mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-15 20:05:13 +02:00
f96a89e7c1
* feat: Enhance control flow analysis with function summaries and taint analysis * feat: Update taint analysis to utilize function summaries for enhanced tracking * Refactor `walk.rs` batch processing and override handling: - Renamed `Batcher` to `BatchSender` for clarity. - Added `BatchSender::new` constructor for cleaner initialization. - Simplified batch size management in `BatchSender`. - Extracted `build_overrides` function for reusable override construction. - Improved error handling and validation in override building. - Enhanced performance with directory and file type filtering in `walk`. * Improve logging and streamline directory walk process: - Added detailed `tracing` logs for debugging batch flushes, override construction, and walk initialization/completion. - Optimized and simplified `filter_entry` logic for directory and file type filters. - Improved metadata checks and max file size enforcement during the scan. * Refactor and optimize taint tracking, label rules, and directory walk process: - Replaced `DefaultHasher` with `blake3::Hasher` for improved taint hashing. - Enhanced sorting and hashing logic in `taint.rs` for consistency and efficiency. - Removed unused `set_hash` function and redundant imports across files. - Improved batch sender logic in `walk.rs`, renaming key components for clarity. - Unified `spawn_senders` and `spawn_file_walker` with thread handling and channel tuple return. - Expanded label rules with additional matchers for sources, sanitizers, and sinks. - Deprecated `dump_cfg` and specific logging utilities in `cfg.rs` for code cleanup. * fix: fixed let chains error in walk.rs * fix: updated dependencies * fix: updated dependencies * chore: Remove standard error in scan.rs * feat: Introduce function summaries for enhanced taint and control flow analysis * feat: Enhance taint analysis with interop support and function summaries * feat: Add configuration analysis module and enhance matcher rules * feat: Add arity column to function_summaries and handle schema migration * fix: fixed clippy &PathBuf warnings * chore: Update dependencies and versioning in Cargo files * docs: Update README to enhance clarity and detail on features and analysis modes * chore: Update CHANGELOG for version 0.2.0 with new features, changes, and fixes * docs: Update SECURITY.md to clarify version support status --------- Co-authored-by: elipeter <eli.peter@es.fcm.travel>
85 lines
2.9 KiB
Rust
85 lines
2.9 KiB
Rust
use crate::labels::{Cap, DataLabel, Kind, LabelRule, ParamConfig};
|
|
use phf::{Map, phf_map};
|
|
|
|
pub static RULES: &[LabelRule] = &[
|
|
// ─────────── Sources ───────────
|
|
LabelRule {
|
|
matchers: &["std::env::var", "env::var", "source_env"],
|
|
label: DataLabel::Source(Cap::all()),
|
|
},
|
|
LabelRule {
|
|
matchers: &["fs::read_to_string", "source_file"],
|
|
label: DataLabel::Source(Cap::all()),
|
|
},
|
|
// ───────── Sanitizers ──────────
|
|
LabelRule {
|
|
matchers: &["html_escape::encode_safe", "sanitize_", "sanitize_html"],
|
|
label: DataLabel::Sanitizer(Cap::HTML_ESCAPE),
|
|
},
|
|
LabelRule {
|
|
matchers: &["shell_escape::unix::escape", "sanitize_shell"],
|
|
label: DataLabel::Sanitizer(Cap::SHELL_ESCAPE),
|
|
},
|
|
// ─────────── Sinks ─────────────
|
|
LabelRule {
|
|
matchers: &[
|
|
"command::new",
|
|
"std::process::command::new",
|
|
"command::arg",
|
|
"command::args",
|
|
"command::status",
|
|
"command::output",
|
|
],
|
|
label: DataLabel::Sink(Cap::SHELL_ESCAPE),
|
|
},
|
|
LabelRule {
|
|
matchers: &["sink_html"],
|
|
label: DataLabel::Sink(Cap::HTML_ESCAPE),
|
|
},
|
|
];
|
|
|
|
pub static KINDS: Map<&'static str, Kind> = phf_map! {
|
|
// control-flow
|
|
"if_expression" => Kind::If,
|
|
"loop_expression" => Kind::InfiniteLoop,
|
|
"loop_statement" => Kind::LoopBody,
|
|
"while_statement" => Kind::While,
|
|
"for_statement" => Kind::For,
|
|
|
|
"return_statement" => Kind::Return,
|
|
"break_expression" => Kind::Break,
|
|
"break_statement" => Kind::Break,
|
|
"continue_expression" => Kind::Continue,
|
|
"continue_statement" => Kind::Continue,
|
|
|
|
// structure
|
|
"source_file" => Kind::SourceFile,
|
|
"block" => Kind::Block,
|
|
"function_item" => Kind::Function,
|
|
|
|
// data-flow
|
|
"call_expression" => Kind::CallFn,
|
|
"method_call_expression" => Kind::CallMethod,
|
|
"macro_invocation" => Kind::CallMacro,
|
|
"let_declaration" => Kind::CallWrapper,
|
|
"expression_statement" => Kind::CallWrapper,
|
|
"assignment_expression" => Kind::Assignment,
|
|
|
|
// trivia
|
|
"line_comment" => Kind::Trivia,
|
|
"block_comment" => Kind::Trivia,
|
|
";" => Kind::Trivia, "," => Kind::Trivia,
|
|
"(" => Kind::Trivia, ")" => Kind::Trivia,
|
|
"{" => Kind::Trivia, "}" => Kind::Trivia, "\n" => Kind::Trivia,
|
|
"use_declaration" => Kind::Trivia,
|
|
"attribute_item" => Kind::Trivia,
|
|
"mod_item" => Kind::Trivia,
|
|
"type_item" => Kind::Trivia,
|
|
};
|
|
|
|
pub static PARAM_CONFIG: ParamConfig = ParamConfig {
|
|
params_field: "parameters",
|
|
param_node_kinds: &["parameter"],
|
|
self_param_kinds: &["self_parameter"],
|
|
ident_fields: &["pattern"],
|
|
};
|