fix(scanner): enable multi-file cross-taint analysis across all supported languages - #67
Adityakk9031 wants to merge 3 commits into
Conversation
|
@juangaitanv and @Ibrahimrahhal have a look |
| for file_path in files { | ||
| self.analyze_file_for_imports_exports(file_path, language, &rule_deduplicator)?; |
There was a problem hiding this comment.
a read or parser failure aborts all cross-file analysis and produces no findings; could we handle failures per file and continue?
There was a problem hiding this comment.
@juangaitanv Thanks for the review! Updated build_import_export_maps in src/scanner/multifile_taint.rs to catch individual file read/parse errors with if let Err(e) = ... { log::warn!(...); } and continue processing remaining files instead of failing the entire cross-file analysis.
| let py_pattern = format!("def {}(", function_name); | ||
| let js_pattern1 = format!("function {}(", function_name); | ||
| let js_pattern2 = format!("const {} =", function_name); | ||
| let js_pattern3 = format!("let {} =", function_name); | ||
| let fn_pattern = format!("fn {}(", function_name); | ||
| content.contains(&py_pattern) | ||
| || content.contains(&js_pattern1) | ||
| || content.contains(&js_pattern2) | ||
| || content.contains(&js_pattern3) | ||
| || content.contains(&fn_pattern) |
There was a problem hiding this comment.
const and let bindings are treated as functions while body extraction accepts only Python def; could we limit lookup to callable declarations and align body extraction?
There was a problem hiding this comment.
@juangaitanv Added is_function_definition_line helper that checks only callable declarations (def, async def, function, async function, fn, async fn, func, const x = (, let x = (, etc.) and aligned both file_contains_function and extract_function_body in src/scanner/dataflow.rs to use it consistently.
2 participants
Summary