search

praetorian-inc / gokart

A static analysis tool for securing Go code
Apache License 2.0
2.18k stars 110 forks source link

Can we get ASTs for some taint paths? #37

Open jmukund opened 3 years ago

jmukund commented 3 years ago

Would like to run them through some language models.

isp1r0 commented 3 years ago

Hi @jmukund - thanks for taking GoKart out for a test drive! Yes, we're very interested in this use case as well. There is an ssadump standalone utility that is part of the ssautil package and can be used to get this information: https://pkg.go.dev/golang.org/x/tools/cmd/ssadump

as well as a pretty cool visualizer available at http://goast.yuroyoro.net/ where you can drop a Go source file and see the AST representation. We will prioritize integration of this type of data directly into GoKart in the near future.