diff --git a/build-client.sh b/build-client.sh index 2005fcfb..4ee0423d 100755 --- a/build-client.sh +++ b/build-client.sh @@ -6,7 +6,7 @@ ROOT_DIR=$(cd "$(dirname "$0")" && pwd) LOGGER_FILE="$ROOT_DIR/src/util/logger.ts" PACKAGE_FILE="$ROOT_DIR/package.json" STARTER_FILE="$ROOT_DIR/src/interface/starter.ts" -SNAPSHOT_DIR=$(mktemp -d "${TMPDIR:-/tmp}/engine-client-build.XXXXXX") +SNAPSHOT_DIR=$(mktemp -d "${TMPDIR:-/tmp}/yasa2-client-build.XXXXXX") LOGGER_SNAPSHOT="$SNAPSHOT_DIR/logger.ts" PACKAGE_SNAPSHOT="$SNAPSHOT_DIR/package.json" STARTER_SNAPSHOT="$SNAPSHOT_DIR/starter.ts" diff --git a/package.json b/package.json index 07f4213f..bbd8c2c5 100644 --- a/package.json +++ b/package.json @@ -98,14 +98,17 @@ "test-clone-util": "npx mocha --require tsx/cjs test/rules-basic-handler/test-clone-util.ts", "test-sink-util-new-expr": "npx mocha --require tsx/cjs test/rules-basic-handler/test-sink-util-new-expr.ts", "test-sink-util-go-interface-passthrough": "npx mocha --require tsx/cjs test/rules-basic-handler/test-sink-util-go-interface-passthrough.ts", + "test-sink-util-go-qid-fallback": "npx mocha --require tsx/cjs test/rules-basic-handler/test-sink-util-go-qid-fallback.ts", "test-taint-output-strategy": "npx mocha --require tsx/cjs test/rules-basic-handler/test-taint-output-strategy.ts", "test-go-dynamic-key-taint": "npx mocha --require tsx/cjs test/rules-basic-handler/test-go-dynamic-key-taint.ts", "test-go-json-unmarshal-field-taint": "npx mocha --require tsx/cjs test/rules-basic-handler/test-go-json-unmarshal-field-taint.ts", "test-go-short-var-callback-taint": "npx mocha --require tsx/cjs test/rules-basic-handler/test-go-short-var-callback-taint.ts", + "test-go-callsite-limit-memory-guard": "npx mocha --require tsx/cjs test/go/test-go-callsite-limit-memory-guard.ts", + "test-go-callsite-limit-integration": "npx mocha --require tsx/cjs test/go/test-go-callsite-limit-integration.ts", "test-php-checker": "npx mocha --require tsx/cjs test/php/test-php-checker.ts", "test-php": "npx mocha --require tsx/cjs test/php/test-php-benchmark.ts", "update-php-expect": "YASA_UPDATE_PHP_BENCHMARK_EXPECT=1 npm run test-php && cp test/php/expect/phpbenchmark-expect.json.candidate test/php/expect/phpbenchmark-expect.json && rm test/php/expect/phpbenchmark-expect.json.candidate && npm run test-php", - "test-all": "npm run test-callargs && npm run test-fastapi-backgroundtasks && npm run test-match-field && npm run test-entrypoint-deadline-budget && npm run test-entrypoint-deadline-scheduler && npm run test-clone-util && npm run test-sink-util-new-expr && npm run test-taint-output-strategy && npm run test-go-dynamic-key-taint && npm run test-js && npm run test-java && npm run test-sarif-codeflow-quality && npm run test-go && npm run test-python && npm run test-callchain && npm run test-php", + "test-all": "npm run test-callargs && npm run test-fastapi-backgroundtasks && npm run test-match-field && npm run test-entrypoint-deadline-budget && npm run test-entrypoint-deadline-scheduler && npm run test-clone-util && npm run test-sink-util-new-expr && npm run test-taint-output-strategy && npm run test-go-dynamic-key-taint && npm run test-go-callsite-limit-memory-guard && npm run test-go-callsite-limit-integration && npm run test-sink-util-go-qid-fallback && npm run test-js && npm run test-java && npm run test-sarif-codeflow-quality && npm run test-go && npm run test-python && npm run test-callchain && npm run test-php", "build": "bash build.sh", "prepare-better-sqlite3-native": "bash scripts/download-better-sqlite3-native.sh", "lint": "eslint .", diff --git a/resource/example-rule-config/rule_config_sanitizer_for_java_example.json b/resource/example-rule-config/rule_config_sanitizer_for_java_example.json index 5900f93a..93ca9a99 100644 --- a/resource/example-rule-config/rule_config_sanitizer_for_java_example.json +++ b/resource/example-rule-config/rule_config_sanitizer_for_java_example.json @@ -16,7 +16,7 @@ "id": "SANITIZER_2", "sanitizerType": "FunctionCallSanitizer", "sanitizerScenario": "SANITIZER.VALIDATE_BY_FUNCTIONCALL", - "calleeType": "com.example.security.util.CommandParameterChecker", + "calleeType": "com.alipay.common.security.util.secutils.cmd.CmdParameterChecker", "fsig": "checkCmdParameter", "args": [ "0" @@ -26,7 +26,7 @@ "id": "SANITIZER_3", "sanitizerType": "FunctionCallSanitizer", "sanitizerScenario": "SANITIZER.CALLSTACK_HAS_FUNCTIONCALL", - "calleeType": "com.example.security.util.CommandChecker", + "calleeType": "com.alipay.common.security.util.secutils.cmd.AlipayCmdChecker", "fsig": "hookStart", "args": [ "0" diff --git a/scripts/regtest-run-case.sh b/scripts/regtest-run-case.sh new file mode 100755 index 00000000..8be6e4e8 --- /dev/null +++ b/scripts/regtest-run-case.sh @@ -0,0 +1,57 @@ +#!/usr/bin/env bash +# 回归用例标准执行脚本（源码形式 tsx + src/main.ts），参数从用例 .config 读取，不自行改参数。 +# 用法: ENGINE_DIR= scripts/regtest-run-case.sh [testcase-root] +# ENGINE_DIR 默认为本脚本所在仓库根（ours）。 +# 严格串行：同一 engine 目录禁止并行；调用方负责不并行起任务。 +set -uo pipefail + +CASE="${1:?case name required}" +REPORT="${2:?report dir required}" +ROOT="${3:-/Users/ariel/code/yasa-reformat/test/yasa2-bench/testcase/python}" + +SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" +ENGINE_DIR="${ENGINE_DIR:-$(cd "$SCRIPT_DIR/.." && pwd)}" +cd "$ENGINE_DIR" + +CASE_DIR="$ROOT/$CASE" +# mpc_server 目录内部 case 名是 mcp_server，特例处理 +if [[ "$CASE" == "mpc_server" ]]; then + CFG_NAME="mcp_server" + SOURCE_PATH="$CASE_DIR/mcp_server" +else + CFG_NAME="$CASE" + SOURCE_PATH="$CASE_DIR/$CASE" +fi + +CONFIG_FILE="$CASE_DIR/$CFG_NAME.config" +[[ -f "$CONFIG_FILE" ]] || { echo "missing $CONFIG_FILE" >&2; exit 2; } + +CHECKER_PACKS=$(python -c "import json;d=json.load(open('$CONFIG_FILE'));print(','.join(d['checkerPackIds']))") +ANALYZER=$(python -c "import json;d=json.load(open('$CONFIG_FILE'));print(d.get('analyzer',''))") +LANGUAGE=$(python -c "import json;d=json.load(open('$CONFIG_FILE'));print(d.get('language',''))") +RULE_CONFIG_REL=$(python -c "import json;d=json.load(open('$CONFIG_FILE'));print(d.get('ruleConfigFile',''))") +RULE_CONFIG="$CASE_DIR/${RULE_CONFIG_REL#./}" + +NODE_OPTS=$(python -c "import json;d=json.load(open('$CONFIG_FILE'));print(d.get('nodeOptions',''))") +[[ -n "$NODE_OPTS" ]] && export NODE_OPTIONS="$NODE_OPTS" + +[[ -d "$SOURCE_PATH" ]] || { echo "missing sourcePath $SOURCE_PATH" >&2; exit 2; } + +rm -rf "$REPORT"; mkdir -p "$REPORT" + +ARGS=(--sourcePath "$SOURCE_PATH" --checkerPackIds "$CHECKER_PACKS" --language "$LANGUAGE" --ruleConfigFile "$RULE_CONFIG" --report "$REPORT") +[[ -n "$ANALYZER" ]] && ARGS+=(--analyzer "$ANALYZER") + +# 留痕：完整命令写进 report/cmd.log +{ + echo "# ENGINE_DIR=$ENGINE_DIR" + echo "# HEAD=$(git rev-parse --short HEAD 2>/dev/null)" + echo "# NODE_OPTIONS=${NODE_OPTIONS:-}" + echo "node ./node_modules/tsx/dist/cli.mjs ./src/main.ts \\" + for a in "${ARGS[@]}"; do echo " $a \\"; done + echo +} > "$REPORT/cmd.log" + +echo "[regtest] ENGINE=$ENGINE_DIR CASE=$CASE REPORT=$REPORT" +/usr/bin/time -l node ./node_modules/tsx/dist/cli.mjs ./src/main.ts "${ARGS[@]}" 1>/dev/null 2>"$REPORT/time.log" +echo "[regtest] exit=$?" \ No newline at end of file diff --git a/src/checker/common/output/taint-output-strategy.ts b/src/checker/common/output/taint-output-strategy.ts index 293ebc37..e27e4c2b 100644 --- a/src/checker/common/output/taint-output-strategy.ts +++ b/src/checker/common/output/taint-output-strategy.ts @@ -1,6 +1,7 @@ import type { IResultManager } from '../../../engine/analyzer/common/result-manager' import type { IConfig } from '../../../config' import type { TaintFinding } from '../../../engine/analyzer/common/common-types' +import type { SarifLocation } from '../../../engine/analyzer/common/sarif' const _ = require('lodash') const path = require('path') @@ -16,8 +17,7 @@ const logger = require('../../../util/logger')(__filename) const { registerDedupFunction, } = require('../../../engine/analyzer/common/entrypoint/merge-coordinator') as typeof import('../../../engine/analyzer/common/entrypoint/merge-coordinator') - -type SarifLocation = { physicalLocation?: Record; [key: string]: unknown } +const { getJavaFindingSignature } = require('../../taint/java/java-finding-candidate') as typeof import('../../taint/java/java-finding-candidate') const { prepareLocation, @@ -265,7 +265,7 @@ function extractSinkKey(finding: TracePreserveFinding): string | null { } type JavaTraceGroup = { call: string; argPass: string } -type JavaFindingProjection = { source: string; sink: string; groups: JavaTraceGroup[] } +type JavaFindingProjection = { source: string; sink: string; sinkAttribute: string; groups: JavaTraceGroup[] } function traceItemIdentity(item: TaintTraceItem): string | null { const file = getTraceFileKey(item) @@ -282,6 +282,9 @@ function getJavaFindingProjection(finding: TracePreserveFinding): JavaFindingPro const source = extractSourceKey(finding) const sink = extractSinkKey(finding) if (!source || source.includes(':-1:-1') || !sink || sink.includes(':-1:-1')) return null + // sinkAttribute 纳入投影键，避免不同 attribute 的同类 finding 被误去重 + const attrArr = (finding as any).sinkAttribute as string[] | undefined + const sinkAttribute = Array.isArray(attrArr) ? attrArr.slice().sort().join(',') : '' const groups: JavaTraceGroup[] = [] for (let i = 0; i < finding.trace.length; i++) { const item = finding.trace[i] @@ -293,12 +296,12 @@ function getJavaFindingProjection(finding: TracePreserveFinding): JavaFindingPro if (call && argPass) groups.push({ call, argPass }) i++ } - return { source, sink, groups } + return { source, sink, sinkAttribute, groups } } function getJavaProjectionKey(projection: JavaFindingProjection): string { const groups = projection.groups.map((group) => `${group.call}${group.argPass}`).join('') - return `${projection.source}${projection.sink}${groups}` + return `${projection.source}${projection.sink}${projection.sinkAttribute}${groups}` } const javaProjectionIndexes = new WeakMap>() @@ -316,15 +319,21 @@ function getJavaProjectionIndex(category: TaintFinding[]): Map` 标记。 + * W14f: 当 fclos.rtype 缺失但 fclos.qid 编码 receiver 类型时（如 Go 全局变量 method call）， + * 按 qid 后缀匹配 calleeType 与 fsig。先 strip qid 中的 `` 标记。 * @param qid fclos.qid * @param calleeType sink rule calleeType（可能带 `*` 前缀） * @param calleeTypeBase calleeType 去 `*` 后的形式 @@ -379,10 +382,12 @@ function matchEmptyCalleeTypeInstanceMethod( if (propertyName !== methodName) return false const cleanQid = typeof fclos.qid === 'string' ? fclos.qid.replace(/]*>/g, '') : '' + // Go qid 用 `/` 分隔包路径，rule.fsig 用 `.`，统一归一化后再做 endsWith + const normalizedQid = cleanQid.replace(/\//g, '.') return ( matchReceiverTypeName(AstUtilSinkUtil.prettyPrint(fclos.object?.rtype?.definiteType), typeName) || matchReceiverTypeName(AstUtilSinkUtil.prettyPrint(fclos.rtype?.definiteType), typeName) || - cleanQid.endsWith(`.${rule.fsig}`) + normalizedQid.endsWith(`.${rule.fsig}`) ) } diff --git a/src/checker/taint/java/callee-entry.ts b/src/checker/taint/java/callee-entry.ts new file mode 100644 index 00000000..e3918aab --- /dev/null +++ b/src/checker/taint/java/callee-entry.ts @@ -0,0 +1,65 @@ +const QidUnifyUtil = require('../../../util/qid-unify-util') as { qidUnifyByRemoveAngleAndPrefix(value: string): string } + +export type CalleeEntryLocation = { + sourcefile: string + start: { line: number; column?: number } + end: { line: number; column?: number } +} + +type NodeLocation = { + sourcefile?: string + start?: { line?: number; column?: number } + end?: { line?: number; column?: number } +} + +type CalleeEntryNode = { + loc?: NodeLocation + _meta?: { nodehash?: unknown } + id?: { name?: string; loc?: NodeLocation } + body?: { loc?: NodeLocation } + [key: string]: unknown +} + +type CalleeEntryFrame = { + fname?: string + qid?: string + ast?: { node?: CalleeEntryNode } +} + +export type CalleeEntry = { + file: string + line: number + loc: CalleeEntryLocation + node: CalleeEntryNode + name: string +} + +function validLocation(location: NodeLocation | undefined): { file: string; line: number; column?: number } | undefined { + const file = location?.sourcefile + const line = location?.start?.line + if (typeof file !== 'string' || file.length === 0 || typeof line !== 'number') return undefined + return { file, line, column: location?.start?.column } +} + +/** + * 统一 callee-entry 展示位置：方法标识符、方法体、函数节点依次回退，并压缩为单行。 + * 节点显式复制 frame nodeHash，避免位置包装丢失调用栈身份。 + */ +export function getCalleeEntry(frame: unknown): CalleeEntry | undefined { + if (!frame || typeof frame !== 'object') return undefined + const candidate = frame as CalleeEntryFrame + const node = candidate.ast?.node + if (!node) return undefined + const selected = validLocation(node.id?.loc) ?? validLocation(node.body?.loc) ?? validLocation(node.loc) + if (!selected) return undefined + const nodehash = node._meta?.nodehash + const loc: CalleeEntryLocation = { + sourcefile: selected.file, + start: { line: selected.line, column: selected.column ?? 0 }, + end: { line: selected.line, column: selected.column ?? 0 }, + } + const wrappedNode: CalleeEntryNode = { ...node, loc, _meta: { ...node._meta, nodehash } } + const rawName = node.id?.name || candidate.fname || candidate.qid || '' + const name = QidUnifyUtil.qidUnifyByRemoveAngleAndPrefix(rawName) || rawName + return { file: selected.file, line: selected.line, loc, node: wrappedNode, name } +} diff --git a/src/checker/taint/java/java-entrypoint-finding-collector.ts b/src/checker/taint/java/java-entrypoint-finding-collector.ts new file mode 100644 index 00000000..0ce02a93 --- /dev/null +++ b/src/checker/taint/java/java-entrypoint-finding-collector.ts @@ -0,0 +1,204 @@ +/** + * Java 逻辑入口的 finding 候补生命周期。 + * + * 候补只在入口正常完成时转交给全局结果管理器；timeout、skip 和异常 + * 不会提前写入全局，也不会把上一次入口的状态带到下一次入口。 + */ + +export type JavaEntrypointTerminalOutcome = 'completed' | 'timeout' | 'skip' | 'exception' + +export type JavaCandidateEmitter = (finding: TFinding) => void +export type JavaCandidateDeduplicator = (finding: TFinding) => boolean +export type JavaCandidatePromotionAdapter = { + isNewFinding: JavaCandidateDeduplicator + emit: JavaCandidateEmitter +} + +export type JavaEntrypointFindingState = { + readonly normalSignatures: Set + readonly candidates: Map +} + +/** 单个逻辑 Java/Spring 入口的状态容器。overload/rerun 共用同一个实例。 */ +export class JavaEntrypointFindingCollector { + private promotionAdapter?: JavaCandidatePromotionAdapter + + private readonly state: JavaEntrypointFindingState = { + normalSignatures: new Set(), + candidates: new Map(), + } + + /** 注入现有全局 dedup 与写入适配器，避免候补在生产路径被静默清空。 */ + configurePromotion(adapter: JavaCandidatePromotionAdapter): void { + this.promotionAdapter = adapter + } + + /** 当前入口的正常 finding 签名，供入口内仲裁使用。 */ + get normalSignatures(): ReadonlySet { + return this.state.normalSignatures + } + + /** 当前入口按首次出现顺序去重的候补。 */ + get candidates(): ReadonlyMap { + return this.state.candidates + } + + /** 登记正常 finding；同签名重复登记不改变稳定顺序。 */ + registerNormal(signature: TSignature): void { + this.state.normalSignatures.add(signature) + this.state.candidates.delete(signature) + } + + /** 登记候补；同签名候补只保留第一个，正常 finding 不在此处写全局。 */ + registerCandidate(signature: TSignature, finding: TFinding): void { + if (this.state.normalSignatures.has(signature) || this.state.candidates.has(signature)) return + this.state.candidates.set(signature, finding) + } + + recordNormal(signature: TSignature): void { + this.registerNormal(signature) + } + + recordCandidate(signature: TSignature, finding: TFinding): void { + this.registerCandidate(signature, finding) + } + + /** + * 入口正常完成时仲裁候补，并在回调返回后清空入口状态。 + * 候补再次走现有全局 dedup；正常签名优先于候补。 + */ + complete( + isNewFinding?: JavaCandidateDeduplicator, + emit?: JavaCandidateEmitter, + ): void { + try { + const promoter = isNewFinding && emit ? { isNewFinding, emit } : this.promotionAdapter + if (!promoter) return + for (const [signature, finding] of this.state.candidates) { + if (this.state.normalSignatures.has(signature)) continue + if (promoter.isNewFinding(finding)) promoter.emit(finding) + } + } finally { + this.clear() + } + } + + /** + * 入口结束异常、skip 或最终 timeout 时丢弃全部临时状态。 + * 非正常 outcome 不调用全局写入回调。 + */ + finalize(outcome: Exclude): void { + if (outcome === 'timeout' || outcome === 'skip' || outcome === 'exception') this.clear() + } + + /** 首次 timeout 后保留状态，供同一逻辑入口的 rerun 继续登记。 */ + deferForRerun(): void { + // 有意保持状态；rerun 完成后调用 complete，最终失败时调用 finalize。 + } + + /** 清空入口状态，保证 collector 可安全复用于下一逻辑入口。 */ + clear(): void { + this.state.normalSignatures.clear() + this.state.candidates.clear() + } + + /** collector 完成或中止后必须为空。 */ + get isEmpty(): boolean { + return this.state.normalSignatures.size === 0 && this.state.candidates.size === 0 + } +} + +/** + * 按逻辑入口 key 隔离 collector；同一 key 的 overload/rerun 会复用状态， + * 不同 key 即使并发执行也不会互相覆盖。 + */ +export class JavaEntrypointFindingCollectorRegistry { + private readonly collectors = new Map>() + private promotionAdapter?: JavaCandidatePromotionAdapter + + /** 开启新的分析运行，丢弃上一次运行遗留的逻辑入口状态。 */ + beginRun(): void { + this.clear() + } + + configurePromoter(adapter: JavaCandidatePromotionAdapter): void { + this.promotionAdapter = adapter + for (const collector of this.collectors.values()) collector.configurePromotion(adapter) + } + + get(logicalEntrypointKey: string): JavaEntrypointFindingCollector { + const existing = this.collectors.get(logicalEntrypointKey) + if (existing) return existing + const collector = new JavaEntrypointFindingCollector() + if (this.promotionAdapter) collector.configurePromotion(this.promotionAdapter) + this.collectors.set(logicalEntrypointKey, collector) + return collector + } + + /** 正常完成并移除入口 collector，避免生命周期状态泄漏。 */ + complete( + logicalEntrypointKey: string, + isNewFinding?: JavaCandidateDeduplicator, + emit?: JavaCandidateEmitter, + ): void { + const collector = this.collectors.get(logicalEntrypointKey) + if (!collector) return + try { + collector.complete(isNewFinding, emit) + } finally { + this.collectors.delete(logicalEntrypointKey) + } + } + + /** timeout/skip/异常最终结束时清理；首次 timeout 不应调用此方法。 */ + finalize(logicalEntrypointKey: string, outcome: Exclude): void { + const collector = this.collectors.get(logicalEntrypointKey) + if (!collector) return + collector.finalize(outcome) + this.collectors.delete(logicalEntrypointKey) + } + + /** 调试及生命周期测试使用；返回仍存活的逻辑入口数量。 */ + get size(): number { + return this.collectors.size + } + + /** 强制清空所有入口，供分析器退出保护路径使用。 */ + clear(): void { + for (const collector of this.collectors.values()) collector.clear() + this.collectors.clear() + } +} + +import type { TaintFinding } from '../../../engine/analyzer/common/common-types' + +/** Java/Spring 主循环共享的入口候补 registry；候补实现接入时复用同一实例。 */ +export const javaEntrypointFindingCollectors = + new JavaEntrypointFindingCollectorRegistry() + +/** 从当前入口对象生成稳定的逻辑入口隔离键。 */ +export function getJavaLogicalEntrypointKey(entryPoint: unknown): string { + if (!entryPoint || typeof entryPoint !== 'object') return '' + const candidate = entryPoint as { + filePath?: unknown + functionName?: unknown + type?: unknown + attribute?: unknown + funcLocStart?: unknown + funcLocEnd?: unknown + entryPointSymVal?: { ast?: { node?: { loc?: { sourcefile?: unknown; start?: { line?: unknown }; end?: { line?: unknown } } } } } + } + const loc = candidate.entryPointSymVal?.ast?.node?.loc + return [ + candidate.filePath ?? loc?.sourcefile ?? '', + candidate.functionName ?? '', + candidate.type ?? '', + candidate.funcLocStart ?? loc?.start?.line ?? '', + candidate.funcLocEnd ?? loc?.end?.line ?? '', + candidate.attribute ?? '', + ].map(String).join('|') +} + +export function getJavaEntrypointFindingCollector(logicalEntrypointKey: string): JavaEntrypointFindingCollector { + return javaEntrypointFindingCollectors.get(logicalEntrypointKey) +} diff --git a/src/checker/taint/java/java-finding-candidate.ts b/src/checker/taint/java/java-finding-candidate.ts new file mode 100644 index 00000000..d65577f4 --- /dev/null +++ b/src/checker/taint/java/java-finding-candidate.ts @@ -0,0 +1,164 @@ +import type { TaintFinding } from '../../../engine/analyzer/common/common-types' +import type { TraceItem } from '../../../util/finding-util' +import { getCalleeEntry } from './callee-entry' + +type SourceLocation = { + sourcefile?: string + start?: { line?: number; column?: number } + end?: { line?: number; column?: number } +} + +type NodeMeta = { nodehash?: unknown } +type AstNode = { + loc?: SourceLocation + _meta?: NodeMeta + id?: { name?: string; loc?: SourceLocation } + body?: { loc?: SourceLocation } + [key: string]: unknown +} +type CallstackFrame = { vtype?: string; ast?: { node?: AstNode }; [key: string]: unknown } +type CallsiteFrame = { code?: string; nodeHash?: string | number; loc?: SourceLocation; [key: string]: unknown } +export type JavaCandidateFinding = TaintFinding & { + trace?: TraceItem[] + callstack?: unknown + callsites?: unknown + sinkAttribute?: string[] + traceRejectReason?: string + node?: AstNode +} +type TraceIdentity = { file: string; startLine: number; endLine: number } + +const ARG_PASS_ORDER_OUT_OF_CALLSTACK = 'ARG_PASS_ORDER_OUT_OF_CALLSTACK' +export const JAVA_CANDIDATE_FINDING_MARKER = 'isJavaCandidateFinding' + +function asCandidateFinding(finding: TaintFinding): JavaCandidateFinding { + return finding as JavaCandidateFinding +} + +function getNodeHash(node: AstNode | undefined): string | number | undefined { + const value = node?._meta?.nodehash + return typeof value === 'string' || typeof value === 'number' ? value : undefined +} + +function getLocation(value: { loc?: SourceLocation; file?: string; line?: number | number[] } | undefined): TraceIdentity | undefined { + if (!value) return undefined + const loc = value.loc ?? (value as { node?: { loc?: SourceLocation } }).node?.loc + const file = loc?.sourcefile ?? value.file + const rawStart = loc?.start?.line ?? value.line + const rawEnd = loc?.end?.line ?? value.line + const startLine = Array.isArray(rawStart) ? rawStart[0] : rawStart + const endLine = Array.isArray(rawEnd) ? rawEnd[rawEnd.length - 1] : rawEnd + if (typeof file !== 'string' || file.length === 0 || typeof startLine !== 'number' || typeof endLine !== 'number') return undefined + return { file, startLine, endLine } +} + +function locationKey(value: { loc?: SourceLocation; file?: string; line?: number | number[]; node?: AstNode } | undefined): string | undefined { + const location = getLocation(value) + if (!location) return undefined + const nodeHash = getNodeHash(value?.node) + return `${location.file}:${location.startLine}-${location.endLine}${nodeHash === undefined ? '' : `#${nodeHash}`}` +} + +function isValidTraceBoundaryStep(step: TraceItem | undefined, expectedTag: string): boolean { + if (step?.tag !== expectedTag) return false + return Boolean(getLocation(step) && getNodeHash(step.node as AstNode | undefined) !== undefined) +} + +function cloneNodeWithLocation(node: AstNode, location: SourceLocation, nodehash: string | number): AstNode { + return { ...node, loc: location, _meta: { ...node._meta, nodehash } } +} + +function getCallstackAndCallsites(finding: JavaCandidateFinding): { callstack: CallstackFrame[]; callsites: CallsiteFrame[] } | undefined { + if (!Array.isArray(finding.callstack) || !Array.isArray(finding.callsites)) return undefined + const callstack = finding.callstack as CallstackFrame[] + const callsites = finding.callsites as CallsiteFrame[] + if (callstack.length < 2 || callstack.length !== callsites.length) return undefined + for (let index = 0; index < callstack.length; index++) { + const frame = callstack[index] + const frameNode = frame?.ast?.node + const callsite = callsites[index] + if (!callsite || !getLocation(callsite) || callsite.nodeHash === undefined) return undefined + if (frame?.vtype !== 'fclos' || !frameNode || !getLocation(frameNode) || getNodeHash(frameNode) === undefined) continue + } + return { callstack, callsites } +} + +/** + * finding签名定义为 SOURCE、SINK、按调用路径顺序排列的 CALL+ARG PASS 对和 SINK ATTRIBUTE。 + * 该签名同时服务正常 finding 与候补 finding，位置键保留既有 Java 去重语义。 + */ +export function getJavaFindingSignature(finding: TaintFinding): string | undefined { + if (!finding) throw new TypeError('Java finding signature received null finding') + if (finding.type !== 'taint_flow_java_input' && finding.type !== 'taint_flow_java_input_inner') return undefined + const candidate = asCandidateFinding(finding) + if (!Array.isArray(candidate.trace) || candidate.trace.length < 2) return undefined + const source = candidate.trace.find((step) => step?.tag === 'SOURCE: ') + const sink = [...candidate.trace].reverse().find((step) => step?.tag === 'SINK: ') + const sourceKey = locationKey(source) + const sinkKey = locationKey(sink) + if (!sourceKey || !sinkKey) return undefined + const groups: string[] = [] + for (let index = 0; index < candidate.trace.length; index++) { + const call = candidate.trace[index] + if (call?.tag !== 'CALL: ') continue + const argPass = candidate.trace[index + 1] + if (argPass?.tag !== 'ARG PASS: ') continue + const callKey = locationKey(call) + const argPassKey = locationKey(argPass) + if (!callKey || !argPassKey) return undefined + groups.push(`${callKey}\u0001${argPassKey}`) + index++ + } + const sinkAttribute = Array.isArray(candidate.sinkAttribute) ? candidate.sinkAttribute.slice().sort().join(',') : '' + return `${sourceKey}\u0003${sinkKey}\u0005${sinkAttribute}\u0004${groups.join('\u0002')}` +} + +/** + * 仅基于唯一 ARG_PASS_ORDER_OUT_OF_CALLSTACK 拒绝原因重建保守 Java 候补。 + * 原 finding 不会被修改或恢复；候补的 trace、callstack、callsites 使用同一可信调用结构裁剪。 + */ +export function buildJavaCandidateFinding(finding: TaintFinding): TaintFinding | undefined { + if (!finding) throw new TypeError('Candidate reconstruction received null finding') + const sourceFinding = asCandidateFinding(finding) + if (sourceFinding.traceRejectReason !== ARG_PASS_ORDER_OUT_OF_CALLSTACK) return undefined + if (!Array.isArray(sourceFinding.trace) || sourceFinding.trace.length < 2) return undefined + const source = sourceFinding.trace[0] + const sink = sourceFinding.trace[sourceFinding.trace.length - 1] + if (!isValidTraceBoundaryStep(source, 'SOURCE: ') || !isValidTraceBoundaryStep(sink, 'SINK: ')) return undefined + if (sourceFinding.sinkAttribute && sourceFinding.sinkAttribute.some((attribute) => typeof attribute !== 'string')) return undefined + const structure = getCallstackAndCallsites(sourceFinding) + if (!structure) return undefined + const { callstack, callsites } = structure + const rootNode = callstack[0]?.ast?.node + if (!rootNode || !getLocation(rootNode) || getNodeHash(rootNode) === undefined) return undefined + const candidateTrace: TraceItem[] = [source] + const candidateCallstack: CallstackFrame[] = [] + const candidateCallsites: CallsiteFrame[] = [] + for (let index = 0; index < callstack.length; index++) { + const frame = callstack[index] + const frameNode = frame?.ast?.node + const callsite = callsites[index] + const calleeEntry = getCalleeEntry(frame) + const frameLocation = getLocation(frameNode) + const callsiteLocation = getLocation(callsite) + const frameHash = getNodeHash(frameNode) + const callsiteHash = callsite?.nodeHash + if (!frameNode || !calleeEntry || !frameLocation || !callsiteLocation || frameHash === undefined || callsiteHash === undefined || !callsite?.loc) continue + candidateCallstack.push(frame) + candidateCallsites.push(callsite) + if (index === 0) continue + const callNode = cloneNodeWithLocation(frameNode, callsite.loc, callsiteHash) + candidateTrace.push({ file: callsiteLocation.file, line: callsiteLocation.startLine, tag: 'CALL: ', node: callNode, affectedNodeName: calleeEntry.name }) + candidateTrace.push({ file: calleeEntry.file, line: calleeEntry.line, tag: 'ARG PASS: ', node: calleeEntry.node, affectedNodeName: calleeEntry.name }) + } + candidateTrace.push(sink) + const edgePairs = candidateTrace.filter((step) => step?.tag === 'CALL: ').length + if (candidateCallstack.length !== edgePairs + 1 || candidateCallsites.length !== candidateCallstack.length) return undefined + const candidate: JavaCandidateFinding = { ...sourceFinding, trace: candidateTrace, callstack: candidateCallstack, callsites: candidateCallsites } + candidate[JAVA_CANDIDATE_FINDING_MARKER] = true + return candidate +} + +export function isJavaCandidateFinding(finding: TaintFinding): finding is JavaCandidateFinding { + return asCandidateFinding(finding)[JAVA_CANDIDATE_FINDING_MARKER] === true +} diff --git a/src/checker/taint/java/java-taint-abstract-checker.ts b/src/checker/taint/java/java-taint-abstract-checker.ts index dc853898..d34b427c 100644 --- a/src/checker/taint/java/java-taint-abstract-checker.ts +++ b/src/checker/taint/java/java-taint-abstract-checker.ts @@ -1,6 +1,7 @@ import type { CallInfo } from '../../../engine/analyzer/common/call-args' import type { AstSourceLocation, EntryPointRuleConfig } from '../../../engine/analyzer/common/entrypoint/entrypoint' import type { Invocation } from '../../../resolver/common/value/invocation' +import type { TaintFinding } from '../../../engine/analyzer/common/common-types' const QidUnifyUtil = require('../../../util/qid-unify-util') const TaintCheckerJava = require('../taint-checker') @@ -19,6 +20,11 @@ const { satisfy, defaultFilter } = require('../../../util/ast-util') const Config = require('../../../config') const logger = require('../../../util/logger')(__filename) const { lodashCloneWithTag } = require('../../../util/clone-util') +const { FunctionValue } = require('../../../engine/analyzer/common/value/function') as typeof import('../../../engine/analyzer/common/value/function') +const { ClassValue } = require('../../../engine/analyzer/common/value/class') as typeof import('../../../engine/analyzer/common/value/class') +const { getEntryPointOwnerKey } = require('../../../engine/analyzer/common/entrypoint/current-entrypoint') as { getEntryPointOwnerKey: () => string | undefined } +const { getJavaFindingSignature, isJavaCandidateFinding } = require('./java-finding-candidate') as typeof import('./java-finding-candidate') +const { getJavaEntrypointFindingCollector } = require('./java-entrypoint-finding-collector') as typeof import('./java-entrypoint-finding-collector') const TAINT_TAG_NAME_JAVA = 'JAVA_INPUT' @@ -26,6 +32,7 @@ type JavaEntrypointConfig = EntryPointRuleConfig & { packageName?: string paramTypes?: string[] signature?: string + funcLoc?: { start?: number; end?: number } } type JavaTypeParamNode = { @@ -46,10 +53,35 @@ type CallableAstLike = JavaEntrypointFunctionNode & { node?: JavaEntrypointFunctionNode } +type JavaOwnerLike = { + vtype?: string + logicalQid?: string + qid?: string + sid?: string + ast?: CallableAstLike & { node?: { loc?: AstSourceLocation & { sourcefile?: string } } } + parent?: JavaOwnerLike + _this?: JavaOwnerLike + members?: Map + value?: Record +} type FunctionClosureLike = { vtype?: string ast?: CallableAstLike overloaded?: JavaEntrypointFunctionNode[] + parent?: JavaOwnerLike +} + +type JavaSymbolTableLike = { + get: (key: unknown) => unknown +} + +type JavaClassMapLike = { + values: () => Iterable +} + +type JavaAnalyzerLike = { + classMap?: JavaClassMapLike + symbolTable?: JavaSymbolTableLike } type JavaTypeResolverLike = { @@ -143,13 +175,21 @@ class JavaTaintAbstractChecker extends TaintCheckerJava { * @param entrypoint */ matchEntrypointFunction(node: JavaEntrypointFunctionNode, entrypoint: JavaEntrypointConfig): boolean { - if (entrypoint.funcLocStart != null || entrypoint.funcLocEnd != null) { + const funcLocStart = entrypoint.funcLocStart ?? entrypoint.funcLoc?.start + const funcLocEnd = entrypoint.funcLocEnd ?? entrypoint.funcLoc?.end + if (funcLocStart != null || funcLocEnd != null) { const loc = getSourceLineLoc(node) - const startMatches = entrypoint.funcLocStart == null || loc.start === entrypoint.funcLocStart - const endMatches = entrypoint.funcLocEnd == null || loc.end === entrypoint.funcLocEnd - if (startMatches && endMatches) return true + const startMatches = funcLocStart == null || loc.start === funcLocStart + const endMatches = funcLocEnd == null || loc.end === funcLocEnd + return startMatches && endMatches + } + if (Array.isArray(entrypoint.paramTypes) && entrypoint.paramTypes.length > 0) { + return matchParamTypes(node, entrypoint.paramTypes) + } + if (typeof entrypoint.signature === 'string') { + return matchSignature(node, entrypoint.signature) } - return matchParamTypes(node, entrypoint.paramTypes) || matchSignature(node, entrypoint.signature) + return true } /** @@ -161,6 +201,8 @@ class JavaTaintAbstractChecker extends TaintCheckerJava { const hasDisambiguator = entrypoint.funcLocStart != null || entrypoint.funcLocEnd != null || + entrypoint.funcLoc?.start != null || + entrypoint.funcLoc?.end != null || (Array.isArray(entrypoint.paramTypes) && entrypoint.paramTypes.length > 0) || typeof entrypoint.signature === 'string' if (!hasDisambiguator || !isFunctionClosureLike(entryPointSymVal)) { @@ -172,7 +214,7 @@ class JavaTaintAbstractChecker extends TaintCheckerJava { ) const matchedNode = candidates.find((node) => this.matchEntrypointFunction(node, entrypoint)) if (!matchedNode) { - return entryPointSymVal + return undefined } const cloned = lodashCloneWithTag(entryPointSymVal) as FunctionClosureLike @@ -183,6 +225,136 @@ class JavaTaintAbstractChecker extends TaintCheckerJava { return cloned } + /** + * 从方法 AST 中收集匿名内部类或局部类里的同名方法。 + * @param root - 外层方法 AST + * @param functionName - 方法名 + * @param ownerClosure - 外层方法闭包 + * @returns 匿名或嵌套方法闭包 + */ + collectNestedEntryPointClosures( + root: JavaEntrypointFunctionNode, + functionName: string, + ownerClosure: FunctionClosureLike + ): FunctionClosureLike[] { + const result: FunctionClosureLike[] = [] + const visited = new Set() + const visit = (value: unknown): void => { + if (!value || typeof value !== 'object') return + const record = value as Record + if (visited.has(record)) return + visited.add(record) + if (record !== root && record.type === 'FunctionDefinition') { + const node = record as JavaEntrypointFunctionNode + const nodeName = node.id?.name ?? node.name + if (nodeName === functionName) { + const owner = this.createNestedEntryPointOwner(ownerClosure, node) + result.push(this.createNestedEntryPointClosure(ownerClosure, owner, node)) + } + } + for (const [key, child] of Object.entries(record)) { + if (key === 'parent' || key === 'loc' || key === '_meta') continue + if (Array.isArray(child)) child.forEach(visit) + else visit(child) + } + } + visit(root) + return result + } + + /** + * 创建嵌套方法的独立 owner，保持其 parent、this 和限定名与外层方法隔离。 + * @param ownerClosure - 外层方法闭包 + * @param node - 嵌套方法 AST + * @returns 嵌套方法 owner + */ + createNestedEntryPointOwner(ownerClosure: FunctionClosureLike, node: JavaEntrypointFunctionNode): JavaOwnerLike { + const parent = ownerClosure.parent + const parentQid = parent?.logicalQid ?? parent?.qid ?? '' + const loc = getSourceLineLoc(node) + const suffix = `` + const owner = new ClassValue(parentQid, suffix, parent as never) + owner.ast = node + const nestedOwner = owner as unknown as JavaOwnerLike & { ast: { hasDecl: (key: string) => boolean } } + if (typeof nestedOwner.ast.hasDecl !== 'function') { + throw new TypeError('Nested entry point owner AST must be AstBinding') + } + return owner as unknown as JavaOwnerLike + } + + /** + * 创建嵌套方法闭包，绑定到独立 owner。 + * @param ownerClosure - 外层方法闭包 + * @param owner - 嵌套方法 owner + * @param node - 嵌套方法 AST + * @returns 嵌套方法闭包 + */ + createNestedEntryPointClosure( + ownerClosure: FunctionClosureLike, + owner: JavaOwnerLike, + node: JavaEntrypointFunctionNode + ): FunctionClosureLike { + const parent = ownerClosure.parent + const qid = owner.logicalQid ?? owner.qid ?? owner.sid ?? '' + const closure = new FunctionValue(parent?.logicalQid ?? parent?.qid ?? '', { + sid: node.id?.name ?? node.name ?? owner.sid ?? '', + qid: `${qid}.${node.id?.name ?? node.name ?? 'function'}`, + parent: owner as never, + ast: node, + overloaded: [node], + _this: owner as never, + }) as FunctionClosureLike + closure.ast = node + closure.ast.fdef = node + closure.ast.node = node + closure.parent = owner + return closure + } + + /** + * 收集指定文件和包下的所有 owner 方法，包含外层类及匿名内部类。 + * @param entrypoint - 自定义入口配置 + * @param analyzer - Java analyzer + * @param functionName - 方法名 + * @returns 所有匹配的方法闭包 + */ + resolveAllMatchingEntryPoints( + entrypoint: JavaEntrypointConfig, + analyzer: JavaAnalyzerLike, + functionName: string + ): FunctionClosureLike[] { + const configuredFilePath = entrypoint.filePath + const configuredPackageName = entrypoint.packageName + const configuredOwnerName = configuredPackageName?.startsWith('.') + ? configuredPackageName.slice(1) + : configuredPackageName + if (!configuredFilePath || !configuredOwnerName || !analyzer.classMap || !analyzer.symbolTable) return [] + + const matched: FunctionClosureLike[] = [] + const seen = new Set() + for (const classRef of analyzer.classMap.values()) { + const classValue = analyzer.symbolTable.get(classRef) + if (!classValue || typeof classValue !== 'object') continue + const owner = classValue as JavaOwnerLike + const classNode = owner.ast?.node + const sourceFile = classNode?.loc?.sourcefile + const normalizedFile = this.normalizeAstSourceFilePath(sourceFile) + const isTargetFile = normalizedFile === configuredFilePath || sourceFile === configuredFilePath || + (typeof sourceFile === 'string' && sourceFile.endsWith(configuredFilePath)) + const ownerQid = owner.logicalQid ?? owner.qid ?? '' + const isTargetOwner = isTargetFile && + (ownerQid === configuredOwnerName || ownerQid.startsWith(`${configuredOwnerName}.`) || ownerQid.startsWith(`${configuredOwnerName}$`) || ownerQid.startsWith(`${configuredOwnerName}<`)) + if (!isTargetOwner) continue + const method = owner.members?.get(functionName) ?? owner.value?.[functionName] + if (isFunctionClosureLike(method) && !seen.has(method)) { + seen.add(method) + matched.push(method) + matched.push(...this.collectNestedEntryPointClosures(method.ast?.node ?? {}, functionName, method)) + } + } + return matched + } + /** * When the entrypoint resolves to an interface/abstract method with no body, * find implementation classes and return their overriding methods instead. @@ -378,10 +550,19 @@ class JavaTaintAbstractChecker extends TaintCheckerJava { EntryPoint: any, Constant: any ): void { - const exactEntryPointSymVal = this.resolveOverloadedEntryPoint(entryPointSymVal, entrypoint) - const resolvedSymVals = this.resolveInterfaceEntryPoint(exactEntryPointSymVal, func, analyzer) - if (resolvedSymVals.length > 0 && resolvedSymVals[0] !== exactEntryPointSymVal) { - this.augmentSourcesForInterfaceResolution(exactEntryPointSymVal, resolvedSymVals, func) + const matchedEntryPoints = this.resolveAllMatchingEntryPoints(entrypoint, analyzer, func) + const hasExplicitFilePath = typeof entrypoint.filePath === 'string' && entrypoint.filePath.length > 0 + if (matchedEntryPoints.length === 0 && hasExplicitFilePath) return + const candidates = matchedEntryPoints.length > 0 ? matchedEntryPoints : [entryPointSymVal] + const resolvedSymVals: unknown[] = [] + for (const candidate of candidates) { + const exactCandidate = this.resolveOverloadedEntryPoint(candidate, entrypoint) + if (!exactCandidate) continue + const resolvedCandidates = this.resolveInterfaceEntryPoint(exactCandidate, func, analyzer) + if (resolvedCandidates.length > 0 && resolvedCandidates[0] !== exactCandidate) { + this.augmentSourcesForInterfaceResolution(exactCandidate, resolvedCandidates, func) + } + resolvedSymVals.push(...resolvedCandidates) } for (const resolvedSymVal of resolvedSymVals) { const scopeVal = new Scoped('', { @@ -597,7 +778,7 @@ class JavaTaintAbstractChecker extends TaintCheckerJava { // JAVA_INPUT 的 buffer 项，导致 args 自身 SanitizerTag 被漏 const argsArrForTags = Array.isArray(args) ? args : [args] for (const a of argsArrForTags) { - // SanitizerTag 独立存放在 sanitizerTags 中，需通过专用接口读取。 + // R37 W11：SanitizerTag 对象走旁路 sanitizerTags，必须用 getSanitizerTags() const sanitizerTags = a?.taint?.getSanitizerTags?.() if (sanitizerTags && sanitizerTags.length > 0) { allTaintTags.push(...sanitizerTags) @@ -663,6 +844,16 @@ class JavaTaintAbstractChecker extends TaintCheckerJava { state.callstack, state.callsites ) + if (!taintFlowFinding) continue + const javaFinding = taintFlowFinding as TaintFinding + const signature = getJavaFindingSignature(javaFinding) + const logicalEntrypointKey = getEntryPointOwnerKey() + const collector = logicalEntrypointKey ? getJavaEntrypointFindingCollector(logicalEntrypointKey) : undefined + if (isJavaCandidateFinding(javaFinding)) { + if (collector && signature) collector.registerCandidate(signature, javaFinding) + continue + } + if (collector && signature) collector.registerNormal(signature) if (!TaintOutputStrategyJava.isNewFinding(this.resultManager, taintFlowFinding)) continue this.resultManager.newFinding(taintFlowFinding, TaintOutputStrategyJava.outputStrategyId) } diff --git a/src/checker/taint/python/python-taint-checker.ts b/src/checker/taint/python/python-taint-checker.ts index 90a905cf..2ae8c19c 100644 --- a/src/checker/taint/python/python-taint-checker.ts +++ b/src/checker/taint/python/python-taint-checker.ts @@ -7,6 +7,7 @@ const { buildFclosIndex, lookupFclos, } = require('../../../engine/analyzer/python/common/entrypoint-collector/python-entrypoint') +const { findFunctionToolEntryPointAndSource } = require('../../../engine/analyzer/python/common/entrypoint-collector/function-tool-entrypoint') const Constant = require('../../../util/constant') const EntryPoint = require('../../../engine/analyzer/common/entrypoint/entrypoint') const Config = require('../../../config') @@ -58,6 +59,30 @@ class PythonTaintChecker extends PythonTaintAbstractChecker { const fileEntryPoints: any[] = [] const { entrypoints: ruleConfigEntryPoints } = this.checkerRuleConfigContent + // 通用装饰器 collector 在 ONLY_CUSTOM 模式下独立填充 source（解决根因 B） + // BOTH 模式下已在 findPythonFcEntryPointAndSource 内填充，SELF_COLLECT 模式下不填充 + if (Config.entryPointMode === 'ONLY_CUSTOM') { + // 从 fileManager 提取 filenameAstObj（与 findPythonFcEntryPointAndSource 一致） + const filenameAstObj: Record = {} + for (const filename in fileManager) { + const fileEntry = fileManager[filename] + if (fileEntry?.astNode?._meta?.nodehash !== undefined) { + filenameAstObj[filename] = fileEntry.astNode + } + } + const { functionToolEntryPointSourceArray } = findFunctionToolEntryPointAndSource(filenameAstObj, dir) + if (functionToolEntryPointSourceArray && functionToolEntryPointSourceArray.length > 0) { + this.checkerRuleConfigContent.sources = this.checkerRuleConfigContent.sources || {} + this.checkerRuleConfigContent.sources.TaintSource = this.checkerRuleConfigContent.sources.TaintSource || [] + this.checkerRuleConfigContent.sources.TaintSource = Array.isArray( + this.checkerRuleConfigContent.sources.TaintSource + ) + ? this.checkerRuleConfigContent.sources.TaintSource + : [this.checkerRuleConfigContent.sources.TaintSource] + this.checkerRuleConfigContent.sources.TaintSource.push(...functionToolEntryPointSourceArray) + } + } + if (Config.entryPointMode !== 'ONLY_CUSTOM') { const pythonDefaultRule = loadPythonDefaultRule() if (pythonDefaultRule[0].checkerIds.includes(this.getCheckerId())) { diff --git a/src/checker/taint/python/tornado-taint-checker.ts b/src/checker/taint/python/tornado-taint-checker.ts index ea164be8..1ba52b53 100644 --- a/src/checker/taint/python/tornado-taint-checker.ts +++ b/src/checker/taint/python/tornado-taint-checker.ts @@ -4,13 +4,48 @@ const { PythonTaintAbstractChecker } = require('./python-taint-abstract-checker' const Config = require('../../../config') const completeEntryPoint = require('../common-kit/entry-points-util') const { markTaintSource } = require('../common-kit/source-util') -const { isTornadoCall, tornadoSourceAPIs, isPreparedBodyRead, isRequestAttributeAccess } = require('./tornado-util') +const { + isTornadoCall, + isTornadoFrameworkCall, + tornadoSourceAPIs, + isPreparedBodyRead, + isRequestAttributeAccess, + registerTornadoHandlerApplication, + resetTornadoHandlerApplications, +} = require('./tornado-util') const { extractRelativePath } = require('../../../util/file-util') // Metadata storage const tornadoRoutesMap = new WeakMap() const tornadoRouteMap = new WeakMap() +type TornadoRouteValue = { + vtype?: string + value?: unknown + ast?: { + node?: { type?: string; value?: unknown } + cdef?: { type?: string } + } +} + +type TornadoRouteCollection = { + [key: string]: unknown + [index: number]: unknown +} + +function isTornadoRouteValue(value: unknown): value is TornadoRouteValue & object { + return typeof value === 'object' && value !== null +} + +function isTornadoRouteCollection(value: unknown): value is TornadoRouteCollection { + return typeof value === 'object' && value !== null +} + +function getTornadoRoutePath(value: unknown): unknown { + if (!isTornadoRouteValue(value)) return undefined + return value.value ?? value.ast?.node?.value +} + /** * Tornado Taint Checker - Simplified */ @@ -32,6 +67,7 @@ class TornadoTaintChecker extends PythonTaintAbstractChecker { * @param info */ triggerAtStartOfAnalyze(analyzer: any, scope: any, node: any, state: any, info: any): void { + resetTornadoHandlerApplications() this.addSourceTagForcheckerRuleConfigContent('PYTHON_INPUT', this.checkerRuleConfigContent) } @@ -256,7 +292,11 @@ class TornadoTaintChecker extends PythonTaintAbstractChecker { const isApp = isTornadoCall(node, 'Application') const isRouter = isTornadoCall(node, 'RuleRouter') if (!isInit && (isApp || isRouter)) { - tornadoRoutesMap.set(ret, argvalues[0]) + const routes = argvalues[0] + tornadoRoutesMap.set(ret, routes) + if (routes && isTornadoFrameworkCall(node, 'Application', fclos)) { + this.registerHandlerApplications(routes, ret) + } } if (tornadoSourceAPIs.has(name)) { markTaintSource(ret, { path: node, kind: 'PYTHON_INPUT' }) @@ -273,6 +313,44 @@ class TornadoTaintChecker extends PythonTaintAbstractChecker { } } + private registerHandlerApplications(routes: unknown, application: unknown): void { + const handlers = new Set() + this.collectRouteHandlers(routes, handlers) + for (const handler of handlers) { + registerTornadoHandlerApplication(handler, application) + } + } + + private collectRouteHandlers(value: unknown, handlers: Set, visited: Set = new Set()): void { + if (!isTornadoRouteValue(value) || visited.has(value)) return + visited.add(value) + if (tornadoRouteMap.has(value)) { + this.collectRouteHandlers(tornadoRouteMap.get(value), handlers, visited) + return + } + if (value.vtype === 'union' && Array.isArray(value.value)) { + for (const item of value.value) this.collectRouteHandlers(item, handlers, visited) + return + } + if (isTornadoRouteCollection(value.value)) { + const tupleHandler = value.value[1] + const routePath = getTornadoRoutePath(value.value[0]) + if (typeof routePath === 'string' && tupleHandler) { + this.collectRouteHandlers(tupleHandler, handlers, visited) + return + } + const items = Array.isArray(value.value) ? value.value : Object.values(value.value) + const isCollection = Array.isArray(value.value) || Object.keys(value.value).some((key) => /^\d+$/.test(key)) + if (isCollection) { + for (const item of items) this.collectRouteHandlers(item, handlers, visited) + return + } + } + if (value.vtype === 'class' || value.ast?.node?.type === 'ClassDefinition' || value.ast?.cdef?.type === 'ClassDefinition') { + handlers.add(value) + } + } + /** * * @param analyzer diff --git a/src/checker/taint/python/tornado-util.ts b/src/checker/taint/python/tornado-util.ts index 61674a55..8177502e 100644 --- a/src/checker/taint/python/tornado-util.ts +++ b/src/checker/taint/python/tornado-util.ts @@ -58,6 +58,45 @@ export function isPreparedBodyRead(node: unknown): node is MemberAccessNode { return typeof node === 'object' && node !== null && tornadoPreparedBodyReads.has(node as MemberAccessNode) } +const tornadoHandlerApplications = new Map>() + +type TornadoClassValue = { + qid?: unknown + ast?: { + cdef?: unknown + node?: unknown + } +} + +function getTornadoHandlerClassKey(value: unknown): string | undefined { + if (typeof value !== 'object' || value === null) return undefined + const handler = value as TornadoClassValue + if (typeof handler.qid !== 'string') return undefined + const classDefinitions = [handler.ast?.node, handler.ast?.cdef] + if (!classDefinitions.some((node) => (node as { type?: unknown } | undefined)?.type === 'ClassDefinition')) return undefined + return handler.qid +} + +export function registerTornadoHandlerApplication(handler: unknown, application: unknown): void { + const handlerClassKey = getTornadoHandlerClassKey(handler) + if (!handlerClassKey || typeof application !== 'object' || application === null) return + const applications = tornadoHandlerApplications.get(handlerClassKey) ?? new Set() + applications.add(application) + tornadoHandlerApplications.set(handlerClassKey, applications) +} + +export function getUniqueTornadoHandlerApplication(handler: unknown): unknown { + const handlerClassKey = getTornadoHandlerClassKey(handler) + if (!handlerClassKey) return undefined + const applications = tornadoHandlerApplications.get(handlerClassKey) + if (applications?.size !== 1) return undefined + return applications.values().next().value +} + +export function resetTornadoHandlerApplications(): void { + tornadoHandlerApplications.clear() +} + /** * Check if node is a Tornado Application call * @param node @@ -81,3 +120,41 @@ export function isTornadoCall(node: any, targetName: string): boolean { } return false } + +type TornadoFrameworkCallable = { + node_module?: boolean + qid?: string + sid?: string + super?: unknown + ast?: { + cdef?: { type?: unknown } + node?: { type?: unknown } + } +} + +function isTornadoApplicationBase(callable: unknown): boolean { + if (typeof callable !== 'object' || callable === null) return false + const value = callable as TornadoFrameworkCallable + return value.node_module === true && typeof value.qid === 'string' && /(?:^|\.)tornado\.web\.Application$/.test(value.qid) +} + +function isLocalTornadoApplicationSubclass(callable: TornadoFrameworkCallable): boolean { + const classDefinitions = [callable.ast?.node, callable.ast?.cdef] + return ( + callable.node_module !== true && + classDefinitions.some((definition) => definition?.type === 'ClassDefinition') && + isTornadoApplicationBase(callable.super) + ) +} + +export function isTornadoFrameworkCall(node: unknown, targetName: string, callable: unknown): boolean { + if (!isTornadoCall(node, targetName)) return false + if (typeof callable !== 'object' || callable === null) return false + const value = callable as TornadoFrameworkCallable + const qualifiedId = value.qid ?? value.sid + const isExternalTornadoCall = + value.node_module === true && + typeof qualifiedId === 'string' && + (targetName === 'Application' ? isTornadoApplicationBase(value) : qualifiedId.includes('tornado.web.')) + return isExternalTornadoCall || (targetName === 'Application' && isLocalTornadoApplicationSubclass(value)) +} diff --git a/src/checker/taint/taint-checker.ts b/src/checker/taint/taint-checker.ts index 6d04b048..ba8ae691 100644 --- a/src/checker/taint/taint-checker.ts +++ b/src/checker/taint/taint-checker.ts @@ -10,7 +10,8 @@ const TaintCheckerSourceLine = require('../../engine/analyzer/common/source-line const entryPointConfig = require('../../engine/analyzer/common/entrypoint/current-entrypoint') const TaintCheckerRules = require('../common/rules-basic-handler') const taintCheckerCommonUtil = require('../../util/common-util') -const QidUnifyUtil = require('../../util/qid-unify-util') +const { buildJavaCandidateFinding } = require('./java/java-finding-candidate') as typeof import('./java/java-finding-candidate') +const { getCalleeEntry } = require('./java/callee-entry') as typeof import('./java/callee-entry') interface SourceLocation { sourcefile?: string @@ -23,6 +24,8 @@ interface AstNodeWithLocation { loc?: SourceLocation _meta?: { nodehash?: string } parent?: AstNodeWithLocation + id?: { name?: string; loc?: SourceLocation } + body?: { loc?: SourceLocation } } interface CallstackFrame { @@ -32,6 +35,12 @@ interface CallstackFrame { qid?: string } +interface CallsiteFrame { + code?: string + nodeHash?: string + loc?: SourceLocation +} + /** * basic class for taint-flow checker */ @@ -112,15 +121,28 @@ class TaintChecker extends Checker { const traceStrategy = Config.taintTraceOutputStrategy const isCallstackOnly = traceStrategy === 'callstack-only' || traceStrategy === 'folded' || !traceStrategy if (isCallstackOnly) { - const isJavaFinding = this.isJavaFindingTrace(finding) - finding.trace = this.filterTraceToCallstackOrder(finding, finding.trace, isJavaFinding) as TraceItem[] + finding.trace = this.filterTraceToCallstackOrder(finding, finding.trace) as TraceItem[] finding.trace = this.synthesizeBridgeSteps(finding, finding.trace) as TraceItem[] if (!this.validateArgPassSegmentWithinFrame(finding)) { return null } - if (isJavaFinding) this.dedupCallArgPassEdgesByCallee(finding) + this.dedupCallArgPassEdgesByCallee(finding) if (!this.validateTraceBoundary(finding, trace)) return null if (!this.verifyCallstackEdgeInvariant(finding)) return null + // 动态 ARG PASS 作用域栈后补：剔除 taint 整段复制串进来的孤儿步（跨函数但非合法入/出帧）。 + // 仅 Java finding；User 2026-09-20 授权的落点 D 后补例外（绕过「源头修」铁律）。 + this.pruneOrphanByArgPassScopeStack(finding) + // 结果层裁剪 propagation 乱序步（细节见 truncateAfterSinkFrameEnter）：sink 帧入帧后浅帧续行、 + // 入帧边前的幻影 body、紧接入帧边的早返 CALL RETURN。不丢 SOURCE/SINK/ARG PASS，validPairs 不变。 + this.truncateAfterSinkFrameEnter(finding) + // buildJavaCandidateFinding 是 Java 专精资产，依赖 Java callstack+callsites 结构重建最小链路； + // 非 Java finding 走它会因结构不符 return null 整条丢。仅对 Java taint type finding 触发 mock 重建路径。 + if ((finding.type === 'taint_flow_java_input' || finding.type === 'taint_flow_java_input_inner') && !this.verifyArgPassOrderConsistency(finding)) { + const candidate = buildJavaCandidateFinding(finding) + if (!candidate) return null + // 原 finding 继续拒绝；该标记仅供 Java 入口 collector 接收精简候补。 + return candidate + } } } if (finding?.trace) { @@ -190,24 +212,6 @@ class TaintChecker extends Checker { return hashes } - private isJavaFindingTrace(finding: TaintFinding): boolean { - const trace = finding?.trace - if (Array.isArray(trace)) { - for (const step of trace) { - const sourcefile = step?.node?.loc?.sourcefile || step?.file - if (typeof sourcefile === 'string' && sourcefile.endsWith('.java')) return true - } - } - const callstack = finding?.callstack - if (Array.isArray(callstack)) { - for (const fclos of callstack as CallstackFrame[]) { - const sourcefile = fclos?.ast?.node?.loc?.sourcefile - if (typeof sourcefile === 'string' && sourcefile.endsWith('.java')) return true - } - } - return false - } - /** * Java callstack-only 链路必须由真实 SOURCE 函数进入当前 callstack，避免跨入口污染节点被错拼到当前 sink。 * @param traceStack @@ -396,7 +400,7 @@ class TaintChecker extends Checker { * synthesizeBridgeSteps 合成补齐）。 * @param finding */ - filterTraceToCallstackOrder(finding: TaintFinding, traceSource?: TraceItem[], javaStrictCalleeOnly = false): TraceItem[] | void { + filterTraceToCallstackOrder(finding: TaintFinding, traceSource?: TraceItem[]): TraceItem[] | void { const callstack = finding?.callstack const trace = traceSource ?? finding?.trace if (!Array.isArray(callstack) || !Array.isArray(trace)) return @@ -437,6 +441,22 @@ class TaintChecker extends Checker { if (s?.tag !== 'ARG PASS: ') continue const inner = this.getStepInnermostIdx(s, callstack) if (inner < 0) continue + // 顶边识别：真 callee-side enter edge 的 ARG PASS 落点必须在被进入帧的签名行附近； + // 回调体内部的 instance-method receiver 伪边（如 result.setXxx(...)）落点在帧 body 内，与签名行相差很远。 + // 伪边 drop 清掉噪音，但这条 ARG PASS 原本替 propagation 漏记的真 enter 边占了进入 inner 帧的位置， + // 故仍将 expected 推进到 inner+1，让后续真边能匹配，避免真链整条丢。 + if (inner >= 1 && inner < callstack.length) { + const frameLoc = callstack[inner]?.ast?.node?.loc + const frameStart = frameLoc?.start?.line + const sLineRaw = s?.node?.loc?.start?.line ?? s?.line + const sLine = Array.isArray(sLineRaw) ? sLineRaw[0] : sLineRaw + if (typeof frameStart === 'number' && typeof sLine === 'number' && sLine > frameStart + 3) { + drop.add(i) + if (i > 0 && inCallstack[i - 1]?.tag === 'CALL: ') drop.add(i - 1) + expected = inner + 1 + continue + } + } // 闭包/lambda：ARG PASS 进入不在 callstack 上的闭包函数体，丢弃该 ARG PASS 但保留前驱 CALL const stepFnHash = this.getStepFunctionNodeHash(s) if (stepFnHash && !callstackHashes.has(stepFnHash)) { @@ -448,19 +468,21 @@ class TaintChecker extends Checker { continue } const isNextCalleeArg = inner === expected - const isLegacyCallerArg = !javaStrictCalleeOnly && inner === expected - 1 - // Java callstack-only 链路需要严格 callee-side ARG PASS；其他语言保留旧 caller/callee 双接受口径。 + // callstack-only 统一口径：ARG PASS 进 callee 帧须严格匹配 expected（callee-side）， + // 或匹配 expected-1（caller-side，callstack 跨帧缺 callee 帧时的兜底；inner>=1 排除 FILE_BEGIN + // 入口对自身形参的噪声 ARG PASS——callstack[0] 已是入口函数自身 nil：se问c特， + // inner===0 时不应作 caller-side 接受否则会吃掉 expected 槽并使真 callee 边被丢）。 + // 按 callee idx 去重保证每个方法跳转只保留一条可见点边，普适所有语言。 + const isLegacyCallerArg = inner === expected - 1 && inner >= 1 if (expected < callstack.length && (isNextCalleeArg || isLegacyCallerArg)) { - if (javaStrictCalleeOnly) { - const prevCallIdx = i > 0 && inCallstack[i - 1]?.tag === 'CALL: ' ? i - 1 : -1 - const edgeKey = `callee:${inner}` - if (seenCallArgEdges.has(edgeKey)) { - drop.add(i) - if (prevCallIdx >= 0) drop.add(prevCallIdx) - continue - } - seenCallArgEdges.add(edgeKey) + const prevCallIdx = i > 0 && inCallstack[i - 1]?.tag === 'CALL: ' ? i - 1 : -1 + const edgeKey = `callee:${inner}` + if (seenCallArgEdges.has(edgeKey)) { + drop.add(i) + if (prevCallIdx >= 0) drop.add(prevCallIdx) + continue } + seenCallArgEdges.add(edgeKey) expected++ } else { drop.add(i) @@ -499,6 +521,106 @@ class TaintChecker extends Checker { finding.trace = trace.filter((_: TraceItem, i: number) => !drop.has(i)) } + /** + * callstack-only 结果层裁剪：清掉 taint propagation 因「先记返回值 / 先探被调方 body」造成的乱序步。 + * + * trace 按"数据流探索顺序"记录、不是运行时执行顺序——propagation 会把被调方的 body 和 return 提前记在 + * 真正入帧边(ARG PASS)之前，使 trace 看起来进进出出、前后错乱。这里按"应处于的位置"删三类噪声步； + * 都不丢 SOURCE / SINK / ARG PASS 自身，所以 verifyCallstackEdgeInvariant 的点边计数不变。 + * + * 一、sink 帧入帧之后的浅帧续行：sink 帧(最深)入帧 ARG PASS 之后到 SINK 之间、比 sink 帧更浅的任意步， + * 是越过 sink 之后的 caller/sibling 探索，全丢；并丢与 SINK 同行的冗余 Return Value。入帧前的 forward + * path 已含全部唯一入边，入帧后无唯一入边，丢浅帧步不丢唯一覆盖。 + * + * 二、入帧边之前的幻影 body：某 callstack 帧 F 的 body 步出现在 F 自己的首条真实入帧 ARG PASS 之前—— + * propagation 先探了 F 的 body 才补入帧边，这段 body 是幻影，丢。不丢"紧接 ARG PASS 的 CALL"(入帧边 + * caller 侧)，以免拆掉 getJavaFindingSignature 的 CALL+ARG PASS 对。入口 head 帧无入帧边，不处理。 + * + * 三、入帧即返的早返：紧接 ARG PASS 入帧边之后的 CALL RETURN——"刚进帧就返回"，是 return 提前记在 body + * 之前，丢。往前跳过已被「二」丢的幻影 body，找上一个未丢步看是不是 ARG PASS。 + * @param finding + */ + private truncateAfterSinkFrameEnter(finding: TaintFinding): void { + const callstack = finding?.callstack + const trace = finding?.trace as TraceItem[] | undefined + if (!Array.isArray(callstack) || !Array.isArray(trace) || trace.length < 2) return + const sinkStep = trace[trace.length - 1] + if (sinkStep?.tag !== 'SINK: ') return + const sinkFrameIdx = this.getStepInnermostIdx(sinkStep, callstack as CallstackFrame[]) + if (sinkFrameIdx < 1) return + + // sink 内层帧入帧 ARG PASS 下标（dedup 后每 callee idx 仅一条；取最后一个 inner==sinkFrameIdx 的 ARG PASS） + let enterIdx = -1 + for (let i = 0; i < trace.length - 1; i++) { + if (trace[i]?.tag === 'ARG PASS: ' && this.getStepInnermostIdx(trace[i], callstack as CallstackFrame[]) === sinkFrameIdx) { + enterIdx = i + } + } + if (enterIdx < 0) return + + const sinkFile = sinkStep?.node?.loc?.sourcefile || sinkStep?.file + const sinkLineRaw = sinkStep?.node?.loc?.start?.line ?? sinkStep?.line + const sinkLine = Array.isArray(sinkLineRaw) ? sinkLineRaw[0] : sinkLineRaw + + const drop = new Set() + for (let i = enterIdx + 1; i < trace.length - 1; i++) { + const s = trace[i] + if (!s) continue + const inner = this.getStepInnermostIdx(s, callstack as CallstackFrame[]) + // 浅帧续行：比 sink 帧更浅的 callstack 帧内的任意步，全丢（sink 帧最深，入帧后无唯一入边，不破不变量）。 + if (inner >= 0 && inner < sinkFrameIdx) { + drop.add(i) + continue + } + // 与 SINK 同文件同行（且同 sink 帧）的 Return Value = sink 表达式自身的 return，冗余 + const tagNorm = typeof s?.tag === 'string' ? s.tag.trim() : '' + if (tagNorm === 'Return Value:' && inner === sinkFrameIdx && typeof sinkLine === 'number' && sinkFile) { + const sFile = s?.node?.loc?.sourcefile || s?.file + const sLineRaw = s?.node?.loc?.start?.line ?? s?.line + const sLine = Array.isArray(sLineRaw) ? sLineRaw[0] : sLineRaw + if (sFile === sinkFile && sLine === sinkLine) drop.add(i) + } + } + + // 处理 docstring 之二、之三（幻影 body、入帧即返）。归帧用 getStepInnermostIdx：Java 走函数 nodeHash、其它语言走行号范围。 + { + // 记每个 callstack 帧的首条"真实"入帧 ARG PASS 下标（跳过 _synthetic 合成边）。 + const firstEnterByFrame = new Map() + for (let i = 0; i < trace.length; i++) { + if (trace[i]?.tag !== 'ARG PASS: ' || trace[i]?._synthetic) continue + const inner = this.getStepInnermostIdx(trace[i], callstack as CallstackFrame[]) + if (inner < 1 || firstEnterByFrame.has(inner)) continue + firstEnterByFrame.set(inner, i) + } + // body 步若在所属帧的入帧边之前 = 幻影 body，丢。不丢 ARG PASS 自身；不丢"紧接 ARG PASS 的 CALL"(入帧边 + // caller 侧)，保护 CALL+ARG PASS 对不拆。 + for (let i = 1; i < trace.length - 1; i++) { + if (drop.has(i)) continue + const s = trace[i] + if (!s || s?.tag === 'ARG PASS: ' || s?.tag === 'SOURCE: ' || s?.tag === 'SINK: ') continue + if (s?.tag === 'CALL: ' && trace[i + 1]?.tag === 'ARG PASS: ') continue + const inner = this.getStepInnermostIdx(s, callstack as CallstackFrame[]) + if (inner < 1) continue + const firstPos = firstEnterByFrame.get(inner) + if (typeof firstPos === 'number' && i < firstPos) drop.add(i) + } + // 紧接入帧边 ARG PASS 之后的 CALL RETURN = "入帧即返"，丢。往前跳过已被丢的幻影 body，找上一个未丢步 + // 看是不是 ARG PASS；正常 return-value 链前驱是 CALL/body，不会误中。 + for (let i = 1; i < enterIdx; i++) { + if (drop.has(i)) continue + const s = trace[i] + if (!s || s?.tag !== 'CALL RETURN:') continue + let prev = i - 1 + while (prev >= 0 && drop.has(prev)) prev-- + if (trace[prev]?.tag !== 'ARG PASS: ') continue + drop.add(i) + } + } + + if (drop.size === 0) return + finding.trace = trace.filter((_: TraceItem, i: number) => !drop.has(i)) + } + /** * 校验 CO 模式下 callstack 与 trace 的点-边不变量：callstack.length+1（点数：fclos+sink 条目）必须 * 等于 "有效 CALL+ARG PASS 对数 + SINK 数"（边数）+ 1。 @@ -519,7 +641,7 @@ class TaintChecker extends Checker { const outputtableFclosIdx = new Set() for (let i = 0; i < callstack.length; i++) { const fclos = callstack[i] - if (!fclos || fclos.vtype !== 'fclos') continue + if (!fclos || (fclos.vtype !== 'fclos' && fclos.vtype !== 'scope')) continue const loc = fclos.ast?.node?.loc if (!loc?.sourcefile || typeof loc.start?.line !== 'number' || typeof loc.end?.line !== 'number') continue outputtableFclosIdx.add(i) @@ -557,6 +679,114 @@ class TaintChecker extends Checker { return edges >= 1 && nodes >= edges + 1 } + /** + * 按「动态 ARG PASS 作用域栈」剔除 taint 整段复制串进来的孤儿步（落点 D，User 2026-09-20 授权后补）。 + * + * 遍历 trace 维护「当前栈顶函数」栈：元素是 callstack frame idx，初始含入口帧 frame[0]： + * - CALL: + 紧接 ARG PASS: 成对 → 若 ARG PASS 进入更深的 callstack 帧则压栈，CALL/ARG PASS 均保留 + * - CALL RETURN: → 与栈顶同帧: in-place return 不退栈；退到栈顶下一帧: 退栈一层；除此以外的为孤儿剔除 + * - 其他步（Var Pass / Field / Return Value / 未配对的 CALL / ARG PASS）必须落在当前栈顶函数内 + * （inner === 当前栈顶 frame idx），不在栈顶函数者 = taint 整段复制串进来的孤儿，剔除 + * - SOURCE: / SINK: 边界步始终保留 + * + * 待剔除步形成的反例：异步体 sink record 携带同步入口的历史足迹步（如 caller-side find() 的 + * CALL/CALL RETURN/Var Pass），被平铺进 trace 与异步体步混排，形成跨函数无入帧边的跳跃。本方法 + * 严格按动态栈语义校验，与「补 ARG PASS 入帧边亦被 filter 丢」的难点无关——剔除而非追加。 + * + * 仅对 callstack-only 输出路径的 Java taint-flow finding 启用，在 verifyCallstackEdgeInvariant + * 通过后、truncateAfterSinkFrameEnter 之前介入。 + * @param finding 仅 Java finding；finding.trace 被原地裁剪。 + */ + private pruneOrphanByArgPassScopeStack(finding: TaintFinding): void { + const callstack = finding?.callstack + const trace = finding?.trace as TraceItem[] | undefined + if (!Array.isArray(callstack) || !Array.isArray(trace) || trace.length === 0) return + if (finding.type !== 'taint_flow_java_input' && finding.type !== 'taint_flow_java_input_inner') return + const frames = callstack as CallstackFrame[] + if (frames.length === 0) return + + // 当前作用域栈：元素是 callstack frame idx；初始含入口帧 frame[0] + const scope: number[] = [0] + const top = (): number => scope[scope.length - 1] + const drop = new Set() + + for (let i = 0; i < trace.length; i++) { + const step = trace[i] + const tag = typeof step?.tag === 'string' ? step.tag : '' + if (tag === 'SOURCE: ' || tag === 'SINK: ') { + continue + } + + // CALL + 紧接 ARG PASS 成对：transit进 callee 帧 + if (tag === 'CALL: ' && i + 1 < trace.length && trace[i + 1]?.tag === 'ARG PASS: ') { + const argPassInner = this.getStepInnermostIdx(trace[i + 1], frames) + if (argPassInner > top()) { + // 进入更深的 callstack 帧：压栈 + scope.push(argPassInner) + } + // 保留 CALL 与 ARG PASS 两步；跳过 ARG PASS 避免重复处理 + i++ + continue + } + + // CALL RETURN：同帧 in-place return 不退栈；退到栈顶下一帧退栈一层；其余孤儿剔除 + if (tag === 'CALL RETURN:') { + const retInner = this.getStepInnermostIdx(step, frames) + if (retInner === top()) { + continue + } + if (scope.length > 1 && retInner === scope[scope.length - 2]) { + scope.pop() + continue + } + drop.add(i) + continue + } + + // 其他步：必须落在当前栈顶函数内；不在栈顶即孤儿 + const stepInner = this.getStepInnermostIdx(step, frames) + if (stepInner !== top()) { + drop.add(i) + } + } + + if (drop.size === 0) return + finding.trace = trace.filter((_: TraceItem, idx: number) => !drop.has(idx)) + } + + /** + * 校验 ARG PASS step 的 callstack-idx 沿 SOURCE→SINK 方向单调不减（外层帧先于内层帧被进入）。 + * + * 来源：taint record 在子调用返回后，其调用点/body step 仍可能残留在向下游传播的值上，导致一条 + * finding 的 trace 里内层帧的 ARG PASS 出现在外层帧之前（如 update 流被 get 的 send body 污染： + * seq=[2,1]）。这种 trace 与 callstack 嵌套顺序矛盾，是传播层污染在输出端的可见形态——跳边 + * （内层 callsite 出现在外层 region）、CALL+ARG PASS 对顺序倒置，并使 order-sensitive 去重 key + * 与同结构的干净 finding 错开，制造重复 finding。校验失败即丢弃该 finding。 + * + * 仅对 callstack-only 的 Java finding 启用：idx 取 getStepInnermostIdx 的最深覆盖 fclos； + * 映射不到 callstack（idx<0，如 helper/闭包）的 ARG PASS 不参与比较，避免误判。 + * @param finding + * @returns true 表示 ARG PASS 顺序与 callstack 嵌套一致；false 表示污染倒序，应丢弃 + */ + private verifyArgPassOrderConsistency(finding: TaintFinding): boolean { + const callstack = finding?.callstack + const trace = finding?.trace + if (!Array.isArray(callstack) || !Array.isArray(trace)) return true + const frames = callstack as CallstackFrame[] + let prevIdx = -1 + for (const s of trace as TraceItem[]) { + if (s?.tag !== 'ARG PASS: ') continue + const idx = this.getStepInnermostIdx(s, frames) + if (idx < 0) continue + if (idx < prevIdx) { + finding.traceRejectReason = 'ARG_PASS_ORDER_OUT_OF_CALLSTACK' + return false + } + prevIdx = idx + } + return true + } + /** * 对 finding.callstack 中"body 内零 trace step"的 fclos 插入一对 synthetic CALL + ARG PASS step。 * @@ -591,26 +821,25 @@ class TaintChecker extends Checker { endLine: number node: NonNullable fname: string + entry: ReturnType } const fcloses: FclosInfo[] = [] callstack.forEach((fclos: TaintFinding, idx: number) => { - if (!fclos || fclos.vtype !== 'fclos') return + if (!fclos || (fclos.vtype !== 'fclos' && fclos.vtype !== 'scope')) return const loc = fclos.ast?.node?.loc const sourcefile: string | undefined = loc?.sourcefile const startLine = loc?.start?.line const endLine = loc?.end?.line - if (!sourcefile || typeof startLine !== 'number' || typeof endLine !== 'number') return - // fname 用 QidUnifyUtil.qidUnifyByRemoveAngleAndPrefix 统一清洗：去掉 `` / `.packageManager` / - // `` / `` / `` / `` 等流敏感标签与 yasa 内部前缀，保证 affectedNodeName 可读 - const rawName = fclos.ast?.node?.id?.name || fclos.fname || fclos.qid || '' - const cleanedName = QidUnifyUtil.qidUnifyByRemoveAngleAndPrefix(rawName) || rawName + const entry = getCalleeEntry(fclos) + if (!sourcefile || typeof startLine !== 'number' || typeof endLine !== 'number' || !entry) return fcloses.push({ idx, file: sourcefile, startLine, endLine, node: fclos.ast.node, - fname: cleanedName, + fname: entry.name, + entry, }) }) if (fcloses.length === 0) return traceSource ? trace : undefined @@ -634,18 +863,41 @@ class TaintChecker extends Checker { return innermost }) - // fclos 覆盖判据：body 内需要至少一条 ARG PASS step（自然或合成均可）。 - // 闭包捕获场景下深层 fclos 只会出现 SOURCE 而无形参 ARG PASS，必须由 synthesize 补桥接，否则 - // verifyCallstackEdgeInvariant 数不到这一对会丢整条 finding；故此处 SOURCE 不再计为已覆盖。 + // fclos 覆盖判据：入帧 ARG PASS 落在 fclos 签名行 ±1 内才算覆盖该 fclos。 + // 严格化（落点 E）：filter 在某些异步路径把 caller-side 的 base-object ARG PASS（如 + // executor.submit 的 receiver）按行号误接受为 callee 帧 enter ARG PASS —— 该 ARG PASS 落在 + // callee body 远区（sLine > frame.startLine+1）而非签名行，原先 coveredByArgPass 只判 + // "depths[i]>=0 && tag==='ARG PASS: '"，把 body 远区 ARG PASS 也算覆盖，使该 frame 误判为已覆盖， + // 跳过 synthesize 现有 SYN 桥补机制，导致 SARIF 跨帧跳跃（如 idx#4 step15 CALL offer@1013 → + // step16 CALL submit@788 之间缺 SYN 1014 CALL invoke + SYN 786 ARG PASS 入帧边）。 + // 闭包捕获场景下深层 fclos 只会出现 SOURCE 而无形参 ARG PASS，必须由 synthesize 补桥接，否则 + // verifyCallstackEdgeInvariant 数不到这一对会丢整条 finding；故此处 SOURCE 不再计为已覆盖。 const coveredByArgPass: Set = new Set() trace.forEach((s: TraceItem, i: number) => { if (depths[i] >= 0 && s?.tag === 'ARG PASS: ') { - coveredByArgPass.add(depths[i]) + const frameIdx = depths[i] + const frame = fcloses.find((f) => f.idx === frameIdx) + // 无匹配 frame（理论上不发生）：保留旧行为，不阻断已 active 的覆盖判定。 + if (!frame) { + coveredByArgPass.add(frameIdx) + return + } + const sLineRaw = s?.node?.loc?.start?.line ?? s?.line + const sLine = Array.isArray(sLineRaw) ? sLineRaw[0] : sLineRaw + // ARG PASS 该值是 callee 签名行 ±1 内才视为入帧边；不能解析 sLine 时保留旧行为（不丢已 active 覆盖）。 + if (typeof sLine !== 'number' || sLine === frame.startLine || sLine === frame.startLine + 1) { + coveredByArgPass.add(frameIdx) + } } }) // 入口 fclos（idx 0）不需要合成；非 callstack 节点不参与覆盖判定。 const uncovered = fcloses.filter((f) => f.idx > 0 && !coveredByArgPass.has(f.idx)) - if (uncovered.length === 0) return traceSource ? trace : undefined + if (uncovered.length === 0) { + // uncovered=0 不代表无孤儿 ARG PASS：内层 CALL RETURN 后直接接外层 ARG PASS 时， + // 外层 CALL tag 未随子值传播到位，send 穿越对缺 CALL 半边。必须补齐再返回。 + this.completeOrphanArgPassCalls(trace, callstack, callsites) + return traceSource ? trace : undefined + } // 为每个 uncovered fclos 找插入位置：只能在 SOURCE 与 SINK 之间补桥，避免 synthetic CALL/ARG PASS 堆到 trace 顶部。 type Insertion = { beforeIdx: number; fclos: FclosInfo } @@ -673,19 +925,10 @@ class TaintChecker extends Checker { }) for (const ins of insertions) { - // 选 signature 行：优先 fdef.id（方法名所在行），其次 body 起始行，最后回落到 fdef.loc.start.line。 - // fdef.loc.start 可能落在注解（@Override）或匿名类 new 表达式所在行，导致 SARIF snippet 取到错误源码。 - const idLine = ins.fclos.node?.id?.loc?.start?.line - const bodyLine = ins.fclos.node?.body?.loc?.start?.line - const signatureLine: number = - typeof idLine === 'number' ? idLine : typeof bodyLine === 'number' ? bodyLine : ins.fclos.startLine - // ARG PASS wrapper：loc 落 callee 签名行，_meta.nodehash 经原型继承自 fdef.ast.node（保 callstack nodeHash 等式） - const argPassNode = Object.create(ins.fclos.node) - argPassNode.loc = { - sourcefile: ins.fclos.file, - start: { line: signatureLine, column: 0 }, - end: { line: signatureLine, column: 0 }, - } + const calleeEntry = ins.fclos.entry + if (!calleeEntry) continue + const signatureLine = calleeEntry.line + const argPassNode = calleeEntry.node const callsite = Array.isArray(callsites) ? callsites[ins.fclos.idx] : undefined const siteLoc = callsite?.loc const siteLineRaw = siteLoc?.start?.line @@ -724,6 +967,28 @@ class TaintChecker extends Checker { // 合成一个 CALL 插到它前面，保证 CALL/ARG PASS 成对出现。反向遍历避免 splice 导致索引失效。 // 仅当 callsite line 与 ARG PASS step line 不同才合成：JS entrypoint 的 callsites[0] 常指向 fclos 自身 // body 起始行，不是真正的 caller-side callsite，用这种 loc 造 CALL 会重复 ARG PASS 的位置信息。 + // 注意：该补齐步骤独立于 uncovered fclos 的桥接插入——即使所有 fclos 都已有 ARG PASS（uncovered=0）， + // 仍可能出现"内层 CALL RETURN 后直接接外层 ARG PASS"的孤儿（外层 CALL tag 未随子值传播到位）， + // 故必须无条件执行，不可被上方 uncovered=0 的提前返回跳过。 + this.completeOrphanArgPassCalls(trace, callstack, callsites) + return traceSource ? trace : undefined + } + + /** + * 补齐孤立 ARG PASS：若紧邻前驱不是 CALL（analyzer 在某些 AST 模式下——例如 Python + * fullfileManagerMade 入口或嵌套 def 跨层调用——只写了 ARG PASS 没写 CALL）则按 callsites[innermost_idx] + * 合成一个 CALL 插到它前面，保证 CALL/ARG PASS 成对出现。反向遍历避免 splice 导致索引失效。 + * 仅当 callsite line 与 ARG PASS step line 不同才合成：JS entrypoint 的 callsites[0] 常指向 fclos 自身 + * body 起始行，不是真正的 caller-side callsite，用这种 loc 造 CALL 会重复 ARG PASS 的位置信息。 + * + * 从 synthesizeBridgeSteps 抽出为独立方法，使其在 uncovered=0 的提前返回路径也能调用—— + * 见 synthesizeBridgeSteps 末尾与上方 uncovered 提前返回处两处调用点。 + * @param trace 原地修改 + * @param callstack + * @param callsites + */ + private completeOrphanArgPassCalls(trace: TraceItem[], callstack: CallstackFrame[], callsites: CallsiteFrame[] | undefined): void { + if (!Array.isArray(trace) || !Array.isArray(callstack)) return for (let i = trace.length - 1; i >= 0; i--) { const step = trace[i] if (step?.tag !== 'ARG PASS: ') continue @@ -740,8 +1005,9 @@ class TaintChecker extends Checker { const argPassFile = step?.node?.loc?.sourcefile || step?.file if (siteLine === argPassLine && siteLoc.sourcefile === argPassFile) continue const fclos = callstack[innermostIdx] - const rawName = fclos?.ast?.node?.id?.name || fclos?.fname || fclos?.qid || '' - const fname = QidUnifyUtil.qidUnifyByRemoveAngleAndPrefix(rawName) || rawName + const calleeEntry = getCalleeEntry(fclos) + if (!calleeEntry) continue + const fname = calleeEntry.name const callNode = Object.create(fclos?.ast?.node || {}) as NonNullable callNode.loc = siteLoc if (typeof callsite?.nodeHash !== 'undefined') { @@ -757,7 +1023,6 @@ class TaintChecker extends Checker { } trace.splice(i, 0, callStep) } - return traceSource ? trace : undefined } /** @@ -895,12 +1160,9 @@ class TaintChecker extends Checker { taintFlowFinding.callstack = callstack // callsites 与 callstack 长度一致，每项结构 { code, nodeHash, loc }，由 analyzer 在 CallExpression 进入被调函数时入栈 taintFlowFinding.callsites = callsites - return taintFlowFinding } - - /** * * @param tagName diff --git a/src/config.ts b/src/config.ts index 4da1c92d..7a8a9b47 100644 --- a/src/config.ts +++ b/src/config.ts @@ -65,8 +65,14 @@ export interface IConfig { scanTimeoutMs?: number // 单入口内存护栏：超阈值提前 stop 当前入口，flush 已分析入口 finding，跳下一入口 entrypointMemoryGuard?: boolean - // 单入口堆使用上限（MB），超过即触发护栏 abort 当前入口 + // @deprecated 单入口堆使用上限（MB），绝对模式阈值。delta 模式下沉后全语言不再使用，字段保留兼容 entrypointMemoryLimitMB?: number + // 单入口 heap growth delta 上限（MB），delta 模式阈值，超过即触发护栏 abort 当前入口。 + // delta 模式只看本入口增长，不受前序入口累积影响，比绝对模式更公平。默认 2048（2GB）。 + // 高 baseline 项目（如多 controller builder pattern 项目）需调小至 1024MB，避免 baseline 累积后 delta 允许堆涨到 V8 上限才触发。 + entrypointMemoryLimitDeltaMB?: number + // Go delta 模式 alias：优先读 Go 专用环境变量，fallback 到 entrypointMemoryLimitDeltaMB + goEntrypointMemoryLimitDeltaMB?: number single?: boolean maindir?: string configFilePath?: string @@ -225,7 +231,15 @@ const configObject: IConfig = { // Memory guard: 单入口堆超阈提前 stop，flush 已分析入口 finding，跳下一入口（零污染，不改 clone） entrypointMemoryGuard: true, + // @deprecated 绝对模式阈值，delta 模式下沉后全语言不再使用；字段保留兼容旧 override entrypointMemoryLimitMB: Number(process.env.YASA_EP_MEM_LIMIT_MB) || 10240, + // delta 模式阈值：per-entrypoint heap growth delta 上限（MB），YASA_EP_MEM_LIMIT_DELTA_MB 环境变量可配置 + entrypointMemoryLimitDeltaMB: Number(process.env.YASA_EP_MEM_LIMIT_DELTA_MB) || 2048, + // Go delta 模式 alias：优先读 Go 专用环境变量，fallback 到通用 delta 阈值 + goEntrypointMemoryLimitDeltaMB: + Number(process.env.YASA_GO_EP_MEM_LIMIT_DELTA_MB) || + Number(process.env.YASA_EP_MEM_LIMIT_DELTA_MB) || + 2048, // Prune parameters for aggressive prune mode maxCallstackDepth: 12, // max callstack depth in aggressive prune mode diff --git a/src/engine/analyzer/common/analyzer-cache.ts b/src/engine/analyzer/common/analyzer-cache.ts index 1d3e909c..8a65e1e1 100644 --- a/src/engine/analyzer/common/analyzer-cache.ts +++ b/src/engine/analyzer/common/analyzer-cache.ts @@ -146,10 +146,17 @@ function serializeObject( // 检测是否是 Proxy，如果是则获取原始对象 let targetObj = obj + // 标记：RAW_TARGET 为空 plain object 的 ValueRefMap proxy，序列化需走 proxy 的 ownKeys/getOwnPropertyDescriptor + let rawTargetEmptyProxy = false if (util.types.isProxy && util.types.isProxy(obj)) { // 尝试获取 Proxy 的原始对象 if ((obj as any)[RAW_TARGET]) { targetObj = (obj as any)[RAW_TARGET] + // ValueRefMap proxy 的 _proxyTarget 永久为空 {}，Reflect.ownKeys 返回空数组 + // 但实际数据在 _map 中，需通过 proxy 的 ownKeys trap 获取 + if (Reflect.ownKeys(targetObj).every(k => typeof k === 'symbol')) { + rawTargetEmptyProxy = true + } } else if ((obj as any)[IS_UNION_ARRAY]) { targetObj = (obj as any)[IS_UNION_ARRAY] } @@ -160,9 +167,10 @@ function serializeObject( // 使用 Reflect.ownKeys 获取所有属性（包括不可枚举的） // 对于 Unit 对象，我们需要同时检查 targetObj 和 obj，因为某些属性（如 astNodehash）可能在原对象上 // 使用 targetObj 而不是 obj，避免触发 Proxy 的 get trap - const allKeys = Reflect.ownKeys(targetObj) + const allKeys = rawTargetEmptyProxy ? [] : Reflect.ownKeys(targetObj) // 对于 Unit 对象，也检查原对象上的属性（如果 targetObj 和 obj 不同） - const allKeysFromObj = targetObj !== obj ? Reflect.ownKeys(obj) : [] + // ValueRefMap 空 proxy 场景：从 obj（proxy）的 ownKeys trap 获取全部 key + const allKeysFromObj = (targetObj !== obj || rawTargetEmptyProxy) ? Reflect.ownKeys(obj) : [] // 合并两个键集合，确保所有属性都被序列化 const allKeysSet = new Set([...allKeys, ...allKeysFromObj]) @@ -184,8 +192,11 @@ function serializeObject( try { // 直接访问 targetObj 的属性，避免触发 Proxy 的 get trap // 如果 targetObj 上没有该属性，尝试从原对象获取（对于某些属性如 astNodehash） - let value = Reflect.get(targetObj, keyStr) - if (value === undefined && targetObj !== obj) { + // ValueRefMap 空 proxy 场景：通过 getOwnPropertyDescriptor trap 获取 UUID string + let value = rawTargetEmptyProxy + ? Object.getOwnPropertyDescriptor(obj, keyStr)?.value + : Reflect.get(targetObj, keyStr) + if (value === undefined && targetObj !== obj && !rawTargetEmptyProxy) { // 如果 targetObj 上没有该属性，尝试从原对象获取 const descriptor = Object.getOwnPropertyDescriptor(obj, keyStr) if (descriptor && 'value' in descriptor) { @@ -1729,7 +1740,9 @@ export function loadAnalyzerCache(analyzer: any, cacheId?: string, sourcePath?: let fieldTarget = unit.value if (fieldTarget && util.types.isProxy(fieldTarget)) { - fieldTarget = (fieldTarget as any)[RAW_TARGET] || fieldTarget + const rawTarget = (fieldTarget as any)[RAW_TARGET] + // ValueRefMap proxy 的 RAW_TARGET 为空 {}，需回退到 proxy 本身 + fieldTarget = rawTarget && Object.keys(rawTarget).length > 0 ? rawTarget : fieldTarget } if (fieldTarget === undefined || fieldTarget === null || typeof fieldTarget !== 'object') { fieldTarget = {} diff --git a/src/engine/analyzer/common/analyzer.ts b/src/engine/analyzer/common/analyzer.ts index 2e74245a..1240b44f 100644 --- a/src/engine/analyzer/common/analyzer.ts +++ b/src/engine/analyzer/common/analyzer.ts @@ -123,8 +123,15 @@ const { moveExistElementsToBuffer, addElementToBuffer } = require('../java/commo const { performanceTracker } = require('../../../util/performance-tracker') const { checkInvocationMatchSink } = require('../../../checker/taint/common-kit/sink-util') const OutputStrategyAutoRegister = require('./output-strategy-auto-register') -// 单入口内存护栏：基类 hook + Python override 写状态；状态由子类持有 -import type { MemoryGuardState } from './memory-guard/entrypoint-memory-guard' +// 单入口内存护栏：基类默认 delta 模式实现，子类可 override +import { + type MemoryGuardState, + createMemoryGuardState, + probeMemoryAndUpdate, + getEntryPointHeapDeltaMb, + resetForEntryPoint, + flushFindingsToReport, +} from './memory-guard/entrypoint-memory-guard' const { logDiagnostics } = require('../../../util/diagnostics-log-util') type IncrementalManagerModule = typeof import('../../../incremental/incremental-manager') @@ -3353,7 +3360,7 @@ class Analyzer extends BaseAnalyzer { // if (importedVal) { // this.saveVarInCurrentScope(scope, local, importedVal, state); // } - return this.processImportDirect(this.topScope, node, state) + return this.processImportDirect(scope, node, state) } /** @@ -3531,37 +3538,69 @@ class Analyzer extends BaseAnalyzer { } /** - * 单入口内存护栏 hook：子类 override 在 processInstruction/executeCall 边界检查 heapUsed， - * 超阈返回 true 提前退出当前入口。基类默认 false（护栏 disabled 或子类未实装）。 + * 单入口内存护栏 hook：基类默认 delta 模式实现，子类可 override 定制行为。 + * 在 processInstruction/executeCall 边界检查 heapUsed delta，超阈返回 true 提前退出当前入口。 + * baselineHeapBytes === 0 时（入口未 reset，如 processModule 阶段）直接返回 false，避免误杀。 */ protected shouldAbortExecutionForMemory(_state: State): boolean { - return false + const state = this.memoryGuardState + if (!state || !state.enabled) return false + return probeMemoryAndUpdate(state) } /** - * 内存护栏状态：子类（如 Python）override 时持有，基类默认 undefined。 + * 内存护栏状态：基类默认 createMemoryGuardState()，子类可 override 持有自定义状态。 * symbolInterpret 主循环每入口开始前通过 resetMemoryGuardForEntryPoint 重置。 */ - protected memoryGuardState: MemoryGuardState | undefined + protected memoryGuardState: MemoryGuardState | undefined = createMemoryGuardState() /** - * 入口开始前重置护栏状态。子类 override 写入具体 state（基类 noop）。 - * 默认实现确保未实装护栏的语言不会崩溃。 + * 入口开始前重置护栏状态：基类默认调共享 resetForEntryPoint（reset baseline + label）。 + * 子类可 override 追加自定义清理逻辑（如 per-entrypoint cache clear）。 */ - protected resetMemoryGuardForEntryPoint(_entryPointLabel: string): void { - // 基类 noop，子类可 override + protected resetMemoryGuardForEntryPoint(entryPointLabel: string): void { + const state = this.memoryGuardState + if (!state || !state.enabled) return + resetForEntryPoint(state, entryPointLabel) } /** - * 入口结束后处理护栏 diagnostics + flush。子类 override 写入具体行为。 - * 返回是否触发了 abort（用于上层 recordEntryPointLoopMetric skipReason）。 + * 入口结束后处理护栏：基类默认 delta 模式 diagnostics + flush + gc + log。 + * 子类可 override 定制 flush 行为。返回是否触发了 abort（用于上层 recordEntryPointLoopMetric skipReason）。 */ - protected onEntryPointMemoryGuardFinalize(_entryPoint: unknown, _findingsBefore: number): { + protected onEntryPointMemoryGuardFinalize( + _entryPoint: unknown, + findingsBefore: number + ): { aborted: boolean peakHeapMb: number deltaHeapMb: number } { - return { aborted: false, peakHeapMb: 0, deltaHeapMb: 0 } + const state = this.memoryGuardState + if (!state || !state.enabled) { + return { aborted: false, peakHeapMb: 0, deltaHeapMb: 0 } + } + const deltaInfo = getEntryPointHeapDeltaMb(state) + if (!state.exceeded) { + return { aborted: false, peakHeapMb: deltaInfo.peakMb, deltaHeapMb: deltaInfo.deltaMb } + } + const resultManager = this.checkerManager?.getResultManager?.() + const findingsAtFlush = flushFindingsToReport(resultManager ?? null, Config) + state.cumulativeFlushedFindings = findingsAtFlush + const gcFn = (globalThis as { gc?: () => void }).gc + if (typeof gcFn === 'function') { + try { + gcFn() + } catch (_e) { + /* --expose-gc 未启时无 gc，忽略 */ + } + } + logger.warn( + `[memory-guard] entrypoint aborted: ${state.entryPointLabel} peak=${deltaInfo.peakMb.toFixed(1)}MB ` + + `delta=${deltaInfo.deltaMb.toFixed(1)}MB limit=${state.deltaLimitMb}MB ` + + `flushedFindings=${findingsAtFlush} findingsBefore=${findingsBefore}` + ) + return { aborted: true, peakHeapMb: deltaInfo.peakMb, deltaHeapMb: deltaInfo.deltaMb } } /** @@ -5695,19 +5734,10 @@ class Analyzer extends BaseAnalyzer { } return } - const outputStrategyAutoRegister = new OutputStrategyAutoRegister() - outputStrategyAutoRegister.autoRegisterAllStrategies() - const allFindings = resultManager.getFindings() - for (const outputStrategyId in allFindings) { - const strategy = outputStrategyAutoRegister.getStrategy(outputStrategyId) - if (strategy && typeof strategy.outputFindings === 'function') { - const strategyStartedAt = Date.now() - const strategyFindings = allFindings[outputStrategyId] - const rawFindingCount = Array.isArray(strategyFindings) ? strategyFindings.length : 0 - strategy.outputFindings(resultManager, strategy.getOutputFilePath(), Config, printf) - logger.info(`[outputFindings] strategy=${outputStrategyId} phase=total raw=${rawFindingCount} elapsed=${Date.now() - strategyStartedAt}ms`) - } - } + // 最终输出：flush 最后一批 findings 到 accumulator + 写 accumulator 到文件 + // 如果扫描中 memory guard 未触发，accumulator 为空，此处将全部 findings 生成 SARIF 并写入 + // 如果扫描中 memory guard 触发过，accumulator 已有历史批次，此处追加最后一批后写最终 SARIF + flushFindingsToReport(resultManager, Config, printf as ((...args: unknown[]) => void) | undefined) } } diff --git a/src/engine/analyzer/common/finding-snapshot.ts b/src/engine/analyzer/common/finding-snapshot.ts index 63a4ed3c..6b8d06c4 100644 --- a/src/engine/analyzer/common/finding-snapshot.ts +++ b/src/engine/analyzer/common/finding-snapshot.ts @@ -1,6 +1,7 @@ -// finding 写入 ResultManagerProxy 前的 snapshot 转换： -// 将 live mutable reference 字段替换为 primitive-only 结构， -// 使 LocalResultBuffer 中的 finding 与 analyzer 运行时完全解耦。 +// finding flush 后的 snapshot 转换： +// SARIF 已从 live AST 生成（含 snippet），flush 后将 live mutable reference 字段 +// 替换为 primitive-only 结构，使 dedupIndex 中的 finding 与 analyzer 运行时解耦。 +// 不预计算 _prettyPrint（SARIF 已写入，不再需要 snippet）。 function deepCloneLoc(loc: any): any { if (!loc) return undefined @@ -11,46 +12,29 @@ function deepCloneLoc(loc: any): any { } } -function tryPrettyPrint(node: any): string | undefined { - if (!node) return undefined - try { - const AstUtil = require('../../../util/ast-util') - const result = AstUtil.prettyPrint(node) - return typeof result === 'string' ? result : undefined - } catch { - return undefined - } -} - export function snapshotFinding(finding: any): any { - // 1. trace[].node → minimal snapshot + 预算 _prettyPrint - // 输出层 normalizeTerminalStringValueOfTrace 用 prettyPrint 判断末端 String.valueOf 节点是否剥除， - // 剥掉 AST body 前必须预算，否则 prettyPrint 返回空导致末端节点未被剥除。 + // 1. trace[].node → minimal snapshot（不预算 _prettyPrint，SARIF 已写入） if (finding.trace && Array.isArray(finding.trace)) { for (const item of finding.trace) { if (item.node) { - const prettyPrint = tryPrettyPrint(item.node) item.node = { loc: deepCloneLoc(item.node.loc), _meta: item.node._meta ? { nodehash: item.node._meta.nodehash } : undefined, - _prettyPrint: prettyPrint, } } } } - // 2. finding.node → minimal snapshot + prettyPrint 预计算 + // 2. finding.node → minimal snapshot（不预算 _prettyPrint） if (finding.node) { - const prettyPrint = tryPrettyPrint(finding.node) finding.node = { loc: deepCloneLoc(finding.node.loc), _meta: finding.node._meta ? { nodehash: finding.node._meta.nodehash } : undefined, type: finding.node.type, - _prettyPrint: prettyPrint, } } - // 3. callstack[] → minimal fclos snapshot（保留 ast.node 结构供 SARIF/callstack-only 消费） + // 3. callstack[] → minimal fclos snapshot（保留 ast.node.loc 供 dedup / SARIF 消费） if (finding.callstack && Array.isArray(finding.callstack)) { finding.callstack = finding.callstack.map((f: any) => { const nodeLoc = f?.ast?.node?.loc diff --git a/src/engine/analyzer/common/memory-guard/entrypoint-memory-guard.ts b/src/engine/analyzer/common/memory-guard/entrypoint-memory-guard.ts index 5f28f53f..54cc51ae 100644 --- a/src/engine/analyzer/common/memory-guard/entrypoint-memory-guard.ts +++ b/src/engine/analyzer/common/memory-guard/entrypoint-memory-guard.ts @@ -10,16 +10,21 @@ import type { IConfig } from '../../../../config' import type { IResultManager } from '../result-manager' +import { snapshotFinding } from '../finding-snapshot' const Config = require('../../../../config') const logger = require('../../../../util/logger')(__filename) +const path = require('path') +const FileUtil = require('../../../../util/file-util') /** 内存护栏状态：每个入口点开始时通过 resetForEntryPoint 重置。 */ export interface MemoryGuardState { /** 是否启用护栏 */ enabled: boolean - /** 堆使用上限（MB） */ + /** 堆使用上限（MB），绝对模式阈值（delta 模式下不使用）。无读取点，保留仅供历史诊断日志兼容 */ limitMb: number + /** per-entrypoint heap growth delta 上限（MB），delta 模式阈值 */ + deltaLimitMb: number /** 当前入口开始前的 heapUsed 基线（字节） */ baselineHeapBytes: number /** 当前入口观测到的 heapUsed 峰值（字节） */ @@ -38,15 +43,19 @@ export interface MemoryGuardState { cumulativeFlushedFindings: number } -/** 创建默认护栏状态。enabled / limitMb 从 Config 读取。 */ +/** 创建默认护栏状态。enabled / deltaLimitMb 从 Config 读取。 */ export function createMemoryGuardState(): MemoryGuardState { const enabled = !!Config.entrypointMemoryGuard const limitMb = typeof Config.entrypointMemoryLimitMB === 'number' && Config.entrypointMemoryLimitMB > 0 ? Config.entrypointMemoryLimitMB : 10240 + const deltaLimitMb = typeof Config.entrypointMemoryLimitDeltaMB === 'number' && Config.entrypointMemoryLimitDeltaMB > 0 + ? Config.entrypointMemoryLimitDeltaMB + : 2048 return { enabled, limitMb, + deltaLimitMb, baselineHeapBytes: 0, peakHeapBytes: 0, exceeded: false, @@ -81,6 +90,8 @@ export function resetForEntryPoint( /** * 节流探测 heapUsed：超时间窗才调 process.memoryUsage()，否则返回 cached 判定。 + * delta 模式：当前 heapUsed 相对 baselineHeapBytes 的增长超过 deltaLimitMb 才 abort。 + * baselineHeapBytes === 0 时（入口未 reset，如 processModule 阶段）直接返回 false，避免误杀。 * 返回 true 表示超阈，调用方应 abort 当前入口。 * * @param state 护栏状态 @@ -93,13 +104,16 @@ export function probeMemoryAndUpdate( ): boolean { if (!state.enabled) return false if (state.exceeded) return true + // processModule 阶段未 reset baseline，guard 不生效（避免误杀 entrypoint 收集） + if (state.baselineHeapBytes === 0) return false // 节流：时间窗内不重复探测 if (now - state.lastProbeMs < state.probeIntervalMs) return false state.lastProbeMs = now const heapUsed = process.memoryUsage().heapUsed if (heapUsed > state.peakHeapBytes) state.peakHeapBytes = heapUsed - const limitBytes = state.limitMb * 1024 * 1024 - if (heapUsed >= limitBytes) { + const deltaBytes = heapUsed - state.baselineHeapBytes + const deltaLimitBytes = state.deltaLimitMb * 1024 * 1024 + if (deltaBytes >= deltaLimitBytes) { state.exceeded = true return true } @@ -109,9 +123,12 @@ export function probeMemoryAndUpdate( /** * flush 当前 resultManager 内 finding 到 Config.reportDir。 * - * 通过实例化 OutputStrategyAutoRegister 调各 strategy 的 outputFindings： - * - 多次调用幂等（outputFindings 全量覆盖写同一路径 sarif） - * - 不 clear resultManager，后续入口继续 append，最终 outputAnalyzerResult 仍正常输出全量 + * 根治跨入口 OOM 的核心流程： + * - 从当前批次 live findings 生成 SARIF（此时 AST 还活着，snippet 可用 prettyPrint 生成） + * - 将 SARIF results 累积到 sarifResultsAccumulator（轻量 JSON，无 AST 重引用） + * - 写 accumulator 到文件（checkpoint，覆盖写包含所有已 flush 批次） + * - snapshot 当前批次 findings → dedupIndex（释放 AST 重引用，保留 dedup 字段供下一入口 isNewFinding） + * - clearFindingsKeepDedup（清空当前批次，保留 dedupIndex 和 accumulator） * * @param resultManager 全局 ResultManager（来自 checkerManager） * @param config 配置对象（默认 Config） @@ -137,22 +154,87 @@ export function flushFindingsToReport( const list = findings[key] if (Array.isArray(list)) total += list.length } - if (total === 0) return 0 - // OutputStrategyAutoRegister 通过 require 加载输出策略；flush 路径只复用同一注册表 + + // 1. 生成 SARIF + 累积到 accumulator（当前批次有 findings 时） + if (total > 0) { + const OutputStrategyAutoRegister = require('../output-strategy-auto-register') + const registry = new OutputStrategyAutoRegister() + registry.autoRegisterAllStrategies() + for (const strategyId of Object.keys(findings)) { + const strategy = registry.getStrategy(strategyId) + if (!strategy || typeof strategy.outputFindings !== 'function') continue + try { + const results = strategy.outputFindings(resultManager, strategy.getOutputFilePath(), config, printf) + if (results) { + mergeSarifResults(resultManager.sarifResultsAccumulator, strategyId, results) + } + } catch (e) { + handleFlushError(strategyId, e) + } + } + } + + // 2. 写 accumulator checkpoint（覆盖写，包含所有已 flush 批次的 results） + writeAccumulatedResults(resultManager, reportDir) + + // 3. snapshot 当前批次 findings → dedupIndex + 清空当前批次 + if (total > 0) { + for (const strategyId of Object.keys(findings)) { + const list = findings[strategyId] + if (!Array.isArray(list)) continue + if (!resultManager.dedupIndex[strategyId]) { + resultManager.dedupIndex[strategyId] = [] + } + for (const finding of list) { + snapshotFinding(finding) + resultManager.dedupIndex[strategyId].push(finding) + } + } + resultManager.clearFindingsKeepDedup() + } + + return total +} + +/** 合并 SARIF results 到 accumulator（按 strategyId 累积 runs[0].results） */ +function mergeSarifResults( + accumulator: Record, + strategyId: string, + newResults: any +): void { + if (!newResults?.runs?.[0]?.results) return + const existing = accumulator[strategyId] + if (!existing) { + accumulator[strategyId] = newResults + return + } + if (!existing.runs?.[0]?.results) { + accumulator[strategyId] = newResults + return + } + existing.runs[0].results.push(...newResults.runs[0].results) +} + +/** 写 accumulator 到 report 目录（checkpoint，覆盖写） */ +function writeAccumulatedResults( + resultManager: IResultManager, + reportDir: string +): void { const OutputStrategyAutoRegister = require('../output-strategy-auto-register') const registry = new OutputStrategyAutoRegister() registry.autoRegisterAllStrategies() - for (const strategyId of Object.keys(findings)) { + for (const strategyId of Object.keys(resultManager.sarifResultsAccumulator)) { const strategy = registry.getStrategy(strategyId) - if (!strategy || typeof strategy.outputFindings !== 'function') continue + if (!strategy || typeof strategy.getOutputFilePath !== 'function') continue + const results = resultManager.sarifResultsAccumulator[strategyId] + if (!results) continue try { - strategy.outputFindings(resultManager, strategy.getOutputFilePath(), config, printf) + const reportFilePath = path.join(reportDir, strategy.getOutputFilePath()) + FileUtil.writeJSONfile(reportFilePath, results, true) } catch (e) { - // flush 失败不影响主流程，记录后继续 handleFlushError(strategyId, e) } } - return total } function handleFlushError(strategyId: string, e: unknown): void { diff --git a/src/engine/analyzer/common/result-manager-proxy.ts b/src/engine/analyzer/common/result-manager-proxy.ts index 44867872..517f5aa6 100644 --- a/src/engine/analyzer/common/result-manager-proxy.ts +++ b/src/engine/analyzer/common/result-manager-proxy.ts @@ -19,6 +19,22 @@ export class ResultManagerProxy implements IResultManager { this.globalResultManager.findings = value } + get dedupIndex(): Record { + return this.globalResultManager.dedupIndex + } + + set dedupIndex(value: Record) { + this.globalResultManager.dedupIndex = value + } + + get sarifResultsAccumulator(): Record { + return this.globalResultManager.sarifResultsAccumulator + } + + set sarifResultsAccumulator(value: Record) { + this.globalResultManager.sarifResultsAccumulator = value + } + getFindings(): Record { return this.globalResultManager.getFindings() } @@ -27,6 +43,10 @@ export class ResultManagerProxy implements IResultManager { this.globalResultManager.clearFindings() } + clearFindingsKeepDedup(): void { + this.globalResultManager.clearFindingsKeepDedup() + } + newFinding(finding: Record, outputStrategyId?: string): void { // 当前 EP 的去重视图保持全局一致，避免本地合并视图反复分配临时数组。 this.globalResultManager.newFinding(finding, outputStrategyId) diff --git a/src/engine/analyzer/common/result-manager.ts b/src/engine/analyzer/common/result-manager.ts index fc56c504..65df00e7 100644 --- a/src/engine/analyzer/common/result-manager.ts +++ b/src/engine/analyzer/common/result-manager.ts @@ -5,8 +5,14 @@ const FindingUtil = require('../../../util/finding-util') */ export interface IResultManager { findings: Record + /** 跨入口 dedop 用的轻量 finding 记录（已 snapshot，无 AST 重引用） */ + dedupIndex: Record + /** 累积的 SARIF results（按 strategyId 存储已序列化的 SARIF 报告） */ + sarifResultsAccumulator: Record getFindings(): Record clearFindings(): void + /** 清空当前 findings，保留 dedupIndex 和 sarifResultsAccumulator */ + clearFindingsKeepDedup(): void newFinding(finding: Record, outputStrategyId?: string): void } @@ -15,12 +21,16 @@ export interface IResultManager { */ class ResultManager implements IResultManager { findings: Record + dedupIndex: Record + sarifResultsAccumulator: Record /** * Constructor of ResultManager */ constructor() { this.findings = {} + this.dedupIndex = {} + this.sarifResultsAccumulator = {} } /** @@ -37,6 +47,13 @@ class ResultManager implements IResultManager { this.findings = {} } + /** + * 清空当前批次 findings（释放 AST 重引用），保留 dedupIndex 和 sarifResultsAccumulator + */ + clearFindingsKeepDedup(): void { + this.findings = {} + } + /** * add a new finding * @param finding finding object diff --git a/src/engine/analyzer/common/sarif.ts b/src/engine/analyzer/common/sarif.ts index cbef251b..b9b608f8 100644 --- a/src/engine/analyzer/common/sarif.ts +++ b/src/engine/analyzer/common/sarif.ts @@ -1,11 +1,14 @@ const { formatSanitizerTags } = require('../../../checker/sanitizer/sanitizer-checker') -interface SarifLocation { +type SarifProperties = Record + +export interface SarifLocation { physicalLocation?: { artifactLocation?: { uri: string } region?: any nodeHash: string } + properties?: SarifProperties [key: string]: any } @@ -24,6 +27,7 @@ interface SarifResult { locations: SarifLocation[] matchedSanitizerTags: any callstack: CallstackElement[] + properties?: SarifProperties } /** @@ -47,9 +51,10 @@ function prepareResult( trace: any, location: SarifLocation, matchedSanitizerTags: any, - callstackElments: CallstackElement[] + callstackElments: CallstackElement[], + properties?: SarifProperties ): SarifResult { - return { + const result: SarifResult = { message: { text: title, }, @@ -62,6 +67,10 @@ function prepareResult( matchedSanitizerTags: formatSanitizerTags(matchedSanitizerTags), callstack: callstackElments, } + if (properties && Object.keys(properties).length > 0) { + result.properties = properties + } + return result } /** @@ -83,7 +92,8 @@ function prepareLocation( uri: string, snippetText: string, nodeHash: string, - affectedNodeName?: string + affectedNodeName?: string, + properties?: SarifProperties ): SarifLocation { const res: SarifLocation = { physicalLocation: { @@ -104,6 +114,9 @@ function prepareLocation( if (affectedNodeName && typeof affectedNodeName === 'string') { res.physicalLocation!.region.snippet.affectedNodeName = affectedNodeName } + if (properties && Object.keys(properties).length > 0) { + res.properties = properties + } return res } @@ -114,14 +127,14 @@ function prepareLocation( function prepareTrace(locations: SarifLocation[]): any[] { const newLocations: any[] = [] for (let i = 0; i < locations.length; i++) { - newLocations.push({ - location: { - message: { - text: `Step ${i.toString()}`, - }, - physicalLocation: locations[i].physicalLocation, + const location = { + message: { + text: `Step ${i.toString()}`, }, - }) + physicalLocation: locations[i].physicalLocation, + ...(locations[i].properties ? { properties: locations[i].properties } : {}), + } + newLocations.push({ location }) } return [ { @@ -134,89 +147,6 @@ function prepareTrace(locations: SarifLocation[]): any[] { ] } -/** - * 按 (sink_uri, sink_line, entrypoint) 聚合同 sink 同 ep 的多条 result， - * 把各自的 codeFlows 合并到一条 result 的 codeFlows 数组中。 - * 用途：D24 triage 发现 43% 的 SARIF result 是同 sink 不同 codeFlow 的枚举重复， - * 下游人工 triage 成本巨大；SARIF 规范允许一个 result 携带多个 codeFlows。 - * - * 聚合 key：`uri|startLine|ep.filePath::ep.functionName::ep.funcReceiverType::ep.attribute`。 - * 以下情况不聚合（按原顺序独立保留）： - * - locations 为空或缺失 physicalLocation / startLine - * - entrypoint 缺失 functionName（无法判定同 ep） - * 合并时保留第一条 result 的非 codeFlows 字段（level / rank / message / sinkInfo / - * callstack / matchedSanitizerTags），codeFlows 依原始顺序拼接且自动去重完全相同的枝。 - * @param results - */ -function dedupResultsBySinkAndEntrypoint(results: SarifResult[]): SarifResult[] { - if (!Array.isArray(results) || results.length <= 1) { - return results - } - const keyToIdx = new Map() - const seenFlowsPerKey = new Map>() - const final: SarifResult[] = [] - - for (const r of results) { - const key = buildDedupKey(r) - if (key === null) { - final.push(r) - continue - } - const existingIdx = keyToIdx.get(key) - if (existingIdx === undefined) { - keyToIdx.set(key, final.length) - final.push(r) - const seen = new Set() - for (const flow of toFlowArray(r.codeFlows)) { - seen.add(serializeFlow(flow)) - } - seenFlowsPerKey.set(key, seen) - continue - } - const existing = final[existingIdx] - if (!Array.isArray(existing.codeFlows)) { - existing.codeFlows = [] - } - const seen = seenFlowsPerKey.get(key)! - for (const flow of toFlowArray(r.codeFlows)) { - const sig = serializeFlow(flow) - if (seen.has(sig)) continue - seen.add(sig) - existing.codeFlows.push(flow) - } - } - return final -} - -function buildDedupKey(r: SarifResult): string | null { - const loc = r?.locations?.[0] - const uri = loc?.physicalLocation?.artifactLocation?.uri - const startLine = loc?.physicalLocation?.region?.startLine - const ep = r?.entrypoint - const epFuncName = ep?.functionName - if (!uri || typeof startLine !== 'number' || !epFuncName) { - return null - } - const epFilePath = ep?.filePath ?? '' - const epAttr = ep?.attribute ?? '' - const epReceiver = ep?.funcReceiverType ?? '' - return `${uri}|${startLine}|${epFilePath}::${epFuncName}::${epReceiver}::${epAttr}` -} - -function toFlowArray(codeFlows: any): any[] { - if (!codeFlows) return [] - if (Array.isArray(codeFlows)) return codeFlows - return [codeFlows] -} - -function serializeFlow(flow: any): string { - try { - return JSON.stringify(flow) - } catch (_err) { - // 极端场景下 flow 含循环引用，退化为唯一随机签名（不聚合） - return `__ref__${Math.random()}` - } -} /** * @@ -224,7 +154,6 @@ function serializeFlow(flow: any): string { * @param graphs */ function prepareSarifFormat(results: SarifResult[], graphs: any): Record { - const deduped = results return { runs: [ { @@ -235,7 +164,7 @@ function prepareSarifFormat(results: SarifResult[], graphs: any): Record 0 ? rawTarget : unitField if (raw && typeof raw === 'object') { for (const key of Object.keys(raw)) { const val = raw[key] @@ -50,7 +52,8 @@ export abstract class EntityValue extends ValueBase { if ('field' in finalOpts) { const val = finalOpts.field if (val && typeof val === 'object') { - const raw = val[RAW_TARGET] || val + const rawTarget = val[RAW_TARGET] + const raw = rawTarget && Object.keys(rawTarget).length > 0 ? rawTarget : val for (const key of Object.keys(raw)) { if (raw[key] != null) members.set(key, raw[key]) } @@ -91,7 +94,8 @@ export abstract class EntityValue extends ValueBase { } if (val && typeof val === 'object') { members.clear() - const raw = val[RAW_TARGET] || val + const rawTarget = val[RAW_TARGET] + const raw = rawTarget && Object.keys(rawTarget).length > 0 ? rawTarget : val if (typeof raw === 'object') { for (const key of Object.keys(raw)) { if (raw[key] != null) members.set(key, raw[key]) diff --git a/src/engine/analyzer/common/value/value-ref-map.ts b/src/engine/analyzer/common/value/value-ref-map.ts index fd61e82b..ec4203d4 100644 --- a/src/engine/analyzer/common/value/value-ref-map.ts +++ b/src/engine/analyzer/common/value/value-ref-map.ts @@ -23,6 +23,14 @@ export interface ValueRegistry extends ValueStore { * 有 UUID → 优先从符号表 resolve（匹配旧 createFieldProxy 行为），_direct 做 fallback。 * 无 UUID → 直返 _direct（非 Unit 值或注册失败时）。 * + * _proxyTarget 永久为空 {}，仅作为 Proxy 构造所需的 target object。 + * 所有数据读写均通过 _map，不往 _proxyTarget 写 string key， + * 避免 V8 NameDictionary::Add 扩容导致的 OOM（原 365k 实例 × bags = 3.73GiB）。 + * + * COW：_clone 共享 _map 引用（避免 clone 时 new Map() 重复 Rehash 扩容的 Map backing OOM）， + * 首次写时拆分为独立副本。注册成功的 Unit 同时存 WeakRef _direct， + * cloned ST 查不到 uuid 时 resolve 回退 _direct 而非退化为 UUID 字符串（避免子作用域被误当字符串）。 + * * proxy[key] → resolve ValueRef → 返回 Value * proxy[key] = val → 转 ValueRef 存储（uuid + direct） * delete proxy[key] → 删除 @@ -30,7 +38,10 @@ export interface ValueRegistry extends ValueStore { * for...in → 遍历 keys */ export class ValueRefMap { + /** 内部数据主体。COW 共享时写前须调 _ensureMapOwned，外部禁止直接写 */ _map: Map = new Map() + /** COW 标记：true 表示 _map 与其他实例共享，写前须拷贝 */ + private _mapShared: boolean = false private _getSymbolTable: () => ValueRegistry | null private _getOwner: (() => Unit | null) | null private _proxy: any @@ -71,6 +82,7 @@ export class ValueRefMap { } set(key: string, value: Unit | ValueRef | null | undefined): void { + this._ensureMapOwned() this._setInternal(key, value) // v5 hook #5：slot_bind 事件。每次成功 set 记一条边（value → ownerUnit） // delete 语义（value==null）不记边 @@ -91,29 +103,25 @@ export class ValueRefMap { private _setInternal(key: string, value: Unit | ValueRef | null | undefined): void { if (value == null) { this._map.delete(key) - delete this._proxyTarget[key] return } if (value instanceof ValueRef) { this._map.set(key, value) - this._proxyTarget[key] = value.uuid || value._direct return } // UUID string → pure reference (no direct object available) if (typeof value === 'string' && (value as any).startsWith('symuuid')) { this._map.set(key, new ValueRef(value as any)) - this._proxyTarget[key] = value return } - // Register Unit values in ST, store UUID-only ref (no _direct). - // Matches old createFieldProxy: SET stores UUID string, GET resolves via ST. + // Register Unit values in ST, store UUID-only ref (no _direct)。 + // Matches旧 createFieldProxy: SET stores UUID string, GET resolves via ST。 if (value && typeof value === 'object' && (value as any).vtype && (value as any).qid) { const st = this._getSymbolTable() if (st) { const uuid = st.register(value as Unit) if (uuid) { this._map.set(key, new ValueRef(uuid)) - this._proxyTarget[key] = uuid return } } @@ -122,23 +130,19 @@ export class ValueRefMap { const uuid = value?.uuid || '' if (uuid) { this._map.set(key, new ValueRef(uuid)) - this._proxyTarget[key] = uuid } else { this._map.set(key, new ValueRef('', value)) - this._proxyTarget[key] = value } } delete(key: string): boolean { - delete this._proxyTarget[key] + this._ensureMapOwned() return this._map.delete(key) } clear(): void { + this._ensureMapOwned() this._map.clear() - for (const k of Object.keys(this._proxyTarget)) { - delete this._proxyTarget[k] - } } keys(): IterableIterator { @@ -163,13 +167,21 @@ export class ValueRefMap { return result } + /** COW 写时拷贝：共享 Map 在首次写前拆分为独立副本 */ + private _ensureMapOwned(): void { + if (this._mapShared) { + this._map = new Map(this._map) + this._mapShared = false + } + } + private _createProxy(): any { const self = this return new Proxy(this._proxyTarget, { get(_target, prop) { if (typeof prop === 'symbol') return (_target as any)[prop] if (typeof prop === 'string') { - if (prop === '_map') return self._map + if (prop === '_map') return self._map as ReadonlyMap if (prop === '_owner') return self if (prop === 'hasOwnProperty') return (key: string) => self._map.has(key) const ref = self._map.get(prop) @@ -193,8 +205,7 @@ export class ValueRefMap { deleteProperty(_target, prop) { if (typeof prop === 'string') { - self._map.delete(prop) - delete _target[prop] + self.delete(prop) return true } return false @@ -217,8 +228,14 @@ export class ValueRefMap { getOwnPropertyDescriptor(_target, prop) { if (typeof prop === 'string' && self._map.has(prop)) { + const ref = self._map.get(prop)! + // uuid 非空返回 UUID string（保持旧 _target[prop] 语义）； + // uuid 为空时回退 resolve/direct，避免 desc.value 退化为 '' + const value = ref.uuid + ? ref.uuid + : ref.resolve(self._getSymbolTable()) ?? ref._direct ?? undefined return { - value: _target[prop], + value, writable: true, enumerable: true, configurable: true, @@ -238,10 +255,8 @@ export class ValueRefMap { for (const [key, value] of entries) { if (value instanceof ValueRef) { map._map.set(key, value) - map._proxyTarget[key] = value.uuid || value._direct } else if (typeof value === 'string') { map._map.set(key, new ValueRef(value)) - map._proxyTarget[key] = value } } return map @@ -249,10 +264,12 @@ export class ValueRefMap { _clone(getSymbolTable: () => ValueRegistry | null): ValueRefMap { const copy = new ValueRefMap(getSymbolTable) - copy._map = new Map(this._map) - for (const [key, ref] of copy._map) { - copy._proxyTarget[key] = ref.uuid || ref._direct - } + // COW：共享 _map 引用不拷贝，写时由 _ensureMapOwned 拆分为独立副本。 + // 不守 size>0：空 map 克隆时若不置 _mapShared，任一侧 set 直接写共享对象、 + // 两侧互相污染,_map 异常增长 → satisfy BFS 触达 2^32-1 抛 RangeError。 + copy._map = this._map + this._mapShared = true + copy._mapShared = true return copy } } diff --git a/src/engine/analyzer/golang/common/entrypoint-collector/go-http-default-entrypoint.ts b/src/engine/analyzer/golang/common/entrypoint-collector/go-http-default-entrypoint.ts index 4f085bcd..b1acfa5d 100644 --- a/src/engine/analyzer/golang/common/entrypoint-collector/go-http-default-entrypoint.ts +++ b/src/engine/analyzer/golang/common/entrypoint-collector/go-http-default-entrypoint.ts @@ -1,6 +1,7 @@ export {} // net/http 形态默认 source 清单：覆盖 *http.Request / *url.URL / url.Values 三类典型 Web 入口 +// 复盘根因：tasks/review/amazonsftp-change-sql/REVIEW_REPORT.md §5.2 修复 A // 与 gin-default-entrypoint 互不重叠（calleeType 不同，不会双注入） const HttpRequestType = '*http.Request' diff --git a/src/engine/analyzer/golang/common/go-analyzer.ts b/src/engine/analyzer/golang/common/go-analyzer.ts index b5d565f7..c0e62eb7 100644 --- a/src/engine/analyzer/golang/common/go-analyzer.ts +++ b/src/engine/analyzer/golang/common/go-analyzer.ts @@ -24,6 +24,7 @@ import type { Node, UnaryExpression, ReturnStatement, + ConditionalExpression, } from '../../../../types/uast' import type { BoundCall, CallArgs, CallInfo } from '../../common/call-args' import { processGoFrameworkCall } from '../framework-call-model' @@ -32,7 +33,15 @@ import { goCallSummaryPolicy } from '../../common/call-summary/language/golang' import type { CallSummaryLanguagePolicy } from '../../common/call-summary/language/types' import { INTERNAL_CALL } from '../../common/call-args' import type { ClassHierarchy } from '../../../../resolver/common/value/class-hierarchy' -import { EntryPointMetricsCollector, type EntryPointMetric, type EntryPointMetricType } from '../../../../util/entrypoint-metrics' +import { EntryPointMetricsCollector, type EntryPointMetric, type EntryPointMetricType, describeEntryPointForLog } from '../../../../util/entrypoint-metrics' +import { + type MemoryGuardState, + createMemoryGuardState, + probeMemoryAndUpdate, + getEntryPointHeapDeltaMb, + resetForEntryPoint, + flushFindingsToReport, +} from '../../common/memory-guard/entrypoint-memory-guard' const path = require('path') const _ = require('lodash') @@ -234,6 +243,41 @@ class GoAnalyzer extends Analyzer { /** Cobra 子命令执行上下文会共享根命令的 context。 */ goCobraContextFallback?: SymbolValueType + /** + * 同一 callsite 单入口内解释次数限流：避免 Go method chaining（builder pattern） + * receiver 反复 executeCall 同一调用点导致 V8 堸线性增长。对齐 Java 的 per-callsite 限流设计。 + * key = node._meta?.nodehash || ${loc.start.line}:${loc.start.column}，value = 累计解释次数。 + * 生命周期：per-entrypoint，入口开始时通过 resetMemoryGuardForEntryPoint override 清空。 + */ + protected callsiteInterpretCount: Map = new Map() + + /** + * per-callsite 解释次数上限。超过则 fallback 到 processLibArgToRet（ARG→RET 保守传播）， + * 保留 sink 匹配（checkAtFunctionCallBefore 已在 processCallExpression 前段无条件调用）+ + * checkAtFunctionCallAfter 在 fallback 后仍触发。 + * 阈值内（≤200）保留完整语义（CHA fallback 正常跑，接口方法 taint 传播保留）。 + */ + private static readonly CALLSITE_INTERPRET_LIMIT = 200 + + /** + * Go 单入口内存护栏 delta 模式状态（独立新设计，不是"对齐 Python"绝对模式）。 + * GoAnalyzer 自存 deltaLimitMb，不改共享 MemoryGuardState 接口。 + */ + protected override memoryGuardState: MemoryGuardState | undefined = createMemoryGuardState() + + /** + * Go per-entrypoint heap growth delta 上限（MB），超过即 abort 当前入口。 + * 默认 2048（2GB），通过 YASA_GO_EP_MEM_LIMIT_DELTA_MB 环境变量配置。 + * delta 模式只看本入口增长，不受前序入口累积影响，比绝对模式更公平。 + */ + private deltaLimitMb: number = Config.goEntrypointMemoryLimitDeltaMB || 2048 + + /** 内存护栏 abort 计数（跨入口累加），用于 diagnostics 日志。 */ + private memoryGuardAbortCount: number = 0 + + /** 内存护栏 flush 计数（跨入口累加），用于 diagnostics 日志。 */ + private memoryGuardFlushCount: number = 0 + /** * * @param options @@ -309,7 +353,6 @@ class GoAnalyzer extends Analyzer { } let { goModPath } = this.topScope.context.modules if (!goModPath) goModPath = '' - // 模块名包含多级路径时，解析结果不能被截断 const modulePackageManager = defaultScope || this.topScope.context.packages.getSubPackage(moduleName, true) // 计算项目模块根路径(go.mod所在目录) @@ -606,9 +649,29 @@ class GoAnalyzer extends Analyzer { }) } if (!ret) { - ret = this.executeWithSummary(scope, fclos, callInfo, state, () => - super.processCallExpression(scope, node, state) - ) + // per-callsite 限流检查：在 super.processCallExpression（executeCall 入口）之前， + // 此时 fclos + argvalues 已就绪，checkAtFunctionCallBefore 已在前段无条件调用。 + // 超限 fallback 到 processLibArgToRet（ARG→RET 保守传播），不补调 checkAtFunctionCallBefore + //（processCallExpression 前段已无条件调用，避免重复触发 sink 匹配）。 + // 阈值内走 super.processCallExpression 正常 dispatch，保留完整语义（含 CHA fallback）。 + const callsiteOverLimit = this.incrementAndCheckCallsiteLimit(node) + if (callsiteOverLimit) { + // 超限 fallback：fclos 是已解析的有效值，Go override processLibArgToRet 能保留 ret.rtype。 + // 限流 fallback 后 ret 是 SymbolValue（vtype='symbol'），CHA fallback 触发条件 + // `(!ret || ret.vtype === 'symbol')` 仍满足，CHA fallback 块仍会执行。 + // 对接口方法 method chaining：CHA fallback 内 executeCall 递归进入 processCallExpression + // 时仍经过上方限流点，累计计数仍生效（限流通过 CHA fallback 内部递归生效，而非跳过 CHA fallback）。 + // 对非接口方法：CHA fallback 触发条件 `fclos?.vtype !== 'fclos' || checkFclosInInterface(fclos)` 不满足， + // CHA fallback 不执行，限流 fallback 的 ARG→RET 保守传播有效。 + // checkAtFunctionCallAfter 在 fallback 后仍触发（ret 非 undefined）。 + ret = this.processLibArgToRet(node, fclos, argvalues, scope, state, { + callArgs: this.buildCallArgs(node, argvalues, fclos), + }) + } else { + ret = this.executeWithSummary(scope, fclos, callInfo, state, () => + super.processCallExpression(scope, node, state) + ) + } } this.applyGoExternalReturnTypeModel(scope, node, fclos, ret) const shouldForceGoShortVarCallback = node._meta?.goShortVarRhs && this.hasGoCallbackArgument(node, argvalues) @@ -722,7 +785,7 @@ class GoAnalyzer extends Analyzer { // 绑定 this 并执行。caller 的 _this 指向接口 receiver（rtype=interface）， // 直接共享会让 impl 函数体内的 receiver.field MemberAccess 继承错误 interface 类型。 - // Go method body 内的 receiver 变量从当前 receiver 对象继承 rtype。 + // Go method body 内 `p` 实际查找 receiver 对象（见 W5 根因 §3.2），其 rtype 即来自 receiver。 // 修复：进入 impl 前把 receiver 对象的 rtype 原地改为 impl struct 类型节点， // 执行完毕立刻恢复，避免污染全局 provider 的 rtype 跨 impl 迭代泄漏。 const oldThis = implFclos._this @@ -2046,6 +2109,43 @@ class GoAnalyzer extends Analyzer { return returnValue } + /** + * 三元表达式 override：加互斥分支预算快照（对齐 Java 的互斥分支预算快照设计）。 + * 分支前 snapshotMethodBudgets → consequent 执行后快照 → restoreMethodBudgets 恢复到分支前 → + * alternative 执行后快照 → mergeMethodBudgets 取每 key max 合并。 + * 避免互斥分支内同一 callsite 被双计次导致限流阈值被拉低。 + * processIfStatement 暂不 override（对齐 Java），测试若发现 if/else 双计次影响再补。 + */ + override processConditionalExpression(scope: Scope, node: ConditionalExpression, state: State): SymbolValueType { + const test = this.processInstruction(scope, node.test, state) + const rscope = MemState.cloneScope(scope, state) + const substates = MemState.forkStates(state) + const lstate = substates[0] + const rstate = substates[1] + this.processLRScopeInternal(lstate, rstate, state, test) + + const res = new UnionValue( + undefined, + undefined, + `${scope.qid}.`, + node + ) + + const budgetSnapshot = this.snapshotMethodBudgets() + const consequentVal = this.processInstruction(scope, node.consequent, lstate) + const consequentFinal = this.snapshotMethodBudgets() + + this.restoreMethodBudgets(budgetSnapshot) + const alternativeVal = this.processInstruction(rscope, node.alternative, rstate) + const alternativeFinal = this.snapshotMethodBudgets() + + this.mergeMethodBudgets(consequentFinal, alternativeFinal) + + res.appendValue(consequentVal) + res.appendValue(alternativeVal) + return res + } + /** * * @param fscope @@ -2084,6 +2184,135 @@ class GoAnalyzer extends Analyzer { return callArgs } + /** + * per-callsite 解释次数限流检查：超限返回 true，调用方应 fallback 到保守传播。 + * key = node._meta?.nodehash || ${loc.start.line}:${loc.start.column}，对齐 Java 的 per-callsite 限流设计。 + * 不加 callstack/scope fingerprint：method chain O(N²) 组合爆炸本身就是同 callsite 被反复解释， + * 限流不分上下文更激进有效。 + */ + private incrementAndCheckCallsiteLimit(node: CallExpression): boolean { + const loc = node.loc?.start + const meta = (node as { _meta?: { nodehash?: string } })._meta + const key = meta?.nodehash || (loc ? `${loc.line}:${loc.column}` : '') + if (!key) return false + const count = (this.callsiteInterpretCount.get(key) || 0) + 1 + this.callsiteInterpretCount.set(key, count) + return count > GoAnalyzer.CALLSITE_INTERPRET_LIMIT + } + + /** + * 快照 callsite 解释预算（互斥分支预算快照，对齐 Java 的互斥分支预算快照设计）。 + * 用于 processConditionalExpression 三元表达式互斥分支避免双计次。 + */ + private snapshotMethodBudgets(): { callsiteCount: Map } { + return { callsiteCount: new Map(this.callsiteInterpretCount) } + } + + /** + * 恢复 callsite 解释预算到指定快照（对齐 Java 的互斥分支预算恢复设计）。 + */ + private restoreMethodBudgets(snapshot: { callsiteCount: Map }): void { + this.callsiteInterpretCount = new Map(snapshot.callsiteCount) + } + + /** + * 合并互斥分支的 callsite 解释预算：取每 key 两分支的 max（对齐 Java 的互斥分支预算合并设计）。 + * 互斥分支内同一 callsite 被双计次时，合并取 max 而非 sum，限流阈值不被双计次拉低。 + */ + private mergeMethodBudgets( + consequentFinal: { callsiteCount: Map }, + alternativeFinal: { callsiteCount: Map } + ): void { + const keys = new Set([...consequentFinal.callsiteCount.keys(), ...alternativeFinal.callsiteCount.keys()]) + for (const key of keys) { + this.callsiteInterpretCount.set( + key, + Math.max(consequentFinal.callsiteCount.get(key) || 0, alternativeFinal.callsiteCount.get(key) || 0) + ) + } + } + + /** + * Go 单入口内存护栏 delta 模式 hook：在 processInstruction/executeCall 边界检查 + * per-entrypoint heap growth delta，超 deltaLimitMb 设 state.exceeded=true 并 return true。 + * 复用共享 probeMemoryAndUpdate（更新 peak，忽略返回值的绝对模式判定）+ + * getEntryPointHeapDeltaMb（取 delta），自行 delta 判定 + 自己设 state.exceeded。 + * + * 仅在 symbolInterpret 入口循环内生效：resetMemoryGuardForEntryPoint 调用后 baselineHeapBytes > 0。 + * processModule 阶段 baselineHeapBytes=0（未 reset），guard 直接 return false， + * 避免 baseline=0 导致 delta=peak 误判超限、abort processModule 导致 entrypoint 收集失败。 + */ + protected override shouldAbortExecutionForMemory(_state: State): boolean { + const state = this.memoryGuardState + if (!state || !state.enabled) return false + // processModule 阶段未 reset baseline，guard 不生效（避免误杀 processModule） + if (state.baselineHeapBytes === 0) return false + // 复用 probeMemoryAndUpdate 更新 peak，忽略返回值（绝对模式判定不适用 Go delta） + probeMemoryAndUpdate(state) + // 复用 getEntryPointHeapDeltaMb 取 delta，自行 delta 判定 + const { deltaMb } = getEntryPointHeapDeltaMb(state) + if (deltaMb >= this.deltaLimitMb) { + state.exceeded = true + return true + } + return false + } + + /** + * 入口开始前重置护栏状态：调共享 resetForEntryPoint（reset baseline + label）+ + * 清 callsiteInterpretCount（per-entrypoint reset，对齐 Java 的入口级 reset 设计）。 + * 必须在 symbolTable.clear() 之后调用，确保 baseline 探测时 tmpSymbolTable 已清理（delta 精度不失真）。 + */ + protected override resetMemoryGuardForEntryPoint(entryPointLabel: string): void { + const state = this.memoryGuardState + if (!state || !state.enabled) return + resetForEntryPoint(state, entryPointLabel) + this.callsiteInterpretCount.clear() + } + + /** + * 入口结束处理护栏：若 exceeded=true 则 flush 当前 resultManager finding 到 report.sarif， + * 强制 gc（--expose-gc 未启时 noop），记录 diagnostics（label/peak/delta/limit/flushedFindings）。 + * Go tmpSymbolTable 在下一入口 symbolTable.clear() 时清理，无需额外 clear（与 Python 入口结束 finalize 清理不同）。 + */ + protected override onEntryPointMemoryGuardFinalize( + _entryPoint: unknown, + findingsBefore: number + ): { aborted: boolean; peakHeapMb: number; deltaHeapMb: number } { + const state = this.memoryGuardState + if (!state || !state.enabled) { + return { aborted: false, peakHeapMb: 0, deltaHeapMb: 0 } + } + const deltaInfo = getEntryPointHeapDeltaMb(state) + // Go 自行 delta 判定：共享 probe 在 delta >= 共享 deltaLimitMb 时会设 state.exceeded=true， + // 但 Go 阈值（this.deltaLimitMb）可能高于共享默认，此时不应判 aborted，避免误 flush/gc/log。 + const aborted = deltaInfo.deltaMb >= this.deltaLimitMb + if (!aborted) { + return { aborted: false, peakHeapMb: deltaInfo.peakMb, deltaHeapMb: deltaInfo.deltaMb } + } + this.memoryGuardAbortCount++ + const resultManager = this.checkerManager?.getResultManager?.() + const findingsAtFlush = flushFindingsToReport(resultManager ?? null, Config) + state.cumulativeFlushedFindings = findingsAtFlush + this.memoryGuardFlushCount++ + // Go tmpSymbolTable 在下一入口 symbolTable.clear() 时清理，无需额外 clear + const gcFn = (globalThis as { gc?: () => void }).gc + if (typeof gcFn === 'function') { + try { + gcFn() + } catch (_e) { + /* --expose-gc 未启时无 gc，忽略 */ + } + } + logger.warn( + `[memory-guard] entrypoint aborted: ${state.entryPointLabel} peak=${deltaInfo.peakMb.toFixed(1)}MB ` + + `delta=${deltaInfo.deltaMb.toFixed(1)}MB limit=${this.deltaLimitMb}MB ` + + `flushedFindings=${findingsAtFlush} cumulativeAborts=${this.memoryGuardAbortCount} ` + + `cumulativeFlushes=${this.memoryGuardFlushCount} findingsBefore=${findingsBefore}` + ) + return { aborted: true, peakHeapMb: deltaInfo.peakMb, deltaHeapMb: deltaInfo.deltaMb } + } + /** * * @param boundCall @@ -2320,6 +2549,11 @@ class GoAnalyzer extends Analyzer { const findingsBefore = this.countFindings() let skipped = false let skipReason: string | undefined + // 单入口内存护栏 reset：每入口开始前记录基线 heap + 清 exceeded + 清 callsiteInterpretCount。 + // 调用顺序约束：必须在 symbolTable.clear()（清上一入口 tmpSymbolTable）之后调用， + // 否则 baseline 探测会包含上一入口 tmpSymbolTable 残留，delta 偏小，delta 模式探测精度下降。 + const epLabel = describeEntryPointForLog(entryPoint).replace(/^\[|\]$/g, '') + let memoryAborted = false try { if (entryPoint.isPreProcess && this.isTmpSymbolTableOpen) { this.restoreSymbolTable() @@ -2331,6 +2565,9 @@ class GoAnalyzer extends Analyzer { this.switchToTemporarySymbolTable() } + // resetMemoryGuardForEntryPoint 必须在 symbolTable.clear() 之后调用（baseline 干净） + this.resetMemoryGuardForEntryPoint(epLabel) + if (entryPoint.type === constValue.ENGIN_START_FILE_BEGIN) { skipped = true skipReason = 'unsupported' @@ -2404,7 +2641,21 @@ class GoAnalyzer extends Analyzer { this.checkerManager?.resultManagerProxy, ) } finally { + // 单入口内存护栏 finalize：若本入口 exceeded，flush 已分析 finding + gc + 记 diagnostics + const guardResult = this.onEntryPointMemoryGuardFinalize(entryPoint, findingsBefore) + if (guardResult.aborted) { + memoryAborted = true + if (!skipped) { + skipped = true + skipReason = `memory-guard-heap-exceeded:peak=${guardResult.peakHeapMb.toFixed(1)}MB,delta=${guardResult.deltaHeapMb.toFixed(1)}MB` + } + } this.recordEntryPointLoopMetric(entryPoint, metricStartTime, findingsBefore, skipped, skipReason, 1) + if (memoryAborted) { + logger.warn( + `[memory-guard] entrypoint ${index}/${entryPoints.length} skipped due to memory guard: ${epLabel}` + ) + } } } return true diff --git a/src/engine/analyzer/java/common/builtins/grpc-stream-observer-builtins.ts b/src/engine/analyzer/java/common/builtins/grpc-stream-observer-builtins.ts new file mode 100644 index 00000000..d9abab36 --- /dev/null +++ b/src/engine/analyzer/java/common/builtins/grpc-stream-observer-builtins.ts @@ -0,0 +1,77 @@ +import type { FunctionDefinition } from '../../../../../types/uast' +import type Unit from '../../../common/value/unit' +import { IdentifierRefValue } from '../../../common/value/identifier-ref' + +const GRPC_OBSERVER = 'io.grpc.stub.StreamObserver' + +type ObserverValue = Unit & { + value?: unknown + members?: Map + getRawValue?: () => unknown +} + +export interface GrpcObserverCallback { + receiver: Unit + method: Unit + request: IdentifierRefValue + definition: FunctionDefinition +} + +export class GrpcStreamObserverModel { + /** 只有完整类型名或显式导入能证明 gRPC 身份，同名业务接口不能触发桥接。 */ + static isObserverType(type: unknown, imports: readonly unknown[]): boolean { + const node = type as { id?: { name?: string }; name?: string } | undefined + const name = (node?.id?.name ?? node?.name ?? '').replace(/<.*>/g, '') + if (name === GRPC_OBSERVER) return true + if (name !== 'StreamObserver') return false + return imports.some((statement: unknown): boolean => { + const declaration = statement as { + id?: { name?: string } + varType?: { id?: { name?: string } } + init?: { type?: string; from?: { value?: string }; imported?: { name?: string } } + } + if (declaration.init?.type !== 'ImportExpression') return false + const imported = declaration.varType?.id?.name + ?? `${declaration.init.from?.value}.${declaration.init.imported?.name ?? declaration.id?.name}` + return imported === GRPC_OBSERVER + }) + } + + /** 返回值可能由分支合并产生，沿值容器展开而不遍历任意对象字段。 */ + private static leaves(value: Unit | undefined, seen: Set = new Set()): Unit[] { + if (!value || seen.has(value)) return [] + seen.add(value) + if (value.vtype !== 'union' && value.vtype !== 'BVT') return [value] + const container = value as ObserverValue + const children = value.vtype === 'union' ? container.value : container.getRawValue?.() + return Array.isArray(children) ? children.flatMap((child: Unit): Unit[] => this.leaves(child, seen)) : [] + } + + /** 将既有入口污点复制到请求参数，保留原始 SOURCE 证据并隔离响应对象类型。 */ + static buildCallbacks( + definition: FunctionDefinition, + imports: readonly unknown[], + source: Unit | undefined, + returned: Unit | undefined, + ): GrpcObserverCallback[] { + if (definition.parameters.length !== 1 || !source?.taint.isTainted) return [] + if (!this.isObserverType(definition.returnType, imports) + || !this.isObserverType(definition.parameters[0].varType, imports)) return [] + const callbacks: GrpcObserverCallback[] = [] + for (const receiver of this.leaves(returned)) { + if (receiver === source) continue + for (const method of this.leaves((receiver as ObserverValue).members?.get('onNext'))) { + if (method.vtype !== 'fclos') continue + const callback = method.ast?.fdef as FunctionDefinition | undefined + if (!callback || callback.body?.type === 'Noop' || callback.parameters.length !== 1) continue + const parameter = callback.parameters[0] + const request = new IdentifierRefValue(method.qid, parameter.id.name ?? '', parameter.id, parameter.loc, 'variable') + request.rtype = { definiteType: parameter.varType?.id } + request.taint.propagateFrom(source) + request.taint.propagateTraceFrom(source.taint) + callbacks.push({ receiver, method, request, definition: callback }) + } + } + return callbacks + } +} diff --git a/src/engine/analyzer/java/common/builtins/stream-builtins.ts b/src/engine/analyzer/java/common/builtins/stream-builtins.ts index 124cd521..adb6d6de 100644 --- a/src/engine/analyzer/java/common/builtins/stream-builtins.ts +++ b/src/engine/analyzer/java/common/builtins/stream-builtins.ts @@ -199,7 +199,7 @@ class Stream { } /** - * Stream.values — Java 标准 Stream API 无 values 方法，但 `Stream.collect(toMap)` 在当前引擎 + * Stream.values — Java 标准 Stream API 无 values 方法，但 `Stream.collect(toMap)` 在 yasa2 * 当前 modeling 下返回 Stream 本身（未真正构造 Map），下游对返回值再调 .values() 时落入未建模 * 路径，元素链断。这里把 Stream.values 视作恒等：把 _this（携带 buffer 元素与 taint）原样 * 返回，让 toMap/values/keySet 链上元素能继续传播到 `new ArrayList<>(...)` 构造器。 diff --git a/src/engine/analyzer/java/common/java-analyzer.ts b/src/engine/analyzer/java/common/java-analyzer.ts index 393e2004..a6f7a4e3 100644 --- a/src/engine/analyzer/java/common/java-analyzer.ts +++ b/src/engine/analyzer/java/common/java-analyzer.ts @@ -1,4 +1,5 @@ import { FindingsCheckpointWriter, combineFindingsFinalizationErrors } from '../../common/findings-checkpoint' +import { describeEntryPointForLog } from '../../../../util/entrypoint-metrics' /* eslint-disable @typescript-eslint/naming-convention, @typescript-eslint/no-unused-vars, @typescript-eslint/no-use-before-define */ import JavaTypeRelatedInfoResolver from '../../../../resolver/java/java-type-related-info-resolver' import type { Invocation } from '../../../../resolver/common/value/invocation' @@ -34,6 +35,8 @@ import type { CallInfo } from '../../common/call-args' import { javaCallSummaryPolicy } from '../../common/call-summary/language/java' import type { CallSummaryLanguagePolicy } from '../../common/call-summary/language/types' import type Unit from '../../common/value/unit' +import { CallExprValue } from '../../common/value/call-expr' +import { GrpcStreamObserverModel } from './builtins/grpc-stream-observer-builtins' const _ = require('lodash') const UastSpec = require('@ant-yasa/uast-spec') @@ -54,6 +57,7 @@ const { executeViaEntryPointExecutor } = const Constant = require('../../../../util/constant') const Config = require('../../../../config') const { handleException } = require('../../common/exception-handler') +const TaintOutputStrategyJava = require('../../../../checker/common/output/taint-output-strategy') const MemState = require('../../common/memState') const { ValueUtil: { UndefinedValue, UnionValue }, @@ -68,6 +72,10 @@ const { addElementToBuffer, getAllElementFromBuffer, collectDeepTaintDonors } = const { yasaLog } = require('../../../../util/format-util') const { createDeadlinePlan, createTimeoutLatch, formatBudgetMs } = require('../../common/entrypoint/deadline-scheduler') as typeof import('../../common/entrypoint/deadline-scheduler') +const { + javaEntrypointFindingCollectors, + getJavaLogicalEntrypointKey, +} = require('../../../../checker/taint/java/java-entrypoint-finding-collector') as typeof import('../../../../checker/taint/java/java-entrypoint-finding-collector') /** 接口虚分派未解析具体 receiver 时的 exhaustive fan-out 上限：超过阈值保留 lib fallback 防执行爆炸 */ const INTERFACE_EXHAUSTIVE_FAN_OUT_LIMIT = 64 @@ -93,6 +101,18 @@ type JavaRuntimeValue = Unit & { getThisObj?: () => unknown } +type LifecycleCallDepthPruneLocation = { + sourcefile?: string + start?: { line?: number; column?: number } + end?: { line?: number; column?: number } +} + +type LifecycleCallDepthPruneRecord = { + callee: string + location: LifecycleCallDepthPruneLocation + depth: number +} + type MiscBufferCarrier = Value & { setMisc?: (key: string, value: unknown) => void } @@ -1043,6 +1063,53 @@ class JavaAnalyzer extends Analyzer { protected currentFanoutOverloadIdentity = '' + // 生命周期回调内的普通调用深度剪枝默认关闭，避免影响普通入口点。 + protected lifecycleCallDepthPruneEnabled = false + + public lifecycleCallDepthPrunes: LifecycleCallDepthPruneRecord[] = [] + + /** + * 在生命周期动态作用域内执行回调，并保证嵌套调用和异常都恢复原状态。 + * @param callback 生命周期回调 + */ + public withLifecycleCallDepthPrune(callback: () => T): T { + const previous = this.lifecycleCallDepthPruneEnabled + this.lifecycleCallDepthPruneEnabled = true + try { + return callback() + } finally { + this.lifecycleCallDepthPruneEnabled = previous + } + } + + /** + * 返回生命周期调用深度剪枝记录。 + */ + getLifecycleCallDepthPrunes(): ReadonlyArray { + return this.lifecycleCallDepthPrunes + } + + /** + * 记录生命周期普通调用的深度剪枝。 + * @param fclos 被剪枝的函数闭包 + * @param node 调用位置 + * @param depth 当前调用栈深度 + */ + protected recordLifecycleCallDepthPrune(fclos: unknown, node: unknown, depth: number): void { + const closure = fclos as { qid?: unknown; sid?: unknown } | null + const callNode = node as { loc?: LifecycleCallDepthPruneLocation } | null + const callee = typeof closure?.qid === 'string' + ? closure.qid + : typeof closure?.sid === 'string' + ? closure.sid + : '' + this.lifecycleCallDepthPrunes.push({ + callee, + location: callNode?.loc ?? {}, + depth, + }) + } + /** * 构造函数 * @param options - 分析器选项 @@ -1850,42 +1917,7 @@ class JavaAnalyzer extends Analyzer { override processBinaryExpression(scope: Scope, node: BinaryExpression, state: State): BinaryExprValue { let res = super.processBinaryExpression(scope, node, state) - if ( - res?.left?.vtype === 'primitive' && - res?.right?.vtype === 'primitive' && - res?.operator && - ['>', '<', '==', '!=', '>=', '<='].includes(res.operator) - ) { - const leftPrim = res.left as PrimitiveValueType - const rightPrim = res.right as PrimitiveValueType - let leftPrimitive = leftPrim.value - if (leftPrim.literalType === 'string' && leftPrimitive != null && typeof leftPrimitive === 'string') { - leftPrimitive = `'${leftPrimitive.replaceAll("'", "\\'")}'` - } - let rightPrimitive = rightPrim.value - if (rightPrim.literalType === 'string' && rightPrimitive != null && typeof rightPrimitive === 'string') { - rightPrimitive = `'${rightPrimitive.replaceAll("'", "\\'")}'` - } - if (leftPrimitive != null && rightPrimitive != null) { - const expr = leftPrimitive + res.operator + rightPrimitive - try { - // eslint-disable-next-line no-eval - const result = eval(expr) - if (result != null) { - res = new PrimitiveValue( - scope.qid, - ``, - result, - null, - 'Literal', - node.loc - ) - } - } catch (e) { - // 忽略 eval 错误 - } - } - } else if (res?.operator === 'instanceof') { + if (res?.operator === 'instanceof') { if (res?.left?.vtype === 'primitive' && (res.left as PrimitiveValueType).literalType === 'null') { res = new PrimitiveValue(scope.qid, '', false, null, 'Literal', node.loc) } else if (res?.right?.vtype === 'class') { @@ -2775,6 +2807,11 @@ class JavaAnalyzer extends Analyzer { if (callbackRes && !res) res = callbackRes } + // AbstractOptUtil.execute callback->Processor 分派：jar 源码不可见时按 optRequest 类型匹配 Processor + if (this.dispatchOptUtilExecuteToProcessors(fclos, node, argvalues, state, scope)) { + fclosExecuted = true + } + const bridgedCallbackRes = this.dispatchReceiverCallbackMethod( node, fclos, @@ -3638,6 +3675,16 @@ class JavaAnalyzer extends Analyzer { /** * */ + /** 为 Java 入口候补绑定生产环境全局去重与入库适配器。 */ + protected configureJavaCandidatePromoter(): void { + const resultManager = this.checkerManager?.resultManagerProxy + if (!resultManager) return + javaEntrypointFindingCollectors.configurePromoter({ + isNewFinding: (finding) => TaintOutputStrategyJava.isNewFinding(resultManager, finding), + emit: (finding) => resultManager.newFinding(finding, TaintOutputStrategyJava.outputStrategyId), + }) + } + override startAnalyze() { super.startAnalyze() FullCallGraphFileEntryPoint.makeFullCallGraphByType(this, this.typeResolver) @@ -3649,6 +3696,8 @@ class JavaAnalyzer extends Analyzer { */ // eslint-disable-next-line complexity async symbolInterpret(): Promise { + this.configureJavaCandidatePromoter() + javaEntrypointFindingCollectors.beginRun() const entryPoints = (this as { entryPoints?: JavaEntryPointShape[] }).entryPoints ?? [] const state = this.initState(this.topScope) as State & { entryPointStartTimestamp?: number | null } if (_.isEmpty(entryPoints)) { @@ -3721,24 +3770,36 @@ class JavaAnalyzer extends Analyzer { let skipped = false let skipReason: string | undefined let overloadCount = 0 + // 单入口内存护栏 reset：每入口开始前记录基线 heap，清 exceeded + const epLabel = describeEntryPointForLog(entryPoint).replace(/^\[|\]$/g, '') + let memoryAborted = false + const logicalEntrypointKey = getJavaLogicalEntrypointKey(entryPoint) + const findingCollector = javaEntrypointFindingCollectors.get(logicalEntrypointKey) + const timeoutQueueBefore = this.timeoutEntryPoints.length + let entrypointCompleted = false + let entryFailed = false try { if (!activeDeadlinePlan.canStartAnalysis()) { skipped = true skipReason = 'analysis-deadline' + javaEntrypointFindingCollectors.finalize(logicalEntrypointKey, 'skip') continue } this.symbolTable.clear() + this.resetMemoryGuardForEntryPoint(epLabel) entryPoint.entryPointSymVal = this.tmpSymbolTable.tmpTableCopyUnit(entryPoint.entryPointSymVal) entryPoint.scopeVal = this.tmpSymbolTable.tmpTableCopyUnit(entryPoint.scopeVal) const symVal = entryPoint.entryPointSymVal if (entryPoint.type !== Constant.ENGIN_START_FUNCALL) { skipped = true skipReason = 'unsupported' + javaEntrypointFindingCollectors.finalize(logicalEntrypointKey, 'skip') continue } if (!symVal?.ast?.node) { skipped = true skipReason = 'unsupported' + javaEntrypointFindingCollectors.finalize(logicalEntrypointKey, 'skip') continue } const entryPointMark = this.markEntryPointForAnalysis(entryPoint, hasAnalysised) @@ -3771,6 +3832,7 @@ class JavaAnalyzer extends Analyzer { if (!overloadedList?.length) { skipped = true skipReason = 'no-overloads' + javaEntrypointFindingCollectors.finalize(logicalEntrypointKey, 'skip') continue } @@ -3783,6 +3845,7 @@ class JavaAnalyzer extends Analyzer { if (!attemptBudget) { skipped = true skipReason = 'analysis-deadline' + javaEntrypointFindingCollectors.finalize(logicalEntrypointKey, 'skip') break } executeViaEntryPointExecutor( @@ -3801,6 +3864,8 @@ class JavaAnalyzer extends Analyzer { classify: () => 'function', execute: () => { let beforeCalled = false + let attemptTimedOut = false + let completedArgValues: Value[] = [] state.entryPointStartTimestamp = Date.now() state.entryPointDeadline = attemptBudget.deadline state.entryPointClock = activeDeadlinePlan.now @@ -3813,6 +3878,7 @@ class JavaAnalyzer extends Analyzer { this.methodCumulativeTime.clear() overloadCount++ const argValues: Value[] = [] + completedArgValues = argValues try { for (const param of overloadFuncDef.parameters ?? []) { if (!param?.id) continue @@ -3837,6 +3903,7 @@ class JavaAnalyzer extends Analyzer { argValues.push(argValue) } } catch (e) { + entryFailed = true handleException( e, 'Error occurred in JavaAnalyzer.symbolInterpret: process argValue err', @@ -3850,6 +3917,7 @@ class JavaAnalyzer extends Analyzer { callArgs: this.buildCallArgs(overloadFuncDef, argValues, symVal), }) } catch (e) { + entryFailed = true handleException( e, `[${overloadFuncDef?.id?.name} symbolInterpret failed. Exception message saved in error log file`, @@ -3882,22 +3950,42 @@ class JavaAnalyzer extends Analyzer { entryPoint.functionName || `` ) - // 首遍超时的入口点入队重跑（无论 finding 是否增长，超时本身就意味着可能有未遍历路径） - this.timeoutEntryPoints.push({ entryPoint, overloadFuncDef, argValues }) + // 首遍超时在入口 after hook 完成后入队，保持 execute→after→enqueue 顺序。 + attemptTimedOut = true } } finally { this.checkerManager.checkAtSymbolInterpretOfEntryPointAfter(this, null, null, null, null) } + if (attemptTimedOut) this.timeoutEntryPoints.push({ entryPoint, overloadFuncDef, argValues: completedArgValues }) }, }, this.checkerManager?.resultManagerProxy ) } + if (entryFailed) { + javaEntrypointFindingCollectors.finalize(logicalEntrypointKey, 'exception') + } else if (!skipped) { + if (this.timeoutEntryPoints.length > timeoutQueueBefore) findingCollector.deferForRerun() + else { + findingCollector.complete() + entrypointCompleted = true + } + } } finally { + if (skipped && !entrypointCompleted) javaEntrypointFindingCollectors.finalize(logicalEntrypointKey, 'skip') state.entryPointDeadline = undefined state.entryPointClock = undefined state.entryPointTimeoutLatch = undefined this.globalState.entryPointTimeout = false + // 单入口内存护栏 finalize：若本入口 exceeded，flush 已分析 finding 并记 diagnostics + const guardResult = this.onEntryPointMemoryGuardFinalize(entryPoint, findingsBefore) + if (guardResult.aborted) { + memoryAborted = true + if (!skipped) { + skipped = true + skipReason = `memory-guard-heap-exceeded:peak=${guardResult.peakHeapMb.toFixed(1)}MB,delta=${guardResult.deltaHeapMb.toFixed(1)}MB` + } + } this.recordEntryPointLoopMetric( entryPoint, metricStartTime, @@ -3906,6 +3994,11 @@ class JavaAnalyzer extends Analyzer { skipReason, overloadCount ) + if (memoryAborted) { + logger.warn( + `[memory-guard] entrypoint ${epIdx}/${entryPoints.length} skipped due to memory guard: ${epLabel}` + ) + } } } // 基于全局时间预算的超时入口点重跑 @@ -3932,6 +4025,8 @@ class JavaAnalyzer extends Analyzer { this.pruneInfoMap.aggressiveMode = true try { let rerunIdx = 0 + const rerunSuccessByKey = new Set() + const rerunFailureByKey = new Set() for (const timeoutEntryPoint of this.timeoutEntryPoints) { rerunIdx++ const metricStartTime = Date.now() @@ -3939,6 +4034,13 @@ class JavaAnalyzer extends Analyzer { let skipped = false let skipReason: string | undefined let overloadCount = 0 + // 单入口内存护栏 reset：重跑入口同样记录基线 heap，清 exceeded + const epLabel = describeEntryPointForLog(timeoutEntryPoint.entryPoint).replace(/^\[|\]$/g, '') + let memoryAborted = false + const logicalEntrypointKey = getJavaLogicalEntrypointKey(timeoutEntryPoint.entryPoint) + let attemptFailed = false + const findingCollector = javaEntrypointFindingCollectors.get(logicalEntrypointKey) + let rerunCompleted = false try { const remainingAttempts = this.timeoutEntryPoints.length - rerunIdx + 1 const attemptBudget = activeDeadlinePlan.allocateAttempt(remainingAttempts, { @@ -3947,6 +4049,13 @@ class JavaAnalyzer extends Analyzer { if (!attemptBudget) { skipped = true skipReason = 'analysis-deadline' + rerunFailureByKey.add(logicalEntrypointKey) + const hasMoreRerunsForKey = this.timeoutEntryPoints.slice(rerunIdx).some((queued: { entryPoint: JavaEntryPointShape }) => getJavaLogicalEntrypointKey(queued.entryPoint) === logicalEntrypointKey) + if (!hasMoreRerunsForKey) { + if (rerunSuccessByKey.has(logicalEntrypointKey)) findingCollector.complete() + else javaEntrypointFindingCollectors.finalize(logicalEntrypointKey, 'skip') + rerunCompleted = true + } else rerunCompleted = true continue } logger.info( @@ -3957,6 +4066,7 @@ class JavaAnalyzer extends Analyzer { attemptBudget.remainingAttempts ) this.symbolTable.clear() + this.resetMemoryGuardForEntryPoint(epLabel) overloadCount = 1 executeViaEntryPointExecutor( @@ -4004,6 +4114,7 @@ class JavaAnalyzer extends Analyzer { } ) } catch (e) { + attemptFailed = true handleException( e, `[${timeoutEntryPoint.overloadFuncDef?.id?.name} symbolInterpret failed. Exception message saved in error log file`, @@ -4042,11 +4153,39 @@ class JavaAnalyzer extends Analyzer { }, this.checkerManager?.resultManagerProxy ) + const hasMoreRerunsForKey = this.timeoutEntryPoints.slice(rerunIdx).some((queued: { entryPoint: JavaEntryPointShape }) => + getJavaLogicalEntrypointKey(queued.entryPoint) === logicalEntrypointKey + ) + if (skipped || attemptFailed) rerunFailureByKey.add(logicalEntrypointKey) + else rerunSuccessByKey.add(logicalEntrypointKey) + if (!hasMoreRerunsForKey) { + if (rerunSuccessByKey.has(logicalEntrypointKey)) { + findingCollector.complete() + } else { + javaEntrypointFindingCollectors.finalize(logicalEntrypointKey, skipped ? 'timeout' : 'exception') + } + rerunCompleted = true + } else { + rerunCompleted = true + } } finally { + if (!rerunCompleted && !skipped && !attemptFailed) javaEntrypointFindingCollectors.finalize(logicalEntrypointKey, 'exception') state.entryPointDeadline = undefined state.entryPointClock = undefined state.entryPointTimeoutLatch = undefined this.globalState.entryPointTimeout = false + // 单入口内存护栏 finalize：若本入口 exceeded，flush 已分析 finding 并记 diagnostics + const guardResult = this.onEntryPointMemoryGuardFinalize( + timeoutEntryPoint.entryPoint, + findingsBefore + ) + if (guardResult.aborted) { + memoryAborted = true + if (!skipped) { + skipped = true + skipReason = `memory-guard-heap-exceeded:peak=${guardResult.peakHeapMb.toFixed(1)}MB,delta=${guardResult.deltaHeapMb.toFixed(1)}MB` + } + } this.recordEntryPointLoopMetric( timeoutEntryPoint.entryPoint, metricStartTime, @@ -4055,6 +4194,11 @@ class JavaAnalyzer extends Analyzer { skipReason, overloadCount ) + if (memoryAborted) { + logger.warn( + `[memory-guard] rerun entrypoint ${rerunIdx}/${this.timeoutEntryPoints.length} skipped due to memory guard: ${epLabel}` + ) + } } } } finally { @@ -4072,6 +4216,7 @@ class JavaAnalyzer extends Analyzer { // 清空，避免重复重跑 this.timeoutEntryPoints = [] } + javaEntrypointFindingCollectors.clear() await persistMandatoryCheckpoint() this.clearFanoutContinuationState() @@ -4127,19 +4272,50 @@ class JavaAnalyzer extends Analyzer { * @param fname * @param state */ - override postProcessFunctionBody(fscope: any, fdecl: any, fname: any, state: any): void { + override postProcessFunctionBody(fscope: Scope, fdecl: FunctionDefinition, fname: string, state: State): void { + this.executeGrpcStreamObserverCallback(fscope, fdecl, state) if (this.lastReturnValue) return if (fdecl?.body?.type !== 'ScopedStatement') return if (!fname?.includes(' s.type === 'ReturnStatement') + const hasReturn = stmts.some((statement): boolean => statement.type === 'ReturnStatement') if (!hasReturn && lastStmt.type !== 'ReturnStatement') { this.lastReturnValue = this.processInstruction(fscope, lastStmt, state) } } + /** gRPC 请求回调由框架在入口返回后触发，沿用当前入口的预算、检查器与闭包。 */ + private executeGrpcStreamObserverCallback(scope: Scope, definition: FunctionDefinition, state: State): void { + const entryPoint = CurrentEntryPoint.getCurrentEntryPoint() as { entryPointSymVal?: Unit } + const activeMethod = state.callstack?.[state.callstack.length - 1] as Unit | undefined + if (!entryPoint.entryPointSymVal || activeMethod !== entryPoint.entryPointSymVal) return + if (definition.parameters?.length !== 1 || !this.lastReturnValue) return + const parameter = definition.parameters[0] + const source = this.getMemberValueNoCreate(scope, parameter.id, state) as Unit | undefined + const imports = this.findDeclaringFileAstBody(scope) ?? this.findFileScopeAstBody(scope) ?? [] + const returned = this.lastReturnValue as Unit + const callbacks = GrpcStreamObserverModel.buildCallbacks(definition, imports, source, returned) + try { + for (const callback of callbacks) { + const method = callback.method as SymbolValueType + const previousThis = method._this + method._this = callback.receiver + try { + this.executeCall(callback.definition, method, state, scope, { + callArgs: this.buildCallArgs(callback.definition, [callback.request], method), + callsiteNode: callback.definition, + }) + } finally { + method._this = previousThis + } + } + } finally { + this.lastReturnValue = returned + } + } + /** * 组装类映射 * @param obj - 对象 @@ -4444,10 +4620,9 @@ class JavaAnalyzer extends Analyzer { argvalues.some((a: any) => a?.taint?.isTaintedRec === true && a.taint.tagTraces?.has(TAINT_TAG)) if (!hasTaintedArg) { this._coarsePropEligibleNoTaint = (this._coarsePropEligibleNoTaint || 0) + 1 - // 无 taint 输入时不跳过方法体：虽然不会产出 finding， - // 但方法返回值会被调用方使用（field access / 下游运算）， - // 返回 nil 会破坏调用方的值语义；必须正常执行以生成正确的返回值 - return undefined + const targetDepth = (state.callstack?.length ?? 0) + 1 + if (targetDepth <= 3) return undefined + return this.createCleanCoarseReturn(scope, node, fclos, argvalues) } // 粗传播命中计数 @@ -4491,6 +4666,16 @@ class JavaAnalyzer extends Analyzer { return res } + /** + * 为深层无污点粗粒度调用保留返回值的静态类型，不执行方法体或写入污点。 + */ + private createCleanCoarseReturn(scope: Scope, node: CallExpression, fclos: JavaRuntimeValue, argvalues: Value[]): Value { + const upperQid = typeof scope?.qid === 'string' ? scope.qid : '' + const result = new CallExprValue(upperQid, fclos, argvalues, node, node?.loc, fclos) as Value & { rtype?: JavaRuntimeType } + result.rtype = fclos?.rtype + return result + } + /** * */ @@ -4673,7 +4858,8 @@ class JavaAnalyzer extends Analyzer { * @param fromCallGraph */ checkFclosCanPruneDuringInterpret(fclos: any, node: any, argvalues: any, state: any, fromCallGraph: boolean) { - if (this.pruneInfoMap.aggressiveMode && state?.callstack?.length >= Config.maxCallstackDepth) { + const callDepth = state?.callstack?.length + if (this.pruneInfoMap.aggressiveMode && callDepth >= Config.maxCallstackDepth) { return true } @@ -4692,6 +4878,15 @@ class JavaAnalyzer extends Analyzer { } } + if ( + this.lifecycleCallDepthPruneEnabled && + typeof callDepth === 'number' && + callDepth >= Config.maxCallstackDepth + ) { + this.recordLifecycleCallDepthPrune(fclos, node, callDepth) + return true + } + if ( !this.enablePruneDuringInterpret || !fclos || @@ -6387,6 +6582,105 @@ class JavaAnalyzer extends Analyzer { ) } + /** + * AbstractOptUtil.execute callback->Processor 分派： + * 当 xxxOptUtil.execute(optRequest, ..., callback) 的 callee 是继承 AbstractOptUtil 的方法、 + * 且 jar 源码不可见导致 fclos 无可执行 body 时，按 optRequest 的 definiteType 匹配 + * implements Processable 的 Processor 类，将 optRequest 的 taint + * 传播到 Processor.process(request) 的第一个参数。 + * + * 匹配策略： + * 1. 调用方法名为 execute，receiver 类型链中包含 AbstractOptUtil + * 2. 取第一个参数 optRequest 的 rtype.definiteType + * 3. 遍历 classMap 查找含 process 方法的类，比对 process 第一个参数 varType 与 optRequest 类型 + * 4. 匹配则 executeCall 流入 Processor.process，将 optRequest 作为实参传播 taint + * @param fclos + * @param node + * @param argvalues + * @param state + * @param scope + */ + private dispatchOptUtilExecuteToProcessors( + fclos: Value, + node: CallExpression, + argvalues: unknown[], + state: State, + scope: Scope + ): boolean { + if (!fclos || typeof fclos !== 'object') return false + if (node.callee?.type !== 'MemberAccess') return false + + const methodName = node.callee.property?.name + if (methodName !== 'execute') return false + + /* receiver 类型链中必须包含 AbstractOptUtil（eduplatform 框架基类） */ + const receiverType = this.getDefiniteTypeText(fclos) + const isOptUtil = + !receiverType || !this.isSameOrSubtype(receiverType, 'com.alipay.eduplatform.service.opt.AbstractOptUtil') + if (isOptUtil) return false + + /* 第一个参数是 optRequest，需要 definiteType 来匹配 Processor */ + if (!Array.isArray(argvalues) || argvalues.length < 1) return false + const optRequestArg = argvalues[0] + const optRequestType = this.getDefiniteTypeText(optRequestArg) + if (!optRequestType) return false + + const erasedRequestType = this.eraseGenericType(optRequestType) + if (!erasedRequestType) return false + + /* 按类型匹配所有 Processor：遍历 classMap 找 process 方法参数类型匹配的类 */ + const processedQids = new Set() + let dispatched = false + + for (const [classFqn, classUuid] of this.classMap.entries()) { + if (processedQids.has(classFqn)) continue + const classScope = this.symbolTable.get(classUuid) + if (!classScope || typeof classScope !== 'object') continue + + const processorMethod = (classScope as { members?: Map }).members?.get('process') + if (!processorMethod || !this.isExecutableConcreteMethod(processorMethod)) continue + + /* 检查 process 方法第一个参数的 varType 是否匹配 optRequest 类型 */ + const fdef = processorMethod.ast?.fdef as unknown as + { parameters?: Array<{ varType?: { id?: unknown } }> } | undefined + const firstParam = + Array.isArray(fdef?.parameters) && fdef!.parameters.length > 0 ? fdef!.parameters[0] : undefined + if (!firstParam?.varType?.id) continue + + const paramTypeName = AstUtil.prettyPrint(firstParam.varType.id) + const normalizedParamType = this.eraseGenericType(this.normalizeQid(paramTypeName)) + if (!normalizedParamType) continue + /* 短类名或 FQN 匹配：参数声明可能只有短类名，需与 FQN 的尾段对比 */ + const matched = + normalizedParamType === erasedRequestType || + (!this.hasPackageQualifier(normalizedParamType) && + this.getShortTypeName(erasedRequestType!) === normalizedParamType) || + (!this.hasPackageQualifier(erasedRequestType!) && + this.getShortTypeName(normalizedParamType) === erasedRequestType) + if (!matched) continue + + /* 匹配成功：流入 Processor.process，将 optRequest 传播到 process(request) 的形参 */ + processedQids.add(classFqn) + const oldThis = processorMethod._this + processorMethod._this = classScope + try { + const processorArgs = [optRequestArg] + const callRes = this.executeCall(node, processorMethod, state, scope, { + callArgs: this.buildCallArgs(node, processorArgs, processorMethod), + callsiteNode: node, + }) + if (callRes) dispatched = true + } finally { + processorMethod._this = oldThis + } + } + + if (dispatched) { + logger.debug(`[OptUtil] execute->Processor dispatch matched for ${erasedRequestType}`) + } + return dispatched + } + /** * * @param className @@ -6830,6 +7124,7 @@ const javaAnalyzerTestHooks = { findJavaInputArgumentDonor, javaReturnExpressionReferencesParameter, javaReturnExpressionReferencesExternalQueryResult, + } ;( JavaAnalyzer as typeof JavaAnalyzer & { __javaAnalyzerTestHooks: typeof javaAnalyzerTestHooks } diff --git a/src/engine/analyzer/java/spring/spring-analyzer.ts b/src/engine/analyzer/java/spring/spring-analyzer.ts index 809bf0d8..501a9bac 100644 --- a/src/engine/analyzer/java/spring/spring-analyzer.ts +++ b/src/engine/analyzer/java/spring/spring-analyzer.ts @@ -48,6 +48,7 @@ const { getLegacyArgValues } = require('../../common/call-args') const { yasaLog } = require('../../../../util/format-util') const { createDeadlinePlan, createTimeoutLatch, formatBudgetMs } = require('../../common/entrypoint/deadline-scheduler') as typeof import('../../common/entrypoint/deadline-scheduler') const { runAllocatedAttempt } = require('../../common/entrypoint/attempt-runner') as typeof import('../../common/entrypoint/attempt-runner') +const { javaEntrypointFindingCollectors, getJavaLogicalEntrypointKey } = require('../../../../checker/taint/java/java-entrypoint-finding-collector') as typeof import('../../../../checker/taint/java/java-entrypoint-finding-collector') const { buildSpringConcreteWorklist, runSpringConcreteWorklist } = require('./spring-entrypoint-scheduler') as typeof import('./spring-entrypoint-scheduler') @@ -357,6 +358,8 @@ class SpringAnalyzer extends JavaAnalyzer { * */ override async symbolInterpret(): Promise { + this.configureJavaCandidatePromoter() + javaEntrypointFindingCollectors.beginRun() const entryPoints = (this as { entryPoints?: SpringEntryPointLike[] }).entryPoints ?? [] const state = this.initState(this.topScope) as State & { entryPointStartTimestamp?: number | null @@ -474,6 +477,14 @@ class SpringAnalyzer extends JavaAnalyzer { }) let overloadCount = 0 const attemptArgs = new Map() + type InitialAttemptLifecycle = { total: number; completed: number; timedOut: number; failed: boolean } + const initialAttemptLifecycle = new Map() + for (const item of concreteWorklist) { + const key = getJavaLogicalEntrypointKey(item.entryPoint) + const lifecycle = initialAttemptLifecycle.get(key) ?? { total: 0, completed: 0, timedOut: 0, failed: false } + lifecycle.total++ + initialAttemptLifecycle.set(key, lifecycle) + } runSpringConcreteWorklist({ plan: deadlinePlan, worklist: concreteWorklist, @@ -509,10 +520,15 @@ class SpringAnalyzer extends JavaAnalyzer { }, execute: (item, argValues, progress) => { const entryPoint = item.entryPoint + const logicalEntrypointKey = getJavaLogicalEntrypointKey(entryPoint) + const findingCollector = javaEntrypointFindingCollectors.get(logicalEntrypointKey) + const lifecycle = initialAttemptLifecycle.get(logicalEntrypointKey) + if (!lifecycle) return const symVal = entryPoint.entryPointSymVal const metricStartTime = Date.now() const findingsBefore = this.countFindings() let beforeCalled = false + let attemptFailed = false executeViaEntryPointExecutor({ analyzer: this, entryPoint, metricStartTime, findingsBefore, executionState: state, overloadCount, epIndex: progress.epIndex, epTotal: concreteWorklist.length }, { language: 'spring', classify: () => 'function', execute: () => { this.checkerManager.checkAtSymbolInterpretOfEntryPointBefore(this, null, null, null, null) @@ -526,6 +542,7 @@ class SpringAnalyzer extends JavaAnalyzer { try { this.executeCall(item.overload, symVal, state, entryPoint.scopeVal, { callArgs: this.buildCallArgs(item.overload, argValues, symVal) }) } catch (e) { + attemptFailed = true const fdefIdName = item.overload.id?.name handleException(e, `[${fdefIdName} symbolInterpret failed. Exception message saved in error log file`, `[${fdefIdName} symbolInterpret failed. Exception message saved in error log file`) if (this.globalState.meetOtherEntryPoint) delete this.globalState.meetOtherEntryPoint @@ -536,6 +553,9 @@ class SpringAnalyzer extends JavaAnalyzer { if (beforeCalled) this.checkerManager.checkAtSymbolInterpretOfEntryPointAfter(this, null, null, null, null) } }, }, this.checkerManager?.resultManagerProxy) + lifecycle.completed++ + if (attemptFailed) lifecycle.failed = true + else if (lifecycle.timedOut === 0) findingCollector.deferForRerun() }, enqueueTimeout: (item, argValues) => { logger.info( @@ -547,8 +567,16 @@ class SpringAnalyzer extends JavaAnalyzer { `` ) this.timeoutEntryPoints.push({ entryPoint: item.entryPoint, overloadFuncDef: item.overload, argValues }) + const lifecycle = initialAttemptLifecycle.get(getJavaLogicalEntrypointKey(item.entryPoint)) + if (lifecycle) lifecycle.timedOut++ }, }) + // 首轮 timeout 仅延迟到 rerun 组末 terminal，保留 collector 候补状态。 + for (const [logicalEntrypointKey, lifecycle] of initialAttemptLifecycle) { + if (lifecycle.failed) javaEntrypointFindingCollectors.finalize(logicalEntrypointKey, 'exception') + else if (lifecycle.timedOut > 0) javaEntrypointFindingCollectors.get(logicalEntrypointKey).deferForRerun() + else if (lifecycle.completed === lifecycle.total) javaEntrypointFindingCollectors.complete(logicalEntrypointKey) + } // 基于全局时间预算的超时入口点重跑 if (this.timeoutEntryPoints.length > 0) { if (deadlinePlan.canStartAnalysis()) { @@ -566,6 +594,8 @@ class SpringAnalyzer extends JavaAnalyzer { this.pruneInfoMap.aggressiveMode = true try { let rerunIdx = 0 + const rerunSuccessByKey = new Set() + const rerunFailureByKey = new Set() for (const timeoutEntryPoint of this.timeoutEntryPoints) { rerunIdx++ const metricStartTime = Date.now() @@ -573,6 +603,10 @@ class SpringAnalyzer extends JavaAnalyzer { let skipped = false let skipReason: string | undefined let overloadCount = 0 + const logicalEntrypointKey = getJavaLogicalEntrypointKey(timeoutEntryPoint.entryPoint) + let attemptFailed = false + const findingCollector = javaEntrypointFindingCollectors.get(logicalEntrypointKey) + let rerunCompleted = false attemptSnapshot = { entryPointDeadline: state.entryPointDeadline, entryPointClock: state.entryPointClock, @@ -586,6 +620,15 @@ class SpringAnalyzer extends JavaAnalyzer { if (!attemptBudget) { skipped = true skipReason = 'analysis-deadline' + rerunFailureByKey.add(logicalEntrypointKey) + const hasMoreRerunsForKey = this.timeoutEntryPoints.slice(rerunIdx).some((queued: { entryPoint: SpringEntryPointLike }) => + getJavaLogicalEntrypointKey(queued.entryPoint) === logicalEntrypointKey + ) + if (!hasMoreRerunsForKey) { + if (rerunSuccessByKey.has(logicalEntrypointKey)) findingCollector.complete() + else javaEntrypointFindingCollectors.finalize(logicalEntrypointKey, 'skip') + rerunCompleted = true + } else rerunCompleted = true logger.info('Skip remaining timeout entrypoints: scan analysis deadline reached') continue } @@ -639,6 +682,7 @@ class SpringAnalyzer extends JavaAnalyzer { } ) } catch (e) { + attemptFailed = true handleException( e, `[${timeoutEntryPoint.overloadFuncDef?.id?.name} symbolInterpret failed. Exception message saved in error log file`, @@ -675,7 +719,21 @@ class SpringAnalyzer extends JavaAnalyzer { }, this.checkerManager?.resultManagerProxy ) + const hasMoreRerunsForKey = this.timeoutEntryPoints.slice(rerunIdx).some((queued: { entryPoint: SpringEntryPointLike }) => + getJavaLogicalEntrypointKey(queued.entryPoint) === logicalEntrypointKey + ) + if (skipped || attemptFailed) rerunFailureByKey.add(logicalEntrypointKey) + else rerunSuccessByKey.add(logicalEntrypointKey) + if (!hasMoreRerunsForKey) { + if (rerunSuccessByKey.has(logicalEntrypointKey) && !rerunFailureByKey.has(logicalEntrypointKey)) { + findingCollector.complete() + } else { + javaEntrypointFindingCollectors.finalize(logicalEntrypointKey, skipped ? 'timeout' : 'exception') + } + rerunCompleted = true + } else rerunCompleted = true } finally { + if (!rerunCompleted && !skipped && !attemptFailed) javaEntrypointFindingCollectors.finalize(logicalEntrypointKey, 'exception') clearAttemptState() this.recordEntryPointLoopMetric( timeoutEntryPoint.entryPoint, @@ -702,9 +760,11 @@ class SpringAnalyzer extends JavaAnalyzer { // 清空，避免重复重跑 this.timeoutEntryPoints = [] } + javaEntrypointFindingCollectors.clear() this.clearFanoutContinuationState() return true } catch (schedulingError) { + javaEntrypointFindingCollectors.clear() let persistenceError: unknown await persistMandatoryCheckpoint() const combined = combineFindingsFinalizationErrors( @@ -715,6 +775,7 @@ class SpringAnalyzer extends JavaAnalyzer { Object.assign(finalizationError, { schedulingError, persistenceError, combined }) throw finalizationError } finally { + javaEntrypointFindingCollectors.clear() clearAttemptState() this.pruneInfoMap.aggressiveMode = oldAggressiveMode Config.entryPointTimeoutMs = oldEntryPointTimeoutMs @@ -888,9 +949,19 @@ class SpringAnalyzer extends JavaAnalyzer { if (isBeanService && beanName && beanName !== '') { let returnType = '' if (node.returnType?.id?.type === 'Identifier') { - const returnClass = node.returnType?.id - const returnTypeIdentifier = this.processIdentifier(scope, returnClass, state) - returnType = returnTypeIdentifier.qid + /* @Bean 方法返回类型解析：当方法名与返回类型同名时， + * processIdentifier 会在方法所在类的 scope 中找到同名方法符号而非 import 的类， + * 导致 beanMap 注册了错误的 className。 + * 此处优先从文件级 import 表查找返回类型的全限定名，回退到 processIdentifier。 */ + const returnTypeName = node.returnType.id.name + const resolvedFqn = this.resolveBeanReturnTypeByImport(scope, returnTypeName) + if (resolvedFqn) { + returnType = resolvedFqn + } else { + const returnClass = node.returnType?.id + const returnTypeIdentifier = this.processIdentifier(scope, returnClass, state) + returnType = returnTypeIdentifier?.qid ?? '' + } } this.topScope.spring.beanMap.set(beanName, { initFClos: res, @@ -901,6 +972,60 @@ class SpringAnalyzer extends JavaAnalyzer { return res } + /** + * 从文件级 import 表解析 @Bean 方法返回类型的全限定名。 + * 当方法名与返回类型同名时，processIdentifier 会被同名方法符号遮蔽， + * 此方法绕过 scope 链，直接查 import 语句获得正确的 fqdn。 + * 不依赖 classMap 校验——processFunctionDefinition 在 scanPackages 阶段运行， + * 此时 classMap 尚未组装完成。 + * @param scope - 当前作用域 + * @param shortName - 返回类型短名 + * @returns 全限定名，未找到返回 undefined + */ + private resolveBeanReturnTypeByImport(scope: Scope, shortName: string): string | undefined { + if (!shortName) return undefined + /* 沿 scope 链找到包含 import 语句的 fileScope AST body， + * 使用 fileScope?.ast?.node?.body 而非 cur?.ast?.node?.body 避免取到 class body */ + let cur: any = scope + let guard = 32 + while (cur && guard-- > 0) { + const astBody = cur.fileScope?.ast?.node?.body ?? cur.scope?.fileScope?.ast?.node?.body + if (Array.isArray(astBody)) { + for (const statement of astBody) { + const importedFqn = this.extractImportedClassFqn(statement, shortName) + if (importedFqn) { + return importedFqn + } + } + } + cur = cur.parent + } + return undefined + } + + /** + * 从单条 import 语句中提取与 name 匹配的类全限定名。 + * 复刻 JavaAnalyzer.getImportedClassName 逻辑，避免访问 private 方法。 + * @param statement - AST 语句节点 + * @param name - 类型短名 + * @returns 全限定名，不匹配返回 undefined + */ + private extractImportedClassFqn(statement: unknown, name: string): string | undefined { + const node = statement as { + type?: string + id?: { name?: string } + varType?: { id?: { name?: string } } + init?: { type?: string; from?: { value?: unknown }; imported?: { name?: string } } + } + if (node.type !== 'VariableDeclaration' || node.init?.type !== 'ImportExpression') return undefined + if (node.id?.name !== name && node.init.imported?.name !== name) return undefined + const importType = node.varType?.id?.name + const importFrom = typeof node.init.from?.value === 'string' ? node.init.from.value : undefined + const candidate = + importType && importType.includes('.') ? importType : importFrom ? `${importFrom}.${name}` : undefined + return candidate ? QidUnifyUtil.qidUnifyByRemoveAngleAndPrefix(candidate) : undefined + } + /** * * @param scope @@ -1398,13 +1523,15 @@ class SpringAnalyzer extends JavaAnalyzer { ;(this as any)._lifecycleDepth = lifecycleDepth + 1 try { const lifecycleState = this.initState(objVal) - this.executeCall( - val.ast?.node, - val as unknown as SymbolValueType, - lifecycleState, - objVal, - INTERNAL_CALL - ) + this.withLifecycleCallDepthPrune(() => { + this.executeCall( + val.ast?.node, + val as unknown as SymbolValueType, + lifecycleState, + objVal, + INTERNAL_CALL + ) + }) } finally { ;(this as any)._lifecycleDepth = lifecycleDepth } diff --git a/src/engine/analyzer/javascript/common/js-analyzer.ts b/src/engine/analyzer/javascript/common/js-analyzer.ts index 321aad63..0c902185 100644 --- a/src/engine/analyzer/javascript/common/js-analyzer.ts +++ b/src/engine/analyzer/javascript/common/js-analyzer.ts @@ -1,4 +1,5 @@ import { INTERNAL_CALL } from '../../common/call-args' +import { describeEntryPointForLog } from '../../../../util/entrypoint-metrics' const path = require('path') const fs = require('fs-extra') const globby = require('fast-glob') @@ -145,8 +146,12 @@ class JsAnalyzer extends Analyzer { const findingsBefore = this.countFindings() let skipped = false let skipReason: string | undefined + // 单入口内存护栏 reset：每入口开始前记录基线 heap，清 exceeded + const epLabel = describeEntryPointForLog(entryPoint).replace(/^\[|\]$/g, '') + let memoryAborted = false try { this.symbolTable.clear() + this.resetMemoryGuardForEntryPoint(epLabel) if (entryPoint.type === constValue.ENGIN_START_FUNCALL) { const entryPointMark = this.markEntryPointForAnalysis(entryPoint, hasAnalysised) if (entryPointMark.skipped) { @@ -271,7 +276,21 @@ class JsAnalyzer extends Analyzer { skipReason = 'unsupported' } } finally { + // 单入口内存护栏 finalize：若本入口 exceeded，flush 已分析 finding 并记 diagnostics + const guardResult = this.onEntryPointMemoryGuardFinalize(entryPoint, findingsBefore) + if (guardResult.aborted) { + memoryAborted = true + if (!skipped) { + skipped = true + skipReason = `memory-guard-heap-exceeded:peak=${guardResult.peakHeapMb.toFixed(1)}MB,delta=${guardResult.deltaHeapMb.toFixed(1)}MB` + } + } this.recordEntryPointLoopMetric(entryPoint, metricStartTime, findingsBefore, skipped, skipReason, 1) + if (memoryAborted) { + logger.warn( + `[memory-guard] entrypoint ${epIdx}/${entryPoints.length} skipped due to memory guard: ${epLabel}` + ) + } } } return true diff --git a/src/engine/analyzer/javascript/egg/egg-analyzer.ts b/src/engine/analyzer/javascript/egg/egg-analyzer.ts index 32d91230..09bddab2 100644 --- a/src/engine/analyzer/javascript/egg/egg-analyzer.ts +++ b/src/engine/analyzer/javascript/egg/egg-analyzer.ts @@ -1,4 +1,5 @@ import { buildNewCopiedWithTag } from '../../../../util/clone-util' +import { describeEntryPointForLog } from '../../../../util/entrypoint-metrics' const path = require('path') const fs = require('fs-extra') @@ -105,9 +106,13 @@ class EggAnalyzer extends JsAnalyzer { const findingsBefore = this.countFindings() let skipped = false let skipReason: string | undefined + // 单入口内存护栏 reset：每入口开始前记录基线 heap，清 exceeded + const epLabel = describeEntryPointForLog(entryPoint).replace(/^\[|\]$/g, '') + let memoryAborted = false try { if (entryPoint.type === constValue.ENGIN_START_FUNCALL) { this.symbolTable.clear() + this.resetMemoryGuardForEntryPoint(epLabel) const entryPointMark = this.markEntryPointForAnalysis(entryPoint, hasAnalysised) if (entryPointMark.skipped) { skipped = true @@ -217,7 +222,21 @@ class EggAnalyzer extends JsAnalyzer { skipReason = 'unsupported' } } finally { + // 单入口内存护栏 finalize：若本入口 exceeded，flush 已分析 finding 并记 diagnostics + const guardResult = this.onEntryPointMemoryGuardFinalize(entryPoint, findingsBefore) + if (guardResult.aborted) { + memoryAborted = true + if (!skipped) { + skipped = true + skipReason = `memory-guard-heap-exceeded:peak=${guardResult.peakHeapMb.toFixed(1)}MB,delta=${guardResult.deltaHeapMb.toFixed(1)}MB` + } + } this.recordEntryPointLoopMetric(entryPoint, metricStartTime, findingsBefore, skipped, skipReason, 1) + if (memoryAborted) { + logger.warn( + `[memory-guard] entrypoint ${epIdx}/${this.entryPoints.length} skipped due to memory guard: ${epLabel}` + ) + } } } } catch (e) { diff --git a/src/engine/analyzer/php/common/php-analyzer.ts b/src/engine/analyzer/php/common/php-analyzer.ts index abcf48da..6fd77cc1 100644 --- a/src/engine/analyzer/php/common/php-analyzer.ts +++ b/src/engine/analyzer/php/common/php-analyzer.ts @@ -1,4 +1,5 @@ /* eslint-disable @typescript-eslint/no-require-imports */ +import { describeEntryPointForLog } from '../../../../util/entrypoint-metrics' const path = require('path') const fs = require('fs-extra') const Analyzer: typeof import('../../common/analyzer').Analyzer = require('../../common/analyzer') @@ -282,8 +283,12 @@ class PhpAnalyzer extends Analyzer { const findingsBefore = this.countFindings() let skipped = false let skipReason: string | undefined + // 单入口内存护栏 reset：每入口开始前记录基线 heap，清 exceeded + const epLabel = describeEntryPointForLog(entryPoint).replace(/^\[|\]$/g, '') + let memoryAborted = false try { this.symbolTable.clear() + this.resetMemoryGuardForEntryPoint(epLabel) if (entryPoint.type === constValue.ENGIN_START_FUNCALL) { const entryPointMark = this.markEntryPointForAnalysis(entryPoint, hasAnalysised) if (entryPointMark.skipped) { @@ -403,7 +408,21 @@ class PhpAnalyzer extends Analyzer { skipReason = 'unsupported' } } finally { + // 单入口内存护栏 finalize：若本入口 exceeded，flush 已分析 finding 并记 diagnostics + const guardResult = this.onEntryPointMemoryGuardFinalize(entryPoint, findingsBefore) + if (guardResult.aborted) { + memoryAborted = true + if (!skipped) { + skipped = true + skipReason = `memory-guard-heap-exceeded:peak=${guardResult.peakHeapMb.toFixed(1)}MB,delta=${guardResult.deltaHeapMb.toFixed(1)}MB` + } + } this.recordEntryPointLoopMetric(entryPoint, metricStartTime, findingsBefore, skipped, skipReason, 1) + if (memoryAborted) { + logger.warn( + `[memory-guard] entrypoint ${epIdx}/${entryPoints.length} skipped due to memory guard: ${epLabel}` + ) + } } } return true diff --git a/src/engine/analyzer/python/common/callgraph/first-arg-callee-resolver.ts b/src/engine/analyzer/python/common/callgraph/first-arg-callee-resolver.ts new file mode 100644 index 00000000..89d104e6 --- /dev/null +++ b/src/engine/analyzer/python/common/callgraph/first-arg-callee-resolver.ts @@ -0,0 +1,154 @@ +/** + * 通用 first-arg-is-callee callgraph 解析 + * + * 识别已知调度函数（asyncio.to_thread / loop.run_in_executor / functools.partial）， + * 把 first-arg（或 second-arg for run_in_executor）解析为被调函数，建立 callgraph 边， + * 把剩余 args 作为被调函数的入参 taint 传播。 + * + * 解决 asyncio.to_thread(_http_get, *args) 跨线程调用不被识别的 taint 断点。 + */ +import type { CallExpression } from '../../../../../types/uast' +import type { CallInfo } from '../../../common/call-args' + +// eslint-disable-next-line @typescript-eslint/no-var-requires +const config = require('../../../../../config') + +interface FirstArgCalleeMatch { + calleeArgIndex: number +} + +// 已知调度函数名列表（完整 object.property 或通配 *.property） +// - asyncio.to_thread: first-arg 是被调函数 +// - functools.partial: first-arg 是被调函数 +// - *.run_in_executor: second-arg 是被调函数（first-arg 是 executor） +const DEFAULT_FIRST_ARG_CALLEE_PATTERNS: Array<{ qualifier: string | null; method: string; argIndex: number }> = [ + { qualifier: 'asyncio', method: 'to_thread', argIndex: 0 }, + { qualifier: 'functools', method: 'partial', argIndex: 0 }, + { qualifier: null, method: 'run_in_executor', argIndex: 1 }, +] + +interface ResolverConfig { + patterns: Array<{ qualifier: string | null; method: string; argIndex: number }> + enabled: boolean +} + +function loadResolverConfig(): ResolverConfig { + const enabled = config.pythonFirstArgCalleeResolverEnabled !== false + const configured = config.pythonFirstArgCalleePatterns + if (Array.isArray(configured) && configured.length > 0) { + const patterns = configured.map((entry: any) => ({ + qualifier: entry.qualifier ?? null, + method: String(entry.method), + argIndex: Number(entry.argIndex) || 0, + })) + return { patterns, enabled } + } + return { patterns: DEFAULT_FIRST_ARG_CALLEE_PATTERNS, enabled } +} + +/** + * 从 callee AST 节点提取 (qualifier, method) + * - MemberAccess(object=Identifier(asyncio), property=Identifier(to_thread)) → ('asyncio', 'to_thread') + * - Identifier(to_thread) → (null, 'to_thread') + */ +function extractCalleeQualifierMethod(callee: any): { qualifier: string | null; method: string | null } { + if (!callee) return { qualifier: null, method: null } + if (callee.type === 'MemberAccess') { + const objectName = callee.object?.type === 'Identifier' ? callee.object.name : null + const propertyName = callee.property?.type === 'Identifier' ? callee.property.name : null + return { qualifier: objectName, method: propertyName } + } + if (callee.type === 'Identifier') { + return { qualifier: null, method: callee.name } + } + return { qualifier: null, method: null } +} + +/** + * 匹配调度函数模式 + */ +function matchFirstArgCalleePattern( + callee: any, + patterns: Array<{ qualifier: string | null; method: string; argIndex: number }> +): FirstArgCalleeMatch | null { + const { qualifier, method } = extractCalleeQualifierMethod(callee) + if (!method) return null + for (const pattern of patterns) { + if (pattern.method !== method) continue + // qualifier 为 null 表示通配（如 *.run_in_executor） + if (pattern.qualifier === null) return { calleeArgIndex: pattern.argIndex } + if (pattern.qualifier === qualifier) return { calleeArgIndex: pattern.argIndex } + } + return null +} + +/** + * 构建 first-arg-callee 调用的 callInfo + * + * 把原调用的 args（除 callee arg 外）作为被调函数的参数。 + * 保留原 callInfo 的 spread/kwspread kind，使 bindCallArgs 能正确解包 *args / **kwargs。 + */ +function buildCalleeCallInfo( + originalCallInfo: CallInfo, + argvalues: any[], + calleeArgIndex: number, + node: CallExpression +): CallInfo { + const originalArgs = originalCallInfo?.callArgs?.args || [] + // 过滤掉 callee arg，保留其余 args + const remainingArgs = originalArgs + .filter((arg: any) => arg && arg.index !== calleeArgIndex) + .map((arg: any, idx: number) => ({ + ...arg, + index: idx, + })) + const remainingArgvalues = argvalues + .slice(0, calleeArgIndex) + .concat(argvalues.slice(calleeArgIndex + 1)) + return { + callArgs: { + args: remainingArgs, + receiver: originalCallInfo?.callArgs?.receiver, + node, + }, + callsiteNode: node, + boundCall: undefined, + } +} + +/** + * 尝试解析 first-arg-is-callee 调用，如果匹配则触发对被调函数的 executeCall + * + * @returns true 如果已处理（caller 是已知调度函数且 first-arg 是 fclos）；false 否则 + */ +export function tryExecuteFirstArgCallee( + analyzer: any, + scope: any, + node: CallExpression, + state: any, + fclos: any, + argvalues: any[], + callInfo: CallInfo +): boolean { + const { patterns, enabled } = loadResolverConfig() + if (!enabled) return false + + const match = matchFirstArgCalleePattern(node?.callee, patterns) + if (!match) return false + + const calleeArg = argvalues[match.calleeArgIndex] + if (!calleeArg || calleeArg.vtype !== 'fclos') return false + + // 被调函数有 fdef（FunctionDefinition）才触发，避免对任意可调用对象误识别 + if (!calleeArg.ast?.fdef && !calleeArg.fdef) return false + + const calleeFclos = calleeArg + const calleeCallInfo = buildCalleeCallInfo(callInfo, argvalues, match.calleeArgIndex, node) + + try { + analyzer.executeCall(node, calleeFclos, state, scope, calleeCallInfo) + } catch { + // 调用失败不阻塞分析 + } + return true +} diff --git a/src/engine/analyzer/python/common/entrypoint-collector/function-tool-entrypoint.ts b/src/engine/analyzer/python/common/entrypoint-collector/function-tool-entrypoint.ts new file mode 100644 index 00000000..5b0ab361 --- /dev/null +++ b/src/engine/analyzer/python/common/entrypoint-collector/function-tool-entrypoint.ts @@ -0,0 +1,169 @@ +import { extractRelativePath } from '../../../../../util/file-util' +import * as Constant from '../../../../../util/constant' +import type { EntryPoint } from '../../../common/entrypoint/entrypoint' + +// eslint-disable-next-line @typescript-eslint/no-var-requires +const config = require('../../../../../config') +// eslint-disable-next-line @typescript-eslint/no-var-requires +const PythonEntrypointSource = require('./python-entrypoint-source') +// eslint-disable-next-line @typescript-eslint/no-var-requires +const EntryPointClass = require('../../../common/entrypoint/entrypoint') + +const { entryPointAndSourceAtSameTime } = config +const { findSourceOfFuncParam } = PythonEntrypointSource + +interface ASTObject { + body?: any[] + [key: string]: any +} + +interface FilenameAstMap { + [filename: string]: ASTObject +} + +interface FunctionToolEntryPointResult { + functionToolEntryPointArray: EntryPoint[] + functionToolEntryPointSourceArray: any[] +} + +// 通用装饰器入口点识别的默认装饰器名列表 +// 覆盖 OpenAI Agents SDK / LangChain / MCP / Flask 等主流框架 +const DEFAULT_FUNCTION_TOOL_DECORATORS = ['function_tool', 'tool', 'mcp.tool', 'app.tool'] + +/** + * 从配置读取装饰器名列表，未配置时用默认列表 + */ +function getFunctionToolDecoratorNames(): string[] { + const configured = config.pythonFunctionToolDecorators + if (Array.isArray(configured) && configured.length > 0) { + return configured + } + return DEFAULT_FUNCTION_TOOL_DECORATORS +} + +/** + * 从配置读取 collector 注册开关，默认 true + */ +function isFunctionToolCollectorEnabled(): boolean { + const enabled = config.pythonFunctionToolCollectorEnabled + return enabled !== false +} + +/** + * 提取装饰器的规范名 + * - Identifier: 返回 name + * - MemberAccess: 返回 objectName.propertyName（如 mcp.tool） + * - CallExpression: 取 callee 递归解析 + */ +function resolveDecoratorName(deco: any): string | null { + if (!deco) return null + if (deco.type === 'Identifier' && typeof deco.name === 'string') { + return deco.name + } + if (deco.type === 'MemberAccess') { + const objectName = deco.object?.type === 'Identifier' ? deco.object.name : null + const propertyName = deco.property?.type === 'Identifier' ? deco.property.name : null + if (objectName && propertyName) { + return `${objectName}.${propertyName}` + } + return propertyName + } + if (deco.type === 'CallExpression') { + return resolveDecoratorName(deco.callee) + } + return null +} + +/** + * 解析 @function_tool(name_override="...") 装饰器的 name_override 参数 + * 用于把 entrypoint 的 functionName 设为 name_override 指定的值 + */ +function extractNameOverride(deco: any): string | null { + if (!deco || deco.type !== 'CallExpression' || !Array.isArray(deco.arguments)) { + return null + } + for (const arg of deco.arguments) { + if (!arg || arg.type !== 'VariableDeclaration' || arg.id?.type !== 'Identifier') continue + if (arg.id.name === 'name_override' && arg.init?.type === 'Literal' && typeof arg.init.value === 'string') { + return arg.init.value + } + } + return null +} + +/** + * 通用装饰器入口点 collector + * + * 识别 @function_tool / @tool / @mcp.tool / @app.tool 装饰器为入口点， + * 把被装饰函数加入 entrypoint 列表，参数标为 TaintSource。 + * + * 装饰器名列表可配置（config.pythonFunctionToolDecorators），默认覆盖主流 agent tool 框架。 + * collector 注册开关：config.pythonFunctionToolCollectorEnabled（默认 true）。 + */ +function findFunctionToolEntryPointAndSource( + filenameAstObj: FilenameAstMap, + dir: string +): FunctionToolEntryPointResult { + const functionToolEntryPointArray: EntryPoint[] = [] + const functionToolEntryPointSourceArray: any[] = [] + + if (!isFunctionToolCollectorEnabled()) { + return { functionToolEntryPointArray, functionToolEntryPointSourceArray } + } + + const decoratorNames = new Set(getFunctionToolDecoratorNames()) + + for (const filename in filenameAstObj) { + if (!Object.prototype.hasOwnProperty.call(filenameAstObj, filename)) continue + const fileObj = filenameAstObj[filename] + if (!fileObj?.body) continue + + const { body } = fileObj + const relativeFile = filename.startsWith(dir) ? extractRelativePath(filename, dir) : filename + if (!relativeFile) continue + + for (const obj of body) { + if (!obj || typeof obj !== 'object') continue + if (obj.type !== 'FunctionDefinition' || !obj._meta?.decorators || !obj.id?.name) continue + + const funcName = obj.id.name + const { decorators } = obj._meta + + let matched = false + let nameOverride: string | null = null + for (const deco of decorators) { + const decoName = resolveDecoratorName(deco) + if (!decoName) continue + if (!decoratorNames.has(decoName)) continue + matched = true + nameOverride = extractNameOverride(deco) + break + } + if (!matched) continue + + const entryPoint = new EntryPointClass(Constant.ENGIN_START_FUNCALL) as EntryPoint + entryPoint.filePath = relativeFile + // entrypoint 匹配依赖 AST 函数名（fclos 索引按 node.id.name 构建） + // name_override 是 OpenAI Agents SDK 对 LLM 暴露的工具名，不改变 Python 函数名 + entryPoint.functionName = funcName + entryPoint.attribute = 'FunctionTool' + entryPoint.funcLocStart = obj.loc?.start?.line as number | undefined + entryPoint.funcLocEnd = obj.loc?.end?.line as number | undefined + + functionToolEntryPointArray.push(entryPoint) + + if (entryPointAndSourceAtSameTime) { + // 被装饰函数的所有参数标为 TaintSource + // name_override 存在时 scopeFunc 仍用真实函数名（与 AST 定义对应） + const paramSources = findSourceOfFuncParam(filename, funcName, obj, undefined) + if (paramSources) { + functionToolEntryPointSourceArray.push(...paramSources) + } + } + } + } + + return { functionToolEntryPointArray, functionToolEntryPointSourceArray } +} + +export = { findFunctionToolEntryPointAndSource } diff --git a/src/engine/analyzer/python/common/entrypoint-collector/python-entrypoint.ts b/src/engine/analyzer/python/common/entrypoint-collector/python-entrypoint.ts index 2026aa02..3ef9d247 100644 --- a/src/engine/analyzer/python/common/entrypoint-collector/python-entrypoint.ts +++ b/src/engine/analyzer/python/common/entrypoint-collector/python-entrypoint.ts @@ -9,6 +9,7 @@ const { findHttpServerEntryPointAndSource } = require('../../httpserver/entrypoi const { findTornadoEntryPointAndSource } = require('../../tornado/entrypoint-collector/tornado-entrypoint') const { findGradioEntryPointAndSource } = require('../../gradio/entrypoint-collector/gradio-default-entrypoint') const { findAgentUniverseEntryPointAndSource } = require('../../agentuniverse/entrypoint-collector/agentuniverse-entrypoint') +const { findFunctionToolEntryPointAndSource } = require('./function-tool-entrypoint') const BasicRuleHandler = require('../../../../../checker/common/rules-basic-handler') const { loadPythonDefaultRule } = require('../../../../../checker/taint/python/python-taint-abstract-checker') const AstUtil = require('../../../../../util/ast-util') @@ -125,6 +126,15 @@ const { tornadoEntryPointArray, tornadoEntryPointSourceArray } = findTornadoEntr pyFcEntryPointSourceArray.push(...agentUniverseEntryPointSourceArray) } + // 通用装饰器入口点 collector：识别 @function_tool / @tool / @mcp.tool / @app.tool + const { functionToolEntryPointArray, functionToolEntryPointSourceArray } = findFunctionToolEntryPointAndSource(filenameAstObj, dir) + if (functionToolEntryPointArray) { + pyFcEntryPointArray.push(...functionToolEntryPointArray) + } + if (functionToolEntryPointSourceArray) { + pyFcEntryPointSourceArray.push(...functionToolEntryPointSourceArray) + } + return { pyFcEntryPointArray, pyFcEntryPointSourceArray, lifespanGlobalAssignments } } diff --git a/src/engine/analyzer/python/common/python-analyzer.ts b/src/engine/analyzer/python/common/python-analyzer.ts index 3ab634e9..42c3d028 100644 --- a/src/engine/analyzer/python/common/python-analyzer.ts +++ b/src/engine/analyzer/python/common/python-analyzer.ts @@ -14,6 +14,7 @@ import type { Logger } from '../../../../util/logger' import type { CallArgs, CallArg, CallArgKind, CallInfo } from '../../common/call-args' import { dispatchPythonCallbackApiModel, handlePythonFrameworkCall } from '../framework-call-model' import { pythonCallSummaryPolicy } from '../../common/call-summary/language/python' +import { tryExecuteFirstArgCallee } from './callgraph/first-arg-callee-resolver' import type { CallSummaryLanguagePolicy } from '../../common/call-summary/language/types' import { INTERNAL_CALL } from '../../common/call-args' import type { @@ -29,14 +30,6 @@ import type { AssignmentExpression, SpreadElement, } from '../../../../types/uast' -import { - createMemoryGuardState, - resetForEntryPoint, - probeMemoryAndUpdate, - flushFindingsToReport, - getEntryPointHeapDeltaMb, - type MemoryGuardState, -} from '../../common/memory-guard/entrypoint-memory-guard' import { describeEntryPointForLog } from '../../../../util/entrypoint-metrics' const Uuid = require('node-uuid') @@ -66,7 +59,8 @@ const AstUtil = require('../../../../util/ast-util') const Stat = require('../../../../util/statistics') const constValue = require('../../../../util/constant') const entryPointConfig = require('../../common/entrypoint/current-entrypoint') -const { executeViaEntryPointExecutor } = require('../../common/entrypoint/entrypoint-executor') as typeof import('../../common/entrypoint/entrypoint-executor') +const { executeViaEntryPointExecutor } = + require('../../common/entrypoint/entrypoint-executor') as typeof import('../../common/entrypoint/entrypoint-executor') const FileUtil = require('../../../../util/file-util') const { getSourceNameList } = require('./entrypoint-collector/python-entrypoint') const { handleException } = require('../../common/exception-handler') @@ -79,6 +73,7 @@ const { findProjectRoot, buildSearchPaths, } = require('./python-import-resolver') +const { getUniqueTornadoHandlerApplication } = require('../../../../checker/taint/python/tornado-util') /** * @@ -86,86 +81,61 @@ const { class PythonAnalyzer extends Analyzer { protected override readonly callSummaryLanguagePolicy: CallSummaryLanguagePolicy = pythonCallSummaryPolicy - /** - * 单入口内存护栏状态。 - * - * 防护机制：每入口开始前 reset（记录基线 heap），processInstruction/executeCall 边界 - * 节流探测 heapUsed，超阈设 exceeded=true 让本入口内后续指令提前返回 UndefinedValue。 - * 入口结束后若 exceeded=true，flush 已分析入口 finding 到 report.sarif 并记录 diagnostics。 - * 不改 clone 逻辑，零污染风险。 - */ - protected override memoryGuardState: MemoryGuardState | undefined = createMemoryGuardState() - /** * 内存护栏 abort 计数与 flush 计数，输出到 stdout 用于 PoC 校验。 */ private memoryGuardAbortCount: number = 0 - private memoryGuardFlushCount: number = 0 - /** - * 单入口内存护栏 hook：节流探测 heapUsed，超阈置 exceeded 提前退出本入口。 - */ - protected override shouldAbortExecutionForMemory(_state: State): boolean { - const state = this.memoryGuardState - if (!state || !state.enabled) return false - return probeMemoryAndUpdate(state) - } + private memoryGuardFlushCount: number = 0 /** - * 入口开始前重置护栏状态。 + * 入口开始前重置护栏状态：基类负责 delta baseline + label 重置， + * Python 追加跨调用 visited memo 清理，避免跨入口污染。 + * @param entryPointLabel */ protected override resetMemoryGuardForEntryPoint(entryPointLabel: string): void { - const state = this.memoryGuardState - if (!state || !state.enabled) return - resetForEntryPoint(state, entryPointLabel) - // Step A：每入口开始重置跨调用 visited memo，避免跨入口污染（卡点 A 完全失败）。 + super.resetMemoryGuardForEntryPoint(entryPointLabel) resetCrossCallVisited() } /** - * 入口结束处理护栏：若 exceeded=true 则 flush 当前 resultManager finding 到 report.sarif， - * 记录 diagnostics（入口名/峰值/已 flush finding 数），返回 abort 信息供上层 metrics。 + * 入口结束处理护栏：基类负责 delta diagnostics + flush + gc + log， + * Python 追加 tmpSymbolTable 清理释放本入口累积的 clone 副本，避免跨入口累积导致后续入口误杀。 + * @param entryPoint + * @param findingsBefore */ - protected override onEntryPointMemoryGuardFinalize(entryPoint: unknown, findingsBefore: number): { + protected override onEntryPointMemoryGuardFinalize( + entryPoint: unknown, + findingsBefore: number + ): { aborted: boolean peakHeapMb: number deltaHeapMb: number } { - const state = this.memoryGuardState - if (!state || !state.enabled) { - return { aborted: false, peakHeapMb: 0, deltaHeapMb: 0 } - } - const deltaInfo = getEntryPointHeapDeltaMb(state) - if (!state.exceeded) { - return { aborted: false, peakHeapMb: deltaInfo.peakMb, deltaHeapMb: deltaInfo.deltaMb } - } + const result = super.onEntryPointMemoryGuardFinalize(entryPoint, findingsBefore) + if (!result.aborted) return result this.memoryGuardAbortCount++ - // flush 当前已分析入口的 finding 到 report.sarif（全量覆盖写，不 clear resultManager） - const resultManager = this.checkerManager?.getResultManager?.() - const findingsAtFlush = flushFindingsToReport(resultManager ?? null, Config) - state.cumulativeFlushedFindings = findingsAtFlush this.memoryGuardFlushCount++ - // abort 后释放本入口累积的 clone 副本：清 tmpSymbolTable 持有的临时注册项 + 强制 gc， + // 释放本入口累积的 clone 副本：清 tmpSymbolTable 持有的临时注册项， // 否则 7GB+ clone 副本留在 tmpSymbolMap 跨入口累积，后续入口一进来就超阈被立刻 abort - const tmpBefore = (this as any).tmpSymbolTable ? (this as any).tmpSymbolTable.size : -1 + const tmpBefore = this.tmpSymbolTable ? this.tmpSymbolTable.size : -1 try { - if ((this as any).tmpSymbolTable && typeof (this as any).tmpSymbolTable.clear === 'function') { - ;(this as any).tmpSymbolTable.clear() + if (this.tmpSymbolTable && typeof this.tmpSymbolTable.clear === 'function') { + this.tmpSymbolTable.clear() } - } catch (e) { /* 清理失败不影响下一入口 */ } - const gcFn = (globalThis as any).gc - if (typeof gcFn === 'function') { - try { gcFn() } catch (e) { /* --expose-gc 未启时无 gc，忽略 */ } + } catch (_e) { + /* 清理失败不影响下一入口 */ } const heapAfterGc = process.memoryUsage().heapUsed + const state = this.memoryGuardState logger.warn( - `[memory-guard] entrypoint aborted: ${state.entryPointLabel} peak=${deltaInfo.peakMb.toFixed(1)}MB ` + - `delta=${deltaInfo.deltaMb.toFixed(1)}MB limit=${state.limitMb}MB ` + - `flushedFindings=${findingsAtFlush} cumulativeAborts=${this.memoryGuardAbortCount} ` + - `cumulativeFlushes=${this.memoryGuardFlushCount} findingsBefore=${findingsBefore} ` + - `tmpBefore=${tmpBefore} heapAfterGcMb=${(heapAfterGc / 1024 / 1024).toFixed(1)}` + `[memory-guard] entrypoint aborted: ${state?.entryPointLabel ?? ''} ` + + `peak=${result.peakHeapMb.toFixed(1)}MB delta=${result.deltaHeapMb.toFixed(1)}MB ` + + `cumulativeAborts=${this.memoryGuardAbortCount} ` + + `cumulativeFlushes=${this.memoryGuardFlushCount} findingsBefore=${findingsBefore} ` + + `tmpBefore=${tmpBefore} heapAfterGcMb=${(heapAfterGc / 1024 / 1024).toFixed(1)}` ) - return { aborted: true, peakHeapMb: deltaInfo.peakMb, deltaHeapMb: deltaInfo.deltaMb } + return result } /** @@ -251,10 +221,10 @@ class PythonAnalyzer extends Analyzer { let overloadCount = 0 // 单入口内存护栏 reset：每入口开始前记录基线 heap，清 exceeded const epLabel = describeEntryPointForLog(entryPoint).replace(/^\[|\]$/g, '') - this.resetMemoryGuardForEntryPoint(epLabel) let memoryAborted = false try { this.symbolTable.clear() + this.resetMemoryGuardForEntryPoint(epLabel) const entryPointRecord = entryPoint as Record if (entryPointRecord.type === constValue.ENGIN_START_FUNCALL) { const entryPointSymVal = entryPointRecord.entryPointSymVal as @@ -305,7 +275,7 @@ class PythonAnalyzer extends Analyzer { } }, }, - this.checkerManager?.resultManagerProxy, + this.checkerManager?.resultManagerProxy ) overloadCount += executedOverloads } else if (entryPointRecord.type === constValue.ENGIN_START_FILE_BEGIN) { @@ -338,7 +308,8 @@ class PythonAnalyzer extends Analyzer { } overloadCount = 1 try { - const astNode = (entryPointRecord.entryPointSymVal as { ast?: { node?: CompileUnit } } | undefined)?.ast?.node + const astNode = (entryPointRecord.entryPointSymVal as { ast?: { node?: CompileUnit } } | undefined)?.ast + ?.node if (!astNode) { skipped = true skipReason = 'missing-file-ast' @@ -360,16 +331,26 @@ class PythonAnalyzer extends Analyzer { classify: () => 'file', execute: () => { this.checkerManager.checkAtSymbolInterpretOfEntryPointBefore(this, null, null, null, null) - this.processCompileUnit(scope, astNode, state) + // module-level 入口把 modClos（entry_fclos）当作最外 head frame push 到 callstack idx0， + // 让 callstack-only filter 的 expected=1 预设（idx0=已在里面的 head）成立： + // 入口函数自身成为 idx1，第一条 ARG PASS 进 idx1 与 expected=1 对齐，真 enter edge 不再被误判为 noise 丢弃。 + const headFrame = scope + const headState = headFrame + ? Object.assign({}, state, { + callstack: ((state as any).callstack || []).concat([headFrame]), + callsites: ((state as any).callsites || []).concat([{ code: '', nodeHash: undefined, loc: astNode?.loc }]), + }) + : state + this.processCompileUnit(scope, astNode, headState) this.checkerManager.checkAtSymbolInterpretOfEntryPointAfter(this, null, null, null, null) }, }, - this.checkerManager?.resultManagerProxy, + this.checkerManager?.resultManagerProxy ) } catch (e) { - const sourceFile = (entryPointRecord.entryPointSymVal as - | { ast?: { node?: { loc?: { sourcefile?: unknown } } } } - | undefined)?.ast?.node?.loc?.sourcefile + const sourceFile = ( + entryPointRecord.entryPointSymVal as { ast?: { node?: { loc?: { sourcefile?: unknown } } } } | undefined + )?.ast?.node?.loc?.sourcefile handleException( e, `[${sourceFile} symbolInterpret failed. Exception message saved in error log file`, @@ -401,6 +382,10 @@ class PythonAnalyzer extends Analyzer { return true } + /** + * + * @param entryPoint + */ private getOverloadedEntryPoints(entryPoint: unknown): unknown[] { const entryPointRecord = entryPoint as { entryPointSymVal?: { overloaded?: unknown } } const overloaded = entryPointRecord.entryPointSymVal?.overloaded @@ -574,10 +559,26 @@ class PythonAnalyzer extends Analyzer { }) } - return this.processPythonCallExpressionDirect(scope, node, state, fclos, argvalues, callInfo) ?? new UndefinedValue() + return ( + this.processPythonCallExpressionDirect(scope, node, state, fclos, argvalues, callInfo) ?? new UndefinedValue() + ) } - executeCallbackModelCall(node: CallExpression, fclos: Value, state: State, scope: Scope, callInfo: CallInfo): boolean { + /** + * + * @param node + * @param fclos + * @param state + * @param scope + * @param callInfo + */ + executeCallbackModelCall( + node: CallExpression, + fclos: Value, + state: State, + scope: Scope, + callInfo: CallInfo + ): boolean { const callbackState = { ...state, throwstack: undefined, throwstackScopeAndState: [] } as State try { this.executeCall(node, fclos, callbackState, scope, callInfo) @@ -587,6 +588,15 @@ class PythonAnalyzer extends Analyzer { return callbackState.throwstackScopeAndState?.length === 0 && callbackState.throwstack === undefined } + /** + * + * @param scope + * @param node + * @param state + * @param fclos + * @param argvalues + * @param callInfo + */ private processPythonCallExpressionDirect( scope: Scope, node: CallExpression, @@ -599,7 +609,9 @@ class PythonAnalyzer extends Analyzer { // union callee 含 class 成员：拆出 class 走 propagateNewObject，其余交给 executeCall if (fclos.vtype === 'union' && Array.isArray(fclos.value)) { - const classMembers = fclos.value.filter((m: Value | undefined) => m && typeof m === 'object' && m.vtype === 'class') + const classMembers = fclos.value.filter( + (m: Value | undefined) => m && typeof m === 'object' && m.vtype === 'class' + ) if (classMembers.length > 0) { const results: Value[] = [] for (const member of classMembers) { @@ -620,7 +632,9 @@ class PythonAnalyzer extends Analyzer { } } // 非 class 成员通过 executeCall 的 union 处理（已内置 checkAtFunctionCallAfter） - const nonClassMembers = fclos.value.filter((m: Value | undefined) => !m || typeof m !== 'object' || m.vtype !== 'class') + const nonClassMembers = fclos.value.filter( + (m: Value | undefined) => !m || typeof m !== 'object' || m.vtype !== 'class' + ) if (nonClassMembers.length > 0) { for (const member of nonClassMembers) { if (!member || typeof member !== 'object') continue @@ -665,7 +679,7 @@ class PythonAnalyzer extends Analyzer { if (signatureAst?.type === 'FunctionDefinition') { callInfo.boundCall = this.bindCallArgs(node, fclos, signatureAst, callInfo) } - const res = this.executeWithSummary( + return this.executeWithSummary( scope, fclos, callInfo, @@ -673,7 +687,6 @@ class PythonAnalyzer extends Analyzer { () => this.propagateNewObject(scope, node, state, fclos, argvalues, callInfo), { getReplayValue: () => undefined } ) - return res } // list.append(x)：将元素添加到列表，并传播污点 if ( @@ -723,8 +736,14 @@ class PythonAnalyzer extends Analyzer { collectedArgs, }) + // 通用 first-arg-is-callee callgraph 解析（asyncio.to_thread / run_in_executor / functools.partial） + // 在 executeFunctionInArguments 之前尝试，如果匹配则用正确参数调用 first-arg，跳过 executeFunctionInArguments 的空参数调用 + let firstArgCalleeHandled = false if (fclos.vtype !== 'fclos' && Config.invokeCallbackOnUnknownFunction && !callbackModelHandled) { - this.executeFunctionInArguments(scope, fclos, node, argvalues, state) + firstArgCalleeHandled = tryExecuteFirstArgCallee(this, scope, node, state, fclos, argvalues, callInfo) + if (!firstArgCalleeHandled) { + this.executeFunctionInArguments(scope, fclos, node, argvalues, state) + } } if (res && this.checkerManager?.checkAtFunctionCallAfter) { @@ -760,8 +779,6 @@ class PythonAnalyzer extends Analyzer { collectedArgs, }) - - return res } @@ -784,6 +801,7 @@ class PythonAnalyzer extends Analyzer { ): Value { if (fclos.ast?.cdef) { const res = this.buildNewObject(fclos.ast.cdef, fclos, state, node, scope, callInfo) + this.injectTornadoApplication(res, fclos) if (res && this.checkerManager?.checkAtFunctionCallAfter) { this.checkerManager.checkAtFunctionCallAfter(this, scope, node, state, { callInfo, @@ -810,7 +828,12 @@ class PythonAnalyzer extends Analyzer { return res } - + private injectTornadoApplication(instance: Value, handler: Value): void { + const application = getUniqueTornadoHandlerApplication(handler) + if (!application || !instance || typeof instance !== 'object') return + const setFieldValue = (instance as { setFieldValue?: (name: string, value: Value) => void }).setFieldValue + if (typeof setFieldValue === 'function') setFieldValue.call(instance, 'application', application as Value) + } /** * 构建 Python 结构化 CallArgs，识别 keyword / spread / kwspread 参数类型 * @@ -896,6 +919,7 @@ class PythonAnalyzer extends Analyzer { const importCacheKey = `${sourceFileAbs}|${from?.value || ''}|${imported?.name || imported?.value || ''}` const cachedImportResult = this._importCache.get(importCacheKey) if (cachedImportResult !== undefined) { + this.bindImportToScope(scope, node, cachedImportResult) return cachedImportResult } @@ -933,6 +957,7 @@ class PythonAnalyzer extends Analyzer { // 缓存结果并返回的辅助函数 const cacheAndReturn = (result: Value): Value => { this._importCache.set(importCacheKey, result) + this.bindImportToScope(scope, node, result) return result } @@ -1102,6 +1127,53 @@ class PythonAnalyzer extends Analyzer { return cacheAndReturn(new UndefinedValue()) } + private bindImportToScope(scope: Scope, node: { from?: unknown; imported?: unknown; local?: unknown }, result: Value): void { + const localName = (node.local as { name?: unknown } | undefined)?.name + if (node.from) { + if (typeof localName === 'string') scope.setFieldValue(localName, result) + return + } + const importedName = (node.imported as { value?: unknown; name?: unknown } | undefined)?.value ?? + (node.imported as { name?: unknown } | undefined)?.name + if (typeof importedName !== 'string') return + const nameParts = importedName.split('.') + if (!importedName.includes('.') || result.node_module !== true) { + if (typeof localName === 'string') scope.setFieldValue(localName, result) + return + } + if (typeof localName === 'string' && localName !== nameParts[0]) { + scope.setFieldValue(localName, result) + return + } + + if (result.node_module !== true) return + + const rootName = nameParts[0] + if (!rootName) return + let parentModule = new SymbolValue(scope.qid, { + sid: rootName, + qid: `${scope.qid}.${rootName}`, + parent: scope, + node_module: true, + }) + scope.setFieldValue(rootName, parentModule) + for (let index = 1; index < nameParts.length; index++) { + const segment = nameParts[index] + const childModule = new SymbolValue(parentModule.qid, { + sid: segment, + qid: `${parentModule.qid}.${segment}`, + parent: parentModule, + node_module: true, + }) + if (index === nameParts.length - 1) { + childModule.value = result.value + childModule.node_module = result.node_module + } + parentModule.setMemberValue(segment, childModule) + parentModule = childModule + } + } + /** * * @param scope @@ -1121,7 +1193,10 @@ class PythonAnalyzer extends Analyzer { resolved_prop.name = '_CTOR_' } if (!resolved_prop) return defscope - let res = this.getMemberValue(defscope, resolved_prop, state) + const res = this.getMemberValue(defscope, resolved_prop, state) + if (defscope?.node_module === true && res && typeof res === 'object') { + res.node_module = true + } if (node.object.type !== 'SuperExpression') { if (res.vtype !== 'union' || !Array.isArray(res.value)) { // 非 union 类型：直接绑定 _this @@ -1233,6 +1308,7 @@ class PythonAnalyzer extends Analyzer { const obj = this.buildNewObject(fdef, fclos, state, node, scope, { callArgs: this.buildCallArgs(node, argvalues, fclos), }) + this.injectTornadoApplication(obj, fclos) if (logger.isTraceEnabled()) logger.trace(`new expression: ${this.formatScope(obj)}`) if (obj && this.checkerManager?.checkAtNewExprAfter) { @@ -1471,6 +1547,9 @@ class PythonAnalyzer extends Analyzer { * 避免无条件 unroll-2 在大项目 OOM，同时保留回边累积污点的传播能力。 * ITER-CONCRETE 分支（具体可枚举迭代体）逐元素行为完全保留。 * 仅 Python override，避免 Go/Java MemberExpr 链式访问在第二轮 body 重入触发栈爆。 + * @param scope + * @param node + * @param state */ override processRangeStatement(scope: Scope, node: any, state: State): any { const { key, value, right, body } = node @@ -1555,6 +1634,7 @@ class PythonAnalyzer extends Analyzer { * 跳过子作用域条目（vtype=scope/class 或 key 以 { const m = new Map() @@ -1576,6 +1656,8 @@ class PythonAnalyzer extends Analyzer { /** * 比对前后两个 scope 状态快照，任意 (新增 / 删除 / vtype 变 / tags 集合变 / isTaintedRec 变) * 视为状态变化。tags 比较忽略顺序。 + * @param a + * @param b */ static diffSnapshots( a: Map, @@ -1945,7 +2027,7 @@ class PythonAnalyzer extends Analyzer { * @param superId */ function _resolveClassInheritance(this: any, fclos: any, superId: any) { - if (fclos?.id === superId?.name) { + if (superId?.type === 'Identifier' && fclos?.sid === superId.name) { return } const superClos = this.processInstruction(scope, superId, state) @@ -2010,12 +2092,19 @@ class PythonAnalyzer extends Analyzer { */ async scanModules(dir: any) { const { options } = this - const modules = FileUtil.loadAllFileTextGlobby( - ['**/*.(py)', '.claude/skills/**/*.py', '.codex/skills/**/*.py', '.codefuse/skills/**/*.py', '.skills/**/*.py', '!**/.venv/**', '!**/vendor/**', '!**/node_modules/**', '!**/site-packages/**'], - dir - ) + const patterns: string[] = [ + '**/*.(py)', + '!**/.claude/**', + '!**/.codex/skills/**/*.py', + '!**/.codefuse/skills/**/*.py', + '!**/.venv/**', + '!**/vendor/**', + '!**/node_modules/**', + '!**/site-packages/**', + ] + const modules = FileUtil.loadAllFileTextGlobby(patterns, dir) this.fileList = globby - .sync(['**/*.(py)', '.claude/skills/**/*.py', '.codex/skills/**/*.py', '.codefuse/skills/**/*.py', '.skills/**/*.py', '!**/.venv/**', '!**/vendor/**', '!**/node_modules/**', '!**/site-packages/**'], { + .sync(patterns, { cwd: dir, caseSensitiveMatch: false, dot: true, @@ -2024,12 +2113,6 @@ class PythonAnalyzer extends Analyzer { // 构建规范化文件路径集合，用于 O(1) 查找 this._normalizedFileSet = new Set(this.fileList.map((f: string) => path.normalize(f))) if (modules.length === 0) { - handleException( - null, - 'find no target compileUnit of the project : no python file found in source path', - 'find no target compileUnit of the project : no python file found in source path' - ) - process.exitCode = ErrorCode.no_valid_source_file return } @@ -2061,8 +2144,7 @@ class PythonAnalyzer extends Analyzer { // 开始 ProcessModule 阶段：处理所有模块（分析 AST） this.performanceTracker.start('preProcess.processModule') - this.callSummarySessions[0].beginForLanguage('Python' - ) + this.callSummarySessions[0].beginForLanguage('Python') try { for (let i = 0; i < modules.length; i++) { const mod = modules[i] @@ -2113,6 +2195,10 @@ class PythonAnalyzer extends Analyzer { * Python 装饰器路径下 params.forEach(processInstruction) 对 Parameter 类型无 handler， * 从不触发 SOURCE mark。此处对每个 param.id 显式触发 checkAtIdentifier，与 baseline * 直接 entrypoint 路径语义对齐；非 entrypoint 形参 sourceScope 无匹配 rule 不会误 mark。 + * @param fscope + * @param params + * @param state + * @param node */ protected override onParamsBound(fscope: any, params: any[], state: State, node: any): void { for (const param of params || []) { @@ -2135,6 +2221,8 @@ class PythonAnalyzer extends Analyzer { * PFD 静态扫描不按求值顺序，后来居上直接盖掉 outer，装饰器反查错路径。 * 修复：本地 def 走超类注册逻辑完成后，把 scope[name] 还原为 import 来源，本地 def 改挂 ``， * 让 EP 索引（按 ast.node.id.name 收集）仍能找到本体。仅当 existing 是不同源文件的 fclos 时触发。 + * @param node + * @param scope */ createFuncScope(node: any, scope: any): any { const funcName: string | undefined = node?.id?.name diff --git a/src/engine/parser/python/python-ast-builder.ts b/src/engine/parser/python/python-ast-builder.ts index e72a2663..4867b0a1 100644 --- a/src/engine/parser/python/python-ast-builder.ts +++ b/src/engine/parser/python/python-ast-builder.ts @@ -53,7 +53,7 @@ function buildUASTPython(rootDir: string, options?: BuildOptions): string | null // 并行任务数：根据 CPU 核心数自动设置 const numJobs = os.cpus().length - const command = `${uast4pyPath} ${isSingle} --rootDir="${rootDir}" --output="${outputPath}" -j${numJobs}` + const command = `${quoteShellArg(uast4pyPath)} ${isSingle} --rootDir=${quoteShellArg(rootDir)} --output=${quoteShellArg(outputPath)} -j${numJobs}` try { const optionForCommand = { @@ -188,6 +188,16 @@ function extractFailedSourcePath(errorText: string): string | null { return null } +/** + * 转义 shell 单参数：单引号包裹并把内部单引号转义， + * 防止被扫描仓库路径/文件名中的 shell 元字符在 execSync 时被解释执行 + * @param value - 任意来自被扫描仓库的路径或文件名 + * @returns 已用单引号安全包裹的 shell 字面量 + */ +function quoteShellArg(value: string): string { + return `'${value.replace(/'/g, `'\\''`)}'` +} + /** * BOM 失败兜底：拷贝到 tmpdir 去 BOM，singleFileParse 重跑，路径反向映射回原 path * 严禁修改用户源码（rootDir 内任何路径都不写入） @@ -204,8 +214,8 @@ function tryRecoverBomFile( if (!fileStartsWithUtf8Bom(originalPath)) { return null } - let tmpInputPath: string | null = null - let tmpOutputPath: string | null = null + let tmpInputPath: string = '' + let tmpOutputPath: string = '' try { // 在 tmpRoot 下保留原文件 basename，避免 sourcefile 字段歧义 const base: string = path.basename(originalPath) @@ -221,7 +231,7 @@ function tryRecoverBomFile( fs.writeFileSync(tmpInputPath, buf.subarray(3)) // singleFileParse 直接调 binary，避免 buildUASTPython 修改模块级 uastFilePath - const cmd: string = `${uast4pyPath} --singleFileParse --rootDir="${tmpInputPath}" --output="${tmpOutputPath}" -j1` + const cmd: string = `${quoteShellArg(uast4pyPath)} --singleFileParse --rootDir=${quoteShellArg(tmpInputPath)} --output=${quoteShellArg(tmpOutputPath)} -j1` ChildProcess.execSync(cmd, { maxBuffer: 5 * 1024 * 1024 * 1024 }) if (!fs.existsSync(tmpOutputPath)) { diff --git a/src/util/ast-util.ts b/src/util/ast-util.ts index 777f9dcb..5631b412 100644 --- a/src/util/ast-util.ts +++ b/src/util/ast-util.ts @@ -432,7 +432,13 @@ function satisfy( const parentMap = new WeakMap() // 使用索引替代 shift() 操作，提高性能 let worklistIndex = 0 + // BFS worklist 上限防御：异常图深度遍历可达 2^32-1 触发 Array.push RangeError。 + // 上限 5M（约 80MB 引用空间）足够覆盖正常 sanitizer BFS，超限安全中断（return res）。 + const WORKLIST_MAX = 5_000_000 while (worklistIndex < worklist.length) { + if (worklist.length > WORKLIST_MAX) { + return res.length === 0 ? null : multiMatch ? res : null + } node = worklist[worklistIndex] const from = fromlist[worklistIndex] const depth = depthlist[worklistIndex] @@ -442,14 +448,17 @@ function satisfy( } visited.add(node) if (Array.isArray(node)) { - node.forEach((child: any) => { + // 超大数组（> WORKLIST_MAX）直接跳过 BFS 深入,避免 forEach 单轮 push 触达 2^32 抛 RangeError + if (node.length > WORKLIST_MAX) continue + for (const child of node) { + if (worklist.length > WORKLIST_MAX) break worklist.push(child) fromlist.push(node) depthlist.push(depth || 1) if (child && typeof child === 'object') { parentMap.set(child, node) } - }) + } } if (f(node)) { @@ -470,6 +479,7 @@ function satisfy( if (depth > maxdepth) continue } for (const prop in node) { + if (worklist.length > WORKLIST_MAX) break if (!Object.prototype.hasOwnProperty.call(node, prop)) continue // 过滤的时候 不仅要过滤_this还要过滤__this if ( diff --git a/src/util/clone-util.ts b/src/util/clone-util.ts index c8542efa..0f928835 100644 --- a/src/util/clone-util.ts +++ b/src/util/clone-util.ts @@ -297,7 +297,11 @@ function buildNewValueInstance( // 递归处理 _field 中的值 if (newVal._field && typeof newVal._field === 'object') { const fieldHolder = newVal as CloneFieldHolder - const fieldTarget: WritableValueContainer | undefined = fieldHolder._field?.[RAW_TARGET] as WritableValueContainer | undefined || fieldHolder._field + const fieldRawTarget = fieldHolder._field?.[RAW_TARGET] + // ValueRefMap proxy 的 RAW_TARGET 为空 {}，需回退到 proxy 本身（走 ownKeys trap） + const fieldTarget: WritableValueContainer | undefined = fieldRawTarget && Object.keys(fieldRawTarget).length > 0 + ? fieldRawTarget as WritableValueContainer + : fieldHolder._field if (fieldTarget !== newVal.value) { ensureWritableValueContainer(newVal, Array.isArray(fieldTarget) ? 0 : '') } diff --git a/src/util/constant.ts b/src/util/constant.ts index bb354d94..fcb2658f 100644 --- a/src/util/constant.ts +++ b/src/util/constant.ts @@ -7,7 +7,7 @@ export const ENGIN_START_FILE_BEGIN = 'fileBegin' export const YASA_DEFAULT = 'YASADefault' // 基础版本号 -const BASE_VERSION = '0.3.2' +const BASE_VERSION = '0.3.3' /** * 尝试读取构建时生成的版本信息文件 diff --git a/src/util/diagnostics-log-util.ts b/src/util/diagnostics-log-util.ts index 29806cb6..f9867c29 100644 --- a/src/util/diagnostics-log-util.ts +++ b/src/util/diagnostics-log-util.ts @@ -429,7 +429,6 @@ function generateScanSummary( callSummaryEffectiveness: buildCallSummaryEffectiveness(analyzer), } - // 返回紧凑的 JSON 字符串（无空格） return JSON.stringify(scanSummary) } diff --git a/src/util/file-util.ts b/src/util/file-util.ts index b106222d..6e16bd81 100644 --- a/src/util/file-util.ts +++ b/src/util/file-util.ts @@ -286,8 +286,6 @@ function loadJsonFileAsts(filename: string): ASTFileUnit[] | ASTFileUnit { function writeJSONfile(filename: string, value: any, diagnosticTiming = false): void { // logger.info('writing JSON file: ' + filename); try { - const normalizeStartedAt = diagnosticTiming ? Date.now() : 0 - const normalizeElapsed = diagnosticTiming ? Date.now() - normalizeStartedAt : 0 // 检测循环引用的函数 const detectCircularRefs = ( obj: any, @@ -414,7 +412,7 @@ function writeJSONfile(filename: string, value: any, diagnosticTiming = false): const writeStartedAt = diagnosticTiming ? Date.now() : 0 jsonfile.writeFileSync(filename, value, {}) if (diagnosticTiming) { - logger.info(`[outputFindings] phase=serialize-write file=${path.basename(filename)} circularRefs=${circularPaths.length} normalizeElapsed=${normalizeElapsed}ms circularElapsed=${circularElapsed}ms writeElapsed=${Date.now() - writeStartedAt}ms`) + logger.info(`[outputFindings] phase=serialize-write file=${path.basename(filename)} circularRefs=${circularPaths.length} circularElapsed=${circularElapsed}ms writeElapsed=${Date.now() - writeStartedAt}ms`) } } catch (err: any) { // 如果错误是循环引用相关的，进行详细诊断 @@ -911,17 +909,11 @@ function resolveUastBinaryPath(options: { yasaWarning(`Failed to extract ${binaryName} from snapshot`, RESOLVE_UAST_BINARY_STAGE) } - // 优先级3: 开发环境路径 + // 优先级3: 开发环境路径（__dirname 相对，即代码/安装目录） if (fs.existsSync(devPath)) { return devPath } - // 优先级4: 当前工作目录 - const cwdPath = resolveBinaryFromDir(path.join(process.cwd(), 'deps'), binaryName) - if (cwdPath && fs.existsSync(cwdPath)) { - return cwdPath - } - return null } diff --git a/src/util/finding-util.ts b/src/util/finding-util.ts index 62226bff..193d00c4 100644 --- a/src/util/finding-util.ts +++ b/src/util/finding-util.ts @@ -11,6 +11,8 @@ interface TraceItem { _meta?: { nodehash?: unknown } id?: { name?: string; loc?: { start?: { line?: number } } } body?: { loc?: { start?: { line?: number } } } + /** snapshot 后预算的 prettyPrint，供输出层 normalizeTerminalStringValueOfTrace 判断末端节点剥除 */ + _prettyPrint?: string } affectedNodeName?: string _synthetic?: boolean diff --git a/src/util/graph.ts b/src/util/graph.ts index 1a6ed0e3..b956a7b1 100644 --- a/src/util/graph.ts +++ b/src/util/graph.ts @@ -27,6 +27,8 @@ interface EdgeCallSiteOpts { callSite?: { loc?: CallSiteLoc } /** 调用点 AST 节点 nodehash（来自 callgraph-checker） */ callSiteNodehash?: string + /** AI call 边的候选 id（无真实调用点时用于区分） */ + candidateId?: string } /** @@ -101,7 +103,7 @@ class GraphClass { /** * 从 opts 推导调用点定位 key，用于区分同一 caller→callee 的不同调用行 - * 优先级：callSite.loc 三元组（人类可读）> callSiteNodehash（AST 节点唯一）> 空 + * 优先级：callSite.loc 三元组（人类可读）> callSiteNodehash（AST 节点唯一）> candidateId > 空 * 同一调用点多次 addEdge 会得到相同 key，仍能按 Map.set 合并去重 */ private buildCallSiteKey(opts: EdgeCallSiteOpts | undefined): string { @@ -112,6 +114,7 @@ class GraphClass { return `loc:${file}:${loc.start.line}:${loc.start.column ?? 0}` } if (opts.callSiteNodehash) return `nh:${opts.callSiteNodehash}` + if (opts.candidateId) return `cand:${opts.candidateId}` return '' } diff --git a/test/go/expect/gobenchmark-expect.json b/test/go/expect/gobenchmark-expect.json index 9d84a3c8..6b2f6a4a 100644 --- a/test/go/expect/gobenchmark-expect.json +++ b/test/go/expect/gobenchmark-expect.json @@ -1 +1 @@ -{"/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_001_F/argument_passing_reference_001_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_002_T/argument_passing_reference_002_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_002_T/argument_passing_reference_002_T.go\nLine 17: __taint_sink(obj.\"data\")\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_002_T/argument_passing_reference_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_002_T/argument_passing_reference_002_T.go\n AffectedNodeName: __taint_src\n 28: SOURCE: argument_passing_reference_002_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_002_T/argument_passing_reference_002_T.go\n AffectedNodeName: argument_passing_reference_002_T\n 28: CALL: argument_passing_reference_002_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_002_T/argument_passing_reference_002_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func argument_passing_reference_002_T(__taint_src interface{}) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_002_T/argument_passing_reference_002_T.go\n AffectedNodeName: process\n 16: CALL: \tprocess(obj, __taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_002_T/argument_passing_reference_002_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(obj[\"data\"])\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_003_F/argument_passing_reference_003_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_004_T/argument_passing_reference_004_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_004_T/argument_passing_reference_004_T.go\nLine 15: __taint_sink(arr)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_004_T/argument_passing_reference_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_004_T/argument_passing_reference_004_T.go\n AffectedNodeName: __taint_src\n 26: SOURCE: argument_passing_reference_005_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_004_T/argument_passing_reference_004_T.go\n AffectedNodeName: argument_passing_reference_005_T\n 26: CALL: argument_passing_reference_005_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_004_T/argument_passing_reference_004_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func argument_passing_reference_005_T(__taint_src interface{}) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_004_T/argument_passing_reference_004_T.go\n AffectedNodeName: process\n 14: CALL: \tprocess(arr, __taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_004_T/argument_passing_reference_004_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(arr)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_005_F/argument_passing_reference_005_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_006_T/argument_passing_reference_006_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_006_T/argument_passing_reference_006_T.go\nLine 17: __taint_sink(objB.\"name\")\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_006_T/argument_passing_reference_006_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_006_T/argument_passing_reference_006_T.go\n AffectedNodeName: __taint_src\n 30: SOURCE: argument_passing_reference_006_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_006_T/argument_passing_reference_006_T.go\n AffectedNodeName: argument_passing_reference_006_T\n 30: CALL: argument_passing_reference_006_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_006_T/argument_passing_reference_006_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func argument_passing_reference_006_T(__taint_src interface{}) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_006_T/argument_passing_reference_006_T.go\n AffectedNodeName: objA\n 13: Var Pass: \tobjA := map[string]interface{}{\"name\": __taint_src}\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_006_T/argument_passing_reference_006_T.go\n AffectedNodeName: swap\n 16: CALL: \tswap(objA, objB)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_006_T/argument_passing_reference_006_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(objB[\"name\"])\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_007_T/argument_passing_reference_007_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_007_T/argument_passing_reference_007_T.go\nLine 20: __taint_sink(&person.GetNamePointer())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_007_T/argument_passing_reference_007_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_007_T/argument_passing_reference_007_T.go\n AffectedNodeName: __taint_src\n 34: SOURCE: argument_passing_reference_007_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_007_T/argument_passing_reference_007_T.go\n AffectedNodeName: argument_passing_reference_007_T\n 34: CALL: argument_passing_reference_007_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_007_T/argument_passing_reference_007_T.go\n AffectedNodeName: __taint_src\n 16: ARG PASS: func argument_passing_reference_007_T(__taint_src string) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_007_T/argument_passing_reference_007_T.go\n AffectedNodeName: UpdateNamePointer\n 19: CALL: \t(&person).UpdateNamePointer(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_007_T/argument_passing_reference_007_T.go\n AffectedNodeName: GetNamePointer\n 20: CALL RETURN: \t__taint_sink((&person).GetNamePointer())\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_007_T/argument_passing_reference_007_T.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t__taint_sink((&person).GetNamePointer())\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_008_F/argument_passing_reference_008_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_011_F/argument_passing_value_011_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_012_T/argument_passing_value_012_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_012_T/argument_passing_value_012_T.go\nLine 16: __taint_sink(arg)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_012_T/argument_passing_value_012_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_012_T/argument_passing_value_012_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: argument_passing_value_012_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_012_T/argument_passing_value_012_T.go\n AffectedNodeName: argument_passing_value_012_T\n 23: CALL: argument_passing_value_012_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_012_T/argument_passing_value_012_T.go\n AffectedNodeName: __taint_src\n 11: ARG PASS: func argument_passing_value_012_T(__taint_src string) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_012_T/argument_passing_value_012_T.go\n AffectedNodeName: process\n 12: CALL: \tprocess(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_012_T/argument_passing_value_012_T.go\n AffectedNodeName: arg\n 15: ARG PASS: func process(arg string) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_012_T/argument_passing_value_012_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(arg)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_013_F/argument_passing_value_013_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_014_T/argument_passing_value_014_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_014_T/argument_passing_value_014_T.go\nLine 18: __taint_sink(arg)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_014_T/argument_passing_value_014_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_014_T/argument_passing_value_014_T.go\n AffectedNodeName: __taint_src\n 28: SOURCE: argument_passing_value_014_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_014_T/argument_passing_value_014_T.go\n AffectedNodeName: argument_passing_value_014_T\n 28: CALL: argument_passing_value_014_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_014_T/argument_passing_value_014_T.go\n AffectedNodeName: __taint_src\n 11: ARG PASS: func argument_passing_value_014_T(__taint_src interface{}) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_014_T/argument_passing_value_014_T.go\n AffectedNodeName: process1\n 14: CALL: \tprocess1(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_014_T/argument_passing_value_014_T.go\n AffectedNodeName: arg\n 17: ARG PASS: func process1(arg interface{}) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_014_T/argument_passing_value_014_T.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t__taint_sink(arg)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_015_F/argument_passing_value_015_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_016_T/argument_passing_value_016_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_016_T/argument_passing_value_016_T.go\nLine 16: __taint_sink(arg1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_016_T/argument_passing_value_016_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_016_T/argument_passing_value_016_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: argument_passing_value_016_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_016_T/argument_passing_value_016_T.go\n AffectedNodeName: argument_passing_value_016_T\n 22: CALL: argument_passing_value_016_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_016_T/argument_passing_value_016_T.go\n AffectedNodeName: __taint_src\n 11: ARG PASS: func argument_passing_value_016_T(__taint_src string) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_016_T/argument_passing_value_016_T.go\n AffectedNodeName: process\n 12: CALL: \tprocess(__taint_src, \"_\")\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_016_T/argument_passing_value_016_T.go\n AffectedNodeName: arg1\n 15: ARG PASS: func process(arg1 string, arg2 string) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_016_T/argument_passing_value_016_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(arg1)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_001_F/multiple_return_001_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_002_T/multiple_return_002_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_002_T/multiple_return_002_T.go\nLine 17: __taint_sink(ret1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_002_T/multiple_return_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_002_T/multiple_return_002_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: multiple_return_002_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_002_T/multiple_return_002_T.go\n AffectedNodeName: multiple_return_002_T\n 27: CALL: multiple_return_002_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_002_T/multiple_return_002_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func multiple_return_002_T(__taint_src interface{}) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_002_T/multiple_return_002_T.go\n AffectedNodeName: processData\n 15: CALL: \tret1, ret2 := processData(__taint_src, a)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_002_T/multiple_return_002_T.go\n AffectedNodeName: processData\n 15: CALL RETURN: \tret1, ret2 := processData(__taint_src, a)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_002_T/multiple_return_002_T.go\n 15: Var Pass: \tret1, ret2 := processData(__taint_src, a)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_002_T/multiple_return_002_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(ret1)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_003_F/multiple_return_003_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_004_T/multiple_return_004_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_004_T/multiple_return_004_T.go\nLine 17: __taint_sink(ret2)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_004_T/multiple_return_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_004_T/multiple_return_004_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: multiple_return_004_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_004_T/multiple_return_004_T.go\n AffectedNodeName: multiple_return_004_T\n 27: CALL: multiple_return_004_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_004_T/multiple_return_004_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func multiple_return_004_T(__taint_src interface{}) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_004_T/multiple_return_004_T.go\n AffectedNodeName: processData\n 15: CALL: \tret1, ret2 := processData(__taint_src, a)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_004_T/multiple_return_004_T.go\n AffectedNodeName: processData\n 15: CALL RETURN: \tret1, ret2 := processData(__taint_src, a)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_004_T/multiple_return_004_T.go\n 15: Var Pass: \tret1, ret2 := processData(__taint_src, a)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_004_T/multiple_return_004_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(ret2)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/named_return_001_F/named_return_001_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/named_return_002_T/named_return_002_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/named_return_002_T/named_return_002_T.go\nLine 15: __taint_sink(ret)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/named_return_002_T/named_return_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/named_return_002_T/named_return_002_T.go\n AffectedNodeName: __taint_src\n 26: SOURCE: named_return_002_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/named_return_002_T/named_return_002_T.go\n AffectedNodeName: named_return_002_T\n 26: CALL: named_return_002_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/named_return_002_T/named_return_002_T.go\n AffectedNodeName: __taint_src\n 11: ARG PASS: func named_return_002_T(__taint_src interface{}) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/named_return_002_T/named_return_002_T.go\n AffectedNodeName: processData\n 14: CALL: \tret := processData(__taint_src, a)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/named_return_002_T/named_return_002_T.go\n AffectedNodeName: processData\n 14: CALL RETURN: \tret := processData(__taint_src, a)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/named_return_002_T/named_return_002_T.go\n AffectedNodeName: ret\n 14: Var Pass: \tret := processData(__taint_src, a)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/named_return_002_T/named_return_002_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(ret)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_001_F/return_value_passing_001_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_002_T/return_value_passing_002_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_002_T/return_value_passing_002_T.go\nLine 13: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_002_T/return_value_passing_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_002_T/return_value_passing_002_T.go\n AffectedNodeName: __taint_src\n 24: SOURCE: return_value_passing_002_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_002_T/return_value_passing_002_T.go\n AffectedNodeName: return_value_passing_002_T\n 24: CALL: return_value_passing_002_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_002_T/return_value_passing_002_T.go\n AffectedNodeName: __taint_src\n 11: ARG PASS: func return_value_passing_002_T(__taint_src interface{}) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_002_T/return_value_passing_002_T.go\n AffectedNodeName: process\n 12: CALL: \tdata := process(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_002_T/return_value_passing_002_T.go\n AffectedNodeName: process\n 12: CALL RETURN: \tdata := process(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_002_T/return_value_passing_002_T.go\n AffectedNodeName: data\n 12: Var Pass: \tdata := process(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_002_T/return_value_passing_002_T.go\n AffectedNodeName: __taint_sink\n 13: SINK: \t__taint_sink(data)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/multi_invoke/multi_invoke_001_F/multi_invoke_001_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/multi_invoke/multi_invoke_002_T/multi_invoke_002_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/multi_invoke/multi_invoke_002_T/multi_invoke_002_T.go\nLine 16: __taint_sink(a)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/multi_invoke/multi_invoke_002_T/multi_invoke_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/multi_invoke/multi_invoke_002_T/multi_invoke_002_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: multi_invoke_002_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/multi_invoke/multi_invoke_002_T/multi_invoke_002_T.go\n AffectedNodeName: multi_invoke_002_T\n 27: CALL: multi_invoke_002_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/multi_invoke/multi_invoke_002_T/multi_invoke_002_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func multi_invoke_002_T(__taint_src string) {\n /sast-go/cases/accuracy/context_sensitive/multi_invoke/multi_invoke_002_T/multi_invoke_002_T.go\n AffectedNodeName: process\n 13: CALL: \ta := process(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/multi_invoke/multi_invoke_002_T/multi_invoke_002_T.go\n AffectedNodeName: process\n 13: CALL RETURN: \ta := process(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/multi_invoke/multi_invoke_002_T/multi_invoke_002_T.go\n AffectedNodeName: a\n 13: Var Pass: \ta := process(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/multi_invoke/multi_invoke_002_T/multi_invoke_002_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(a)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_001_T/polymorphism_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_001_T/polymorphism_001_T.go\nLine 15: __taint_sink(sub.call(__taint_src))\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_001_T/polymorphism_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_001_T/polymorphism_001_T.go\n AffectedNodeName: __taint_src\n 38: SOURCE: polymorphism_001_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_001_T/polymorphism_001_T.go\n AffectedNodeName: polymorphism_001_T\n 38: CALL: polymorphism_001_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_001_T/polymorphism_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func polymorphism_001_T(__taint_src interface{}) {\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_001_T/polymorphism_001_T.go\n AffectedNodeName: call\n 15: CALL: \t__taint_sink(sub.call(__taint_src))\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_001_T/polymorphism_001_T.go\n AffectedNodeName: call\n 15: CALL RETURN: \t__taint_sink(sub.call(__taint_src))\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_001_T/polymorphism_001_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(sub.call(__taint_src))\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_002_F/polymorphism_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_003_T/polymorphism_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_003_T/polymorphism_003_T.go\nLine 15: __taint_sink(student.Run())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_003_T/polymorphism_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_003_T/polymorphism_003_T.go\n AffectedNodeName: __taint_src\n 46: SOURCE: polymorphism_003_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_003_T/polymorphism_003_T.go\n AffectedNodeName: polymorphism_003_T\n 46: CALL: polymorphism_003_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_003_T/polymorphism_003_T.go\n AffectedNodeName: __taint_src\n 11: ARG PASS: func polymorphism_003_T(__taint_src string) {\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_003_T/polymorphism_003_T.go\n AffectedNodeName: student\n 12: Var Pass: \tvar student Person = &Student{Name: __taint_src, Age: 20, GPA: 3.8}\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_003_T/polymorphism_003_T.go\n AffectedNodeName: Run\n 15: CALL RETURN: \t__taint_sink(student.Run())\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_003_T/polymorphism_003_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(student.Run())\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_004_F/polymorphism_004_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/multidimensional_collection/array_index_005_T/array_index_005_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/multidimensional_collection/array_index_005_T/array_index_005_T.go\nLine 14: __taint_sink(str.0.0)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/multidimensional_collection/array_index_005_T/array_index_005_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/multidimensional_collection/array_index_005_T/array_index_005_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: array_index_005_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/multidimensional_collection/array_index_005_T/array_index_005_T.go\n AffectedNodeName: array_index_005_T\n 21: CALL: array_index_005_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/multidimensional_collection/array_index_005_T/array_index_005_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func array_index_005_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/multidimensional_collection/array_index_005_T/array_index_005_T.go\n AffectedNodeName: str\n 13: Var Pass: \tvar str = [3][1]string{[1]string{__taint_src}, [1]string{\"b\"}, [1]string{\"c\"}}\n /sast-go/cases/accuracy/field_sensitive/multidimensional_collection/array_index_005_T/array_index_005_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(str[0][0])\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/multidimensional_collection/array_index_006_F/array_index_006_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/multidimensional_collection/slice_index_003_T/slice_index_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/multidimensional_collection/slice_index_003_T/slice_index_003_T.go\nLine 18: __taint_sink(s.2.2)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/multidimensional_collection/slice_index_003_T/slice_index_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/multidimensional_collection/slice_index_003_T/slice_index_003_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: slice_index_003_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/multidimensional_collection/slice_index_003_T/slice_index_003_T.go\n AffectedNodeName: slice_index_003_T\n 25: CALL: slice_index_003_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/multidimensional_collection/slice_index_003_T/slice_index_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func slice_index_003_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/multidimensional_collection/slice_index_003_T/slice_index_003_T.go\n AffectedNodeName: s\n 13: Var Pass: \ts := [][]string{\n 14: Var Pass: \t\t[]string{\"a\"},\n 15: Var Pass: \t\t[]string{\"b\", \"c\"},\n 16: Var Pass: \t\t[]string{\"d\", \"e\", __taint_src},\n 17: Var Pass: \t}\n /sast-go/cases/accuracy/field_sensitive/multidimensional_collection/slice_index_003_T/slice_index_003_T.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t__taint_sink(s[2][2])\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/multidimensional_collection/slice_index_004_F/slice_index_004_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_001_T/array_index_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_001_T/array_index_001_T.go\nLine 14: __taint_sink(str.0)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_001_T/array_index_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_001_T/array_index_001_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: array_index_001_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_001_T/array_index_001_T.go\n AffectedNodeName: array_index_001_T\n 21: CALL: array_index_001_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_001_T/array_index_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func array_index_001_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_001_T/array_index_001_T.go\n AffectedNodeName: str\n 13: Var Pass: \tvar str = [3]string{__taint_src, \"b\", \"c\"}\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_001_T/array_index_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(str[0])\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_002_F/array_index_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_003_T/array_index_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_003_T/array_index_003_T.go\nLine 15: __taint_sink(str)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_003_T/array_index_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_003_T/array_index_003_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: array_index_003_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_003_T/array_index_003_T.go\n AffectedNodeName: array_index_003_T\n 22: CALL: array_index_003_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_003_T/array_index_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func array_index_003_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_003_T/array_index_003_T.go\n AffectedNodeName: str\n 13: Var Pass: \tvar str = [3]string{__taint_src, \"b\", \"c\"}\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_003_T/array_index_003_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(str)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_004_F/array_index_004_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T/map_field_sensitive_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T/map_field_sensitive_001_T.go\nLine 16: __taint_sink(m.\"key1\")\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T/map_field_sensitive_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T/map_field_sensitive_001_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: map_field_sensitive_001_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T/map_field_sensitive_001_T.go\n AffectedNodeName: map_field_sensitive_001_T\n 23: CALL: map_field_sensitive_001_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T/map_field_sensitive_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func map_field_sensitive_001_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T/map_field_sensitive_001_T.go\n AffectedNodeName: m[\"key1\"]\n 14: Var Pass: \tm[\"key1\"] = __taint_src\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T/map_field_sensitive_001_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(m[\"key1\"])\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_002_F/map_field_sensitive_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_003_F/map_field_sensitive_003_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T/map_field_sensitive_004_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T/map_field_sensitive_004_T.go\nLine 18: __taint_sink(m.\"key2\")\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T/map_field_sensitive_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T/map_field_sensitive_004_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: map_field_sensitive_004_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T/map_field_sensitive_004_T.go\n AffectedNodeName: map_field_sensitive_004_T\n 25: CALL: map_field_sensitive_004_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T/map_field_sensitive_004_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func map_field_sensitive_004_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T/map_field_sensitive_004_T.go\n AffectedNodeName: m[\"key2\"]\n 16: Var Pass: \tm[\"key2\"] = __taint_src\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T/map_field_sensitive_004_T.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t__taint_sink(m[\"key2\"])\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_005_F/map_field_sensitive_005_F": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_005_F/map_field_sensitive_005_F.go\nLine 17: __taint_sink(m.