feat(analyzer): Add $* star operator - #313
Open
misonijnik wants to merge 66 commits into
Open
Conversation
misonijnik
force-pushed
the
misonijnik/2-star
branch
2 times, most recently
from
July 29, 2026 21:09
bdee182 to
76bd03e
Compare
…peline Accepts a starred metavar in expression, formal-parameter and declaration positions, and carries the star flag on IsMetavar through the automata pipeline, including across the remapping done by string-concat elimination. Parsing only -- no taint semantics are attached yet.
A starred metavar denotes whole-object taint, so:
- a starred source assigns both the value and the any-field position;
- a starred sanitizer cleans both, keeping the field-clean anchored on the
value base;
- a starred sink is satisfied by a mark on the value OR on any field.
The sink side needs a serialized form of the existing ContainsMarkOnAnyField
condition so a rule can express it, added here along with the `withAnyField`
position helper.
Covered by propagator, pattern-not and end-to-end source/sink/sanitizer
field-taint samples.
…esolution Parses the starred metavar on plain and typed Go metavars, threads it through the Go taint emitter, and implements the any-field mark check on the Go condition builder. Backs the any-field position with a real resolver on the source, pass and clean paths -- memoized, since any-field evaluation sits on a hot path -- and adds the any-accessor variant of the sanitizer clean on the Go side. Also completes the Java surface: the star threads through assignment-LHS and typed declarations, the any-field shadow tree collapses via an AnyFieldLift decorator, an unsupported starred / pattern-not coincidence is diagnosed rather than silently mis-lowered, and the serialized any-field condition gets its own key so it round-trips independently of the depth-1 mark check.
Moves the star from a suffix to a prefix. The suffix form was ambiguous with multiplication -- `$X * y` and `$X*y` are ordinary multiplication -- so the prefix spelling is the one the parser can accept unambiguously. Also fixes three clean-path defects the starred sanitizers expose: concrete nested-field taint left behind underneath an any-field position, the sanitizer cleaning only Result instead of its focus position, and the clean not being applied at call-to-start for resolved calls.
Adds the deep-nesting matrix for Java and Go, crossing interprocedural depth with field depth, plus the state-var mechanism the Go side needs to express it via ClassStatic positions. Replaces the runtime array-element sink reader with an any-field condition, and keeps $X and $*X distinct in the constraint solver. The matrix also pins the remaining whole-object source vs value-sanitizer false positives, so the surviving gaps are characterized rather than silent.
Exercises the DeepMarkExclusion machinery through the querylang surface now that the star syntax can express it: the composition boundary of deep exclusions, mixed deep and plain exclusion sanitizers, a starred clean followed by a constant field store, and field-level overwrite after the clean. Unparks the StarDeepSink depth-5 case and accepts a starred metavar in a typed expression position.
misonijnik
force-pushed
the
misonijnik/2-star
branch
from
July 30, 2026 07:42
76bd03e to
d5139a1
Compare
Saloed
force-pushed
the
misonijnik/2-star
branch
2 times, most recently
from
August 11, 2026 18:42
1f5979c to
d5139a1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.