pub struct TaintedBinding {
pub local: String,
pub source_path: String,
pub source_span_start: u32,
}Expand description
A local binding tied to the flattened member-access path it was initialized
from. The analyze layer matches source_path against the data-driven source
catalogue; when it matches, local is treated as carrying untrusted input.
Captured for two shapes: a direct assignment (const id = req.query.id ->
{ local: "id", source_path: "req.query" }, the literal-key tail dropped so
the path matches a catalogue prefix) and an object destructure
(const { id } = req.query -> { local: "id", source_path: "req.query" }).
Fields§
§local: StringThe local binding name introduced by the declarator.
source_path: StringThe flattened object member-access path the binding was sourced from.
source_span_start: u32Byte offset of the source read (the member-access expression the binding
was sourced from), so the analyze layer can anchor a taint trace’s source
node at the real read line instead of the module import line. Stored as a
u32 (not Span) to stay bitcode-encodable for the cache. 0 when no
concrete read expression is available (synthetic framework-param /
helper-return bindings), in which case the analyze layer falls back to the
sink site rather than claiming a spurious line.