Package com.tonic.analysis.cpg.taint

Class TaintQuery

java.lang.Object

com.tonic.analysis.cpg.taint.TaintQuery

public class TaintQuery
extends Object

A source-to-sink taint search over a code property graph, configured with source, sink, and sanitizer definitions.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	TaintQuery.Sanitizer	A regex pair matching call targets that neutralize taint on a path.

Constructor Summary

Constructors

Constructor	Description
TaintQuery(CodePropertyGraph cpg)	Creates an empty query over a graph, defaulting to a 50 node path cap and interprocedural traversal.

Method Summary

Modifier and Type	Method	Description
TaintQuery	addSanitizer(TaintQuery.Sanitizer sanitizer)	Registers one sanitizer.
TaintQuery	addSanitizer(String ownerPattern, String methodPattern)	Registers a sanitizer built from a pair of regexes.
TaintQuery	addSink(TaintSink sink)	Registers one sink definition.
TaintQuery	addSinks(TaintSink... sinks)	Registers several sink definitions.
TaintQuery	addSource(TaintSource source)	Registers one source definition.
TaintQuery	addSources(TaintSource... sources)	Registers several source definitions.
TaintAnalysisResult	analyze()	Walks data flow edges from every source node to every reachable sink, capped at ten paths per pair.
List<CPGNode>	findSinkNodes()	Scans every call site in the graph for one matching a registered sink.
List<CPGNode>	findSourceNodes()	Scans every call site in the graph for one matching a registered source.
CodePropertyGraph	getCpg()
int	getMaxPathLength()
Set<TaintQuery.Sanitizer>	getSanitizers()
List<TaintSink>	getSinks()
List<TaintSource>	getSources()
TaintQuery	interprocedural(boolean enabled)	Controls whether traversal follows call, parameter, and return edges across methods.
boolean	isInterprocedural()
TaintQuery	maxPathLength(int length)	Caps how many nodes a reported path may contain.
TaintQuery	withDefaultSanitizers()	Adds the built-in sanitizers for URL encoding, OWASP and commons-text escaping, and prepared statements.
TaintQuery	withDefaultSinks()	Adds the built-in injection, traversal, SSRF, deserialization, and reflection sinks.
TaintQuery	withDefaultSources()	Adds the built-in sources for HTTP input, console input, file reads, environment, and database reads.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

TaintQuery

public TaintQuery(CodePropertyGraph cpg)

Creates an empty query over a graph, defaulting to a 50 node path cap and interprocedural traversal.

Parameters:

cpg - the graph to search

Method Detail

getCpg

public CodePropertyGraph getCpg()

Returns:

the cpg

getSources

public List<TaintSource> getSources()

Returns:

the sources

getSinks

public List<TaintSink> getSinks()

Returns:

the sinks

getSanitizers

public Set<TaintQuery.Sanitizer> getSanitizers()

Returns:

the sanitizers

getMaxPathLength

public int getMaxPathLength()

Returns:

the max path length

isInterprocedural

public boolean isInterprocedural()

Returns:

whether interprocedural

addSource

public TaintQuery addSource(TaintSource source)

Registers one source definition.

Parameters:

source - the source to match call sites against

Returns:

this query

addSources

public TaintQuery addSources(TaintSource... sources)

Registers several source definitions.

Parameters:

sources - the sources to match call sites against

Returns:

this query

addSink

public TaintQuery addSink(TaintSink sink)

Registers one sink definition.

Parameters:

sink - the sink to match call sites against

Returns:

this query

addSinks

public TaintQuery addSinks(TaintSink... sinks)

Registers several sink definitions.

Parameters:

sinks - the sinks to match call sites against

Returns:

this query

addSanitizer

public TaintQuery addSanitizer(TaintQuery.Sanitizer sanitizer)

Registers one sanitizer.

Parameters:

sanitizer - the sanitizer to match path hops against

Returns:

this query

addSanitizer

public TaintQuery addSanitizer(String ownerPattern,
                               String methodPattern)

Registers a sanitizer built from a pair of regexes.

Parameters:

ownerPattern - regex for the declaring class internal name

methodPattern - regex for the method name

Returns:

this query

Throws:

PatternSyntaxException - if either pattern is not valid regex

maxPathLength

public TaintQuery maxPathLength(int length)

Caps how many nodes a reported path may contain.

Parameters:

length - the maximum hop count

Returns:

this query

interprocedural

public TaintQuery interprocedural(boolean enabled)

Controls whether traversal follows call, parameter, and return edges across methods.

Parameters:

enabled - true to cross method boundaries

Returns:

this query

withDefaultSources

public TaintQuery withDefaultSources()

Adds the built-in sources for HTTP input, console input, file reads, environment, and database reads.

Returns:

this query

withDefaultSinks

public TaintQuery withDefaultSinks()

Adds the built-in injection, traversal, SSRF, deserialization, and reflection sinks.

Returns:

this query

withDefaultSanitizers

public TaintQuery withDefaultSanitizers()

Adds the built-in sanitizers for URL encoding, OWASP and commons-text escaping, and prepared statements.

Returns:

this query

findSourceNodes

public List<CPGNode> findSourceNodes()

Scans every call site in the graph for one matching a registered source.

Returns:

the matching call site nodes

findSinkNodes

public List<CPGNode> findSinkNodes()

Scans every call site in the graph for one matching a registered sink.

Returns:

the matching call site nodes

analyze

public TaintAnalysisResult analyze()

Walks data flow edges from every source node to every reachable sink, capped at ten paths per pair.

Returns:

the collected paths, each already checked for sanitizers