-
A taint should be reported here, but is not:
https://psalm.dev/r/0b805cb3ee
The taint is reported if lines 4 or 11 are commented. This example was distilled down from actual case spanning hundr…
-
### Taint Analysis Setup (Introduction)
The original purpose of the taint tracking was to be able to follow all instructions which used information from a certain source (e.g. a sensor), which coul…
HAM41 updated
4 years ago
-
### Description
I used the following configuration:
```yml
- { method: "", from: base, to: result }
```
When I use the return value of Map.get() directly as a sink, the taint is captured, but w…
-
### Description
Hi,
I saw the test cases in resources, including TaintParam, CSBackPropagation, but not found case for back taint propagation.
One case I test shown below:
```
public st…
-
Pyre [0] allows for further static analysis to ensure untrusted and/or unsanitized input never makes it it's way through to sensitive functions.
We should add annotations for sources, sanitizers an…
emkll updated
1 month ago
-
Steps:
* Create a `psalm.xml` with `psalm-baseline.xml`
* Ensure the `psalm.xml` has `errorBaseline="psalm-baseline.xml"`
* Run Taint Analysis with a separate baseline, `psalm-taint-baseline.xml`…
-
I fixed the taint.py in example/taint2, however I got the warnning and I don't know how to fix it.
I am running panda in a virtualBox virtual machine, Ubuntu 22.04
Is there any way to fix this probl…
-
```
1. Configure analysis for Android. That is, restrict THIS of
non-private methods of app classes extending/implementing
Android library classes/interfaces, to {POLY,TAINTED}. In other
words, disall…
-
Move https://appsec.guide/docs/static-analysis/semgrep/installation/#:~:text=d.%20Data%20flow%20tracing%3A here: https://appsec.guide/docs/static-analysis/semgrep/advanced/#taint-mode
-
when I want to check a source-sink path with follows, I can't get any results:
```xml
```
But when change the source to:
```xml…