Handoff: structural taint engine progress (foundation + field/foreach propagators)
ober
16e7c9d57ac73b21dafb6ccc26f5c50cbdea99ee
--- a/HANDOFF_OPUS_4_8.md +++ b/HANDOFF_OPUS_4_8.md @@ -176,12 +176,23 @@ languages, so closing them is the tip of the larger work: typed-metavar-not). All validated by targeted normalize comparison + smoke 321/321. - STILL handler-side (the deep remaining work, all genuinely hard): - - **TAINT** for every language (`scan-{lang}-taint-rule`) — needs a real - dataflow engine (type-aware assume-safe, best-fit-sink, lambda/getter - propagators, dead-catch reachability). This is the biggest remaining chunk - and what blocks dart + the java/scala/etc. taint fixtures. - - **FQN resolution** (java metavariable-resolution-test: Foo -> org.foo.Foo). + **Structural taint engine (in progress).** Building java taint on the general + structural engine to retire `scan-java-taint-rule`. Done so far: + - foundation: `java-parse-pattern` class-scaffold (fallback when a bare java + pattern errors at top level) so bare-identifier/expression SOURCES match; + java `implicit-assignment-patterns` ($L=$R, $T $L=$R, this.$L=$R, $L[$I]=$R). + - `java-field-decl-matches`: a `$T $L=$R` pattern matches a field_declaration, + so field initializers propagate taint. + - enhanced-for propagator: `for ($T $L : $R) {...}` taints the loop var. + Result: 8/18 java taint fixtures now flow structurally; removed the `tainting`, + `java-iterator-missed-propagation`, and `documentbuilderfactory` overfit clauses + (java 42/42, smoke 321/321 each step). + STILL handler-side (the harder taint features, the `test` rule-id group can't be + retired until ALL its fixtures pass): type-aware assume-safe (numbers1/booleans1), + best-fit-sink ranges (sink11), getter/setter sensitivity, lambda propagators + (lambda1/propagator_lambda), jpa-sqli (propagator4), tainted-file-path, and FQN + resolution (final_globals2, metavariable-resolution-test: Foo -> org.foo.Foo). + The same engine retires the other languages' taint handlers + unblocks dart. - a few per-language pattern hard-cases (go constant-folding/struct_tags, php metavar-call/non-prim-type, rust macro-call, kotlin named-ellipsis).