json | ||
| numeric_attr_safe.js | ||
| open_redirect.expect.json | ||
| open_redirect.js | ||
| open_redirect_unsafe.expect.json | ||
| open_redirect_unsafe.js | ||
| parse_from_string_xss.expect.json | ||
| parse_from_string_xss.js | ||
| path_traversal_fs.expect.json | ||
| path_traversal_fs.js | ||
| permission_mask_gate.expect.json | ||
| permission_mask_gate.js | ||
| phi_must_validation_regression.expect.json | ||
| phi_must_validation_regression.js | ||
| proto_pollution.expect.json | ||
| proto_pollution.js | ||
| reassignment_compound.expect.json | ||
| reassignment_compound.js | ||
| reassignment_conditional.expect.json | ||
| reassignment_conditional.js | ||
| reassignment_taint.expect.json | ||
| reassignment_taint.js | ||
| receiver_taint_resolved.expect.json | ||
| receiver_taint_resolved.js | ||
| relational_feasible_check.expect.json | ||
| relational_feasible_check.js | ||
| safe_constant_args.expect.json | ||
| safe_constant_args.js | ||
| safe_hardcoded_exec.expect.json | ||
| safe_hardcoded_exec.js | ||
| safe_he_encode.expect.json | ||
| safe_he_encode.js | ||
| safe_int_bounded.expect.json | ||
| safe_int_bounded.js | ||
| safe_no_source.expect.json | ||
| safe_no_source.js | ||
| safe_reassigned_const.expect.json | ||
| safe_reassigned_const.js | ||
| safe_sanitized_flow.expect.json | ||
| safe_sanitized_flow.js | ||
| safe_ssrf_allowlist.expect.json | ||
| safe_ssrf_allowlist.js | ||
| safe_ssrf_axios_hardcoded.expect.json | ||
| safe_ssrf_axios_hardcoded.js | ||
| safe_ssrf_hardcoded.expect.json | ||
| safe_ssrf_hardcoded.js | ||
| safe_ssrf_prefix.expect.json | ||
| safe_ssrf_prefix.js | ||
| safe_validated_input.expect.json | ||
| safe_validated_input.js | ||
| scope_shadow_precision.expect.json | ||
| scope_shadow_precision.js | ||
| session_destroy_safe.expect.json | ||
| session_destroy_safe.js | ||
| session_destroy_with_query.expect.json | ||
| session_destroy_with_query.js | ||
| set_attribute_xss.expect.json | ||
| set_attribute_xss.js | ||
| sqli_concat.expect.json | ||
| sqli_concat.js | ||
| sqli_mixed_parameterized.expect.json | ||
| sqli_mixed_parameterized.js | ||
| sqli_mysql_query.expect.json | ||
| sqli_mysql_query.js | ||
| sqli_parameterized_edge_cases.expect.json | ||
| sqli_parameterized_edge_cases.js | ||
| sqli_pg_client.expect.json | ||
| sqli_pg_client.js | ||
| sqli_sequelize_raw.expect.json | ||
| sqli_sequelize_raw.js | ||
| ssrf_axios_bare.expect.json | ||
| ssrf_axios_bare.js | ||
| ssrf_fetch.expect.json | ||
| ssrf_fetch.js | ||
| ssrf_got.expect.json | ||
| ssrf_got.js | ||
| ssrf_multihop.expect.json | ||
| ssrf_multihop.js | ||
| ssrf_undici.expect.json | ||
| ssrf_undici.js | ||
| string_concat_sink.expect.json | ||
| string_concat_sink.js | ||
| symex_encoding_html_xss.expect.json | ||
| symex_encoding_html_xss.js | ||
| symex_encoding_wrong_type.expect.json | ||
| symex_encoding_wrong_type.js | ||
| symex_exception_catch_taint.expect.json | ||
| symex_exception_catch_taint.js | ||
| symex_exception_finally_safe.expect.json | ||
| symex_exception_finally_safe.js | ||
| symex_exception_scope_taint.expect.json | ||
| symex_exception_scope_taint.js | ||