\"key1\")\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_005_F/map_field_sensitive_005_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_005_F/map_field_sensitive_005_F.go\n AffectedNodeName: __taint_src\n 24: SOURCE: map_field_sensitive_005_F(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_005_F/map_field_sensitive_005_F.go\n AffectedNodeName: map_field_sensitive_005_F\n 24: CALL: map_field_sensitive_005_F(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_005_F/map_field_sensitive_005_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func map_field_sensitive_005_F(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_005_F/map_field_sensitive_005_F.go\n AffectedNodeName: m[\"key1\"]\n 14: Var Pass: \tm[\"key1\"] = __taint_src\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_005_F/map_field_sensitive_005_F.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(m[\"key1\"])\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_001_T/slice_index_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_001_T/slice_index_001_T.go\nLine 14: __taint_sink(s.0)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_001_T/slice_index_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_001_T/slice_index_001_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: slice_index_001_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_001_T/slice_index_001_T.go\n AffectedNodeName: slice_index_001_T\n 21: CALL: slice_index_001_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_001_T/slice_index_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func slice_index_001_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_001_T/slice_index_001_T.go\n AffectedNodeName: s\n 13: Var Pass: \tvar s []string = []string{__taint_src, \"b\", \"c\"}\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_001_T/slice_index_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(s[0])\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_002_F/slice_index_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_005_T/slice_index_005_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_005_T/slice_index_005_T.go\nLine 16: __taint_sink(s.0)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_005_T/slice_index_005_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_005_T/slice_index_005_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: slice_index_005_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_005_T/slice_index_005_T.go\n AffectedNodeName: slice_index_005_T\n 23: CALL: slice_index_005_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_005_T/slice_index_005_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func slice_index_005_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_005_T/slice_index_005_T.go\n AffectedNodeName: arr\n 13: Var Pass: \tvar arr [3]string = [3]string{__taint_src, \"b\", \"c\"}\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_005_T/slice_index_005_T.go\n AffectedNodeName: s\n 15: Var Pass: \ts = arr[:]\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_005_T/slice_index_005_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(s[0])\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_006_F/slice_index_006_F": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_006_F/slice_index_006_F.go\nLine 16: __taint_sink(s.0)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_006_F/slice_index_006_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_006_F/slice_index_006_F.go\n AffectedNodeName: __taint_src\n 23: SOURCE: slice_index_006_F(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_006_F/slice_index_006_F.go\n AffectedNodeName: slice_index_006_F\n 23: CALL: slice_index_006_F(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_006_F/slice_index_006_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func slice_index_006_F(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_006_F/slice_index_006_F.go\n AffectedNodeName: arr\n 13: Var Pass: \tvar arr [3]string = [3]string{__taint_src, \"b\", \"c\"}\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_006_F/slice_index_006_F.go\n AffectedNodeName: s\n 15: Var Pass: \ts = arr[1:]\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_006_F/slice_index_006_F.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(s[0])\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_index_007_T/array_index_007_T": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_index_008_F/array_index_008_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/field_len_001_T/field_len_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/struct/field_len_001_T/field_len_001_T.go\nLine 30: __taint_sink(c.b.a.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/struct/field_len_001_T/field_len_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_001_T/field_len_001_T.go\n AffectedNodeName: __taint_src\n 37: SOURCE: field_len_001_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_001_T/field_len_001_T.go\n AffectedNodeName: field_len_001_T\n 37: CALL: field_len_001_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_001_T/field_len_001_T.go\n AffectedNodeName: __taint_src\n 22: ARG PASS: func field_len_001_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_001_T/field_len_001_T.go\n AffectedNodeName: pa\n 23: Var Pass: \tpa := A{\n 24: Var Pass: \t\tdata: __taint_src,\n 25: Var Pass: \t}\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_001_T/field_len_001_T.go\n AffectedNodeName: b.a\n 27: Var Pass: \tb.a = pa\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_001_T/field_len_001_T.go\n AffectedNodeName: c.b\n 29: Var Pass: \tc.b = b\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_001_T/field_len_001_T.go\n AffectedNodeName: __taint_sink\n 30: SINK: \t__taint_sink(c.b.a.data)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/field_len_002_F/field_len_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\nLine 100: __taint_sink(q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: __taint_src\n 107: SOURCE: field_len_003_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: field_len_003_T\n 107: CALL: field_len_003_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: __taint_src\n 64: ARG PASS: func field_len_003_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: pa\n 65: Var Pass: \tpa := A{\n 66: Var Pass: \t\tdata: __taint_src,\n 67: Var Pass: \t}\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: b.a\n 69: Var Pass: \tb.a = pa\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: c.b\n 71: Var Pass: \tc.b = b\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: d.c\n 73: Var Pass: \td.c = c\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: e.d\n 75: Var Pass: \te.d = d\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: f.e\n 77: Var Pass: \tf.e = e\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: g.f\n 79: Var Pass: \tg.f = f\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: h.g\n 81: Var Pass: \th.g = g\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: i.h\n 83: Var Pass: \ti.h = h\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: j.i\n 85: Var Pass: \tj.i = i\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: k.j\n 87: Var Pass: \tk.j = j\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: l.k\n 89: Var Pass: \tl.k = k\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: m.l\n 91: Var Pass: \tm.l = l\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: n.m\n 93: Var Pass: \tn.m = m\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: o.n\n 95: Var Pass: \to.n = n\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: p.o\n 97: Var Pass: \tp.o = o\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: q.p\n 99: Var Pass: \tq.p = p\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: __taint_sink\n 100: SINK: \t__taint_sink(q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.data)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/field_len_004_F/field_len_004_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\nLine 47: __taint_sink(q)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: __taint_src\n 54: SOURCE: field_len_005_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: field_len_005_T\n 54: CALL: field_len_005_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: __taint_src\n 31: ARG PASS: func field_len_005_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: pa\n 32: Var Pass: \tpa := A{\n 33: Var Pass: \t\tdata: __taint_src,\n 34: Var Pass: \t}\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: b.a\n 36: Var Pass: \tb.a = pa\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: c.b\n 38: Var Pass: \tc.b = b\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: d.c\n 40: Var Pass: \td.c = c\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: e.d\n 42: Var Pass: \te.d = d\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: f.e\n 44: Var Pass: \tf.e = e\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: p\n 45: Var Pass: \tp := f.e.d.c\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: q\n 46: Var Pass: \tq := p.b.a.data\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: __taint_sink\n 47: SINK: \t__taint_sink(q)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/field_len_006_F/field_len_006_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/struct_field_001_T/struct_field_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/struct/struct_field_001_T/struct_field_001_T.go\nLine 22: __taint_sink(p.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/struct/struct_field_001_T/struct_field_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_001_T/struct_field_001_T.go\n AffectedNodeName: __taint_src\n 29: SOURCE: struct_field_001_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_001_T/struct_field_001_T.go\n AffectedNodeName: struct_field_001_T\n 29: CALL: struct_field_001_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_001_T/struct_field_001_T.go\n AffectedNodeName: __taint_src\n 17: ARG PASS: func struct_field_001_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_001_T/struct_field_001_T.go\n AffectedNodeName: p\n 18: Var Pass: \tp := A{\n 19: Var Pass: \t\tdata: __taint_src,\n 20: Var Pass: \t\tsani: \"_\",\n 21: Var Pass: \t}\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_001_T/struct_field_001_T.go\n AffectedNodeName: __taint_sink\n 22: SINK: \t__taint_sink(p.data)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/struct_field_002_F/struct_field_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/struct_field_003_T/struct_field_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/struct/struct_field_003_T/struct_field_003_T.go\nLine 21: __taint_sink(p1.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/struct/struct_field_003_T/struct_field_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_003_T/struct_field_003_T.go\n AffectedNodeName: __taint_src\n 28: SOURCE: struct_field_003_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_003_T/struct_field_003_T.go\n AffectedNodeName: struct_field_003_T\n 28: CALL: struct_field_003_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_003_T/struct_field_003_T.go\n AffectedNodeName: __taint_src\n 17: ARG PASS: func struct_field_003_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_003_T/struct_field_003_T.go\n AffectedNodeName: p1.data\n 19: Var Pass: \tp1.data = __taint_src\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_003_T/struct_field_003_T.go\n AffectedNodeName: __taint_sink\n 21: SINK: \t__taint_sink(p1.data)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/struct_field_004_F/struct_field_004_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/struct_field_005_T/struct_field_005_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/struct/struct_field_005_T/struct_field_005_T.go\nLine 19: __taint_sink(p1.string)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/struct/struct_field_005_T/struct_field_005_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_005_T/struct_field_005_T.go\n AffectedNodeName: __taint_src\n 26: SOURCE: struct_field_005_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_005_T/struct_field_005_T.go\n AffectedNodeName: struct_field_005_T\n 26: CALL: struct_field_005_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_005_T/struct_field_005_T.go\n AffectedNodeName: __taint_src\n 16: ARG PASS: func struct_field_005_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_005_T/struct_field_005_T.go\n AffectedNodeName: p1.string\n 18: Var Pass: \tp1.string = __taint_src\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_005_T/struct_field_005_T.go\n AffectedNodeName: __taint_sink\n 19: SINK: \t__taint_sink(p1.string)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/struct_field_006_F/struct_field_006_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/flow_sensitive/asynchronous/asynchronous_execution_001_T/asynchronous_execution_001_T": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/flow_sensitive/asynchronous/asynchronous_execution_002_F/asynchronous_execution_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/flow_sensitive/defer_exectution/defer_exectution_001_T/defer_exectution_001_T": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/flow_sensitive/defer_exectution/defer_exectution_002_F/defer_exectution_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_001_T/for_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_001_T/for_001_T.go\nLine 16: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_001_T/for_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_001_T/for_001_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: for_001_T(__taint_src)\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_001_T/for_001_T.go\n AffectedNodeName: for_001_T\n 23: CALL: for_001_T(__taint_src)\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_001_T/for_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func for_001_T(__taint_src string) {\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_001_T/for_001_T.go\n AffectedNodeName: res\n 15: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_001_T/for_001_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t\t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_002_F/for_002_F": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_002_F/for_002_F.go\nLine 15: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_002_F/for_002_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_002_F/for_002_F.go\n AffectedNodeName: __taint_src\n 23: SOURCE: for_002_F(__taint_src)\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_002_F/for_002_F.go\n AffectedNodeName: for_002_F\n 23: CALL: for_002_F(__taint_src)\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_002_F/for_002_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func for_002_F(__taint_src string) {\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_002_F/for_002_F.go\n AffectedNodeName: res\n 16: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_002_F/for_002_F.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t\t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_003_T/for_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_003_T/for_003_T.go\nLine 16: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_003_T/for_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_003_T/for_003_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: for_003_T(__taint_src)\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_003_T/for_003_T.go\n AffectedNodeName: for_003_T\n 23: CALL: for_003_T(__taint_src)\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_003_T/for_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func for_003_T(__taint_src string) {\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_003_T/for_003_T.go\n AffectedNodeName: res\n 15: Var Pass: \tfor res = __taint_src; i < 1; i++ {\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_003_T/for_003_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t\t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_004_F/for_004_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_001_T/array_obj_sensitive_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_001_T/array_obj_sensitive_001_T.go\nLine 16: __taint_sink(str)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_001_T/array_obj_sensitive_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_001_T/array_obj_sensitive_001_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: array_obj_sensitive_001_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_001_T/array_obj_sensitive_001_T.go\n AffectedNodeName: array_obj_sensitive_001_T\n 23: CALL: array_obj_sensitive_001_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_001_T/array_obj_sensitive_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func array_obj_sensitive_001_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_001_T/array_obj_sensitive_001_T.go\n AffectedNodeName: str\n 13: Var Pass: \tvar str = [3]string{__taint_src, \"b\", \"c\"}\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_001_T/array_obj_sensitive_001_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(str)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_002_F/array_obj_sensitive_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_003_T/array_obj_sensitive_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_003_T/array_obj_sensitive_003_T.go\nLine 16: __taint_sink(str)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_003_T/array_obj_sensitive_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_003_T/array_obj_sensitive_003_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: array_obj_sensitive_003_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_003_T/array_obj_sensitive_003_T.go\n AffectedNodeName: array_obj_sensitive_003_T\n 23: CALL: array_obj_sensitive_003_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_003_T/array_obj_sensitive_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func array_obj_sensitive_003_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_003_T/array_obj_sensitive_003_T.go\n AffectedNodeName: str\n 13: Var Pass: \tvar str = [3][1]string{[1]string{__taint_src}, [1]string{\"b\"}, [1]string{\"c\"}}\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_003_T/array_obj_sensitive_003_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(str)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_004_F/array_obj_sensitive_004_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_007_T/array_obj_sensitive_007_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_007_T/array_obj_sensitive_007_T.go\nLine 16: __taint_sink(str)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_007_T/array_obj_sensitive_007_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_007_T/array_obj_sensitive_007_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: array_obj_sensitive_007_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_007_T/array_obj_sensitive_007_T.go\n AffectedNodeName: array_obj_sensitive_007_T\n 22: CALL: array_obj_sensitive_007_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_007_T/array_obj_sensitive_007_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func array_obj_sensitive_007_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_007_T/array_obj_sensitive_007_T.go\n AffectedNodeName: str\n 13: Var Pass: \tvar str = [...]string{__taint_src, \"b\", \"c\"}\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_007_T/array_obj_sensitive_007_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(str)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_008_F/array_obj_sensitive_008_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_001_T/map_obj_sensitive_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_001_T/map_obj_sensitive_001_T.go\nLine 17: __taint_sink(m)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_001_T/map_obj_sensitive_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_001_T/map_obj_sensitive_001_T.go\n AffectedNodeName: __taint_src\n 24: SOURCE: map_obj_sensitive_001_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_001_T/map_obj_sensitive_001_T.go\n AffectedNodeName: map_obj_sensitive_001_T\n 24: CALL: map_obj_sensitive_001_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_001_T/map_obj_sensitive_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func map_obj_sensitive_001_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_001_T/map_obj_sensitive_001_T.go\n AffectedNodeName: m[\"key1\"]\n 15: Var Pass: \tm[\"key1\"] = __taint_src\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_001_T/map_obj_sensitive_001_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(m)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_002_T/map_obj_sensitive_002_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_002_T/map_obj_sensitive_002_T.go\nLine 15: __taint_sink(m)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_002_T/map_obj_sensitive_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_002_T/map_obj_sensitive_002_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: map_obj_sensitive_002_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_002_T/map_obj_sensitive_002_T.go\n AffectedNodeName: map_obj_sensitive_002_T\n 22: CALL: map_obj_sensitive_002_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_002_T/map_obj_sensitive_002_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func map_obj_sensitive_002_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_002_T/map_obj_sensitive_002_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(m)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_003_F/map_obj_sensitive_003_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_004_T/map_obj_sensitive_004_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_004_T/map_obj_sensitive_004_T.go\nLine 20: __taint_sink(m)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_004_T/map_obj_sensitive_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_004_T/map_obj_sensitive_004_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: map_obj_sensitive_004_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_004_T/map_obj_sensitive_004_T.go\n AffectedNodeName: map_obj_sensitive_004_T\n 27: CALL: map_obj_sensitive_004_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_004_T/map_obj_sensitive_004_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func map_obj_sensitive_004_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_004_T/map_obj_sensitive_004_T.go\n AffectedNodeName: m\n 13: Var Pass: \tm := map[string]string{\n 14: Var Pass: \t\t\"key1\": __taint_src,\n 15: Var Pass: \t}\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_004_T/map_obj_sensitive_004_T.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t__taint_sink(m)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_005_F/map_obj_sensitive_005_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_001_T/slice_obj_sensitive_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_001_T/slice_obj_sensitive_001_T.go\nLine 18: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_001_T/slice_obj_sensitive_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_001_T/slice_obj_sensitive_001_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: slice_001slice_obj_sensitive_001_T_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_001_T/slice_obj_sensitive_001_T.go\n AffectedNodeName: slice_001slice_obj_sensitive_001_T_T\n 25: CALL: slice_001slice_obj_sensitive_001_T_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_001_T/slice_obj_sensitive_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func slice_001slice_obj_sensitive_001_T_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_001_T/slice_obj_sensitive_001_T.go\n AffectedNodeName: arr\n 13: Var Pass: \tvar arr [3]string = [3]string{__taint_src, \"b\", \"c\"}\n /sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_001_T/slice_obj_sensitive_001_T.go\n AffectedNodeName: s\n 17: Var Pass: \ts = arr[:]\n /sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_001_T/slice_obj_sensitive_001_T.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t__taint_sink(s)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_002_F/slice_obj_sensitive_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_003_T/slice_obj_sensitive_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_003_T/slice_obj_sensitive_003_T.go\nLine 24: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_003_T/slice_obj_sensitive_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_003_T/slice_obj_sensitive_003_T.go\n AffectedNodeName: __taint_src\n 31: SOURCE: slice_obj_sensitive_003_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_003_T/slice_obj_sensitive_003_T.go\n AffectedNodeName: slice_obj_sensitive_003_T\n 31: CALL: slice_obj_sensitive_003_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_003_T/slice_obj_sensitive_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func slice_obj_sensitive_003_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_003_T/slice_obj_sensitive_003_T.go\n AffectedNodeName: s\n 13: Var Pass: \ts := [][]string{\n 14: Var Pass: \t\t[]string{\"a\"},\n 15: Var Pass: \t\t[]string{\"b\", \"c\"},\n 16: Var Pass: \t\t[]string{\"d\", \"e\", __taint_src},\n 17: Var Pass: \t}\n /sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_003_T/slice_obj_sensitive_003_T.go\n AffectedNodeName: __taint_sink\n 24: SINK: \t__taint_sink(s)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_004_F/slice_obj_sensitive_004_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_001_F/interface_class_001_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_002_T/interface_class_002_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_002_T/interface_class_002_T.go\nLine 41: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_002_T/interface_class_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_002_T/interface_class_002_T.go\n AffectedNodeName: __taint_src\n 48: SOURCE: interface_class_002_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_002_T/interface_class_002_T.go\n AffectedNodeName: interface_class_002_T\n 48: CALL: interface_class_002_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_002_T/interface_class_002_T.go\n AffectedNodeName: __taint_src\n 38: ARG PASS: func interface_class_002_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_002_T/interface_class_002_T.go\n AffectedNodeName: process\n 40: CALL: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_002_T/interface_class_002_T.go\n AffectedNodeName: process\n 40: CALL RETURN: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_002_T/interface_class_002_T.go\n AffectedNodeName: res\n 40: Var Pass: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_002_T/interface_class_002_T.go\n AffectedNodeName: __taint_sink\n 41: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_003_F/interface_class_003_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_004_T/interface_class_004_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_004_T/interface_class_004_T.go\nLine 47: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_004_T/interface_class_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_004_T/interface_class_004_T.go\n AffectedNodeName: __taint_src\n 54: SOURCE: interface_class_004_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_004_T/interface_class_004_T.go\n AffectedNodeName: interface_class_004_T\n 54: CALL: interface_class_004_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_004_T/interface_class_004_T.go\n AffectedNodeName: __taint_src\n 44: ARG PASS: func interface_class_004_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_004_T/interface_class_004_T.go\n AffectedNodeName: process\n 46: CALL: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_004_T/interface_class_004_T.go\n AffectedNodeName: process\n 46: CALL RETURN: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_004_T/interface_class_004_T.go\n AffectedNodeName: res\n 46: Var Pass: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_004_T/interface_class_004_T.go\n AffectedNodeName: __taint_sink\n 47: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_005_F/interface_class_005_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_006_T/interface_class_006_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_006_T/interface_class_006_T.go\nLine 39: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_006_T/interface_class_006_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_006_T/interface_class_006_T.go\n AffectedNodeName: __taint_src\n 46: SOURCE: interface_class_006_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_006_T/interface_class_006_T.go\n AffectedNodeName: interface_class_006_T\n 46: CALL: interface_class_006_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_006_T/interface_class_006_T.go\n AffectedNodeName: __taint_src\n 36: ARG PASS: func interface_class_006_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_006_T/interface_class_006_T.go\n AffectedNodeName: process\n 38: CALL: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_006_T/interface_class_006_T.go\n AffectedNodeName: process\n 38: CALL RETURN: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_006_T/interface_class_006_T.go\n AffectedNodeName: res\n 38: Var Pass: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_006_T/interface_class_006_T.go\n AffectedNodeName: __taint_sink\n 39: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_007_F/interface_class_007_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_008_T/interface_class_008_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_008_T/interface_class_008_T.go\nLine 34: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_008_T/interface_class_008_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_008_T/interface_class_008_T.go\n AffectedNodeName: __taint_src\n 41: SOURCE: interface_class_008_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_008_T/interface_class_008_T.go\n AffectedNodeName: interface_class_008_T\n 41: CALL: interface_class_008_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_008_T/interface_class_008_T.go\n AffectedNodeName: __taint_src\n 31: ARG PASS: func interface_class_008_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_008_T/interface_class_008_T.go\n AffectedNodeName: process\n 33: CALL: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_008_T/interface_class_008_T.go\n AffectedNodeName: process\n 33: CALL RETURN: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_008_T/interface_class_008_T.go\n AffectedNodeName: res\n 33: Var Pass: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_008_T/interface_class_008_T.go\n AffectedNodeName: __taint_sink\n 34: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_009_F/interface_class_009_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_010_T/interface_class_010_T": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_011_F/interface_class_011_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_012_T/interface_class_012_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_012_T/interface_class_012_T.go\nLine 46: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_012_T/interface_class_012_T.go\",\"functionName\":\"interface_class_012_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_012_T/interface_class_012_T.go\n AffectedNodeName: __taint_src\n 43: SOURCE: func interface_class_012_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_012_T/interface_class_012_T.go\n AffectedNodeName: processArg\n 45: CALL: \tres := processArg(iTestService, __taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_012_T/interface_class_012_T.go\n AffectedNodeName: processArg\n 45: CALL RETURN: \tres := processArg(iTestService, __taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_012_T/interface_class_012_T.go\n AffectedNodeName: res\n 45: Var Pass: \tres := processArg(iTestService, __taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_012_T/interface_class_012_T.go\n AffectedNodeName: __taint_sink\n 46: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_007_T/struct_007_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/struct/struct_007_T/struct_007_T.go\nLine 24: __taint_sink(p)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/struct/struct_007_T/struct_007_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/struct/struct_007_T/struct_007_T.go\n AffectedNodeName: __taint_src\n 31: SOURCE: struct_007_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_007_T/struct_007_T.go\n AffectedNodeName: struct_007_T\n 31: CALL: struct_007_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_007_T/struct_007_T.go\n AffectedNodeName: __taint_src\n 16: ARG PASS: func struct_007_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/struct/struct_007_T/struct_007_T.go\n AffectedNodeName: p\n 17: Var Pass: \tp := A{\n 18: Var Pass: \t\tdata: __taint_src,\n 19: Var Pass: \t}\n /sast-go/cases/accuracy/object_sensitive/struct/struct_007_T/struct_007_T.go\n AffectedNodeName: __taint_sink\n 24: SINK: \t__taint_sink(p)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_008_F/struct_008_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_001_T/struct_deep10_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_001_T/struct_deep10_001_T.go\nLine 57: __taint_sink(obj1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_001_T/struct_deep10_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_001_T/struct_deep10_001_T.go\n AffectedNodeName: __taint_src\n 65: SOURCE: struct_deep10_001_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_001_T/struct_deep10_001_T.go\n AffectedNodeName: struct_deep10_001_T\n 65: CALL: struct_deep10_001_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_001_T/struct_deep10_001_T.go\n AffectedNodeName: __taint_src\n 50: ARG PASS: func struct_deep10_001_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_001_T/struct_deep10_001_T.go\n AffectedNodeName: obj1.deepA02.deepA03.deepA04.deepA05.deepA06.deepA07.deepA08.deepA09.deepA10.deepA11\n 55: Var Pass: \tobj1.deepA02.deepA03.deepA04.deepA05.deepA06.deepA07.deepA08.deepA09.deepA10.deepA11 = __taint_src\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_001_T/struct_deep10_001_T.go\n AffectedNodeName: __taint_sink\n 57: SINK: \t__taint_sink(obj1)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_002_F/struct_deep10_002_F": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_002_F/struct_deep10_002_F.go\nLine 57: __taint_sink(obj2)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_002_F/struct_deep10_002_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_002_F/struct_deep10_002_F.go\n AffectedNodeName: __taint_src\n 65: SOURCE: struct_deep10_002_F(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_002_F/struct_deep10_002_F.go\n AffectedNodeName: struct_deep10_002_F\n 65: CALL: struct_deep10_002_F(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_002_F/struct_deep10_002_F.go\n AffectedNodeName: __taint_src\n 50: ARG PASS: func struct_deep10_002_F(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_002_F/struct_deep10_002_F.go\n AffectedNodeName: obj1.deepA02.deepA03.deepA04.deepA05.deepA06.deepA07.deepA08.deepA09.deepA10.deepA11\n 55: Var Pass: \tobj1.deepA02.deepA03.deepA04.deepA05.deepA06.deepA07.deepA08.deepA09.deepA10.deepA11 = __taint_src\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_002_F/struct_deep10_002_F.go\n AffectedNodeName: __taint_sink\n 57: SINK: \t__taint_sink(obj2)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_001_T/struct_deep3_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_001_T/struct_deep3_001_T.go\nLine 31: __taint_sink(obj1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_001_T/struct_deep3_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_001_T/struct_deep3_001_T.go\n AffectedNodeName: __taint_src\n 39: SOURCE: struct_deep3_001_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_001_T/struct_deep3_001_T.go\n AffectedNodeName: struct_deep3_001_T\n 39: CALL: struct_deep3_001_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_001_T/struct_deep3_001_T.go\n AffectedNodeName: __taint_src\n 24: ARG PASS: func struct_deep3_001_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_001_T/struct_deep3_001_T.go\n AffectedNodeName: obj1.deepC02.deepC03.deepC04\n 29: Var Pass: \tobj1.deepC02.deepC03.deepC04 = __taint_src\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_001_T/struct_deep3_001_T.go\n AffectedNodeName: __taint_sink\n 31: SINK: \t__taint_sink(obj1)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_002_F/struct_deep3_002_F": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_002_F/struct_deep3_002_F.go\nLine 30: __taint_sink(obj2)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_002_F/struct_deep3_002_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_002_F/struct_deep3_002_F.go\n AffectedNodeName: __taint_src\n 38: SOURCE: struct_deep3_002_F(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_002_F/struct_deep3_002_F.go\n AffectedNodeName: struct_deep3_002_F\n 38: CALL: struct_deep3_002_F(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_002_F/struct_deep3_002_F.go\n AffectedNodeName: __taint_src\n 24: ARG PASS: func struct_deep3_002_F(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_002_F/struct_deep3_002_F.go\n AffectedNodeName: obj1.deepC02.deepC03.deepC04\n 29: Var Pass: \tobj1.deepC02.deepC03.deepC04 = __taint_src\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_002_F/struct_deep3_002_F.go\n AffectedNodeName: __taint_sink\n 30: SINK: \t__taint_sink(obj2)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_003_T/struct_deep3_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_003_T/struct_deep3_003_T.go\nLine 34: __taint_sink(obj1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_003_T/struct_deep3_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_003_T/struct_deep3_003_T.go\n AffectedNodeName: __taint_src\n 42: SOURCE: struct_deep3_003_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_003_T/struct_deep3_003_T.go\n AffectedNodeName: struct_deep3_003_T\n 42: CALL: struct_deep3_003_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_003_T/struct_deep3_003_T.go\n AffectedNodeName: __taint_src\n 24: ARG PASS: func struct_deep3_003_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_003_T/struct_deep3_003_T.go\n AffectedNodeName: deepC03\n 29: Var Pass: \tdeepC03 := DeepC03{\n 30: Var Pass: \t\tdeepC04: __taint_src,\n 31: Var Pass: \t}\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_003_T/struct_deep3_003_T.go\n AffectedNodeName: obj1.deepC02.deepC03\n 32: Var Pass: \tobj1.deepC02.deepC03 = deepC03\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_003_T/struct_deep3_003_T.go\n AffectedNodeName: __taint_sink\n 34: SINK: \t__taint_sink(obj1)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_004_F/struct_deep3_004_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_001_T/struct_deep5_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_001_T/struct_deep5_001_T.go\nLine 35: __taint_sink(obj1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_001_T/struct_deep5_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_001_T/struct_deep5_001_T.go\n AffectedNodeName: __taint_src\n 43: SOURCE: struct_deep5_001_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_001_T/struct_deep5_001_T.go\n AffectedNodeName: struct_deep5_001_T\n 43: CALL: struct_deep5_001_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_001_T/struct_deep5_001_T.go\n AffectedNodeName: __taint_src\n 28: ARG PASS: func struct_deep5_001_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_001_T/struct_deep5_001_T.go\n AffectedNodeName: obj1.deepB02.deepB03.deepB04.deepB05\n 33: Var Pass: \tobj1.deepB02.deepB03.deepB04.deepB05 = __taint_src\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_001_T/struct_deep5_001_T.go\n AffectedNodeName: __taint_sink\n 35: SINK: \t__taint_sink(obj1)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_002_F/struct_deep5_002_F": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_002_F/struct_deep5_002_F.go\nLine 35: __taint_sink(obj2)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_002_F/struct_deep5_002_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_002_F/struct_deep5_002_F.go\n AffectedNodeName: __taint_src\n 43: SOURCE: struct_deep5_002_F(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_002_F/struct_deep5_002_F.go\n AffectedNodeName: struct_deep5_002_F\n 43: CALL: struct_deep5_002_F(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_002_F/struct_deep5_002_F.go\n AffectedNodeName: __taint_src\n 28: ARG PASS: func struct_deep5_002_F(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_002_F/struct_deep5_002_F.go\n AffectedNodeName: obj1.deepB02.deepB03.deepB04.deepB05\n 33: Var Pass: \tobj1.deepB02.deepB03.deepB04.deepB05 = __taint_src\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_002_F/struct_deep5_002_F.go\n AffectedNodeName: __taint_sink\n 35: SINK: \t__taint_sink(obj2)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_003_T/struct_deep5_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_003_T/struct_deep5_003_T.go\nLine 42: __taint_sink(obj1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_003_T/struct_deep5_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_003_T/struct_deep5_003_T.go\n AffectedNodeName: __taint_src\n 50: SOURCE: struct_deep5_003_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_003_T/struct_deep5_003_T.go\n AffectedNodeName: struct_deep5_003_T\n 50: CALL: struct_deep5_003_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_003_T/struct_deep5_003_T.go\n AffectedNodeName: __taint_src\n 32: ARG PASS: func struct_deep5_003_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_003_T/struct_deep5_003_T.go\n AffectedNodeName: deepB05\n 37: Var Pass: \tdeepB05 := DeepB05{\n 38: Var Pass: \t\tdeepB06: __taint_src,\n 39: Var Pass: \t}\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_003_T/struct_deep5_003_T.go\n AffectedNodeName: obj1.deepB02.deepB03.deepB04.deepB05\n 40: Var Pass: \tobj1.deepB02.deepB03.deepB04.deepB05 = deepB05\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_003_T/struct_deep5_003_T.go\n AffectedNodeName: __taint_sink\n 42: SINK: \t__taint_sink(obj1)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_004_F/struct_deep5_004_F": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_004_F/struct_deep5_004_F.go\nLine 42: __taint_sink(obj2)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_004_F/struct_deep5_004_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_004_F/struct_deep5_004_F.go\n AffectedNodeName: __taint_src\n 50: SOURCE: struct_deep5_004_F(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_004_F/struct_deep5_004_F.go\n AffectedNodeName: struct_deep5_004_F\n 50: CALL: struct_deep5_004_F(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_004_F/struct_deep5_004_F.go\n AffectedNodeName: __taint_src\n 32: ARG PASS: func struct_deep5_004_F(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_004_F/struct_deep5_004_F.go\n AffectedNodeName: deepB05\n 37: Var Pass: \tdeepB05 := DeepB05{\n 38: Var Pass: \t\tdeepB06: __taint_src,\n 39: Var Pass: \t}\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_004_F/struct_deep5_004_F.go\n AffectedNodeName: obj1.deepB02.deepB03.deepB04.deepB05\n 40: Var Pass: \tobj1.deepB02.deepB03.deepB04.deepB05 = deepB05\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_004_F/struct_deep5_004_F.go\n AffectedNodeName: __taint_sink\n 42: SINK: \t__taint_sink(obj2)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: break_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\n AffectedNodeName: break_003_T\n 25: CALL: break_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func break_003_T(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\n AffectedNodeName: res\n 16: Var Pass: \t\t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t\t__taint_sink(res)\n\n------------- 2: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: break_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\n AffectedNodeName: break_003_T\n 25: CALL: break_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func break_003_T(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\n AffectedNodeName: res\n 16: Var Pass: \t\t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\n AffectedNodeName: __taint_sink\n 18: CALL: \t\t__taint_sink(res)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t\t__taint_sink(res)\n==========================================================\n #Total-findings:2\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\nLine 19: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\n AffectedNodeName: __taint_src\n 26: SOURCE: break_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\n AffectedNodeName: break_004_F\n 26: CALL: break_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func break_004_F(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\n AffectedNodeName: res\n 16: Var Pass: \t\t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\n AffectedNodeName: __taint_sink\n 19: SINK: \t\t__taint_sink(res)\n\n------------- 2: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\nLine 19: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\n AffectedNodeName: __taint_src\n 26: SOURCE: break_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\n AffectedNodeName: break_004_F\n 26: CALL: break_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func break_004_F(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\n AffectedNodeName: res\n 16: Var Pass: \t\t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\n AffectedNodeName: __taint_sink\n 19: CALL: \t\t__taint_sink(res)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\n AffectedNodeName: __taint_sink\n 19: SINK: \t\t__taint_sink(res)\n==========================================================\n #Total-findings:2\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_003_T/break_label_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_003_T/break_label_003_T.go\nLine 21: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_003_T/break_label_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_003_T/break_label_003_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: break_label_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_003_T/break_label_003_T.go\n AffectedNodeName: break_label_003_T\n 27: CALL: break_label_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_003_T/break_label_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func break_label_003_T(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_003_T/break_label_003_T.go\n AffectedNodeName: res\n 17: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_003_T/break_label_003_T.go\n AffectedNodeName: __taint_sink\n 21: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_004_F/break_label_004_F": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_004_F/break_label_004_F.go\nLine 21: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_004_F/break_label_004_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_004_F/break_label_004_F.go\n AffectedNodeName: __taint_src\n 27: SOURCE: break_label_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_004_F/break_label_004_F.go\n AffectedNodeName: break_label_004_F\n 27: CALL: break_label_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_004_F/break_label_004_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func break_label_004_F(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_004_F/break_label_004_F.go\n AffectedNodeName: res\n 18: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_004_F/break_label_004_F.go\n AffectedNodeName: __taint_sink\n 21: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_003_T/continue_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_003_T/continue_003_T.go\nLine 20: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_003_T/continue_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_003_T/continue_003_T.go\n AffectedNodeName: __taint_src\n 26: SOURCE: continue_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_003_T/continue_003_T.go\n AffectedNodeName: continue_003_T\n 26: CALL: continue_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_003_T/continue_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func continue_003_T(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_003_T/continue_003_T.go\n AffectedNodeName: res\n 16: Var Pass: \t\t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_003_T/continue_003_T.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_004_F/continue_004_F": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_004_F/continue_004_F.go\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_004_F/continue_004_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_004_F/continue_004_F.go\n AffectedNodeName: __taint_src\n 26: SOURCE: continue_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_004_F/continue_004_F.go\n AffectedNodeName: continue_004_F\n 26: CALL: continue_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_004_F/continue_004_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func continue_004_F(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_004_F/continue_004_F.go\n AffectedNodeName: res\n 16: Var Pass: \t\t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_004_F/continue_004_F.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t\t\t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/fallthrough_003_T/fallthrough_003_T": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/fallthrough_004_F/fallthrough_004_F": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/fallthrough_004_F/fallthrough_004_F.go\nLine 24: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/fallthrough_004_F/fallthrough_004_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/fallthrough_004_F/fallthrough_004_F.go\n AffectedNodeName: __taint_src\n 30: SOURCE: fallthrough_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/fallthrough_004_F/fallthrough_004_F.go\n AffectedNodeName: fallthrough_004_F\n 30: CALL: fallthrough_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/fallthrough_004_F/fallthrough_004_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func fallthrough_004_F(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/fallthrough_004_F/fallthrough_004_F.go\n AffectedNodeName: res\n 18: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/fallthrough_004_F/fallthrough_004_F.go\n AffectedNodeName: __taint_sink\n 24: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/goto_003_T/goto_003_T": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/goto_004_F/goto_004_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_003_T/return_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_003_T/return_003_T.go\nLine 16: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_003_T/return_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_003_T/return_003_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: return_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_003_T/return_003_T.go\n AffectedNodeName: return_003_T\n 23: CALL: return_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_003_T/return_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func return_003_T(__taint_src string) string {\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_003_T/return_003_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_004_F/return_004_F": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_004_F/return_004_F.go\nLine 16: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_004_F/return_004_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_004_F/return_004_F.go\n AffectedNodeName: __taint_src\n 23: SOURCE: return_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_004_F/return_004_F.go\n AffectedNodeName: return_004_F\n 23: CALL: return_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_004_F/return_004_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func return_004_F(__taint_src string) string {\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_004_F/return_004_F.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_005_F/conditional_if_005_F": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_005_F/conditional_if_005_F.go\nLine 17: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_005_F/conditional_if_005_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_005_F/conditional_if_005_F.go\n AffectedNodeName: __taint_src\n 24: SOURCE: conditional_if_005_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_005_F/conditional_if_005_F.go\n AffectedNodeName: conditional_if_005_F\n 24: CALL: conditional_if_005_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_005_F/conditional_if_005_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_if_005_F(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_005_F/conditional_if_005_F.go\n AffectedNodeName: res\n 15: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_005_F/conditional_if_005_F.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t\t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_006_F/conditional_if_006_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_007_T/conditional_if_007_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_007_T/conditional_if_007_T.go\nLine 19: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_007_T/conditional_if_007_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_007_T/conditional_if_007_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: conditional_if_007_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_007_T/conditional_if_007_T.go\n AffectedNodeName: conditional_if_007_T\n 25: CALL: conditional_if_007_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_007_T/conditional_if_007_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_if_007_T(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_007_T/conditional_if_007_T.go\n AffectedNodeName: res\n 15: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_007_T/conditional_if_007_T.go\n AffectedNodeName: __taint_sink\n 19: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_008_F/conditional_if_008_F": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_008_F/conditional_if_008_F.go\nLine 19: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_008_F/conditional_if_008_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_008_F/conditional_if_008_F.go\n AffectedNodeName: __taint_src\n 25: SOURCE: conditional_if_008_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_008_F/conditional_if_008_F.go\n AffectedNodeName: conditional_if_008_F\n 25: CALL: conditional_if_008_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_008_F/conditional_if_008_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_if_008_F(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_008_F/conditional_if_008_F.go\n AffectedNodeName: res\n 17: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_008_F/conditional_if_008_F.go\n AffectedNodeName: __taint_sink\n 19: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_stmt_003_F/conditional_switch_stmt_003_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_stmt_004_F/conditional_switch_stmt_004_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_stmt_005_T/conditional_switch_stmt_005_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_stmt_005_T/conditional_switch_stmt_005_T.go\nLine 20: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_stmt_005_T/conditional_switch_stmt_005_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_stmt_005_T/conditional_switch_stmt_005_T.go\n AffectedNodeName: __taint_src\n 26: SOURCE: conditional_switch_stmt_005_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_stmt_005_T/conditional_switch_stmt_005_T.go\n AffectedNodeName: conditional_switch_stmt_005_T\n 26: CALL: conditional_switch_stmt_005_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_stmt_005_T/conditional_switch_stmt_005_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_switch_stmt_005_T(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_stmt_005_T/conditional_switch_stmt_005_T.go\n AffectedNodeName: res\n 18: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_stmt_005_T/conditional_switch_stmt_005_T.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_stmt_006_F/conditional_switch_stmt_006_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_009_T/conditional_if_009_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_009_T/conditional_if_009_T.go\nLine 19: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_009_T/conditional_if_009_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_009_T/conditional_if_009_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: conditional_if_009_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_009_T/conditional_if_009_T.go\n AffectedNodeName: conditional_if_009_T\n 25: CALL: conditional_if_009_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_009_T/conditional_if_009_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_if_009_T(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_009_T/conditional_if_009_T.go\n AffectedNodeName: res\n 15: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_009_T/conditional_if_009_T.go\n AffectedNodeName: __taint_sink\n 19: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_010_F/conditional_if_010_F": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_010_F/conditional_if_010_F.go\nLine 19: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_010_F/conditional_if_010_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_010_F/conditional_if_010_F.go\n AffectedNodeName: __taint_src\n 25: SOURCE: conditional_if_010_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_010_F/conditional_if_010_F.go\n AffectedNodeName: conditional_if_010_F\n 25: CALL: conditional_if_010_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_010_F/conditional_if_010_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_if_010_F(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_010_F/conditional_if_010_F.go\n AffectedNodeName: res\n 17: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_010_F/conditional_if_010_F.go\n AffectedNodeName: __taint_sink\n 19: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_007_T/conditional_switch_stmt_007_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_007_T/conditional_switch_stmt_007_T.go\nLine 20: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_007_T/conditional_switch_stmt_007_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_007_T/conditional_switch_stmt_007_T.go\n AffectedNodeName: __taint_src\n 26: SOURCE: conditional_switch_stmt_007_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_007_T/conditional_switch_stmt_007_T.go\n AffectedNodeName: conditional_switch_stmt_007_T\n 26: CALL: conditional_switch_stmt_007_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_007_T/conditional_switch_stmt_007_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_switch_stmt_007_T(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_007_T/conditional_switch_stmt_007_T.go\n AffectedNodeName: res\n 16: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_007_T/conditional_switch_stmt_007_T.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_008_F/conditional_switch_stmt_008_F": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_008_F/conditional_switch_stmt_008_F.go\nLine 20: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_008_F/conditional_switch_stmt_008_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_008_F/conditional_switch_stmt_008_F.go\n AffectedNodeName: __taint_src\n 26: SOURCE: conditional_switch_stmt_008_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_008_F/conditional_switch_stmt_008_F.go\n AffectedNodeName: conditional_switch_stmt_008_F\n 26: CALL: conditional_switch_stmt_008_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_008_F/conditional_switch_stmt_008_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_switch_stmt_008_F(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_008_F/conditional_switch_stmt_008_F.go\n AffectedNodeName: res\n 16: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_008_F/conditional_switch_stmt_008_F.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_003_T/for_body_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_003_T/for_body_003_T.go\nLine 17: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_003_T/for_body_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_003_T/for_body_003_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: for_body_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_003_T/for_body_003_T.go\n AffectedNodeName: for_body_003_T\n 23: CALL: for_body_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_003_T/for_body_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func for_body_003_T(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_003_T/for_body_003_T.go\n AffectedNodeName: res\n 15: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_003_T/for_body_003_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_004_F/for_body_004_F": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_004_F/for_body_004_F.go\nLine 16: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_004_F/for_body_004_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_004_F/for_body_004_F.go\n AffectedNodeName: __taint_src\n 22: SOURCE: for_body_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_004_F/for_body_004_F.go\n AffectedNodeName: for_body_004_F\n 22: CALL: for_body_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_004_F/for_body_004_F.go\n AffectedNodeName: __taint_src\n 11: ARG PASS: func for_body_004_F(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_004_F/for_body_004_F.go\n AffectedNodeName: res\n 14: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_004_F/for_body_004_F.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\nLine 26: __taint_sink(s.Field(i))\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: __taint_src\n 34: SOURCE: reflect_call_001_T(__taint_src)\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: reflect_call_001_T\n 34: CALL: reflect_call_001_T(__taint_src)\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: __taint_src\n 21: ARG PASS: func reflect_call_001_T(__taint_src string) {\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: t\n 22: Var Pass: \tt := T{123, __taint_src}\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: s\n 23: Var Pass: \ts := reflect.ValueOf(t)\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: __taint_sink\n 26: SINK: \t\t__taint_sink(s.Field(i))\n\n------------- 2: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\nLine 26: __taint_sink(s.Field(i))\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: __taint_src\n 34: SOURCE: reflect_call_001_T(__taint_src)\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: reflect_call_001_T\n 34: CALL: reflect_call_001_T(__taint_src)\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: __taint_src\n 21: ARG PASS: func reflect_call_001_T(__taint_src string) {\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: t\n 22: Var Pass: \tt := T{123, __taint_src}\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: s\n 23: Var Pass: \ts := reflect.ValueOf(t)\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: __taint_sink\n 26: CALL: \t\t__taint_sink(s.Field(i))\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: __taint_sink\n 26: SINK: \t\t__taint_sink(s.Field(i))\n==========================================================\n #Total-findings:2\n==========================================================", "/benchmarks/sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_002_F/reflect_call_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/alias/alias_001_F/alias_001_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/alias/alias_002_T/alias_002_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/alias/alias_002_T/alias_002_T.go\nLine 21: __taint_sink(a.Value)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/alias/alias_002_T/alias_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/alias/alias_002_T/alias_002_T.go\n AffectedNodeName: __taint_src\n 28: SOURCE: alias_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/alias/alias_002_T/alias_002_T.go\n AffectedNodeName: alias_002_T\n 28: CALL: alias_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/alias/alias_002_T/alias_002_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func alias_002_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/alias/alias_002_T/alias_002_T.go\n AffectedNodeName: b.Value\n 19: Var Pass: \tb.Value = __taint_src\n /sast-go/cases/completeness/single_app_tracing/alias/alias_002_T/alias_002_T.go\n AffectedNodeName: __taint_sink\n 21: SINK: \t__taint_sink(a.Value)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_001_T/asynchronous_goroutine_channel_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_001_T/asynchronous_goroutine_channel_001_T.go\nLine 17: __taint_sink(popch)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_001_T/asynchronous_goroutine_channel_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_001_T/asynchronous_goroutine_channel_001_T.go\n AffectedNodeName: __taint_src\n 24: SOURCE: asynchronous_goroutine_channel_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_001_T/asynchronous_goroutine_channel_001_T.go\n AffectedNodeName: asynchronous_goroutine_channel_001_T\n 24: CALL: asynchronous_goroutine_channel_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_001_T/asynchronous_goroutine_channel_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func asynchronous_goroutine_channel_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_001_T/asynchronous_goroutine_channel_001_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(<-ch)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_002_F/asynchronous_goroutine_channel_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_003_T/asynchronous_goroutine_channel_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_003_T/asynchronous_goroutine_channel_003_T.go\nLine 30: __taint_sink(message)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_003_T/asynchronous_goroutine_channel_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_003_T/asynchronous_goroutine_channel_003_T.go\n AffectedNodeName: __taint_src\n 40: SOURCE: asynchronous_goroutine_channel_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_003_T/asynchronous_goroutine_channel_003_T.go\n AffectedNodeName: asynchronous_goroutine_channel_003_T\n 40: CALL: asynchronous_goroutine_channel_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_003_T/asynchronous_goroutine_channel_003_T.go\n AffectedNodeName: __taint_src\n 16: ARG PASS: func asynchronous_goroutine_channel_003_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_003_T/asynchronous_goroutine_channel_003_T.go\n AffectedNodeName: __single_module__.%dir_/.asynchronous_goroutine_channel_003_T.\n 27: CALL: \tgo func() {\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_003_T/asynchronous_goroutine_channel_003_T.go\n AffectedNodeName: __single_module__.%dir_/.asynchronous_goroutine_channel_003_T.\n 27: ARG PASS: \tgo func() {\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_003_T/asynchronous_goroutine_channel_003_T.go\n AffectedNodeName: __taint_sink\n 30: SINK: \t\t__taint_sink(message)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_004_F/asynchronous_goroutine_channel_004_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_multiple_select_001_T/asynchronous_multiple_select_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_multiple_select_001_T/asynchronous_multiple_select_001_T.go\nLine 33: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_multiple_select_001_T/asynchronous_multiple_select_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_multiple_select_001_T/asynchronous_multiple_select_001_T.go\n AffectedNodeName: __taint_src\n 45: SOURCE: asynchronous_multiple_select_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_multiple_select_001_T/asynchronous_multiple_select_001_T.go\n AffectedNodeName: asynchronous_multiple_select_001_T\n 45: CALL: asynchronous_multiple_select_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_multiple_select_001_T/asynchronous_multiple_select_001_T.go\n AffectedNodeName: __taint_src\n 17: ARG PASS: func asynchronous_multiple_select_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_multiple_select_001_T/asynchronous_multiple_select_001_T.go\n AffectedNodeName: result\n 22: Var Pass: \t\tresult := __taint_src\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_multiple_select_001_T/asynchronous_multiple_select_001_T.go\n AffectedNodeName: __taint_sink\n 33: SINK: \t\t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_multiple_select_002_F/asynchronous_multiple_select_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_select_001_T/asynchronous_select_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_select_001_T/asynchronous_select_001_T.go\nLine 26: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_select_001_T/asynchronous_select_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_select_001_T/asynchronous_select_001_T.go\n AffectedNodeName: __taint_src\n 36: SOURCE: asynchronous_select_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_select_001_T/asynchronous_select_001_T.go\n AffectedNodeName: asynchronous_select_001_T\n 36: CALL: asynchronous_select_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_select_001_T/asynchronous_select_001_T.go\n AffectedNodeName: __taint_src\n 17: ARG PASS: func asynchronous_select_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_select_001_T/asynchronous_select_001_T.go\n AffectedNodeName: __taint_sink\n 26: SINK: \t\t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_select_002_F/asynchronous_select_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_001_T/synchronization_primitive_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_001_T/synchronization_primitive_001_T.go\nLine 16: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_001_T/synchronization_primitive_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_001_T/synchronization_primitive_001_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: synchronization_primitive_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_001_T/synchronization_primitive_001_T.go\n AffectedNodeName: synchronization_primitive_001_T\n 22: CALL: synchronization_primitive_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_001_T/synchronization_primitive_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func synchronization_primitive_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_001_T/synchronization_primitive_001_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_002_F/synchronization_primitive_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_003_T/synchronization_primitive_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_003_T/synchronization_primitive_003_T.go\nLine 19: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_003_T/synchronization_primitive_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_003_T/synchronization_primitive_003_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: synchronization_primitive_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_003_T/synchronization_primitive_003_T.go\n AffectedNodeName: synchronization_primitive_003_T\n 25: CALL: synchronization_primitive_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_003_T/synchronization_primitive_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func synchronization_primitive_003_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_003_T/synchronization_primitive_003_T.go\n AffectedNodeName: __taint_sink\n 19: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_004_F/synchronization_primitive_004_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T/conditional_if_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T/conditional_if_001_T.go\nLine 14: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T/conditional_if_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T/conditional_if_001_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: conditional_if_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T/conditional_if_001_T.go\n AffectedNodeName: conditional_if_001_T\n 21: CALL: conditional_if_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T/conditional_if_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_if_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T/conditional_if_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t\t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_002_F/conditional_if_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T/conditional_if_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T/conditional_if_003_T.go\nLine 16: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T/conditional_if_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T/conditional_if_003_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: conditional_if_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T/conditional_if_003_T.go\n AffectedNodeName: conditional_if_003_T\n 25: CALL: conditional_if_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T/conditional_if_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_if_003_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T/conditional_if_003_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t\t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_004_F/conditional_if_004_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T/conditional_switch_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T/conditional_switch_001_T.go\nLine 15: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T/conditional_switch_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T/conditional_switch_001_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: conditional_switch_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T/conditional_switch_001_T.go\n AffectedNodeName: conditional_switch_001_T\n 22: CALL: conditional_switch_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T/conditional_switch_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_switch_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T/conditional_switch_001_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t\t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_002_F/conditional_switch_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_003_T/conditional_switch_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_003_T/conditional_switch_003_T.go\nLine 16: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_003_T/conditional_switch_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_003_T/conditional_switch_003_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: conditional_switch_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_003_T/conditional_switch_003_T.go\n AffectedNodeName: conditional_switch_003_T\n 23: CALL: conditional_switch_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_003_T/conditional_switch_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_switch_003_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_003_T/conditional_switch_003_T.go\n AffectedNodeName: data\n 14: Var Pass: \tswitch data := __taint_src; data {\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_003_T/conditional_switch_003_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t\t__taint_sink(data)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_004_F/conditional_switch_004_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_005_T/conditional_switch_005_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_005_T/conditional_switch_005_T.go\nLine 22: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_005_T/conditional_switch_005_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_005_T/conditional_switch_005_T.go\n AffectedNodeName: __taint_src\n 30: SOURCE: conditional_switch_005_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_005_T/conditional_switch_005_T.go\n AffectedNodeName: conditional_switch_005_T\n 30: CALL: conditional_switch_005_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_005_T/conditional_switch_005_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_switch_005_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_005_T/conditional_switch_005_T.go\n AffectedNodeName: __taint_sink\n 22: SINK: \t\t\t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_006_F/conditional_switch_006_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/select_001_T/select_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/select_001_T/select_001_T.go\nLine 18: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/select_001_T/select_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/select_001_T/select_001_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: select_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/select_001_T/select_001_T.go\n AffectedNodeName: select_001_T\n 27: CALL: select_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/select_001_T/select_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func select_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/select_001_T/select_001_T.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t\t__taint_sink(data)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/select_002_F/select_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T/for_body_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T/for_body_001_T.go\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T/for_body_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T/for_body_001_T.go\n AffectedNodeName: __taint_src\n 24: SOURCE: for_body_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T/for_body_001_T.go\n AffectedNodeName: for_body_001_T\n 24: CALL: for_body_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T/for_body_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func for_body_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T/for_body_001_T.go\n AffectedNodeName: res\n 16: Var Pass: \t\tres = __taint_src\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T/for_body_001_T.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_body_002_F/for_body_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T/for_init_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T/for_init_001_T.go\nLine 19: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T/for_init_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T/for_init_001_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: for_init_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T/for_init_001_T.go\n AffectedNodeName: for_init_001_T\n 25: CALL: for_init_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T/for_init_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func for_init_001_T(__taint_src int) {\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T/for_init_001_T.go\n AffectedNodeName: ini\n 16: Var Pass: \tfor ini = __taint_src; j < 10; j++ {\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T/for_init_001_T.go\n AffectedNodeName: res\n 17: Var Pass: \t\tres = res + ini\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T/for_init_001_T.go\n AffectedNodeName: __taint_sink\n 19: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_init_002_F/for_init_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_range_001_T/for_range_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_range_001_T/for_range_001_T.go\nLine 15: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_range_001_T/for_range_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_range_001_T/for_range_001_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: for_range_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_range_001_T/for_range_001_T.go\n AffectedNodeName: for_range_001_T\n 22: CALL: for_range_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_range_001_T/for_range_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func for_range_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_range_001_T/for_range_001_T.go\n AffectedNodeName: m\n 13: Var Pass: \tvar m = map[string]string{\"a\": __taint_src, \"b\": \"2\"}\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_range_001_T/for_range_001_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t\t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_range_002_F/for_range_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T/for_update_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T/for_update_001_T.go\nLine 20: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T/for_update_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T/for_update_001_T.go\n AffectedNodeName: __taint_src\n 26: SOURCE: for_update_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T/for_update_001_T.go\n AffectedNodeName: for_update_001_T\n 26: CALL: for_update_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T/for_update_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func for_update_001_T(__taint_src int) {\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T/for_update_001_T.go\n AffectedNodeName: j\n 16: Var Pass: \tfor ; ini < 2; j = __taint_src {\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T/for_update_001_T.go\n AffectedNodeName: res\n 17: Var Pass: \t\tres = j\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T/for_update_001_T.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_update_002_F/for_update_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/array/array_001_T/array_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/array/array_001_T/array_001_T.go\nLine 14: __taint_sink(str)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/array/array_001_T/array_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_001_T/array_001_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: array_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_001_T/array_001_T.go\n AffectedNodeName: array_001_T\n 21: CALL: array_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_001_T/array_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func array_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_001_T/array_001_T.go\n AffectedNodeName: str\n 13: Var Pass: \tvar str = [3]string{__taint_src, \"b\", \"c\"}\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_001_T/array_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(str)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/array/array_002_F/array_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/array/array_003_T/array_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/array/array_003_T/array_003_T.go\nLine 14: __taint_sink(str)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/array/array_003_T/array_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_003_T/array_003_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: array_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_003_T/array_003_T.go\n AffectedNodeName: array_003_T\n 21: CALL: array_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_003_T/array_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func array_003_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_003_T/array_003_T.go\n AffectedNodeName: str\n 13: Var Pass: \tvar str = [3][1]string{[1]string{__taint_src}, [1]string{\"b\"}, [1]string{\"c\"}}\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_003_T/array_003_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(str)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/array/array_004_F/array_004_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/array/array_005_T/array_005_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/array/array_005_T/array_005_T.go\nLine 13: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/array/array_005_T/array_005_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_005_T/array_005_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: array_005_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_005_T/array_005_T.go\n AffectedNodeName: array_005_T\n 20: CALL: array_005_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_005_T/array_005_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func array_005_T(__taint_src [3]string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_005_T/array_005_T.go\n AffectedNodeName: __taint_sink\n 13: SINK: \t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/array/array_006_F/array_006_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/array/array_007_T/array_007_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/array/array_007_T/array_007_T.go\nLine 14: __taint_sink(str)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/array/array_007_T/array_007_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_007_T/array_007_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: array_007_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_007_T/array_007_T.go\n AffectedNodeName: array_007_T\n 20: CALL: array_007_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_007_T/array_007_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func array_007_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_007_T/array_007_T.go\n AffectedNodeName: str\n 13: Var Pass: \tvar str = [...]string{__taint_src, \"b\", \"c\"}\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_007_T/array_007_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(str)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/array/array_008_F/array_008_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/generics/generics_001_T/generics_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/generics/generics_001_T/generics_001_T.go\nLine 16: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/generics/generics_001_T/generics_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/generics/generics_001_T/generics_001_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: generics_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/generics/generics_001_T/generics_001_T.go\n AffectedNodeName: generics_001_T\n 23: CALL: generics_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/generics/generics_001_T/generics_001_T.go\n AffectedNodeName: __taint_src\n 14: ARG PASS: func generics_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/generics/generics_001_T/generics_001_T.go\n AffectedNodeName: s\n 15: Var Pass: \tvar s Slice[string] = []string{\"a\", \"b\", __taint_src}\n /sast-go/cases/completeness/single_app_tracing/datatype/generics/generics_001_T/generics_001_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(s)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/generics/generics_002_F/generics_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/map/map_001_T/map_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/map/map_001_T/map_001_T.go\nLine 15: __taint_sink(m)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/map/map_001_T/map_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/map/map_001_T/map_001_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: map_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/map/map_001_T/map_001_T.go\n AffectedNodeName: map_001_T\n 22: CALL: map_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/map/map_001_T/map_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func map_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/map/map_001_T/map_001_T.go\n AffectedNodeName: m[\"key1\"]\n 14: Var Pass: \tm[\"key1\"] = __taint_src\n /sast-go/cases/completeness/single_app_tracing/datatype/map/map_001_T/map_001_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(m)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/map/map_002_F/map_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/map/map_003_T/map_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/map/map_003_T/map_003_T.go\nLine 16: __taint_sink(m)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/map/map_003_T/map_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/map/map_003_T/map_003_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: map_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/map/map_003_T/map_003_T.go\n AffectedNodeName: map_003_T\n 23: CALL: map_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/map/map_003_T/map_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func map_003_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/map/map_003_T/map_003_T.go\n AffectedNodeName: m\n 13: Var Pass: \tm := map[string]string{\n 14: Var Pass: \t\t\"key1\": __taint_src,\n 15: Var Pass: \t}\n /sast-go/cases/completeness/single_app_tracing/datatype/map/map_003_T/map_003_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(m)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/map/map_004_F/map_004_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_001_T/pointer_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_001_T/pointer_001_T.go\nLine 14: __taint_sink(*ps)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_001_T/pointer_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_001_T/pointer_001_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: pointer_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_001_T/pointer_001_T.go\n AffectedNodeName: pointer_001_T\n 21: CALL: pointer_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_001_T/pointer_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func pointer_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_001_T/pointer_001_T.go\n AffectedNodeName: ps\n 13: Var Pass: \tps := &__taint_src\n /sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_001_T/pointer_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(*ps)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_002_F/pointer_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_new_001_T/pointer_new_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_new_001_T/pointer_new_001_T.go\nLine 16: __taint_sink(*ps)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_new_001_T/pointer_new_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_new_001_T/pointer_new_001_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: pointer_new_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_new_001_T/pointer_new_001_T.go\n AffectedNodeName: pointer_new_001_T\n 23: CALL: pointer_new_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_new_001_T/pointer_new_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func pointer_new_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_new_001_T/pointer_new_001_T.go\n AffectedNodeName: *ps\n 15: Var Pass: \t*ps = __taint_src\n /sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_new_001_T/pointer_new_001_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(*ps)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_new_002_F/pointer_new_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_bool_001_T/primitives_bool_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_bool_001_T/primitives_bool_001_T.go\nLine 13: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_bool_001_T/primitives_bool_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_bool_001_T/primitives_bool_001_T.go\n AffectedNodeName: __taint_src\n 19: SOURCE: primitives_bool_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_bool_001_T/primitives_bool_001_T.go\n AffectedNodeName: primitives_bool_001_T\n 19: CALL: primitives_bool_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_bool_001_T/primitives_bool_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func primitives_bool_001_T(__taint_src bool) {\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_bool_001_T/primitives_bool_001_T.go\n AffectedNodeName: __taint_sink\n 13: SINK: \t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_bool_002_F/primitives_bool_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_complex_001_T/primitives_complex_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_complex_001_T/primitives_complex_001_T.go\nLine 13: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_complex_001_T/primitives_complex_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_complex_001_T/primitives_complex_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: primitives_complex_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_complex_001_T/primitives_complex_001_T.go\n AffectedNodeName: primitives_complex_001_T\n 20: CALL: primitives_complex_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_complex_001_T/primitives_complex_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func primitives_complex_001_T(__taint_src complex64) {\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_complex_001_T/primitives_complex_001_T.go\n AffectedNodeName: __taint_sink\n 13: SINK: \t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_complex_002_F/primitives_complex_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_float_001_T/primitives_float_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_float_001_T/primitives_float_001_T.go\nLine 13: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_float_001_T/primitives_float_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_float_001_T/primitives_float_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: primitives_float_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_float_001_T/primitives_float_001_T.go\n AffectedNodeName: primitives_float_001_T\n 20: CALL: primitives_float_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_float_001_T/primitives_float_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func primitives_float_001_T(__taint_src float64) {\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_float_001_T/primitives_float_001_T.go\n AffectedNodeName: __taint_sink\n 13: SINK: \t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_float_002_F/primitives_float_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_int_001_T/primitives_int_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_int_001_T/primitives_int_001_T.go\nLine 13: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_int_001_T/primitives_int_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_int_001_T/primitives_int_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: primitives_int_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_int_001_T/primitives_int_001_T.go\n AffectedNodeName: primitives_int_001_T\n 20: CALL: primitives_int_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_int_001_T/primitives_int_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func primitives_int_001_T(__taint_src int) {\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_int_001_T/primitives_int_001_T.go\n AffectedNodeName: __taint_sink\n 13: SINK: \t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_int_002_F/primitives_int_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_001_T/slice_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_001_T/slice_001_T.go\nLine 14: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_001_T/slice_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_001_T/slice_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: slice_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_001_T/slice_001_T.go\n AffectedNodeName: slice_001_T\n 20: CALL: slice_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_001_T/slice_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func slice_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_001_T/slice_001_T.go\n AffectedNodeName: s\n 13: Var Pass: \tvar s []string = []string{__taint_src, \"b\", \"c\"}\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_001_T/slice_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(s)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_002_F/slice_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_003_T/slice_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_003_T/slice_003_T.go\nLine 15: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_003_T/slice_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_003_T/slice_003_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: slice_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_003_T/slice_003_T.go\n AffectedNodeName: slice_003_T\n 22: CALL: slice_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_003_T/slice_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func slice_003_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_003_T/slice_003_T.go\n AffectedNodeName: s\n 14: Var Pass: \ts = append(s, __taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_003_T/slice_003_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(s)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_004_F/slice_004_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_005_T/slice_005_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_005_T/slice_005_T.go\nLine 18: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_005_T/slice_005_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_005_T/slice_005_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: slice_005_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_005_T/slice_005_T.go\n AffectedNodeName: slice_005_T\n 25: CALL: slice_005_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_005_T/slice_005_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func slice_005_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_005_T/slice_005_T.go\n AffectedNodeName: s\n 13: Var Pass: \ts := [][]string{\n 14: Var Pass: \t\t[]string{\"a\"},\n 15: Var Pass: \t\t[]string{\"b\", \"c\"},\n 16: Var Pass: \t\t[]string{\"d\", \"e\", __taint_src},\n 17: Var Pass: \t}\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_005_T/slice_005_T.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t__taint_sink(s)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_006_F/slice_006_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_007_T/slice_007_T": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_008_F/slice_008_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/specialtype/channel_001_T/channel_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/specialtype/channel_001_T/channel_001_T.go\nLine 17: __taint_sink(c)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/specialtype/channel_001_T/channel_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/specialtype/channel_001_T/channel_001_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: channel_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/specialtype/channel_001_T/channel_001_T.go\n AffectedNodeName: channel_001_T\n 23: CALL: channel_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/specialtype/channel_001_T/channel_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func channel_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/specialtype/channel_001_T/channel_001_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(c)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/specialtype/channel_002_F/channel_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/string/string_001_T/string_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/string/string_001_T/string_001_T.go\nLine 13: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/string/string_001_T/string_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/string/string_001_T/string_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: string_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/string/string_001_T/string_001_T.go\n AffectedNodeName: string_001_T\n 20: CALL: string_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/string/string_001_T/string_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func string_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/string/string_001_T/string_001_T.go\n AffectedNodeName: __taint_sink\n 13: SINK: \t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/string/string_002_F/string_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/complex_struct_001_T/complex_struct_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/struct/complex_struct_001_T/complex_struct_001_T.go\nLine 30: __taint_sink(c)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/struct/complex_struct_001_T/complex_struct_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/complex_struct_001_T/complex_struct_001_T.go\n AffectedNodeName: __taint_src\n 37: SOURCE: complex_struct_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/complex_struct_001_T/complex_struct_001_T.go\n AffectedNodeName: complex_struct_001_T\n 37: CALL: complex_struct_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/complex_struct_001_T/complex_struct_001_T.go\n AffectedNodeName: __taint_src\n 13: ARG PASS: func complex_struct_001_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/complex_struct_001_T/complex_struct_001_T.go\n AffectedNodeName: Say\n 16: CALL: \ta.b.Say(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/complex_struct_001_T/complex_struct_001_T.go\n AffectedNodeName: c\n 29: ARG PASS: func (b B) Say(c interface{}) {\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/complex_struct_001_T/complex_struct_001_T.go\n AffectedNodeName: __taint_sink\n 30: SINK: \t__taint_sink(c)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/complex_struct_002_F/complex_struct_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_001_T/struct_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_001_T/struct_001_T.go\nLine 20: __taint_sink(p)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_001_T/struct_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_001_T/struct_001_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: struct_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_001_T/struct_001_T.go\n AffectedNodeName: struct_001_T\n 27: CALL: struct_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_001_T/struct_001_T.go\n AffectedNodeName: __taint_src\n 16: ARG PASS: func struct_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_001_T/struct_001_T.go\n AffectedNodeName: p\n 17: Var Pass: \tp := A{\n 18: Var Pass: \t\tdata: __taint_src,\n 19: Var Pass: \t}\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_001_T/struct_001_T.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t__taint_sink(p)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_002_F/struct_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_003_T/struct_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_003_T/struct_003_T.go\nLine 19: __taint_sink(p)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_003_T/struct_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_003_T/struct_003_T.go\n AffectedNodeName: __taint_src\n 26: SOURCE: struct_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_003_T/struct_003_T.go\n AffectedNodeName: struct_003_T\n 26: CALL: struct_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_003_T/struct_003_T.go\n AffectedNodeName: __taint_src\n 16: ARG PASS: func struct_003_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_003_T/struct_003_T.go\n AffectedNodeName: p.data\n 18: Var Pass: \tp.data = __taint_src\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_003_T/struct_003_T.go\n AffectedNodeName: __taint_sink\n 19: SINK: \t__taint_sink(p)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_004_F/struct_004_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_005_T/struct_005_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_005_T/struct_005_T.go\nLine 18: __taint_sink(p.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_005_T/struct_005_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_005_T/struct_005_T.go\n AffectedNodeName: __taint_src\n 24: SOURCE: struct_005_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_005_T/struct_005_T.go\n AffectedNodeName: struct_005_T\n 24: CALL: struct_005_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_005_T/struct_005_T.go\n AffectedNodeName: __taint_src\n 16: ARG PASS: func struct_005_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_005_T/struct_005_T.go\n AffectedNodeName: p\n 17: Var Pass: \tp := A{__taint_src}\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_005_T/struct_005_T.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t__taint_sink(p.data)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_006_F/struct_006_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_001_T/struct_cross_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_001_T/struct_cross_001_T.go\nLine 25: __taint_sink(pb)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_001_T/struct_cross_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_001_T/struct_cross_001_T.go\n AffectedNodeName: __taint_src\n 32: SOURCE: struct_cross_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_001_T/struct_cross_001_T.go\n AffectedNodeName: struct_cross_001_T\n 32: CALL: struct_cross_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_001_T/struct_cross_001_T.go\n AffectedNodeName: __taint_src\n 19: ARG PASS: func struct_cross_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_001_T/struct_cross_001_T.go\n AffectedNodeName: pa\n 20: Var Pass: \tpa := A{\n 21: Var Pass: \t\tdata: __taint_src,\n 22: Var Pass: \t}\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_001_T/struct_cross_001_T.go\n AffectedNodeName: pb.data\n 24: Var Pass: \tpb.data = pa.data\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_001_T/struct_cross_001_T.go\n AffectedNodeName: __taint_sink\n 25: SINK: \t__taint_sink(pb)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_002_F/struct_cross_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_003_T/struct_cross_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_003_T/struct_cross_003_T.go\nLine 24: __taint_sink(p)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_003_T/struct_cross_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_003_T/struct_cross_003_T.go\n AffectedNodeName: __taint_src\n 30: SOURCE: struct_cross_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_003_T/struct_cross_003_T.go\n AffectedNodeName: struct_cross_003_T\n 30: CALL: struct_cross_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_003_T/struct_cross_003_T.go\n AffectedNodeName: __taint_src\n 20: ARG PASS: func struct_cross_003_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_003_T/struct_cross_003_T.go\n AffectedNodeName: p\n 21: Var Pass: \tp := B{A{\n 22: Var Pass: \t\tdata: __taint_src,\n 23: Var Pass: \t}, \"_\"}\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_003_T/struct_cross_003_T.go\n AffectedNodeName: __taint_sink\n 24: SINK: \t__taint_sink(p)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_004_F/struct_cross_004_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/exception_error/exception_throw/exception_throw_001_T/exception_throw_001_T": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/exception_error/exception_throw/exception_throw_002_F/exception_throw_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T/assign_expression_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T/assign_expression_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T/assign_expression_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T/assign_expression_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: assign_expression_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T/assign_expression_001_T.go\n AffectedNodeName: assign_expression_001_T\n 20: CALL: assign_expression_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T/assign_expression_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func assign_expression_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T/assign_expression_001_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := __taint_src\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T/assign_expression_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_002_F/assign_expression_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T/binary_expression_add_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T/binary_expression_add_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T/binary_expression_add_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T/binary_expression_add_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: binary_expression_add_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T/binary_expression_add_001_T.go\n AffectedNodeName: binary_expression_add_001_T\n 20: CALL: binary_expression_add_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T/binary_expression_add_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func binary_expression_add_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T/binary_expression_add_001_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := __taint_src + \"_\"\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T/binary_expression_add_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_002_F/binary_expression_add_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T/binary_expression_add_assignment_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T/binary_expression_add_assignment_001_T.go\nLine 15: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T/binary_expression_add_assignment_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T/binary_expression_add_assignment_001_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: binary_expression_add_assignment_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T/binary_expression_add_assignment_001_T.go\n AffectedNodeName: binary_expression_add_assignment_001_T\n 21: CALL: binary_expression_add_assignment_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T/binary_expression_add_assignment_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func binary_expression_add_assignment_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T/binary_expression_add_assignment_001_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_002_F/binary_expression_add_assignment_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T/bitwise_expression_and_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T/bitwise_expression_and_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T/bitwise_expression_and_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T/bitwise_expression_and_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: bitwise_expression_and_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T/bitwise_expression_and_001_T.go\n AffectedNodeName: bitwise_expression_and_001_T\n 20: CALL: bitwise_expression_and_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T/bitwise_expression_and_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func bitwise_expression_and_001_T(__taint_src int) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T/bitwise_expression_and_001_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := __taint_src & 1\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T/bitwise_expression_and_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_002_F/bitwise_expression_and_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T/bitwise_expression_lsh_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T/bitwise_expression_lsh_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T/bitwise_expression_lsh_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T/bitwise_expression_lsh_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: bitwise_expression_lsh_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T/bitwise_expression_lsh_001_T.go\n AffectedNodeName: bitwise_expression_lsh_001_T\n 20: CALL: bitwise_expression_lsh_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T/bitwise_expression_lsh_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func bitwise_expression_lsh_001_T(__taint_src int) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T/bitwise_expression_lsh_001_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := __taint_src << 1\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T/bitwise_expression_lsh_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_002_F/bitwise_expression_lsh_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T/bitwise_expression_not_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T/bitwise_expression_not_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T/bitwise_expression_not_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T/bitwise_expression_not_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: bitwise_expression_not_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T/bitwise_expression_not_001_T.go\n AffectedNodeName: bitwise_expression_not_001_T\n 20: CALL: bitwise_expression_not_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T/bitwise_expression_not_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func bitwise_expression_not_001_T(__taint_src int) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T/bitwise_expression_not_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_002_F/bitwise_expression_not_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T/bitwise_expression_or_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T/bitwise_expression_or_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T/bitwise_expression_or_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T/bitwise_expression_or_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: bitwise_expression_or_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T/bitwise_expression_or_001_T.go\n AffectedNodeName: bitwise_expression_or_001_T\n 20: CALL: bitwise_expression_or_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T/bitwise_expression_or_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func bitwise_expression_or_001_T(__taint_src int) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T/bitwise_expression_or_001_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := __taint_src | 1\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T/bitwise_expression_or_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_002_F/bitwise_expression_or_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T/bitwise_expression_rsh_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T/bitwise_expression_rsh_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T/bitwise_expression_rsh_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T/bitwise_expression_rsh_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: bitwise_expression_rsh_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T/bitwise_expression_rsh_001_T.go\n AffectedNodeName: bitwise_expression_rsh_001_T\n 20: CALL: bitwise_expression_rsh_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T/bitwise_expression_rsh_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func bitwise_expression_rsh_001_T(__taint_src int) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T/bitwise_expression_rsh_001_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := __taint_src >> 1\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T/bitwise_expression_rsh_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_002_F/bitwise_expression_rsh_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T/bitwise_expression_xor_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T/bitwise_expression_xor_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T/bitwise_expression_xor_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T/bitwise_expression_xor_001_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: bitwise_expression_xor_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T/bitwise_expression_xor_001_T.go\n AffectedNodeName: bitwise_expression_xor_001_T\n 21: CALL: bitwise_expression_xor_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T/bitwise_expression_xor_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func bitwise_expression_xor_001_T(__taint_src int) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T/bitwise_expression_xor_001_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := __taint_src ^ 1\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T/bitwise_expression_xor_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_002_F/bitwise_expression_xor_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_001_T/logic_expression_and_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_001_T/logic_expression_and_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_001_T/logic_expression_and_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_001_T/logic_expression_and_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: logic_expression_and_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_001_T/logic_expression_and_001_T.go\n AffectedNodeName: logic_expression_and_001_T\n 20: CALL: logic_expression_and_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_001_T/logic_expression_and_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func logic_expression_and_001_T(__taint_src bool) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_001_T/logic_expression_and_001_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := __taint_src && true\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_001_T/logic_expression_and_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_002_F/logic_expression_and_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T/logic_expression_or_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T/logic_expression_or_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T/logic_expression_or_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T/logic_expression_or_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: logic_expression_or_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T/logic_expression_or_001_T.go\n AffectedNodeName: logic_expression_or_001_T\n 20: CALL: logic_expression_or_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T/logic_expression_or_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func logic_expression_or_001_T(__taint_src bool) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T/logic_expression_or_001_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := false || __taint_src\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T/logic_expression_or_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_002_F/logic_expression_or_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T/relation_expression_equal_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T/relation_expression_equal_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T/relation_expression_equal_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T/relation_expression_equal_001_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: relation_expression_equal_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T/relation_expression_equal_001_T.go\n AffectedNodeName: relation_expression_equal_001_T\n 21: CALL: relation_expression_equal_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T/relation_expression_equal_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func relation_expression_equal_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T/relation_expression_equal_001_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := __taint_src == \"__taint_src\"\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T/relation_expression_equal_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_002_F/relation_expression_equal_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/special_expression/blank_identifier_001_T/blank_identifier_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/special_expression/blank_identifier_001_T/blank_identifier_001_T.go\nLine 14: __taint_sink(a)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/special_expression/blank_identifier_001_T/blank_identifier_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/blank_identifier_001_T/blank_identifier_001_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: blank_identifier_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/blank_identifier_001_T/blank_identifier_001_T.go\n AffectedNodeName: blank_identifier_001_T\n 25: CALL: blank_identifier_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/blank_identifier_001_T/blank_identifier_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func blank_identifier_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/blank_identifier_001_T/blank_identifier_001_T.go\n AffectedNodeName: getData\n 13: CALL: \ta, _ := getData(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/blank_identifier_001_T/blank_identifier_001_T.go\n AffectedNodeName: getData\n 13: CALL RETURN: \ta, _ := getData(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/blank_identifier_001_T/blank_identifier_001_T.go\n 13: Var Pass: \ta, _ := getData(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/blank_identifier_001_T/blank_identifier_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(a)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/special_expression/blank_identifier_002_F/blank_identifier_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/special_expression/multiple_assignment_001_T/multiple_assignment_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/special_expression/multiple_assignment_001_T/multiple_assignment_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/special_expression/multiple_assignment_001_T/multiple_assignment_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/multiple_assignment_001_T/multiple_assignment_001_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: multiple_assignment_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/multiple_assignment_001_T/multiple_assignment_001_T.go\n AffectedNodeName: multiple_assignment_001_T\n 21: CALL: multiple_assignment_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/multiple_assignment_001_T/multiple_assignment_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func multiple_assignment_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/multiple_assignment_001_T/multiple_assignment_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/special_expression/multiple_assignment_002_F/multiple_assignment_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T/rest_parameter_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T/rest_parameter_001_T.go\nLine 17: __taint_sink(args)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T/rest_parameter_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T/rest_parameter_001_T.go\n AffectedNodeName: __taint_src\n 24: SOURCE: rest_parameter_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T/rest_parameter_001_T.go\n AffectedNodeName: rest_parameter_001_T\n 24: CALL: rest_parameter_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T/rest_parameter_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func rest_parameter_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T/rest_parameter_001_T.go\n AffectedNodeName: collectArgs\n 13: CALL: \tcollectArgs(\"prefix\", __taint_src, \"suffix\")\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T/rest_parameter_001_T.go\n AffectedNodeName: args\n 16: ARG PASS: func collectArgs(args ...interface{}) {\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T/rest_parameter_001_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(args)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/special_expression/rest_parameter_002_F/rest_parameter_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T/spread_operator_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T/spread_operator_001_T.go\nLine 15: __taint_sink(array)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T/spread_operator_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T/spread_operator_001_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: spread_operator_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T/spread_operator_001_T.go\n AffectedNodeName: spread_operator_001_T\n 22: CALL: spread_operator_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T/spread_operator_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func spread_operator_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T/spread_operator_001_T.go\n AffectedNodeName: array1\n 13: Var Pass: \tarray1 := []string{\"a\", \"b\", __taint_src}\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T/spread_operator_001_T.go\n AffectedNodeName: array\n 14: Var Pass: \tarray := append([]string{\"c\"}, array1...)