feat: Add Docker support, Windows compatibility, and update docs - #3
Merged
Conversation
seqradev
pushed a commit
that referenced
this pull request
Jan 29, 2026
misonijnik
pushed a commit
that referenced
this pull request
Mar 19, 2026
misonijnik
pushed a commit
that referenced
this pull request
Mar 19, 2026
misonijnik
pushed a commit
that referenced
this pull request
Mar 19, 2026
misonijnik
pushed a commit
that referenced
this pull request
Mar 19, 2026
misonijnik
pushed a commit
that referenced
this pull request
Mar 19, 2026
misonijnik
pushed a commit
that referenced
this pull request
Mar 19, 2026
misonijnik
added a commit
that referenced
this pull request
Mar 19, 2026
Saloed
pushed a commit
that referenced
this pull request
Mar 23, 2026
Saloed
added a commit
that referenced
this pull request
Jun 29, 2026
New sample packages under samples-go/ wired into GoSampleBasedTest, each isolating a limitation found while improving the Go ruleset (see issues.md): - TypedFieldReadSource (#1): typed receiver on a field-read source crashes analysis (IllegalStateException "Unsupported field-source position: This"). - InterfaceImplSink (#2): a typed receiver matches only the exact static type, not a concrete implementor of the interface. - TypedArgSink (#3): a type ascription in argument position is ignored. - FieldReadSink (#4): a field-read sink never fires in taint mode. - MapValueToReceiver (#5): confirms the core DOES propagate a map value into a receiver-position sink, so the full-scan ServeJSON false-negative is an unroll-strategy/config issue, not a core bug. #1-#4 are @disabled with a todo referencing the issue; removing @disabled reproduces the bug now and the test should pass once it is fixed. #5 is enabled and passing. Full GoSampleBasedTest: 89 tests, 0 failures, 5 skipped. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Saloed
added a commit
that referenced
this pull request
Jun 29, 2026
Engine (opentaint-go-dataflow): - #1 typed field-read source no longer crashes: thread GoFieldSignature.receiverType, allow This as a field-source condition base (taint target stays Result-only). - #2 TypeUtils.matchesType matches interface implementations (method-set check, pointer/value rules, graceful fallback). - #7 GoFunctionSignature.pkgName (declared package clause name) + candidates() branch so bare rand.* matches math/rand/v2. - #11 GoConditionResolver.resolveWithType descends a single-element GoIRTupleType (single-return result) before a Field/Element modifier, so a result-field source taint action (cookie .Value) resolves and seeds field-sensitively. No whole-value taint. - #12 GoCallExpr peels the receiver for DIRECT concrete pointer-receiver methods from the static target signature (fixes *sql.DB.Query arg indexing); no go-ssa-server change. - #6 GoTaintConfiguration.matchPackage is exact for slash-qualified matchers. Querylang (opentaint-go-querylang): - #3 typed metavar in argument position parses to ParamCondition.TypeIs(Argument). - #6 new GoImportRewriter pre-pass resolves package qualifiers from in-pattern imports. Ruleset (rules/ruleset/go): - #6 import-qualified package names across lib/security rules (bare where a local test-stub / ambiguous package / typed-receiver method pattern requires it). - #7 weak-random drops the v2.* block. - #11 http-sources cookies source taints [$I].Value. Tooling: #10 restore scan --entry-point flag; re-point fn_investigate.py to test rule reachability. Gates: engine units 1300/1300; GoSampleBasedTest 95 (3 intentional skips); rules/test/go detection harness 197/197. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
misonijnik
added a commit
that referenced
this pull request
Jul 3, 2026
- #7 PreparedStatementCreatorFactory: newPreparedStatementCreator(String, Object[]) DOES exist in Spring JDBC 5.3.x (arg0 is the SQL) — the "no String overload" note was about the single-arg form. Added unsafeNewPSC using the 2-arg overload; re-enabled. Suite: OK 979 | Skip 0 | FP 0 | FN 0. - Removed the three disabled samples whose behavior is now captured by minimal engine repros on misonijnik/core-engine-repros, leaving a NOTE that points to each repro: - #2 staticResource(new URL("..."+resource)) -> taint/WrapperPropagatorRepro - #3 ResponseEntity.header(..., "*") (varargs) -> custom/BuilderChainMatchRepro - #9 (File $F).getCanonicalFile() sanitizer -> taint/InstanceSanitizerRepro
misonijnik
added a commit
that referenced
this pull request
Jul 3, 2026
- #7 PreparedStatementCreatorFactory: newPreparedStatementCreator(String, Object[]) DOES exist in Spring JDBC 5.3.x (arg0 is the SQL) — the "no String overload" note was about the single-arg form. Added unsafeNewPSC using the 2-arg overload; re-enabled. Suite: OK 979 | Skip 0 | FP 0 | FN 0. - Removed the three disabled samples whose behavior is now captured by minimal engine repros on misonijnik/core-engine-repros, leaving a NOTE that points to each repro: - #2 staticResource(new URL("..."+resource)) -> taint/WrapperPropagatorRepro - #3 ResponseEntity.header(..., "*") (varargs) -> custom/BuilderChainMatchRepro - #9 (File $F).getCanonicalFile() sanitizer -> taint/InstanceSanitizerRepro
misonijnik
added a commit
that referenced
this pull request
Jul 3, 2026
- #7 PreparedStatementCreatorFactory: newPreparedStatementCreator(String, Object[]) DOES exist in Spring JDBC 5.3.x (arg0 is the SQL) — the "no String overload" note was about the single-arg form. Added unsafeNewPSC using the 2-arg overload; re-enabled. Suite: OK 979 | Skip 0 | FP 0 | FN 0. - Removed the three disabled samples whose behavior is now captured by minimal engine repros on misonijnik/core-engine-repros, leaving a NOTE that points to each repro: - #2 staticResource(new URL("..."+resource)) -> taint/WrapperPropagatorRepro - #3 ResponseEntity.header(..., "*") (varargs) -> custom/BuilderChainMatchRepro - #9 (File $F).getCanonicalFile() sanitizer -> taint/InstanceSanitizerRepro
misonijnik
added a commit
that referenced
this pull request
Jul 4, 2026
- #7 PreparedStatementCreatorFactory: newPreparedStatementCreator(String, Object[]) DOES exist in Spring JDBC 5.3.x (arg0 is the SQL) — the "no String overload" note was about the single-arg form. Added unsafeNewPSC using the 2-arg overload; re-enabled. Suite: OK 979 | Skip 0 | FP 0 | FN 0. - Removed the three disabled samples whose behavior is now captured by minimal engine repros on misonijnik/core-engine-repros, leaving a NOTE that points to each repro: - #2 staticResource(new URL("..."+resource)) -> taint/WrapperPropagatorRepro - #3 ResponseEntity.header(..., "*") (varargs) -> custom/BuilderChainMatchRepro - #9 (File $F).getCanonicalFile() sanitizer -> taint/InstanceSanitizerRepro
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.