Skip to content

Fix: pass sig db to lambda analysis, handle method mutation tainting#520

Merged
corneliuhoffman merged 1 commit intomainfrom
lambda-bug
Jan 6, 2026
Merged

Fix: pass sig db to lambda analysis, handle method mutation tainting#520
corneliuhoffman merged 1 commit intomainfrom
lambda-bug

Conversation

@corneliuhoffman
Copy link
Contributor

@corneliuhoffman corneliuhoffman commented Jan 5, 2026 •
edited
Loading

Premise

This PR fixes two bugs:

  1. function calls in lambdas were not found because the lambdas did not receive the signature db.
  2. Specific collection methods have effect taints on the collection and were not found.This bug was found in BenchmarkJava repos with opengrep-rules.

Before the fix we had:

  • without taint-intrafile 3608 finds
    with intrafile 3404 finds

After the fix

  • without taint-intrafile 3608 finds
  • with intrafile 3740 finds finds

More details:

  • 53 of the finds without taint-intrafile are actually FP.
Pattern Count Sanitizer
barbarians _at_the_gate pattern 34 Static string replacement
ESAPI.encoder().encodeForHTML() 13 In rule
HtmlUtils.htmlEscape() 1 In rule
StringEscapeUtils.escapeHtml() 5 In rule
  • 185 new finds in taint-intrafile
Category Count Description
HashMap pattern 71 map.put(key, tainted) → map.get(key) → sink
List pattern 113 list.add(tainted) → list.get(i) or ProcessBuilder args
Non-literal regexp 1 JavaScript RegExp detection (separate rule)

Summary

  • Add built-in taint models for collection operations across 10 languages
  • Fix lambda interprocedural taint flow by passing signature databases to lambda analysis

Collection Models

Two types of models:

ArgTaintsThis - Mutator methods where an argument taints the receiver:

  • map.put(key, value) → value taints map
  • list.add(item) → item taints list
  • sb.append(str) → str taints sb (+ returns this for fluent APIs)

ThisTaintsReturn - Accessor methods where receiver taints return value:

  • map.get(key) → map taint flows to return
  • list.pop() → list taint flows to return
  • sb.toString() → sb taint flows to return
Language Mutators Accessors
Java put, putIfAbsent, add, set, append, insert, push, offer get, peek, poll, pop, remove, toString, next
JS/TS set, push, unshift, add get, pop, shift, at, toString, valueOf, join
Python append, add, insert, extend, update pop, get, setdefault, copy, keys, values, items
Ruby push, append, unshift, prepend, merge!, update pop, shift, first, last, fetch, dig, to_s, join
C# Add, Push, Enqueue, Insert, TryAdd Pop, Dequeue, Peek, ElementAt, GetValueOrDefault, ToString
Kotlin add, put, putIfAbsent, append get, getOrNull, getOrDefault, first, last, toString
Swift append, insert, updateValue popLast, removeFirst, removeLast, first, last, remove
Rust push, push_front, push_back, insert pop, get, get_mut, remove, iter
Scala append, prepend, addOne, add, put, update head, last, apply, get, getOrElse, mkString, toString
Go Store (sync.Map) Load (sync.Map)

Lambda Fix

Pass signature_db, builtin_signature_db, and call_graph to fixpoint_lambda so function calls inside lambdas can resolve signatures:

// Now detected with --taint-intrafile

function Caller(props: { url: string }) {
  return <button onClick={() => callee(props.url)} />;
}
function callee(input: string) {
  window.location.href = input;  // Finding!
}

Test Plan

  • 10 collection model tests (one per language) - all pass
  • Lambda interprocedural test - passes
  • BenchmarkJava: +132 net findings with --taint-intrafile

@corneliuhoffman corneliuhoffman removed the request for review from willem-delbare January 5, 2026 08:11
@dimitris-m
Copy link
Collaborator

dimitris-m commented Jan 5, 2026

Why not merge the fix and leave the bench.py changes for a separate PR (when ready)?

@corneliuhoffman corneliuhoffman force-pushed the lambda-bug branch 2 times, most recently from 050224b to 5a3a73d Compare January 6, 2026 10:29
@corneliuhoffman corneliuhoffman changed the title WIP fix lambda bug WIP fix lambda bug and method mutation taining Jan 6, 2026
@corneliuhoffman corneliuhoffman changed the title WIP fix lambda bug and method mutation taining Fix lambda bug and method mutation tainting Jan 6, 2026
@dimitris-m dimitris-m changed the title Fix lambda bug and method mutation tainting Fix: pass sig db to lambda analysis, handle method mutation tainting Jan 6, 2026
dimitris-m
dimitris-m approved these changes Jan 6, 2026
View reviewed changes
Copy link
Collaborator

@dimitris-m dimitris-m left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Eventually we may decide to make this more generic in the spirit of custom propagators.

