docs: Update demo in README.md - #6
Merged
Merged
Conversation
misonijnik
pushed a commit
that referenced
this pull request
Mar 19, 2026
misonijnik
pushed a commit
that referenced
this pull request
Mar 19, 2026
* Add local name resolver to SarifTraits * Add thorough JIRValue printer
misonijnik
pushed a commit
that referenced
this pull request
Mar 19, 2026
misonijnik
pushed a commit
that referenced
this pull request
Mar 19, 2026
* Add maven executable finder * Add `mvnw` to Maven search list * Update order for Maven executables
misonijnik
pushed a commit
that referenced
this pull request
Mar 19, 2026
Saloed
added a commit
that referenced
this pull request
Jun 29, 2026
…Buffer Increase true positives on the Go owasp benchmark (445->500 TP, 56.2%->63.1%) without regressing sec-code (179/250 unchanged), via legitimate sink/source coverage and a missing taint approximation. All shipped by default. Rules (rules/ruleset/go): - xss-sinks: add beego ($W : *context.Response).Write($BUF) sink. beego's c.Ctx.ResponseWriter is *context.Response, not http.ResponseWriter, so the typed sink missed it (+48 CWE-79 TP). - weak-random: add a math/rand/v2 arm (v2.*). The engine keys the package qualifier on the import-path last segment, which for /vN modules is "v2", not "rand" (+4 CWE-330 TP). Deliberately exclude rand.Read (collides with crypto/rand.Read) and rand.Seed (benchmark FP). - http-sources: add ($X : *context.BeegoInput).Query($K) source. - sql-sinks: add *sql.Tx and *sql.Conn sink variants (their first arg is the query; *sql.Stmt.Exec/Query are intentionally omitted as those args are the safe ?-parameters). Approximation (core/opentaint-config/go-config): - bytes.yaml: model bytes.Buffer Write/WriteString/WriteByte/WriteRune/String/ ReadFrom/WriteTo passThrough (only the read accessors existed; strings.Builder was already complete). Bake into the analyzer jar. Tests: - rules/test/go: add positives/negatives for each rule change (beego Response write, math/rand/v2, BeegoInput.Query, *sql.Tx, bytes.Buffer flow) plus stub support; rule-test passes 529 success / 0 FP / 0 FN. - go-querylang: add CookieValueFieldRead and InsecureCookieLiteral reproducers (@disabled) for the field-read-propagation and struct-literal-matching engine gaps. issues.md: document the findings that cap the remaining FN gap as benchmark truth-mislabeling/mutation or engine limits (#6 corollary-#13): math/rand/v2 resolution, no struct-literal field matching (blocks CWE-614), cookie .Value field-read taint drop, cookie taint dropped at database/sql sinks, chained- receiver Cookies() slice-taint loss, and the removed --entry-point CLI flag. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Saloed
added a commit
that referenced
this pull request
Jun 29, 2026
Engine (opentaint-go-dataflow): - #1 typed field-read source no longer crashes: thread GoFieldSignature.receiverType, allow This as a field-source condition base (taint target stays Result-only). - #2 TypeUtils.matchesType matches interface implementations (method-set check, pointer/value rules, graceful fallback). - #7 GoFunctionSignature.pkgName (declared package clause name) + candidates() branch so bare rand.* matches math/rand/v2. - #11 GoConditionResolver.resolveWithType descends a single-element GoIRTupleType (single-return result) before a Field/Element modifier, so a result-field source taint action (cookie .Value) resolves and seeds field-sensitively. No whole-value taint. - #12 GoCallExpr peels the receiver for DIRECT concrete pointer-receiver methods from the static target signature (fixes *sql.DB.Query arg indexing); no go-ssa-server change. - #6 GoTaintConfiguration.matchPackage is exact for slash-qualified matchers. Querylang (opentaint-go-querylang): - #3 typed metavar in argument position parses to ParamCondition.TypeIs(Argument). - #6 new GoImportRewriter pre-pass resolves package qualifiers from in-pattern imports. Ruleset (rules/ruleset/go): - #6 import-qualified package names across lib/security rules (bare where a local test-stub / ambiguous package / typed-receiver method pattern requires it). - #7 weak-random drops the v2.* block. - #11 http-sources cookies source taints [$I].Value. Tooling: #10 restore scan --entry-point flag; re-point fn_investigate.py to test rule reachability. Gates: engine units 1300/1300; GoSampleBasedTest 95 (3 intentional skips); rules/test/go detection harness 197/197. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Saloed
added a commit
that referenced
this pull request
Jun 29, 2026
…ckage exactness A slash-qualified pattern package could wrongly tail-match a shorter value package because matchesType used a lenient endsWith (true when value pkg shorter than pattern). Extract matchesPackage: slash-qualified pattern -> exact match; bare selector -> tail match (mirrors the #6 matchPackage change). Fix endsWith to reject longer 'other'. With this, typed-receiver method patterns can be import-qualified: re-qualify the four *exec.Cmd method sinks in cmdi-sinks.yaml with import "os/exec". Tests: TypeUtilsTest (qualified pointer receiver exact-matches full path; bare tail-matches; slash-qualified does not tail-match a shorter package), GoImportRewriterTest (receiver QualifiedType rewrite), PatternToActionListConverterTest (bare vs qualified TypeIs), samples-go/CmdTypedReceiverSink end-to-end. rules/test/go 197/197; unit suites green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.