| symex_expression_tree.expect.json | ||
| symex_expression_tree.js | ||
| symex_field_nested.expect.json | ||
| symex_field_nested.js | ||
| symex_field_propagation_regression.expect.json | ||
| symex_field_propagation_regression.js | ||
| symex_field_taint.expect.json | ||
| symex_field_taint.js | ||
| symex_interproc_budget_exhaustion.expect.json | ||
| symex_interproc_budget_exhaustion.js | ||
| symex_interproc_callee_internal_sink.expect.json | ||
| symex_interproc_callee_internal_sink.js | ||
| symex_interproc_callee_sanitize.expect.json | ||
| symex_interproc_callee_sanitize.js | ||
| symex_interproc_heap_mutation.expect.json | ||
| symex_interproc_heap_mutation.js | ||
| symex_interproc_multi_return.expect.json | ||
| symex_interproc_multi_return.js | ||
| symex_interproc_mutual_recursion.expect.json | ||
| symex_interproc_mutual_recursion.js | ||
| symex_interproc_nested_depth3.expect.json | ||
| symex_interproc_nested_depth3.js | ||
| symex_interproc_passthrough.expect.json | ||
| symex_interproc_passthrough.js | ||
| symex_interproc_recursive.expect.json | ||
| symex_interproc_recursive.js | ||
| symex_loop_exit_correct.expect.json | ||
| symex_loop_exit_correct.js | ||
| symex_loop_infinite.expect.json | ||
| symex_loop_infinite.js | ||
| symex_loop_inner_sink.expect.json | ||
| symex_loop_inner_sink.js | ||
| symex_loop_multi_exit.expect.json | ||
| symex_loop_multi_exit.js | ||
| symex_loop_nested.expect.json | ||
| symex_loop_nested.js | ||
| symex_loop_post_sink.expect.json | ||
| symex_loop_post_sink.js | ||
| symex_loop_taint_survives.expect.json | ||
| symex_loop_taint_survives.js | ||
| symex_multipath.expect.json | ||
| symex_multipath.js | ||
| symex_nested_expr.expect.json | ||
| symex_nested_expr.js | ||
| symex_phi_merge.expect.json | ||
| symex_phi_merge.js | ||
| symex_smt_infeasible.expect.json | ||
| symex_smt_infeasible.js | ||
| symex_string_chain.expect.json | ||
| symex_string_chain.js | ||
| symex_string_replace_xss.expect.json | ||
| symex_string_replace_xss.js | ||
| symex_witness_cmdi.expect.json | ||
| symex_witness_cmdi.js | ||
| symex_witness_sqli.expect.json | ||
| symex_witness_sqli.js | ||
| symex_witness_xss.expect.json | ||
| symex_witness_xss.js | ||
| telemetry_user_agent_fp.expect.json | ||
| telemetry_user_agent_fp.js | ||
| template_literal_xss.expect.json | ||
| template_literal_xss.js | ||
| ternary_both_branches_sanitized_safe.expect.json | ||
| ternary_both_branches_sanitized_safe.js | ||
| ternary_literal_branches_safe.expect.json | ||
| ternary_literal_branches_safe.js | ||
| ternary_one_branch_tainted.expect.json | ||
| ternary_one_branch_tainted.js | ||
| ternary_taint.expect.json | ||
| ternary_taint.js | ||
| try_catch_taint.expect.json | ||
| try_catch_taint.js | ||
| typeof_guard_eval.expect.json | ||
| typeof_guard_eval.js | ||
| unsafe_bitwise_or.expect.json | ||
| unsafe_bitwise_or.js | ||
| unsafe_he_no_encode.expect.json | ||
| unsafe_he_no_encode.js | ||
| unsafe_ssrf_scheme_only.expect.json | ||
| unsafe_ssrf_scheme_only.js | ||
| unsafe_string_bounded.expect.json | ||
| unsafe_string_bounded.js | ||
| xss_res_send.expect.json | ||
| xss_res_send.js | ||