feat(rules): Update rules to use star operator - #314
Draft
misonijnik wants to merge 76 commits into
Draft
Conversation
misonijnik
force-pushed
the
misonijnik/3-rules
branch
2 times, most recently
from
July 29, 2026 21:09
7a7b7b7 to
f5be3ef
Compare
…peline Accepts a starred metavar in expression, formal-parameter and declaration positions, and carries the star flag on IsMetavar through the automata pipeline, including across the remapping done by string-concat elimination. Parsing only -- no taint semantics are attached yet.
A starred metavar denotes whole-object taint, so:
- a starred source assigns both the value and the any-field position;
- a starred sanitizer cleans both, keeping the field-clean anchored on the
value base;
- a starred sink is satisfied by a mark on the value OR on any field.
The sink side needs a serialized form of the existing ContainsMarkOnAnyField
condition so a rule can express it, added here along with the `withAnyField`
position helper.
Covered by propagator, pattern-not and end-to-end source/sink/sanitizer
field-taint samples.
…esolution Parses the starred metavar on plain and typed Go metavars, threads it through the Go taint emitter, and implements the any-field mark check on the Go condition builder. Backs the any-field position with a real resolver on the source, pass and clean paths -- memoized, since any-field evaluation sits on a hot path -- and adds the any-accessor variant of the sanitizer clean on the Go side. Also completes the Java surface: the star threads through assignment-LHS and typed declarations, the any-field shadow tree collapses via an AnyFieldLift decorator, an unsupported starred / pattern-not coincidence is diagnosed rather than silently mis-lowered, and the serialized any-field condition gets its own key so it round-trips independently of the depth-1 mark check.
Moves the star from a suffix to a prefix. The suffix form was ambiguous with multiplication -- `$X * y` and `$X*y` are ordinary multiplication -- so the prefix spelling is the one the parser can accept unambiguously. Also fixes three clean-path defects the starred sanitizers expose: concrete nested-field taint left behind underneath an any-field position, the sanitizer cleaning only Result instead of its focus position, and the clean not being applied at call-to-start for resolved calls.
Adds the deep-nesting matrix for Java and Go, crossing interprocedural depth with field depth, plus the state-var mechanism the Go side needs to express it via ClassStatic positions. Replaces the runtime array-element sink reader with an any-field condition, and keeps $X and $*X distinct in the constraint solver. The matrix also pins the remaining whole-object source vs value-sanitizer false positives, so the surviving gaps are characterized rather than silent.
Exercises the DeepMarkExclusion machinery through the querylang surface now that the star syntax can express it: the composition boundary of deep exclusions, mixed deep and plain exclusion sanitizers, a starred clean followed by a constant field store, and field-level overwrite after the clean. Unparks the StarDeepSink depth-5 case and accepts a starred metavar in a typed expression position.
…e star Replaces the two hard-coded Spring hacks with rule-level star operators: the controller parameter source is now `$*UNTRUSTED`, and the controller-return any-field sinks are expressed with a starred metavar. Both the source hack and the sink hack are deleted. Also restores the Z2F-gate bypass for controller-return sinks and tightens the source `$TYPE` regex, which the hack had been masking.
Keeps array and primitive parameters as plain value sources, stars the untrusted-path-source pattern-not with a fresh metavar, drops the List adapter overloads from the command-injection sink, and collapses the servlet upload source read-back -- all expressible directly now that a starred metavar means whole-object taint. Documents the pattern-not star limitation, the sink focus requirement and the Go parity story in the rules README.
resolveArrayPosition was the last implicit type-triggered array mechanism: it silently gave every array- or Object-typed source ASSIGN position an element twin. The star operator expresses the same thing from the rules, and does it better -- the any-field star is recursive, so it also catches the deep Map<String,String[]> flows the element-only twin missed. Array and vararg sink args are now starred explicitly, the implicit sink any-field emission is gone, and the Go side drops its blanket any-accessor emission in favour of explicit variadic taint in the Go model config.
Makes the servlet source whole-object and adds the channel-model getter passthroughs it reads back, and stars the xss and response-injection value sanitizers so a sanitized wrapper is recognised as clean at every depth.
Collapses the source down to a single focused form, focuses and stars the session-store sink, and flags a tainted attribute NAME as well as a tainted value -- previously only the value was considered.
Makes the java.io.File model field-sensitive with starred path sinks, and migrates every starred metavar in the ruleset, the Spring rule provider and the rules README to the $*VAR spelling the parser accepts.
misonijnik
force-pushed
the
misonijnik/3-rules
branch
from
July 30, 2026 08:10
f5be3ef to
97adcc7
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.