infigraph-core 1.5.2

AST-powered code analysis framework — parser, graph, diff, and analysis engine
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125

pub struct TaintSource {
    pub kind: &'static str,
    pub patterns: &'static [&'static str],
    pub extensions: Option<&'static [&'static str]>,
}

pub static TAINT_SOURCES: &[TaintSource] = &[
    // HTTP parameters
    TaintSource {
        kind: "HttpParam",
        patterns: &[
            "request.GET[",
            "request.GET.get(",
            "request.POST[",
            "request.POST.get(",
            "request.args.get(",
            "request.args[",
            "request.form[",
            "request.form.get(",
            "req.query.",
            "req.query[",
            "req.params.",
            "req.params[",
            "request.getParameter(",
            "request.getParameterValues(",
            "@RequestParam",
            "@PathVariable",
            "@QueryParam",
            "Request.Query[",
            "Request.Form[",
            "c.Param(",
            "c.Query(",
            "c.DefaultQuery(",
            "r.URL.Query()",
            "r.FormValue(",
        ],
        extensions: None,
    },
    // HTTP body
    TaintSource {
        kind: "HttpBody",
        patterns: &[
            "request.body",
            "req.body",
            "request.json",
            "request.data",
            "request.get_json(",
            "request.content",
            "@RequestBody",
            "request.getInputStream(",
            "Request.Body",
            "ReadFromJsonAsync(",
            "c.BindJSON(",
            "c.ShouldBindJSON(",
            "json.NewDecoder(r.Body)",
        ],
        extensions: None,
    },
    // HTTP headers
    TaintSource {
        kind: "HttpHeader",
        patterns: &[
            "request.headers[",
            "request.headers.get(",
            "req.headers[",
            "req.headers.get(",
            "req.header(",
            "request.getHeader(",
            "request.META[",
            "Request.Headers[",
            "r.Header.Get(",
        ],
        extensions: None,
    },
    // File reads
    TaintSource {
        kind: "FileRead",
        patterns: &[
            "open(",
            "readFile(",
            "fs.read",
            "File(",
            "fs.readFileSync(",
            "fs.readFile(",
            "Files.readAllBytes(",
            "Files.readString(",
            "File.ReadAllText(",
            "File.ReadAllLines(",
            "os.ReadFile(",
            "ioutil.ReadFile(",
        ],
        extensions: None,
    },
    // User input (CLI/console)
    TaintSource {
        kind: "UserInput",
        patterns: &[
            "input(",
            "readline(",
            "Scanner(",
            "process.stdin",
            "sys.stdin",
            "Console.ReadLine(",
            "bufio.NewReader(os.Stdin)",
            "std::io::stdin()",
        ],
        extensions: None,
    },
    // Environment variables (can be attacker-controlled in some contexts)
    TaintSource {
        kind: "EnvVar",
        patterns: &[
            "os.environ[",
            "os.environ.get(",
            "os.getenv(",
            "process.env.",
            "process.env[",
            "System.getenv(",
            "Environment.GetEnvironmentVariable(",
            "os.Getenv(",
            "std::env::var(",
        ],
        extensions: None,
    },
];