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T/spread_operator_001_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(array)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/special_expression/spread_operator_002_F/spread_operator_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_001_T/type_cast_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_001_T/type_cast_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_001_T/type_cast_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_001_T/type_cast_001_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: type_cast_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_001_T/type_cast_001_T.go\n AffectedNodeName: type_cast_001_T\n 21: CALL: type_cast_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_001_T/type_cast_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func type_cast_001_T(__taint_src int) {\n /sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_001_T/type_cast_001_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := float64(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_001_T/type_cast_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_002_F/type_cast_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_003_T/type_cast_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_003_T/type_cast_003_T.go\nLine 15: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_003_T/type_cast_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_003_T/type_cast_003_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: type_cast_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_003_T/type_cast_003_T.go\n AffectedNodeName: type_cast_003_T\n 22: CALL: type_cast_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_003_T/type_cast_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func type_cast_003_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_003_T/type_cast_003_T.go\n 13: Var Pass: \tresult, ok := __taint_src.(string)\n /sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_003_T/type_cast_003_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_004_F/type_cast_004_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_001_F/anonymous_function_001_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T/anonymous_function_002_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T/anonymous_function_002_T.go\nLine 16: __taint_sink(process(__taint_src, \"foo\"))\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T/anonymous_function_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T/anonymous_function_002_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: anonymous_function_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T/anonymous_function_002_T.go\n AffectedNodeName: anonymous_function_002_T\n 23: CALL: anonymous_function_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T/anonymous_function_002_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func anonymous_function_002_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T/anonymous_function_002_T.go\n AffectedNodeName: [return value]\n 14: Return Value: \t\treturn a + b\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T/anonymous_function_002_T.go\n AffectedNodeName: \n 16: CALL RETURN: \t__taint_sink(process(__taint_src, \"foo\"))\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T/anonymous_function_002_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(process(__taint_src, \"foo\"))\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_003_F/anonymous_function_003_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T/anonymous_function_004_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T/anonymous_function_004_T.go\nLine 15: __taint_sink(input)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T/anonymous_function_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T/anonymous_function_004_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: anonymous_function_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T/anonymous_function_004_T.go\n AffectedNodeName: anonymous_function_004_T\n 25: CALL: anonymous_function_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T/anonymous_function_004_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func anonymous_function_004_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T/anonymous_function_004_T.go\n AffectedNodeName: \n 18: CALL: \tprocess(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T/anonymous_function_004_T.go\n AffectedNodeName: input\n 14: ARG PASS: \tprocess := func(input interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T/anonymous_function_004_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t\t__taint_sink(input)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_005_F/anonymous_function_005_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T/anonymous_function_006_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T/anonymous_function_006_T.go\nLine 14: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T/anonymous_function_006_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T/anonymous_function_006_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: anonymous_function_006_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T/anonymous_function_006_T.go\n AffectedNodeName: anonymous_function_006_T\n 22: CALL: anonymous_function_006_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T/anonymous_function_006_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func anonymous_function_006_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T/anonymous_function_006_T.go\n AffectedNodeName: __single_module__.%dir_/.anonymous_function_006_T.\n 13: CALL: \tfunc() {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T/anonymous_function_006_T.go\n AffectedNodeName: __single_module__.%dir_/.anonymous_function_006_T.\n 13: ARG PASS: \tfunc() {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T/anonymous_function_006_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t\t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_001_F/closure_function_001_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T/closure_function_002_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T/closure_function_002_T.go\nLine 14: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T/closure_function_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T/closure_function_002_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: closure_function_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T/closure_function_002_T.go\n AffectedNodeName: closure_function_002_T\n 23: CALL: closure_function_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T/closure_function_002_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func closure_function_002_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T/closure_function_002_T.go\n AffectedNodeName: __single_module__.%dir_/.closure_function_002_T.\n 17: CALL: \tclosure()\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T/closure_function_002_T.go\n AffectedNodeName: __single_module__.%dir_/.closure_function_002_T.\n 13: ARG PASS: \tclosure := func() {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T/closure_function_002_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t\t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_003_F/closure_function_003_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T/closure_function_004_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T/closure_function_004_T.go\nLine 15: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T/closure_function_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T/closure_function_004_T.go\n AffectedNodeName: __taint_src\n 26: SOURCE: closure_function_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T/closure_function_004_T.go\n AffectedNodeName: closure_function_004_T\n 26: CALL: closure_function_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T/closure_function_004_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func closure_function_004_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T/closure_function_004_T.go\n AffectedNodeName: __single_module__.%dir_/.closure_function_004_T..\n 20: CALL: \tclosure_function_004_Function()\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T/closure_function_004_T.go\n AffectedNodeName: __single_module__.%dir_/.closure_function_004_T..\n 14: ARG PASS: \t\treturn func() {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T/closure_function_004_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t\t\t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_005_F/closure_function_005_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_006_T/closure_function_006_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_006_T/closure_function_006_T.go\nLine 35: __taint_sink(a.update())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_006_T/closure_function_006_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_006_T/closure_function_006_T.go\n AffectedNodeName: __taint_src\n 42: SOURCE: closure_function_006_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_006_T/closure_function_006_T.go\n AffectedNodeName: closure_function_006_T\n 42: CALL: closure_function_006_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_006_T/closure_function_006_T.go\n AffectedNodeName: __taint_src\n 13: ARG PASS: func closure_function_006_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_006_T/closure_function_006_T.go\n AffectedNodeName: source\n 25: Var Pass: \t\t\t\tsource = __taint_src\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_006_T/closure_function_006_T.go\n AffectedNodeName: [return value]\n 26: Return Value: \t\t\t\treturn source\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_006_T/closure_function_006_T.go\n AffectedNodeName: \n 35: CALL RETURN: \t__taint_sink(a.update())\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_006_T/closure_function_006_T.go\n AffectedNodeName: __taint_sink\n 35: SINK: \t__taint_sink(a.update())\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_007_F/closure_function_007_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_T/closure_function_008_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_T/closure_function_008_T.go\nLine 20: __taint_sink(middleVar)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_T/closure_function_008_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_T/closure_function_008_T.go\n AffectedNodeName: __taint_src\n 38: SOURCE: closure_function_008_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_T/closure_function_008_T.go\n AffectedNodeName: closure_function_008_T\n 38: CALL: closure_function_008_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_T/closure_function_008_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func closure_function_008_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_T/closure_function_008_T.go\n AffectedNodeName: outerVar\n 14: Var Pass: \t\touterVar := __taint_src\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_T/closure_function_008_T.go\n AffectedNodeName: middleVar\n 17: Var Pass: \t\t\tmiddleVar := outerVar\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_T/closure_function_008_T.go\n AffectedNodeName: __single_module__.%dir_/.closure_function_008_T...\n 31: CALL: \tclosure_function_008_Tunction()\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_T/closure_function_008_T.go\n AffectedNodeName: __single_module__.%dir_/.closure_function_008_T...\n 19: ARG PASS: \t\t\tinner := func() {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_T/closure_function_008_T.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t\t\t\t__taint_sink(middleVar)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_009_F/closure_function_009_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_010_T/closure_function_010_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_010_T/closure_function_010_T.go\nLine 18: __taint_sink(outerVar)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_010_T/closure_function_010_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_010_T/closure_function_010_T.go\n AffectedNodeName: __taint_src\n 36: SOURCE: closure_function_010_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_010_T/closure_function_010_T.go\n AffectedNodeName: closure_function_010_T\n 36: CALL: closure_function_010_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_010_T/closure_function_010_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func closure_function_010_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_010_T/closure_function_010_T.go\n AffectedNodeName: outerVar\n 14: Var Pass: \t\touterVar := __taint_src\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_010_T/closure_function_010_T.go\n AffectedNodeName: __single_module__.%dir_/.closure_function_010_T...\n 29: CALL: \tclosure_function_010_Tunction()\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_010_T/closure_function_010_T.go\n AffectedNodeName: __single_module__.%dir_/.closure_function_010_T...\n 17: ARG PASS: \t\t\tinner := func() {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_010_T/closure_function_010_T.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t\t\t\t__taint_sink(outerVar)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_001_F/argument_passing_value_001_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_002_T/argument_passing_value_002_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_002_T/argument_passing_value_002_T.go\nLine 17: __taint_sink(arg)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_002_T/argument_passing_value_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_002_T/argument_passing_value_002_T.go\n AffectedNodeName: __taint_src\n 24: SOURCE: argument_passing_value_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_002_T/argument_passing_value_002_T.go\n AffectedNodeName: argument_passing_value_002_T\n 24: CALL: argument_passing_value_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_002_T/argument_passing_value_002_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func argument_passing_value_002_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_002_T/argument_passing_value_002_T.go\n AffectedNodeName: process\n 13: CALL: \tprocess(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_002_T/argument_passing_value_002_T.go\n AffectedNodeName: arg\n 16: ARG PASS: func process(arg string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_002_T/argument_passing_value_002_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(arg)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_003_F/argument_passing_value_003_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_004_T/argument_passing_value_004_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_004_T/argument_passing_value_004_T.go\nLine 19: __taint_sink(arg)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_004_T/argument_passing_value_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_004_T/argument_passing_value_004_T.go\n AffectedNodeName: __taint_src\n 29: SOURCE: argument_passing_value_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_004_T/argument_passing_value_004_T.go\n AffectedNodeName: argument_passing_value_004_T\n 29: CALL: argument_passing_value_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_004_T/argument_passing_value_004_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func argument_passing_value_004_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_004_T/argument_passing_value_004_T.go\n AffectedNodeName: process1\n 15: CALL: \tprocess1(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_004_T/argument_passing_value_004_T.go\n AffectedNodeName: arg\n 18: ARG PASS: func process1(arg interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_004_T/argument_passing_value_004_T.go\n AffectedNodeName: __taint_sink\n 19: SINK: \t__taint_sink(arg)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_005_F/argument_passing_value_005_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_006_T/argument_passing_value_006_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_006_T/argument_passing_value_006_T.go\nLine 17: __taint_sink(arg1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_006_T/argument_passing_value_006_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_006_T/argument_passing_value_006_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: argument_passing_value_006_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_006_T/argument_passing_value_006_T.go\n AffectedNodeName: argument_passing_value_006_T\n 23: CALL: argument_passing_value_006_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_006_T/argument_passing_value_006_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func argument_passing_value_006_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_006_T/argument_passing_value_006_T.go\n AffectedNodeName: process\n 13: CALL: \tprocess(__taint_src, \"_\")\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_006_T/argument_passing_value_006_T.go\n AffectedNodeName: arg1\n 16: ARG PASS: func process(arg1 string, arg2 string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_006_T/argument_passing_value_006_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(arg1)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_007_F/argument_passing_value_007_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_008_T/argument_passing_value_008_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_008_T/argument_passing_value_008_T.go\nLine 15: __taint_sink(innerInput)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_008_T/argument_passing_value_008_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_008_T/argument_passing_value_008_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: argument_passing_value_008_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_008_T/argument_passing_value_008_T.go\n AffectedNodeName: argument_passing_value_008_T\n 27: CALL: argument_passing_value_008_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_008_T/argument_passing_value_008_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func argument_passing_value_008_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_008_T/argument_passing_value_008_T.go\n AffectedNodeName: \n 21: CALL: \touter(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_008_T/argument_passing_value_008_T.go\n AffectedNodeName: input\n 13: ARG PASS: \touter := func(input string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_008_T/argument_passing_value_008_T.go\n AffectedNodeName: \n 18: CALL: \t\tinner(input)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_008_T/argument_passing_value_008_T.go\n AffectedNodeName: innerInput\n 14: ARG PASS: \t\tinner := func(innerInput interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_008_T/argument_passing_value_008_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t\t\t__taint_sink(innerInput)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_009_T/argument_passing_value_009_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_009_T/argument_passing_value_009_T.go\nLine 20: __taint_sink(person.GetNamePointer())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_009_T/argument_passing_value_009_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_009_T/argument_passing_value_009_T.go\n AffectedNodeName: __taint_src\n 35: SOURCE: argument_passing_value_009_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_009_T/argument_passing_value_009_T.go\n AffectedNodeName: argument_passing_value_009_T\n 35: CALL: argument_passing_value_009_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_009_T/argument_passing_value_009_T.go\n AffectedNodeName: __taint_src\n 16: ARG PASS: func argument_passing_value_009_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_009_T/argument_passing_value_009_T.go\n AffectedNodeName: person\n 17: Var Pass: \tperson := Person{Name: __taint_src}\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_009_T/argument_passing_value_009_T.go\n AffectedNodeName: GetNamePointer\n 20: CALL RETURN: \t__taint_sink(person.GetNamePointer())\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_009_T/argument_passing_value_009_T.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t__taint_sink(person.GetNamePointer())\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_010_F/argument_passing_value_010_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_001_F/chained_call_001_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T.go\nLine 31: __taint_sink(a.name)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T.go\n AffectedNodeName: __taint_src\n 37: SOURCE: chained_call_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T.go\n AffectedNodeName: chained_call_002_T\n 37: CALL: chained_call_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func chained_call_002_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T.go\n AffectedNodeName: setName\n 13: CALL: \tnew(A).setName(\"_\").clearName().setName(__taint_src).process()\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T.go\n AffectedNodeName: setName\n 13: CALL RETURN: \tnew(A).setName(\"_\").clearName().setName(__taint_src).process()\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T.go\n AffectedNodeName: process\n 13: CALL: \tnew(A).setName(\"_\").clearName().setName(__taint_src).process()\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T.go\n AffectedNodeName: new A().setName(\"_\").clearName().setName(__taint_s\n 13: ARG PASS: \tnew(A).setName(\"_\").clearName().setName(__taint_src).process()\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T.go\n AffectedNodeName: process\n 13: CALL: \tnew(A).setName(\"_\").clearName().setName(__taint_src).process()\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T.go\n AffectedNodeName: process\n 30: ARG PASS: func (a *A) process() {\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T.go\n AffectedNodeName: __taint_sink\n 31: SINK: \t__taint_sink(a.name)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_003_F/chained_call_003_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\nLine 39: __taint_sink(b.name)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\n AffectedNodeName: __taint_src\n 46: SOURCE: chained_call_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\n AffectedNodeName: chained_call_004_T\n 46: CALL: chained_call_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func chained_call_004_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\n AffectedNodeName: SetName\n 13: CALL: \tNewB().SetName(__taint_src).SetOther().Process()\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\n AffectedNodeName: SetName\n 13: CALL RETURN: \tNewB().SetName(__taint_src).SetOther().Process()\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\n AffectedNodeName: SetOther\n 13: CALL: \tNewB().SetName(__taint_src).SetOther().Process()\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\n AffectedNodeName: NewB().SetName(__taint_src)\n 13: ARG PASS: \tNewB().SetName(__taint_src).SetOther().Process()\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\n AffectedNodeName: SetOther\n 13: CALL RETURN: \tNewB().SetName(__taint_src).SetOther().Process()\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\n AffectedNodeName: Process\n 13: CALL: \tNewB().SetName(__taint_src).SetOther().Process()\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\n AffectedNodeName: Process\n 38: ARG PASS: func (b *B) Process() {\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\n AffectedNodeName: __taint_sink\n 39: SINK: \t__taint_sink(b.name)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_001_F/higher_order_function_001_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T/higher_order_function_002_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T/higher_order_function_002_T.go\nLine 20: __taint_sink(f(__taint_src, \"_\")())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T/higher_order_function_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T/higher_order_function_002_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: higher_order_function_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T/higher_order_function_002_T.go\n AffectedNodeName: higher_order_function_002_T\n 27: CALL: higher_order_function_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T/higher_order_function_002_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func higher_order_function_002_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T/higher_order_function_002_T.go\n AffectedNodeName: [return value]\n 16: Return Value: \t\t\treturn a + b + c\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T/higher_order_function_002_T.go\n AffectedNodeName: \n 20: CALL RETURN: \t__taint_sink(f(__taint_src, \"_\")())\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T/higher_order_function_002_T.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t__taint_sink(f(__taint_src, \"_\")())\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_003_F/higher_order_function_003_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T/higher_order_function_004_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T/higher_order_function_004_T.go\nLine 24: __taint_sink(f(g, __taint_src, \"_\"))\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T/higher_order_function_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T/higher_order_function_004_T.go\n AffectedNodeName: __taint_src\n 31: SOURCE: higher_order_function_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T/higher_order_function_004_T.go\n AffectedNodeName: higher_order_function_004_T\n 31: CALL: higher_order_function_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T/higher_order_function_004_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func higher_order_function_004_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T/higher_order_function_004_T.go\n AffectedNodeName: [return value]\n 20: Return Value: \t\t\treturn a + b + c\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T/higher_order_function_004_T.go\n AffectedNodeName: \n 14: CALL RETURN: \t\treturn g(a, b)()\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T/higher_order_function_004_T.go\n AffectedNodeName: [return value]\n 14: Return Value: \t\treturn g(a, b)()\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T/higher_order_function_004_T.go\n AffectedNodeName: \n 24: CALL RETURN: \t__taint_sink(f(g, __taint_src, \"_\"))\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T/higher_order_function_004_T.go\n AffectedNodeName: __taint_sink\n 24: SINK: \t__taint_sink(f(g, __taint_src, \"_\"))\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_005_F/higher_order_function_005_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T/higher_order_function_006_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T/higher_order_function_006_T.go\nLine 13: __taint_sink(f(g, u, __taint_src, \"_\")())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T/higher_order_function_006_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T/higher_order_function_006_T.go\n AffectedNodeName: __taint_src\n 35: SOURCE: higher_order_function_006_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T/higher_order_function_006_T.go\n AffectedNodeName: higher_order_function_006_T\n 35: CALL: higher_order_function_006_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T/higher_order_function_006_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func higher_order_function_006_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T/higher_order_function_006_T.go\n AffectedNodeName: f\n 13: CALL: \t__taint_sink(f(g, u, __taint_src, \"_\")())\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T/higher_order_function_006_T.go\n AffectedNodeName: \n 13: CALL RETURN: \t__taint_sink(f(g, u, __taint_src, \"_\")())\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T/higher_order_function_006_T.go\n AffectedNodeName: __taint_sink\n 13: SINK: \t__taint_sink(f(g, u, __taint_src, \"_\")())\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_007_F/higher_order_function_007_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T/higher_order_function_008_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T/higher_order_function_008_T.go\nLine 16: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T/higher_order_function_008_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T/higher_order_function_008_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: higher_order_function_008_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T/higher_order_function_008_T.go\n AffectedNodeName: higher_order_function_008_T\n 27: CALL: higher_order_function_008_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T/higher_order_function_008_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func higher_order_function_008_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T/higher_order_function_008_T.go\n AffectedNodeName: [return value]\n 14: Return Value: \t\treturn a + b\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T/higher_order_function_008_T.go\n AffectedNodeName: higher_order_function_008_Function\n 13: CALL RETURN: \tresult := higher_order_function_008_Function(func(a string, b string) string {\n 14: CALL RETURN: \t\treturn a + b\n 15: CALL RETURN: \t}, __taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T/higher_order_function_008_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := higher_order_function_008_Function(func(a string, b string) string {\n 14: Var Pass: \t\treturn a + b\n 15: Var Pass: \t}, __taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T/higher_order_function_008_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_arg_001_T/arg_arg_001_T": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_arg_002_F/arg_arg_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_001_T/arg_return_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_001_T/arg_return_001_T.go\nLine 16: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_001_T/arg_return_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_001_T/arg_return_001_T.go\n AffectedNodeName: __taint_src\n 28: SOURCE: arg_return_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_001_T/arg_return_001_T.go\n AffectedNodeName: arg_return_001_T\n 28: CALL: arg_return_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_001_T/arg_return_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func arg_return_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_001_T/arg_return_001_T.go\n AffectedNodeName: taintedData\n 13: Var Pass: \ttaintedData := __taint_src\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_001_T/arg_return_001_T.go\n AffectedNodeName: appendTaint\n 15: CALL: \tresult := appendTaint(sList, taintedData)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_001_T/arg_return_001_T.go\n AffectedNodeName: appendTaint\n 15: CALL RETURN: \tresult := appendTaint(sList, taintedData)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_001_T/arg_return_001_T.go\n AffectedNodeName: result\n 15: Var Pass: \tresult := appendTaint(sList, taintedData)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_001_T/arg_return_001_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_002_F/arg_return_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_003_T/arg_return_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_003_T/arg_return_003_T.go\nLine 17: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_003_T/arg_return_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_003_T/arg_return_003_T.go\n AffectedNodeName: __taint_src\n 29: SOURCE: arg_return_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_003_T/arg_return_003_T.go\n AffectedNodeName: arg_return_003_T\n 29: CALL: arg_return_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_003_T/arg_return_003_T.go\n AffectedNodeName: __taint_src\n 14: ARG PASS: func arg_return_003_T(__taint_src int) {\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_003_T/arg_return_003_T.go\n AffectedNodeName: taintedData\n 15: Var Pass: \ttaintedData := __taint_src\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_003_T/arg_return_003_T.go\n AffectedNodeName: itoaTaint\n 16: CALL: \tresult := itoaTaint(taintedData)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_003_T/arg_return_003_T.go\n AffectedNodeName: itoaTaint\n 16: CALL RETURN: \tresult := itoaTaint(taintedData)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_003_T/arg_return_003_T.go\n AffectedNodeName: result\n 16: Var Pass: \tresult := itoaTaint(taintedData)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_003_T/arg_return_003_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_004_F/arg_return_004_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_001_T/this_return_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_001_T/this_return_001_T.go\nLine 15: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_001_T/this_return_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_001_T/this_return_001_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: this_return_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_001_T/this_return_001_T.go\n AffectedNodeName: this_return_001_T\n 27: CALL: this_return_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_001_T/this_return_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func this_return_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_001_T/this_return_001_T.go\n AffectedNodeName: taintedData\n 13: Var Pass: \ttaintedData := __taint_src\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_001_T/this_return_001_T.go\n AffectedNodeName: taintToString\n 14: CALL: \tresult := taintToString(taintedData)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_001_T/this_return_001_T.go\n AffectedNodeName: taintToString\n 14: CALL RETURN: \tresult := taintToString(taintedData)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_001_T/this_return_001_T.go\n AffectedNodeName: result\n 14: Var Pass: \tresult := taintToString(taintedData)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_001_T/this_return_001_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_002_F/this_return_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T/polymorphism_override_001_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T/polymorphism_override_001_T.go\nLine 14: __taint_sink(sub.call(__taint_src))\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T/polymorphism_override_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T/polymorphism_override_001_T.go\n AffectedNodeName: __taint_src\n 37: SOURCE: polymorphism_override_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T/polymorphism_override_001_T.go\n AffectedNodeName: polymorphism_override_001_T\n 37: CALL: polymorphism_override_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T/polymorphism_override_001_T.go\n AffectedNodeName: __taint_src\n 11: ARG PASS: func polymorphism_override_001_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T/polymorphism_override_001_T.go\n AffectedNodeName: call\n 14: CALL: \t__taint_sink(sub.call(__taint_src))\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T/polymorphism_override_001_T.go\n AffectedNodeName: call\n 14: CALL RETURN: \t__taint_sink(sub.call(__taint_src))\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T/polymorphism_override_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(sub.call(__taint_src))\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_002_F/polymorphism_override_002_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_003_T/polymorphism_override_003_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_003_T/polymorphism_override_003_T.go\nLine 15: __taint_sink(student.Run())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_003_T/polymorphism_override_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_003_T/polymorphism_override_003_T.go\n AffectedNodeName: __taint_src\n 46: SOURCE: polymorphism_override_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_003_T/polymorphism_override_003_T.go\n AffectedNodeName: polymorphism_override_003_T\n 46: CALL: polymorphism_override_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_003_T/polymorphism_override_003_T.go\n AffectedNodeName: __taint_src\n 11: ARG PASS: func polymorphism_override_003_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_003_T/polymorphism_override_003_T.go\n AffectedNodeName: student\n 12: Var Pass: \tvar student Person = &Student{Name: __taint_src, Age: 20, GPA: 3.8}\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_003_T/polymorphism_override_003_T.go\n AffectedNodeName: Run\n 15: CALL RETURN: \t__taint_sink(student.Run())\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_003_T/polymorphism_override_003_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(student.Run())\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_004_F/polymorphism_override_004_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/multiple_return_005_F/multiple_return_005_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/multiple_return_006_T/multiple_return_006_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/multiple_return_006_T/multiple_return_006_T.go\nLine 17: __taint_sink(ret1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/multiple_return_006_T/multiple_return_006_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/multiple_return_006_T/multiple_return_006_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: multiple_return_006_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/multiple_return_006_T/multiple_return_006_T.go\n AffectedNodeName: multiple_return_006_T\n 27: CALL: multiple_return_006_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/multiple_return_006_T/multiple_return_006_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func multiple_return_006_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/multiple_return_006_T/multiple_return_006_T.go\n AffectedNodeName: processData\n 15: CALL: \tret1, ret2 := processData(__taint_src, a)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/multiple_return_006_T/multiple_return_006_T.go\n AffectedNodeName: processData\n 15: CALL RETURN: \tret1, ret2 := processData(__taint_src, a)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/multiple_return_006_T/multiple_return_006_T.go\n 15: Var Pass: \tret1, ret2 := processData(__taint_src, a)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/multiple_return_006_T/multiple_return_006_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(ret1)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/named_return_003_F/named_return_003_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/named_return_004_T/named_return_004_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/named_return_004_T/named_return_004_T.go\nLine 16: __taint_sink(ret)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/named_return_004_T/named_return_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/named_return_004_T/named_return_004_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: named_return_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/named_return_004_T/named_return_004_T.go\n AffectedNodeName: named_return_004_T\n 27: CALL: named_return_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/named_return_004_T/named_return_004_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func named_return_004_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/named_return_004_T/named_return_004_T.go\n AffectedNodeName: processData\n 15: CALL: \tret := processData(__taint_src, a)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/named_return_004_T/named_return_004_T.go\n AffectedNodeName: processData\n 15: CALL RETURN: \tret := processData(__taint_src, a)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/named_return_004_T/named_return_004_T.go\n AffectedNodeName: ret\n 15: Var Pass: \tret := processData(__taint_src, a)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/named_return_004_T/named_return_004_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(ret)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/return_value_passing_003_F/return_value_passing_003_F": "======================== Findings ========================\nNo findings!\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/return_value_passing_004_T/return_value_passing_004_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/return_value_passing_004_T/return_value_passing_004_T.go\nLine 14: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/return_value_passing_004_T/return_value_passing_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/return_value_passing_004_T/return_value_passing_004_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: return_value_passing_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/return_value_passing_004_T/return_value_passing_004_T.go\n AffectedNodeName: return_value_passing_004_T\n 25: CALL: return_value_passing_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/return_value_passing_004_T/return_value_passing_004_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func return_value_passing_004_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/return_value_passing_004_T/return_value_passing_004_T.go\n AffectedNodeName: process\n 13: CALL: \tdata := process(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/return_value_passing_004_T/return_value_passing_004_T.go\n AffectedNodeName: process\n 13: CALL RETURN: \tdata := process(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/return_value_passing_004_T/return_value_passing_004_T.go\n AffectedNodeName: data\n 13: Var Pass: \tdata := process(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/return_value_passing_004_T/return_value_passing_004_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(data)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/interface_class/interface_implementation/interface_class_001_c_T/interface_class_001_c_T": "======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/interface_class/interface_implementation/interface_class_001_c_T/interface_class_001_c_T.go\nLine 20: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/interface_class/interface_implementation/interface_class_001_c_T/interface_class_001_c_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/interface_class/interface_implementation/interface_class_001_c_T/interface_class_001_c_T.go\n AffectedNodeName: __taint_src\n 58: SOURCE: interface_class_001_c_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/interface_class/interface_implementation/interface_class_001_c_T/interface_class_001_c_T.go\n AffectedNodeName: interface_class_001_c_T\n 58: CALL: interface_class_001_c_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/interface_class/interface_implementation/interface_class_001_c_T/interface_class_001_c_T.go\n AffectedNodeName: __taint_src\n 11: ARG PASS: func interface_class_001_c_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/interface_class/interface_implementation/interface_class_001_c_T/interface_class_001_c_T.go\n AffectedNodeName: GetTest\n 19: CALL: \tresult, _ := testAPI.GetTest(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/interface_class/interface_implementation/interface_class_001_c_T/interface_class_001_c_T.go\n AffectedNodeName: GetTest\n 19: CALL RETURN: \tresult, _ := testAPI.GetTest(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/interface_class/interface_implementation/interface_class_001_c_T/interface_class_001_c_T.go\n 19: Var Pass: \tresult, _ := testAPI.GetTest(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/interface_class/interface_implementation/interface_class_001_c_T/interface_class_001_c_T.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================", "/benchmarks/sast-go/cases/completeness/single_app_tracing/interface_class/interface_implementation/interface_class_002_c_F/interface_class_002_c_F": "======================== Findings ========================\nNo findings!\n=========================================================="} +{"/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_001_F/argument_passing_reference_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_002_T/argument_passing_reference_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_002_T/argument_passing_reference_002_T.go\nLine 17: __taint_sink(obj.\"data\")\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_002_T/argument_passing_reference_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_002_T/argument_passing_reference_002_T.go\n AffectedNodeName: __taint_src\n 28: SOURCE: argument_passing_reference_002_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_002_T/argument_passing_reference_002_T.go\n AffectedNodeName: argument_passing_reference_002_T\n 28: CALL: argument_passing_reference_002_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_002_T/argument_passing_reference_002_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func argument_passing_reference_002_T(__taint_src interface{}) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_002_T/argument_passing_reference_002_T.go\n AffectedNodeName: process\n 16: CALL: \tprocess(obj, __taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_002_T/argument_passing_reference_002_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(obj[\"data\"])\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_003_F/argument_passing_reference_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_004_T/argument_passing_reference_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_004_T/argument_passing_reference_004_T.go\nLine 15: __taint_sink(arr)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_004_T/argument_passing_reference_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_004_T/argument_passing_reference_004_T.go\n AffectedNodeName: __taint_src\n 26: SOURCE: argument_passing_reference_005_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_004_T/argument_passing_reference_004_T.go\n AffectedNodeName: argument_passing_reference_005_T\n 26: CALL: argument_passing_reference_005_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_004_T/argument_passing_reference_004_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func argument_passing_reference_005_T(__taint_src interface{}) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_004_T/argument_passing_reference_004_T.go\n AffectedNodeName: process\n 14: CALL: \tprocess(arr, __taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_004_T/argument_passing_reference_004_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(arr)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_005_F/argument_passing_reference_005_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_006_T/argument_passing_reference_006_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_006_T/argument_passing_reference_006_T.go\nLine 17: __taint_sink(objB.\"name\")\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_006_T/argument_passing_reference_006_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_006_T/argument_passing_reference_006_T.go\n AffectedNodeName: __taint_src\n 30: SOURCE: argument_passing_reference_006_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_006_T/argument_passing_reference_006_T.go\n AffectedNodeName: argument_passing_reference_006_T\n 30: CALL: argument_passing_reference_006_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_006_T/argument_passing_reference_006_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func argument_passing_reference_006_T(__taint_src interface{}) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_006_T/argument_passing_reference_006_T.go\n AffectedNodeName: objA\n 13: Var Pass: \tobjA := map[string]interface{}{\"name\": __taint_src}\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_006_T/argument_passing_reference_006_T.go\n AffectedNodeName: swap\n 16: CALL: \tswap(objA, objB)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_006_T/argument_passing_reference_006_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(objB[\"name\"])\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_007_T/argument_passing_reference_007_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_007_T/argument_passing_reference_007_T.go\nLine 20: __taint_sink(&person.GetNamePointer())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_007_T/argument_passing_reference_007_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_007_T/argument_passing_reference_007_T.go\n AffectedNodeName: __taint_src\n 34: SOURCE: argument_passing_reference_007_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_007_T/argument_passing_reference_007_T.go\n AffectedNodeName: argument_passing_reference_007_T\n 34: CALL: argument_passing_reference_007_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_007_T/argument_passing_reference_007_T.go\n AffectedNodeName: __taint_src\n 16: ARG PASS: func argument_passing_reference_007_T(__taint_src string) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_007_T/argument_passing_reference_007_T.go\n AffectedNodeName: UpdateNamePointer\n 19: CALL: \t(&person).UpdateNamePointer(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_007_T/argument_passing_reference_007_T.go\n AffectedNodeName: GetNamePointer\n 20: CALL RETURN: \t__taint_sink((&person).GetNamePointer())\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_007_T/argument_passing_reference_007_T.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t__taint_sink((&person).GetNamePointer())\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_reference_008_F/argument_passing_reference_008_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_011_F/argument_passing_value_011_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_012_T/argument_passing_value_012_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_012_T/argument_passing_value_012_T.go\nLine 16: __taint_sink(arg)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_012_T/argument_passing_value_012_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_012_T/argument_passing_value_012_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: argument_passing_value_012_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_012_T/argument_passing_value_012_T.go\n AffectedNodeName: argument_passing_value_012_T\n 23: CALL: argument_passing_value_012_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_012_T/argument_passing_value_012_T.go\n AffectedNodeName: __taint_src\n 11: ARG PASS: func argument_passing_value_012_T(__taint_src string) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_012_T/argument_passing_value_012_T.go\n AffectedNodeName: process\n 12: CALL: \tprocess(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_012_T/argument_passing_value_012_T.go\n AffectedNodeName: arg\n 15: ARG PASS: func process(arg string) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_012_T/argument_passing_value_012_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(arg)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_013_F/argument_passing_value_013_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_014_T/argument_passing_value_014_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_014_T/argument_passing_value_014_T.go\nLine 18: __taint_sink(arg)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_014_T/argument_passing_value_014_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_014_T/argument_passing_value_014_T.go\n AffectedNodeName: __taint_src\n 28: SOURCE: argument_passing_value_014_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_014_T/argument_passing_value_014_T.go\n AffectedNodeName: argument_passing_value_014_T\n 28: CALL: argument_passing_value_014_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_014_T/argument_passing_value_014_T.go\n AffectedNodeName: __taint_src\n 11: ARG PASS: func argument_passing_value_014_T(__taint_src interface{}) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_014_T/argument_passing_value_014_T.go\n AffectedNodeName: process1\n 14: CALL: \tprocess1(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_014_T/argument_passing_value_014_T.go\n AffectedNodeName: arg\n 17: ARG PASS: func process1(arg interface{}) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_014_T/argument_passing_value_014_T.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t__taint_sink(arg)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_015_F/argument_passing_value_015_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_016_T/argument_passing_value_016_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_016_T/argument_passing_value_016_T.go\nLine 16: __taint_sink(arg1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_016_T/argument_passing_value_016_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_016_T/argument_passing_value_016_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: argument_passing_value_016_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_016_T/argument_passing_value_016_T.go\n AffectedNodeName: argument_passing_value_016_T\n 22: CALL: argument_passing_value_016_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_016_T/argument_passing_value_016_T.go\n AffectedNodeName: __taint_src\n 11: ARG PASS: func argument_passing_value_016_T(__taint_src string) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_016_T/argument_passing_value_016_T.go\n AffectedNodeName: process\n 12: CALL: \tprocess(__taint_src, \"_\")\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_016_T/argument_passing_value_016_T.go\n AffectedNodeName: arg1\n 15: ARG PASS: func process(arg1 string, arg2 string) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_016_T/argument_passing_value_016_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(arg1)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_001_F/multiple_return_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_002_T/multiple_return_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_002_T/multiple_return_002_T.go\nLine 17: __taint_sink(ret1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_002_T/multiple_return_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_002_T/multiple_return_002_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: multiple_return_002_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_002_T/multiple_return_002_T.go\n AffectedNodeName: multiple_return_002_T\n 27: CALL: multiple_return_002_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_002_T/multiple_return_002_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func multiple_return_002_T(__taint_src interface{}) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_002_T/multiple_return_002_T.go\n AffectedNodeName: processData\n 15: CALL: \tret1, ret2 := processData(__taint_src, a)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_002_T/multiple_return_002_T.go\n AffectedNodeName: processData\n 15: CALL RETURN: \tret1, ret2 := processData(__taint_src, a)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_002_T/multiple_return_002_T.go\n 15: Var Pass: \tret1, ret2 := processData(__taint_src, a)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_002_T/multiple_return_002_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(ret1)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_003_F/multiple_return_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_004_T/multiple_return_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_004_T/multiple_return_004_T.go\nLine 17: __taint_sink(ret2)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_004_T/multiple_return_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_004_T/multiple_return_004_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: multiple_return_004_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_004_T/multiple_return_004_T.go\n AffectedNodeName: multiple_return_004_T\n 27: CALL: multiple_return_004_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_004_T/multiple_return_004_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func multiple_return_004_T(__taint_src interface{}) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_004_T/multiple_return_004_T.go\n AffectedNodeName: processData\n 15: CALL: \tret1, ret2 := processData(__taint_src, a)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_004_T/multiple_return_004_T.go\n AffectedNodeName: processData\n 15: CALL RETURN: \tret1, ret2 := processData(__taint_src, a)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_004_T/multiple_return_004_T.go\n 15: Var Pass: \tret1, ret2 := processData(__taint_src, a)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/multiple_return_004_T/multiple_return_004_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(ret2)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/named_return_001_F/named_return_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/named_return_002_T/named_return_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/named_return_002_T/named_return_002_T.go\nLine 15: __taint_sink(ret)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/named_return_002_T/named_return_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/named_return_002_T/named_return_002_T.go\n AffectedNodeName: __taint_src\n 26: SOURCE: named_return_002_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/named_return_002_T/named_return_002_T.go\n AffectedNodeName: named_return_002_T\n 26: CALL: named_return_002_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/named_return_002_T/named_return_002_T.go\n AffectedNodeName: __taint_src\n 11: ARG PASS: func named_return_002_T(__taint_src interface{}) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/named_return_002_T/named_return_002_T.go\n AffectedNodeName: processData\n 14: CALL: \tret := processData(__taint_src, a)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/named_return_002_T/named_return_002_T.go\n AffectedNodeName: processData\n 14: CALL RETURN: \tret := processData(__taint_src, a)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/named_return_002_T/named_return_002_T.go\n AffectedNodeName: ret\n 14: Var Pass: \tret := processData(__taint_src, a)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/named_return_002_T/named_return_002_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(ret)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_001_F/return_value_passing_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_002_T/return_value_passing_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_002_T/return_value_passing_002_T.go\nLine 13: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_002_T/return_value_passing_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_002_T/return_value_passing_002_T.go\n AffectedNodeName: __taint_src\n 24: SOURCE: return_value_passing_002_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_002_T/return_value_passing_002_T.go\n AffectedNodeName: return_value_passing_002_T\n 24: CALL: return_value_passing_002_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_002_T/return_value_passing_002_T.go\n AffectedNodeName: __taint_src\n 11: ARG PASS: func return_value_passing_002_T(__taint_src interface{}) {\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_002_T/return_value_passing_002_T.go\n AffectedNodeName: process\n 12: CALL: \tdata := process(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_002_T/return_value_passing_002_T.go\n AffectedNodeName: process\n 12: CALL RETURN: \tdata := process(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_002_T/return_value_passing_002_T.go\n AffectedNodeName: data\n 12: Var Pass: \tdata := process(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_002_T/return_value_passing_002_T.go\n AffectedNodeName: __taint_sink\n 13: SINK: \t__taint_sink(data)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/multi_invoke/multi_invoke_001_F/multi_invoke_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/multi_invoke/multi_invoke_002_T/multi_invoke_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/multi_invoke/multi_invoke_002_T/multi_invoke_002_T.go\nLine 16: __taint_sink(a)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/multi_invoke/multi_invoke_002_T/multi_invoke_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/multi_invoke/multi_invoke_002_T/multi_invoke_002_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: multi_invoke_002_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/multi_invoke/multi_invoke_002_T/multi_invoke_002_T.go\n AffectedNodeName: multi_invoke_002_T\n 27: CALL: multi_invoke_002_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/multi_invoke/multi_invoke_002_T/multi_invoke_002_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func multi_invoke_002_T(__taint_src string) {\n /sast-go/cases/accuracy/context_sensitive/multi_invoke/multi_invoke_002_T/multi_invoke_002_T.go\n AffectedNodeName: process\n 13: CALL: \ta := process(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/multi_invoke/multi_invoke_002_T/multi_invoke_002_T.go\n AffectedNodeName: process\n 13: CALL RETURN: \ta := process(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/multi_invoke/multi_invoke_002_T/multi_invoke_002_T.go\n AffectedNodeName: a\n 13: Var Pass: \ta := process(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/multi_invoke/multi_invoke_002_T/multi_invoke_002_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(a)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_001_T/polymorphism_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_001_T/polymorphism_001_T.go\nLine 15: __taint_sink(sub.call(__taint_src))\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_001_T/polymorphism_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_001_T/polymorphism_001_T.go\n AffectedNodeName: __taint_src\n 38: SOURCE: polymorphism_001_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_001_T/polymorphism_001_T.go\n AffectedNodeName: polymorphism_001_T\n 38: CALL: polymorphism_001_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_001_T/polymorphism_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func polymorphism_001_T(__taint_src interface{}) {\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_001_T/polymorphism_001_T.go\n AffectedNodeName: call\n 15: CALL: \t__taint_sink(sub.call(__taint_src))\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_001_T/polymorphism_001_T.go\n AffectedNodeName: call\n 15: CALL RETURN: \t__taint_sink(sub.call(__taint_src))\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_001_T/polymorphism_001_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(sub.call(__taint_src))\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_002_F/polymorphism_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_003_T/polymorphism_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_003_T/polymorphism_003_T.go\nLine 15: __taint_sink(student.Run())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_003_T/polymorphism_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_003_T/polymorphism_003_T.go\n AffectedNodeName: __taint_src\n 46: SOURCE: polymorphism_003_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_003_T/polymorphism_003_T.go\n AffectedNodeName: polymorphism_003_T\n 46: CALL: polymorphism_003_T(__taint_src)\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_003_T/polymorphism_003_T.go\n AffectedNodeName: __taint_src\n 11: ARG PASS: func polymorphism_003_T(__taint_src string) {\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_003_T/polymorphism_003_T.go\n AffectedNodeName: student\n 12: Var Pass: \tvar student Person = &Student{Name: __taint_src, Age: 20, GPA: 3.8}\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_003_T/polymorphism_003_T.go\n AffectedNodeName: Run\n 15: CALL RETURN: \t__taint_sink(student.Run())\n /sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_003_T/polymorphism_003_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(student.Run())\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/context_sensitive/polymorphism/polymorphism_004_F/polymorphism_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/multidimensional_collection/array_index_005_T/array_index_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/multidimensional_collection/array_index_005_T/array_index_005_T.go\nLine 14: __taint_sink(str.0.0)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/multidimensional_collection/array_index_005_T/array_index_005_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/multidimensional_collection/array_index_005_T/array_index_005_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: array_index_005_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/multidimensional_collection/array_index_005_T/array_index_005_T.go\n AffectedNodeName: array_index_005_T\n 21: CALL: array_index_005_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/multidimensional_collection/array_index_005_T/array_index_005_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func array_index_005_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/multidimensional_collection/array_index_005_T/array_index_005_T.go\n AffectedNodeName: str\n 13: Var Pass: \tvar str = [3][1]string{[1]string{__taint_src}, [1]string{\"b\"}, [1]string{\"c\"}}\n /sast-go/cases/accuracy/field_sensitive/multidimensional_collection/array_index_005_T/array_index_005_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(str[0][0])\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/multidimensional_collection/array_index_006_F/array_index_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/multidimensional_collection/slice_index_003_T/slice_index_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/multidimensional_collection/slice_index_003_T/slice_index_003_T.go\nLine 18: __taint_sink(s.2.2)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/multidimensional_collection/slice_index_003_T/slice_index_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/multidimensional_collection/slice_index_003_T/slice_index_003_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: slice_index_003_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/multidimensional_collection/slice_index_003_T/slice_index_003_T.go\n AffectedNodeName: slice_index_003_T\n 25: CALL: slice_index_003_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/multidimensional_collection/slice_index_003_T/slice_index_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func slice_index_003_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/multidimensional_collection/slice_index_003_T/slice_index_003_T.go\n AffectedNodeName: s\n 13: Var Pass: \ts := [][]string{\n 14: Var Pass: \t\t[]string{\"a\"},\n 15: Var Pass: \t\t[]string{\"b\", \"c\"},\n 16: Var Pass: \t\t[]string{\"d\", \"e\", __taint_src},\n 17: Var Pass: \t}\n /sast-go/cases/accuracy/field_sensitive/multidimensional_collection/slice_index_003_T/slice_index_003_T.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t__taint_sink(s[2][2])\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/multidimensional_collection/slice_index_004_F/slice_index_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_001_T/array_index_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_001_T/array_index_001_T.go\nLine 14: __taint_sink(str.0)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_001_T/array_index_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_001_T/array_index_001_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: array_index_001_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_001_T/array_index_001_T.go\n AffectedNodeName: array_index_001_T\n 21: CALL: array_index_001_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_001_T/array_index_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func array_index_001_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_001_T/array_index_001_T.go\n AffectedNodeName: str\n 13: Var Pass: \tvar str = [3]string{__taint_src, \"b\", \"c\"}\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_001_T/array_index_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(str[0])\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_002_F/array_index_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_003_T/array_index_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_003_T/array_index_003_T.go\nLine 15: __taint_sink(str)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_003_T/array_index_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_003_T/array_index_003_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: array_index_003_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_003_T/array_index_003_T.go\n AffectedNodeName: array_index_003_T\n 22: CALL: array_index_003_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_003_T/array_index_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func array_index_003_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_003_T/array_index_003_T.go\n AffectedNodeName: str\n 13: Var Pass: \tvar str = [3]string{__taint_src, \"b\", \"c\"}\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_003_T/array_index_003_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(str)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_index_004_F/array_index_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T/map_field_sensitive_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T/map_field_sensitive_001_T.go\nLine 16: __taint_sink(m.\"key1\")\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T/map_field_sensitive_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T/map_field_sensitive_001_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: map_field_sensitive_001_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T/map_field_sensitive_001_T.go\n AffectedNodeName: map_field_sensitive_001_T\n 23: CALL: map_field_sensitive_001_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T/map_field_sensitive_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func map_field_sensitive_001_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T/map_field_sensitive_001_T.go\n AffectedNodeName: m[\"key1\"]\n 14: Var Pass: \tm[\"key1\"] = __taint_src\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T/map_field_sensitive_001_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(m[\"key1\"])\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_002_F/map_field_sensitive_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_003_F/map_field_sensitive_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T/map_field_sensitive_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T/map_field_sensitive_004_T.go\nLine 18: __taint_sink(m.\"key2\")\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T/map_field_sensitive_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T/map_field_sensitive_004_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: map_field_sensitive_004_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T/map_field_sensitive_004_T.go\n AffectedNodeName: map_field_sensitive_004_T\n 25: CALL: map_field_sensitive_004_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T/map_field_sensitive_004_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func map_field_sensitive_004_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T/map_field_sensitive_004_T.go\n AffectedNodeName: m[\"key2\"]\n 16: Var Pass: \tm[\"key2\"] = __taint_src\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T/map_field_sensitive_004_T.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t__taint_sink(m[\"key2\"])\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_005_F/map_field_sensitive_005_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_005_F/map_field_sensitive_005_F.go\nLine 17: __taint_sink(m.\"key1\")\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_005_F/map_field_sensitive_005_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_005_F/map_field_sensitive_005_F.go\n AffectedNodeName: __taint_src\n 24: SOURCE: map_field_sensitive_005_F(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_005_F/map_field_sensitive_005_F.go\n AffectedNodeName: map_field_sensitive_005_F\n 24: CALL: map_field_sensitive_005_F(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_005_F/map_field_sensitive_005_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func map_field_sensitive_005_F(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_005_F/map_field_sensitive_005_F.go\n AffectedNodeName: m[\"key1\"]\n 14: Var Pass: \tm[\"key1\"] = __taint_src\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_005_F/map_field_sensitive_005_F.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(m[\"key1\"])\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_001_T/slice_index_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_001_T/slice_index_001_T.go\nLine 14: __taint_sink(s.0)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_001_T/slice_index_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_001_T/slice_index_001_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: slice_index_001_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_001_T/slice_index_001_T.go\n AffectedNodeName: slice_index_001_T\n 21: CALL: slice_index_001_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_001_T/slice_index_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func slice_index_001_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_001_T/slice_index_001_T.go\n AffectedNodeName: s\n 13: Var Pass: \tvar s []string = []string{__taint_src, \"b\", \"c\"}\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_001_T/slice_index_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(s[0])\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_002_F/slice_index_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_005_T/slice_index_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_005_T/slice_index_005_T.go\nLine 16: __taint_sink(s.0)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_005_T/slice_index_005_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_005_T/slice_index_005_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: slice_index_005_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_005_T/slice_index_005_T.go\n AffectedNodeName: slice_index_005_T\n 23: CALL: slice_index_005_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_005_T/slice_index_005_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func slice_index_005_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_005_T/slice_index_005_T.go\n AffectedNodeName: arr\n 13: Var Pass: \tvar arr [3]string = [3]string{__taint_src, \"b\", \"c\"}\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_005_T/slice_index_005_T.go\n AffectedNodeName: s\n 15: Var Pass: \ts = arr[:]\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_005_T/slice_index_005_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(s[0])\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_006_F/slice_index_006_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_006_F/slice_index_006_F.go\nLine 16: __taint_sink(s.0)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_006_F/slice_index_006_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_006_F/slice_index_006_F.go\n AffectedNodeName: __taint_src\n 23: SOURCE: slice_index_006_F(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_006_F/slice_index_006_F.go\n AffectedNodeName: slice_index_006_F\n 23: CALL: slice_index_006_F(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_006_F/slice_index_006_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func slice_index_006_F(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_006_F/slice_index_006_F.go\n AffectedNodeName: arr\n 13: Var Pass: \tvar arr [3]string = [3]string{__taint_src, \"b\", \"c\"}\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_006_F/slice_index_006_F.go\n AffectedNodeName: s\n 15: Var Pass: \ts = arr[1:]\n /sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/slice_index_006_F/slice_index_006_F.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(s[0])\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_index_007_T/array_index_007_T":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_index_008_F/array_index_008_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/field_len_001_T/field_len_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/struct/field_len_001_T/field_len_001_T.go\nLine 30: __taint_sink(c.b.a.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/struct/field_len_001_T/field_len_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_001_T/field_len_001_T.go\n AffectedNodeName: __taint_src\n 37: SOURCE: field_len_001_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_001_T/field_len_001_T.go\n AffectedNodeName: field_len_001_T\n 37: CALL: field_len_001_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_001_T/field_len_001_T.go\n AffectedNodeName: __taint_src\n 22: ARG PASS: func field_len_001_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_001_T/field_len_001_T.go\n AffectedNodeName: pa\n 23: Var Pass: \tpa := A{\n 24: Var Pass: \t\tdata: __taint_src,\n 25: Var Pass: \t}\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_001_T/field_len_001_T.go\n AffectedNodeName: b.a\n 27: Var Pass: \tb.a = pa\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_001_T/field_len_001_T.go\n AffectedNodeName: c.b\n 29: Var Pass: \tc.b = b\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_001_T/field_len_001_T.go\n AffectedNodeName: __taint_sink\n 30: SINK: \t__taint_sink(c.b.a.data)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/field_len_002_F/field_len_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\nLine 100: __taint_sink(q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: __taint_src\n 107: SOURCE: field_len_003_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: field_len_003_T\n 107: CALL: field_len_003_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: __taint_src\n 64: ARG PASS: func field_len_003_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: pa\n 65: Var Pass: \tpa := A{\n 66: Var Pass: \t\tdata: __taint_src,\n 67: Var Pass: \t}\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: b.a\n 69: Var Pass: \tb.a = pa\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: c.b\n 71: Var Pass: \tc.b = b\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: d.c\n 73: Var Pass: \td.c = c\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: e.d\n 75: Var Pass: \te.d = d\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: f.e\n 77: Var Pass: \tf.e = e\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: g.f\n 79: Var Pass: \tg.f = f\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: h.g\n 81: Var Pass: \th.g = g\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: i.h\n 83: Var Pass: \ti.h = h\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: j.i\n 85: Var Pass: \tj.i = i\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: k.j\n 87: Var Pass: \tk.j = j\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: l.k\n 89: Var Pass: \tl.k = k\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: m.l\n 91: Var Pass: \tm.l = l\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: n.m\n 93: Var Pass: \tn.m = m\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: o.n\n 95: Var Pass: \to.n = n\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: p.o\n 97: Var Pass: \tp.o = o\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: q.p\n 99: Var Pass: \tq.p = p\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_003_T/field_len_003_T.go\n AffectedNodeName: __taint_sink\n 100: SINK: \t__taint_sink(q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.data)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/field_len_004_F/field_len_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\nLine 47: __taint_sink(q)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: __taint_src\n 54: SOURCE: field_len_005_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: field_len_005_T\n 54: CALL: field_len_005_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: __taint_src\n 31: ARG PASS: func field_len_005_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: pa\n 32: Var Pass: \tpa := A{\n 33: Var Pass: \t\tdata: __taint_src,\n 34: Var Pass: \t}\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: b.a\n 36: Var Pass: \tb.a = pa\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: c.b\n 38: Var Pass: \tc.b = b\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: d.c\n 40: Var Pass: \td.c = c\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: e.d\n 42: Var Pass: \te.d = d\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: f.e\n 44: Var Pass: \tf.e = e\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: p\n 45: Var Pass: \tp := f.e.d.c\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: q\n 46: Var Pass: \tq := p.b.a.data\n /sast-go/cases/accuracy/field_sensitive/struct/field_len_005_T/field_len_005_T.go\n AffectedNodeName: __taint_sink\n 47: SINK: \t__taint_sink(q)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/field_len_006_F/field_len_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/struct_field_001_T/struct_field_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/struct/struct_field_001_T/struct_field_001_T.go\nLine 22: __taint_sink(p.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/struct/struct_field_001_T/struct_field_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_001_T/struct_field_001_T.go\n AffectedNodeName: __taint_src\n 29: SOURCE: struct_field_001_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_001_T/struct_field_001_T.go\n AffectedNodeName: struct_field_001_T\n 29: CALL: struct_field_001_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_001_T/struct_field_001_T.go\n AffectedNodeName: __taint_src\n 17: ARG PASS: func struct_field_001_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_001_T/struct_field_001_T.go\n AffectedNodeName: p\n 18: Var Pass: \tp := A{\n 19: Var Pass: \t\tdata: __taint_src,\n 20: Var Pass: \t\tsani: \"_\",\n 21: Var Pass: \t}\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_001_T/struct_field_001_T.go\n AffectedNodeName: __taint_sink\n 22: SINK: \t__taint_sink(p.data)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/struct_field_002_F/struct_field_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/struct_field_003_T/struct_field_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/struct/struct_field_003_T/struct_field_003_T.go\nLine 21: __taint_sink(p1.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/struct/struct_field_003_T/struct_field_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_003_T/struct_field_003_T.go\n AffectedNodeName: __taint_src\n 28: SOURCE: struct_field_003_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_003_T/struct_field_003_T.go\n AffectedNodeName: struct_field_003_T\n 28: CALL: struct_field_003_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_003_T/struct_field_003_T.go\n AffectedNodeName: __taint_src\n 17: ARG PASS: func struct_field_003_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_003_T/struct_field_003_T.go\n AffectedNodeName: p1.data\n 19: Var Pass: \tp1.data = __taint_src\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_003_T/struct_field_003_T.go\n AffectedNodeName: __taint_sink\n 21: SINK: \t__taint_sink(p1.data)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/struct_field_004_F/struct_field_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/struct_field_005_T/struct_field_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/field_sensitive/struct/struct_field_005_T/struct_field_005_T.go\nLine 19: __taint_sink(p1.string)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/field_sensitive/struct/struct_field_005_T/struct_field_005_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_005_T/struct_field_005_T.go\n AffectedNodeName: __taint_src\n 26: SOURCE: struct_field_005_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_005_T/struct_field_005_T.go\n AffectedNodeName: struct_field_005_T\n 26: CALL: struct_field_005_T(__taint_src)\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_005_T/struct_field_005_T.go\n AffectedNodeName: __taint_src\n 16: ARG PASS: func struct_field_005_T(__taint_src string) {\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_005_T/struct_field_005_T.go\n AffectedNodeName: p1.string\n 18: Var Pass: \tp1.string = __taint_src\n /sast-go/cases/accuracy/field_sensitive/struct/struct_field_005_T/struct_field_005_T.go\n AffectedNodeName: __taint_sink\n 19: SINK: \t__taint_sink(p1.string)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/field_sensitive/struct/struct_field_006_F/struct_field_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/flow_sensitive/asynchronous/asynchronous_execution_001_T/asynchronous_execution_001_T":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/flow_sensitive/asynchronous/asynchronous_execution_002_F/asynchronous_execution_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/flow_sensitive/defer_exectution/defer_exectution_001_T/defer_exectution_001_T":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/flow_sensitive/defer_exectution/defer_exectution_002_F/defer_exectution_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_001_T/for_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_001_T/for_001_T.go\nLine 16: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_001_T/for_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_001_T/for_001_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: for_001_T(__taint_src)\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_001_T/for_001_T.go\n AffectedNodeName: for_001_T\n 23: CALL: for_001_T(__taint_src)\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_001_T/for_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func for_001_T(__taint_src string) {\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_001_T/for_001_T.go\n AffectedNodeName: res\n 15: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_001_T/for_001_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t\t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_002_F/for_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_002_F/for_002_F.go\nLine 15: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_002_F/for_002_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_002_F/for_002_F.go\n AffectedNodeName: __taint_src\n 23: SOURCE: for_002_F(__taint_src)\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_002_F/for_002_F.go\n AffectedNodeName: for_002_F\n 23: CALL: for_002_F(__taint_src)\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_002_F/for_002_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func for_002_F(__taint_src string) {\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_002_F/for_002_F.go\n AffectedNodeName: res\n 16: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_002_F/for_002_F.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t\t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_003_T/for_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_003_T/for_003_T.go\nLine 16: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_003_T/for_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_003_T/for_003_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: for_003_T(__taint_src)\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_003_T/for_003_T.go\n AffectedNodeName: for_003_T\n 23: CALL: for_003_T(__taint_src)\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_003_T/for_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func for_003_T(__taint_src string) {\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_003_T/for_003_T.go\n AffectedNodeName: res\n 15: Var Pass: \tfor res = __taint_src; i < 1; i++ {\n /sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_003_T/for_003_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t\t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/flow_sensitive/loop_stmt/for_004_F/for_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_001_T/array_obj_sensitive_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_001_T/array_obj_sensitive_001_T.go\nLine 16: __taint_sink(str)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_001_T/array_obj_sensitive_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_001_T/array_obj_sensitive_001_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: array_obj_sensitive_001_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_001_T/array_obj_sensitive_001_T.go\n AffectedNodeName: array_obj_sensitive_001_T\n 23: CALL: array_obj_sensitive_001_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_001_T/array_obj_sensitive_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func array_obj_sensitive_001_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_001_T/array_obj_sensitive_001_T.go\n AffectedNodeName: str\n 13: Var Pass: \tvar str = [3]string{__taint_src, \"b\", \"c\"}\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_001_T/array_obj_sensitive_001_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(str)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_002_F/array_obj_sensitive_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_003_T/array_obj_sensitive_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_003_T/array_obj_sensitive_003_T.go\nLine 16: __taint_sink(str)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_003_T/array_obj_sensitive_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_003_T/array_obj_sensitive_003_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: array_obj_sensitive_003_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_003_T/array_obj_sensitive_003_T.go\n AffectedNodeName: array_obj_sensitive_003_T\n 23: CALL: array_obj_sensitive_003_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_003_T/array_obj_sensitive_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func array_obj_sensitive_003_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_003_T/array_obj_sensitive_003_T.go\n AffectedNodeName: str\n 13: Var Pass: \tvar str = [3][1]string{[1]string{__taint_src}, [1]string{\"b\"}, [1]string{\"c\"}}\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_003_T/array_obj_sensitive_003_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(str)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_004_F/array_obj_sensitive_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_007_T/array_obj_sensitive_007_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_007_T/array_obj_sensitive_007_T.go\nLine 16: __taint_sink(str)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_007_T/array_obj_sensitive_007_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_007_T/array_obj_sensitive_007_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: array_obj_sensitive_007_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_007_T/array_obj_sensitive_007_T.go\n AffectedNodeName: array_obj_sensitive_007_T\n 22: CALL: array_obj_sensitive_007_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_007_T/array_obj_sensitive_007_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func array_obj_sensitive_007_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_007_T/array_obj_sensitive_007_T.go\n AffectedNodeName: str\n 13: Var Pass: \tvar str = [...]string{__taint_src, \"b\", \"c\"}\n /sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_007_T/array_obj_sensitive_007_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(str)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/array_obj_sensitive_008_F/array_obj_sensitive_008_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_001_T/map_obj_sensitive_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_001_T/map_obj_sensitive_001_T.go\nLine 17: __taint_sink(m)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_001_T/map_obj_sensitive_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_001_T/map_obj_sensitive_001_T.go\n AffectedNodeName: __taint_src\n 24: SOURCE: map_obj_sensitive_001_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_001_T/map_obj_sensitive_001_T.go\n AffectedNodeName: map_obj_sensitive_001_T\n 24: CALL: map_obj_sensitive_001_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_001_T/map_obj_sensitive_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func map_obj_sensitive_001_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_001_T/map_obj_sensitive_001_T.go\n AffectedNodeName: m[\"key1\"]\n 15: Var Pass: \tm[\"key1\"] = __taint_src\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_001_T/map_obj_sensitive_001_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(m)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_002_T/map_obj_sensitive_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_002_T/map_obj_sensitive_002_T.go\nLine 15: __taint_sink(m)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_002_T/map_obj_sensitive_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_002_T/map_obj_sensitive_002_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: map_obj_sensitive_002_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_002_T/map_obj_sensitive_002_T.go\n AffectedNodeName: map_obj_sensitive_002_T\n 22: CALL: map_obj_sensitive_002_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_002_T/map_obj_sensitive_002_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func map_obj_sensitive_002_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_002_T/map_obj_sensitive_002_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(m)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_003_F/map_obj_sensitive_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_004_T/map_obj_sensitive_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_004_T/map_obj_sensitive_004_T.go\nLine 20: __taint_sink(m)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_004_T/map_obj_sensitive_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_004_T/map_obj_sensitive_004_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: map_obj_sensitive_004_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_004_T/map_obj_sensitive_004_T.go\n AffectedNodeName: map_obj_sensitive_004_T\n 27: CALL: map_obj_sensitive_004_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_004_T/map_obj_sensitive_004_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func map_obj_sensitive_004_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_004_T/map_obj_sensitive_004_T.go\n AffectedNodeName: m\n 13: Var Pass: \tm := map[string]string{\n 14: Var Pass: \t\t\"key1\": __taint_src,\n 15: Var Pass: \t}\n /sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_004_T/map_obj_sensitive_004_T.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t__taint_sink(m)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/map_obj_sensitive_005_F/map_obj_sensitive_005_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_001_T/slice_obj_sensitive_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_001_T/slice_obj_sensitive_001_T.go\nLine 18: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_001_T/slice_obj_sensitive_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_001_T/slice_obj_sensitive_001_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: slice_001slice_obj_sensitive_001_T_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_001_T/slice_obj_sensitive_001_T.go\n AffectedNodeName: slice_001slice_obj_sensitive_001_T_T\n 25: CALL: slice_001slice_obj_sensitive_001_T_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_001_T/slice_obj_sensitive_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func slice_001slice_obj_sensitive_001_T_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_001_T/slice_obj_sensitive_001_T.go\n AffectedNodeName: arr\n 13: Var Pass: \tvar arr [3]string = [3]string{__taint_src, \"b\", \"c\"}\n /sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_001_T/slice_obj_sensitive_001_T.go\n AffectedNodeName: s\n 17: Var Pass: \ts = arr[:]\n /sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_001_T/slice_obj_sensitive_001_T.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t__taint_sink(s)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_002_F/slice_obj_sensitive_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_003_T/slice_obj_sensitive_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_003_T/slice_obj_sensitive_003_T.go\nLine 24: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_003_T/slice_obj_sensitive_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_003_T/slice_obj_sensitive_003_T.go\n AffectedNodeName: __taint_src\n 31: SOURCE: slice_obj_sensitive_003_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_003_T/slice_obj_sensitive_003_T.go\n AffectedNodeName: slice_obj_sensitive_003_T\n 31: CALL: slice_obj_sensitive_003_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_003_T/slice_obj_sensitive_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func slice_obj_sensitive_003_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_003_T/slice_obj_sensitive_003_T.go\n AffectedNodeName: s\n 13: Var Pass: \ts := [][]string{\n 14: Var Pass: \t\t[]string{\"a\"},\n 15: Var Pass: \t\t[]string{\"b\", \"c\"},\n 16: Var Pass: \t\t[]string{\"d\", \"e\", __taint_src},\n 17: Var Pass: \t}\n /sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_003_T/slice_obj_sensitive_003_T.go\n AffectedNodeName: __taint_sink\n 24: SINK: \t__taint_sink(s)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/collection/slice_obj_sensitive_004_F/slice_obj_sensitive_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_001_F/interface_class_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_002_T/interface_class_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_002_T/interface_class_002_T.go\nLine 41: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_002_T/interface_class_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_002_T/interface_class_002_T.go\n AffectedNodeName: __taint_src\n 48: SOURCE: interface_class_002_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_002_T/interface_class_002_T.go\n AffectedNodeName: interface_class_002_T\n 48: CALL: interface_class_002_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_002_T/interface_class_002_T.go\n AffectedNodeName: __taint_src\n 38: ARG PASS: func interface_class_002_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_002_T/interface_class_002_T.go\n AffectedNodeName: process\n 40: CALL: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_002_T/interface_class_002_T.go\n AffectedNodeName: process\n 40: CALL RETURN: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_002_T/interface_class_002_T.go\n AffectedNodeName: res\n 40: Var Pass: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_002_T/interface_class_002_T.go\n AffectedNodeName: __taint_sink\n 41: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_003_F/interface_class_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_004_T/interface_class_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_004_T/interface_class_004_T.go\nLine 47: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_004_T/interface_class_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_004_T/interface_class_004_T.go\n AffectedNodeName: __taint_src\n 54: SOURCE: interface_class_004_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_004_T/interface_class_004_T.go\n AffectedNodeName: interface_class_004_T\n 54: CALL: interface_class_004_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_004_T/interface_class_004_T.go\n AffectedNodeName: __taint_src\n 44: ARG PASS: func interface_class_004_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_004_T/interface_class_004_T.go\n AffectedNodeName: process\n 46: CALL: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_004_T/interface_class_004_T.go\n AffectedNodeName: process\n 46: CALL RETURN: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_004_T/interface_class_004_T.go\n AffectedNodeName: res\n 46: Var Pass: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_004_T/interface_class_004_T.go\n AffectedNodeName: __taint_sink\n 47: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_005_F/interface_class_005_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_006_T/interface_class_006_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_006_T/interface_class_006_T.go\nLine 39: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_006_T/interface_class_006_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_006_T/interface_class_006_T.go\n AffectedNodeName: __taint_src\n 46: SOURCE: interface_class_006_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_006_T/interface_class_006_T.go\n AffectedNodeName: interface_class_006_T\n 46: CALL: interface_class_006_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_006_T/interface_class_006_T.go\n AffectedNodeName: __taint_src\n 36: ARG PASS: func interface_class_006_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_006_T/interface_class_006_T.go\n AffectedNodeName: process\n 38: CALL: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_006_T/interface_class_006_T.go\n AffectedNodeName: process\n 38: CALL RETURN: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_006_T/interface_class_006_T.go\n AffectedNodeName: res\n 38: Var Pass: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_006_T/interface_class_006_T.go\n AffectedNodeName: __taint_sink\n 39: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_007_F/interface_class_007_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_008_T/interface_class_008_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_008_T/interface_class_008_T.go\nLine 34: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_008_T/interface_class_008_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_008_T/interface_class_008_T.go\n AffectedNodeName: __taint_src\n 41: SOURCE: interface_class_008_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_008_T/interface_class_008_T.go\n AffectedNodeName: interface_class_008_T\n 41: CALL: interface_class_008_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_008_T/interface_class_008_T.go\n AffectedNodeName: __taint_src\n 31: ARG PASS: func interface_class_008_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_008_T/interface_class_008_T.go\n AffectedNodeName: process\n 33: CALL: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_008_T/interface_class_008_T.go\n AffectedNodeName: process\n 33: CALL RETURN: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_008_T/interface_class_008_T.go\n AffectedNodeName: res\n 33: Var Pass: \tres := iTestService.process(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_008_T/interface_class_008_T.go\n AffectedNodeName: __taint_sink\n 34: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_009_F/interface_class_009_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_010_T/interface_class_010_T":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_011_F/interface_class_011_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_012_T/interface_class_012_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_012_T/interface_class_012_T.go\nLine 46: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_012_T/interface_class_012_T.go\",\"functionName\":\"interface_class_012_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_012_T/interface_class_012_T.go\n AffectedNodeName: __taint_src\n 43: SOURCE: func interface_class_012_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_012_T/interface_class_012_T.go\n AffectedNodeName: processArg\n 45: CALL: \tres := processArg(iTestService, __taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_012_T/interface_class_012_T.go\n AffectedNodeName: processArg\n 45: CALL RETURN: \tres := processArg(iTestService, __taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_012_T/interface_class_012_T.go\n AffectedNodeName: res\n 45: Var Pass: \tres := processArg(iTestService, __taint_src)\n /sast-go/cases/accuracy/object_sensitive/interface_class/interface_class_012_T/interface_class_012_T.go\n AffectedNodeName: __taint_sink\n 46: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_007_T/struct_007_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/struct/struct_007_T/struct_007_T.go\nLine 24: __taint_sink(p)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/struct/struct_007_T/struct_007_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/struct/struct_007_T/struct_007_T.go\n AffectedNodeName: __taint_src\n 31: SOURCE: struct_007_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_007_T/struct_007_T.go\n AffectedNodeName: struct_007_T\n 31: CALL: struct_007_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_007_T/struct_007_T.go\n AffectedNodeName: __taint_src\n 16: ARG PASS: func struct_007_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/struct/struct_007_T/struct_007_T.go\n AffectedNodeName: p\n 17: Var Pass: \tp := A{\n 18: Var Pass: \t\tdata: __taint_src,\n 19: Var Pass: \t}\n /sast-go/cases/accuracy/object_sensitive/struct/struct_007_T/struct_007_T.go\n AffectedNodeName: __taint_sink\n 24: SINK: \t__taint_sink(p)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_008_F/struct_008_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_001_T/struct_deep10_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_001_T/struct_deep10_001_T.go\nLine 57: __taint_sink(obj1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_001_T/struct_deep10_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_001_T/struct_deep10_001_T.go\n AffectedNodeName: __taint_src\n 65: SOURCE: struct_deep10_001_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_001_T/struct_deep10_001_T.go\n AffectedNodeName: struct_deep10_001_T\n 65: CALL: struct_deep10_001_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_001_T/struct_deep10_001_T.go\n AffectedNodeName: __taint_src\n 50: ARG PASS: func struct_deep10_001_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_001_T/struct_deep10_001_T.go\n AffectedNodeName: obj1.deepA02.deepA03.deepA04.deepA05.deepA06.deepA07.deepA08.deepA09.deepA10.deepA11\n 55: Var Pass: \tobj1.deepA02.deepA03.deepA04.deepA05.deepA06.deepA07.deepA08.deepA09.deepA10.deepA11 = __taint_src\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_001_T/struct_deep10_001_T.go\n AffectedNodeName: __taint_sink\n 57: SINK: \t__taint_sink(obj1)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_002_F/struct_deep10_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_002_F/struct_deep10_002_F.go\nLine 57: __taint_sink(obj2)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_002_F/struct_deep10_002_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_002_F/struct_deep10_002_F.go\n AffectedNodeName: __taint_src\n 65: SOURCE: struct_deep10_002_F(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_002_F/struct_deep10_002_F.go\n AffectedNodeName: struct_deep10_002_F\n 65: CALL: struct_deep10_002_F(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_002_F/struct_deep10_002_F.go\n AffectedNodeName: __taint_src\n 50: ARG PASS: func struct_deep10_002_F(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_002_F/struct_deep10_002_F.go\n AffectedNodeName: obj1.deepA02.deepA03.deepA04.deepA05.deepA06.deepA07.deepA08.deepA09.deepA10.deepA11\n 55: Var Pass: \tobj1.deepA02.deepA03.deepA04.deepA05.deepA06.deepA07.deepA08.deepA09.deepA10.deepA11 = __taint_src\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep10_002_F/struct_deep10_002_F.go\n AffectedNodeName: __taint_sink\n 57: SINK: \t__taint_sink(obj2)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_001_T/struct_deep3_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_001_T/struct_deep3_001_T.go\nLine 31: __taint_sink(obj1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_001_T/struct_deep3_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_001_T/struct_deep3_001_T.go\n AffectedNodeName: __taint_src\n 39: SOURCE: struct_deep3_001_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_001_T/struct_deep3_001_T.go\n AffectedNodeName: struct_deep3_001_T\n 39: CALL: struct_deep3_001_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_001_T/struct_deep3_001_T.go\n AffectedNodeName: __taint_src\n 24: ARG PASS: func struct_deep3_001_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_001_T/struct_deep3_001_T.go\n AffectedNodeName: obj1.deepC02.deepC03.deepC04\n 29: Var Pass: \tobj1.deepC02.deepC03.deepC04 = __taint_src\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_001_T/struct_deep3_001_T.go\n AffectedNodeName: __taint_sink\n 31: SINK: \t__taint_sink(obj1)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_002_F/struct_deep3_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_002_F/struct_deep3_002_F.go\nLine 30: __taint_sink(obj2)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_002_F/struct_deep3_002_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_002_F/struct_deep3_002_F.go\n AffectedNodeName: __taint_src\n 38: SOURCE: struct_deep3_002_F(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_002_F/struct_deep3_002_F.go\n AffectedNodeName: struct_deep3_002_F\n 38: CALL: struct_deep3_002_F(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_002_F/struct_deep3_002_F.go\n AffectedNodeName: __taint_src\n 24: ARG PASS: func struct_deep3_002_F(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_002_F/struct_deep3_002_F.go\n AffectedNodeName: obj1.deepC02.deepC03.deepC04\n 29: Var Pass: \tobj1.deepC02.deepC03.deepC04 = __taint_src\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_002_F/struct_deep3_002_F.go\n AffectedNodeName: __taint_sink\n 30: SINK: \t__taint_sink(obj2)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_003_T/struct_deep3_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_003_T/struct_deep3_003_T.go\nLine 34: __taint_sink(obj1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_003_T/struct_deep3_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_003_T/struct_deep3_003_T.go\n AffectedNodeName: __taint_src\n 42: SOURCE: struct_deep3_003_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_003_T/struct_deep3_003_T.go\n AffectedNodeName: struct_deep3_003_T\n 42: CALL: struct_deep3_003_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_003_T/struct_deep3_003_T.go\n AffectedNodeName: __taint_src\n 24: ARG PASS: func struct_deep3_003_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_003_T/struct_deep3_003_T.go\n AffectedNodeName: deepC03\n 29: Var Pass: \tdeepC03 := DeepC03{\n 30: Var Pass: \t\tdeepC04: __taint_src,\n 31: Var Pass: \t}\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_003_T/struct_deep3_003_T.go\n AffectedNodeName: obj1.deepC02.deepC03\n 32: Var Pass: \tobj1.deepC02.deepC03 = deepC03\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_003_T/struct_deep3_003_T.go\n AffectedNodeName: __taint_sink\n 34: SINK: \t__taint_sink(obj1)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_deep3_004_F/struct_deep3_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_001_T/struct_deep5_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_001_T/struct_deep5_001_T.go\nLine 35: __taint_sink(obj1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_001_T/struct_deep5_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_001_T/struct_deep5_001_T.go\n AffectedNodeName: __taint_src\n 43: SOURCE: struct_deep5_001_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_001_T/struct_deep5_001_T.go\n AffectedNodeName: struct_deep5_001_T\n 43: CALL: struct_deep5_001_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_001_T/struct_deep5_001_T.go\n AffectedNodeName: __taint_src\n 28: ARG PASS: func struct_deep5_001_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_001_T/struct_deep5_001_T.go\n AffectedNodeName: obj1.deepB02.deepB03.deepB04.deepB05\n 33: Var Pass: \tobj1.deepB02.deepB03.deepB04.deepB05 = __taint_src\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_001_T/struct_deep5_001_T.go\n AffectedNodeName: __taint_sink\n 35: SINK: \t__taint_sink(obj1)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_002_F/struct_deep5_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_002_F/struct_deep5_002_F.go\nLine 35: __taint_sink(obj2)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_002_F/struct_deep5_002_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_002_F/struct_deep5_002_F.go\n AffectedNodeName: __taint_src\n 43: SOURCE: struct_deep5_002_F(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_002_F/struct_deep5_002_F.go\n AffectedNodeName: struct_deep5_002_F\n 43: CALL: struct_deep5_002_F(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_002_F/struct_deep5_002_F.go\n AffectedNodeName: __taint_src\n 28: ARG PASS: func struct_deep5_002_F(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_002_F/struct_deep5_002_F.go\n AffectedNodeName: obj1.deepB02.deepB03.deepB04.deepB05\n 33: Var Pass: \tobj1.deepB02.deepB03.deepB04.deepB05 = __taint_src\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_002_F/struct_deep5_002_F.go\n AffectedNodeName: __taint_sink\n 35: SINK: \t__taint_sink(obj2)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_003_T/struct_deep5_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_003_T/struct_deep5_003_T.go\nLine 42: __taint_sink(obj1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_003_T/struct_deep5_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_003_T/struct_deep5_003_T.go\n AffectedNodeName: __taint_src\n 50: SOURCE: struct_deep5_003_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_003_T/struct_deep5_003_T.go\n AffectedNodeName: struct_deep5_003_T\n 50: CALL: struct_deep5_003_T(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_003_T/struct_deep5_003_T.go\n AffectedNodeName: __taint_src\n 32: ARG PASS: func struct_deep5_003_T(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_003_T/struct_deep5_003_T.go\n AffectedNodeName: deepB05\n 37: Var Pass: \tdeepB05 := DeepB05{\n 38: Var Pass: \t\tdeepB06: __taint_src,\n 39: Var Pass: \t}\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_003_T/struct_deep5_003_T.go\n AffectedNodeName: obj1.deepB02.deepB03.deepB04.deepB05\n 40: Var Pass: \tobj1.deepB02.deepB03.deepB04.deepB05 = deepB05\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_003_T/struct_deep5_003_T.go\n AffectedNodeName: __taint_sink\n 42: SINK: \t__taint_sink(obj1)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_004_F/struct_deep5_004_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_004_F/struct_deep5_004_F.go\nLine 42: __taint_sink(obj2)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_004_F/struct_deep5_004_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_004_F/struct_deep5_004_F.go\n AffectedNodeName: __taint_src\n 50: SOURCE: struct_deep5_004_F(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_004_F/struct_deep5_004_F.go\n AffectedNodeName: struct_deep5_004_F\n 50: CALL: struct_deep5_004_F(__taint_src)\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_004_F/struct_deep5_004_F.go\n AffectedNodeName: __taint_src\n 32: ARG PASS: func struct_deep5_004_F(__taint_src string) {\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_004_F/struct_deep5_004_F.go\n AffectedNodeName: deepB05\n 37: Var Pass: \tdeepB05 := DeepB05{\n 38: Var Pass: \t\tdeepB06: __taint_src,\n 39: Var Pass: \t}\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_004_F/struct_deep5_004_F.go\n AffectedNodeName: obj1.deepB02.deepB03.deepB04.deepB05\n 40: Var Pass: \tobj1.deepB02.deepB03.deepB04.deepB05 = deepB05\n /sast-go/cases/accuracy/object_sensitive/struct/struct_deep5_004_F/struct_deep5_004_F.go\n AffectedNodeName: __taint_sink\n 42: SINK: \t__taint_sink(obj2)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: break_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\n AffectedNodeName: break_003_T\n 25: CALL: break_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func break_003_T(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\n AffectedNodeName: res\n 16: Var Pass: \t\t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t\t__taint_sink(res)\n\n------------- 2: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: break_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\n AffectedNodeName: break_003_T\n 25: CALL: break_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func break_003_T(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\n AffectedNodeName: res\n 16: Var Pass: \t\t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\n AffectedNodeName: __taint_sink\n 18: CALL: \t\t__taint_sink(res)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_003_T/break_003_T.