anya-core 1.2.0

Enterprise-grade Bitcoin Infrastructure Platform
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

// [AIR-3] AI Security Rules
import javascript

from CallExpr call
where
  call.getCalleeName() = "predict" and
  not call.getArgument(0).getType().hasName("SecureTensor")
select call, "Unsafe ML prediction input - use SecureTensor wrapper"

from DataFlow::Node source, DataFlow::Node sink
where
  source.asExpr() = any(RemoteInputSource()) and
  sink.asExpr() = any(MlModelCall()) and
  DataFlow::flow(source, sink)
select sink, "Potential adversarial input to ML model"