fix: Set Java 21 as a default version for the analyzer - #14
Merged
Conversation
misonijnik
pushed a commit
that referenced
this pull request
Mar 19, 2026
misonijnik
pushed a commit
that referenced
this pull request
Mar 19, 2026
Saloed
added a commit
that referenced
this pull request
Jun 29, 2026
Investigation of the go-nethttp-demo /safe-twin false positives. Recall is perfect (32/32 TP, 0 FN); all 19 FPs are engine-precision-bound and not rule-fixable -- the rules already carry the correct sinks and the html.EscapeString/template sanitizers. The requested command-injection precision heuristic (treat exec.Command as safe when the executable is a fixed non-shell literal, flag only sh/bash -c) cannot be expressed: proven by experiment that the engine matches neither a string literal in any argument position nor an exact-arity call shape, and silently ignores metavariable-regex. The only matchable form is exec.Command($NAME, ...), which flags any tainted argument indiscriminately. - issues.md #14: the argument-value-constraint limitation with the full experiment table, plus the demo FP map (ssrf allow-list path-sensitivity, xss-async sanitizer-lost-across-channel, xss/ssti interface-dispatch). - go-querylang: add ShellExecArgConstraint reproducer (vuln sh -c + safe echo twin) wired into GoSampleBasedTest @disabled; confirmed it reproduces (the Negative wrongly fires) then re-disabled. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Saloed
added a commit
that referenced
this pull request
Jun 29, 2026
Engine (opentaint-go-dataflow): - #1 typed field-read source no longer crashes: thread GoFieldSignature.receiverType, allow This as a field-source condition base (taint target stays Result-only). - #2 TypeUtils.matchesType matches interface implementations (method-set check, pointer/value rules, graceful fallback). - #7 GoFunctionSignature.pkgName (declared package clause name) + candidates() branch so bare rand.* matches math/rand/v2. - #11 GoConditionResolver.resolveWithType descends a single-element GoIRTupleType (single-return result) before a Field/Element modifier, so a result-field source taint action (cookie .Value) resolves and seeds field-sensitively. No whole-value taint. - #12 GoCallExpr peels the receiver for DIRECT concrete pointer-receiver methods from the static target signature (fixes *sql.DB.Query arg indexing); no go-ssa-server change. - #6 GoTaintConfiguration.matchPackage is exact for slash-qualified matchers. Querylang (opentaint-go-querylang): - #3 typed metavar in argument position parses to ParamCondition.TypeIs(Argument). - #6 new GoImportRewriter pre-pass resolves package qualifiers from in-pattern imports. Ruleset (rules/ruleset/go): - #6 import-qualified package names across lib/security rules (bare where a local test-stub / ambiguous package / typed-receiver method pattern requires it). - #7 weak-random drops the v2.* block. - #11 http-sources cookies source taints [$I].Value. Tooling: #10 restore scan --entry-point flag; re-point fn_investigate.py to test rule reachability. Gates: engine units 1300/1300; GoSampleBasedTest 95 (3 intentional skips); rules/test/go detection harness 197/197. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.