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t\t__taint_sink(res)\n==========================================================\n #Total-findings:2\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\nLine 19: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\n AffectedNodeName: __taint_src\n 26: SOURCE: break_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\n AffectedNodeName: break_004_F\n 26: CALL: break_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func break_004_F(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\n AffectedNodeName: res\n 16: Var Pass: \t\t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\n AffectedNodeName: __taint_sink\n 19: SINK: \t\t__taint_sink(res)\n\n------------- 2: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\nLine 19: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\n AffectedNodeName: __taint_src\n 26: SOURCE: break_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\n AffectedNodeName: break_004_F\n 26: CALL: break_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func break_004_F(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\n AffectedNodeName: res\n 16: Var Pass: \t\t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\n AffectedNodeName: __taint_sink\n 19: CALL: \t\t__taint_sink(res)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_004_F/break_004_F.go\n AffectedNodeName: __taint_sink\n 19: SINK: \t\t__taint_sink(res)\n==========================================================\n #Total-findings:2\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_003_T/break_label_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_003_T/break_label_003_T.go\nLine 21: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_003_T/break_label_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_003_T/break_label_003_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: break_label_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_003_T/break_label_003_T.go\n AffectedNodeName: break_label_003_T\n 27: CALL: break_label_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_003_T/break_label_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func break_label_003_T(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_003_T/break_label_003_T.go\n AffectedNodeName: res\n 17: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_003_T/break_label_003_T.go\n AffectedNodeName: __taint_sink\n 21: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_004_F/break_label_004_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_004_F/break_label_004_F.go\nLine 21: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_004_F/break_label_004_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_004_F/break_label_004_F.go\n AffectedNodeName: __taint_src\n 27: SOURCE: break_label_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_004_F/break_label_004_F.go\n AffectedNodeName: break_label_004_F\n 27: CALL: break_label_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_004_F/break_label_004_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func break_label_004_F(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_004_F/break_label_004_F.go\n AffectedNodeName: res\n 18: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/break_label_004_F/break_label_004_F.go\n AffectedNodeName: __taint_sink\n 21: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_003_T/continue_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_003_T/continue_003_T.go\nLine 20: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_003_T/continue_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_003_T/continue_003_T.go\n AffectedNodeName: __taint_src\n 26: SOURCE: continue_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_003_T/continue_003_T.go\n AffectedNodeName: continue_003_T\n 26: CALL: continue_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_003_T/continue_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func continue_003_T(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_003_T/continue_003_T.go\n AffectedNodeName: res\n 16: Var Pass: \t\t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_003_T/continue_003_T.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_004_F/continue_004_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_004_F/continue_004_F.go\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_004_F/continue_004_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_004_F/continue_004_F.go\n AffectedNodeName: __taint_src\n 26: SOURCE: continue_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_004_F/continue_004_F.go\n AffectedNodeName: continue_004_F\n 26: CALL: continue_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_004_F/continue_004_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func continue_004_F(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_004_F/continue_004_F.go\n AffectedNodeName: res\n 16: Var Pass: \t\t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/continue_004_F/continue_004_F.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t\t\t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/fallthrough_003_T/fallthrough_003_T":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/fallthrough_004_F/fallthrough_004_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/fallthrough_004_F/fallthrough_004_F.go\nLine 24: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/fallthrough_004_F/fallthrough_004_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/fallthrough_004_F/fallthrough_004_F.go\n AffectedNodeName: __taint_src\n 30: SOURCE: fallthrough_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/fallthrough_004_F/fallthrough_004_F.go\n AffectedNodeName: fallthrough_004_F\n 30: CALL: fallthrough_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/fallthrough_004_F/fallthrough_004_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func fallthrough_004_F(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/fallthrough_004_F/fallthrough_004_F.go\n AffectedNodeName: res\n 18: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/fallthrough_004_F/fallthrough_004_F.go\n AffectedNodeName: __taint_sink\n 24: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/goto_003_T/goto_003_T":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/goto_004_F/goto_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_003_T/return_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_003_T/return_003_T.go\nLine 16: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_003_T/return_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_003_T/return_003_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: return_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_003_T/return_003_T.go\n AffectedNodeName: return_003_T\n 23: CALL: return_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_003_T/return_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func return_003_T(__taint_src string) string {\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_003_T/return_003_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_004_F/return_004_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_004_F/return_004_F.go\nLine 16: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_004_F/return_004_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_004_F/return_004_F.go\n AffectedNodeName: __taint_src\n 23: SOURCE: return_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_004_F/return_004_F.go\n AffectedNodeName: return_004_F\n 23: CALL: return_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_004_F/return_004_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func return_004_F(__taint_src string) string {\n /sast-go/cases/accuracy/path_sensitive/explicit_jump_control/return_004_F/return_004_F.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_005_F/conditional_if_005_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_005_F/conditional_if_005_F.go\nLine 17: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_005_F/conditional_if_005_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_005_F/conditional_if_005_F.go\n AffectedNodeName: __taint_src\n 24: SOURCE: conditional_if_005_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_005_F/conditional_if_005_F.go\n AffectedNodeName: conditional_if_005_F\n 24: CALL: conditional_if_005_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_005_F/conditional_if_005_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_if_005_F(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_005_F/conditional_if_005_F.go\n AffectedNodeName: res\n 15: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_005_F/conditional_if_005_F.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t\t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_006_F/conditional_if_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_007_T/conditional_if_007_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_007_T/conditional_if_007_T.go\nLine 19: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_007_T/conditional_if_007_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_007_T/conditional_if_007_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: conditional_if_007_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_007_T/conditional_if_007_T.go\n AffectedNodeName: conditional_if_007_T\n 25: CALL: conditional_if_007_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_007_T/conditional_if_007_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_if_007_T(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_007_T/conditional_if_007_T.go\n AffectedNodeName: res\n 15: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_007_T/conditional_if_007_T.go\n AffectedNodeName: __taint_sink\n 19: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_008_F/conditional_if_008_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_008_F/conditional_if_008_F.go\nLine 19: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_008_F/conditional_if_008_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_008_F/conditional_if_008_F.go\n AffectedNodeName: __taint_src\n 25: SOURCE: conditional_if_008_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_008_F/conditional_if_008_F.go\n AffectedNodeName: conditional_if_008_F\n 25: CALL: conditional_if_008_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_008_F/conditional_if_008_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_if_008_F(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_008_F/conditional_if_008_F.go\n AffectedNodeName: res\n 17: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_008_F/conditional_if_008_F.go\n AffectedNodeName: __taint_sink\n 19: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_stmt_003_F/conditional_switch_stmt_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_stmt_004_F/conditional_switch_stmt_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_stmt_005_T/conditional_switch_stmt_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_stmt_005_T/conditional_switch_stmt_005_T.go\nLine 20: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_stmt_005_T/conditional_switch_stmt_005_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_stmt_005_T/conditional_switch_stmt_005_T.go\n AffectedNodeName: __taint_src\n 26: SOURCE: conditional_switch_stmt_005_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_stmt_005_T/conditional_switch_stmt_005_T.go\n AffectedNodeName: conditional_switch_stmt_005_T\n 26: CALL: conditional_switch_stmt_005_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_stmt_005_T/conditional_switch_stmt_005_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_switch_stmt_005_T(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_stmt_005_T/conditional_switch_stmt_005_T.go\n AffectedNodeName: res\n 18: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_stmt_005_T/conditional_switch_stmt_005_T.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_stmt_006_F/conditional_switch_stmt_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_009_T/conditional_if_009_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_009_T/conditional_if_009_T.go\nLine 19: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_009_T/conditional_if_009_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_009_T/conditional_if_009_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: conditional_if_009_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_009_T/conditional_if_009_T.go\n AffectedNodeName: conditional_if_009_T\n 25: CALL: conditional_if_009_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_009_T/conditional_if_009_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_if_009_T(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_009_T/conditional_if_009_T.go\n AffectedNodeName: res\n 15: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_009_T/conditional_if_009_T.go\n AffectedNodeName: __taint_sink\n 19: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_010_F/conditional_if_010_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_010_F/conditional_if_010_F.go\nLine 19: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_010_F/conditional_if_010_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_010_F/conditional_if_010_F.go\n AffectedNodeName: __taint_src\n 25: SOURCE: conditional_if_010_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_010_F/conditional_if_010_F.go\n AffectedNodeName: conditional_if_010_F\n 25: CALL: conditional_if_010_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_010_F/conditional_if_010_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_if_010_F(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_010_F/conditional_if_010_F.go\n AffectedNodeName: res\n 17: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_010_F/conditional_if_010_F.go\n AffectedNodeName: __taint_sink\n 19: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_007_T/conditional_switch_stmt_007_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_007_T/conditional_switch_stmt_007_T.go\nLine 20: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_007_T/conditional_switch_stmt_007_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_007_T/conditional_switch_stmt_007_T.go\n AffectedNodeName: __taint_src\n 26: SOURCE: conditional_switch_stmt_007_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_007_T/conditional_switch_stmt_007_T.go\n AffectedNodeName: conditional_switch_stmt_007_T\n 26: CALL: conditional_switch_stmt_007_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_007_T/conditional_switch_stmt_007_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_switch_stmt_007_T(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_007_T/conditional_switch_stmt_007_T.go\n AffectedNodeName: res\n 16: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_007_T/conditional_switch_stmt_007_T.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_008_F/conditional_switch_stmt_008_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_008_F/conditional_switch_stmt_008_F.go\nLine 20: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_008_F/conditional_switch_stmt_008_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_008_F/conditional_switch_stmt_008_F.go\n AffectedNodeName: __taint_src\n 26: SOURCE: conditional_switch_stmt_008_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_008_F/conditional_switch_stmt_008_F.go\n AffectedNodeName: conditional_switch_stmt_008_F\n 26: CALL: conditional_switch_stmt_008_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_008_F/conditional_switch_stmt_008_F.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_switch_stmt_008_F(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_008_F/conditional_switch_stmt_008_F.go\n AffectedNodeName: res\n 16: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_stmt_008_F/conditional_switch_stmt_008_F.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_003_T/for_body_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_003_T/for_body_003_T.go\nLine 17: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_003_T/for_body_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_003_T/for_body_003_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: for_body_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_003_T/for_body_003_T.go\n AffectedNodeName: for_body_003_T\n 23: CALL: for_body_003_T(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_003_T/for_body_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func for_body_003_T(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_003_T/for_body_003_T.go\n AffectedNodeName: res\n 15: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_003_T/for_body_003_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_004_F/for_body_004_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_004_F/for_body_004_F.go\nLine 16: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_004_F/for_body_004_F.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_004_F/for_body_004_F.go\n AffectedNodeName: __taint_src\n 22: SOURCE: for_body_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_004_F/for_body_004_F.go\n AffectedNodeName: for_body_004_F\n 22: CALL: for_body_004_F(__taint_src)\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_004_F/for_body_004_F.go\n AffectedNodeName: __taint_src\n 11: ARG PASS: func for_body_004_F(__taint_src string) {\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_004_F/for_body_004_F.go\n AffectedNodeName: res\n 14: Var Pass: \t\tres = __taint_src\n /sast-go/cases/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_004_F/for_body_004_F.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\nLine 26: __taint_sink(s.Field(i))\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: __taint_src\n 34: SOURCE: reflect_call_001_T(__taint_src)\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: reflect_call_001_T\n 34: CALL: reflect_call_001_T(__taint_src)\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: __taint_src\n 21: ARG PASS: func reflect_call_001_T(__taint_src string) {\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: t\n 22: Var Pass: \tt := T{123, __taint_src}\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: s\n 23: Var Pass: \ts := reflect.ValueOf(t)\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: __taint_sink\n 26: SINK: \t\t__taint_sink(s.Field(i))\n\n------------- 2: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\nLine 26: __taint_sink(s.Field(i))\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: __taint_src\n 34: SOURCE: reflect_call_001_T(__taint_src)\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: reflect_call_001_T\n 34: CALL: reflect_call_001_T(__taint_src)\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: __taint_src\n 21: ARG PASS: func reflect_call_001_T(__taint_src string) {\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: t\n 22: Var Pass: \tt := T{123, __taint_src}\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: s\n 23: Var Pass: \ts := reflect.ValueOf(t)\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: __taint_sink\n 26: CALL: \t\t__taint_sink(s.Field(i))\n /sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_001_T/reflect_call_001_T.go\n AffectedNodeName: __taint_sink\n 26: SINK: \t\t__taint_sink(s.Field(i))\n==========================================================\n #Total-findings:2\n==========================================================","/benchmarks/sast-go/cases/completeness/dynamic_tracing/reflect_call/reflect_call_002_F/reflect_call_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/alias/alias_001_F/alias_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/alias/alias_002_T/alias_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/alias/alias_002_T/alias_002_T.go\nLine 21: __taint_sink(a.Value)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/alias/alias_002_T/alias_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/alias/alias_002_T/alias_002_T.go\n AffectedNodeName: __taint_src\n 28: SOURCE: alias_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/alias/alias_002_T/alias_002_T.go\n AffectedNodeName: alias_002_T\n 28: CALL: alias_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/alias/alias_002_T/alias_002_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func alias_002_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/alias/alias_002_T/alias_002_T.go\n AffectedNodeName: b.Value\n 19: Var Pass: \tb.Value = __taint_src\n /sast-go/cases/completeness/single_app_tracing/alias/alias_002_T/alias_002_T.go\n AffectedNodeName: __taint_sink\n 21: SINK: \t__taint_sink(a.Value)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_001_T/asynchronous_goroutine_channel_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_001_T/asynchronous_goroutine_channel_001_T.go\nLine 17: __taint_sink(popch)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_001_T/asynchronous_goroutine_channel_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_001_T/asynchronous_goroutine_channel_001_T.go\n AffectedNodeName: __taint_src\n 24: SOURCE: asynchronous_goroutine_channel_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_001_T/asynchronous_goroutine_channel_001_T.go\n AffectedNodeName: asynchronous_goroutine_channel_001_T\n 24: CALL: asynchronous_goroutine_channel_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_001_T/asynchronous_goroutine_channel_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func asynchronous_goroutine_channel_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_001_T/asynchronous_goroutine_channel_001_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(<-ch)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_002_F/asynchronous_goroutine_channel_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_003_T/asynchronous_goroutine_channel_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_003_T/asynchronous_goroutine_channel_003_T.go\nLine 30: __taint_sink(message)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_003_T/asynchronous_goroutine_channel_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_003_T/asynchronous_goroutine_channel_003_T.go\n AffectedNodeName: __taint_src\n 40: SOURCE: asynchronous_goroutine_channel_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_003_T/asynchronous_goroutine_channel_003_T.go\n AffectedNodeName: asynchronous_goroutine_channel_003_T\n 40: CALL: asynchronous_goroutine_channel_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_003_T/asynchronous_goroutine_channel_003_T.go\n AffectedNodeName: __taint_src\n 16: ARG PASS: func asynchronous_goroutine_channel_003_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_003_T/asynchronous_goroutine_channel_003_T.go\n AffectedNodeName: __single_module__.%dir_/.asynchronous_goroutine_channel_003_T.\n 27: CALL: \tgo func() {\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_003_T/asynchronous_goroutine_channel_003_T.go\n AffectedNodeName: __single_module__.%dir_/.asynchronous_goroutine_channel_003_T.\n 27: ARG PASS: \tgo func() {\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_003_T/asynchronous_goroutine_channel_003_T.go\n AffectedNodeName: __taint_sink\n 30: SINK: \t\t__taint_sink(message)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_goroutine_channel_004_F/asynchronous_goroutine_channel_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_multiple_select_001_T/asynchronous_multiple_select_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_multiple_select_001_T/asynchronous_multiple_select_001_T.go\nLine 33: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_multiple_select_001_T/asynchronous_multiple_select_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_multiple_select_001_T/asynchronous_multiple_select_001_T.go\n AffectedNodeName: __taint_src\n 45: SOURCE: asynchronous_multiple_select_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_multiple_select_001_T/asynchronous_multiple_select_001_T.go\n AffectedNodeName: asynchronous_multiple_select_001_T\n 45: CALL: asynchronous_multiple_select_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_multiple_select_001_T/asynchronous_multiple_select_001_T.go\n AffectedNodeName: __taint_src\n 17: ARG PASS: func asynchronous_multiple_select_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_multiple_select_001_T/asynchronous_multiple_select_001_T.go\n AffectedNodeName: result\n 22: Var Pass: \t\tresult := __taint_src\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_multiple_select_001_T/asynchronous_multiple_select_001_T.go\n AffectedNodeName: __taint_sink\n 33: SINK: \t\t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_multiple_select_002_F/asynchronous_multiple_select_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_select_001_T/asynchronous_select_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_select_001_T/asynchronous_select_001_T.go\nLine 26: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_select_001_T/asynchronous_select_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_select_001_T/asynchronous_select_001_T.go\n AffectedNodeName: __taint_src\n 36: SOURCE: asynchronous_select_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_select_001_T/asynchronous_select_001_T.go\n AffectedNodeName: asynchronous_select_001_T\n 36: CALL: asynchronous_select_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_select_001_T/asynchronous_select_001_T.go\n AffectedNodeName: __taint_src\n 17: ARG PASS: func asynchronous_select_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_select_001_T/asynchronous_select_001_T.go\n AffectedNodeName: __taint_sink\n 26: SINK: \t\t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/multi_thread/asynchronous_select_002_F/asynchronous_select_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_001_T/synchronization_primitive_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_001_T/synchronization_primitive_001_T.go\nLine 16: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_001_T/synchronization_primitive_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_001_T/synchronization_primitive_001_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: synchronization_primitive_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_001_T/synchronization_primitive_001_T.go\n AffectedNodeName: synchronization_primitive_001_T\n 22: CALL: synchronization_primitive_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_001_T/synchronization_primitive_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func synchronization_primitive_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_001_T/synchronization_primitive_001_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_002_F/synchronization_primitive_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_003_T/synchronization_primitive_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_003_T/synchronization_primitive_003_T.go\nLine 19: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_003_T/synchronization_primitive_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_003_T/synchronization_primitive_003_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: synchronization_primitive_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_003_T/synchronization_primitive_003_T.go\n AffectedNodeName: synchronization_primitive_003_T\n 25: CALL: synchronization_primitive_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_003_T/synchronization_primitive_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func synchronization_primitive_003_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_003_T/synchronization_primitive_003_T.go\n AffectedNodeName: __taint_sink\n 19: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/asynchronous_tracing/synchronization_primitive/synchronization_primitive_004_F/synchronization_primitive_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T/conditional_if_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T/conditional_if_001_T.go\nLine 14: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T/conditional_if_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T/conditional_if_001_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: conditional_if_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T/conditional_if_001_T.go\n AffectedNodeName: conditional_if_001_T\n 21: CALL: conditional_if_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T/conditional_if_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_if_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T/conditional_if_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t\t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_002_F/conditional_if_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T/conditional_if_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T/conditional_if_003_T.go\nLine 16: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T/conditional_if_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T/conditional_if_003_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: conditional_if_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T/conditional_if_003_T.go\n AffectedNodeName: conditional_if_003_T\n 25: CALL: conditional_if_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T/conditional_if_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_if_003_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T/conditional_if_003_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t\t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_004_F/conditional_if_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T/conditional_switch_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T/conditional_switch_001_T.go\nLine 15: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T/conditional_switch_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T/conditional_switch_001_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: conditional_switch_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T/conditional_switch_001_T.go\n AffectedNodeName: conditional_switch_001_T\n 22: CALL: conditional_switch_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T/conditional_switch_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_switch_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T/conditional_switch_001_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t\t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_002_F/conditional_switch_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_003_T/conditional_switch_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_003_T/conditional_switch_003_T.go\nLine 16: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_003_T/conditional_switch_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_003_T/conditional_switch_003_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: conditional_switch_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_003_T/conditional_switch_003_T.go\n AffectedNodeName: conditional_switch_003_T\n 23: CALL: conditional_switch_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_003_T/conditional_switch_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_switch_003_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_003_T/conditional_switch_003_T.go\n AffectedNodeName: data\n 14: Var Pass: \tswitch data := __taint_src; data {\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_003_T/conditional_switch_003_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t\t__taint_sink(data)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_004_F/conditional_switch_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_005_T/conditional_switch_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_005_T/conditional_switch_005_T.go\nLine 22: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_005_T/conditional_switch_005_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_005_T/conditional_switch_005_T.go\n AffectedNodeName: __taint_src\n 30: SOURCE: conditional_switch_005_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_005_T/conditional_switch_005_T.go\n AffectedNodeName: conditional_switch_005_T\n 30: CALL: conditional_switch_005_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_005_T/conditional_switch_005_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func conditional_switch_005_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_005_T/conditional_switch_005_T.go\n AffectedNodeName: __taint_sink\n 22: SINK: \t\t\t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_006_F/conditional_switch_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/select_001_T/select_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/select_001_T/select_001_T.go\nLine 18: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/select_001_T/select_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/select_001_T/select_001_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: select_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/select_001_T/select_001_T.go\n AffectedNodeName: select_001_T\n 27: CALL: select_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/select_001_T/select_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func select_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/select_001_T/select_001_T.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t\t__taint_sink(data)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/conditional_stmt/select_002_F/select_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T/for_body_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T/for_body_001_T.go\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T/for_body_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T/for_body_001_T.go\n AffectedNodeName: __taint_src\n 24: SOURCE: for_body_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T/for_body_001_T.go\n AffectedNodeName: for_body_001_T\n 24: CALL: for_body_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T/for_body_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func for_body_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T/for_body_001_T.go\n AffectedNodeName: res\n 16: Var Pass: \t\tres = __taint_src\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T/for_body_001_T.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_body_002_F/for_body_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T/for_init_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T/for_init_001_T.go\nLine 19: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T/for_init_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T/for_init_001_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: for_init_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T/for_init_001_T.go\n AffectedNodeName: for_init_001_T\n 25: CALL: for_init_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T/for_init_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func for_init_001_T(__taint_src int) {\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T/for_init_001_T.go\n AffectedNodeName: ini\n 16: Var Pass: \tfor ini = __taint_src; j < 10; j++ {\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T/for_init_001_T.go\n AffectedNodeName: res\n 17: Var Pass: \t\tres = res + ini\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T/for_init_001_T.go\n AffectedNodeName: __taint_sink\n 19: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_init_002_F/for_init_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_range_001_T/for_range_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_range_001_T/for_range_001_T.go\nLine 15: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_range_001_T/for_range_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_range_001_T/for_range_001_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: for_range_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_range_001_T/for_range_001_T.go\n AffectedNodeName: for_range_001_T\n 22: CALL: for_range_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_range_001_T/for_range_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func for_range_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_range_001_T/for_range_001_T.go\n AffectedNodeName: m\n 13: Var Pass: \tvar m = map[string]string{\"a\": __taint_src, \"b\": \"2\"}\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_range_001_T/for_range_001_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t\t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_range_002_F/for_range_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T/for_update_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T/for_update_001_T.go\nLine 20: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T/for_update_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T/for_update_001_T.go\n AffectedNodeName: __taint_src\n 26: SOURCE: for_update_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T/for_update_001_T.go\n AffectedNodeName: for_update_001_T\n 26: CALL: for_update_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T/for_update_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func for_update_001_T(__taint_src int) {\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T/for_update_001_T.go\n AffectedNodeName: j\n 16: Var Pass: \tfor ; ini < 2; j = __taint_src {\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T/for_update_001_T.go\n AffectedNodeName: res\n 17: Var Pass: \t\tres = j\n /sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T/for_update_001_T.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t__taint_sink(res)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/control_flow/loop_stmt/for_update_002_F/for_update_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/array/array_001_T/array_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/array/array_001_T/array_001_T.go\nLine 14: __taint_sink(str)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/array/array_001_T/array_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_001_T/array_001_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: array_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_001_T/array_001_T.go\n AffectedNodeName: array_001_T\n 21: CALL: array_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_001_T/array_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func array_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_001_T/array_001_T.go\n AffectedNodeName: str\n 13: Var Pass: \tvar str = [3]string{__taint_src, \"b\", \"c\"}\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_001_T/array_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(str)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/array/array_002_F/array_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/array/array_003_T/array_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/array/array_003_T/array_003_T.go\nLine 14: __taint_sink(str)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/array/array_003_T/array_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_003_T/array_003_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: array_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_003_T/array_003_T.go\n AffectedNodeName: array_003_T\n 21: CALL: array_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_003_T/array_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func array_003_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_003_T/array_003_T.go\n AffectedNodeName: str\n 13: Var Pass: \tvar str = [3][1]string{[1]string{__taint_src}, [1]string{\"b\"}, [1]string{\"c\"}}\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_003_T/array_003_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(str)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/array/array_004_F/array_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/array/array_005_T/array_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/array/array_005_T/array_005_T.go\nLine 13: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/array/array_005_T/array_005_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_005_T/array_005_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: array_005_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_005_T/array_005_T.go\n AffectedNodeName: array_005_T\n 20: CALL: array_005_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_005_T/array_005_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func array_005_T(__taint_src [3]string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_005_T/array_005_T.go\n AffectedNodeName: __taint_sink\n 13: SINK: \t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/array/array_006_F/array_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/array/array_007_T/array_007_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/array/array_007_T/array_007_T.go\nLine 14: __taint_sink(str)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/array/array_007_T/array_007_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_007_T/array_007_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: array_007_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_007_T/array_007_T.go\n AffectedNodeName: array_007_T\n 20: CALL: array_007_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_007_T/array_007_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func array_007_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_007_T/array_007_T.go\n AffectedNodeName: str\n 13: Var Pass: \tvar str = [...]string{__taint_src, \"b\", \"c\"}\n /sast-go/cases/completeness/single_app_tracing/datatype/array/array_007_T/array_007_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(str)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/array/array_008_F/array_008_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/generics/generics_001_T/generics_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/generics/generics_001_T/generics_001_T.go\nLine 16: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/generics/generics_001_T/generics_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/generics/generics_001_T/generics_001_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: generics_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/generics/generics_001_T/generics_001_T.go\n AffectedNodeName: generics_001_T\n 23: CALL: generics_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/generics/generics_001_T/generics_001_T.go\n AffectedNodeName: __taint_src\n 14: ARG PASS: func generics_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/generics/generics_001_T/generics_001_T.go\n AffectedNodeName: s\n 15: Var Pass: \tvar s Slice[string] = []string{\"a\", \"b\", __taint_src}\n /sast-go/cases/completeness/single_app_tracing/datatype/generics/generics_001_T/generics_001_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(s)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/generics/generics_002_F/generics_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/map/map_001_T/map_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/map/map_001_T/map_001_T.go\nLine 15: __taint_sink(m)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/map/map_001_T/map_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/map/map_001_T/map_001_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: map_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/map/map_001_T/map_001_T.go\n AffectedNodeName: map_001_T\n 22: CALL: map_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/map/map_001_T/map_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func map_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/map/map_001_T/map_001_T.go\n AffectedNodeName: m[\"key1\"]\n 14: Var Pass: \tm[\"key1\"] = __taint_src\n /sast-go/cases/completeness/single_app_tracing/datatype/map/map_001_T/map_001_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(m)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/map/map_002_F/map_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/map/map_003_T/map_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/map/map_003_T/map_003_T.go\nLine 16: __taint_sink(m)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/map/map_003_T/map_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/map/map_003_T/map_003_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: map_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/map/map_003_T/map_003_T.go\n AffectedNodeName: map_003_T\n 23: CALL: map_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/map/map_003_T/map_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func map_003_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/map/map_003_T/map_003_T.go\n AffectedNodeName: m\n 13: Var Pass: \tm := map[string]string{\n 14: Var Pass: \t\t\"key1\": __taint_src,\n 15: Var Pass: \t}\n /sast-go/cases/completeness/single_app_tracing/datatype/map/map_003_T/map_003_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(m)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/map/map_004_F/map_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_001_T/pointer_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_001_T/pointer_001_T.go\nLine 14: __taint_sink(*ps)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_001_T/pointer_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_001_T/pointer_001_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: pointer_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_001_T/pointer_001_T.go\n AffectedNodeName: pointer_001_T\n 21: CALL: pointer_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_001_T/pointer_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func pointer_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_001_T/pointer_001_T.go\n AffectedNodeName: ps\n 13: Var Pass: \tps := &__taint_src\n /sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_001_T/pointer_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(*ps)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_002_F/pointer_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_new_001_T/pointer_new_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_new_001_T/pointer_new_001_T.go\nLine 16: __taint_sink(*ps)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_new_001_T/pointer_new_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_new_001_T/pointer_new_001_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: pointer_new_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_new_001_T/pointer_new_001_T.go\n AffectedNodeName: pointer_new_001_T\n 23: CALL: pointer_new_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_new_001_T/pointer_new_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func pointer_new_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_new_001_T/pointer_new_001_T.go\n AffectedNodeName: *ps\n 15: Var Pass: \t*ps = __taint_src\n /sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_new_001_T/pointer_new_001_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(*ps)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/pointer/pointer_new_002_F/pointer_new_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_bool_001_T/primitives_bool_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_bool_001_T/primitives_bool_001_T.go\nLine 13: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_bool_001_T/primitives_bool_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_bool_001_T/primitives_bool_001_T.go\n AffectedNodeName: __taint_src\n 19: SOURCE: primitives_bool_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_bool_001_T/primitives_bool_001_T.go\n AffectedNodeName: primitives_bool_001_T\n 19: CALL: primitives_bool_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_bool_001_T/primitives_bool_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func primitives_bool_001_T(__taint_src bool) {\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_bool_001_T/primitives_bool_001_T.go\n AffectedNodeName: __taint_sink\n 13: SINK: \t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_bool_002_F/primitives_bool_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_complex_001_T/primitives_complex_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_complex_001_T/primitives_complex_001_T.go\nLine 13: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_complex_001_T/primitives_complex_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_complex_001_T/primitives_complex_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: primitives_complex_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_complex_001_T/primitives_complex_001_T.go\n AffectedNodeName: primitives_complex_001_T\n 20: CALL: primitives_complex_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_complex_001_T/primitives_complex_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func primitives_complex_001_T(__taint_src complex64) {\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_complex_001_T/primitives_complex_001_T.go\n AffectedNodeName: __taint_sink\n 13: SINK: \t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_complex_002_F/primitives_complex_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_float_001_T/primitives_float_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_float_001_T/primitives_float_001_T.go\nLine 13: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_float_001_T/primitives_float_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_float_001_T/primitives_float_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: primitives_float_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_float_001_T/primitives_float_001_T.go\n AffectedNodeName: primitives_float_001_T\n 20: CALL: primitives_float_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_float_001_T/primitives_float_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func primitives_float_001_T(__taint_src float64) {\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_float_001_T/primitives_float_001_T.go\n AffectedNodeName: __taint_sink\n 13: SINK: \t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_float_002_F/primitives_float_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_int_001_T/primitives_int_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_int_001_T/primitives_int_001_T.go\nLine 13: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_int_001_T/primitives_int_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_int_001_T/primitives_int_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: primitives_int_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_int_001_T/primitives_int_001_T.go\n AffectedNodeName: primitives_int_001_T\n 20: CALL: primitives_int_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_int_001_T/primitives_int_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func primitives_int_001_T(__taint_src int) {\n /sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_int_001_T/primitives_int_001_T.go\n AffectedNodeName: __taint_sink\n 13: SINK: \t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/primitives/primitives_int_002_F/primitives_int_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_001_T/slice_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_001_T/slice_001_T.go\nLine 14: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_001_T/slice_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_001_T/slice_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: slice_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_001_T/slice_001_T.go\n AffectedNodeName: slice_001_T\n 20: CALL: slice_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_001_T/slice_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func slice_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_001_T/slice_001_T.go\n AffectedNodeName: s\n 13: Var Pass: \tvar s []string = []string{__taint_src, \"b\", \"c\"}\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_001_T/slice_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(s)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_002_F/slice_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_003_T/slice_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_003_T/slice_003_T.go\nLine 15: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_003_T/slice_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_003_T/slice_003_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: slice_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_003_T/slice_003_T.go\n AffectedNodeName: slice_003_T\n 22: CALL: slice_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_003_T/slice_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func slice_003_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_003_T/slice_003_T.go\n AffectedNodeName: s\n 14: Var Pass: \ts = append(s, __taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_003_T/slice_003_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(s)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_004_F/slice_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_005_T/slice_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_005_T/slice_005_T.go\nLine 18: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_005_T/slice_005_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_005_T/slice_005_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: slice_005_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_005_T/slice_005_T.go\n AffectedNodeName: slice_005_T\n 25: CALL: slice_005_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_005_T/slice_005_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func slice_005_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_005_T/slice_005_T.go\n AffectedNodeName: s\n 13: Var Pass: \ts := [][]string{\n 14: Var Pass: \t\t[]string{\"a\"},\n 15: Var Pass: \t\t[]string{\"b\", \"c\"},\n 16: Var Pass: \t\t[]string{\"d\", \"e\", __taint_src},\n 17: Var Pass: \t}\n /sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_005_T/slice_005_T.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t__taint_sink(s)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_006_F/slice_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_007_T/slice_007_T":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/slice/slice_008_F/slice_008_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/specialtype/channel_001_T/channel_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/specialtype/channel_001_T/channel_001_T.go\nLine 17: __taint_sink(c)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/specialtype/channel_001_T/channel_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/specialtype/channel_001_T/channel_001_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: channel_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/specialtype/channel_001_T/channel_001_T.go\n AffectedNodeName: channel_001_T\n 23: CALL: channel_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/specialtype/channel_001_T/channel_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func channel_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/specialtype/channel_001_T/channel_001_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(c)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/specialtype/channel_002_F/channel_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/string/string_001_T/string_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/string/string_001_T/string_001_T.go\nLine 13: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/string/string_001_T/string_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/string/string_001_T/string_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: string_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/string/string_001_T/string_001_T.go\n AffectedNodeName: string_001_T\n 20: CALL: string_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/string/string_001_T/string_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func string_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/string/string_001_T/string_001_T.go\n AffectedNodeName: __taint_sink\n 13: SINK: \t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/string/string_002_F/string_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/complex_struct_001_T/complex_struct_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/struct/complex_struct_001_T/complex_struct_001_T.go\nLine 30: __taint_sink(c)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/struct/complex_struct_001_T/complex_struct_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/complex_struct_001_T/complex_struct_001_T.go\n AffectedNodeName: __taint_src\n 37: SOURCE: complex_struct_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/complex_struct_001_T/complex_struct_001_T.go\n AffectedNodeName: complex_struct_001_T\n 37: CALL: complex_struct_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/complex_struct_001_T/complex_struct_001_T.go\n AffectedNodeName: __taint_src\n 13: ARG PASS: func complex_struct_001_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/complex_struct_001_T/complex_struct_001_T.go\n AffectedNodeName: Say\n 16: CALL: \ta.b.Say(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/complex_struct_001_T/complex_struct_001_T.go\n AffectedNodeName: c\n 29: ARG PASS: func (b B) Say(c interface{}) {\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/complex_struct_001_T/complex_struct_001_T.go\n AffectedNodeName: __taint_sink\n 30: SINK: \t__taint_sink(c)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/complex_struct_002_F/complex_struct_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_001_T/struct_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_001_T/struct_001_T.go\nLine 20: __taint_sink(p)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_001_T/struct_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_001_T/struct_001_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: struct_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_001_T/struct_001_T.go\n AffectedNodeName: struct_001_T\n 27: CALL: struct_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_001_T/struct_001_T.go\n AffectedNodeName: __taint_src\n 16: ARG PASS: func struct_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_001_T/struct_001_T.go\n AffectedNodeName: p\n 17: Var Pass: \tp := A{\n 18: Var Pass: \t\tdata: __taint_src,\n 19: Var Pass: \t}\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_001_T/struct_001_T.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t__taint_sink(p)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_002_F/struct_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_003_T/struct_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_003_T/struct_003_T.go\nLine 19: __taint_sink(p)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_003_T/struct_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_003_T/struct_003_T.go\n AffectedNodeName: __taint_src\n 26: SOURCE: struct_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_003_T/struct_003_T.go\n AffectedNodeName: struct_003_T\n 26: CALL: struct_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_003_T/struct_003_T.go\n AffectedNodeName: __taint_src\n 16: ARG PASS: func struct_003_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_003_T/struct_003_T.go\n AffectedNodeName: p.data\n 18: Var Pass: \tp.data = __taint_src\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_003_T/struct_003_T.go\n AffectedNodeName: __taint_sink\n 19: SINK: \t__taint_sink(p)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_004_F/struct_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_005_T/struct_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_005_T/struct_005_T.go\nLine 18: __taint_sink(p.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_005_T/struct_005_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_005_T/struct_005_T.go\n AffectedNodeName: __taint_src\n 24: SOURCE: struct_005_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_005_T/struct_005_T.go\n AffectedNodeName: struct_005_T\n 24: CALL: struct_005_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_005_T/struct_005_T.go\n AffectedNodeName: __taint_src\n 16: ARG PASS: func struct_005_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_005_T/struct_005_T.go\n AffectedNodeName: p\n 17: Var Pass: \tp := A{__taint_src}\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_005_T/struct_005_T.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t__taint_sink(p.data)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_006_F/struct_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_001_T/struct_cross_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_001_T/struct_cross_001_T.go\nLine 25: __taint_sink(pb)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_001_T/struct_cross_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_001_T/struct_cross_001_T.go\n AffectedNodeName: __taint_src\n 32: SOURCE: struct_cross_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_001_T/struct_cross_001_T.go\n AffectedNodeName: struct_cross_001_T\n 32: CALL: struct_cross_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_001_T/struct_cross_001_T.go\n AffectedNodeName: __taint_src\n 19: ARG PASS: func struct_cross_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_001_T/struct_cross_001_T.go\n AffectedNodeName: pa\n 20: Var Pass: \tpa := A{\n 21: Var Pass: \t\tdata: __taint_src,\n 22: Var Pass: \t}\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_001_T/struct_cross_001_T.go\n AffectedNodeName: pb.data\n 24: Var Pass: \tpb.data = pa.data\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_001_T/struct_cross_001_T.go\n AffectedNodeName: __taint_sink\n 25: SINK: \t__taint_sink(pb)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_002_F/struct_cross_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_003_T/struct_cross_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_003_T/struct_cross_003_T.go\nLine 24: __taint_sink(p)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_003_T/struct_cross_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_003_T/struct_cross_003_T.go\n AffectedNodeName: __taint_src\n 30: SOURCE: struct_cross_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_003_T/struct_cross_003_T.go\n AffectedNodeName: struct_cross_003_T\n 30: CALL: struct_cross_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_003_T/struct_cross_003_T.go\n AffectedNodeName: __taint_src\n 20: ARG PASS: func struct_cross_003_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_003_T/struct_cross_003_T.go\n AffectedNodeName: p\n 21: Var Pass: \tp := B{A{\n 22: Var Pass: \t\tdata: __taint_src,\n 23: Var Pass: \t}, \"_\"}\n /sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_003_T/struct_cross_003_T.go\n AffectedNodeName: __taint_sink\n 24: SINK: \t__taint_sink(p)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/datatype/struct/struct_cross_004_F/struct_cross_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/exception_error/exception_throw/exception_throw_001_T/exception_throw_001_T":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/exception_error/exception_throw/exception_throw_002_F/exception_throw_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T/assign_expression_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T/assign_expression_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T/assign_expression_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T/assign_expression_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: assign_expression_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T/assign_expression_001_T.go\n AffectedNodeName: assign_expression_001_T\n 20: CALL: assign_expression_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T/assign_expression_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func assign_expression_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T/assign_expression_001_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := __taint_src\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T/assign_expression_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_002_F/assign_expression_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T/binary_expression_add_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T/binary_expression_add_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T/binary_expression_add_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T/binary_expression_add_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: binary_expression_add_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T/binary_expression_add_001_T.go\n AffectedNodeName: binary_expression_add_001_T\n 20: CALL: binary_expression_add_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T/binary_expression_add_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func binary_expression_add_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T/binary_expression_add_001_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := __taint_src + \"_\"\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T/binary_expression_add_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_002_F/binary_expression_add_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T/binary_expression_add_assignment_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T/binary_expression_add_assignment_001_T.go\nLine 15: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T/binary_expression_add_assignment_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T/binary_expression_add_assignment_001_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: binary_expression_add_assignment_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T/binary_expression_add_assignment_001_T.go\n AffectedNodeName: binary_expression_add_assignment_001_T\n 21: CALL: binary_expression_add_assignment_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T/binary_expression_add_assignment_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func binary_expression_add_assignment_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T/binary_expression_add_assignment_001_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_002_F/binary_expression_add_assignment_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T/bitwise_expression_and_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T/bitwise_expression_and_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T/bitwise_expression_and_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T/bitwise_expression_and_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: bitwise_expression_and_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T/bitwise_expression_and_001_T.go\n AffectedNodeName: bitwise_expression_and_001_T\n 20: CALL: bitwise_expression_and_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T/bitwise_expression_and_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func bitwise_expression_and_001_T(__taint_src int) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T/bitwise_expression_and_001_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := __taint_src & 1\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T/bitwise_expression_and_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_002_F/bitwise_expression_and_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T/bitwise_expression_lsh_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T/bitwise_expression_lsh_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T/bitwise_expression_lsh_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T/bitwise_expression_lsh_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: bitwise_expression_lsh_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T/bitwise_expression_lsh_001_T.go\n AffectedNodeName: bitwise_expression_lsh_001_T\n 20: CALL: bitwise_expression_lsh_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T/bitwise_expression_lsh_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func bitwise_expression_lsh_001_T(__taint_src int) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T/bitwise_expression_lsh_001_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := __taint_src << 1\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T/bitwise_expression_lsh_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_002_F/bitwise_expression_lsh_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T/bitwise_expression_not_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T/bitwise_expression_not_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T/bitwise_expression_not_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T/bitwise_expression_not_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: bitwise_expression_not_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T/bitwise_expression_not_001_T.go\n AffectedNodeName: bitwise_expression_not_001_T\n 20: CALL: bitwise_expression_not_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T/bitwise_expression_not_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func bitwise_expression_not_001_T(__taint_src int) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T/bitwise_expression_not_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_002_F/bitwise_expression_not_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T/bitwise_expression_or_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T/bitwise_expression_or_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T/bitwise_expression_or_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T/bitwise_expression_or_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: bitwise_expression_or_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T/bitwise_expression_or_001_T.go\n AffectedNodeName: bitwise_expression_or_001_T\n 20: CALL: bitwise_expression_or_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T/bitwise_expression_or_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func bitwise_expression_or_001_T(__taint_src int) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T/bitwise_expression_or_001_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := __taint_src | 1\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T/bitwise_expression_or_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_002_F/bitwise_expression_or_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T/bitwise_expression_rsh_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T/bitwise_expression_rsh_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T/bitwise_expression_rsh_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T/bitwise_expression_rsh_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: bitwise_expression_rsh_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T/bitwise_expression_rsh_001_T.go\n AffectedNodeName: bitwise_expression_rsh_001_T\n 20: CALL: bitwise_expression_rsh_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T/bitwise_expression_rsh_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func bitwise_expression_rsh_001_T(__taint_src int) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T/bitwise_expression_rsh_001_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := __taint_src >> 1\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T/bitwise_expression_rsh_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_002_F/bitwise_expression_rsh_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T/bitwise_expression_xor_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T/bitwise_expression_xor_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T/bitwise_expression_xor_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T/bitwise_expression_xor_001_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: bitwise_expression_xor_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T/bitwise_expression_xor_001_T.go\n AffectedNodeName: bitwise_expression_xor_001_T\n 21: CALL: bitwise_expression_xor_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T/bitwise_expression_xor_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func bitwise_expression_xor_001_T(__taint_src int) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T/bitwise_expression_xor_001_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := __taint_src ^ 1\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T/bitwise_expression_xor_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_002_F/bitwise_expression_xor_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_001_T/logic_expression_and_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_001_T/logic_expression_and_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_001_T/logic_expression_and_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_001_T/logic_expression_and_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: logic_expression_and_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_001_T/logic_expression_and_001_T.go\n AffectedNodeName: logic_expression_and_001_T\n 20: CALL: logic_expression_and_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_001_T/logic_expression_and_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func logic_expression_and_001_T(__taint_src bool) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_001_T/logic_expression_and_001_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := __taint_src && true\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_001_T/logic_expression_and_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_002_F/logic_expression_and_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T/logic_expression_or_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T/logic_expression_or_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T/logic_expression_or_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T/logic_expression_or_001_T.go\n AffectedNodeName: __taint_src\n 20: SOURCE: logic_expression_or_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T/logic_expression_or_001_T.go\n AffectedNodeName: logic_expression_or_001_T\n 20: CALL: logic_expression_or_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T/logic_expression_or_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func logic_expression_or_001_T(__taint_src bool) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T/logic_expression_or_001_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := false || __taint_src\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T/logic_expression_or_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_002_F/logic_expression_or_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T/relation_expression_equal_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T/relation_expression_equal_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T/relation_expression_equal_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T/relation_expression_equal_001_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: relation_expression_equal_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T/relation_expression_equal_001_T.go\n AffectedNodeName: relation_expression_equal_001_T\n 21: CALL: relation_expression_equal_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T/relation_expression_equal_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func relation_expression_equal_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T/relation_expression_equal_001_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := __taint_src == \"__taint_src\"\n /sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T/relation_expression_equal_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_002_F/relation_expression_equal_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/special_expression/blank_identifier_001_T/blank_identifier_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/special_expression/blank_identifier_001_T/blank_identifier_001_T.go\nLine 14: __taint_sink(a)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/special_expression/blank_identifier_001_T/blank_identifier_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/blank_identifier_001_T/blank_identifier_001_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: blank_identifier_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/blank_identifier_001_T/blank_identifier_001_T.go\n AffectedNodeName: blank_identifier_001_T\n 25: CALL: blank_identifier_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/blank_identifier_001_T/blank_identifier_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func blank_identifier_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/blank_identifier_001_T/blank_identifier_001_T.go\n AffectedNodeName: getData\n 13: CALL: \ta, _ := getData(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/blank_identifier_001_T/blank_identifier_001_T.go\n AffectedNodeName: getData\n 13: CALL RETURN: \ta, _ := getData(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/blank_identifier_001_T/blank_identifier_001_T.go\n 13: Var Pass: \ta, _ := getData(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/blank_identifier_001_T/blank_identifier_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(a)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/special_expression/blank_identifier_002_F/blank_identifier_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/special_expression/multiple_assignment_001_T/multiple_assignment_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/special_expression/multiple_assignment_001_T/multiple_assignment_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/special_expression/multiple_assignment_001_T/multiple_assignment_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/multiple_assignment_001_T/multiple_assignment_001_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: multiple_assignment_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/multiple_assignment_001_T/multiple_assignment_001_T.go\n AffectedNodeName: multiple_assignment_001_T\n 21: CALL: multiple_assignment_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/multiple_assignment_001_T/multiple_assignment_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func multiple_assignment_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/multiple_assignment_001_T/multiple_assignment_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/special_expression/multiple_assignment_002_F/multiple_assignment_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T/rest_parameter_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T/rest_parameter_001_T.go\nLine 17: __taint_sink(args)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T/rest_parameter_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T/rest_parameter_001_T.go\n AffectedNodeName: __taint_src\n 24: SOURCE: rest_parameter_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T/rest_parameter_001_T.go\n AffectedNodeName: rest_parameter_001_T\n 24: CALL: rest_parameter_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T/rest_parameter_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func rest_parameter_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T/rest_parameter_001_T.go\n AffectedNodeName: collectArgs\n 13: CALL: \tcollectArgs(\"prefix\", __taint_src, \"suffix\")\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T/rest_parameter_001_T.go\n AffectedNodeName: args\n 16: ARG PASS: func collectArgs(args ...interface{}) {\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T/rest_parameter_001_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(args)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/special_expression/rest_parameter_002_F/rest_parameter_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T/spread_operator_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T/spread_operator_001_T.go\nLine 15: __taint_sink(array)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T/spread_operator_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T/spread_operator_001_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: spread_operator_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T/spread_operator_001_T.go\n AffectedNodeName: spread_operator_001_T\n 22: CALL: spread_operator_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T/spread_operator_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func spread_operator_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T/spread_operator_001_T.go\n AffectedNodeName: array1\n 13: Var Pass: \tarray1 := []string{\"a\", \"b\", __taint_src}\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T/spread_operator_001_T.go\n AffectedNodeName: array\n 14: Var Pass: \tarray := append([]string{\"c\"}, array1...)\n /sast-go/cases/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T/spread_operator_001_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(array)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/special_expression/spread_operator_002_F/spread_operator_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_001_T/type_cast_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_001_T/type_cast_001_T.go\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_001_T/type_cast_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_001_T/type_cast_001_T.go\n AffectedNodeName: __taint_src\n 21: SOURCE: type_cast_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_001_T/type_cast_001_T.go\n AffectedNodeName: type_cast_001_T\n 21: CALL: type_cast_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_001_T/type_cast_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func type_cast_001_T(__taint_src int) {\n /sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_001_T/type_cast_001_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := float64(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_001_T/type_cast_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_002_F/type_cast_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_003_T/type_cast_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_003_T/type_cast_003_T.go\nLine 15: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_003_T/type_cast_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_003_T/type_cast_003_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: type_cast_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_003_T/type_cast_003_T.go\n AffectedNodeName: type_cast_003_T\n 22: CALL: type_cast_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_003_T/type_cast_003_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func type_cast_003_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_003_T/type_cast_003_T.go\n 13: Var Pass: \tresult, ok := __taint_src.(string)\n /sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_003_T/type_cast_003_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/expression/type_cast/type_cast_004_F/type_cast_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_001_F/anonymous_function_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T/anonymous_function_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T/anonymous_function_002_T.go\nLine 16: __taint_sink(process(__taint_src, \"foo\"))\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T/anonymous_function_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T/anonymous_function_002_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: anonymous_function_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T/anonymous_function_002_T.go\n AffectedNodeName: anonymous_function_002_T\n 23: CALL: anonymous_function_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T/anonymous_function_002_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func anonymous_function_002_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T/anonymous_function_002_T.go\n AffectedNodeName: [return value]\n 14: Return Value: \t\treturn a + b\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T/anonymous_function_002_T.go\n AffectedNodeName: \n 16: CALL RETURN: \t__taint_sink(process(__taint_src, \"foo\"))\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T/anonymous_function_002_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(process(__taint_src, \"foo\"))\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_003_F/anonymous_function_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T/anonymous_function_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T/anonymous_function_004_T.go\nLine 15: __taint_sink(input)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T/anonymous_function_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T/anonymous_function_004_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: anonymous_function_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T/anonymous_function_004_T.go\n AffectedNodeName: anonymous_function_004_T\n 25: CALL: anonymous_function_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T/anonymous_function_004_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func anonymous_function_004_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T/anonymous_function_004_T.go\n AffectedNodeName: \n 18: CALL: \tprocess(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T/anonymous_function_004_T.go\n AffectedNodeName: input\n 14: ARG PASS: \tprocess := func(input interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T/anonymous_function_004_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t\t__taint_sink(input)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_005_F/anonymous_function_005_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T/anonymous_function_006_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T/anonymous_function_006_T.go\nLine 14: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T/anonymous_function_006_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T/anonymous_function_006_T.go\n AffectedNodeName: __taint_src\n 22: SOURCE: anonymous_function_006_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T/anonymous_function_006_T.go\n AffectedNodeName: anonymous_function_006_T\n 22: CALL: anonymous_function_006_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T/anonymous_function_006_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func anonymous_function_006_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T/anonymous_function_006_T.go\n AffectedNodeName: __single_module__.%dir_/.anonymous_function_006_T.\n 13: CALL: \tfunc() {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T/anonymous_function_006_T.go\n AffectedNodeName: __single_module__.%dir_/.anonymous_function_006_T.\n 13: ARG PASS: \tfunc() {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T/anonymous_function_006_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t\t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_001_F/closure_function_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T/closure_function_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T/closure_function_002_T.go\nLine 14: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T/closure_function_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T/closure_function_002_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: closure_function_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T/closure_function_002_T.go\n AffectedNodeName: closure_function_002_T\n 23: CALL: closure_function_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T/closure_function_002_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func closure_function_002_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T/closure_function_002_T.go\n AffectedNodeName: __single_module__.%dir_/.closure_function_002_T.\n 17: CALL: \tclosure()\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T/closure_function_002_T.go\n AffectedNodeName: __single_module__.%dir_/.closure_function_002_T.\n 13: ARG PASS: \tclosure := func() {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T/closure_function_002_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t\t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_003_F/closure_function_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T/closure_function_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T/closure_function_004_T.go\nLine 15: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T/closure_function_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T/closure_function_004_T.go\n AffectedNodeName: __taint_src\n 26: SOURCE: closure_function_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T/closure_function_004_T.go\n AffectedNodeName: closure_function_004_T\n 26: CALL: closure_function_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T/closure_function_004_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func closure_function_004_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T/closure_function_004_T.go\n AffectedNodeName: __single_module__.%dir_/.closure_function_004_T..\n 20: CALL: \tclosure_function_004_Function()\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T/closure_function_004_T.go\n AffectedNodeName: __single_module__.%dir_/.closure_function_004_T..\n 14: ARG PASS: \t\treturn func() {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T/closure_function_004_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t\t\t__taint_sink(__taint_src)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_005_F/closure_function_005_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_006_T/closure_function_006_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_006_T/closure_function_006_T.go\nLine 35: __taint_sink(a.update())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_006_T/closure_function_006_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_006_T/closure_function_006_T.go\n AffectedNodeName: __taint_src\n 42: SOURCE: closure_function_006_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_006_T/closure_function_006_T.go\n AffectedNodeName: closure_function_006_T\n 42: CALL: closure_function_006_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_006_T/closure_function_006_T.go\n AffectedNodeName: __taint_src\n 13: ARG PASS: func closure_function_006_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_006_T/closure_function_006_T.go\n AffectedNodeName: source\n 25: Var Pass: \t\t\t\tsource = __taint_src\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_006_T/closure_function_006_T.go\n AffectedNodeName: [return value]\n 26: Return Value: \t\t\t\treturn source\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_006_T/closure_function_006_T.go\n AffectedNodeName: \n 35: CALL RETURN: \t__taint_sink(a.update())\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_006_T/closure_function_006_T.go\n AffectedNodeName: __taint_sink\n 35: SINK: \t__taint_sink(a.update())\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_007_F/closure_function_007_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_T/closure_function_008_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_T/closure_function_008_T.go\nLine 20: __taint_sink(middleVar)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_T/closure_function_008_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_T/closure_function_008_T.go\n AffectedNodeName: __taint_src\n 38: SOURCE: closure_function_008_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_T/closure_function_008_T.go\n AffectedNodeName: closure_function_008_T\n 38: CALL: closure_function_008_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_T/closure_function_008_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func closure_function_008_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_T/closure_function_008_T.go\n AffectedNodeName: outerVar\n 14: Var Pass: \t\touterVar := __taint_src\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_T/closure_function_008_T.go\n AffectedNodeName: middleVar\n 17: Var Pass: \t\t\tmiddleVar := outerVar\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_T/closure_function_008_T.go\n AffectedNodeName: __single_module__.%dir_/.closure_function_008_T...\n 31: CALL: \tclosure_function_008_Tunction()\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_T/closure_function_008_T.go\n AffectedNodeName: __single_module__.%dir_/.closure_function_008_T...\n 19: ARG PASS: \t\t\tinner := func() {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_T/closure_function_008_T.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t\t\t\t__taint_sink(middleVar)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_009_F/closure_function_009_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_010_T/closure_function_010_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_010_T/closure_function_010_T.go\nLine 18: __taint_sink(outerVar)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_010_T/closure_function_010_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_010_T/closure_function_010_T.go\n AffectedNodeName: __taint_src\n 36: SOURCE: closure_function_010_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_010_T/closure_function_010_T.go\n AffectedNodeName: closure_function_010_T\n 36: CALL: closure_function_010_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_010_T/closure_function_010_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func closure_function_010_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_010_T/closure_function_010_T.go\n AffectedNodeName: outerVar\n 14: Var Pass: \t\touterVar := __taint_src\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_010_T/closure_function_010_T.go\n AffectedNodeName: __single_module__.%dir_/.closure_function_010_T...\n 29: CALL: \tclosure_function_010_Tunction()\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_010_T/closure_function_010_T.go\n AffectedNodeName: __single_module__.%dir_/.closure_function_010_T...\n 17: ARG PASS: \t\t\tinner := func() {\n /sast-go/cases/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_010_T/closure_function_010_T.go\n AffectedNodeName: __taint_sink\n 18: SINK: \t\t\t\t__taint_sink(outerVar)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_001_F/argument_passing_value_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_002_T/argument_passing_value_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_002_T/argument_passing_value_002_T.go\nLine 17: __taint_sink(arg)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_002_T/argument_passing_value_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_002_T/argument_passing_value_002_T.go\n AffectedNodeName: __taint_src\n 24: SOURCE: argument_passing_value_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_002_T/argument_passing_value_002_T.go\n AffectedNodeName: argument_passing_value_002_T\n 24: CALL: argument_passing_value_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_002_T/argument_passing_value_002_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func argument_passing_value_002_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_002_T/argument_passing_value_002_T.go\n AffectedNodeName: process\n 13: CALL: \tprocess(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_002_T/argument_passing_value_002_T.go\n AffectedNodeName: arg\n 16: ARG PASS: func process(arg string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_002_T/argument_passing_value_002_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(arg)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_003_F/argument_passing_value_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_004_T/argument_passing_value_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_004_T/argument_passing_value_004_T.go\nLine 19: __taint_sink(arg)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_004_T/argument_passing_value_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_004_T/argument_passing_value_004_T.go\n AffectedNodeName: __taint_src\n 29: SOURCE: argument_passing_value_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_004_T/argument_passing_value_004_T.go\n AffectedNodeName: argument_passing_value_004_T\n 29: CALL: argument_passing_value_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_004_T/argument_passing_value_004_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func argument_passing_value_004_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_004_T/argument_passing_value_004_T.go\n AffectedNodeName: process1\n 15: CALL: \tprocess1(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_004_T/argument_passing_value_004_T.go\n AffectedNodeName: arg\n 18: ARG PASS: func process1(arg interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_004_T/argument_passing_value_004_T.go\n AffectedNodeName: __taint_sink\n 19: SINK: \t__taint_sink(arg)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_005_F/argument_passing_value_005_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_006_T/argument_passing_value_006_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_006_T/argument_passing_value_006_T.go\nLine 17: __taint_sink(arg1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_006_T/argument_passing_value_006_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_006_T/argument_passing_value_006_T.go\n AffectedNodeName: __taint_src\n 23: SOURCE: argument_passing_value_006_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_006_T/argument_passing_value_006_T.go\n AffectedNodeName: argument_passing_value_006_T\n 23: CALL: argument_passing_value_006_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_006_T/argument_passing_value_006_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func argument_passing_value_006_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_006_T/argument_passing_value_006_T.go\n AffectedNodeName: process\n 13: CALL: \tprocess(__taint_src, \"_\")\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_006_T/argument_passing_value_006_T.go\n AffectedNodeName: arg1\n 16: ARG PASS: func process(arg1 string, arg2 string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_006_T/argument_passing_value_006_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(arg1)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_007_F/argument_passing_value_007_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_008_T/argument_passing_value_008_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_008_T/argument_passing_value_008_T.go\nLine 15: __taint_sink(innerInput)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_008_T/argument_passing_value_008_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_008_T/argument_passing_value_008_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: argument_passing_value_008_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_008_T/argument_passing_value_008_T.go\n AffectedNodeName: argument_passing_value_008_T\n 27: CALL: argument_passing_value_008_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_008_T/argument_passing_value_008_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func argument_passing_value_008_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_008_T/argument_passing_value_008_T.go\n AffectedNodeName: \n 21: CALL: \touter(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_008_T/argument_passing_value_008_T.go\n AffectedNodeName: input\n 13: ARG PASS: \touter := func(input string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_008_T/argument_passing_value_008_T.go\n AffectedNodeName: \n 18: CALL: \t\tinner(input)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_008_T/argument_passing_value_008_T.go\n AffectedNodeName: innerInput\n 14: ARG PASS: \t\tinner := func(innerInput interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_008_T/argument_passing_value_008_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t\t\t__taint_sink(innerInput)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_009_T/argument_passing_value_009_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_009_T/argument_passing_value_009_T.go\nLine 20: __taint_sink(person.GetNamePointer())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_009_T/argument_passing_value_009_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_009_T/argument_passing_value_009_T.go\n AffectedNodeName: __taint_src\n 35: SOURCE: argument_passing_value_009_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_009_T/argument_passing_value_009_T.go\n AffectedNodeName: argument_passing_value_009_T\n 35: CALL: argument_passing_value_009_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_009_T/argument_passing_value_009_T.go\n AffectedNodeName: __taint_src\n 16: ARG PASS: func argument_passing_value_009_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_009_T/argument_passing_value_009_T.go\n AffectedNodeName: person\n 17: Var Pass: \tperson := Person{Name: __taint_src}\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_009_T/argument_passing_value_009_T.go\n AffectedNodeName: GetNamePointer\n 20: CALL RETURN: \t__taint_sink(person.GetNamePointer())\n /sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_009_T/argument_passing_value_009_T.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t__taint_sink(person.GetNamePointer())\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/argument_passing/argument_passing_value_010_F/argument_passing_value_010_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_001_F/chained_call_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T.go\nLine 31: __taint_sink(a.name)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T.go\n AffectedNodeName: __taint_src\n 37: SOURCE: chained_call_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T.go\n AffectedNodeName: chained_call_002_T\n 37: CALL: chained_call_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func chained_call_002_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T.go\n AffectedNodeName: setName\n 13: CALL: \tnew(A).setName(\"_\").clearName().setName(__taint_src).process()\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T.go\n AffectedNodeName: setName\n 13: CALL RETURN: \tnew(A).setName(\"_\").clearName().setName(__taint_src).process()\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T.go\n AffectedNodeName: process\n 13: CALL: \tnew(A).setName(\"_\").clearName().setName(__taint_src).process()\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T.go\n AffectedNodeName: process\n 30: ARG PASS: func (a *A) process() {\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T/chained_call_002_T.go\n AffectedNodeName: __taint_sink\n 31: SINK: \t__taint_sink(a.name)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_003_F/chained_call_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\nLine 39: __taint_sink(b.name)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\n AffectedNodeName: __taint_src\n 46: SOURCE: chained_call_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\n AffectedNodeName: chained_call_004_T\n 46: CALL: chained_call_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func chained_call_004_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\n AffectedNodeName: SetName\n 13: CALL: \tNewB().SetName(__taint_src).SetOther().Process()\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\n AffectedNodeName: SetName\n 13: CALL RETURN: \tNewB().SetName(__taint_src).SetOther().Process()\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\n AffectedNodeName: SetOther\n 13: CALL RETURN: \tNewB().SetName(__taint_src).SetOther().Process()\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\n AffectedNodeName: Process\n 13: CALL: \tNewB().SetName(__taint_src).SetOther().Process()\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\n AffectedNodeName: Process\n 38: ARG PASS: func (b *B) Process() {\n /sast-go/cases/completeness/single_app_tracing/function_call/chained_call/chained_call_004_T/chained_call_004_T.go\n AffectedNodeName: __taint_sink\n 39: SINK: \t__taint_sink(b.name)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_001_F/higher_order_function_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T/higher_order_function_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T/higher_order_function_002_T.go\nLine 20: __taint_sink(f(__taint_src, \"_\")())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T/higher_order_function_002_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T/higher_order_function_002_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: higher_order_function_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T/higher_order_function_002_T.go\n AffectedNodeName: higher_order_function_002_T\n 27: CALL: higher_order_function_002_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T/higher_order_function_002_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func higher_order_function_002_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T/higher_order_function_002_T.go\n AffectedNodeName: [return value]\n 16: Return Value: \t\t\treturn a + b + c\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T/higher_order_function_002_T.go\n AffectedNodeName: \n 20: CALL RETURN: \t__taint_sink(f(__taint_src, \"_\")())\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T/higher_order_function_002_T.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t__taint_sink(f(__taint_src, \"_\")())\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_003_F/higher_order_function_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T/higher_order_function_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T/higher_order_function_004_T.go\nLine 24: __taint_sink(f(g, __taint_src, \"_\"))\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T/higher_order_function_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T/higher_order_function_004_T.go\n AffectedNodeName: __taint_src\n 31: SOURCE: higher_order_function_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T/higher_order_function_004_T.go\n AffectedNodeName: higher_order_function_004_T\n 31: CALL: higher_order_function_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T/higher_order_function_004_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func higher_order_function_004_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T/higher_order_function_004_T.go\n AffectedNodeName: [return value]\n 20: Return Value: \t\t\treturn a + b + c\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T/higher_order_function_004_T.go\n AffectedNodeName: \n 14: CALL RETURN: \t\treturn g(a, b)()\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T/higher_order_function_004_T.go\n AffectedNodeName: [return value]\n 14: Return Value: \t\treturn g(a, b)()\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T/higher_order_function_004_T.go\n AffectedNodeName: \n 24: CALL RETURN: \t__taint_sink(f(g, __taint_src, \"_\"))\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T/higher_order_function_004_T.go\n AffectedNodeName: __taint_sink\n 24: SINK: \t__taint_sink(f(g, __taint_src, \"_\"))\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_005_F/higher_order_function_005_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T/higher_order_function_006_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T/higher_order_function_006_T.go\nLine 13: __taint_sink(f(g, u, __taint_src, \"_\")())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T/higher_order_function_006_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T/higher_order_function_006_T.go\n AffectedNodeName: __taint_src\n 35: SOURCE: higher_order_function_006_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T/higher_order_function_006_T.go\n AffectedNodeName: higher_order_function_006_T\n 35: CALL: higher_order_function_006_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T/higher_order_function_006_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func higher_order_function_006_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T/higher_order_function_006_T.go\n AffectedNodeName: f\n 13: CALL: \t__taint_sink(f(g, u, __taint_src, \"_\")())\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T/higher_order_function_006_T.go\n AffectedNodeName: \n 13: CALL RETURN: \t__taint_sink(f(g, u, __taint_src, \"_\")())\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T/higher_order_function_006_T.go\n AffectedNodeName: __taint_sink\n 13: SINK: \t__taint_sink(f(g, u, __taint_src, \"_\")())\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_007_F/higher_order_function_007_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T/higher_order_function_008_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T/higher_order_function_008_T.go\nLine 16: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T/higher_order_function_008_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T/higher_order_function_008_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: higher_order_function_008_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T/higher_order_function_008_T.go\n AffectedNodeName: higher_order_function_008_T\n 27: CALL: higher_order_function_008_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T/higher_order_function_008_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func higher_order_function_008_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T/higher_order_function_008_T.go\n AffectedNodeName: [return value]\n 14: Return Value: \t\treturn a + b\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T/higher_order_function_008_T.go\n AffectedNodeName: higher_order_function_008_Function\n 13: CALL RETURN: \tresult := higher_order_function_008_Function(func(a string, b string) string {\n 14: CALL RETURN: \t\treturn a + b\n 15: CALL RETURN: \t}, __taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T/higher_order_function_008_T.go\n AffectedNodeName: result\n 13: Var Pass: \tresult := higher_order_function_008_Function(func(a string, b string) string {\n 14: Var Pass: \t\treturn a + b\n 15: Var Pass: \t}, __taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T/higher_order_function_008_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_arg_001_T/arg_arg_001_T":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_arg_002_F/arg_arg_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_001_T/arg_return_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_001_T/arg_return_001_T.go\nLine 16: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_001_T/arg_return_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_001_T/arg_return_001_T.go\n AffectedNodeName: __taint_src\n 28: SOURCE: arg_return_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_001_T/arg_return_001_T.go\n AffectedNodeName: arg_return_001_T\n 28: CALL: arg_return_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_001_T/arg_return_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func arg_return_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_001_T/arg_return_001_T.go\n AffectedNodeName: taintedData\n 13: Var Pass: \ttaintedData := __taint_src\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_001_T/arg_return_001_T.go\n AffectedNodeName: appendTaint\n 15: CALL: \tresult := appendTaint(sList, taintedData)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_001_T/arg_return_001_T.go\n AffectedNodeName: appendTaint\n 15: CALL RETURN: \tresult := appendTaint(sList, taintedData)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_001_T/arg_return_001_T.go\n AffectedNodeName: result\n 15: Var Pass: \tresult := appendTaint(sList, taintedData)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_001_T/arg_return_001_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_002_F/arg_return_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_003_T/arg_return_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_003_T/arg_return_003_T.go\nLine 17: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_003_T/arg_return_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_003_T/arg_return_003_T.go\n AffectedNodeName: __taint_src\n 29: SOURCE: arg_return_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_003_T/arg_return_003_T.go\n AffectedNodeName: arg_return_003_T\n 29: CALL: arg_return_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_003_T/arg_return_003_T.go\n AffectedNodeName: __taint_src\n 14: ARG PASS: func arg_return_003_T(__taint_src int) {\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_003_T/arg_return_003_T.go\n AffectedNodeName: taintedData\n 15: Var Pass: \ttaintedData := __taint_src\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_003_T/arg_return_003_T.go\n AffectedNodeName: itoaTaint\n 16: CALL: \tresult := itoaTaint(taintedData)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_003_T/arg_return_003_T.go\n AffectedNodeName: itoaTaint\n 16: CALL RETURN: \tresult := itoaTaint(taintedData)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_003_T/arg_return_003_T.go\n AffectedNodeName: result\n 16: Var Pass: \tresult := itoaTaint(taintedData)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_003_T/arg_return_003_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/library_function/arg_return_004_F/arg_return_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_001_T/this_return_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_001_T/this_return_001_T.go\nLine 15: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_001_T/this_return_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_001_T/this_return_001_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: this_return_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_001_T/this_return_001_T.go\n AffectedNodeName: this_return_001_T\n 27: CALL: this_return_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_001_T/this_return_001_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func this_return_001_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_001_T/this_return_001_T.go\n AffectedNodeName: taintedData\n 13: Var Pass: \ttaintedData := __taint_src\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_001_T/this_return_001_T.go\n AffectedNodeName: taintToString\n 14: CALL: \tresult := taintToString(taintedData)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_001_T/this_return_001_T.go\n AffectedNodeName: taintToString\n 14: CALL RETURN: \tresult := taintToString(taintedData)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_001_T/this_return_001_T.go\n AffectedNodeName: result\n 14: Var Pass: \tresult := taintToString(taintedData)\n /sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_001_T/this_return_001_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/library_function/this_return_002_F/this_return_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T/polymorphism_override_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T/polymorphism_override_001_T.go\nLine 14: __taint_sink(sub.call(__taint_src))\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T/polymorphism_override_001_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T/polymorphism_override_001_T.go\n AffectedNodeName: __taint_src\n 37: SOURCE: polymorphism_override_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T/polymorphism_override_001_T.go\n AffectedNodeName: polymorphism_override_001_T\n 37: CALL: polymorphism_override_001_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T/polymorphism_override_001_T.go\n AffectedNodeName: __taint_src\n 11: ARG PASS: func polymorphism_override_001_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T/polymorphism_override_001_T.go\n AffectedNodeName: call\n 14: CALL: \t__taint_sink(sub.call(__taint_src))\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T/polymorphism_override_001_T.go\n AffectedNodeName: call\n 14: CALL RETURN: \t__taint_sink(sub.call(__taint_src))\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T/polymorphism_override_001_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(sub.call(__taint_src))\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_002_F/polymorphism_override_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_003_T/polymorphism_override_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_003_T/polymorphism_override_003_T.go\nLine 15: __taint_sink(student.Run())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_003_T/polymorphism_override_003_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_003_T/polymorphism_override_003_T.go\n AffectedNodeName: __taint_src\n 46: SOURCE: polymorphism_override_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_003_T/polymorphism_override_003_T.go\n AffectedNodeName: polymorphism_override_003_T\n 46: CALL: polymorphism_override_003_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_003_T/polymorphism_override_003_T.go\n AffectedNodeName: __taint_src\n 11: ARG PASS: func polymorphism_override_003_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_003_T/polymorphism_override_003_T.go\n AffectedNodeName: student\n 12: Var Pass: \tvar student Person = &Student{Name: __taint_src, Age: 20, GPA: 3.8}\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_003_T/polymorphism_override_003_T.go\n AffectedNodeName: Run\n 15: CALL RETURN: \t__taint_sink(student.Run())\n /sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_003_T/polymorphism_override_003_T.go\n AffectedNodeName: __taint_sink\n 15: SINK: \t__taint_sink(student.Run())\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/override/polymorphism_override_004_F/polymorphism_override_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/multiple_return_005_F/multiple_return_005_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/multiple_return_006_T/multiple_return_006_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/multiple_return_006_T/multiple_return_006_T.go\nLine 17: __taint_sink(ret1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/multiple_return_006_T/multiple_return_006_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/multiple_return_006_T/multiple_return_006_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: multiple_return_006_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/multiple_return_006_T/multiple_return_006_T.go\n AffectedNodeName: multiple_return_006_T\n 27: CALL: multiple_return_006_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/multiple_return_006_T/multiple_return_006_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func multiple_return_006_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/multiple_return_006_T/multiple_return_006_T.go\n AffectedNodeName: processData\n 15: CALL: \tret1, ret2 := processData(__taint_src, a)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/multiple_return_006_T/multiple_return_006_T.go\n AffectedNodeName: processData\n 15: CALL RETURN: \tret1, ret2 := processData(__taint_src, a)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/multiple_return_006_T/multiple_return_006_T.go\n 15: Var Pass: \tret1, ret2 := processData(__taint_src, a)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/multiple_return_006_T/multiple_return_006_T.go\n AffectedNodeName: __taint_sink\n 17: SINK: \t__taint_sink(ret1)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/named_return_003_F/named_return_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/named_return_004_T/named_return_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/named_return_004_T/named_return_004_T.go\nLine 16: __taint_sink(ret)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/named_return_004_T/named_return_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/named_return_004_T/named_return_004_T.go\n AffectedNodeName: __taint_src\n 27: SOURCE: named_return_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/named_return_004_T/named_return_004_T.go\n AffectedNodeName: named_return_004_T\n 27: CALL: named_return_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/named_return_004_T/named_return_004_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func named_return_004_T(__taint_src interface{}) {\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/named_return_004_T/named_return_004_T.go\n AffectedNodeName: processData\n 15: CALL: \tret := processData(__taint_src, a)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/named_return_004_T/named_return_004_T.go\n AffectedNodeName: processData\n 15: CALL RETURN: \tret := processData(__taint_src, a)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/named_return_004_T/named_return_004_T.go\n AffectedNodeName: ret\n 15: Var Pass: \tret := processData(__taint_src, a)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/named_return_004_T/named_return_004_T.go\n AffectedNodeName: __taint_sink\n 16: SINK: \t__taint_sink(ret)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/return_value_passing_003_F/return_value_passing_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/return_value_passing_004_T/return_value_passing_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/return_value_passing_004_T/return_value_passing_004_T.go\nLine 14: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/return_value_passing_004_T/return_value_passing_004_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/return_value_passing_004_T/return_value_passing_004_T.go\n AffectedNodeName: __taint_src\n 25: SOURCE: return_value_passing_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/return_value_passing_004_T/return_value_passing_004_T.go\n AffectedNodeName: return_value_passing_004_T\n 25: CALL: return_value_passing_004_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/return_value_passing_004_T/return_value_passing_004_T.go\n AffectedNodeName: __taint_src\n 12: ARG PASS: func return_value_passing_004_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/return_value_passing_004_T/return_value_passing_004_T.go\n AffectedNodeName: process\n 13: CALL: \tdata := process(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/return_value_passing_004_T/return_value_passing_004_T.go\n AffectedNodeName: process\n 13: CALL RETURN: \tdata := process(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/return_value_passing_004_T/return_value_passing_004_T.go\n AffectedNodeName: data\n 13: Var Pass: \tdata := process(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/function_call/return_value_passing/return_value_passing_004_T/return_value_passing_004_T.go\n AffectedNodeName: __taint_sink\n 14: SINK: \t__taint_sink(data)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/interface_class/interface_implementation/interface_class_001_c_T/interface_class_001_c_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/sast-go/cases/completeness/single_app_tracing/interface_class/interface_implementation/interface_class_001_c_T/interface_class_001_c_T.go\nLine 20: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/sast-go/cases/completeness/single_app_tracing/interface_class/interface_implementation/interface_class_001_c_T/interface_class_001_c_T.go\",\"functionName\":\"main\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /sast-go/cases/completeness/single_app_tracing/interface_class/interface_implementation/interface_class_001_c_T/interface_class_001_c_T.go\n AffectedNodeName: __taint_src\n 58: SOURCE: interface_class_001_c_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/interface_class/interface_implementation/interface_class_001_c_T/interface_class_001_c_T.go\n AffectedNodeName: interface_class_001_c_T\n 58: CALL: interface_class_001_c_T(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/interface_class/interface_implementation/interface_class_001_c_T/interface_class_001_c_T.go\n AffectedNodeName: __taint_src\n 11: ARG PASS: func interface_class_001_c_T(__taint_src string) {\n /sast-go/cases/completeness/single_app_tracing/interface_class/interface_implementation/interface_class_001_c_T/interface_class_001_c_T.go\n AffectedNodeName: GetTest\n 19: CALL: \tresult, _ := testAPI.GetTest(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/interface_class/interface_implementation/interface_class_001_c_T/interface_class_001_c_T.go\n AffectedNodeName: GetTest\n 19: CALL RETURN: \tresult, _ := testAPI.GetTest(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/interface_class/interface_implementation/interface_class_001_c_T/interface_class_001_c_T.go\n 19: Var Pass: \tresult, _ := testAPI.GetTest(__taint_src)\n /sast-go/cases/completeness/single_app_tracing/interface_class/interface_implementation/interface_class_001_c_T/interface_class_001_c_T.go\n AffectedNodeName: __taint_sink\n 20: SINK: \t__taint_sink(result)\n==========================================================\n #Total-findings:1\n==========================================================","/benchmarks/sast-go/cases/completeness/single_app_tracing/interface_class/interface_implementation/interface_class_002_c_F/interface_class_002_c_F":"======================== Findings ========================\nNo findings!