Branch needs rebase.

@corneliuhoffman corneliuhoffman merged commit a5b8337 into main Jan 6, 2026
6 checks passed
@corneliuhoffman corneliuhoffman deleted the lambda-bug branch January 6, 2026 15:50
@corneliuhoffman corneliuhoffman mentioned this pull request Jan 6, 2026
Closed
3 tasks
@dimitris-m dimitris-m mentioned this pull request Jan 6, 2026
Merged
tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Jan 9, 2026
@tmeijn
build(deps): update opengrep/opengrep to v1.14.1
0a97be3 
This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [opengrep/opengrep](https://github.com/opengrep/opengrep) | minor | `v1.13.2` → `v1.14.1` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>opengrep/opengrep (opengrep/opengrep)</summary>

### [`v1.14.1`](https://github.com/opengrep/opengrep/releases/tag/v1.14.1): Opengrep 1.14.1

[Compare Source](opengrep/opengrep@v1.14.0...v1.14.1)

#### Improvements

- Clojure translation part II by [@&#8203;dimitris-m](https://github.com/dimitris-m) in [#&#8203;517](opengrep/opengrep#517)
- C#: Allow implicit variables in properties to be taint sources by [@&#8203;maciejpirog](https://github.com/maciejpirog) in [#&#8203;516](opengrep/opengrep#516)
- Add core flags `dump_rule` and `dump_patterns_of_rule` as options in the show command by [@&#8203;maciejpirog](https://github.com/maciejpirog) in [#&#8203;519](opengrep/opengrep#519)

#### Bug fixes

- Fix: pass signature databaseb to lambda analysis, handle method mutation tainting by [@&#8203;corneliuhoffman](https://github.com/corneliuhoffman) in [#&#8203;520](opengrep/opengrep#520)

#### Tech debt

- Fix CHANGELOG.md, OPENGREP.md, remove unused files by [@&#8203;dimitris-m](https://github.com/dimitris-m) in [#&#8203;523](opengrep/opengrep#523)

**Full Changelog**: <opengrep/opengrep@v1.14.0...v1.14.1>

### [`v1.14.0`](https://github.com/opengrep/opengrep/releases/tag/v1.14.0): Opengrep 1.14.0

[Compare Source](opengrep/opengrep@v1.13.2...v1.14.0)

#### Improvements

- Support for higher-order functions in intrafile taint analysis by [@&#8203;corneliuhoffman](https://github.com/corneliuhoffman) in [#&#8203;469](opengrep/opengrep#469) and [#&#8203;513](opengrep/opengrep#513)
- Clojure: Improved support for Clojure (incl. tainting) by [@&#8203;dimitris-m](https://github.com/dimitris-m) in [#&#8203;501](opengrep/opengrep#501)
- Dart: Improved support for Dart by [@&#8203;maciejpirog](https://github.com/maciejpirog) in [#&#8203;508](opengrep/opengrep#508)
- C#: Better handing of extension methods and extension blocks by [@&#8203;maciejpirog](https://github.com/maciejpirog) in [#&#8203;514](opengrep/opengrep#514)

#### Fixes

- Bump cygwin install action by [@&#8203;dimitris-m](https://github.com/dimitris-m) in [#&#8203;503](opengrep/opengrep#503) and [#&#8203;509](opengrep/opengrep#509)

**Full Changelog**: <opengrep/opengrep@v1.13.2...v1.14.0>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi42OS4yIiwidXBkYXRlZEluVmVyIjoiNDIuNjkuMiIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiUmVub3ZhdGUgQm90IiwiYXV0b21hdGlvbjpib3QtYXV0aG9yZWQiLCJkZXBlbmRlbmN5LXR5cGU6Om1pbm9yIl19-->
@dimitris-m dimitris-m added bug Something isn't working taint labels Jan 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@maciejpirog maciejpirog maciejpirog approved these changes

@dimitris-m dimitris-m dimitris-m approved these changes

Assignees

No one assigned

Labels

bug Something isn't working taint

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@corneliuhoffman @dimitris-m @maciejpirog