module

Flaw::Taint

Shape-based taint predicates. This is deliberately local — we look at direct AST node shapes without full call-graph tracing. It's enough to kill the common false positives (string coercion, parameterised calls, constant strings) without shipping a taint engine.

Constants

SAFE_RECEIVERS = {"URI", "HTML", "JSON", "Base64", "Crypto::Subtle"}

Method receivers whose calls are generally safe (escape/encode classes).

SANITIZER_CALLS = {"to_i", "to_i32", "to_i64", "to_u32", "to_u64", "to_f", "to_f32", "to_f64", "to_i?", "to_i64?", "to_f?", "encode_path", "encode_www_form", "escape", "constant_time_compare"}

Known sanitizers. A call wrapping a tainted value in one of these neutralises taint for our purposes.

TAINTED_CALLS = {"query_params", "path_params", "form_params", "body", "read_string"}
TAINTED_PARAM_RE = /\A(user_|raw_|unsafe_|untrusted_|input|body|payload|params|query|q|url|uri|path|name|id|cmd|command)\b/i
TAINTED_RECEIVERS = {"params", "request", "session", "cookies", "headers", "ARGV", "ENV"}

Known web-input sources. If an interpolated expression reads from one of these, we treat it as tainted.

Class methods

current_bindings

Per-file bindings, set by AstBackend.run for the duration of rule dispatch. Rules resolve Var references through this to peek at the RHS of local assignments.

Source
current_bindings=(current_bindings : Analysis::Bindings | Nil)

Per-file bindings, set by AstBackend.run for the duration of rule dispatch. Rules resolve Var references through this to peek at the RHS of local assignments.

Source
sanitized_call?(node : Crystal::Call) : Bool
Source
tainted?(node) : Bool
Source
tainted_source?(node) : Bool
Source