\n=========================================================="} \ No newline at end of file diff --git a/test/go/test-go-callsite-limit-integration.ts b/test/go/test-go-callsite-limit-integration.ts new file mode 100644 index 00000000..33f6a4e9 --- /dev/null +++ b/test/go/test-go-callsite-limit-integration.ts @@ -0,0 +1,310 @@ +/** + * go-analyzer per-callsite 限流 + 内存护栏 delta 模式集成测试 + * + * 通过 analyzeSingleFile 跑完整 processInstruction → processCallExpression 链路， + * 验证限流 / 内存护栏 / CHA fallback / 互斥分支预算快照在真实分析流程中的行为。 + * 单元测试（test-go-callsite-limit-memory-guard.ts）只覆盖 helper 纯数据语义， + * 集成测试覆盖真实 processInstruction 调用链。 + * + * Go UAST 解析器（uast4go 外部二进制）从磁盘读取文件，测试代码先写入临时文件再分析。 + */ +import * as fs from 'fs' +import * as os from 'os' +import * as path from 'path' +import { describe, it, before, after } from 'mocha' +import * as assert from 'assert' +const config = require('../../src/config') +const Analyzer = require('../../src/engine/analyzer/golang/common/go-analyzer') + +/** + * builder pattern method chaining：a.b().c().d() 链式调用，receiver 反复 executeCall 同一 callsite。 + * 验证：限流累计计数 + fallback 触发后不 OOM + 不崩溃 + sink 仍可达。 + */ +const METHOD_CHAIN_CODE = ` +package chain_test + +func __taint_sink(o interface{}) {} + +type Builder struct { + val string +} + +func NewBuilder() *Builder { + return &Builder{} +} + +func (b *Builder) SetVal(v string) *Builder { + b.val = v + return b +} + +func (b *Builder) Clear() *Builder { + b.val = "" + return b +} + +func (b *Builder) Build() { + __taint_sink(b.val) +} + +func chainEntry(__taint_src string) { + NewBuilder().SetVal(__taint_src).Clear().SetVal(__taint_src).Build() +} + +func main() { + chainEntry("source") +} +` + +/** + * 接口方法 method chaining：CHA fallback 块在限流命中后仍执行， + * CHA fallback 内 executeCall 递归进入 processCallExpression 时仍经过限流点。 + * 验证：限流 fallback 后 CHA fallback 仍能跑，接口方法 sink 命中不丢失。 + */ +const INTERFACE_CHAIN_CODE = ` +package iface_test + +func __taint_sink(o interface{}) {} + +type IProcessor interface { + Process(data string) string +} + +type BaseProcessor struct{} + +func (p *BaseProcessor) Process(data string) string { + return data +} + +type Wrapper struct { + inner IProcessor +} + +func NewWrapper(inner IProcessor) *Wrapper { + return &Wrapper{inner: inner} +} + +func (w *Wrapper) Wrap(data string) *Wrapper { + w.inner.Process(data) + return w +} + +func ifaceEntry(__taint_src string) { + bp := &BaseProcessor{} + NewWrapper(bp).Wrap(__taint_src).Wrap(__taint_src).Wrap(__taint_src) +} + +func main() { + ifaceEntry("source") +} +` + +/** + * 三元表达式互斥分支：consequent / alternative 内同一 callsite 不应双计次。 + * 验证：processConditionalExpression override 的 snapshot/restore/merge 在真实流程中生效。 + */ +const COND_BRANCH_CODE = ` +package cond_test + +func __taint_sink(o interface{}) {} + +type B struct { + val string +} + +func NewB() *B { + return &B{} +} + +func (b *B) Set(v string) *B { + b.val = v + return b +} + +func (b *B) Done() { + __taint_sink(b.val) +} + +func condEntry(__taint_src string, cond bool) { + b := NewB() + v := cond && true + if v { + b.Set(__taint_src).Done() + } else { + b.Set(__taint_src).Done() + } +} + +func ternaryEntry(__taint_src string, cond bool) { + b := NewB() + x := cond + _ = x + result := b.Set(__taint_src) + _ = result + b.Done() +} + +func main() { + condEntry("source", true) + ternaryEntry("source", false) +} +` + +/** 写临时 Go 文件并返回路径（os.tmpdir 下唯一目录）。 */ +function writeTempGoFile(code: string, name: string): string { + const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'yasa-int-')) + const filePath = path.join(tmpDir, name) + fs.writeFileSync(filePath, code, 'utf8') + return filePath +} + +function makeAnalyzer(): any { + config.ruleConfigFile = __dirname + '/rule_config.json' + config.checkerIds = ['taint_flow_test'] + config.uastSDKPath = path.join(__dirname, '../../deps') + config.language = 'golang' + config.maindirPrefix = __dirname + '/benchmarks' + return new Analyzer({ + language: 'golang', + examineIssues: true, + checkers: { taint_flow_test: true }, + ...config, + mode: { intra: true }, + sanity: true, + }) +} + +describe('go-analyzer × callsite 限流 + 内存护栏集成测试', function () { + this.timeout(120000) + let originalDeltaMb: string | undefined + const tmpDirs: string[] = [] + + before(() => { + originalDeltaMb = process.env.YASA_GO_EP_MEM_LIMIT_DELTA_MB + }) + + after(() => { + if (originalDeltaMb === undefined) { + delete process.env.YASA_GO_EP_MEM_LIMIT_DELTA_MB + } else { + process.env.YASA_GO_EP_MEM_LIMIT_DELTA_MB = originalDeltaMb + } + // 清理临时目录 + for (const dir of tmpDirs) { + try { + fs.rmSync(dir, { recursive: true, force: true }) + } catch { + // ignore + } + } + }) + + describe('INT-1 method chain 集成', () => { + it('链式调用不崩溃 + 限流计数累积（callsiteInterpretCount > 0）', async () => { + const filePath = writeTempGoFile(METHOD_CHAIN_CODE, 'chain_int_test.go') + tmpDirs.push(path.dirname(filePath)) + const analyzer = makeAnalyzer() + const result = await analyzer.analyzeSingleFile(METHOD_CHAIN_CODE, filePath) + assert.ok(result !== false, 'analyzeSingleFile 应成功返回') + // method chain 的 callsite 有 loc，incrementAndCheckCallsiteLimit 应被触发并计数 + assert.ok( + analyzer.callsiteInterpretCount.size > 0, + 'method chain 应触发 callsiteInterpretCount 计数（callsite 有 loc）' + ) + }) + }) + + describe('INT-2 多入口序列 baseline 独立', () => { + it('连续分析两个文件：analyzer1 计数 > 0 + analyzer2 实例独立从 0 开始', async () => { + const filePath1 = writeTempGoFile(METHOD_CHAIN_CODE, 'multi_ep_1.go') + tmpDirs.push(path.dirname(filePath1)) + const analyzer1 = makeAnalyzer() + await analyzer1.analyzeSingleFile(METHOD_CHAIN_CODE, filePath1) + const countAfterFirst = analyzer1.callsiteInterpretCount.size + // analyzer1 分析后应有计数（method chain 触发 incrementAndCheckCallsiteLimit） + assert.ok(countAfterFirst > 0, 'analyzer1 分析后 callsiteInterpretCount 应 > 0') + // 新 analyzer 实例的 callsiteInterpretCount 应独立（不继承前一个） + const analyzer2 = makeAnalyzer() + assert.strictEqual( + analyzer2.callsiteInterpretCount.size, + 0, + '新 analyzer 实例 callsiteInterpretCount 应从 0 开始' + ) + }) + }) + + describe('INT-3 processConditionalExpression override 集成', () => { + it('三元 + if/else 分支内 method chain 不崩溃', async () => { + const filePath = writeTempGoFile(COND_BRANCH_CODE, 'cond_branch_test.go') + tmpDirs.push(path.dirname(filePath)) + const analyzer = makeAnalyzer() + const result = await analyzer.analyzeSingleFile(COND_BRANCH_CODE, filePath) + assert.ok(result !== false, 'analyzeSingleFile 应成功返回') + // processConditionalExpression override 应被真实调用链触发（不崩溃即通过） + }) + }) + + describe('INT-4 CHA fallback 阈值内正常跑', () => { + it('接口方法 method chain 不崩溃 + CHA fallback 正常 dispatch', async () => { + const filePath = writeTempGoFile(INTERFACE_CHAIN_CODE, 'iface_chain_test.go') + tmpDirs.push(path.dirname(filePath)) + const analyzer = makeAnalyzer() + const result = await analyzer.analyzeSingleFile(INTERFACE_CHAIN_CODE, filePath) + assert.ok(result !== false, 'analyzeSingleFile 应成功返回') + // 限流未命中时（count ≤ 200），super.processCallExpression 正常 dispatch， + // CHA fallback 正常执行（不崩溃即通过） + }) + }) + + describe('INT-5 接口 method chain 不崩溃（限流未命中场景）', () => { + it('接口 method chain 短链（count ≤ 200）不触发限流，正常 dispatch 不崩溃', async () => { + // 短链 method chain（3 层 Wrap）callsite 计数远低于 CALLSITE_INTERPRET_LIMIT=200， + // 限流未命中，super.processCallExpression 正常 dispatch，CHA fallback 正常执行。 + // 限流命中需大规模 builder pattern 项目（>200 次同 callsite），单测无法构造。 + // 此用例验证限流未命中场景的 CHA fallback 正常路径不崩溃。 + const filePath = writeTempGoFile(INTERFACE_CHAIN_CODE, 'iface_chain_limit_test.go') + tmpDirs.push(path.dirname(filePath)) + const analyzer = makeAnalyzer() + const result = await analyzer.analyzeSingleFile(INTERFACE_CHAIN_CODE, filePath) + assert.ok(result !== false, 'analyzeSingleFile 应成功返回') + // 限流未命中：callsiteInterpretCount 有计数但远低于 200 + assert.ok( + analyzer.callsiteInterpretCount.size > 0, + '接口 method chain 应触发 callsiteInterpretCount 计数' + ) + }) + }) + + describe('INT-6 内存护栏 delta 模式集成', () => { + it('delta=0 极小阈值下分析不崩溃（单文件 heap growth 小，guard 可能不触发）', async () => { + // delta=0 理论上任何 heap growth 都触发 abort，但单文件 fixture 规模小， + // baseline 探测后 peak 与 baseline 差值可能 < throttle 窗口精度，guard 不一定触发。 + // 此用例验证 delta=0 不导致崩溃（guard 逻辑本身不抛异常）。 + process.env.YASA_GO_EP_MEM_LIMIT_DELTA_MB = '0' + const filePath = writeTempGoFile(METHOD_CHAIN_CODE, 'mem_guard_test.go') + tmpDirs.push(path.dirname(filePath)) + const analyzer = makeAnalyzer() + const result = await analyzer.analyzeSingleFile(METHOD_CHAIN_CODE, filePath) + // 分析应正常完成（不抛异常），guard 触发与否取决于实际 heap growth + assert.ok(result !== undefined, 'analyzeSingleFile 应正常返回（不抛异常）') + // memoryGuardAbortCount 非负（触发与否都合法，单文件规模小可能不触发） + assert.ok(analyzer.memoryGuardAbortCount >= 0, 'memoryGuardAbortCount 应非负') + }) + + it('正常 delta 阈值下不误杀正常入口', async () => { + // 恢复默认 delta（2048），正常入口不应被 abort + process.env.YASA_GO_EP_MEM_LIMIT_DELTA_MB = '2048' + const filePath = writeTempGoFile(METHOD_CHAIN_CODE, 'mem_guard_normal_test.go') + tmpDirs.push(path.dirname(filePath)) + const analyzer = makeAnalyzer() + const result = await analyzer.analyzeSingleFile(METHOD_CHAIN_CODE, filePath) + assert.ok(result !== false, 'analyzeSingleFile 应成功返回') + // 正常 delta 阈值下不应有 abort + assert.strictEqual( + analyzer.memoryGuardAbortCount, + 0, + '正常 delta 阈值下 memoryGuardAbortCount 应为 0' + ) + }) + }) +}) diff --git a/test/go/test-go-callsite-limit-memory-guard.ts b/test/go/test-go-callsite-limit-memory-guard.ts new file mode 100644 index 00000000..b723de5f --- /dev/null +++ b/test/go/test-go-callsite-limit-memory-guard.ts @@ -0,0 +1,302 @@ +/** + * go-analyzer per-callsite interpret count 限流 + 内存护栏 delta 模式单元测试 + * + * 覆盖 per-callsite 限流 + 内存护栏 delta 模式： + * - incrementAndCheckCallsiteLimit：key 设计 + 超限返回 true + * - snapshotMethodBudgets/restoreMethodBudgets/mergeMethodBudgets：互斥分支预算快照 + * - shouldAbortExecutionForMemory：delta 模式判定 + state.exceeded 设置 + * - resetMemoryGuardForEntryPoint：baseline reset + callsiteInterpretCount.clear + * - onEntryPointMemoryGuardFinalize：exceeded=false 时返回非 aborted / exceeded=true 时返回 aborted + * - 交互验证：callsiteInterpretCount 在 resetMemoryGuardForEntryPoint 时 clear + * + * 说明：GoAnalyzer 继承 Analyzer，构造器需要完整 symbolInterpret 上下文；这里直接引用 prototype + * 方法，把 helper 所需的 memoryGuardState / callsiteInterpretCount / deltaLimitMb 作为最小 mock 挂上， + * 不走 processInstruction / checkerManager。重点是验证新 helper 的纯数据遍历 + 限流语义正确。 + */ +import { describe, it, beforeEach } from 'mocha' +import * as assert from 'assert' +const GoAnalyzer = require('../../src/engine/analyzer/golang/common/go-analyzer') +const { + createMemoryGuardState, + resetForEntryPoint, + getEntryPointHeapDeltaMb, +} = require('../../src/engine/analyzer/common/memory-guard/entrypoint-memory-guard') + +/** 构造一个最小的 GoAnalyzer 替身：只含 helper 需要的字段，方法从 prototype 借过来。 */ +function makeAnalyzerStub(): any { + const stub: any = { + callsiteInterpretCount: new Map(), + memoryGuardState: createMemoryGuardState(), + deltaLimitMb: 2048, + memoryGuardAbortCount: 0, + memoryGuardFlushCount: 0, + } + // 借用 helper 方法（不依赖构造器） + stub.incrementAndCheckCallsiteLimit = GoAnalyzer.prototype.incrementAndCheckCallsiteLimit + stub.snapshotMethodBudgets = GoAnalyzer.prototype.snapshotMethodBudgets + stub.restoreMethodBudgets = GoAnalyzer.prototype.restoreMethodBudgets + stub.mergeMethodBudgets = GoAnalyzer.prototype.mergeMethodBudgets + stub.shouldAbortExecutionForMemory = GoAnalyzer.prototype.shouldAbortExecutionForMemory + stub.resetMemoryGuardForEntryPoint = GoAnalyzer.prototype.resetMemoryGuardForEntryPoint + stub.onEntryPointMemoryGuardFinalize = GoAnalyzer.prototype.onEntryPointMemoryGuardFinalize + return stub +} + +/** 构造一个 CallExpression 节点 mock。 */ +function makeCallNode(nodehash: string, line: number, column: number): any { + return { + type: 'CallExpression', + loc: { start: { line, column } }, + _meta: { nodehash }, + } +} + +describe('go-analyzer × callsite 限流 + 内存护栏 delta 模式', () => { + let analyzer: any + beforeEach(() => { + analyzer = makeAnalyzerStub() + }) + + describe('A.2 incrementAndCheckCallsiteLimit', () => { + it('LIM-1: nodehash 优先作为 key', () => { + const node = makeCallNode('hash-abc', 10, 5) + const over1 = analyzer.incrementAndCheckCallsiteLimit(node) + assert.strictEqual(over1, false, '第 1 次不应超限') + assert.strictEqual(analyzer.callsiteInterpretCount.get('hash-abc'), 1) + }) + + it('LIM-2: nodehash 缺失时用 loc.line:loc.column 作 key', () => { + const node = { type: 'CallExpression', loc: { start: { line: 20, column: 8 } } } + const over = analyzer.incrementAndCheckCallsiteLimit(node as any) + assert.strictEqual(over, false, '第 1 次不应超限') + assert.strictEqual(analyzer.callsiteInterpretCount.get('20:8'), 1) + }) + + it('LIM-3: 同 callsite 累计到超限阈值（CALLSITE_INTERPRET_LIMIT=200）返回 true', () => { + const node = makeCallNode('hash-chain', 1, 1) + let lastOver = false + for (let i = 0; i < 250; i++) { + lastOver = analyzer.incrementAndCheckCallsiteLimit(node) + } + assert.strictEqual(lastOver, true, '第 250 次应超限') + assert.strictEqual(analyzer.callsiteInterpretCount.get('hash-chain'), 250) + }) + + it('LIM-4: 不同 callsite 独立计数（nodehash 不同）', () => { + const nodeA = makeCallNode('hash-a', 1, 1) + const nodeB = makeCallNode('hash-b', 2, 2) + analyzer.incrementAndCheckCallsiteLimit(nodeA) + analyzer.incrementAndCheckCallsiteLimit(nodeA) + analyzer.incrementAndCheckCallsiteLimit(nodeB) + assert.strictEqual(analyzer.callsiteInterpretCount.get('hash-a'), 2) + assert.strictEqual(analyzer.callsiteInterpretCount.get('hash-b'), 1) + }) + + it('LIM-5: 无 loc 无 nodehash 时不计数，不超限', () => { + const node = { type: 'CallExpression' } + const over = analyzer.incrementAndCheckCallsiteLimit(node as any) + assert.strictEqual(over, false) + assert.strictEqual(analyzer.callsiteInterpretCount.size, 0) + }) + }) + + describe('A.4 互斥分支预算快照', () => { + it('SNAP-1: snapshotMethodBudgets 深拷贝 callsiteInterpretCount', () => { + analyzer.callsiteInterpretCount.set('k1', 10) + const snap = analyzer.snapshotMethodBudgets() + analyzer.callsiteInterpretCount.set('k1', 99) + assert.strictEqual(snap.callsiteCount.get('k1'), 10, '快照应不受后续修改影响') + }) + + it('SNAP-2: restoreMethodBudgets 恢复到快照状态', () => { + analyzer.callsiteInterpretCount.set('k1', 10) + analyzer.callsiteInterpretCount.set('k2', 20) + const snap = analyzer.snapshotMethodBudgets() + analyzer.callsiteInterpretCount.set('k1', 50) + analyzer.callsiteInterpretCount.set('k3', 30) + analyzer.restoreMethodBudgets(snap) + assert.strictEqual(analyzer.callsiteInterpretCount.get('k1'), 10, 'k1 恢复到快照') + assert.strictEqual(analyzer.callsiteInterpretCount.get('k2'), 20, 'k2 保留') + assert.strictEqual(analyzer.callsiteInterpretCount.get('k3'), undefined, 'k3 被清除') + }) + + it('SNAP-3: mergeMethodBudgets 取每 key max 合并', () => { + const consequentFinal = { callsiteCount: new Map([['k1', 30], ['k2', 10]]) } + const alternativeFinal = { callsiteCount: new Map([['k1', 15], ['k3', 25]]) } + analyzer.callsiteInterpretCount.set('k1', 0) + analyzer.mergeMethodBudgets(consequentFinal, alternativeFinal) + assert.strictEqual(analyzer.callsiteInterpretCount.get('k1'), 30, 'k1=max(30,15)=30') + assert.strictEqual(analyzer.callsiteInterpretCount.get('k2'), 10, 'k2 只在 consequent，max=10') + assert.strictEqual(analyzer.callsiteInterpretCount.get('k3'), 25, 'k3 只在 alternative，max=25') + }) + + it('SNAP-4: 互斥分支场景模拟：consequent + alternative 同 callsite 取 max 不 sum', () => { + const node = makeCallNode('hash-mut', 1, 1) + // 模拟 processConditionalExpression 流程 + analyzer.incrementAndCheckCallsiteLimit(node) // 分支前 1 次 + const budgetSnapshot = analyzer.snapshotMethodBudgets() + // consequent 分支：执行 50 次 + for (let i = 0; i < 50; i++) analyzer.incrementAndCheckCallsiteLimit(node) + const consequentFinal = analyzer.snapshotMethodBudgets() + // 恢复到分支前 + analyzer.restoreMethodBudgets(budgetSnapshot) + // alternative 分支：执行 30 次 + for (let i = 0; i < 30; i++) analyzer.incrementAndCheckCallsiteLimit(node) + const alternativeFinal = analyzer.snapshotMethodBudgets() + // 合并 + analyzer.mergeMethodBudgets(consequentFinal, alternativeFinal) + // 预期：max(51, 31) = 51，不是 sum=81 + assert.strictEqual(analyzer.callsiteInterpretCount.get('hash-mut'), 51) + }) + }) + + describe('B.4 shouldAbortExecutionForMemory (delta 模式)', () => { + it('MG-1: guard disabled 时返回 false', () => { + analyzer.memoryGuardState.enabled = false + const abort = analyzer.shouldAbortExecutionForMemory({} as any) + assert.strictEqual(abort, false) + }) + + it('MG-2: delta 未超限返回 false，不设 exceeded', () => { + analyzer.memoryGuardState.enabled = true + analyzer.deltaLimitMb = 2048 + resetForEntryPoint(analyzer.memoryGuardState, 'test-ep') + const abort = analyzer.shouldAbortExecutionForMemory({} as any) + assert.strictEqual(abort, false) + assert.strictEqual(analyzer.memoryGuardState.exceeded, false) + }) + + it('MG-3: delta 超限时返回 true 并设 exceeded=true', () => { + analyzer.memoryGuardState.enabled = true + analyzer.deltaLimitMb = 0 // delta 阈值=0 → 任何增长都超限 + resetForEntryPoint(analyzer.memoryGuardState, 'test-ep') + // baseline 探测后，强制 peakHeapBytes 比 baseline 大 1MB → delta 1MB > 0 + analyzer.memoryGuardState.peakHeapBytes = analyzer.memoryGuardState.baselineHeapBytes + 2 * 1024 * 1024 + const abort = analyzer.shouldAbortExecutionForMemory({} as any) + assert.strictEqual(abort, true, 'delta 2MB > limit 0MB 应 abort') + assert.strictEqual(analyzer.memoryGuardState.exceeded, true) + }) + + it('MG-4: 节流窗内 probeMemoryAndUpdate 不更新 peak（delta 保守不误杀）', () => { + analyzer.memoryGuardState.enabled = true + analyzer.deltaLimitMb = 100 + resetForEntryPoint(analyzer.memoryGuardState, 'test-ep') + const baseline = analyzer.memoryGuardState.baselineHeapBytes + // 模拟节流窗内：lastProbeMs 设为现在，下次 probe 不会更新 peak + analyzer.memoryGuardState.lastProbeMs = Date.now() + const abort = analyzer.shouldAbortExecutionForMemory({} as any) + // 节流窗内 probeMemoryAndUpdate 返回 false，不更新 peakHeapBytes + // delta = peak - baseline = 0（peak 还是 baseline） + assert.strictEqual(abort, false, '节流窗内 delta=0 不应 abort') + assert.strictEqual(analyzer.memoryGuardState.peakHeapBytes, baseline, 'peak 不应被更新') + }) + }) + + describe('B.5 resetMemoryGuardForEntryPoint', () => { + it('RESET-1: reset 后 baseline 探测 + exceeded=false + callsiteInterpretCount clear', () => { + analyzer.memoryGuardState.enabled = true + analyzer.callsiteInterpretCount.set('k1', 100) + analyzer.callsiteInterpretCount.set('k2', 200) + analyzer.memoryGuardState.exceeded = true + analyzer.resetMemoryGuardForEntryPoint('new-ep') + assert.strictEqual(analyzer.memoryGuardState.entryPointLabel, 'new-ep') + assert.strictEqual(analyzer.memoryGuardState.exceeded, false) + assert.ok(analyzer.memoryGuardState.baselineHeapBytes > 0, 'baseline 应被探测') + assert.strictEqual(analyzer.callsiteInterpretCount.size, 0, 'callsiteInterpretCount 应被 clear') + }) + + it('RESET-2: guard disabled 时 reset 不执行（不探测 baseline，不清 callsiteInterpretCount）', () => { + analyzer.memoryGuardState.enabled = false + analyzer.callsiteInterpretCount.set('k1', 100) + analyzer.resetMemoryGuardForEntryPoint('test-ep') + // guard disabled 时 reset 直接 return，不动 callsiteInterpretCount + assert.strictEqual(analyzer.callsiteInterpretCount.size, 1, 'callsiteInterpretCount 不应被 clear') + }) + + it('RESET-3: 交互：reset 同时清 callsiteInterpretCount（per-entrypoint reset）', () => { + analyzer.memoryGuardState.enabled = true + const node = makeCallNode('hash-x', 1, 1) + for (let i = 0; i < 150; i++) analyzer.incrementAndCheckCallsiteLimit(node) + assert.strictEqual(analyzer.callsiteInterpretCount.get('hash-x'), 150) + analyzer.resetMemoryGuardForEntryPoint('next-ep') + assert.strictEqual(analyzer.callsiteInterpretCount.size, 0, '跨入口污染被清除') + // 下一入口从 0 开始重新计数 + const over = analyzer.incrementAndCheckCallsiteLimit(node) + assert.strictEqual(over, false, 'reset 后第 1 次不应超限') + assert.strictEqual(analyzer.callsiteInterpretCount.get('hash-x'), 1) + }) + }) + + describe('B.6 onEntryPointMemoryGuardFinalize', () => { + it('FIN-1: exceeded=false 时返回 aborted=false + peak/delta 信息', () => { + analyzer.memoryGuardState.enabled = true + resetForEntryPoint(analyzer.memoryGuardState, 'normal-ep') + const result = analyzer.onEntryPointMemoryGuardFinalize(null, 5) + assert.strictEqual(result.aborted, false) + assert.ok(result.peakHeapMb >= 0) + assert.ok(result.deltaHeapMb >= 0) + }) + + it('FIN-2: exceeded=true 时返回 aborted=true + abortCount/flushCount 自增', () => { + analyzer.memoryGuardState.enabled = true + analyzer.deltaLimitMb = 0 + resetForEntryPoint(analyzer.memoryGuardState, 'oom-ep') + analyzer.memoryGuardState.peakHeapBytes = analyzer.memoryGuardState.baselineHeapBytes + 5 * 1024 * 1024 + // 触发 shouldAbortExecutionForMemory 设 exceeded=true + analyzer.shouldAbortExecutionForMemory({} as any) + assert.strictEqual(analyzer.memoryGuardState.exceeded, true) + const beforeAbort = analyzer.memoryGuardAbortCount + const result = analyzer.onEntryPointMemoryGuardFinalize(null, 10) + assert.strictEqual(result.aborted, true) + assert.strictEqual(analyzer.memoryGuardAbortCount, beforeAbort + 1, 'abortCount 应自增') + // flushFindingsToReport 在无 resultManager 时返回 0，flushCount 仍自增 + assert.strictEqual(analyzer.memoryGuardFlushCount, 1, 'flushCount 应自增') + }) + + it('FIN-3: guard disabled 时返回 aborted=false + 零 delta 信息', () => { + analyzer.memoryGuardState.enabled = false + const result = analyzer.onEntryPointMemoryGuardFinalize(null, 0) + assert.strictEqual(result.aborted, false) + assert.strictEqual(result.peakHeapMb, 0) + assert.strictEqual(result.deltaHeapMb, 0) + }) + }) + + describe('A+B 交互验证', () => { + it('INTERACT-1: 限流点在 shouldAbortExecutionForMemory 检查之后（abort 时不执行限流计数）', () => { + // 验证：先触发 abort（exceeded=true），再调 incrementAndCheckCallsiteLimit， + // callsiteInterpretCount 仍会累积（因为 incrementAndCheckCallsiteLimit 本身不检查 exceeded）， + // 但 processInstruction 在 abort 时提前 return UndefinedValue，不走到限流点。 + // 这里验证 shouldAbortExecutionForMemory 和 incrementAndCheckCallsiteLimit 是独立 hook， + // 限流逻辑依赖 processInstruction/executeCall 的 abort 提前 return。 + analyzer.memoryGuardState.enabled = true + analyzer.deltaLimitMb = 0 + resetForEntryPoint(analyzer.memoryGuardState, 'oom-ep') + analyzer.memoryGuardState.peakHeapBytes = analyzer.memoryGuardState.baselineHeapBytes + 1 * 1024 * 1024 + const abort = analyzer.shouldAbortExecutionForMemory({} as any) + assert.strictEqual(abort, true) + // 即使 exceeded=true，incrementAndCheckCallsiteLimit 本身仍可调用（但 processInstruction 不会走到这里） + const node = makeCallNode('hash-after-abort', 1, 1) + const over = analyzer.incrementAndCheckCallsiteLimit(node) + assert.strictEqual(over, false, 'incrementAndCheckCallsiteLimit 不检查 exceeded，只做计数') + // 验证：abort 后下一入口 resetMemoryGuardForEntryPoint 清 callsiteInterpretCount + analyzer.resetMemoryGuardForEntryPoint('next-ep') + assert.strictEqual(analyzer.callsiteInterpretCount.size, 0) + }) + + it('INTERACT-2: delta 探测精度受 resetMemoryGuardForEntryPoint 调用顺序影响（symbolTable.clear 之后）', () => { + // 验证：resetMemoryGuardForEntryPoint 探测 baseline 时 callsiteInterpretCount 已 clear， + // baseline 干净（不含上一入口 callsite 计数的 Map 对象残留）。 + analyzer.memoryGuardState.enabled = true + // 模拟上一入口累积 callsiteInterpretCount + const node = makeCallNode('hash-prev', 1, 1) + for (let i = 0; i < 100; i++) analyzer.incrementAndCheckCallsiteLimit(node) + // 模拟 symbolTable.clear()（不在本测试范围，但 callsiteInterpretCount.clear 在 reset 内） + analyzer.resetMemoryGuardForEntryPoint('new-ep') + // baseline 探测时 callsiteInterpretCount 已 clear，delta 精度不受影响 + const { deltaMb } = getEntryPointHeapDeltaMb(analyzer.memoryGuardState) + assert.ok(deltaMb >= 0, 'delta 应为非负') + assert.strictEqual(analyzer.callsiteInterpretCount.size, 0) + }) + }) +}) diff --git a/test/java-entrypoint-finding-collector.test.ts b/test/java-entrypoint-finding-collector.test.ts new file mode 100644 index 00000000..82cdf881 --- /dev/null +++ b/test/java-entrypoint-finding-collector.test.ts @@ -0,0 +1,195 @@ +import assert from 'assert' +import { describe, it } from 'mocha' +import { + JavaEntrypointFindingCollector, + JavaEntrypointFindingCollectorRegistry, +} from '../src/checker/taint/java/java-entrypoint-finding-collector' + +type Finding = { id: string } + +describe('Java entrypoint finding collector', () => { + it('keeps overload candidates and normal signatures, then emits only unmatched candidates', () => { + const collector = new JavaEntrypointFindingCollector() + collector.recordCandidate('candidate', { id: 'first' }) + collector.recordCandidate('candidate', { id: 'duplicate' }) + collector.recordCandidate('normal', { id: 'suppressed' }) + collector.recordNormal('normal') + collector.recordNormal('normal') + + const emitted: Finding[] = [] + const checked: Finding[] = [] + collector.complete((finding) => { + checked.push(finding) + return true + }, (finding) => emitted.push(finding)) + + assert.deepStrictEqual(checked, [{ id: 'first' }]) + assert.deepStrictEqual(emitted, [{ id: 'first' }]) + assert.strictEqual(collector.isEmpty, true) + }) + + it('does not globally emit a candidate before complete promotes it', () => { + const collector = new JavaEntrypointFindingCollector() + const globalFindings: Finding[] = [] + collector.registerCandidate('candidate', { id: 'candidate' }) + assert.deepStrictEqual(globalFindings, []) + collector.complete(() => true, (finding) => globalFindings.push(finding)) + assert.deepStrictEqual(globalFindings, [{ id: 'candidate' }]) + }) + + it('retains state across a timeout rerun and clears after final timeout', () => { + const collector = new JavaEntrypointFindingCollector() + collector.recordCandidate('candidate', { id: 'before-rerun' }) + collector.deferForRerun() + collector.recordNormal('normal-on-rerun') + assert.strictEqual(collector.isEmpty, false) + collector.finalize('timeout') + assert.strictEqual(collector.isEmpty, true) + }) + + it('isolates consecutive and concurrent logical entrypoints', () => { + const registry = new JavaEntrypointFindingCollectorRegistry() + const first = registry.get('first') + const second = registry.get('second') + first.recordCandidate('same-signature', { id: 'first' }) + second.recordCandidate('same-signature', { id: 'second' }) + + const emitted: Finding[] = [] + registry.complete('first', () => true, (finding) => emitted.push(finding)) + assert.deepStrictEqual(emitted, [{ id: 'first' }]) + assert.strictEqual(registry.size, 1) + + registry.finalize('second', 'skip') + assert.strictEqual(registry.size, 0) + assert.strictEqual(first.isEmpty, true) + assert.strictEqual(second.isEmpty, true) + }) + + it('promotes candidates through a configured adapter on normal completion', () => { + const registry = new JavaEntrypointFindingCollectorRegistry() + const promoted: Finding[] = [] + registry.configurePromoter({ isNewFinding: () => true, emit: (finding) => promoted.push(finding) }) + registry.get('normal').recordCandidate('candidate', { id: 'promoted' }) + registry.complete('normal') + assert.deepStrictEqual(promoted, [{ id: 'promoted' }]) + assert.strictEqual(registry.size, 0) + }) + + it('does not promote candidates after an execution exception', () => { + const registry = new JavaEntrypointFindingCollectorRegistry() + const promoted: Finding[] = [] + registry.configurePromoter({ isNewFinding: () => true, emit: (finding) => promoted.push(finding) }) + registry.get('exception').recordCandidate('candidate', { id: 'discarded' }) + registry.finalize('exception', 'exception') + assert.deepStrictEqual(promoted, []) + assert.strictEqual(registry.size, 0) + }) + + it('promotes after rerun success and aborts after final timeout', () => { + const registry = new JavaEntrypointFindingCollectorRegistry() + const promoted: Finding[] = [] + registry.configurePromoter({ isNewFinding: () => true, emit: (finding) => promoted.push(finding) }) + registry.get('rerun').recordCandidate('candidate', { id: 'rerun-success' }) + registry.complete('rerun') + assert.deepStrictEqual(promoted, [{ id: 'rerun-success' }]) + registry.get('timeout').recordCandidate('candidate', { id: 'timeout-discarded' }) + registry.finalize('timeout', 'timeout') + assert.strictEqual(registry.size, 0) + assert.deepStrictEqual(promoted, [{ id: 'rerun-success' }]) + }) + + + it('isolates a new production run and terminalizes same-key reruns only once', () => { + const registry = new JavaEntrypointFindingCollectorRegistry() + const promoted: Finding[] = [] + registry.configurePromoter({ isNewFinding: () => true, emit: (finding) => promoted.push(finding) }) + const collector = registry.get('same-key') + collector.recordCandidate('first', { id: 'first-run' }) + collector.deferForRerun() + collector.recordCandidate('second', { id: 'second-run' }) + registry.beginRun() + assert.strictEqual(registry.size, 0) + registry.get('same-key').recordCandidate('new-run', { id: 'new-run' }) + registry.complete('same-key') + assert.deepStrictEqual(promoted, [{ id: 'new-run' }]) + assert.strictEqual(registry.size, 0) + }) + + it('keeps caught exceptions and cross-entry timeout states from promoting', () => { + const registry = new JavaEntrypointFindingCollectorRegistry() + const promoted: Finding[] = [] + registry.configurePromoter({ isNewFinding: () => true, emit: (finding) => promoted.push(finding) }) + registry.get('java-exception').recordCandidate('candidate', { id: 'java-error' }) + registry.get('spring-timeout').recordCandidate('candidate', { id: 'spring-timeout' }) + registry.finalize('java-exception', 'exception') + registry.finalize('spring-timeout', 'timeout') + assert.deepStrictEqual(promoted, []) + assert.strictEqual(registry.size, 0) + }) + + it('promotes normal entry A while aborting timed-out entry B', () => { + const registry = new JavaEntrypointFindingCollectorRegistry() + const promoted: Finding[] = [] + registry.configurePromoter({ isNewFinding: () => true, emit: (finding) => promoted.push(finding) }) + registry.get('entry-A').recordCandidate('candidate', { id: 'A' }) + registry.get('entry-B').recordCandidate('candidate', { id: 'B' }) + registry.complete('entry-A') + registry.finalize('entry-B', 'timeout') + assert.deepStrictEqual(promoted, [{ id: 'A' }]) + assert.strictEqual(registry.size, 0) + }) + + + it('retains first-timeout candidates for rerun promotion, then aborts final timeout', () => { + const registry = new JavaEntrypointFindingCollectorRegistry() + const promoted: Finding[] = [] + registry.configurePromoter({ isNewFinding: () => true, emit: (finding) => promoted.push(finding) }) + const success = registry.get('rerun-success') + success.recordCandidate('candidate', { id: 'first-timeout' }) + success.deferForRerun() + assert.strictEqual(success.isEmpty, false) + registry.complete('rerun-success') + assert.deepStrictEqual(promoted, [{ id: 'first-timeout' }]) + const failure = registry.get('rerun-final-timeout') + failure.recordCandidate('candidate', { id: 'discarded' }) + failure.deferForRerun() + registry.finalize('rerun-final-timeout', 'timeout') + assert.deepStrictEqual(promoted, [{ id: 'first-timeout' }]) + assert.strictEqual(registry.size, 0) + }) + + + it('aggregates same-key reruns and terminalizes only at group end', () => { + const registry = new JavaEntrypointFindingCollectorRegistry() + const promoted: Finding[] = [] + registry.configurePromoter({ isNewFinding: () => true, emit: (finding) => promoted.push(finding) }) + const collector = registry.get('java-multi-rerun') + collector.recordCandidate('candidate', { id: 'candidate' }) + collector.deferForRerun() + assert.strictEqual(collector.isEmpty, false) + collector.deferForRerun() + assert.strictEqual(collector.isEmpty, false) + registry.complete('java-multi-rerun') + assert.deepStrictEqual(promoted, [{ id: 'candidate' }]) + }) + + + it('failure takes priority over same-key timeout and survives rerun group', () => { + const registry = new JavaEntrypointFindingCollectorRegistry() + const promoted: Finding[] = [] + registry.configurePromoter({ isNewFinding: () => true, emit: (finding) => promoted.push(finding) }) + const collector = registry.get('spring-failed-timeout') + collector.recordCandidate('candidate', { id: 'must-abort' }) + collector.deferForRerun() + registry.finalize('spring-failed-timeout', 'exception') + assert.deepStrictEqual(promoted, []) + assert.strictEqual(registry.size, 0) + }) + + it('clears state when the dedup callback throws', () => { + const collector = new JavaEntrypointFindingCollector() + collector.recordCandidate('candidate', { id: 'candidate' }) + assert.throws(() => collector.complete(() => { throw new Error('dedup failed') }, () => undefined), /dedup failed/) + assert.strictEqual(collector.isEmpty, true) + }) +}) diff --git a/test/java-finding-candidate.test.ts b/test/java-finding-candidate.test.ts new file mode 100644 index 00000000..697ed603 --- /dev/null +++ b/test/java-finding-candidate.test.ts @@ -0,0 +1,117 @@ +import assert from 'assert' +import { describe, it } from 'mocha' +import { buildJavaCandidateFinding, getJavaFindingSignature } from '../src/checker/taint/java/java-finding-candidate' +import { getCalleeEntry } from '../src/checker/taint/java/callee-entry' + +type Node = { loc: { sourcefile: string; start: { line: number }; end: { line: number } }; _meta: { nodehash: string }; id?: { name: string; loc?: Node['loc'] }; body?: { loc: Node['loc'] } } +const node = (file: string, line: number, hash: string, name = 'method'): Node => ({ + loc: { sourcefile: file, start: { line }, end: { line } }, + _meta: { nodehash: hash }, + id: { name }, +}) + +function finding() { + const sourceNode = node('Source.java', 3, 'source') + const outerNode = node('Controller.java', 10, 'outer', 'outer') + const innerNode = node('Service.java', 20, 'inner', 'inner') + const sinkNode = node('Sink.java', 30, 'sink') + return { + type: 'taint_flow_java_input', + traceRejectReason: 'ARG_PASS_ORDER_OUT_OF_CALLSTACK', + sinkAttribute: ['body'], + trace: [ + { file: 'Source.java', line: 3, tag: 'SOURCE: ', node: sourceNode }, + { file: 'Service.java', line: 21, tag: 'ARG PASS: ', node: innerNode }, + { file: 'Controller.java', line: 11, tag: 'ARG PASS: ', node: outerNode }, + { file: 'Sink.java', line: 30, tag: 'SINK: ', node: sinkNode }, + ], + callstack: [ + { vtype: 'fclos', ast: { node: outerNode } }, + { vtype: 'fclos', ast: { node: innerNode } }, + ], + callsites: [ + { nodeHash: 'outer-call', loc: { sourcefile: 'Entry.java', start: { line: 5 }, end: { line: 5 } } }, + { nodeHash: 'inner-call', loc: { sourcefile: 'Controller.java', start: { line: 11 }, end: { line: 11 } } }, + ], + } +} + +describe('Java finding candidate reconstruction', () => { + it('rebuilds a concise source-call-arg-sink trace without accepting the rejected trace', () => { + const original = finding() + const candidate = buildJavaCandidateFinding(original) + assert.ok(candidate) + assert.deepStrictEqual(candidate?.trace?.map((step) => step.tag), ['SOURCE: ', 'CALL: ', 'ARG PASS: ', 'SINK: ']) + assert.strictEqual(candidate?.callstack?.length, 2) + assert.strictEqual(candidate?.callsites?.length, 2) + assert.deepStrictEqual(original.trace?.map((step) => step.tag), ['SOURCE: ', 'ARG PASS: ', 'ARG PASS: ', 'SINK: ']) + assert.strictEqual(getJavaFindingSignature(candidate), getJavaFindingSignature({ ...original, trace: candidate?.trace })) + }) + + + it('places candidate ARG PASS on the callee method entry instead of annotation range', () => { + const original = finding() + const innerNode = original.callstack[1].ast.node + innerNode.loc = { sourcefile: 'Service.java', start: { line: 18 }, end: { line: 28 } } + innerNode.id = { name: 'queryAisTaskStatus', loc: { sourcefile: 'Service.java', start: { line: 22 }, end: { line: 22 } } } + const candidate = buildJavaCandidateFinding(original) + const argPass = candidate?.trace?.find((step) => step.tag === 'ARG PASS: ') + assert.strictEqual(argPass?.line, 22) + assert.strictEqual(argPass?.node?.loc?.start?.line, 22) + assert.strictEqual(argPass?.node?._meta?.nodehash, 'inner') + assert.strictEqual(argPass?.affectedNodeName, 'queryAisTaskStatus') + }) + + it('skips an AST-less library frame while preserving edgePairs plus one method', () => { + const original = finding() + const libraryFrame = { vtype: 'fclos' } + original.callstack = [original.callstack[0], libraryFrame, original.callstack[1]] + original.callsites = [ + original.callsites[0], + { nodeHash: 'library-call', loc: { sourcefile: 'Library.java', start: { line: 50 }, end: { line: 50 } } }, + original.callsites[1], + ] + const candidate = buildJavaCandidateFinding(original) + assert.ok(candidate) + const trace = candidate?.trace ?? [] + const edgePairs = trace.filter((step) => step.tag === 'CALL: ').length + assert.strictEqual(candidate?.callstack?.length, edgePairs + 1) + assert.strictEqual(trace[0]?.tag, 'SOURCE: ') + assert.strictEqual(trace[trace.length - 1]?.tag, 'SINK: ') + }) + + + it('keeps same-line distinct node hashes distinct in signatures', () => { + const first = finding() + const second = finding() + second.trace[0].node._meta.nodehash = 'different-source' + assert.notStrictEqual(getJavaFindingSignature(first), getJavaFindingSignature(second)) + }) + + it('uses callee entry location priority, single-line loc, frame hash, and cleaned name', () => { + const frame = { + vtype: 'fclos', + fname: '.queryAisTaskStatus', + ast: { node: { ...node('Controller.java', 10, 'frame'), id: { name: '.queryAisTaskStatus', loc: { sourcefile: 'Controller.java', start: { line: 12 }, end: { line: 12 } } }, body: { loc: { sourcefile: 'Controller.java', start: { line: 13 }, end: { line: 20 } } } } }, + } + const entry = getCalleeEntry(frame) + assert.ok(entry) + assert.strictEqual(entry?.line, 12) + assert.deepStrictEqual(entry?.loc.start, { line: 12, column: 0 }) + assert.deepStrictEqual(entry?.loc.end, { line: 12, column: 0 }) + assert.strictEqual(entry?.node._meta?.nodehash, 'frame') + assert.strictEqual(entry?.name, 'queryAisTaskStatus') + + const fallbackFrame = { vtype: 'fclos', ast: { node: { ...node('Controller.java', 10, 'fallback'), body: { loc: { sourcefile: 'Controller.java', start: { line: 14 }, end: { line: 18 } } } } } } + assert.strictEqual(getCalleeEntry(fallbackFrame)?.line, 14) + const frameLoc = { vtype: 'fclos', ast: { node: node('Controller.java', 16, 'frame-only') } } + assert.strictEqual(getCalleeEntry(frameLoc)?.line, 16) + }) + + it('rejects incomplete structure and non-Java findings', () => { + const malformed = finding() + malformed.callsites = malformed.callsites.slice(0, 1) + assert.strictEqual(buildJavaCandidateFinding(malformed), undefined) + assert.strictEqual(getJavaFindingSignature({ ...finding(), type: 'taint_flow_go_input' }), undefined) + }) +}) diff --git a/test/java/expect/sast-java-expect.result b/test/java/expect/sast-java-expect.result index 9e182019..9fcb153d 100644 --- a/test/java/expect/sast-java-expect.result +++ b/test/java/expect/sast-java-expect.result @@ -3262,6 +3262,37 @@ Trace: ------------- 155: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/service/SSRFShowManageImpl.java +Line 36: httpclient.execute(httpget) +SINK RULE:execute +SINK Attribute:JavaSSRF +entrypoint: +{"filePath":"/src/main/java/com/sast/astbenchmark/case_language_maturity/completeness/single_app_tracing/expression/this_expression/Expression_ThisExpression_Anonymous_001_T.java","functionName":"aTaintCase0131","attribute":"HTTP","type":"functionCall"} +Trace: + /src/main/java/com/sast/astbenchmark/case_language_maturity/completeness/single_app_tracing/expression/this_expression/Expression_ThisExpression_Anonymous_001_T.java + AffectedNodeName: url + 27: SOURCE: public Map aTaintCase0131(@PathVariable String url) { + /src/main/java/com/sast/astbenchmark/case_language_maturity/completeness/single_app_tracing/expression/this_expression/Expression_ThisExpression_Anonymous_001_T.java + AffectedNodeName: anonymousFacade + 31: CALL: this.ssrfShowManager.anonymousFacade(url); + /src/main/java/com/sast/astbenchmark/service/SSRFShowManageImpl.java + AffectedNodeName: url + 28: ARG PASS: public void anonymousFacade(String url) { + /src/main/java/com/sast/astbenchmark/service/SSRFShowManageImpl.java + AffectedNodeName: doConnect + 29: CALL: super.doConnect(url, new SsrfClient() { + /src/main/java/com/sast/astbenchmark/service/SSRFShowManageImpl.java + AffectedNodeName: url + 31: ARG PASS: protected void doConnect(String url) { + /src/main/java/com/sast/astbenchmark/service/SSRFShowManageImpl.java + AffectedNodeName: httpget + 33: Var Pass: HttpGet httpget = new HttpGet(url); + /src/main/java/com/sast/astbenchmark/service/SSRFShowManageImpl.java + AffectedNodeName: httpclient.execute + 36: SINK: response = (httpclient).execute(httpget); + +------------- 156: taint_flow_java_input_inner------------- +Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 +File:/src/main/java/com/sast/astbenchmark/service/SSRFShowManageImpl.java Line 72: httpclient.execute(httpget) SINK RULE:execute SINK Attribute:JavaSSRF @@ -3290,7 +3321,7 @@ Trace: AffectedNodeName: httpclient.execute 72: SINK: response = httpclient.execute(httpget); -------------- 156: taint_flow_java_input_inner------------- +------------- 157: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/completeness/single_app_tracing/expression/type_cast/Expression_CastExpression_001_T.java Line 28: Runtime.getRuntime().exec((String)cmdObject) @@ -3309,7 +3340,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 28: SINK: Runtime.getRuntime().exec((String) cmdObject); -------------- 157: taint_flow_java_input_inner------------- +------------- 158: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/completeness/single_app_tracing/expression/type_cast/Expression_CastExpression_003_T.java Line 30: realUrl.openConnection() @@ -3328,7 +3359,7 @@ Trace: AffectedNodeName: realUrl.openConnection 30: SINK: HttpURLConnection connection = (HttpURLConnection) realUrl.openConnection(); -------------- 158: taint_flow_java_input_inner------------- +------------- 159: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/common/utils/HttpUtil.java Line 44: httpclient.execute(httpGet) @@ -3365,7 +3396,7 @@ Trace: AffectedNodeName: httpclient.execute 44: SINK: response = httpclient.execute(httpGet); -------------- 159: taint_flow_java_input_inner------------- +------------- 160: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/common/utils/CmdUtil.java Line 7: Runtime.getRuntime().exec(cmd) @@ -3387,7 +3418,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 7: SINK: Runtime.getRuntime().exec(cmd); -------------- 160: taint_flow_java_input_inner------------- +------------- 161: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/common/utils/CmdUtil.java Line 7: Runtime.getRuntime().exec(cmd) @@ -3409,7 +3440,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 7: SINK: Runtime.getRuntime().exec(cmd); -------------- 161: taint_flow_java_input_inner------------- +------------- 162: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/completeness/single_app_tracing/function_call/chained_call/Expression_MethodInvocation_Argument_002_T.java Line 27: HttpRequest.post(http://localhost:39100/ataint/case00124/2?cmd=+cmd) @@ -3425,7 +3456,7 @@ Trace: AffectedNodeName: HttpRequest.post 27: SINK: HttpRequest.post("http://localhost:39100/ataint/case00124/2?cmd=" + cmd) -------------- 162: taint_flow_java_input_inner------------- +------------- 163: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_001_T.java Line 33: Runtime.getRuntime().exec(o) @@ -3453,7 +3484,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 33: SINK: Runtime.getRuntime().exec(o); -------------- 163: taint_flow_java_input_inner------------- +------------- 164: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/completeness/single_app_tracing/function_call/library_function/CallExpression_NoSourceCode_Native_002_T.java Line 28: Runtime.getRuntime().exec(exec) @@ -3472,7 +3503,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 28: SINK: Runtime.getRuntime().exec(exec); -------------- 164: taint_flow_java_input_inner------------- +------------- 165: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/completeness/single_app_tracing/function_call/library_function/CallExpression_NoSourceCode_Native_004_T.java Line 26: Runtime.getRuntime().exec(new String(cmd)) @@ -3488,7 +3519,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 26: SINK: Runtime.getRuntime().exec(new String(cmd)); -------------- 165: taint_flow_java_input_inner------------- +------------- 166: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/completeness/single_app_tracing/function_call/library_function/CallExpression_NoSourceCode_Native_006_T.java Line 27: Runtime.getRuntime().exec(cmd) @@ -3507,7 +3538,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 27: SINK: Runtime.getRuntime().exec(cmd); -------------- 166: taint_flow_java_input_inner------------- +------------- 167: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/completeness/single_app_tracing/function_call/library_function/Expression_CallExpression_Array_002_T.java Line 27: Runtime.getRuntime().exec(String.valueOf(chars)) @@ -3526,7 +3557,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 27: SINK: Runtime.getRuntime().exec(String.valueOf(chars)); -------------- 167: taint_flow_java_input_inner------------- +------------- 168: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/completeness/single_app_tracing/function_call/library_function/Expression_MethodInvocation_MethodInvocation_002_T.java Line 27: Runtime.getRuntime().exec(builder.toString()) @@ -3545,7 +3576,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 27: SINK: Runtime.getRuntime().exec(builder.toString()); -------------- 168: taint_flow_java_input_inner------------- +------------- 169: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/completeness/single_app_tracing/function_call/override/Expression_Override_001_T.java Line 27: Runtime.getRuntime().exec(ps.getCmd()) @@ -3570,7 +3601,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 27: SINK: Runtime.getRuntime().exec(ps.getCmd()); -------------- 169: taint_flow_java_input_inner------------- +------------- 170: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/completeness/single_app_tracing/function_call/return_value_passing/function_return_value_passing_001_T.java Line 31: Runtime.getRuntime().exec(o) @@ -3601,7 +3632,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 31: SINK: Runtime.getRuntime().exec(o); -------------- 170: taint_flow_java_input_inner------------- +------------- 171: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/completeness/single_app_tracing/function_call/return_value_passing/function_return_value_passing_002_F.java Line 31: Runtime.getRuntime().exec(o) @@ -3629,7 +3660,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 31: SINK: Runtime.getRuntime().exec(o); -------------- 171: taint_flow_java_input_inner------------- +------------- 172: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/completeness/single_app_tracing/function_call/static_method/static_field_001_T.java Line 30: Runtime.getRuntime().exec(MyClass.data) @@ -3654,7 +3685,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 30: SINK: Runtime.getRuntime().exec(MyClass.data); -------------- 172: taint_flow_java_input_inner------------- +------------- 173: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/completeness/single_app_tracing/function_call/static_method/static_method_001_T.java Line 20: Runtime.getRuntime().exec(arg) @@ -3682,7 +3713,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 20: SINK: Runtime.getRuntime().exec(arg); -------------- 173: taint_flow_java_input_inner------------- +------------- 174: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/object_field_sensitive/field_sensitive_one_collection/numeric_index_state_no_solver/ArrayOutOfBoundOrNot_001_T.java Line 27: Runtime.getRuntime().exec(arr) @@ -3701,7 +3732,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 27: SINK: Runtime.getRuntime().exec(arr); -------------- 174: taint_flow_java_input_inner------------- +------------- 175: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/object_field_sensitive/field_sensitive_one_collection/numeric_index_state_no_solver/Array_index_001_T.java Line 26: Runtime.getRuntime().exec(arr.0) @@ -3720,7 +3751,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 26: SINK: Runtime.getRuntime().exec(arr[0]); -------------- 175: taint_flow_java_input_inner------------- +------------- 176: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/object_field_sensitive/field_sensitive_one_collection/numeric_index_state_no_solver/MapField_001_T.java Line 28: Runtime.getRuntime().exec(map.get(key1)) @@ -3739,7 +3770,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 28: SINK: Runtime.getRuntime().exec(map.get("key1")); -------------- 176: taint_flow_java_input_inner------------- +------------- 177: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/object_field_sensitive/field_sensitive_one_collection/numeric_index_state_no_solver/MapField_003_T.java Line 29: SinkUtil.sink(map.values()) @@ -3758,7 +3789,7 @@ Trace: AffectedNodeName: SinkUtil.sink 29: SINK: SinkUtil.sink(map.values()); -------------- 177: taint_flow_java_input_inner------------- +------------- 178: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/object_field_sensitive/field_sensitive_one_collection/numeric_index_state_no_solver/MapField_005_T.java Line 29: SinkUtil.sink(map.keySet()) @@ -3777,7 +3808,7 @@ Trace: AffectedNodeName: SinkUtil.sink 29: SINK: SinkUtil.sink(map.keySet()); -------------- 178: taint_flow_java_input_inner------------- +------------- 179: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/object_field_sensitive/field_sensitive_one_collection/numeric_index_state_no_solver/MapField_007_T.java Line 29: SinkUtil.sink(map.entrySet()) @@ -3796,7 +3827,7 @@ Trace: AffectedNodeName: SinkUtil.sink 29: SINK: SinkUtil.sink(map.entrySet()); -------------- 179: taint_flow_java_input_inner------------- +------------- 180: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/common/utils/HttpUtil.java Line 44: httpclient.execute(httpGet) @@ -3836,7 +3867,7 @@ Trace: AffectedNodeName: httpclient.execute 44: SINK: response = httpclient.execute(httpGet); -------------- 180: taint_flow_java_input_inner------------- +------------- 181: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/object_field_sensitive/field_sensitive_one_collection/numeric_index_state_no_solver/QueueWithLambda_001_T.java Line 36: Runtime.getRuntime().exec(e) @@ -3861,7 +3892,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 36: SINK: Runtime.getRuntime().exec(e); -------------- 181: taint_flow_java_input_inner------------- +------------- 182: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/multi_invoke/multi_invoke_need_solve/DifferentParamsForFunction_need_solve_001_T.java Line 32: Runtime.getRuntime().exec(exec2) @@ -3873,12 +3904,6 @@ Trace: /src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/multi_invoke/multi_invoke_need_solve/DifferentParamsForFunction_need_solve_001_T.java AffectedNodeName: cmd 24: SOURCE: public Map testcase(@RequestParam String cmd) { - /src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/multi_invoke/multi_invoke_need_solve/DifferentParamsForFunction_need_solve_001_T.java - AffectedNodeName: getCmdWithContextSensitive - 28: CALL: exec1 = CmdUtil.getCmdWithContextSensitive(i, cmd); - /src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/multi_invoke/multi_invoke_need_solve/DifferentParamsForFunction_need_solve_001_T.java - AffectedNodeName: exec1 - 28: Var Pass: exec1 = CmdUtil.getCmdWithContextSensitive(i, cmd); /src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/multi_invoke/multi_invoke_need_solve/DifferentParamsForFunction_need_solve_001_T.java AffectedNodeName: getCmdWithContextSensitive 30: CALL: exec2 = CmdUtil.getCmdWithContextSensitive(i, cmd); @@ -3892,7 +3917,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 32: SINK: Runtime.getRuntime().exec(exec2); -------------- 182: taint_flow_java_input_inner------------- +------------- 183: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/multi_invoke/multi_invoke_need_solve/DifferentParamsForFunction_need_solve_002_F.java Line 33: Runtime.getRuntime().exec(exec2) @@ -3907,6 +3932,9 @@ Trace: /src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/multi_invoke/multi_invoke_need_solve/DifferentParamsForFunction_need_solve_002_F.java AffectedNodeName: getCmdWithContextSensitive 31: CALL: exec2 = CmdUtil.getCmdWithContextSensitive(i, cmd); + /src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/multi_invoke/multi_invoke_need_solve/DifferentParamsForFunction_need_solve_002_F.java + AffectedNodeName: getCmdWithContextSensitive + 31: CALL RETURN: exec2 = CmdUtil.getCmdWithContextSensitive(i, cmd); /src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/multi_invoke/multi_invoke_need_solve/DifferentParamsForFunction_need_solve_002_F.java AffectedNodeName: exec2 31: Var Pass: exec2 = CmdUtil.getCmdWithContextSensitive(i, cmd); @@ -3914,7 +3942,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 33: SINK: Runtime.getRuntime().exec(exec2); -------------- 183: taint_flow_java_input_inner------------- +------------- 184: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/multi_invoke/multi_invoke_without_solve/DifferentParamsForFunction_001_T.java Line 36: Runtime.getRuntime().exec(rx1.y.f) @@ -3942,7 +3970,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 36: SINK: Runtime.getRuntime().exec(rx1.y.f); -------------- 184: taint_flow_java_input_inner------------- +------------- 185: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/multi_invoke/multi_invoke_without_solve/DifferentParamsForFunction_003_T.java Line 29: Runtime.getRuntime().exec(c1) @@ -3967,7 +3995,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 29: SINK: Runtime.getRuntime().exec(c1); -------------- 185: taint_flow_java_input_inner------------- +------------- 186: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/context_sensitive/multi_invoke/multi_invoke_without_solve/MultiCallSite_001_T.java Line 28: Runtime.getRuntime().exec(c2) @@ -3995,7 +4023,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 28: SINK: Runtime.getRuntime().exec(c2); -------------- 186: taint_flow_java_input_inner------------- +------------- 187: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/flow_sensitive/loop_stmt/loop_stmt_init/Statement_ForStatement_init_001_T.java Line 28: Runtime.getRuntime().exec(a) @@ -4014,7 +4042,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 28: SINK: Runtime.getRuntime().exec(a); -------------- 187: taint_flow_java_input_inner------------- +------------- 188: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/flow_sensitive/loop_stmt/loop_stmt_update/Statement_ForStatement_update_001_T.java Line 26: Runtime.getRuntime().exec(a) @@ -4033,7 +4061,26 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 26: SINK: for (int i = 0; i < 1; Runtime.getRuntime().exec(a)) { -------------- 188: taint_flow_java_input_inner------------- +------------- 189: taint_flow_java_input_inner------------- +Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 +File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/flow_sensitive/loop_stmt/loop_stmt_update/Statement_ForStatement_update_002_F.java +Line 27: Runtime.getRuntime().exec(a) +SINK RULE:Runtime.getRuntime().exec +SINK Attribute:JavaCommandExec +entrypoint: +{"filePath":"/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/flow_sensitive/loop_stmt/loop_stmt_update/Statement_ForStatement_update_002_F.java","functionName":"testcase","attribute":"HTTP","type":"functionCall"} +Trace: + /src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/flow_sensitive/loop_stmt/loop_stmt_update/Statement_ForStatement_update_002_F.java + AffectedNodeName: cmd + 22: SOURCE: public Map testcase(@PathVariable String cmd) { + /src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/flow_sensitive/loop_stmt/loop_stmt_update/Statement_ForStatement_update_002_F.java + AffectedNodeName: a + 26: Var Pass: for (int i = 0; i < 1; a = cmd + "|") { + /src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/flow_sensitive/loop_stmt/loop_stmt_update/Statement_ForStatement_update_002_F.java + AffectedNodeName: Runtime.getRuntime().exec + 27: SINK: Runtime.getRuntime().exec(a); + +------------- 190: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/no_solver/ConstantIfGuard_001_T.java Line 27: Runtime.getRuntime().exec(exec) @@ -4048,9 +4095,6 @@ Trace: /src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/no_solver/ConstantIfGuard_001_T.java AffectedNodeName: getCmdWithPathSensitive 25: CALL: String exec = getCmdWithPathSensitive(cmd); - /src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/no_solver/ConstantIfGuard_001_T.java - AffectedNodeName: getCmdWithPathSensitive - 25: CALL RETURN: String exec = getCmdWithPathSensitive(cmd); /src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/no_solver/ConstantIfGuard_001_T.java AffectedNodeName: exec 25: Var Pass: String exec = getCmdWithPathSensitive(cmd); @@ -4058,7 +4102,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 27: SINK: Runtime.getRuntime().exec(exec); -------------- 189: taint_flow_java_input_inner------------- +------------- 191: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/no_solver/ConstantIfGuard_002_F.java Line 27: Runtime.getRuntime().exec(exec) @@ -4080,7 +4124,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 27: SINK: Runtime.getRuntime().exec(exec); -------------- 190: taint_flow_java_input_inner------------- +------------- 192: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/no_solver/Statement_ForStatement_no_solver_001_T.java Line 29: Runtime.getRuntime().exec(a) @@ -4099,7 +4143,26 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 29: SINK: Runtime.getRuntime().exec(a); -------------- 191: taint_flow_java_input_inner------------- +------------- 193: taint_flow_java_input_inner------------- +Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 +File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/no_solver/Statement_ForStatement_no_solver_002_F.java +Line 29: Runtime.getRuntime().exec(a) +SINK RULE:Runtime.getRuntime().exec +SINK Attribute:JavaCommandExec +entrypoint: +{"filePath":"/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/no_solver/Statement_ForStatement_no_solver_002_F.java","functionName":"testcase","attribute":"HTTP","type":"functionCall"} +Trace: + /src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/no_solver/Statement_ForStatement_no_solver_002_F.java + AffectedNodeName: cmd + 22: SOURCE: public Map testcase(@PathVariable String cmd) { + /src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/no_solver/Statement_ForStatement_no_solver_002_F.java + AffectedNodeName: a + 27: Var Pass: a = cmd + "|"; + /src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/no_solver/Statement_ForStatement_no_solver_002_F.java + AffectedNodeName: Runtime.getRuntime().exec + 29: SINK: Runtime.getRuntime().exec(a); + +------------- 194: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/solver/DifferentIfBranch_ArrayLength_001_T.java Line 29: Runtime.getRuntime().exec(arr) @@ -4118,7 +4181,26 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 29: SINK: Runtime.getRuntime().exec(arr); -------------- 192: taint_flow_java_input_inner------------- +------------- 195: taint_flow_java_input_inner------------- +Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 +File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/solver/DifferentIfBranch_ArrayLength_002_F.java +Line 29: Runtime.getRuntime().exec(arr) +SINK RULE:Runtime.getRuntime().exec +SINK Attribute:JavaCommandExec +entrypoint: +{"filePath":"/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/solver/DifferentIfBranch_ArrayLength_002_F.java","functionName":"testcase","attribute":"HTTP","type":"functionCall"} +Trace: + /src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/solver/DifferentIfBranch_ArrayLength_002_F.java + AffectedNodeName: cmd + 22: SOURCE: public Map testcase(@RequestParam String cmd) { + /src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/solver/DifferentIfBranch_ArrayLength_002_F.java + AffectedNodeName: arr[1] + 27: Var Pass: arr[1] = cmd; // UnReachable + /src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/solver/DifferentIfBranch_ArrayLength_002_F.java + AffectedNodeName: Runtime.getRuntime().exec + 29: SINK: Runtime.getRuntime().exec(arr); + +------------- 196: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/solver/DifferentIfBranch_ArrayLength_003_T.java Line 30: Runtime.getRuntime().exec(arr2) @@ -4137,7 +4219,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 30: SINK: Runtime.getRuntime().exec(arr2); -------------- 193: taint_flow_java_input_inner------------- +------------- 197: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/solver/Expression_InstanceofExpression_solver_001_T.java Line 26: Runtime.getRuntime().exec(cmd) @@ -4153,7 +4235,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 26: SINK: Runtime.getRuntime().exec(cmd); -------------- 194: taint_flow_java_input_inner------------- +------------- 198: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/solver/Expression_InstanceofExpression_solver_003_T.java Line 28: Runtime.getRuntime().exec(cmd) @@ -4169,7 +4251,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 28: SINK: Runtime.getRuntime().exec(cmd); -------------- 195: taint_flow_java_input_inner------------- +------------- 199: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/solver/Statement_AssertStatement_solver_001_T.java Line 26: Runtime.getRuntime().exec(cmd) @@ -4185,7 +4267,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 26: SINK: assert a > 0 : Runtime.getRuntime().exec(cmd); -------------- 196: taint_flow_java_input_inner------------- +------------- 200: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/solver/Statement_AssertStatement_solver_003_T.java Line 26: Runtime.getRuntime().exec(cmd) @@ -4201,7 +4283,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 26: SINK: assert a > 0 : Runtime.getRuntime().exec(cmd); -------------- 197: taint_flow_java_input_inner------------- +------------- 201: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/solver/Statement_WhileStatement_solver_001_T.java Line 29: Runtime.getRuntime().exec(a) @@ -4220,7 +4302,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 29: SINK: Runtime.getRuntime().exec(a); -------------- 198: taint_flow_java_input_inner------------- +------------- 202: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/accuracy/path_sensitive/loop_conditional_stmt/solver/Statement_WhileStatement_solver_002_F.java Line 31: Runtime.getRuntime().exec(a) @@ -4239,7 +4321,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 31: SINK: Runtime.getRuntime().exec(a); -------------- 199: taint_flow_java_input_inner------------- +------------- 203: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/completeness/single_app_tracing/cross_file_package_namespace/cross_file/cross_file_001_T/cross_file_001_T_b.java Line 23: Runtime.getRuntime().exec(cmd) @@ -4261,7 +4343,7 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 23: SINK: Runtime.getRuntime().exec(cmd); -------------- 200: taint_flow_java_input_inner------------- +------------- 204: taint_flow_java_input_inner------------- Description:Java污点分析checker，不会使用CallGraph边界制作entrypoint，蚂蚁内部使用 File:/src/main/java/com/sast/astbenchmark/case_language_maturity/completeness/single_app_tracing/cross_file_package_namespace/cross_directory/cross_directory_001_T/B/cross_directory_001_T_b.java Line 23: Runtime.getRuntime().exec(cmd) @@ -4283,5 +4365,5 @@ Trace: AffectedNodeName: Runtime.getRuntime().exec 23: SINK: Runtime.getRuntime().exec(cmd); ========================================================== - #Total-findings:200 + #Total-findings:204 ========================================================== \ No newline at end of file diff --git a/test/java/java-custom-entrypoint-matches.test.ts b/test/java/java-custom-entrypoint-matches.test.ts new file mode 100644 index 00000000..acbe77fd --- /dev/null +++ b/test/java/java-custom-entrypoint-matches.test.ts @@ -0,0 +1,142 @@ +import * as assert from 'assert' +import * as fs from 'fs' +import * as os from 'os' +import * as path from 'path' +import { describe, it } from 'mocha' + +const JavaAnalyzer = require('../../src/engine/analyzer/java/common/java-analyzer') +const Config = require('../../src/config') + +const JavaChecker = require('../../src/checker/taint/java/java-taint-abstract-checker') as { + prototype: { + resolveAllMatchingEntryPoints: (entrypoint: Record, analyzer: unknown, functionName: string) => unknown[] + matchEntrypointFunction: (node: Record, entrypoint: Record) => boolean + resolveAndPushEntryPoint: (...args: unknown[]) => void + } +} + +type JavaClass = { + logicalQid: string + ast: { node: { loc: { sourcefile: string } } } + members: Map +} + +const functionClosure = (line: number): Record => ({ + vtype: 'fclos', + ast: { node: { id: { name: 'handle' }, loc: { start: { line }, end: { line: line + 2 } } } }, +}) + +describe('Java custom entrypoint matching', () => { + it('expands nested callback methods from a parser-backed Java analyzer', async () => { + const root = fs.mkdtempSync(path.join(os.tmpdir(), 'yasa-java-entrypoint-')) + const sourcePath = path.join(root, 'demo', 'MedicalTradeQueryProcessor.java') + fs.mkdirSync(path.dirname(sourcePath), { recursive: true }) + fs.writeFileSync(sourcePath, `package demo; +public class MedicalTradeQueryProcessor { + public void doProcess(String request) { + Runnable callback = new Runnable() { + public void doProcess(String value) { + System.out.println(value); + } + }; + } +} +`) + Config.maindirPrefix = root + const analyzer = new JavaAnalyzer({ + language: 'java', + sourcePath: root, + uastSDKPath: path.resolve(__dirname, '../../deps'), + checkerIds: [], + checkerPackIds: [], + printers: [], + }) + await analyzer.preProcess(root) + const owner = analyzer.symbolTable.get(analyzer.classMap.get('demo.MedicalTradeQueryProcessor')) + const outerMethod = owner.members.get('doProcess') + const checker = Object.create(JavaChecker.prototype) as typeof JavaChecker.prototype + const matched = checker.resolveAllMatchingEntryPoints( + { filePath: '/demo/MedicalTradeQueryProcessor.java', packageName: 'demo.MedicalTradeQueryProcessor' }, + analyzer, + 'doProcess' + ) + const locations = matched.map((candidate) => candidate.ast.node.loc) + assert.strictEqual(analyzer.classMap.has('demo.MedicalTradeQueryProcessor'), true) + assert.strictEqual(matched.length, 2) + assert.deepStrictEqual(locations.map((loc) => loc.start.line), [3, 5]) + assert.deepStrictEqual(locations.map((loc) => loc.end.line), [9, 7]) + assert.strictEqual(matched[0], outerMethod) + assert.notStrictEqual(matched[1].parent, matched[0].parent) + assert.strictEqual(matched[1].parent?.logicalQid?.includes(''), true) + assert.strictEqual(typeof (matched[1].parent?.ast as { hasDecl?: unknown })?.hasDecl, 'function') + assert.strictEqual(Array.isArray(matched[1].overloaded), false) + assert.strictEqual(matched[1].overloaded?.length, 1) + + const checkerWithEntries = Object.create(JavaChecker.prototype) as typeof JavaChecker.prototype & { entryPoints: unknown[]; normalizeAstSourceFilePath: (value: string) => string | null } + checkerWithEntries.entryPoints = [] + checkerWithEntries.normalizeAstSourceFilePath = (value: string): string | null => value ? value.replace(root, '') : null + const EntryPoint = class { entryPointSymVal: unknown; constructor(_type: unknown) {} } as unknown as new (type: unknown) => Record + checkerWithEntries.resolveAndPushEntryPoint(outerMethod, { filePath: '/demo/MedicalTradeQueryProcessor.java', packageName: 'demo.MedicalTradeQueryProcessor', functionName: 'doProcess' }, 'doProcess', analyzer, class {}, EntryPoint, { ENGIN_START_FUNCALL: 'start' }) + assert.strictEqual(checkerWithEntries.entryPoints.length, 2) + assert.notStrictEqual((checkerWithEntries.entryPoints[0] as { entryPointSymVal: unknown }).entryPointSymVal, (checkerWithEntries.entryPoints[1] as { entryPointSymVal: unknown }).entryPointSymVal) + }) + + it('does not fall back when filePath does not match', () => { + const outer = { logicalQid: 'demo.Service', ast: { node: { loc: { sourcefile: '/workspace/src/demo/Service.java' } } }, members: new Map([['handle', functionClosure(10)]]) } + const analyzer = { classMap: new Map([['demo.Service', 'outer']]), symbolTable: new Map([['outer', outer]]) } + const checker = Object.create(JavaChecker.prototype) as typeof JavaChecker.prototype + checker.normalizeAstSourceFilePath = (value: string): string | null => value.replace('/workspace', '') + assert.strictEqual(checker.resolveAllMatchingEntryPoints({ filePath: '/src/Other.java', packageName: 'demo.Service' }, analyzer, 'handle').length, 0) + }) + + it('expands one file/package rule to outer and anonymous owners', () => { + const outer = { logicalQid: 'demo.Service', ast: { node: { loc: { sourcefile: '/workspace/src/demo/Service.java' } } }, members: new Map([['handle', functionClosure(10)]]) } + const anonymous = { logicalQid: 'demo.Service$1', ast: { node: { loc: { sourcefile: '/workspace/src/demo/Service.java' } } }, members: new Map([['handle', functionClosure(30)]]) } + const analyzer = { classMap: new Map([['demo.Service', 'outer'], ['demo.Service$1', 'anonymous']]), symbolTable: new Map([['outer', outer], ['anonymous', anonymous]]) } + const checker = Object.create(JavaChecker.prototype) as typeof JavaChecker.prototype + checker.normalizeAstSourceFilePath = (path: string): string | null => path.replace('/workspace', '') + const matched = checker.resolveAllMatchingEntryPoints({ filePath: '/src/demo/Service.java', packageName: 'demo.Service' }, analyzer, 'handle') + assert.strictEqual(matched.length, 2) + assert.deepStrictEqual(matched.map((candidate) => (candidate as Record).ast).length, 2) + }) + + it('normalizes a leading dot in the configured package name', () => { + const outer = { logicalQid: 'demo.Service', ast: { node: { loc: { sourcefile: '/workspace/src/demo/Service.java' } } }, members: new Map([['handle', functionClosure(10)]]) } + const analyzer = { classMap: new Map([['demo.Service', 'outer']]), symbolTable: new Map([['outer', outer]]) } + const checker = Object.create(JavaChecker.prototype) as typeof JavaChecker.prototype + checker.normalizeAstSourceFilePath = (sourcePath: string): string | null => sourcePath.replace('/workspace', '') + + const matched = checker.resolveAllMatchingEntryPoints( + { filePath: '/src/demo/Service.java', packageName: '.demo.Service' }, + analyzer, + 'handle' + ) + + assert.strictEqual(matched.length, 1) + assert.strictEqual(matched[0], outer.members.get('handle')) + }) + + it('pushes two independent entrypoints for the outer and anonymous owners', () => { + const outer = { logicalQid: 'demo.Service', ast: { node: { loc: { sourcefile: '/workspace/src/demo/Service.java' } } }, members: new Map([['handle', functionClosure(10)]]) } + const anonymous = { logicalQid: 'demo.Service$1', ast: { node: { loc: { sourcefile: '/workspace/src/demo/Service.java' } } }, members: new Map([['handle', functionClosure(30)]]) } + const analyzer = { classMap: new Map([['demo.Service', 'outer'], ['demo.Service$1', 'anonymous']]), symbolTable: new Map([['outer', outer], ['anonymous', anonymous]]) } + const checker = Object.create(JavaChecker.prototype) as typeof JavaChecker.prototype & { entryPoints: unknown[]; normalizeAstSourceFilePath: (path: string) => string } + checker.entryPoints = [] + checker.normalizeAstSourceFilePath = (path: string): string => path.replace('/workspace', '') + const entrypoint = { filePath: '/src/demo/Service.java', packageName: 'demo.Service', functionName: 'handle' } + const EntryPoint = class { entryPointSymVal: unknown; constructor(_type: unknown) {} } as unknown as new (type: unknown) => Record + checker.resolveAndPushEntryPoint(outer.members.get('handle'), entrypoint, 'handle', analyzer, class {}, EntryPoint, { ENGIN_START_FUNCALL: 'start' }) + assert.strictEqual(checker.entryPoints.length, 2) + assert.notStrictEqual((checker.entryPoints[0] as { entryPointSymVal: unknown }).entryPointSymVal, (checker.entryPoints[1] as { entryPointSymVal: unknown }).entryPointSymVal) + }) + + it('uses funcLoc, paramTypes, and signature as mutually exclusive selectors', () => { + const checker = Object.create(JavaChecker.prototype) as typeof JavaChecker.prototype + const node = { id: { name: 'handle' }, loc: { start: { line: 10 }, end: { line: 12 } }, parameters: [{ varType: { id: { name: 'String' } } }] } + assert.strictEqual(checker.matchEntrypointFunction(node, { funcLocStart: 10, funcLocEnd: 12, paramTypes: ['Other'], signature: 'handle(Other)' }), true) + assert.strictEqual(checker.matchEntrypointFunction(node, { paramTypes: ['String'], signature: 'handle(Other)' }), true) + assert.strictEqual(checker.matchEntrypointFunction(node, { signature: 'handle(String)' }), true) + assert.strictEqual(checker.matchEntrypointFunction(node, { funcLocStart: 99, paramTypes: ['String'] }), false) + assert.strictEqual(checker.matchEntrypointFunction(node, { paramTypes: ['Other'] }), false) + }) +}) diff --git a/test/java/test-java-coarse-clean-depth.ts b/test/java/test-java-coarse-clean-depth.ts new file mode 100644 index 00000000..4b327e03 --- /dev/null +++ b/test/java/test-java-coarse-clean-depth.ts @@ -0,0 +1,118 @@ +import * as assert from 'assert' +import { describe, it } from 'mocha' + +const JavaAnalyzer = require('../../src/engine/analyzer/java/common/java-analyzer') as { prototype: object } +const { setGlobalAnalyzer, getGlobalAnalyzer } = require('../../src/engine/analyzer/common/source-line') as { + setGlobalAnalyzer: (analyzer: unknown) => void + getGlobalAnalyzer: () => unknown +} +const { ObjectValue } = require('../../src/engine/analyzer/common/value/object') as { ObjectValue: typeof import('../../src/engine/analyzer/common/value/object').ObjectValue } + +type RuntimeValue = { + vtype: string + sid: string + qid: string + ast: { fdef: { body: { type: string } } } + rtype: { definiteType: string } +} + +type CoarseHarness = { + symbolTable: { calculateUUID: (value: unknown, tag: string) => string; has: (uuid: string) => boolean } + sourceCodeCache: Map + tryCoarseTaintPropagation: ( + scope: unknown, + node: { arguments: unknown[] }, + state: { callstack: unknown[] }, + fclos: RuntimeValue & { _coarsePropEligible: boolean }, + argvalues: unknown[], + ) => unknown +} + +function createAnalyzer(): CoarseHarness { + const analyzer = Object.create(JavaAnalyzer.prototype) as CoarseHarness + analyzer.symbolTable = { + calculateUUID: (value: { sid?: string }, tag: string) => `${value.sid ?? 'value'}|${tag}`, + has: () => false, + } + analyzer.sourceCodeCache = new Map() + return analyzer +} + +function createFclos(): RuntimeValue & { _coarsePropEligible: boolean } { + return { + vtype: 'fclos', + sid: 'Example.load', + qid: 'example.Example.load', + ast: { fdef: { body: { type: 'Block' } } }, + rtype: { definiteType: 'java.lang.String' }, + _coarsePropEligible: true, + } +} + +describe('Java coarse clean depth guard', function () { + it('executes clean eligible calls through target depth three', function () { + const analyzer = createAnalyzer() + const result = analyzer.tryCoarseTaintPropagation( + {}, + { arguments: [] }, + { callstack: [{ depth: 1 }, { depth: 2 }] }, + createFclos(), + [], + ) + + assert.strictEqual(result, undefined) + }) + + it('returns a typed clean CallExprValue below target depth three', function () { + const analyzer = createAnalyzer() + const result = analyzer.tryCoarseTaintPropagation( + {}, + { arguments: [] }, + { callstack: [{ depth: 1 }, { depth: 2 }, { depth: 3 }] }, + createFclos(), + [], + ) as RuntimeValue & { taint?: { isTaintedRec?: boolean; tagTraces?: Map } } + + assert.ok(result) + assert.strictEqual(result.vtype, 'symbol') + assert.strictEqual((result as RuntimeValue & { exprKind?: string }).exprKind, 'call') + assert.deepStrictEqual(result.rtype, { definiteType: 'java.lang.String' }) + assert.ok(!result.taint || result.taint.isTaintedRec !== true) + assert.ok(!result.taint?.tagTraces?.has('JAVA_INPUT')) + }) + + it('preserves existing ARG to RET and CALL trace semantics for tainted arguments', function () { + const previousAnalyzer = getGlobalAnalyzer() + const analyzer = createAnalyzer() + setGlobalAnalyzer(analyzer) + const source = new ObjectValue('', { sid: 'request', qid: 'request' }) + source.taint.addTag('JAVA_INPUT') + source.taint.addTraceToTag('JAVA_INPUT', { tag: 'SOURCE: ', file: 'SampleController.java', line: 89 }) + source.taint.markSource() + const result = analyzer.tryCoarseTaintPropagation( + {}, + { + type: 'FunctionCall', + callee: { type: 'Identifier' }, + arguments: [], + loc: { sourcefile: 'SampleController.java', start: { line: 100 }, end: { line: 100 } }, + }, + { callstack: [{ depth: 1 }, { depth: 2 }, { depth: 3 }] }, + createFclos(), + [source], + ) as RuntimeValue & { + getMisc: (key: string) => unknown + taint: { isTaintedRec: boolean; getTags: () => string[]; getTrace: (tag: string) => Array<{ tag: string }> } + } + + assert.strictEqual(result.vtype, 'symbol') + assert.strictEqual(result.taint.isTaintedRec, true) + assert.deepStrictEqual(result.taint.getTags(), ['JAVA_INPUT']) + assert.ok(result.taint.getTrace('JAVA_INPUT').some((trace) => trace.tag === 'CALL: ')) + const propagatedArg = (result.getMisc('buffer') as Array<{ taint: { getTrace: (tag: string) => Array<{ tag: string }> } }>)[0] + assert.ok(propagatedArg.taint.getTrace('JAVA_INPUT').some((trace) => trace.tag === 'SOURCE: ')) + assert.ok(propagatedArg.taint.getTrace('JAVA_INPUT').some((trace) => trace.tag === 'CALL: ')) + assert.strictEqual(source.taint.getTrace('JAVA_INPUT')[0].tag, 'SOURCE: ') + setGlobalAnalyzer(previousAnalyzer) + }) +}) diff --git a/test/javascript/expect/jsbenchmark-expect.json b/test/javascript/expect/jsbenchmark-expect.json index ca346767..fc67f638 100644 --- a/test/javascript/expect/jsbenchmark-expect.json +++ b/test/javascript/expect/jsbenchmark-expect.json @@ -1 +1 @@ -{"/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_001_T\nLine 14: __taint_sink(arg)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_001_T\",\"functionName\":\"argument_passing_value_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_001_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function argument_passing_value_001_T(__taint_src) {\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_001_T\n AffectedNodeName: process\n 11: CALL: process(__taint_src);\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_001_T\n AffectedNodeName: arg\n 13: ARG PASS: function process(arg) {\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(arg);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_003_T\nLine 15: __taint_sink(arg1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_003_T\",\"functionName\":\"argument_passing_value_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function argument_passing_value_003_T(__taint_src) {\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_003_T\n AffectedNodeName: process\n 12: CALL: process(__taint_src, \"_\");\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_003_T\n AffectedNodeName: arg1\n 14: ARG PASS: function process(arg1, arg2) {\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_003_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(arg1);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_001_T\nLine 12: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_001_T\",\"functionName\":\"return_value_passing_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_001_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function return_value_passing_001_T(__taint_src) {\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_001_T\n AffectedNodeName: process\n 11: CALL RETURN: let data = process();\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_001_T\n AffectedNodeName: data\n 11: Var Pass: let data = process();\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_001_T\n AffectedNodeName: __taint_sink\n 12: SINK: __taint_sink(data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/context_sensitive/multi_invoke/multi_invoke_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/context_sensitive/multi_invoke/multi_invoke_001_T\nLine 13: __taint_sink(a)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/context_sensitive/multi_invoke/multi_invoke_001_T\",\"functionName\":\"multi_invoke_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/context_sensitive/multi_invoke/multi_invoke_001_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function multi_invoke_001_T(__taint_src) {\n /jsbenchmark/accuracy/context_sensitive/multi_invoke/multi_invoke_001_T\n AffectedNodeName: process\n 11: CALL: let a = process(__taint_src);\n /jsbenchmark/accuracy/context_sensitive/multi_invoke/multi_invoke_001_T\n AffectedNodeName: process\n 11: CALL RETURN: let a = process(__taint_src);\n /jsbenchmark/accuracy/context_sensitive/multi_invoke/multi_invoke_001_T\n AffectedNodeName: a\n 11: Var Pass: let a = process(__taint_src);\n /jsbenchmark/accuracy/context_sensitive/multi_invoke/multi_invoke_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(a);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/context_sensitive/multi_invoke/multi_invoke_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/context_sensitive/polymorphism/no_solver/polymorphism_no_solver_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/context_sensitive/polymorphism/no_solver/polymorphism_no_solver_001_T\nLine 26: __taint_sink(sub.call())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/context_sensitive/polymorphism/no_solver/polymorphism_no_solver_001_T\",\"functionName\":\"polymorphism_no_solver_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/context_sensitive/polymorphism/no_solver/polymorphism_no_solver_001_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function polymorphism_no_solver_001_T(__taint_src) {\n /jsbenchmark/accuracy/context_sensitive/polymorphism/no_solver/polymorphism_no_solver_001_T\n AffectedNodeName: call\n 26: CALL RETURN: __taint_sink(sub.call());\n /jsbenchmark/accuracy/context_sensitive/polymorphism/no_solver/polymorphism_no_solver_001_T\n AffectedNodeName: __taint_sink\n 26: SINK: __taint_sink(sub.call());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/context_sensitive/polymorphism/no_solver/polymorphism_no_solver_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/context_sensitive/polymorphism/solver/polymorphism_001_T":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/context_sensitive/polymorphism/solver/polymorphism_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/class/constructor_field_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/class/constructor_field_001_T\nLine 20: __taint_sink(obj.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/class/constructor_field_001_T\",\"functionName\":\"constructor_field_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/class/constructor_field_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function constructor_field_001_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/class/constructor_field_001_T\n AffectedNodeName: obj\n 19: Var Pass: let obj = new A();\n /jsbenchmark/accuracy/field_sensitive/class/constructor_field_001_T\n AffectedNodeName: __taint_sink\n 20: SINK: __taint_sink(obj.data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/class/constructor_field_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/class/constructor_field_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/class/constructor_field_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/class/constructor_field_004_T\nLine 20: __taint_sink(obj.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/class/constructor_field_004_T\",\"functionName\":\"constructor_field_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/class/constructor_field_004_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function constructor_field_004_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/class/constructor_field_004_T\n AffectedNodeName: constructor\n 19: CALL: let obj = new A(__taint_src);\n /jsbenchmark/accuracy/field_sensitive/class/constructor_field_004_T\n AffectedNodeName: obj\n 19: Var Pass: let obj = new A(__taint_src);\n /jsbenchmark/accuracy/field_sensitive/class/constructor_field_004_T\n AffectedNodeName: __taint_sink\n 20: SINK: __taint_sink(obj.data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/class/field_len_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/class/field_len_001_T\nLine 32: __taint_sink(a.b.c.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/class/field_len_001_T\",\"functionName\":\"field_len_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/class/field_len_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function field_len_001_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/class/field_len_001_T\n AffectedNodeName: a\n 31: Var Pass: const a = new A();\n /jsbenchmark/accuracy/field_sensitive/class/field_len_001_T\n AffectedNodeName: __taint_sink\n 32: SINK: __taint_sink(a.b.c.data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/class/field_len_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/class/field_len_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/class/field_len_003_T\nLine 52: __taint_sink(s1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/class/field_len_003_T\",\"functionName\":\"field_len_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/class/field_len_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function field_len_003_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/class/field_len_003_T\n AffectedNodeName: a\n 49: Var Pass: const a = new A();\n /jsbenchmark/accuracy/field_sensitive/class/field_len_003_T\n AffectedNodeName: s\n 50: Var Pass: const s = a.b.c;\n /jsbenchmark/accuracy/field_sensitive/class/field_len_003_T\n AffectedNodeName: s1\n 51: Var Pass: const s1 = s.d.e.f.data;\n /jsbenchmark/accuracy/field_sensitive/class/field_len_003_T\n AffectedNodeName: __taint_sink\n 52: SINK: __taint_sink(s1);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/class/field_len_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/class/field_len_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/class/field_len_005_T\nLine 86: __taint_sink(a.b.c.d.e.f.g.h.i.j.k.l.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/class/field_len_005_T\",\"functionName\":\"field_len_005_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/class/field_len_005_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function field_len_005_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/class/field_len_005_T\n AffectedNodeName: a\n 85: Var Pass: const a = new A();\n /jsbenchmark/accuracy/field_sensitive/class/field_len_005_T\n AffectedNodeName: __taint_sink\n 86: SINK: __taint_sink(a.b.c.d.e.f.g.h.i.j.k.l.data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/class/field_len_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/multidimensional_collection/array_multidimensional_collection_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/multidimensional_collection/array_multidimensional_collection_001_T\nLine 13: __taint_sink(s.0.0)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/multidimensional_collection/array_multidimensional_collection_001_T\",\"functionName\":\"array_multidimensional_collection_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/multidimensional_collection/array_multidimensional_collection_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function array_multidimensional_collection_001_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/multidimensional_collection/array_multidimensional_collection_001_T\n AffectedNodeName: s\n 12: Var Pass: let s = [[__taint_src], [\"b\"], \"c\"];\n /jsbenchmark/accuracy/field_sensitive/multidimensional_collection/array_multidimensional_collection_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(s[0][0]);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/multidimensional_collection/array_multidimensional_collection_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_001_T\nLine 13: __taint_sink(s.0)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_001_T\",\"functionName\":\"array_no_solver_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function array_no_solver_001_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_001_T\n AffectedNodeName: s\n 12: Var Pass: let s = [__taint_src, \"b\", \"c\"];\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(s[0]);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_003_T\nLine 14: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_003_T\",\"functionName\":\"array_no_solver_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function array_no_solver_003_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_003_T\n AffectedNodeName: s\n 12: Var Pass: let s = [__taint_src, \"b\", \"c\"];\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_003_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(s);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T\nLine 15: __taint_sink(map.get(key1))\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T\",\"functionName\":\"map_field_sensitive_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function map_field_sensitive_001_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T\n AffectedNodeName: set\n 13: CALL: map.set(\"key1\", __taint_src);\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(map.get(\"key1\"));\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T\nLine 17: __taint_sink(map.get(key2))\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T\",\"functionName\":\"map_field_sensitive_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function map_field_sensitive_004_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T\n AffectedNodeName: set\n 15: CALL: map.set(\"key2\", __taint_src);\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T\n AffectedNodeName: __taint_sink\n 17: SINK: __taint_sink(map.get(\"key2\"));\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_005_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_006_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_006_T\nLine 15: __taint_sink(map.values())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_006_T\",\"functionName\":\"map_field_sensitive_006_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_006_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function map_field_sensitive_006_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_006_T\n AffectedNodeName: set\n 13: CALL: map.set(\"key1\", __taint_src);\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_006_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(map.values());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_007_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_008_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_008_T\nLine 15: __taint_sink(map.keys())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_008_T\",\"functionName\":\"map_field_sensitive_008_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_008_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function map_field_sensitive_008_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_008_T\n AffectedNodeName: set\n 13: CALL: map.set(__taint_src, \"value1\");\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_008_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(map.keys());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_009_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/rest_parameter_no_solver_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/rest_parameter_no_solver_001_T\nLine 16: __taint_sink(args.1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/rest_parameter_no_solver_001_T\",\"functionName\":\"rest_parameter_no_solver_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/rest_parameter_no_solver_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function rest_parameter_no_solver_001_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/rest_parameter_no_solver_001_T\n AffectedNodeName: collectArgs\n 12: CALL: collectArgs(\"prefix\", __taint_src, \"suffix\");\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/rest_parameter_no_solver_001_T\n AffectedNodeName: __tmp1__\n 15: ARG PASS: function collectArgs(...args) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/rest_parameter_no_solver_001_T\n AffectedNodeName: args\n 15: Var Pass: function collectArgs(...args) {\n 16: Var Pass: __taint_sink(args[1]);\n 17: Var Pass: }\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/rest_parameter_no_solver_001_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(args[1]);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/rest_parameter_no_solver_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_001_T\nLine 15: __taint_sink(rest.0)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_001_T\",\"functionName\":\"spread_operator_no_solver_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function spread_operator_no_solver_001_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_001_T\n AffectedNodeName: foo\n 12: Var Pass: const foo = __taint_src;\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_001_T\n AffectedNodeName: __tmp2__\n 14: Var Pass: const [r1, r2, ...rest] = [123, 456, foo, bar];\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_001_T\n AffectedNodeName: rest\n 14: Var Pass: const [r1, r2, ...rest] = [123, 456, foo, bar];\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_001_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(rest[0]);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_003_T\nLine 14: __taint_sink(array.3)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_003_T\",\"functionName\":\"spread_operator_no_solver_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function spread_operator_no_solver_003_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_003_T\n AffectedNodeName: array1\n 12: Var Pass: let array1 = [\"a\", \"b\", __taint_src];\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_003_T\n AffectedNodeName: array\n 13: Var Pass: let array = [\"c\", ...array1];\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_003_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(array[3]);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_001_T\nLine 13: __taint_sink(s.1+1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_001_T\",\"functionName\":\"array_solver_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function array_solver_001_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_001_T\n AffectedNodeName: s\n 12: Var Pass: let s = [\"a\", \"b\", __taint_src, \"c\", \"d\"];\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(s[1 + 1]);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_002_F\nLine 13: __taint_sink(s.1+2)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_002_F\",\"functionName\":\"array_solver_002_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_002_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function array_solver_002_F(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_002_F\n AffectedNodeName: s\n 12: Var Pass: let s = [\"a\", \"b\", __taint_src, \"c\", \"d\"];\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_002_F\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(s[1 + 2]);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/flow_sensitive/asynchronous/asynchronous_await_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/flow_sensitive/asynchronous/asynchronous_await_001_T\nLine 14: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/flow_sensitive/asynchronous/asynchronous_await_001_T\",\"functionName\":\"asynchronous_await_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/flow_sensitive/asynchronous/asynchronous_await_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: async function asynchronous_await_001_T(__taint_src) {\n /jsbenchmark/accuracy/flow_sensitive/asynchronous/asynchronous_await_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/flow_sensitive/asynchronous/asynchronous_await_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_001_T\nLine 15: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_001_T\",\"functionName\":\"dowhile_body_loop_stmt_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function dowhile_body_loop_stmt_001_T(__taint_src) {\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_001_T\n AffectedNodeName: res\n 14: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_001_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_002_F\nLine 14: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_002_F\",\"functionName\":\"dowhile_body_loop_stmt_002_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_002_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function dowhile_body_loop_stmt_002_F(__taint_src) {\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_002_F\n AffectedNodeName: res\n 15: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_002_F\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_001_T\nLine 16: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_001_T\",\"functionName\":\"for_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function for_001_T(__taint_src) {\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_001_T\n AffectedNodeName: res\n 15: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_001_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_002_F\nLine 15: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_002_F\",\"functionName\":\"for_002_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_002_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function for_002_F(__taint_src) {\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_002_F\n AffectedNodeName: res\n 16: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_002_F\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_003_T\nLine 15: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_003_T\",\"functionName\":\"for_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function for_003_T(__taint_src) {\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_003_T\n AffectedNodeName: res\n 14: Var Pass: for (res = __taint_src; i < 1; i++) {\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_003_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/flow_sensitive/normal_stmt/assign_expression_stmt_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/flow_sensitive/normal_stmt/assign_expression_stmt_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/flow_sensitive/normal_stmt/assign_expression_stmt_001_T\",\"functionName\":\"assign_expression_stmt_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/flow_sensitive/normal_stmt/assign_expression_stmt_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function assign_expression_stmt_001_T(__taint_src) {\n /jsbenchmark/accuracy/flow_sensitive/normal_stmt/assign_expression_stmt_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src;\n /jsbenchmark/accuracy/flow_sensitive/normal_stmt/assign_expression_stmt_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/flow_sensitive/normal_stmt/assign_expression_stmt_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/object_sensitive/class/constructor_obj_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/object_sensitive/class/constructor_obj_001_T\nLine 20: __taint_sink(obj)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/object_sensitive/class/constructor_obj_001_T\",\"functionName\":\"constructor_obj_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/object_sensitive/class/constructor_obj_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function constructor_obj_001_T(__taint_src) {\n /jsbenchmark/accuracy/object_sensitive/class/constructor_obj_001_T\n AffectedNodeName: constructor\n 18: CALL: let obj = new A(__taint_src);\n /jsbenchmark/accuracy/object_sensitive/class/constructor_obj_001_T\n AffectedNodeName: obj\n 18: Var Pass: let obj = new A(__taint_src);\n /jsbenchmark/accuracy/object_sensitive/class/constructor_obj_001_T\n AffectedNodeName: __taint_sink\n 20: SINK: __taint_sink(obj);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/object_sensitive/class/constructor_obj_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_001_T\nLine 14: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_001_T\",\"functionName\":\"array_object_sensitive_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function array_object_sensitive_001_T(__taint_src) {\n /jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_001_T\n AffectedNodeName: s\n 12: Var Pass: let s = [__taint_src, \"b\", \"c\"];\n /jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(s);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_003_T\nLine 14: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_003_T\",\"functionName\":\"array_object_sensitive_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function array_object_sensitive_003_T(__taint_src) {\n /jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_003_T\n AffectedNodeName: s\n 12: Var Pass: let s = [[__taint_src], [\"b\"], \"c\"];\n /jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_003_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(s);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_005_T\nLine 16: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_005_T\",\"functionName\":\"array_object_sensitive_005_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_005_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function array_object_sensitive_005_T(__taint_src) {\n /jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_005_T\n AffectedNodeName: push\n 13: CALL: s.push(__taint_src);\n /jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_005_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(s);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_001_T\nLine 16: __taint_sink(map)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_001_T\",\"functionName\":\"map_object_sensitive_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function map_object_sensitive_001_T(__taint_src) {\n /jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_001_T\n AffectedNodeName: set\n 13: CALL: map.set(\"key1\", __taint_src);\n /jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_001_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(map);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_003_T\nLine 16: __taint_sink(map)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_003_T\",\"functionName\":\"map_object_sensitive_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function map_object_sensitive_003_T(__taint_src) {\n /jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_003_T\n AffectedNodeName: set\n 13: CALL: map.set(__taint_src, \"value\");\n /jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_003_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(map);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_005_T\nLine 16: __taint_sink(map)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_005_T\",\"functionName\":\"map_object_sensitive_005_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_005_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function map_object_sensitive_005_T(__taint_src) {\n /jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_005_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(map);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_001_T\nLine 14: __taint_sink(set)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_001_T\",\"functionName\":\"set_object_sensitive_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function set_object_sensitive_001_T(__taint_src) {\n /jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_001_T\n AffectedNodeName: set\n 12: Var Pass: let set = new Set(__taint_src);\n /jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(set);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_003_T\nLine 15: __taint_sink(set)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_003_T\",\"functionName\":\"set_object_sensitive_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function set_object_sensitive_003_T(__taint_src) {\n /jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_003_T\n AffectedNodeName: add\n 13: CALL: set.add(__taint_src);\n /jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_003_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(set);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_001_T\nLine 13: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_001_T\",\"functionName\":\"exception_throw_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function exception_throw_001_T(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_002_F\nLine 14: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_002_F\",\"functionName\":\"exception_throw_002_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_002_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function exception_throw_002_F(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_002_F\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_003_T\nLine 15: __taint_sink(e)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_003_T\",\"functionName\":\"exception_throw_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function exception_throw_003_T(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_003_T\n AffectedNodeName: __taint_src\n 13: Var Pass: throw __taint_src;\n /jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_003_T\n AffectedNodeName: e\n 14: Var Pass: } catch (e) {\n /jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_003_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(e);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F\",\"functionName\":\"break_001_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function break_001_F(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F\n AffectedNodeName: res\n 15: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(res);\n\n------------- 2: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F\",\"functionName\":\"break_001_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function break_001_F(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F\n AffectedNodeName: res\n 15: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F\n AffectedNodeName: __taint_sink\n 18: CALL: __taint_sink(res);\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:2\n==========================================================","/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T\nLine 17: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T\",\"functionName\":\"break_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function break_002_T(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T\n AffectedNodeName: res\n 15: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T\n AffectedNodeName: __taint_sink\n 17: SINK: __taint_sink(res);\n\n------------- 2: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T\nLine 17: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T\",\"functionName\":\"break_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function break_002_T(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T\n AffectedNodeName: res\n 15: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T\n AffectedNodeName: __taint_sink\n 17: CALL: __taint_sink(res);\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T\n AffectedNodeName: __taint_sink\n 17: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:2\n==========================================================","/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_label_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_label_002_T":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T\",\"functionName\":\"continue_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function continue_001_T(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T\n AffectedNodeName: res\n 15: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(res);\n\n------------- 2: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T\",\"functionName\":\"continue_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function continue_001_T(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T\n AffectedNodeName: res\n 15: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T\n AffectedNodeName: __taint_sink\n 18: CALL: __taint_sink(res);\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:2\n==========================================================","/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_002_F\nLine 15: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_002_F\",\"functionName\":\"continue_002_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_002_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function continue_002_F(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_002_F\n AffectedNodeName: res\n 16: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_002_F\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/return_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/return_001_T\nLine 16: __taint_sink(arg1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/return_001_T\",\"functionName\":\"return_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/return_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function return_001_T(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/return_001_T\n AffectedNodeName: process\n 12: CALL: process(__taint_src, \"some_condition\");\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/return_001_T\n AffectedNodeName: arg1\n 14: ARG PASS: function process(arg1, arg2) {\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/return_001_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(arg1);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/return_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_no_solver_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_no_solver_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_no_solver_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_no_solver_003_T\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_no_solver_003_T\",\"functionName\":\"conditional_if_no_solver_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_no_solver_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function conditional_if_no_solver_003_T(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_no_solver_003_T\n AffectedNodeName: res\n 16: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_no_solver_003_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_no_solver_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_no_solver_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_no_solver_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_no_solver_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_no_solver_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_no_solver_004_T\nLine 18: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_no_solver_004_T\",\"functionName\":\"conditional_switch_no_solver_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_no_solver_004_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function conditional_switch_no_solver_004_T(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_no_solver_004_T\n AffectedNodeName: data\n 15: Var Pass: data = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_no_solver_004_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_001_T\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_001_T\",\"functionName\":\"conditional_if_solver_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function conditional_if_solver_001_T(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_001_T\n AffectedNodeName: res\n 14: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_001_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_002_F\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_002_F\",\"functionName\":\"conditional_if_solver_002_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_002_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function conditional_if_solver_002_F(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_002_F\n AffectedNodeName: res\n 14: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_002_F\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_001_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_001_F\nLine 18: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_001_F\",\"functionName\":\"conditional_switch_solver_001_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_001_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function conditional_switch_solver_001_F(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_001_F\n AffectedNodeName: data\n 15: Var Pass: data = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_001_F\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_002_T\nLine 18: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_002_T\",\"functionName\":\"conditional_switch_solver_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function conditional_switch_solver_002_T(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_002_T\n AffectedNodeName: data\n 15: Var Pass: data = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_002_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_solver_001_T":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_solver_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_solver_002_F\nLine 16: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_solver_002_F\",\"functionName\":\"for_body_solver_002_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_solver_002_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function for_body_solver_002_F(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_solver_002_F\n AffectedNodeName: res\n 14: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_solver_002_F\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/while_body_solver_001_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/while_body_solver_001_F\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/while_body_solver_001_F\",\"functionName\":\"while_body_solver_001_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/while_body_solver_001_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function while_body_solver_001_F(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/while_body_solver_001_F\n AffectedNodeName: res\n 15: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/while_body_solver_001_F\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/while_body_solver_002_T":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_002_T\nLine 16: __taint_sink(Reflect.get(obj, name))\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_002_T\",\"functionName\":\"dynamic_call_reflect_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function dynamic_call_reflect_002_T(__taint_src) {\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_002_T\n AffectedNodeName: obj\n 12: Var Pass: let obj = {\n 13: Var Pass: name: __taint_src,\n 14: Var Pass: };\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_002_T\n AffectedNodeName: get\n 16: CALL: __taint_sink(Reflect.get(obj, \"name\"));\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_002_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(Reflect.get(obj, \"name\"));\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_003_T\nLine 17: __taint_sink(obj.foo)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_003_T\",\"functionName\":\"dynamic_call_reflect_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function dynamic_call_reflect_003_T(__taint_src) {\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_003_T\n AffectedNodeName: set\n 16: CALL: Reflect.set(obj, \"foo\", __taint_src);\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_003_T\n AffectedNodeName: \n 16: Reflect.set Pass: Reflect.set(obj, \"foo\", __taint_src);\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_003_T\n AffectedNodeName: __taint_sink\n 17: SINK: __taint_sink(obj.foo);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_005_T\nLine 18: __taint_sink(obj.