Simplified mode, exclusions, concurrent path search

[hex0punk]

• indicator/indicator.go: The changes modify the Indicator struct to use a slice of MatchFilters instead of a single MatchFilter. This provides more flexibility but also increases complexity
• cmd/search.go: The changes modify the searchFunc to use the new matchFilters slice instead of a single matchFilter.
• match/match.go: The changes focus on improving the efficiency and accuracy of the call path tracking functionality.
• cmd/map.go: The changes introduce new configuration options for excluding matches by pos or packages.
• wallylib/core.go: The changes to the Match function in the FuncInfo struct improve the matching functionality
• navigator/navigator.go: introduction of exclusions and parallel processing of paths
• wallylib/callmapper/callmapper.go: The changes to the callmapper.go file are aimed at improving the presentation of call paths.
• wallynode/factory.go: Introduces a new WallyNodeFactory for creating WallyNode instances
• wallynode/wallynode.go: Includes functions for analyzing the recoverability of function calls

[dryrunsecurity[bot]]

DryRun Security Summary

The pull request introduces a range of improvements and modifications to the Wally application, a static analysis tool for mapping and analyzing call graphs in Go applications, with a focus on enhancing the functionality, performance, and security-related aspects of the tool, including improved exclusion capabilities, handling of user input, callgraph algorithm selection, closure and recoverability analysis, and centralized exclusion logic.

Expand for full summary

**Summary:** The code changes in this pull request cover a wide range of improvements and modifications to the Wally application, a static analysis tool for mapping and analyzing call graphs in Go applications. The changes focus on enhancing the functionality, performance, and security-related aspects of the tool. Key highlights from a security perspective include: 1. **Improved Exclusion Capabilities**: The ability to exclude specific packages and code positions from the analysis can help focus the security review on the most critical areas of the codebase. However, this feature should be carefully documented and used responsibly to avoid potentially hiding security-sensitive code paths. 2. **Handling of User Input**: The changes introduce new user-configurable options, such as the `match-filter` flag in the `search` command. It is crucial to ensure that all user-provided inputs are properly validated and sanitized to prevent potential security issues like code injection or path traversal. 3. **Callgraph Algorithm Selection**: The tool allows users to select different callgraph algorithms, which can have security implications in terms of precision, performance, and potential for false positives or negatives. The default or recommended algorithm should be secure and appropriate for the application's needs. 4. **Closure and Recoverability Analysis**: The improvements in handling closures and analyzing the recoverability of function calls can provide valuable insights for understanding the application's control flow and error handling mechanisms, which is important from a security perspective. 5. **Centralized Exclusion Logic**: The introduction of the `Exclusions` field in the `Navigator` struct helps to consolidate the exclusion logic, making it easier to maintain and apply consistently throughout the codebase. Overall, the changes in this pull request appear to be focused on enhancing the security analysis capabilities of the Wally tool, while also improving its overall functionality and performance. As an application security engineer, I would recommend a thorough review of the changes, with a focus on ensuring that all user-provided inputs are properly handled, that the exclusion functionality is used responsibly, and that the overall security posture of the application is maintained or improved. **Files Changed:** 1. `cmd/map.go`: Adds new configuration options for simplifying the output, excluding specific packages, and excluding code positions. These changes can be useful for security analysis but should be carefully reviewed. 2. `indicator/indicator.go`: Introduces the ability to use multiple match filters, which could lead to potential injection vulnerabilities if not properly handled. 3. `cmd/search.go`: Adds a new `match-filter` flag, which should be reviewed for proper input validation and sanitization. 4. `README.md`: Documents the new features, including the ability to map function call paths and detect fault tolerance, which can be valuable for security analysis. 5. `navigator/navigator.go`: Adds an `Exclusions` field to the `Navigator` struct, centralizing the exclusion logic and making it easier to maintain. 6. `match/match.go`: Includes changes related to the handling of call paths and recoverable nodes, which are important for understanding the application's control flow and error handling. 7. `wallylib/core.go`: Modifies the `Match` function to handle multiple `MatchFilters`, which should be reviewed for potential security implications. 8. `wallylib/callmapper/callmapper.go`: Enhances the call path analysis, including the handling of closures and the ability to filter and limit the analysis, which can be useful for security reviews. 9. `wallynode/factory.go`: Introduces a new `WallyNodeFactory` for creating `WallyNode` instances, which should be reviewed for proper input validation and error handling. 10. `wallynode/wallynode.go`: Includes functions for analyzing the recoverability of function calls, which can be relevant for understanding the application's error handling mechanisms.

Code Analysis

We ran 9 analyzers against 10 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Authn/Authz Analyzer	1 finding

Riskiness

:green_circle: Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[dryrunsecurity[bot]]

DryRun Security Summary

We are currently analyzing this pull request to produce a meaningful summary.

Code Analysis

We ran 9 analyzers against 8 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

:green_circle: Risk threshold not exceeded.

View PR in the DryRun Dashboard.