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_005_T\",\"functionName\":\"dynamic_call_reflect_005_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_005_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function dynamic_call_reflect_005_T(__taint_src) {\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_005_T\n AffectedNodeName: obj\n 12: Var Pass: let obj = {\n 13: Var Pass: data: __taint_src,\n 14: Var Pass: data1: \"aaa\",\n 15: Var Pass: };\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_005_T\n AffectedNodeName: deleteProperty\n 17: CALL: Reflect.deleteProperty(obj, \"data1\");\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_005_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(obj.data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/alias/alias_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/alias/alias_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/alias/alias_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/alias/alias_003_T\nLine 15: __taint_sink(a.value)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/alias/alias_003_T\",\"functionName\":\"alias_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/alias/alias_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function alias_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/alias/alias_003_T\n AffectedNodeName: b.value\n 14: Var Pass: b.value = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/alias/alias_003_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(a.value);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/async_await_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/async_await_001_T\nLine 13: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/async_await_001_T\",\"functionName\":\"async_await_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/async_await_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: async function async_await_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/async_await_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/async_await_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_001_T\nLine 18: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_001_T\",\"functionName\":\"asynchronous_promise_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function asynchronous_promise_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_001_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_001_T.asynchronous_promise_001_T.\n 16: CALL: promise\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_001_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_001_T.asynchronous_promise_001_T.\n 17: ARG PASS: .then((result) => {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_001_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_003_T\nLine 18: __taint_sink(value)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_003_T\",\"functionName\":\"asynchronous_promise_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function asynchronous_promise_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_003_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_003_T.asynchronous_promise_003_T.\n 18: CALL: asyncFunc(__taint_src).then((value) => __taint_sink(value));\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_003_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_003_T.asynchronous_promise_003_T.\n 18: ARG PASS: asyncFunc(__taint_src).then((value) => __taint_sink(value));\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_003_T\n AffectedNodeName: asyncFunc\n 18: CALL: asyncFunc(__taint_src).then((value) => __taint_sink(value));\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_003_T\n AffectedNodeName: __taint_sink\n 18: SINK: asyncFunc(__taint_src).then((value) => __taint_sink(value));\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_005_T\nLine 18: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_005_T\",\"functionName\":\"asynchronous_promise_005_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_005_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function asynchronous_promise_005_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_005_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_005_T.asynchronous_promise_005_T.\n 16: CALL: promise\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_005_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_005_T.asynchronous_promise_005_T.\n 17: ARG PASS: .then((result) => {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_005_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_007_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_007_T\nLine 24: __taint_sink(final)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_007_T\",\"functionName\":\"asynchronous_promise_007_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_007_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function asynchronous_promise_007_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_007_T\n AffectedNodeName: \n 16: CALL: promise\n 17: CALL: .then((result) => {\n 18: CALL: final = result;\n 19: CALL: })\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_007_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_007_T.asynchronous_promise_007_T.\n 23: CALL: .finally(() => {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_007_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_007_T.asynchronous_promise_007_T.\n 23: ARG PASS: .finally(() => {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_007_T\n AffectedNodeName: __taint_sink\n 24: SINK: __taint_sink(final);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_008_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T\nLine 20: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T\",\"functionName\":\"asynchronous_promise_009_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function asynchronous_promise_009_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T\n AffectedNodeName: \n 16: CALL: promise\n 17: CALL: .then((result) => result + \"_1\")\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T\n AffectedNodeName: \n 16: CALL RETURN: promise\n 17: CALL RETURN: .then((result) => result + \"_1\")\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T\n AffectedNodeName: \n 16: CALL: promise\n 17: CALL: .then((result) => result + \"_1\")\n 18: CALL: .then((result) => result + \"_2\")\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T\n AffectedNodeName: \n 16: CALL RETURN: promise\n 17: CALL RETURN: .then((result) => result + \"_1\")\n 18: CALL RETURN: .then((result) => result + \"_2\")\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T.asynchronous_promise_009_T.\n 16: CALL: promise\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T.asynchronous_promise_009_T.\n 19: ARG PASS: .then((result) => {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T\n AffectedNodeName: __taint_sink\n 20: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_010_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_011_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_011_T\nLine 19: __taint_sink(error)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_011_T\",\"functionName\":\"asynchronous_promise_011_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_011_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function asynchronous_promise_011_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_011_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_011_T.asynchronous_promise_011_T.\n 16: CALL: promise\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_011_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_011_T.asynchronous_promise_011_T.\n 18: ARG PASS: .catch((error) => {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_011_T\n AffectedNodeName: __taint_sink\n 19: SINK: __taint_sink(error);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_012_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promisify_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promisify_001_T\nLine 26: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promisify_001_T\",\"functionName\":\"asynchronous_promisify_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promisify_001_T\n AffectedNodeName: __taint_src\n 22: SOURCE: async function asynchronous_promisify_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promisify_001_T\n AffectedNodeName: data\n 25: Var Pass: let data = await readFileAsync(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promisify_001_T\n AffectedNodeName: __taint_sink\n 26: SINK: __taint_sink(data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promisify_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_001_T\nLine 29: __taint_sink(obj)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_001_T\",\"functionName\":\"cross_class_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function cross_class_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_001_T\n AffectedNodeName: obj\n 28: Var Pass: let obj = new B();\n /jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_001_T\n AffectedNodeName: __taint_sink\n 29: SINK: __taint_sink(obj);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_003_T\nLine 36: __taint_sink(a)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_003_T\",\"functionName\":\"cross_class_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function cross_class_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_003_T\n AffectedNodeName: setData\n 35: CALL: b.setData(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_003_T\n AffectedNodeName: __taint_sink\n 36: SINK: __taint_sink(a);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_001_T\nLine 19: __taint_sink(obj)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_001_T\",\"functionName\":\"simple_object_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function simple_object_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_001_T\n AffectedNodeName: constructor\n 18: CALL: let obj = new A(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_001_T\n AffectedNodeName: obj\n 18: Var Pass: let obj = new A(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_001_T\n AffectedNodeName: __taint_sink\n 19: SINK: __taint_sink(obj);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_001_T\nLine 18: __taint_sink(person.name)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_001_T\",\"functionName\":\"simple_object_prototype_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function simple_object_prototype_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_001_T\n AffectedNodeName: Person.prototype.name\n 14: Var Pass: Person.prototype.name = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_001_T\n AffectedNodeName: person\n 16: Var Pass: let person = new Person();\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_001_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(person.name);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_003_T\nLine 18: __taint_sink(person.__proto__.name)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_003_T\",\"functionName\":\"simple_object_prototype_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function simple_object_prototype_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_003_T\n AffectedNodeName: Person.prototype.name\n 14: Var Pass: Person.prototype.name = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_003_T\n AffectedNodeName: person\n 16: Var Pass: let person = new Person();\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_003_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(person.__proto__.name);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T\nLine 13: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T\",\"functionName\":\"conditional_if_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function conditional_if_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T\nLine 14: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T\",\"functionName\":\"conditional_if_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function conditional_if_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_005_T\nLine 14: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_005_T\",\"functionName\":\"conditional_if_005_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_005_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function conditional_if_005_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_005_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T\nLine 14: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T\",\"functionName\":\"conditional_switch_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function conditional_switch_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/dowhile_body_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/dowhile_body_001_T\nLine 15: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/dowhile_body_001_T\",\"functionName\":\"dowhile_body_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/dowhile_body_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function dowhile_body_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/dowhile_body_001_T\n AffectedNodeName: res\n 14: Var Pass: res = res + __taint_src;\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/dowhile_body_001_T\n AffectedNodeName: __taint_sink\n 15: SINK: } while (__taint_sink(res));\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/dowhile_body_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/every_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/every_001_T\nLine 14: __taint_sink(item)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/every_001_T\",\"functionName\":\"every_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/every_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function every_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/every_001_T\n AffectedNodeName: arr\n 12: Var Pass: let arr = [\"a\", \"b\", __taint_src];\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/every_001_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/every_001_T.every_001_T.\n 13: CALL: arr.every(function (item) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/every_001_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/every_001_T.every_001_T.\n 13: ARG PASS: arr.every(function (item) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/every_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(item);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/every_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T\nLine 17: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T\",\"functionName\":\"for_body_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function for_body_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T\n AffectedNodeName: res\n 15: Var Pass: res = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T\n AffectedNodeName: __taint_sink\n 17: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_body_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T\",\"functionName\":\"for_init_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function for_init_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T\n AffectedNodeName: ini\n 15: Var Pass: for (ini = __taint_src; j < 10; j++) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T\n AffectedNodeName: res\n 16: Var Pass: res = res + ini;\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_init_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T\nLine 19: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T\",\"functionName\":\"for_update_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function for_update_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T\n AffectedNodeName: j\n 15: Var Pass: for (; ini < 2; j = __taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T\n AffectedNodeName: res\n 16: Var Pass: res = j;\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T\n AffectedNodeName: __taint_sink\n 19: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_update_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/foreach_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/foreach_001_T\nLine 15: __taint_sink(item)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/foreach_001_T\",\"functionName\":\"foreach_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/foreach_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function foreach_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/foreach_001_T\n AffectedNodeName: arr\n 12: Var Pass: let arr = [\"a\", \"b\", __taint_src];\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/foreach_001_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/foreach_001_T.foreach_001_T.\n 14: CALL: arr.forEach(function (item) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/foreach_001_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/foreach_001_T.foreach_001_T.\n 14: ARG PASS: arr.forEach(function (item) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/foreach_001_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(item);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/foreach_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forin_body_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forin_body_001_T\nLine 19: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forin_body_001_T\",\"functionName\":\"forin_body_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forin_body_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function forin_body_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forin_body_001_T\n AffectedNodeName: obj\n 12: Var Pass: let obj = { key1: \"value1\", key2: __taint_src };\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forin_body_001_T\n AffectedNodeName: __taint_sink\n 19: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forin_body_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forof_body_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forof_body_001_T\nLine 17: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forof_body_001_T\",\"functionName\":\"forof_body_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forof_body_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function forof_body_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forof_body_001_T\n AffectedNodeName: arr\n 12: Var Pass: let arr = [\"a\", \"b\", __taint_src];\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forof_body_001_T\n AffectedNodeName: value\n 14: Var Pass: for (let value of arr) {\n 15: Var Pass: res = value;\n 16: Var Pass: }\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forof_body_001_T\n AffectedNodeName: res\n 15: Var Pass: res = value;\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forof_body_001_T\n AffectedNodeName: __taint_sink\n 17: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forof_body_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/some_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/some_001_T\nLine 14: __taint_sink(item)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/some_001_T\",\"functionName\":\"some_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/some_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function some_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/some_001_T\n AffectedNodeName: arr\n 12: Var Pass: let arr = [\"a\", \"b\", __taint_src];\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/some_001_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/some_001_T.some_001_T.\n 13: CALL: arr.some(function (item) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/some_001_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/some_001_T.some_001_T.\n 13: ARG PASS: arr.some(function (item) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/some_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(item);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/some_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/while_body_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/while_body_001_T\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/while_body_001_T\",\"functionName\":\"while_body_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/while_body_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function while_body_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/while_body_001_T\n AffectedNodeName: res\n 15: Var Pass: res = res + __taint_src;\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/while_body_001_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/while_body_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_001_T/A/cross_module_001_T_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_001_T/B/cross_module_001_T_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_002_F/A/cross_module_002_F_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_002_F/B/cross_module_002_F_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_003_T/A/cross_module_003_T_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_003_T/B/cross_module_003_T_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_004_F/A/cross_module_004_F_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_004_F/B/cross_module_004_F_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_005_T/A/cross_module_005_T_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_005_T/B/cross_module_005_T_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_006_F/A/cross_module_006_F_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_006_F/B/cross_module_006_F_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_007_T/A/cross_module_007_T_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_007_T/B/cross_module_007_T_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_008_F/A/cross_module_008_F_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_008_F/B/cross_module_008_F_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_009_T/A/cross_module_009_T_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_009_T/B/cross_module_009_T_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_010_F/A/cross_module_010_F_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_010_F/B/cross_module_010_F_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_011_T/A/cross_module_011_T_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_011_T/B/cross_module_011_T_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_012_F/A/cross_module_012_F_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_012_F/B/cross_module_012_F_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/datatype/array/array_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/datatype/array/array_001_T\nLine 13: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/datatype/array/array_001_T\",\"functionName\":\"array_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/datatype/array/array_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function array_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/datatype/array/array_001_T\n AffectedNodeName: s\n 12: Var Pass: let s = [__taint_src, \"b\", \"c\"];\n /jsbenchmark/completeness/single_app_tracing/datatype/array/array_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(s);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/datatype/array/array_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/datatype/array/array_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/datatype/array/array_003_T\nLine 13: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/datatype/array/array_003_T\",\"functionName\":\"array_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/datatype/array/array_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function array_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/datatype/array/array_003_T\n AffectedNodeName: s\n 12: Var Pass: let s = [[__taint_src], [\"b\"], \"c\"];\n /jsbenchmark/completeness/single_app_tracing/datatype/array/array_003_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(s);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/datatype/array/array_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/datatype/array/array_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/datatype/array/array_005_T\nLine 14: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/datatype/array/array_005_T\",\"functionName\":\"array_005_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/datatype/array/array_005_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function array_005_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/datatype/array/array_005_T\n AffectedNodeName: push\n 13: CALL: s.push(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/datatype/array/array_005_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(s);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/datatype/array/array_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/datatype/collections/set_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/datatype/collections/set_001_T\nLine 13: __taint_sink(set)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/datatype/collections/set_001_T\",\"functionName\":\"set_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/datatype/collections/set_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function set_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/datatype/collections/set_001_T\n AffectedNodeName: set\n 12: Var Pass: let set = new Set(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/datatype/collections/set_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(set);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/datatype/collections/set_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/datatype/map/map_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/datatype/map/map_001_T\nLine 14: __taint_sink(map)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/datatype/map/map_001_T\",\"functionName\":\"map_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/datatype/map/map_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function map_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/datatype/map/map_001_T\n AffectedNodeName: set\n 13: CALL: map.set(\"key1\", __taint_src);\n /jsbenchmark/completeness/single_app_tracing/datatype/map/map_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(map);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/datatype/map/map_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_001_T\nLine 15: __taint_sink(e)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_001_T\",\"functionName\":\"exception_catch_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function exception_catch_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_001_T\n AffectedNodeName: __taint_src\n 13: Var Pass: throw __taint_src;\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_001_T\n AffectedNodeName: e\n 14: Var Pass: } catch (e) {\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_001_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(e);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_003_T\nLine 15: __taint_sink(e.message)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_003_T\",\"functionName\":\"exception_catch_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function exception_catch_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_003_T\n AffectedNodeName: {message:__taint_src, code:123}\n 13: Var Pass: throw { message: __taint_src, code: 123 };\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_003_T\n AffectedNodeName: e\n 14: Var Pass: } catch (e) {\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_003_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(e.message);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_finally_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_finally_001_T\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_finally_001_T\",\"functionName\":\"exception_finally_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_finally_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function exception_finally_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_finally_001_T\n AffectedNodeName: __taint_src\n 14: Var Pass: throw __taint_src;\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_finally_001_T\n AffectedNodeName: e\n 15: Var Pass: } catch (e) {\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_finally_001_T\n AffectedNodeName: res\n 16: Var Pass: res = e;\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_finally_001_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_finally_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_try_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_try_001_T\nLine 13: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_try_001_T\",\"functionName\":\"exception_try_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_try_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function exception_try_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_try_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_try_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T\",\"functionName\":\"assign_expression_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function assign_expression_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T\n AffectedNodeName: result\n 13: Var Pass: result = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T\",\"functionName\":\"binary_expression_add_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function binary_expression_add_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src + \"_\";\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T\",\"functionName\":\"binary_expression_add_assignment_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function binary_expression_add_assignment_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T\",\"functionName\":\"bitwise_expression_and_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function bitwise_expression_and_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src & 1;\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T\",\"functionName\":\"bitwise_expression_lsh_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function bitwise_expression_lsh_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src << 1;\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T\",\"functionName\":\"bitwise_expression_not_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function bitwise_expression_not_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T\",\"functionName\":\"bitwise_expression_or_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function bitwise_expression_or_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src | 1;\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T\",\"functionName\":\"bitwise_expression_rsh_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function bitwise_expression_rsh_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src >> 1;\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T\",\"functionName\":\"bitwise_expression_xor_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function bitwise_expression_xor_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src ^ 1;\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_002_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_002_T\",\"functionName\":\"logic_expression_and_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function logic_expression_and_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_002_T\n AffectedNodeName: result\n 12: Var Pass: let result = \"_\" && __taint_src;\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_002_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T\",\"functionName\":\"logic_expression_or_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function logic_expression_or_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src || \"_\";\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/prefix_expression_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/prefix_expression_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/prefix_expression_001_T\",\"functionName\":\"prefix_expression_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/prefix_expression_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function prefix_expression_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/prefix_expression_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/prefix_expression_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T\",\"functionName\":\"relation_expression_equal_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function relation_expression_equal_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src === \"taint_src_value\";\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_002_F\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_002_F\",\"functionName\":\"relation_expression_equal_002_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_002_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function relation_expression_equal_002_F(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_002_F\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src === \"__taint_src\";\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_002_F\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_001_T\",\"functionName\":\"relation_expression_greater_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function relation_expression_greater_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src > \"__taint_src\";\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_002_F\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_002_F\",\"functionName\":\"relation_expression_greater_002_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_002_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function relation_expression_greater_002_F(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_002_F\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src > \"taint_src_value\";\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_002_F\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_001_T\",\"functionName\":\"relation_expression_less_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function relation_expression_less_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src < \"__taint_src\";\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_002_F\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_002_F\",\"functionName\":\"relation_expression_less_002_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_002_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function relation_expression_less_002_F(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_002_F\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src < \"taint_src_valueaa\";\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_002_F\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/suffix_expression_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/suffix_expression_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/suffix_expression_001_T\",\"functionName\":\"suffix_expression_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/suffix_expression_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function suffix_expression_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/suffix_expression_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/suffix_expression_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/conditional_expression/conditional_expression_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/conditional_expression/conditional_expression_001_T\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/conditional_expression/conditional_expression_001_T\",\"functionName\":\"conditional_expression_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/conditional_expression/conditional_expression_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function conditional_expression_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/conditional_expression/conditional_expression_001_T\n AffectedNodeName: result\n 13: Var Pass: result = true ? __taint_src : \"aa\";\n /jsbenchmark/completeness/single_app_tracing/expression/conditional_expression/conditional_expression_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/conditional_expression/conditional_expression_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/lambda_expression/lambda_expression_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/lambda_expression/lambda_expression_001_T\nLine 15: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/lambda_expression/lambda_expression_001_T\",\"functionName\":\"lambda_expression_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/lambda_expression/lambda_expression_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function lambda_expression_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/lambda_expression/lambda_expression_001_T\n AffectedNodeName: lambda\n 14: CALL: result = lambda(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/expression/lambda_expression/lambda_expression_001_T\n AffectedNodeName: lambda\n 14: CALL RETURN: result = lambda(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/expression/lambda_expression/lambda_expression_001_T\n AffectedNodeName: result\n 14: Var Pass: result = lambda(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/expression/lambda_expression/lambda_expression_001_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/lambda_expression/lambda_expression_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_001_T\nLine 17: __taint_sink(Employee.lastname)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_001_T\",\"functionName\":\"delete_expression_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_001_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function delete_expression_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_001_T\n AffectedNodeName: Employee\n 11: Var Pass: const Employee = {\n 12: Var Pass: firstname: \"Bob\",\n 13: Var Pass: lastname: __taint_src,\n 14: Var Pass: };\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_001_T\n AffectedNodeName: __taint_sink\n 17: SINK: __taint_sink(Employee.lastname);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_003_T\nLine 13: __taint_sink(array)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_003_T\",\"functionName\":\"delete_expression_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_003_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function delete_expression_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_003_T\n AffectedNodeName: array\n 11: Var Pass: const array = [__taint_src, \"b\", \"c\", \"d\"];\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_003_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(array);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_001_T\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_001_T\",\"functionName\":\"destructuring_assignment_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function destructuring_assignment_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_001_T\n AffectedNodeName: arr\n 12: Var Pass: let arr = [\"_\", \"_\", __taint_src];\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_001_T\n AffectedNodeName: result\n 13: Var Pass: let [a, b, result] = arr;\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_003_T\nLine 14: __taint_sink(c)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_003_T\",\"functionName\":\"destructuring_assignment_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function destructuring_assignment_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_003_T\n AffectedNodeName: arr\n 12: Var Pass: let arr = { a: \"_\", b: \"_\", c: __taint_src };\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_003_T\n AffectedNodeName: c\n 13: Var Pass: let { a, b, c } = arr;\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_003_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(c);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_005_T\nLine 14: __taint_sink(c)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_005_T\",\"functionName\":\"destructuring_assignment_005_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_005_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function destructuring_assignment_005_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_005_T\n AffectedNodeName: arr\n 12: Var Pass: let arr = [\"_\", \"_\", [__taint_src, \"_\"]];\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_005_T\n AffectedNodeName: c\n 13: Var Pass: let [a, b, [c, d]] = arr;\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_005_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(c);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_007_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_007_T\nLine 14: __taint_sink(c)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_007_T\",\"functionName\":\"destructuring_assignment_007_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_007_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function destructuring_assignment_007_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_007_T\n AffectedNodeName: arr\n 12: Var Pass: let arr = { a: \"_\", b: \"_\", c: { __taint_src, d: \"a\" } };\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_007_T\n AffectedNodeName: c\n 13: Var Pass: let { a, b, c } = arr;\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_007_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(c);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_008_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/exponentiation_operator_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/exponentiation_operator_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/exponentiation_operator_001_T\",\"functionName\":\"exponentiation_operator_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/exponentiation_operator_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function exponentiation_operator_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/exponentiation_operator_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src ** 2;\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/exponentiation_operator_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/exponentiation_operator_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/nullish_coalescing_operator_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/nullish_coalescing_operator_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/nullish_coalescing_operator_001_T\",\"functionName\":\"nullish_coalescing_operator_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/nullish_coalescing_operator_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function nullish_coalescing_operator_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/nullish_coalescing_operator_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = null ?? __taint_src;\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/nullish_coalescing_operator_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/nullish_coalescing_operator_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/optional_chaining_operator_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/optional_chaining_operator_001_T\nLine 17: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/optional_chaining_operator_001_T\",\"functionName\":\"optional_chaining_operator_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/optional_chaining_operator_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function optional_chaining_operator_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/optional_chaining_operator_001_T\n AffectedNodeName: obj\n 12: Var Pass: let obj = {\n 13: Var Pass: taintKey: __taint_src,\n 14: Var Pass: };\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/optional_chaining_operator_001_T\n AffectedNodeName: result\n 16: Var Pass: let result = obj?.taintKey;\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/optional_chaining_operator_001_T\n AffectedNodeName: __taint_sink\n 17: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/optional_chaining_operator_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T\nLine 16: __taint_sink(args)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T\",\"functionName\":\"rest_parameter_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function rest_parameter_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T\n AffectedNodeName: collectArgs\n 12: CALL: collectArgs(\"prefix\", __taint_src, \"suffix\");\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T\n AffectedNodeName: __tmp1__\n 15: ARG PASS: function collectArgs(...args) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T\n AffectedNodeName: args\n 15: Var Pass: function collectArgs(...args) {\n 16: Var Pass: __taint_sink(args);\n 17: Var Pass: }\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(args);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_003_T\nLine 17: __taint_sink({with(params)})\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_003_T\",\"functionName\":\"rest_parameter_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function rest_parameter_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_003_T\n AffectedNodeName: params\n 12: Var Pass: const params = {\n 13: Var Pass: name: \"Tony\",\n 14: Var Pass: age: \"12\",\n 15: Var Pass: id: __taint_src,\n 16: Var Pass: };\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_003_T\n AffectedNodeName: __taint_sink\n 17: SINK: __taint_sink({ ...params });\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_005_T\nLine 16: __taint_sink(args)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_005_T\",\"functionName\":\"rest_parameter_005_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_005_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function rest_parameter_005_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_005_T\n AffectedNodeName: collectArgs\n 12: CALL: collectArgs([\"prefix\", __taint_src, \"suffix\"]);\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_005_T\n AffectedNodeName: __tmp1__\n 15: ARG PASS: function collectArgs(...args) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_005_T\n AffectedNodeName: args\n 15: Var Pass: function collectArgs(...args) {\n 16: Var Pass: __taint_sink(args);\n 17: Var Pass: }\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_005_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(args);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T\nLine 14: __taint_sink(array)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T\",\"functionName\":\"spread_operator_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function spread_operator_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T\n AffectedNodeName: array1\n 12: Var Pass: let array1 = [\"a\", \"b\", __taint_src];\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T\n AffectedNodeName: array\n 13: Var Pass: let array = [\"c\", ...array1];\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(array);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_003_T\nLine 21: __taint_sink(newParams)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_003_T\",\"functionName\":\"spread_operator_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function spread_operator_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_003_T\n AffectedNodeName: params\n 12: Var Pass: const params = {\n 13: Var Pass: name: \"Tony\",\n 14: Var Pass: age: \"12\",\n 15: Var Pass: id: __taint_src,\n 16: Var Pass: };\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_003_T\n AffectedNodeName: newParams\n 17: Var Pass: const newParams = {\n 18: Var Pass: score: 100,\n 19: Var Pass: ...params,\n 20: Var Pass: };\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_003_T\n AffectedNodeName: __taint_sink\n 21: SINK: __taint_sink(newParams);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_005_T\nLine 15: __taint_sink(rest)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_005_T\",\"functionName\":\"spread_operator_005_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_005_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function spread_operator_005_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_005_T\n AffectedNodeName: foo\n 12: Var Pass: const foo = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_005_T\n AffectedNodeName: __tmp2__\n 14: Var Pass: const [r1, r2, ...rest] = [123, 456, foo, bar];\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_005_T\n AffectedNodeName: rest\n 14: Var Pass: const [r1, r2, ...rest] = [123, 456, foo, bar];\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_005_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(rest);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_001_T\",\"functionName\":\"template_literal_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function template_literal_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = `_${__taint_src}`;\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_003_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_003_T\",\"functionName\":\"template_literal_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function template_literal_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_003_T\n AffectedNodeName: result\n 12: Var Pass: let result = `${__taint_src}_`;\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_003_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_005_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_005_T\",\"functionName\":\"template_literal_005_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_005_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function template_literal_005_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_005_T\n AffectedNodeName: result\n 12: Var Pass: let result = `_${__taint_src}_`;\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_005_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_001_T\nLine 20: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_001_T\",\"functionName\":\"this_expression_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function this_expression_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_001_T\n AffectedNodeName: obj\n 12: Var Pass: let obj = {\n 13: Var Pass: value: __taint_src,\n 14: Var Pass: getValue: function () {\n 15: Var Pass: return this.value;\n 16: Var Pass: },\n 17: Var Pass: };\n /jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_001_T\n AffectedNodeName: \n 19: CALL RETURN: let result = obj.getValue();\n /jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_001_T\n AffectedNodeName: result\n 19: Var Pass: let result = obj.getValue();\n /jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_001_T\n AffectedNodeName: __taint_sink\n 20: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_003_T\nLine 15: __taint_sink(this.result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_003_T\",\"functionName\":\"this_expression_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_003_T\n AffectedNodeName: __taint_src\n 13: SOURCE: function this_expression_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_003_T\n AffectedNodeName: this.result\n 14: Var Pass: this.result = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_003_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(this.result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_001_T\",\"functionName\":\"type_cast_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function type_cast_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = Number(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_003_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_003_T\",\"functionName\":\"type_cast_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function type_cast_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_003_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src == 5;\n /jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_003_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_004_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_004_T\",\"functionName\":\"type_cast_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_004_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function type_cast_004_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_004_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src == \"5\";\n /jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_004_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T\nLine 14: __taint_sink(process(__taint_src, foo))\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T\",\"functionName\":\"anonymous_function_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function anonymous_function_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T\n AffectedNodeName: process\n 14: CALL: __taint_sink(process(__taint_src, \"foo\"));\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T\n AffectedNodeName: process\n 14: CALL RETURN: __taint_sink(process(__taint_src, \"foo\"));\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(process(__taint_src, \"foo\"));\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T\nLine 12: __taint_sink(input)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T\",\"functionName\":\"anonymous_function_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function anonymous_function_004_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T\n AffectedNodeName: process\n 15: CALL: process(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T\n AffectedNodeName: input\n 11: ARG PASS: let process = function (input) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T\n AffectedNodeName: __taint_sink\n 12: SINK: __taint_sink(input);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_005_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T\nLine 12: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T\",\"functionName\":\"anonymous_function_006_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function anonymous_function_006_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T.anonymous_function_006_T.\n 11: CALL: (function () {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T.anonymous_function_006_T.\n 11: ARG PASS: (function () {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T\n AffectedNodeName: __taint_sink\n 12: SINK: __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T\nLine 12: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T\",\"functionName\":\"closure_function_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function closure_function_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T.closure_function_002_T.closure\n 14: CALL: closure();\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T.closure_function_002_T.closure\n 11: ARG PASS: let closure = function () {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T\n AffectedNodeName: __taint_sink\n 12: SINK: __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T\nLine 13: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T\",\"functionName\":\"closure_function_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function closure_function_004_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T\n AffectedNodeName: inner\n 18: CALL: innerFunction();\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T\n AffectedNodeName: inner\n 12: ARG PASS: return function inner() {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_005_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_007_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_007_T\nLine 25: __taint_sink(a.update())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_007_T\",\"functionName\":\"closure_function_007_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_007_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function closure_function_007_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_007_T\n AffectedNodeName: \n 25: CALL RETURN: __taint_sink(a.update());\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_007_T\n AffectedNodeName: __taint_sink\n 25: SINK: __taint_sink(a.update());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_009_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_009_T\nLine 18: __taint_sink(middleVar)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_009_T\",\"functionName\":\"closure_function_009_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_009_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function closure_function_009_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_009_T\n AffectedNodeName: inner\n 25: CALL: innerFunction();\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_009_T\n AffectedNodeName: inner\n 17: ARG PASS: return function inner() {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_009_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(middleVar);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_010_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_011_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_011_T\nLine 16: __taint_sink(outerVar)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_011_T\",\"functionName\":\"closure_function_011_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_011_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function closure_function_011_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_011_T\n AffectedNodeName: inner\n 23: CALL: innerFunction();\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_011_T\n AffectedNodeName: inner\n 15: ARG PASS: return function inner() {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_011_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(outerVar);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_012_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_013_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_013_T\nLine 14: __taint_sink(this.name)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_013_T\",\"functionName\":\"closure_function_013_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_013_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function closure_function_013_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_013_T\n AffectedNodeName: data\n 11: Var Pass: var data = {\n 12: Var Pass: name: __taint_src,\n 13: Var Pass: show: function () {\n 14: Var Pass: __taint_sink(this.name);\n 15: Var Pass: },\n 16: Var Pass: };\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_013_T\n AffectedNodeName: \n 17: CALL: data.show();\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_013_T\n AffectedNodeName: data\n 17: ARG PASS: data.show();\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_013_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_013_T.closure_function_013_T.\n 17: CALL: data.show();\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_013_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_013_T.closure_function_013_T.\n 13: ARG PASS: show: function () {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_013_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(this.name);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_014_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_015_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_015_T\nLine 15: __taint_sink(this.name)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_015_T\",\"functionName\":\"closure_function_015_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_015_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function closure_function_015_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_015_T\n AffectedNodeName: data\n 11: Var Pass: var data = {\n 12: Var Pass: name: __taint_src,\n 13: Var Pass: show: function () {\n 14: Var Pass: return function () {\n 15: Var Pass: __taint_sink(this.name);\n 16: Var Pass: };\n 17: Var Pass: },\n 18: Var Pass: };\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_015_T\n AffectedNodeName: \n 19: CALL: data.show().call(data);\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_015_T\n AffectedNodeName: data\n 19: ARG PASS: data.show().call(data);\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_015_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_015_T.closure_function_015_T..\n 19: CALL: data.show().call(data);\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_015_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_015_T.closure_function_015_T..\n 14: ARG PASS: return function () {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_015_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(this.name);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_016_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T\nLine 14: __taint_sink(this.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T\",\"functionName\":\"closure_function_017_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function closure_function_017_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T\n AffectedNodeName: Process\n 18: CALL: const p = new Process(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T\n AffectedNodeName: p\n 18: Var Pass: const p = new Process(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T\n AffectedNodeName: \n 19: CALL: p.show();\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T\n AffectedNodeName: p\n 19: ARG PASS: p.show();\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T.closure_function_017_T.Process.Process_scope.\n 19: CALL: p.show();\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T.closure_function_017_T.Process.Process_scope.\n 13: ARG PASS: this.show = function () {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(this.data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_default_value_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_default_value_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_default_value_002_T\nLine 15: __taint_sink(input)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_default_value_002_T\",\"functionName\":\"argument_passing_default_value_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_default_value_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function argument_passing_default_value_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_default_value_002_T\n AffectedNodeName: process\n 12: CALL: process(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_default_value_002_T\n AffectedNodeName: __tmp1__\n 14: ARG PASS: function process(input = \"default_value\") {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_default_value_002_T\n AffectedNodeName: input\n 14: Var Pass: function process(input = \"default_value\") {\n 15: Var Pass: __taint_sink(input);\n 16: Var Pass: }\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_default_value_002_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(input);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_002_T\nLine 15: __taint_sink(arg)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_002_T\",\"functionName\":\"argument_passing_normal_value_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function argument_passing_normal_value_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_002_T\n AffectedNodeName: process\n 12: CALL: process(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_002_T\n AffectedNodeName: arg\n 14: ARG PASS: function process(arg) {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_002_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(arg);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_004_T\nLine 15: __taint_sink(arg1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_004_T\",\"functionName\":\"argument_passing_normal_value_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_004_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function argument_passing_normal_value_004_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_004_T\n AffectedNodeName: process\n 12: CALL: process(__taint_src, \"_\");\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_004_T\n AffectedNodeName: arg1\n 14: ARG PASS: function process(arg1, arg2) {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_004_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(arg1);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_005_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_006_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_006_T\nLine 13: __taint_sink(innerInput)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_006_T\",\"functionName\":\"argument_passing_normal_value_006_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_006_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function argument_passing_normal_value_006_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_006_T\n AffectedNodeName: outer\n 19: CALL: outer(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_006_T\n AffectedNodeName: input\n 11: ARG PASS: function outer(input) {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_006_T\n AffectedNodeName: inner\n 16: CALL: inner(input);\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_006_T\n AffectedNodeName: innerInput\n 12: ARG PASS: function inner(innerInput) {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_006_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(innerInput);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_002_T\nLine 14: __taint_sink(obj.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_002_T\",\"functionName\":\"argument_passing_reference_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function argument_passing_reference_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_002_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(obj.data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_004_T\nLine 14: __taint_sink(arr)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_004_T\",\"functionName\":\"argument_passing_reference_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_004_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function argument_passing_reference_004_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_004_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(arr);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_005_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_006_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_006_T\nLine 16: __taint_sink(objB.name)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_006_T\",\"functionName\":\"argument_passing_reference_006_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_006_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function argument_passing_reference_006_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_006_T\n AffectedNodeName: objA\n 12: Var Pass: const objA = { name: __taint_src };\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_006_T\n AffectedNodeName: swap\n 15: CALL: swap(objA, objB);\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_006_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(objB.name);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_002_T\nLine 12: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_002_T\",\"functionName\":\"arrow_function_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function arrow_function_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_002_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_002_T.arrow_function_002_T.arrowFunction\n 13: CALL: arrowFunction();\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_002_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_002_T.arrow_function_002_T.arrowFunction\n 12: ARG PASS: let arrowFunction = () => __taint_sink(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_002_T\n AffectedNodeName: __taint_sink\n 12: SINK: let arrowFunction = () => __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_004_T\nLine 14: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_004_T\",\"functionName\":\"arrow_function_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_004_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function arrow_function_004_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_004_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_004_T.arrow_function_004_T.outer.\n 19: CALL: innerFunction();\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_004_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_004_T.arrow_function_004_T.outer.\n 13: ARG PASS: return () => {\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_004_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_005_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_006_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_006_T\nLine 15: __taint_sink(self.name)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_006_T\",\"functionName\":\"arrow_function_006_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_006_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function arrow_function_006_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_006_T\n AffectedNodeName: this.name\n 12: Var Pass: this.name = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_006_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_006_T.arrow_function_006_T.\n 17: CALL: data.show();\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_006_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_006_T.arrow_function_006_T.\n 15: ARG PASS: show: () => __taint_sink(self.name),\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_006_T\n AffectedNodeName: __taint_sink\n 15: SINK: show: () => __taint_sink(self.name),\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_007_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_008_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_008_T\nLine 16: __taint_sink(self.name)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_008_T\",\"functionName\":\"arrow_function_008_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_008_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function arrow_function_008_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_008_T\n AffectedNodeName: this.name\n 12: Var Pass: this.name = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_008_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_008_T.arrow_function_008_T..\n 19: CALL: data.show().call(data);\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_008_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_008_T.arrow_function_008_T..\n 16: ARG PASS: return () => __taint_sink(self.name);\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_008_T\n AffectedNodeName: __taint_sink\n 16: SINK: return () => __taint_sink(self.name);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_009_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T\nLine 14: __taint_sink(this.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T\",\"functionName\":\"arrow_function_010_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function arrow_function_010_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T\n AffectedNodeName: Process\n 17: CALL: const p = new Process(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T\n AffectedNodeName: p\n 17: Var Pass: const p = new Process(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T\n AffectedNodeName: \n 18: CALL: p.show();\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T\n AffectedNodeName: p\n 18: ARG PASS: p.show();\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T.arrow_function_010_T.Process.Process_scope.\n 18: CALL: p.show();\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T.arrow_function_010_T.Process.Process_scope.\n 14: ARG PASS: this.show = () => __taint_sink(this.data);\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T\n AffectedNodeName: __taint_sink\n 14: SINK: this.show = () => __taint_sink(this.data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/chained_call/chained_call_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T\nLine 28: __taint_sink(this.name)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T\",\"functionName\":\"chained_call_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function chained_call_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T\n AffectedNodeName: setName\n 32: CALL: new A().setName(\"_\").clearName().setName(__taint_src).process();\n /jsbenchmark/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T\n AffectedNodeName: setName\n 32: CALL RETURN: new A().setName(\"_\").clearName().setName(__taint_src).process();\n /jsbenchmark/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T\n AffectedNodeName: process\n 32: CALL: new A().setName(\"_\").clearName().setName(__taint_src).process();\n /jsbenchmark/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T\n AffectedNodeName: new A().setName(_).clearName().setName(__taint_src\n 32: ARG PASS: new A().setName(\"_\").clearName().setName(__taint_src).process();\n /jsbenchmark/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T\n AffectedNodeName: process\n 32: CALL: new A().setName(\"_\").clearName().setName(__taint_src).process();\n /jsbenchmark/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T\n AffectedNodeName: process\n 27: ARG PASS: process() {\n /jsbenchmark/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T\n AffectedNodeName: __taint_sink\n 28: SINK: __taint_sink(this.name);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_decorator_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_decorator_002_T":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_decorator_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_decorator_004_T":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_member_decorator_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_member_decorator_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_member_decorator_002_T\nLine 18: __taint_sink(taintData)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_member_decorator_002_T\",\"functionName\":\"class_member_decorator_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_member_decorator_002_T\n AffectedNodeName: __taint_src\n 13: SOURCE: function class_member_decorator_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_member_decorator_002_T\n AffectedNodeName: \n 29: CALL: instance.someMethod(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_member_decorator_002_T\n AffectedNodeName: __tmp1__\n 16: ARG PASS: return function (...args) {\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_member_decorator_002_T\n AffectedNodeName: args\n 16: Var Pass: return function (...args) {\n 17: Var Pass: const taintData = args[0];\n 18: Var Pass: __taint_sink(taintData);\n 19: Var Pass: return originalMethod.apply(this, args);\n 20: Var Pass: };\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_member_decorator_002_T\n AffectedNodeName: taintData\n 17: Var Pass: const taintData = args[0];\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_member_decorator_002_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(taintData);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_002_T\nLine 14: __taint_sink(args)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_002_T\",\"functionName\":\"function_decorator_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function function_decorator_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_002_T\n AffectedNodeName: \n 20: CALL: decoratedFunction(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_002_T\n AffectedNodeName: __tmp1__\n 13: ARG PASS: return function (...args) {\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_002_T\n AffectedNodeName: args\n 13: Var Pass: return function (...args) {\n 14: Var Pass: __taint_sink(args);\n 15: Var Pass: return targetFunction.apply(this, args);\n 16: Var Pass: };\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_002_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(args);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T\nLine 19: __taint_sink(input)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T\",\"functionName\":\"function_decorator_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function function_decorator_004_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T\n AffectedNodeName: \n 21: CALL: decoratedFunction(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T\n AffectedNodeName: __tmp1__\n 13: ARG PASS: return function (...args) {\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T\n AffectedNodeName: args\n 13: Var Pass: return function (...args) {\n 14: Var Pass: return targetFunction.apply(this, args);\n 15: Var Pass: };\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T.function_decorator_004_T.\n 14: CALL: return targetFunction.apply(this, args);\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T.function_decorator_004_T.\n 18: ARG PASS: const decoratedFunction = taintDecorator(function (input) {\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T\n AffectedNodeName: __taint_sink\n 19: SINK: __taint_sink(input);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/generator_function/generator_function_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/generator_function/generator_function_002_T":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/generator_function/generator_function_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/generator_function/generator_function_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/generator_function/generator_function_004_T\nLine 21: __taint_sink(g.next(__taint_src).value)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/generator_function/generator_function_004_T\",\"functionName\":\"generator_function_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/generator_function/generator_function_004_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function generator_function_004_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/generator_function/generator_function_004_T\n AffectedNodeName: __taint_sink\n 21: SINK: __taint_sink(g.next(__taint_src).value);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T\nLine 19: __taint_sink(f(__taint_src, _)())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T\",\"functionName\":\"higher_order_function_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function higher_order_function_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T\n AffectedNodeName: f\n 19: CALL: __taint_sink(f(__taint_src, \"_\")());\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T\n AffectedNodeName: \n 19: CALL RETURN: __taint_sink(f(__taint_src, \"_\")());\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T\n AffectedNodeName: __taint_sink\n 19: SINK: __taint_sink(f(__taint_src, \"_\")());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T\nLine 23: __taint_sink(f(g, __taint_src, _)())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T\",\"functionName\":\"higher_order_function_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function higher_order_function_004_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T\n AffectedNodeName: f\n 23: CALL: __taint_sink(f(g, __taint_src, \"_\")());\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T\n AffectedNodeName: \n 23: CALL RETURN: __taint_sink(f(g, __taint_src, \"_\")());\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T\n AffectedNodeName: __taint_sink\n 23: SINK: __taint_sink(f(g, __taint_src, \"_\")());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_005_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T\nLine 27: __taint_sink(f(g, u, __taint_src, _)())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T\",\"functionName\":\"higher_order_function_006_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function higher_order_function_006_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T\n AffectedNodeName: f\n 27: CALL: __taint_sink(f(g, u, __taint_src, \"_\")());\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T\n AffectedNodeName: \n 27: CALL RETURN: __taint_sink(f(g, u, __taint_src, \"_\")());\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T\n AffectedNodeName: __taint_sink\n 27: SINK: __taint_sink(f(g, u, __taint_src, \"_\")());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_007_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T\nLine 17: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T\",\"functionName\":\"higher_order_function_008_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function higher_order_function_008_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T\n AffectedNodeName: higherOrderFunction\n 16: CALL RETURN: const result = higherOrderFunction((a, b) => a + b);\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T\n AffectedNodeName: result\n 16: Var Pass: const result = higherOrderFunction((a, b) => a + b);\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T\n AffectedNodeName: __taint_sink\n 17: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_009_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_010_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_010_T\nLine 19: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_010_T\",\"functionName\":\"higher_order_function_010_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_010_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function higher_order_function_010_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_010_T\n AffectedNodeName: higherOrderFunction\n 16: CALL RETURN: const result = higherOrderFunction(function (a, b) {\n 17: CALL RETURN: return a + b;\n 18: CALL RETURN: });\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_010_T\n AffectedNodeName: result\n 16: Var Pass: const result = higherOrderFunction(function (a, b) {\n 17: Var Pass: return a + b;\n 18: Var Pass: });\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_010_T\n AffectedNodeName: __taint_sink\n 19: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/library_function/json_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/library_function/json_001_T\nLine 15: __taint_sink(obj)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/library_function/json_001_T\",\"functionName\":\"json_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/library_function/json_001_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function json_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/library_function/json_001_T\n AffectedNodeName: process\n 11: CALL: process(JSON.stringify(__taint_src));\n /jsbenchmark/completeness/single_app_tracing/function_call/library_function/json_001_T\n AffectedNodeName: arg\n 13: ARG PASS: function process(arg) {\n /jsbenchmark/completeness/single_app_tracing/function_call/library_function/json_001_T\n AffectedNodeName: obj\n 14: Var Pass: let obj = JSON.parse(arg);\n /jsbenchmark/completeness/single_app_tracing/function_call/library_function/json_001_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(obj);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/library_function/json_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/library_function/string_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/library_function/string_001_T\nLine 15: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/library_function/string_001_T\",\"functionName\":\"string_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/library_function/string_001_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function string_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/library_function/string_001_T\n AffectedNodeName: process\n 11: CALL: process(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/library_function/string_001_T\n AffectedNodeName: arg\n 13: ARG PASS: function process(arg) {\n /jsbenchmark/completeness/single_app_tracing/function_call/library_function/string_001_T\n AffectedNodeName: result\n 14: Var Pass: let result = arg.trim();\n /jsbenchmark/completeness/single_app_tracing/function_call/library_function/string_001_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/library_function/string_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_001_T\nLine 31: __taint_sink(this.getData())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_001_T\",\"functionName\":\"constructor_extends_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_001_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function constructor_extends_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_001_T\n AffectedNodeName: constructor\n 35: CALL: const derived = new DerivedClass(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_001_T\n AffectedNodeName: derived\n 35: Var Pass: const derived = new DerivedClass(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_001_T\n AffectedNodeName: process\n 36: CALL: derived.process();\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_001_T\n AffectedNodeName: derived\n 36: ARG PASS: derived.process();\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_001_T\n AffectedNodeName: process\n 36: CALL: derived.process();\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_001_T\n AffectedNodeName: process\n 30: ARG PASS: process() {\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_001_T\n AffectedNodeName: getData\n 31: CALL RETURN: __taint_sink(this.getData());\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_001_T\n AffectedNodeName: __taint_sink\n 31: SINK: __taint_sink(this.getData());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_003_T\nLine 29: __taint_sink(this.getData())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_003_T\",\"functionName\":\"constructor_extends_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_003_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function constructor_extends_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_003_T\n AffectedNodeName: derived\n 33: Var Pass: const derived = new DerivedClass();\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_003_T\n AffectedNodeName: process\n 34: CALL: derived.process();\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_003_T\n AffectedNodeName: derived\n 34: ARG PASS: derived.process();\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_003_T\n AffectedNodeName: process\n 34: CALL: derived.process();\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_003_T\n AffectedNodeName: process\n 28: ARG PASS: process() {\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_003_T\n AffectedNodeName: getData\n 29: CALL RETURN: __taint_sink(this.getData());\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_003_T\n AffectedNodeName: __taint_sink\n 29: SINK: __taint_sink(this.getData());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T\nLine 26: __taint_sink(sub.call())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T\",\"functionName\":\"polymorphism_override_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function polymorphism_override_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T\n AffectedNodeName: call\n 26: CALL RETURN: __taint_sink(sub.call());\n /jsbenchmark/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T\n AffectedNodeName: __taint_sink\n 26: SINK: __taint_sink(sub.call());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/override/polymorphism_override_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/override/prototype_extends_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/override/prototype_extends_001_T\nLine 27: __taint_sink(instance.getChValue())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/override/prototype_extends_001_T\",\"functionName\":\"prototype_extends_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/override/prototype_extends_001_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function prototype_extends_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/override/prototype_extends_001_T\n AffectedNodeName: instance\n 26: Var Pass: let instance = new Child();\n /jsbenchmark/completeness/single_app_tracing/function_call/override/prototype_extends_001_T\n AffectedNodeName: \n 27: CALL RETURN: __taint_sink(instance.getChValue());\n /jsbenchmark/completeness/single_app_tracing/function_call/override/prototype_extends_001_T\n AffectedNodeName: __taint_sink\n 27: SINK: __taint_sink(instance.getChValue());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/override/prototype_extends_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/return_value_passing/return_normal_value_passing_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/return_value_passing/return_normal_value_passing_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/return_value_passing/return_normal_value_passing_002_T\nLine 13: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/return_value_passing/return_normal_value_passing_002_T\",\"functionName\":\"return_normal_value_passing_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/return_value_passing/return_normal_value_passing_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function return_normal_value_passing_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/return_value_passing/return_normal_value_passing_002_T\n AffectedNodeName: process\n 12: CALL RETURN: let data = process();\n /jsbenchmark/completeness/single_app_tracing/function_call/return_value_passing/return_normal_value_passing_002_T\n AffectedNodeName: data\n 12: Var Pass: let data = process();\n /jsbenchmark/completeness/single_app_tracing/function_call/return_value_passing/return_normal_value_passing_002_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/static_method/static_method_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/static_method/static_method_001_T\nLine 13: __taint_sink(arg)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/static_method/static_method_001_T\",\"functionName\":\"static_method_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/static_method/static_method_001_T\n AffectedNodeName: __taint_src\n 17: SOURCE: function static_method_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/static_method/static_method_001_T\n AffectedNodeName: process\n 18: CALL: MyClass.process(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/static_method/static_method_001_T\n AffectedNodeName: arg\n 12: ARG PASS: static process(arg) {\n /jsbenchmark/completeness/single_app_tracing/function_call/static_method/static_method_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(arg);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/static_method/static_method_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/tagged_template_literals/tagged_template_literal_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/tagged_template_literals/tagged_template_literal_002_T":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/variable_scope/private_scope/private_variable_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/variable_scope/private_scope/private_variable_001_T\nLine 22: __taint_sink(o.GetData())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/variable_scope/private_scope/private_variable_001_T\",\"functionName\":\"private_variable_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/variable_scope/private_scope/private_variable_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function private_variable_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/variable_scope/private_scope/private_variable_001_T\n AffectedNodeName: data\n 13: Var Pass: #data = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/variable_scope/private_scope/private_variable_001_T\n AffectedNodeName: o\n 21: Var Pass: let o = new A();\n /jsbenchmark/completeness/single_app_tracing/variable_scope/private_scope/private_variable_001_T\n AffectedNodeName: GetData\n 22: CALL RETURN: __taint_sink(o.GetData());\n /jsbenchmark/completeness/single_app_tracing/variable_scope/private_scope/private_variable_001_T\n AffectedNodeName: __taint_sink\n 22: SINK: __taint_sink(o.GetData());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/variable_scope/private_scope/private_variable_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_001_T\nLine 16: __taint_sink(A.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_001_T\",\"functionName\":\"static_variable_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function static_variable_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_001_T\n AffectedNodeName: data\n 13: Var Pass: static data = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_001_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(A.data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\nLine 27: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\",\"functionName\":\"static_variable_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function static_variable_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\n AffectedNodeName: data\n 13: Var Pass: static data = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\n AffectedNodeName: processA\n 32: CALL: a.processA();\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\n AffectedNodeName: processA\n 15: ARG PASS: processA() {\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\n AffectedNodeName: test\n 16: CALL: this.test();\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\n AffectedNodeName: test\n 19: ARG PASS: test() {\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\n AffectedNodeName: processB\n 20: CALL: new B().processB();\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\n AffectedNodeName: processB\n 25: ARG PASS: processB() {\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\n AffectedNodeName: data\n 26: Var Pass: const data = A.data;\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\n AffectedNodeName: __taint_sink\n 27: SINK: __taint_sink(data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_004_F":"======================== Findings ========================\nNo findings!\n=========================================================="} \ No newline at end of file +{"/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_001_T\nLine 14: __taint_sink(arg)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_001_T\",\"functionName\":\"argument_passing_value_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_001_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function argument_passing_value_001_T(__taint_src) {\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_001_T\n AffectedNodeName: process\n 11: CALL: process(__taint_src);\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_001_T\n AffectedNodeName: arg\n 13: ARG PASS: function process(arg) {\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(arg);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_003_T\nLine 15: __taint_sink(arg1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_003_T\",\"functionName\":\"argument_passing_value_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function argument_passing_value_003_T(__taint_src) {\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_003_T\n AffectedNodeName: process\n 12: CALL: process(__taint_src, \"_\");\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_003_T\n AffectedNodeName: arg1\n 14: ARG PASS: function process(arg1, arg2) {\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_003_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(arg1);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/argument_passing_value_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_001_T\nLine 12: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_001_T\",\"functionName\":\"return_value_passing_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_001_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function return_value_passing_001_T(__taint_src) {\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_001_T\n AffectedNodeName: process\n 11: CALL RETURN: let data = process();\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_001_T\n AffectedNodeName: data\n 11: Var Pass: let data = process();\n /jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_001_T\n AffectedNodeName: __taint_sink\n 12: SINK: __taint_sink(data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/context_sensitive/argument_return_value_passing/return_value_passing_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/context_sensitive/multi_invoke/multi_invoke_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/context_sensitive/multi_invoke/multi_invoke_001_T\nLine 13: __taint_sink(a)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/context_sensitive/multi_invoke/multi_invoke_001_T\",\"functionName\":\"multi_invoke_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/context_sensitive/multi_invoke/multi_invoke_001_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function multi_invoke_001_T(__taint_src) {\n /jsbenchmark/accuracy/context_sensitive/multi_invoke/multi_invoke_001_T\n AffectedNodeName: process\n 11: CALL: let a = process(__taint_src);\n /jsbenchmark/accuracy/context_sensitive/multi_invoke/multi_invoke_001_T\n AffectedNodeName: process\n 11: CALL RETURN: let a = process(__taint_src);\n /jsbenchmark/accuracy/context_sensitive/multi_invoke/multi_invoke_001_T\n AffectedNodeName: a\n 11: Var Pass: let a = process(__taint_src);\n /jsbenchmark/accuracy/context_sensitive/multi_invoke/multi_invoke_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(a);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/context_sensitive/multi_invoke/multi_invoke_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/context_sensitive/polymorphism/no_solver/polymorphism_no_solver_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/context_sensitive/polymorphism/no_solver/polymorphism_no_solver_001_T\nLine 26: __taint_sink(sub.call())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/context_sensitive/polymorphism/no_solver/polymorphism_no_solver_001_T\",\"functionName\":\"polymorphism_no_solver_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/context_sensitive/polymorphism/no_solver/polymorphism_no_solver_001_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function polymorphism_no_solver_001_T(__taint_src) {\n /jsbenchmark/accuracy/context_sensitive/polymorphism/no_solver/polymorphism_no_solver_001_T\n AffectedNodeName: call\n 26: CALL RETURN: __taint_sink(sub.call());\n /jsbenchmark/accuracy/context_sensitive/polymorphism/no_solver/polymorphism_no_solver_001_T\n AffectedNodeName: __taint_sink\n 26: SINK: __taint_sink(sub.call());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/context_sensitive/polymorphism/no_solver/polymorphism_no_solver_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/context_sensitive/polymorphism/solver/polymorphism_001_T":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/context_sensitive/polymorphism/solver/polymorphism_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/class/constructor_field_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/class/constructor_field_001_T\nLine 20: __taint_sink(obj.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/class/constructor_field_001_T\",\"functionName\":\"constructor_field_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/class/constructor_field_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function constructor_field_001_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/class/constructor_field_001_T\n AffectedNodeName: obj\n 19: Var Pass: let obj = new A();\n /jsbenchmark/accuracy/field_sensitive/class/constructor_field_001_T\n AffectedNodeName: __taint_sink\n 20: SINK: __taint_sink(obj.data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/class/constructor_field_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/class/constructor_field_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/class/constructor_field_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/class/constructor_field_004_T\nLine 20: __taint_sink(obj.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/class/constructor_field_004_T\",\"functionName\":\"constructor_field_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/class/constructor_field_004_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function constructor_field_004_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/class/constructor_field_004_T\n AffectedNodeName: constructor\n 19: CALL: let obj = new A(__taint_src);\n /jsbenchmark/accuracy/field_sensitive/class/constructor_field_004_T\n AffectedNodeName: obj\n 19: Var Pass: let obj = new A(__taint_src);\n /jsbenchmark/accuracy/field_sensitive/class/constructor_field_004_T\n AffectedNodeName: __taint_sink\n 20: SINK: __taint_sink(obj.data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/class/field_len_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/class/field_len_001_T\nLine 32: __taint_sink(a.b.c.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/class/field_len_001_T\",\"functionName\":\"field_len_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/class/field_len_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function field_len_001_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/class/field_len_001_T\n AffectedNodeName: a\n 31: Var Pass: const a = new A();\n /jsbenchmark/accuracy/field_sensitive/class/field_len_001_T\n AffectedNodeName: __taint_sink\n 32: SINK: __taint_sink(a.b.c.data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/class/field_len_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/class/field_len_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/class/field_len_003_T\nLine 52: __taint_sink(s1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/class/field_len_003_T\",\"functionName\":\"field_len_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/class/field_len_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function field_len_003_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/class/field_len_003_T\n AffectedNodeName: a\n 49: Var Pass: const a = new A();\n /jsbenchmark/accuracy/field_sensitive/class/field_len_003_T\n AffectedNodeName: s\n 50: Var Pass: const s = a.b.c;\n /jsbenchmark/accuracy/field_sensitive/class/field_len_003_T\n AffectedNodeName: s1\n 51: Var Pass: const s1 = s.d.e.f.data;\n /jsbenchmark/accuracy/field_sensitive/class/field_len_003_T\n AffectedNodeName: __taint_sink\n 52: SINK: __taint_sink(s1);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/class/field_len_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/class/field_len_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/class/field_len_005_T\nLine 86: __taint_sink(a.b.c.d.e.f.g.h.i.j.k.l.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/class/field_len_005_T\",\"functionName\":\"field_len_005_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/class/field_len_005_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function field_len_005_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/class/field_len_005_T\n AffectedNodeName: a\n 85: Var Pass: const a = new A();\n /jsbenchmark/accuracy/field_sensitive/class/field_len_005_T\n AffectedNodeName: __taint_sink\n 86: SINK: __taint_sink(a.b.c.d.e.f.g.h.i.j.k.l.data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/class/field_len_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/multidimensional_collection/array_multidimensional_collection_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/multidimensional_collection/array_multidimensional_collection_001_T\nLine 13: __taint_sink(s.0.0)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/multidimensional_collection/array_multidimensional_collection_001_T\",\"functionName\":\"array_multidimensional_collection_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/multidimensional_collection/array_multidimensional_collection_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function array_multidimensional_collection_001_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/multidimensional_collection/array_multidimensional_collection_001_T\n AffectedNodeName: s\n 12: Var Pass: let s = [[__taint_src], [\"b\"], \"c\"];\n /jsbenchmark/accuracy/field_sensitive/multidimensional_collection/array_multidimensional_collection_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(s[0][0]);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/multidimensional_collection/array_multidimensional_collection_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_001_T\nLine 13: __taint_sink(s.0)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_001_T\",\"functionName\":\"array_no_solver_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function array_no_solver_001_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_001_T\n AffectedNodeName: s\n 12: Var Pass: let s = [__taint_src, \"b\", \"c\"];\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(s[0]);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_003_T\nLine 14: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_003_T\",\"functionName\":\"array_no_solver_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function array_no_solver_003_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_003_T\n AffectedNodeName: s\n 12: Var Pass: let s = [__taint_src, \"b\", \"c\"];\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_003_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(s);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/array_no_solver_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T\nLine 15: __taint_sink(map.get(key1))\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T\",\"functionName\":\"map_field_sensitive_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function map_field_sensitive_001_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T\n AffectedNodeName: set\n 13: CALL: map.set(\"key1\", __taint_src);\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_001_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(map.get(\"key1\"));\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T\nLine 17: __taint_sink(map.get(key2))\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T\",\"functionName\":\"map_field_sensitive_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function map_field_sensitive_004_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T\n AffectedNodeName: set\n 15: CALL: map.set(\"key2\", __taint_src);\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_004_T\n AffectedNodeName: __taint_sink\n 17: SINK: __taint_sink(map.get(\"key2\"));\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_005_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_006_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_006_T\nLine 15: __taint_sink(map.values())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_006_T\",\"functionName\":\"map_field_sensitive_006_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_006_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function map_field_sensitive_006_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_006_T\n AffectedNodeName: set\n 13: CALL: map.set(\"key1\", __taint_src);\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_006_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(map.values());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_007_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_008_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_008_T\nLine 15: __taint_sink(map.keys())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_008_T\",\"functionName\":\"map_field_sensitive_008_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_008_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function map_field_sensitive_008_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_008_T\n AffectedNodeName: set\n 13: CALL: map.set(__taint_src, \"value1\");\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_008_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(map.keys());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/map_field_sensitive_009_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/rest_parameter_no_solver_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/rest_parameter_no_solver_001_T\nLine 16: __taint_sink(args.1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/rest_parameter_no_solver_001_T\",\"functionName\":\"rest_parameter_no_solver_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/rest_parameter_no_solver_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function rest_parameter_no_solver_001_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/rest_parameter_no_solver_001_T\n AffectedNodeName: collectArgs\n 12: CALL: collectArgs(\"prefix\", __taint_src, \"suffix\");\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/rest_parameter_no_solver_001_T\n AffectedNodeName: __tmp1__\n 15: ARG PASS: function collectArgs(...args) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/rest_parameter_no_solver_001_T\n AffectedNodeName: args\n 15: Var Pass: function collectArgs(...args) {\n 16: Var Pass: __taint_sink(args[1]);\n 17: Var Pass: }\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/rest_parameter_no_solver_001_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(args[1]);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/rest_parameter_no_solver_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_001_T\nLine 15: __taint_sink(rest.0)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_001_T\",\"functionName\":\"spread_operator_no_solver_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function spread_operator_no_solver_001_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_001_T\n AffectedNodeName: foo\n 12: Var Pass: const foo = __taint_src;\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_001_T\n AffectedNodeName: __tmp2__\n 14: Var Pass: const [r1, r2, ...rest] = [123, 456, foo, bar];\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_001_T\n AffectedNodeName: rest\n 14: Var Pass: const [r1, r2, ...rest] = [123, 456, foo, bar];\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_001_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(rest[0]);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_003_T\nLine 14: __taint_sink(array.3)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_003_T\",\"functionName\":\"spread_operator_no_solver_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function spread_operator_no_solver_003_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_003_T\n AffectedNodeName: array1\n 12: Var Pass: let array1 = [\"a\", \"b\", __taint_src];\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_003_T\n AffectedNodeName: array\n 13: Var Pass: let array = [\"c\", ...array1];\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_003_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(array[3]);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_no_solver/spread_operator_no_solver_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_001_T\nLine 13: __taint_sink(s.1+1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_001_T\",\"functionName\":\"array_solver_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function array_solver_001_T(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_001_T\n AffectedNodeName: s\n 12: Var Pass: let s = [\"a\", \"b\", __taint_src, \"c\", \"d\"];\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(s[1 + 1]);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_002_F\nLine 13: __taint_sink(s.1+2)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_002_F\",\"functionName\":\"array_solver_002_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_002_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function array_solver_002_F(__taint_src) {\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_002_F\n AffectedNodeName: s\n 12: Var Pass: let s = [\"a\", \"b\", __taint_src, \"c\", \"d\"];\n /jsbenchmark/accuracy/field_sensitive/one_dimensional_collection/numeric_index_state_solver/array_solver_002_F\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(s[1 + 2]);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/flow_sensitive/asynchronous/asynchronous_await_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/flow_sensitive/asynchronous/asynchronous_await_001_T\nLine 14: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/flow_sensitive/asynchronous/asynchronous_await_001_T\",\"functionName\":\"asynchronous_await_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/flow_sensitive/asynchronous/asynchronous_await_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: async function asynchronous_await_001_T(__taint_src) {\n /jsbenchmark/accuracy/flow_sensitive/asynchronous/asynchronous_await_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/flow_sensitive/asynchronous/asynchronous_await_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_001_T\nLine 15: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_001_T\",\"functionName\":\"dowhile_body_loop_stmt_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function dowhile_body_loop_stmt_001_T(__taint_src) {\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_001_T\n AffectedNodeName: res\n 14: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_001_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_002_F\nLine 14: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_002_F\",\"functionName\":\"dowhile_body_loop_stmt_002_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_002_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function dowhile_body_loop_stmt_002_F(__taint_src) {\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_002_F\n AffectedNodeName: res\n 15: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/dowhile_body_loop_stmt_002_F\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_001_T\nLine 16: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_001_T\",\"functionName\":\"for_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function for_001_T(__taint_src) {\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_001_T\n AffectedNodeName: res\n 15: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_001_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_002_F\nLine 15: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_002_F\",\"functionName\":\"for_002_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_002_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function for_002_F(__taint_src) {\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_002_F\n AffectedNodeName: res\n 16: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_002_F\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_003_T\nLine 15: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_003_T\",\"functionName\":\"for_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function for_003_T(__taint_src) {\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_003_T\n AffectedNodeName: res\n 14: Var Pass: for (res = __taint_src; i < 1; i++) {\n /jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_003_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/flow_sensitive/loop_stmt/for_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/flow_sensitive/normal_stmt/assign_expression_stmt_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/flow_sensitive/normal_stmt/assign_expression_stmt_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/flow_sensitive/normal_stmt/assign_expression_stmt_001_T\",\"functionName\":\"assign_expression_stmt_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/flow_sensitive/normal_stmt/assign_expression_stmt_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function assign_expression_stmt_001_T(__taint_src) {\n /jsbenchmark/accuracy/flow_sensitive/normal_stmt/assign_expression_stmt_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src;\n /jsbenchmark/accuracy/flow_sensitive/normal_stmt/assign_expression_stmt_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/flow_sensitive/normal_stmt/assign_expression_stmt_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/object_sensitive/class/constructor_obj_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/object_sensitive/class/constructor_obj_001_T\nLine 20: __taint_sink(obj)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/object_sensitive/class/constructor_obj_001_T\",\"functionName\":\"constructor_obj_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/object_sensitive/class/constructor_obj_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function constructor_obj_001_T(__taint_src) {\n /jsbenchmark/accuracy/object_sensitive/class/constructor_obj_001_T\n AffectedNodeName: constructor\n 18: CALL: let obj = new A(__taint_src);\n /jsbenchmark/accuracy/object_sensitive/class/constructor_obj_001_T\n AffectedNodeName: obj\n 18: Var Pass: let obj = new A(__taint_src);\n /jsbenchmark/accuracy/object_sensitive/class/constructor_obj_001_T\n AffectedNodeName: __taint_sink\n 20: SINK: __taint_sink(obj);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/object_sensitive/class/constructor_obj_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_001_T\nLine 14: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_001_T\",\"functionName\":\"array_object_sensitive_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function array_object_sensitive_001_T(__taint_src) {\n /jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_001_T\n AffectedNodeName: s\n 12: Var Pass: let s = [__taint_src, \"b\", \"c\"];\n /jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(s);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_003_T\nLine 14: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_003_T\",\"functionName\":\"array_object_sensitive_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function array_object_sensitive_003_T(__taint_src) {\n /jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_003_T\n AffectedNodeName: s\n 12: Var Pass: let s = [[__taint_src], [\"b\"], \"c\"];\n /jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_003_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(s);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_005_T\nLine 16: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_005_T\",\"functionName\":\"array_object_sensitive_005_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_005_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function array_object_sensitive_005_T(__taint_src) {\n /jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_005_T\n AffectedNodeName: push\n 13: CALL: s.push(__taint_src);\n /jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_005_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(s);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/array_object_sensitive_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_001_T\nLine 16: __taint_sink(map)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_001_T\",\"functionName\":\"map_object_sensitive_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function map_object_sensitive_001_T(__taint_src) {\n /jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_001_T\n AffectedNodeName: set\n 13: CALL: map.set(\"key1\", __taint_src);\n /jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_001_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(map);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_003_T\nLine 16: __taint_sink(map)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_003_T\",\"functionName\":\"map_object_sensitive_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function map_object_sensitive_003_T(__taint_src) {\n /jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_003_T\n AffectedNodeName: set\n 13: CALL: map.set(__taint_src, \"value\");\n /jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_003_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(map);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_005_T\nLine 16: __taint_sink(map)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_005_T\",\"functionName\":\"map_object_sensitive_005_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_005_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function map_object_sensitive_005_T(__taint_src) {\n /jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_005_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(map);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/map_object_sensitive_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_001_T\nLine 14: __taint_sink(set)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_001_T\",\"functionName\":\"set_object_sensitive_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function set_object_sensitive_001_T(__taint_src) {\n /jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_001_T\n AffectedNodeName: set\n 12: Var Pass: let set = new Set(__taint_src);\n /jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(set);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_003_T\nLine 15: __taint_sink(set)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_003_T\",\"functionName\":\"set_object_sensitive_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function set_object_sensitive_003_T(__taint_src) {\n /jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_003_T\n AffectedNodeName: add\n 13: CALL: set.add(__taint_src);\n /jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_003_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(set);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/object_sensitive/collection/set_object_sensitive_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_001_T\nLine 13: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_001_T\",\"functionName\":\"exception_throw_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function exception_throw_001_T(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_002_F\nLine 14: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_002_F\",\"functionName\":\"exception_throw_002_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_002_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function exception_throw_002_F(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_002_F\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_003_T\nLine 15: __taint_sink(e)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_003_T\",\"functionName\":\"exception_throw_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function exception_throw_003_T(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_003_T\n AffectedNodeName: __taint_src\n 13: Var Pass: throw __taint_src;\n /jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_003_T\n AffectedNodeName: e\n 14: Var Pass: } catch (e) {\n /jsbenchmark/accuracy/path_sensitive/exception_throw/exception_throw_003_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(e);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F\",\"functionName\":\"break_001_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function break_001_F(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F\n AffectedNodeName: res\n 15: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(res);\n\n------------- 2: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F\",\"functionName\":\"break_001_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function break_001_F(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F\n AffectedNodeName: res\n 15: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F\n AffectedNodeName: __taint_sink\n 18: CALL: __taint_sink(res);\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_001_F\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:2\n==========================================================","/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T\nLine 17: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T\",\"functionName\":\"break_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function break_002_T(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T\n AffectedNodeName: res\n 15: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T\n AffectedNodeName: __taint_sink\n 17: SINK: __taint_sink(res);\n\n------------- 2: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T\nLine 17: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T\",\"functionName\":\"break_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function break_002_T(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T\n AffectedNodeName: res\n 15: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T\n AffectedNodeName: __taint_sink\n 17: CALL: __taint_sink(res);\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_002_T\n AffectedNodeName: __taint_sink\n 17: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:2\n==========================================================","/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_label_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/break_label_002_T":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T\",\"functionName\":\"continue_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function continue_001_T(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T\n AffectedNodeName: res\n 15: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(res);\n\n------------- 2: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T\",\"functionName\":\"continue_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function continue_001_T(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T\n AffectedNodeName: res\n 15: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T\n AffectedNodeName: __taint_sink\n 18: CALL: __taint_sink(res);\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_001_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:2\n==========================================================","/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_002_F\nLine 15: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_002_F\",\"functionName\":\"continue_002_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_002_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function continue_002_F(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_002_F\n AffectedNodeName: res\n 16: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/continue_002_F\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/return_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/return_001_T\nLine 16: __taint_sink(arg1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/return_001_T\",\"functionName\":\"return_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/return_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function return_001_T(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/return_001_T\n AffectedNodeName: process\n 12: CALL: process(__taint_src, \"some_condition\");\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/return_001_T\n AffectedNodeName: arg1\n 14: ARG PASS: function process(arg1, arg2) {\n /jsbenchmark/accuracy/path_sensitive/explicit_jump_control/return_001_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(arg1);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/explicit_jump_control/return_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_no_solver_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_no_solver_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_no_solver_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_no_solver_003_T\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_no_solver_003_T\",\"functionName\":\"conditional_if_no_solver_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_no_solver_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function conditional_if_no_solver_003_T(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_no_solver_003_T\n AffectedNodeName: res\n 16: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_no_solver_003_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_if_no_solver_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_no_solver_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_no_solver_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_no_solver_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_no_solver_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_no_solver_004_T\nLine 18: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_no_solver_004_T\",\"functionName\":\"conditional_switch_no_solver_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_no_solver_004_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function conditional_switch_no_solver_004_T(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_no_solver_004_T\n AffectedNodeName: data\n 15: Var Pass: data = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/no_solver/conditional_switch_no_solver_004_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_001_T\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_001_T\",\"functionName\":\"conditional_if_solver_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function conditional_if_solver_001_T(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_001_T\n AffectedNodeName: res\n 14: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_001_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_002_F\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_002_F\",\"functionName\":\"conditional_if_solver_002_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_002_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function conditional_if_solver_002_F(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_002_F\n AffectedNodeName: res\n 14: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_if_solver_002_F\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_001_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_001_F\nLine 18: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_001_F\",\"functionName\":\"conditional_switch_solver_001_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_001_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function conditional_switch_solver_001_F(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_001_F\n AffectedNodeName: data\n 15: Var Pass: data = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_001_F\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_002_T\nLine 18: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_002_T\",\"functionName\":\"conditional_switch_solver_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function conditional_switch_solver_002_T(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_002_T\n AffectedNodeName: data\n 15: Var Pass: data = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/conditional_switch_solver_002_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_solver_001_T":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_solver_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_solver_002_F\nLine 16: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_solver_002_F\",\"functionName\":\"for_body_solver_002_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_solver_002_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function for_body_solver_002_F(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_solver_002_F\n AffectedNodeName: res\n 14: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/for_body_solver_002_F\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/while_body_solver_001_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/while_body_solver_001_F\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/while_body_solver_001_F\",\"functionName\":\"while_body_solver_001_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/while_body_solver_001_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function while_body_solver_001_F(__taint_src) {\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/while_body_solver_001_F\n AffectedNodeName: res\n 15: Var Pass: res = __taint_src;\n /jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/while_body_solver_001_F\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/accuracy/path_sensitive/loop_conditional_stmt/solver/while_body_solver_002_T":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_002_T\nLine 16: __taint_sink(Reflect.get(obj, name))\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_002_T\",\"functionName\":\"dynamic_call_reflect_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function dynamic_call_reflect_002_T(__taint_src) {\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_002_T\n AffectedNodeName: obj\n 12: Var Pass: let obj = {\n 13: Var Pass: name: __taint_src,\n 14: Var Pass: };\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_002_T\n AffectedNodeName: get\n 16: CALL: __taint_sink(Reflect.get(obj, \"name\"));\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_002_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(Reflect.get(obj, \"name\"));\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_003_T\nLine 17: __taint_sink(obj.foo)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_003_T\",\"functionName\":\"dynamic_call_reflect_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function dynamic_call_reflect_003_T(__taint_src) {\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_003_T\n AffectedNodeName: set\n 16: CALL: Reflect.set(obj, \"foo\", __taint_src);\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_003_T\n AffectedNodeName: \n 16: Reflect.set Pass: Reflect.set(obj, \"foo\", __taint_src);\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_003_T\n AffectedNodeName: __taint_sink\n 17: SINK: __taint_sink(obj.foo);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_005_T\nLine 18: __taint_sink(obj.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_005_T\",\"functionName\":\"dynamic_call_reflect_005_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_005_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function dynamic_call_reflect_005_T(__taint_src) {\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_005_T\n AffectedNodeName: obj\n 12: Var Pass: let obj = {\n 13: Var Pass: data: __taint_src,\n 14: Var Pass: data1: \"aaa\",\n 15: Var Pass: };\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_005_T\n AffectedNodeName: deleteProperty\n 17: CALL: Reflect.deleteProperty(obj, \"data1\");\n /jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_005_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(obj.data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/dynamic_tracing/dynamic_call/dynamic_call_reflect_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/alias/alias_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/alias/alias_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/alias/alias_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/alias/alias_003_T\nLine 15: __taint_sink(a.value)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/alias/alias_003_T\",\"functionName\":\"alias_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/alias/alias_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function alias_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/alias/alias_003_T\n AffectedNodeName: b.value\n 14: Var Pass: b.value = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/alias/alias_003_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(a.value);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/async_await_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/async_await_001_T\nLine 13: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/async_await_001_T\",\"functionName\":\"async_await_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/async_await_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: async function async_await_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/async_await_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/async_await_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_001_T\nLine 18: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_001_T\",\"functionName\":\"asynchronous_promise_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function asynchronous_promise_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_001_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_001_T.asynchronous_promise_001_T.\n 16: CALL: promise\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_001_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_001_T.asynchronous_promise_001_T.\n 17: ARG PASS: .then((result) => {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_001_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_003_T\nLine 18: __taint_sink(value)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_003_T\",\"functionName\":\"asynchronous_promise_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function asynchronous_promise_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_003_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_003_T.asynchronous_promise_003_T.\n 18: CALL: asyncFunc(__taint_src).then((value) => __taint_sink(value));\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_003_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_003_T.asynchronous_promise_003_T.\n 18: ARG PASS: asyncFunc(__taint_src).then((value) => __taint_sink(value));\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_003_T\n AffectedNodeName: asyncFunc\n 18: CALL: asyncFunc(__taint_src).then((value) => __taint_sink(value));\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_003_T\n AffectedNodeName: __taint_sink\n 18: SINK: asyncFunc(__taint_src).then((value) => __taint_sink(value));\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_005_T\nLine 18: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_005_T\",\"functionName\":\"asynchronous_promise_005_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_005_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function asynchronous_promise_005_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_005_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_005_T.asynchronous_promise_005_T.\n 16: CALL: promise\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_005_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_005_T.asynchronous_promise_005_T.\n 17: ARG PASS: .then((result) => {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_005_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_007_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_007_T\nLine 24: __taint_sink(final)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_007_T\",\"functionName\":\"asynchronous_promise_007_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_007_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function asynchronous_promise_007_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_007_T\n AffectedNodeName: \n 16: CALL: promise\n 17: CALL: .then((result) => {\n 18: CALL: final = result;\n 19: CALL: })\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_007_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_007_T.asynchronous_promise_007_T.\n 23: CALL: .finally(() => {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_007_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_007_T.asynchronous_promise_007_T.\n 23: ARG PASS: .finally(() => {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_007_T\n AffectedNodeName: __taint_sink\n 24: SINK: __taint_sink(final);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_008_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T\nLine 20: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T\",\"functionName\":\"asynchronous_promise_009_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function asynchronous_promise_009_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T\n AffectedNodeName: \n 16: CALL: promise\n 17: CALL: .then((result) => result + \"_1\")\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T\n AffectedNodeName: \n 16: CALL RETURN: promise\n 17: CALL RETURN: .then((result) => result + \"_1\")\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T\n AffectedNodeName: \n 16: CALL: promise\n 17: CALL: .then((result) => result + \"_1\")\n 18: CALL: .then((result) => result + \"_2\")\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T\n AffectedNodeName: \n 16: CALL RETURN: promise\n 17: CALL RETURN: .then((result) => result + \"_1\")\n 18: CALL RETURN: .then((result) => result + \"_2\")\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T.asynchronous_promise_009_T.\n 16: CALL: promise\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T.asynchronous_promise_009_T.\n 19: ARG PASS: .then((result) => {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_009_T\n AffectedNodeName: __taint_sink\n 20: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_010_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_011_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_011_T\nLine 19: __taint_sink(error)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_011_T\",\"functionName\":\"asynchronous_promise_011_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_011_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function asynchronous_promise_011_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_011_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_011_T.asynchronous_promise_011_T.\n 16: CALL: promise\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_011_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_011_T.asynchronous_promise_011_T.\n 18: ARG PASS: .catch((error) => {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_011_T\n AffectedNodeName: __taint_sink\n 19: SINK: __taint_sink(error);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promise_012_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promisify_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promisify_001_T\nLine 26: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promisify_001_T\",\"functionName\":\"asynchronous_promisify_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promisify_001_T\n AffectedNodeName: __taint_src\n 22: SOURCE: async function asynchronous_promisify_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promisify_001_T\n AffectedNodeName: data\n 25: Var Pass: let data = await readFileAsync(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promisify_001_T\n AffectedNodeName: __taint_sink\n 26: SINK: __taint_sink(data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/asynchronous_tracing/promise_callback_await/asynchronous_promisify_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_001_T\nLine 29: __taint_sink(obj)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_001_T\",\"functionName\":\"cross_class_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function cross_class_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_001_T\n AffectedNodeName: obj\n 28: Var Pass: let obj = new B();\n /jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_001_T\n AffectedNodeName: __taint_sink\n 29: SINK: __taint_sink(obj);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_003_T\nLine 36: __taint_sink(a)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_003_T\",\"functionName\":\"cross_class_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function cross_class_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_003_T\n AffectedNodeName: setData\n 35: CALL: b.setData(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_003_T\n AffectedNodeName: __taint_sink\n 36: SINK: __taint_sink(a);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/class/complex_object/cross_class_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_001_T\nLine 19: __taint_sink(obj)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_001_T\",\"functionName\":\"simple_object_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function simple_object_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_001_T\n AffectedNodeName: constructor\n 18: CALL: let obj = new A(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_001_T\n AffectedNodeName: obj\n 18: Var Pass: let obj = new A(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_001_T\n AffectedNodeName: __taint_sink\n 19: SINK: __taint_sink(obj);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_001_T\nLine 18: __taint_sink(person.name)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_001_T\",\"functionName\":\"simple_object_prototype_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function simple_object_prototype_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_001_T\n AffectedNodeName: Person.prototype.name\n 14: Var Pass: Person.prototype.name = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_001_T\n AffectedNodeName: person\n 16: Var Pass: let person = new Person();\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_001_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(person.name);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_003_T\nLine 18: __taint_sink(person.__proto__.name)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_003_T\",\"functionName\":\"simple_object_prototype_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function simple_object_prototype_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_003_T\n AffectedNodeName: Person.prototype.name\n 14: Var Pass: Person.prototype.name = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_003_T\n AffectedNodeName: person\n 16: Var Pass: let person = new Person();\n /jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_003_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(person.__proto__.name);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/class/simple_object/simple_object_prototype_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T\nLine 13: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T\",\"functionName\":\"conditional_if_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function conditional_if_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T\nLine 14: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T\",\"functionName\":\"conditional_if_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function conditional_if_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_003_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_005_T\nLine 14: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_005_T\",\"functionName\":\"conditional_if_005_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_005_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function conditional_if_005_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_005_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_if_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T\nLine 14: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T\",\"functionName\":\"conditional_switch_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function conditional_switch_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/conditional_stmt/conditional_switch_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/dowhile_body_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/dowhile_body_001_T\nLine 15: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/dowhile_body_001_T\",\"functionName\":\"dowhile_body_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/dowhile_body_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function dowhile_body_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/dowhile_body_001_T\n AffectedNodeName: res\n 14: Var Pass: res = res + __taint_src;\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/dowhile_body_001_T\n AffectedNodeName: __taint_sink\n 15: SINK: } while (__taint_sink(res));\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/dowhile_body_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/every_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/every_001_T\nLine 14: __taint_sink(item)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/every_001_T\",\"functionName\":\"every_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/every_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function every_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/every_001_T\n AffectedNodeName: arr\n 12: Var Pass: let arr = [\"a\", \"b\", __taint_src];\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/every_001_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/every_001_T.every_001_T.\n 13: CALL: arr.every(function (item) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/every_001_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/every_001_T.every_001_T.\n 13: ARG PASS: arr.every(function (item) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/every_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(item);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/every_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T\nLine 17: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T\",\"functionName\":\"for_body_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function for_body_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T\n AffectedNodeName: res\n 15: Var Pass: res = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_body_001_T\n AffectedNodeName: __taint_sink\n 17: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_body_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T\",\"functionName\":\"for_init_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function for_init_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T\n AffectedNodeName: ini\n 15: Var Pass: for (ini = __taint_src; j < 10; j++) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T\n AffectedNodeName: res\n 16: Var Pass: res = res + ini;\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_init_001_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_init_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T\nLine 19: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T\",\"functionName\":\"for_update_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function for_update_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T\n AffectedNodeName: j\n 15: Var Pass: for (; ini < 2; j = __taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T\n AffectedNodeName: res\n 16: Var Pass: res = j;\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_update_001_T\n AffectedNodeName: __taint_sink\n 19: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/for_update_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/foreach_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/foreach_001_T\nLine 15: __taint_sink(item)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/foreach_001_T\",\"functionName\":\"foreach_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/foreach_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function foreach_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/foreach_001_T\n AffectedNodeName: arr\n 12: Var Pass: let arr = [\"a\", \"b\", __taint_src];\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/foreach_001_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/foreach_001_T.foreach_001_T.\n 14: CALL: arr.forEach(function (item) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/foreach_001_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/foreach_001_T.foreach_001_T.\n 14: ARG PASS: arr.forEach(function (item) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/foreach_001_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(item);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/foreach_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forin_body_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forin_body_001_T\nLine 19: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forin_body_001_T\",\"functionName\":\"forin_body_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forin_body_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function forin_body_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forin_body_001_T\n AffectedNodeName: obj\n 12: Var Pass: let obj = { key1: \"value1\", key2: __taint_src };\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forin_body_001_T\n AffectedNodeName: __taint_sink\n 19: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forin_body_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forof_body_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forof_body_001_T\nLine 17: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forof_body_001_T\",\"functionName\":\"forof_body_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forof_body_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function forof_body_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forof_body_001_T\n AffectedNodeName: arr\n 12: Var Pass: let arr = [\"a\", \"b\", __taint_src];\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forof_body_001_T\n AffectedNodeName: value\n 14: Var Pass: for (let value of arr) {\n 15: Var Pass: res = value;\n 16: Var Pass: }\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forof_body_001_T\n AffectedNodeName: res\n 15: Var Pass: res = value;\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forof_body_001_T\n AffectedNodeName: __taint_sink\n 17: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/forof_body_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/some_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/some_001_T\nLine 14: __taint_sink(item)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/some_001_T\",\"functionName\":\"some_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/some_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function some_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/some_001_T\n AffectedNodeName: arr\n 12: Var Pass: let arr = [\"a\", \"b\", __taint_src];\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/some_001_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/some_001_T.some_001_T.\n 13: CALL: arr.some(function (item) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/some_001_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/some_001_T.some_001_T.\n 13: ARG PASS: arr.some(function (item) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/some_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(item);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/some_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/while_body_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/while_body_001_T\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/while_body_001_T\",\"functionName\":\"while_body_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/while_body_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function while_body_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/while_body_001_T\n AffectedNodeName: res\n 15: Var Pass: res = res + __taint_src;\n /jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/while_body_001_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/control_flow/loop_stmt/while_body_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_001_T/A/cross_module_001_T_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_001_T/B/cross_module_001_T_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_002_F/A/cross_module_002_F_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_002_F/B/cross_module_002_F_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_003_T/A/cross_module_003_T_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_003_T/B/cross_module_003_T_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_004_F/A/cross_module_004_F_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_004_F/B/cross_module_004_F_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_005_T/A/cross_module_005_T_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_005_T/B/cross_module_005_T_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_006_F/A/cross_module_006_F_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_006_F/B/cross_module_006_F_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_007_T/A/cross_module_007_T_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_007_T/B/cross_module_007_T_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_008_F/A/cross_module_008_F_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_008_F/B/cross_module_008_F_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_009_T/A/cross_module_009_T_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_009_T/B/cross_module_009_T_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_010_F/A/cross_module_010_F_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_010_F/B/cross_module_010_F_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_011_T/A/cross_module_011_T_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_011_T/B/cross_module_011_T_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_012_F/A/cross_module_012_F_a":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/cross_file_package_namespace/cross_module/cross_module_012_F/B/cross_module_012_F_b":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/datatype/array/array_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/datatype/array/array_001_T\nLine 13: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/datatype/array/array_001_T\",\"functionName\":\"array_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/datatype/array/array_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function array_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/datatype/array/array_001_T\n AffectedNodeName: s\n 12: Var Pass: let s = [__taint_src, \"b\", \"c\"];\n /jsbenchmark/completeness/single_app_tracing/datatype/array/array_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(s);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/datatype/array/array_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/datatype/array/array_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/datatype/array/array_003_T\nLine 13: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/datatype/array/array_003_T\",\"functionName\":\"array_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/datatype/array/array_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function array_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/datatype/array/array_003_T\n AffectedNodeName: s\n 12: Var Pass: let s = [[__taint_src], [\"b\"], \"c\"];\n /jsbenchmark/completeness/single_app_tracing/datatype/array/array_003_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(s);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/datatype/array/array_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/datatype/array/array_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/datatype/array/array_005_T\nLine 14: __taint_sink(s)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/datatype/array/array_005_T\",\"functionName\":\"array_005_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/datatype/array/array_005_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function array_005_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/datatype/array/array_005_T\n AffectedNodeName: push\n 13: CALL: s.push(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/datatype/array/array_005_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(s);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/datatype/array/array_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/datatype/collections/set_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/datatype/collections/set_001_T\nLine 13: __taint_sink(set)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/datatype/collections/set_001_T\",\"functionName\":\"set_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/datatype/collections/set_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function set_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/datatype/collections/set_001_T\n AffectedNodeName: set\n 12: Var Pass: let set = new Set(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/datatype/collections/set_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(set);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/datatype/collections/set_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/datatype/map/map_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/datatype/map/map_001_T\nLine 14: __taint_sink(map)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/datatype/map/map_001_T\",\"functionName\":\"map_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/datatype/map/map_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function map_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/datatype/map/map_001_T\n AffectedNodeName: set\n 13: CALL: map.set(\"key1\", __taint_src);\n /jsbenchmark/completeness/single_app_tracing/datatype/map/map_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(map);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/datatype/map/map_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_001_T\nLine 15: __taint_sink(e)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_001_T\",\"functionName\":\"exception_catch_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function exception_catch_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_001_T\n AffectedNodeName: __taint_src\n 13: Var Pass: throw __taint_src;\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_001_T\n AffectedNodeName: e\n 14: Var Pass: } catch (e) {\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_001_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(e);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_003_T\nLine 15: __taint_sink(e.message)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_003_T\",\"functionName\":\"exception_catch_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function exception_catch_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_003_T\n AffectedNodeName: {message:__taint_src, code:123}\n 13: Var Pass: throw { message: __taint_src, code: 123 };\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_003_T\n AffectedNodeName: e\n 14: Var Pass: } catch (e) {\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_003_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(e.message);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_catch_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_finally_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_finally_001_T\nLine 18: __taint_sink(res)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_finally_001_T\",\"functionName\":\"exception_finally_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_finally_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function exception_finally_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_finally_001_T\n AffectedNodeName: __taint_src\n 14: Var Pass: throw __taint_src;\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_finally_001_T\n AffectedNodeName: e\n 15: Var Pass: } catch (e) {\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_finally_001_T\n AffectedNodeName: res\n 16: Var Pass: res = e;\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_finally_001_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(res);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_finally_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_try_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_try_001_T\nLine 13: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_try_001_T\",\"functionName\":\"exception_try_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_try_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function exception_try_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_try_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/exception_error/exception_throw/exception_try_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T\",\"functionName\":\"assign_expression_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function assign_expression_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T\n AffectedNodeName: result\n 13: Var Pass: result = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/assign_expression_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T\",\"functionName\":\"binary_expression_add_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function binary_expression_add_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src + \"_\";\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T\",\"functionName\":\"binary_expression_add_assignment_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function binary_expression_add_assignment_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/binary_expression_add_assignment_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T\",\"functionName\":\"bitwise_expression_and_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function bitwise_expression_and_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src & 1;\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_and_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T\",\"functionName\":\"bitwise_expression_lsh_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function bitwise_expression_lsh_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src << 1;\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_lsh_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T\",\"functionName\":\"bitwise_expression_not_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function bitwise_expression_not_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_not_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T\",\"functionName\":\"bitwise_expression_or_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function bitwise_expression_or_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src | 1;\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_or_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T\",\"functionName\":\"bitwise_expression_rsh_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function bitwise_expression_rsh_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src >> 1;\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_rsh_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T\",\"functionName\":\"bitwise_expression_xor_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function bitwise_expression_xor_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src ^ 1;\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/bitwise_expression_xor_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_002_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_002_T\",\"functionName\":\"logic_expression_and_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function logic_expression_and_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_002_T\n AffectedNodeName: result\n 12: Var Pass: let result = \"_\" && __taint_src;\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_and_002_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T\",\"functionName\":\"logic_expression_or_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function logic_expression_or_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src || \"_\";\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/logic_expression_or_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/prefix_expression_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/prefix_expression_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/prefix_expression_001_T\",\"functionName\":\"prefix_expression_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/prefix_expression_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function prefix_expression_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/prefix_expression_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/prefix_expression_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T\",\"functionName\":\"relation_expression_equal_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function relation_expression_equal_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src === \"taint_src_value\";\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_002_F\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_002_F\",\"functionName\":\"relation_expression_equal_002_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_002_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function relation_expression_equal_002_F(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_002_F\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src === \"__taint_src\";\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_equal_002_F\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_001_T\",\"functionName\":\"relation_expression_greater_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function relation_expression_greater_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src > \"__taint_src\";\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_002_F\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_002_F\",\"functionName\":\"relation_expression_greater_002_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_002_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function relation_expression_greater_002_F(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_002_F\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src > \"taint_src_value\";\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_greater_002_F\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_001_T\",\"functionName\":\"relation_expression_less_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function relation_expression_less_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src < \"__taint_src\";\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_002_F":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_002_F\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_002_F\",\"functionName\":\"relation_expression_less_002_F\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_002_F\n AffectedNodeName: __taint_src\n 11: SOURCE: function relation_expression_less_002_F(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_002_F\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src < \"taint_src_valueaa\";\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/relation_expression_less_002_F\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/suffix_expression_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/suffix_expression_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/suffix_expression_001_T\",\"functionName\":\"suffix_expression_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/suffix_expression_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function suffix_expression_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/suffix_expression_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/basic_expression_operation/suffix_expression_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/conditional_expression/conditional_expression_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/conditional_expression/conditional_expression_001_T\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/conditional_expression/conditional_expression_001_T\",\"functionName\":\"conditional_expression_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/conditional_expression/conditional_expression_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function conditional_expression_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/conditional_expression/conditional_expression_001_T\n AffectedNodeName: result\n 13: Var Pass: result = true ? __taint_src : \"aa\";\n /jsbenchmark/completeness/single_app_tracing/expression/conditional_expression/conditional_expression_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/conditional_expression/conditional_expression_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/lambda_expression/lambda_expression_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/lambda_expression/lambda_expression_001_T\nLine 15: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/lambda_expression/lambda_expression_001_T\",\"functionName\":\"lambda_expression_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/lambda_expression/lambda_expression_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function lambda_expression_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/lambda_expression/lambda_expression_001_T\n AffectedNodeName: lambda\n 14: CALL: result = lambda(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/expression/lambda_expression/lambda_expression_001_T\n AffectedNodeName: lambda\n 14: CALL RETURN: result = lambda(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/expression/lambda_expression/lambda_expression_001_T\n AffectedNodeName: result\n 14: Var Pass: result = lambda(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/expression/lambda_expression/lambda_expression_001_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/lambda_expression/lambda_expression_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_001_T\nLine 17: __taint_sink(Employee.lastname)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_001_T\",\"functionName\":\"delete_expression_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_001_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function delete_expression_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_001_T\n AffectedNodeName: Employee\n 11: Var Pass: const Employee = {\n 12: Var Pass: firstname: \"Bob\",\n 13: Var Pass: lastname: __taint_src,\n 14: Var Pass: };\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_001_T\n AffectedNodeName: __taint_sink\n 17: SINK: __taint_sink(Employee.lastname);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_003_T\nLine 13: __taint_sink(array)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_003_T\",\"functionName\":\"delete_expression_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_003_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function delete_expression_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_003_T\n AffectedNodeName: array\n 11: Var Pass: const array = [__taint_src, \"b\", \"c\", \"d\"];\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_003_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(array);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/delete_expression_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_001_T\nLine 14: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_001_T\",\"functionName\":\"destructuring_assignment_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function destructuring_assignment_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_001_T\n AffectedNodeName: arr\n 12: Var Pass: let arr = [\"_\", \"_\", __taint_src];\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_001_T\n AffectedNodeName: result\n 13: Var Pass: let [a, b, result] = arr;\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_003_T\nLine 14: __taint_sink(c)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_003_T\",\"functionName\":\"destructuring_assignment_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function destructuring_assignment_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_003_T\n AffectedNodeName: arr\n 12: Var Pass: let arr = { a: \"_\", b: \"_\", c: __taint_src };\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_003_T\n AffectedNodeName: c\n 13: Var Pass: let { a, b, c } = arr;\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_003_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(c);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_005_T\nLine 14: __taint_sink(c)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_005_T\",\"functionName\":\"destructuring_assignment_005_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_005_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function destructuring_assignment_005_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_005_T\n AffectedNodeName: arr\n 12: Var Pass: let arr = [\"_\", \"_\", [__taint_src, \"_\"]];\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_005_T\n AffectedNodeName: c\n 13: Var Pass: let [a, b, [c, d]] = arr;\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_005_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(c);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_007_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_007_T\nLine 14: __taint_sink(c)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_007_T\",\"functionName\":\"destructuring_assignment_007_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_007_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function destructuring_assignment_007_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_007_T\n AffectedNodeName: arr\n 12: Var Pass: let arr = { a: \"_\", b: \"_\", c: { __taint_src, d: \"a\" } };\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_007_T\n AffectedNodeName: c\n 13: Var Pass: let { a, b, c } = arr;\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_007_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(c);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/destructuring_assignment_008_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/exponentiation_operator_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/exponentiation_operator_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/exponentiation_operator_001_T\",\"functionName\":\"exponentiation_operator_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/exponentiation_operator_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function exponentiation_operator_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/exponentiation_operator_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src ** 2;\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/exponentiation_operator_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/exponentiation_operator_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/nullish_coalescing_operator_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/nullish_coalescing_operator_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/nullish_coalescing_operator_001_T\",\"functionName\":\"nullish_coalescing_operator_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/nullish_coalescing_operator_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function nullish_coalescing_operator_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/nullish_coalescing_operator_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = null ?? __taint_src;\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/nullish_coalescing_operator_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/nullish_coalescing_operator_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/optional_chaining_operator_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/optional_chaining_operator_001_T\nLine 17: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/optional_chaining_operator_001_T\",\"functionName\":\"optional_chaining_operator_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/optional_chaining_operator_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function optional_chaining_operator_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/optional_chaining_operator_001_T\n AffectedNodeName: obj\n 12: Var Pass: let obj = {\n 13: Var Pass: taintKey: __taint_src,\n 14: Var Pass: };\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/optional_chaining_operator_001_T\n AffectedNodeName: result\n 16: Var Pass: let result = obj?.taintKey;\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/optional_chaining_operator_001_T\n AffectedNodeName: __taint_sink\n 17: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/optional_chaining_operator_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T\nLine 16: __taint_sink(args)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T\",\"functionName\":\"rest_parameter_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function rest_parameter_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T\n AffectedNodeName: collectArgs\n 12: CALL: collectArgs(\"prefix\", __taint_src, \"suffix\");\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T\n AffectedNodeName: __tmp1__\n 15: ARG PASS: function collectArgs(...args) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T\n AffectedNodeName: args\n 15: Var Pass: function collectArgs(...args) {\n 16: Var Pass: __taint_sink(args);\n 17: Var Pass: }\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_001_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(args);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_003_T\nLine 17: __taint_sink({with(params)})\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_003_T\",\"functionName\":\"rest_parameter_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function rest_parameter_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_003_T\n AffectedNodeName: params\n 12: Var Pass: const params = {\n 13: Var Pass: name: \"Tony\",\n 14: Var Pass: age: \"12\",\n 15: Var Pass: id: __taint_src,\n 16: Var Pass: };\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_003_T\n AffectedNodeName: __taint_sink\n 17: SINK: __taint_sink({ ...params });\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_005_T\nLine 16: __taint_sink(args)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_005_T\",\"functionName\":\"rest_parameter_005_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_005_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function rest_parameter_005_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_005_T\n AffectedNodeName: collectArgs\n 12: CALL: collectArgs([\"prefix\", __taint_src, \"suffix\"]);\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_005_T\n AffectedNodeName: __tmp1__\n 15: ARG PASS: function collectArgs(...args) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_005_T\n AffectedNodeName: args\n 15: Var Pass: function collectArgs(...args) {\n 16: Var Pass: __taint_sink(args);\n 17: Var Pass: }\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_005_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(args);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/rest_parameter_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T\nLine 14: __taint_sink(array)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T\",\"functionName\":\"spread_operator_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function spread_operator_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T\n AffectedNodeName: array1\n 12: Var Pass: let array1 = [\"a\", \"b\", __taint_src];\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T\n AffectedNodeName: array\n 13: Var Pass: let array = [\"c\", ...array1];\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_001_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(array);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_003_T\nLine 21: __taint_sink(newParams)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_003_T\",\"functionName\":\"spread_operator_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function spread_operator_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_003_T\n AffectedNodeName: params\n 12: Var Pass: const params = {\n 13: Var Pass: name: \"Tony\",\n 14: Var Pass: age: \"12\",\n 15: Var Pass: id: __taint_src,\n 16: Var Pass: };\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_003_T\n AffectedNodeName: newParams\n 17: Var Pass: const newParams = {\n 18: Var Pass: score: 100,\n 19: Var Pass: ...params,\n 20: Var Pass: };\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_003_T\n AffectedNodeName: __taint_sink\n 21: SINK: __taint_sink(newParams);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_005_T\nLine 15: __taint_sink(rest)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_005_T\",\"functionName\":\"spread_operator_005_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_005_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function spread_operator_005_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_005_T\n AffectedNodeName: foo\n 12: Var Pass: const foo = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_005_T\n AffectedNodeName: __tmp2__\n 14: Var Pass: const [r1, r2, ...rest] = [123, 456, foo, bar];\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_005_T\n AffectedNodeName: rest\n 14: Var Pass: const [r1, r2, ...rest] = [123, 456, foo, bar];\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_005_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(rest);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/spread_operator_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_001_T\",\"functionName\":\"template_literal_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function template_literal_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = `_${__taint_src}`;\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_003_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_003_T\",\"functionName\":\"template_literal_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function template_literal_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_003_T\n AffectedNodeName: result\n 12: Var Pass: let result = `${__taint_src}_`;\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_003_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_005_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_005_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_005_T\",\"functionName\":\"template_literal_005_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_005_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function template_literal_005_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_005_T\n AffectedNodeName: result\n 12: Var Pass: let result = `_${__taint_src}_`;\n /jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_005_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/special_expression/template_literal_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_001_T\nLine 20: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_001_T\",\"functionName\":\"this_expression_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function this_expression_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_001_T\n AffectedNodeName: obj\n 12: Var Pass: let obj = {\n 13: Var Pass: value: __taint_src,\n 14: Var Pass: getValue: function () {\n 15: Var Pass: return this.value;\n 16: Var Pass: },\n 17: Var Pass: };\n /jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_001_T\n AffectedNodeName: \n 19: CALL RETURN: let result = obj.getValue();\n /jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_001_T\n AffectedNodeName: result\n 19: Var Pass: let result = obj.getValue();\n /jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_001_T\n AffectedNodeName: __taint_sink\n 20: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_003_T\nLine 15: __taint_sink(this.result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_003_T\",\"functionName\":\"this_expression_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_003_T\n AffectedNodeName: __taint_src\n 13: SOURCE: function this_expression_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_003_T\n AffectedNodeName: this.result\n 14: Var Pass: this.result = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_003_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(this.result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/this_expression/this_expression_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_001_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_001_T\",\"functionName\":\"type_cast_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function type_cast_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_001_T\n AffectedNodeName: result\n 12: Var Pass: let result = Number(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_003_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_003_T\",\"functionName\":\"type_cast_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function type_cast_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_003_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src == 5;\n /jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_003_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_004_T\nLine 13: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_004_T\",\"functionName\":\"type_cast_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_004_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function type_cast_004_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_004_T\n AffectedNodeName: result\n 12: Var Pass: let result = __taint_src == \"5\";\n /jsbenchmark/completeness/single_app_tracing/expression/type_cast/type_cast_004_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T\nLine 14: __taint_sink(process(__taint_src, foo))\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T\",\"functionName\":\"anonymous_function_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function anonymous_function_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T\n AffectedNodeName: process\n 14: CALL: __taint_sink(process(__taint_src, \"foo\"));\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T\n AffectedNodeName: process\n 14: CALL RETURN: __taint_sink(process(__taint_src, \"foo\"));\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_002_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(process(__taint_src, \"foo\"));\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T\nLine 12: __taint_sink(input)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T\",\"functionName\":\"anonymous_function_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function anonymous_function_004_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T\n AffectedNodeName: process\n 15: CALL: process(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T\n AffectedNodeName: input\n 11: ARG PASS: let process = function (input) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_004_T\n AffectedNodeName: __taint_sink\n 12: SINK: __taint_sink(input);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_005_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T\nLine 12: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T\",\"functionName\":\"anonymous_function_006_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function anonymous_function_006_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T.anonymous_function_006_T.\n 11: CALL: (function () {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T.anonymous_function_006_T.\n 11: ARG PASS: (function () {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/anonymous_function_006_T\n AffectedNodeName: __taint_sink\n 12: SINK: __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T\nLine 12: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T\",\"functionName\":\"closure_function_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function closure_function_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T.closure_function_002_T.closure\n 14: CALL: closure();\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T.closure_function_002_T.closure\n 11: ARG PASS: let closure = function () {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_002_T\n AffectedNodeName: __taint_sink\n 12: SINK: __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T\nLine 13: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T\",\"functionName\":\"closure_function_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function closure_function_004_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T\n AffectedNodeName: inner\n 18: CALL: innerFunction();\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T\n AffectedNodeName: inner\n 12: ARG PASS: return function inner() {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_004_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_005_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_006_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_007_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_007_T\nLine 25: __taint_sink(a.update())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_007_T\",\"functionName\":\"closure_function_007_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_007_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function closure_function_007_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_007_T\n AffectedNodeName: \n 25: CALL RETURN: __taint_sink(a.update());\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_007_T\n AffectedNodeName: __taint_sink\n 25: SINK: __taint_sink(a.update());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_008_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_009_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_009_T\nLine 18: __taint_sink(middleVar)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_009_T\",\"functionName\":\"closure_function_009_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_009_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function closure_function_009_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_009_T\n AffectedNodeName: inner\n 25: CALL: innerFunction();\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_009_T\n AffectedNodeName: inner\n 17: ARG PASS: return function inner() {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_009_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(middleVar);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_010_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_011_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_011_T\nLine 16: __taint_sink(outerVar)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_011_T\",\"functionName\":\"closure_function_011_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_011_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function closure_function_011_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_011_T\n AffectedNodeName: inner\n 23: CALL: innerFunction();\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_011_T\n AffectedNodeName: inner\n 15: ARG PASS: return function inner() {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_011_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(outerVar);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_012_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_013_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_013_T\nLine 14: __taint_sink(this.name)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_013_T\",\"functionName\":\"closure_function_013_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_013_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function closure_function_013_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_013_T\n AffectedNodeName: data\n 11: Var Pass: var data = {\n 12: Var Pass: name: __taint_src,\n 13: Var Pass: show: function () {\n 14: Var Pass: __taint_sink(this.name);\n 15: Var Pass: },\n 16: Var Pass: };\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_013_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_013_T.closure_function_013_T.\n 17: CALL: data.show();\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_013_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_013_T.closure_function_013_T.\n 13: ARG PASS: show: function () {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_013_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(this.name);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_014_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_015_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_015_T\nLine 15: __taint_sink(this.name)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_015_T\",\"functionName\":\"closure_function_015_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_015_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function closure_function_015_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_015_T\n AffectedNodeName: data\n 11: Var Pass: var data = {\n 12: Var Pass: name: __taint_src,\n 13: Var Pass: show: function () {\n 14: Var Pass: return function () {\n 15: Var Pass: __taint_sink(this.name);\n 16: Var Pass: };\n 17: Var Pass: },\n 18: Var Pass: };\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_015_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_015_T.closure_function_015_T..\n 19: CALL: data.show().call(data);\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_015_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_015_T.closure_function_015_T..\n 14: ARG PASS: return function () {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_015_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(this.name);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_016_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T\nLine 14: __taint_sink(this.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T\",\"functionName\":\"closure_function_017_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function closure_function_017_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T\n AffectedNodeName: Process\n 18: CALL: const p = new Process(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T\n AffectedNodeName: p\n 18: Var Pass: const p = new Process(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T.closure_function_017_T.Process.Process_scope.\n 19: CALL: p.show();\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T.closure_function_017_T.Process.Process_scope.\n 13: ARG PASS: this.show = function () {\n /jsbenchmark/completeness/single_app_tracing/function_call/anonymous_function_closure/closure_function_017_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(this.data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_default_value_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_default_value_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_default_value_002_T\nLine 15: __taint_sink(input)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_default_value_002_T\",\"functionName\":\"argument_passing_default_value_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_default_value_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function argument_passing_default_value_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_default_value_002_T\n AffectedNodeName: process\n 12: CALL: process(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_default_value_002_T\n AffectedNodeName: __tmp1__\n 14: ARG PASS: function process(input = \"default_value\") {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_default_value_002_T\n AffectedNodeName: input\n 14: Var Pass: function process(input = \"default_value\") {\n 15: Var Pass: __taint_sink(input);\n 16: Var Pass: }\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_default_value_002_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(input);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_002_T\nLine 15: __taint_sink(arg)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_002_T\",\"functionName\":\"argument_passing_normal_value_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function argument_passing_normal_value_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_002_T\n AffectedNodeName: process\n 12: CALL: process(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_002_T\n AffectedNodeName: arg\n 14: ARG PASS: function process(arg) {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_002_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(arg);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_004_T\nLine 15: __taint_sink(arg1)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_004_T\",\"functionName\":\"argument_passing_normal_value_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_004_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function argument_passing_normal_value_004_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_004_T\n AffectedNodeName: process\n 12: CALL: process(__taint_src, \"_\");\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_004_T\n AffectedNodeName: arg1\n 14: ARG PASS: function process(arg1, arg2) {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_004_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(arg1);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_005_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_006_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_006_T\nLine 13: __taint_sink(innerInput)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_006_T\",\"functionName\":\"argument_passing_normal_value_006_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_006_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function argument_passing_normal_value_006_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_006_T\n AffectedNodeName: outer\n 19: CALL: outer(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_006_T\n AffectedNodeName: input\n 11: ARG PASS: function outer(input) {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_006_T\n AffectedNodeName: inner\n 16: CALL: inner(input);\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_006_T\n AffectedNodeName: innerInput\n 12: ARG PASS: function inner(innerInput) {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_normal_value_006_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(innerInput);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_002_T\nLine 14: __taint_sink(obj.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_002_T\",\"functionName\":\"argument_passing_reference_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function argument_passing_reference_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_002_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(obj.data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_004_T\nLine 14: __taint_sink(arr)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_004_T\",\"functionName\":\"argument_passing_reference_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_004_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function argument_passing_reference_004_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_004_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(arr);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_005_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_006_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_006_T\nLine 16: __taint_sink(objB.name)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_006_T\",\"functionName\":\"argument_passing_reference_006_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_006_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function argument_passing_reference_006_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_006_T\n AffectedNodeName: objA\n 12: Var Pass: const objA = { name: __taint_src };\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_006_T\n AffectedNodeName: swap\n 15: CALL: swap(objA, objB);\n /jsbenchmark/completeness/single_app_tracing/function_call/argument_passing/argument_passing_reference_006_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(objB.name);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_002_T\nLine 12: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_002_T\",\"functionName\":\"arrow_function_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function arrow_function_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_002_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_002_T.arrow_function_002_T.arrowFunction\n 13: CALL: arrowFunction();\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_002_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_002_T.arrow_function_002_T.arrowFunction\n 12: ARG PASS: let arrowFunction = () => __taint_sink(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_002_T\n AffectedNodeName: __taint_sink\n 12: SINK: let arrowFunction = () => __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_004_T\nLine 14: __taint_sink(__taint_src)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_004_T\",\"functionName\":\"arrow_function_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_004_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function arrow_function_004_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_004_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_004_T.arrow_function_004_T.outer.\n 19: CALL: innerFunction();\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_004_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_004_T.arrow_function_004_T.outer.\n 13: ARG PASS: return () => {\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_004_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(__taint_src);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_005_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_006_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_006_T\nLine 15: __taint_sink(self.name)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_006_T\",\"functionName\":\"arrow_function_006_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_006_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function arrow_function_006_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_006_T\n AffectedNodeName: this.name\n 12: Var Pass: this.name = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_006_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_006_T.arrow_function_006_T.\n 17: CALL: data.show();\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_006_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_006_T.arrow_function_006_T.\n 15: ARG PASS: show: () => __taint_sink(self.name),\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_006_T\n AffectedNodeName: __taint_sink\n 15: SINK: show: () => __taint_sink(self.name),\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_007_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_008_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_008_T\nLine 16: __taint_sink(self.name)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_008_T\",\"functionName\":\"arrow_function_008_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_008_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function arrow_function_008_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_008_T\n AffectedNodeName: this.name\n 12: Var Pass: this.name = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_008_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_008_T.arrow_function_008_T..\n 19: CALL: data.show().call(data);\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_008_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_008_T.arrow_function_008_T..\n 16: ARG PASS: return () => __taint_sink(self.name);\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_008_T\n AffectedNodeName: __taint_sink\n 16: SINK: return () => __taint_sink(self.name);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_009_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T\nLine 14: __taint_sink(this.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T\",\"functionName\":\"arrow_function_010_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function arrow_function_010_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T\n AffectedNodeName: Process\n 17: CALL: const p = new Process(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T\n AffectedNodeName: p\n 17: Var Pass: const p = new Process(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T.arrow_function_010_T.Process.Process_scope.\n 18: CALL: p.show();\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T.arrow_function_010_T.Process.Process_scope.\n 14: ARG PASS: this.show = () => __taint_sink(this.data);\n /jsbenchmark/completeness/single_app_tracing/function_call/arrow_function/arrow_function_010_T\n AffectedNodeName: __taint_sink\n 14: SINK: this.show = () => __taint_sink(this.data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/chained_call/chained_call_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T\nLine 28: __taint_sink(this.name)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T\",\"functionName\":\"chained_call_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function chained_call_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T\n AffectedNodeName: setName\n 32: CALL: new A().setName(\"_\").clearName().setName(__taint_src).process();\n /jsbenchmark/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T\n AffectedNodeName: setName\n 32: CALL RETURN: new A().setName(\"_\").clearName().setName(__taint_src).process();\n /jsbenchmark/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T\n AffectedNodeName: process\n 32: CALL: new A().setName(\"_\").clearName().setName(__taint_src).process();\n /jsbenchmark/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T\n AffectedNodeName: process\n 27: ARG PASS: process() {\n /jsbenchmark/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T\n AffectedNodeName: __taint_sink\n 28: SINK: __taint_sink(this.name);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_decorator_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_decorator_002_T":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_decorator_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_decorator_004_T":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_member_decorator_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_member_decorator_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_member_decorator_002_T\nLine 18: __taint_sink(taintData)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_member_decorator_002_T\",\"functionName\":\"class_member_decorator_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_member_decorator_002_T\n AffectedNodeName: __taint_src\n 13: SOURCE: function class_member_decorator_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_member_decorator_002_T\n AffectedNodeName: \n 29: CALL: instance.someMethod(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_member_decorator_002_T\n AffectedNodeName: __tmp1__\n 16: ARG PASS: return function (...args) {\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_member_decorator_002_T\n AffectedNodeName: args\n 16: Var Pass: return function (...args) {\n 17: Var Pass: const taintData = args[0];\n 18: Var Pass: __taint_sink(taintData);\n 19: Var Pass: return originalMethod.apply(this, args);\n 20: Var Pass: };\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_member_decorator_002_T\n AffectedNodeName: taintData\n 17: Var Pass: const taintData = args[0];\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/class_member_decorator_002_T\n AffectedNodeName: __taint_sink\n 18: SINK: __taint_sink(taintData);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_002_T\nLine 14: __taint_sink(args)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_002_T\",\"functionName\":\"function_decorator_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function function_decorator_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_002_T\n AffectedNodeName: \n 20: CALL: decoratedFunction(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_002_T\n AffectedNodeName: __tmp1__\n 13: ARG PASS: return function (...args) {\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_002_T\n AffectedNodeName: args\n 13: Var Pass: return function (...args) {\n 14: Var Pass: __taint_sink(args);\n 15: Var Pass: return targetFunction.apply(this, args);\n 16: Var Pass: };\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_002_T\n AffectedNodeName: __taint_sink\n 14: SINK: __taint_sink(args);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T\nLine 19: __taint_sink(input)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T\",\"functionName\":\"function_decorator_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function function_decorator_004_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T\n AffectedNodeName: \n 21: CALL: decoratedFunction(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T\n AffectedNodeName: __tmp1__\n 13: ARG PASS: return function (...args) {\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T\n AffectedNodeName: args\n 13: Var Pass: return function (...args) {\n 14: Var Pass: return targetFunction.apply(this, args);\n 15: Var Pass: };\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T.function_decorator_004_T.\n 14: CALL: return targetFunction.apply(this, args);\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T\n AffectedNodeName: /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T.function_decorator_004_T.\n 18: ARG PASS: const decoratedFunction = taintDecorator(function (input) {\n /jsbenchmark/completeness/single_app_tracing/function_call/decorator_function/function_decorator_004_T\n AffectedNodeName: __taint_sink\n 19: SINK: __taint_sink(input);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/generator_function/generator_function_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/generator_function/generator_function_002_T":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/generator_function/generator_function_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/generator_function/generator_function_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/generator_function/generator_function_004_T\nLine 21: __taint_sink(g.next(__taint_src).value)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/generator_function/generator_function_004_T\",\"functionName\":\"generator_function_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/generator_function/generator_function_004_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function generator_function_004_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/generator_function/generator_function_004_T\n AffectedNodeName: __taint_sink\n 21: SINK: __taint_sink(g.next(__taint_src).value);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T\nLine 19: __taint_sink(f(__taint_src, _)())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T\",\"functionName\":\"higher_order_function_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function higher_order_function_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T\n AffectedNodeName: f\n 19: CALL: __taint_sink(f(__taint_src, \"_\")());\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T\n AffectedNodeName: \n 19: CALL RETURN: __taint_sink(f(__taint_src, \"_\")());\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_002_T\n AffectedNodeName: __taint_sink\n 19: SINK: __taint_sink(f(__taint_src, \"_\")());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_003_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T\nLine 23: __taint_sink(f(g, __taint_src, _)())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T\",\"functionName\":\"higher_order_function_004_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function higher_order_function_004_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T\n AffectedNodeName: f\n 23: CALL: __taint_sink(f(g, __taint_src, \"_\")());\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T\n AffectedNodeName: \n 23: CALL RETURN: __taint_sink(f(g, __taint_src, \"_\")());\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_004_T\n AffectedNodeName: __taint_sink\n 23: SINK: __taint_sink(f(g, __taint_src, \"_\")());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_005_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T\nLine 27: __taint_sink(f(g, u, __taint_src, _)())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T\",\"functionName\":\"higher_order_function_006_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function higher_order_function_006_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T\n AffectedNodeName: f\n 27: CALL: __taint_sink(f(g, u, __taint_src, \"_\")());\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T\n AffectedNodeName: \n 27: CALL RETURN: __taint_sink(f(g, u, __taint_src, \"_\")());\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_006_T\n AffectedNodeName: __taint_sink\n 27: SINK: __taint_sink(f(g, u, __taint_src, \"_\")());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_007_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T\nLine 17: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T\",\"functionName\":\"higher_order_function_008_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function higher_order_function_008_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T\n AffectedNodeName: higherOrderFunction\n 16: CALL RETURN: const result = higherOrderFunction((a, b) => a + b);\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T\n AffectedNodeName: result\n 16: Var Pass: const result = higherOrderFunction((a, b) => a + b);\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_008_T\n AffectedNodeName: __taint_sink\n 17: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_009_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_010_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_010_T\nLine 19: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_010_T\",\"functionName\":\"higher_order_function_010_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_010_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function higher_order_function_010_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_010_T\n AffectedNodeName: higherOrderFunction\n 16: CALL RETURN: const result = higherOrderFunction(function (a, b) {\n 17: CALL RETURN: return a + b;\n 18: CALL RETURN: });\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_010_T\n AffectedNodeName: result\n 16: Var Pass: const result = higherOrderFunction(function (a, b) {\n 17: Var Pass: return a + b;\n 18: Var Pass: });\n /jsbenchmark/completeness/single_app_tracing/function_call/higher_order_function/higher_order_function_010_T\n AffectedNodeName: __taint_sink\n 19: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/library_function/json_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/library_function/json_001_T\nLine 15: __taint_sink(obj)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/library_function/json_001_T\",\"functionName\":\"json_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/library_function/json_001_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function json_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/library_function/json_001_T\n AffectedNodeName: process\n 11: CALL: process(JSON.stringify(__taint_src));\n /jsbenchmark/completeness/single_app_tracing/function_call/library_function/json_001_T\n AffectedNodeName: arg\n 13: ARG PASS: function process(arg) {\n /jsbenchmark/completeness/single_app_tracing/function_call/library_function/json_001_T\n AffectedNodeName: obj\n 14: Var Pass: let obj = JSON.parse(arg);\n /jsbenchmark/completeness/single_app_tracing/function_call/library_function/json_001_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(obj);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/library_function/json_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/library_function/string_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/library_function/string_001_T\nLine 15: __taint_sink(result)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/library_function/string_001_T\",\"functionName\":\"string_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/library_function/string_001_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function string_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/library_function/string_001_T\n AffectedNodeName: process\n 11: CALL: process(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/library_function/string_001_T\n AffectedNodeName: arg\n 13: ARG PASS: function process(arg) {\n /jsbenchmark/completeness/single_app_tracing/function_call/library_function/string_001_T\n AffectedNodeName: result\n 14: Var Pass: let result = arg.trim();\n /jsbenchmark/completeness/single_app_tracing/function_call/library_function/string_001_T\n AffectedNodeName: __taint_sink\n 15: SINK: __taint_sink(result);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/library_function/string_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_001_T\nLine 31: __taint_sink(this.getData())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_001_T\",\"functionName\":\"constructor_extends_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_001_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function constructor_extends_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_001_T\n AffectedNodeName: constructor\n 35: CALL: const derived = new DerivedClass(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_001_T\n AffectedNodeName: derived\n 35: Var Pass: const derived = new DerivedClass(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_001_T\n AffectedNodeName: getData\n 31: CALL: __taint_sink(this.getData());\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_001_T\n AffectedNodeName: this\n 31: ARG PASS: __taint_sink(this.getData());\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_001_T\n AffectedNodeName: getData\n 31: CALL RETURN: __taint_sink(this.getData());\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_001_T\n AffectedNodeName: __taint_sink\n 31: SINK: __taint_sink(this.getData());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_003_T\nLine 29: __taint_sink(this.getData())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_003_T\",\"functionName\":\"constructor_extends_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_003_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function constructor_extends_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_003_T\n AffectedNodeName: derived\n 33: Var Pass: const derived = new DerivedClass();\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_003_T\n AffectedNodeName: getData\n 29: CALL: __taint_sink(this.getData());\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_003_T\n AffectedNodeName: this\n 29: ARG PASS: __taint_sink(this.getData());\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_003_T\n AffectedNodeName: getData\n 29: CALL RETURN: __taint_sink(this.getData());\n /jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_003_T\n AffectedNodeName: __taint_sink\n 29: SINK: __taint_sink(this.getData());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/override/constructor_extends_004_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T\nLine 26: __taint_sink(sub.call())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T\",\"functionName\":\"polymorphism_override_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function polymorphism_override_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T\n AffectedNodeName: call\n 26: CALL RETURN: __taint_sink(sub.call());\n /jsbenchmark/completeness/single_app_tracing/function_call/override/polymorphism_override_001_T\n AffectedNodeName: __taint_sink\n 26: SINK: __taint_sink(sub.call());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/override/polymorphism_override_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/override/prototype_extends_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/override/prototype_extends_001_T\nLine 27: __taint_sink(instance.getChValue())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/override/prototype_extends_001_T\",\"functionName\":\"prototype_extends_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/override/prototype_extends_001_T\n AffectedNodeName: __taint_src\n 10: SOURCE: function prototype_extends_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/override/prototype_extends_001_T\n AffectedNodeName: instance\n 26: Var Pass: let instance = new Child();\n /jsbenchmark/completeness/single_app_tracing/function_call/override/prototype_extends_001_T\n AffectedNodeName: \n 27: CALL RETURN: __taint_sink(instance.getChValue());\n /jsbenchmark/completeness/single_app_tracing/function_call/override/prototype_extends_001_T\n AffectedNodeName: __taint_sink\n 27: SINK: __taint_sink(instance.getChValue());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/override/prototype_extends_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/return_value_passing/return_normal_value_passing_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/return_value_passing/return_normal_value_passing_002_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/return_value_passing/return_normal_value_passing_002_T\nLine 13: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/return_value_passing/return_normal_value_passing_002_T\",\"functionName\":\"return_normal_value_passing_002_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/return_value_passing/return_normal_value_passing_002_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function return_normal_value_passing_002_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/return_value_passing/return_normal_value_passing_002_T\n AffectedNodeName: process\n 12: CALL RETURN: let data = process();\n /jsbenchmark/completeness/single_app_tracing/function_call/return_value_passing/return_normal_value_passing_002_T\n AffectedNodeName: data\n 12: Var Pass: let data = process();\n /jsbenchmark/completeness/single_app_tracing/function_call/return_value_passing/return_normal_value_passing_002_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/static_method/static_method_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/function_call/static_method/static_method_001_T\nLine 13: __taint_sink(arg)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/function_call/static_method/static_method_001_T\",\"functionName\":\"static_method_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/function_call/static_method/static_method_001_T\n AffectedNodeName: __taint_src\n 17: SOURCE: function static_method_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/function_call/static_method/static_method_001_T\n AffectedNodeName: process\n 18: CALL: MyClass.process(__taint_src);\n /jsbenchmark/completeness/single_app_tracing/function_call/static_method/static_method_001_T\n AffectedNodeName: arg\n 12: ARG PASS: static process(arg) {\n /jsbenchmark/completeness/single_app_tracing/function_call/static_method/static_method_001_T\n AffectedNodeName: __taint_sink\n 13: SINK: __taint_sink(arg);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/static_method/static_method_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/tagged_template_literals/tagged_template_literal_001_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/function_call/tagged_template_literals/tagged_template_literal_002_T":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/variable_scope/private_scope/private_variable_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/variable_scope/private_scope/private_variable_001_T\nLine 22: __taint_sink(o.GetData())\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/variable_scope/private_scope/private_variable_001_T\",\"functionName\":\"private_variable_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/variable_scope/private_scope/private_variable_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function private_variable_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/variable_scope/private_scope/private_variable_001_T\n AffectedNodeName: data\n 13: Var Pass: #data = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/variable_scope/private_scope/private_variable_001_T\n AffectedNodeName: o\n 21: Var Pass: let o = new A();\n /jsbenchmark/completeness/single_app_tracing/variable_scope/private_scope/private_variable_001_T\n AffectedNodeName: GetData\n 22: CALL RETURN: __taint_sink(o.GetData());\n /jsbenchmark/completeness/single_app_tracing/variable_scope/private_scope/private_variable_001_T\n AffectedNodeName: __taint_sink\n 22: SINK: __taint_sink(o.GetData());\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/variable_scope/private_scope/private_variable_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_001_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_001_T\nLine 16: __taint_sink(A.data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_001_T\",\"functionName\":\"static_variable_001_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_001_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function static_variable_001_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_001_T\n AffectedNodeName: data\n 13: Var Pass: static data = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_001_T\n AffectedNodeName: __taint_sink\n 16: SINK: __taint_sink(A.data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_002_F":"======================== Findings ========================\nNo findings!\n==========================================================","/jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T":"======================== Findings ========================\n\n------------- 1: taint_flow_test-------------\nDescription:taint_flow_test，回归测试使用，不推荐外部使用\nFile:/jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\nLine 27: __taint_sink(data)\nSINK RULE:__taint_sink\nentrypoint:\n{\"filePath\":\"/jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\",\"functionName\":\"static_variable_003_T\",\"attribute\":\"fullCallGraphMade\",\"type\":\"functionCall\",\"funcReceiverType\":\"\"}\nTrace:\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\n AffectedNodeName: __taint_src\n 11: SOURCE: function static_variable_003_T(__taint_src) {\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\n AffectedNodeName: data\n 13: Var Pass: static data = __taint_src;\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\n AffectedNodeName: processA\n 32: CALL: a.processA();\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\n AffectedNodeName: processA\n 15: ARG PASS: processA() {\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\n AffectedNodeName: test\n 16: CALL: this.test();\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\n AffectedNodeName: test\n 19: ARG PASS: test() {\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\n AffectedNodeName: processB\n 20: CALL: new B().processB();\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\n AffectedNodeName: processB\n 25: ARG PASS: processB() {\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\n AffectedNodeName: data\n 26: Var Pass: const data = A.data;\n /jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_003_T\n AffectedNodeName: __taint_sink\n 27: SINK: __taint_sink(data);\n==========================================================\n #Total-findings:1\n==========================================================","/jsbenchmark/completeness/single_app_tracing/variable_scope/static_variable/static_variable_004_F":"======================== Findings ========================\nNo findings!\n=========================================================="} \ No newline at end of file diff --git a/test/lifecycle-call-depth-prune.test.ts b/test/lifecycle-call-depth-prune.test.ts new file mode 100644 index 00000000..22186592 --- /dev/null +++ b/test/lifecycle-call-depth-prune.test.ts @@ -0,0 +1,252 @@ +import assert from 'assert' +import { describe, it } from 'mocha' +import JavaAnalyzer = require('../src/engine/analyzer/java/common/java-analyzer') +import { ObjectValue } from '../src/engine/analyzer/common/value/object' +import { PrimitiveValue } from '../src/engine/analyzer/common/value/primitive' +import type { Value } from '../src/types/analyzer' + +interface IntegrationAnalyzer extends AnalyzerProbe { + entryPointSymValArray: unknown[] + globalState: Record + checkerManager: { checkAtFunctionCallBefore: () => void } + entry_fclos: unknown + ainfo: unknown + inRange: boolean + thisFClos: unknown + processInstruction: () => unknown + evaluateNestedCallArgument: (_scope: unknown, _argument: unknown, _state: unknown) => unknown + findNodeInvocations: () => unknown[] + checkFclosInInterfaceOrAbstractClass: () => boolean + incrementAndCheckCallsiteLimit: () => boolean + checkMethodCumulativeTimeLimit: () => boolean + processLibFuncTagPropagation: () => { matched: boolean } + buildCallArgs: (_node: unknown, values: unknown[]) => { args: unknown[] } + propagateReadWrapperReceiverTrace: () => void + isJavaBeanSetterCall: () => boolean + getCalledMethodName: () => string + getReadWrapperReceiver: () => unknown + resolveRuntimeValueRef: (value: unknown) => unknown + mergeJavaCallResultType: () => void + executeWithSummary: (...args: unknown[]) => unknown +} + +const createIntegrationAnalyzer = (): IntegrationAnalyzer => { + const analyzer = createAnalyzer() as IntegrationAnalyzer + analyzer.entryPointSymValArray = [] + analyzer.globalState = {} + analyzer.checkerManager = { checkAtFunctionCallBefore: () => {} } + analyzer.entry_fclos = undefined + analyzer.ainfo = undefined + analyzer.inRange = false + ;(analyzer as unknown as { _thisFClos?: unknown })._thisFClos = undefined + analyzer.processInstruction = () => undefined + analyzer.evaluateNestedCallArgument = (_scope, argument) => argument + analyzer.findNodeInvocations = () => [] + analyzer.checkFclosInInterfaceOrAbstractClass = () => false + analyzer.incrementAndCheckCallsiteLimit = () => false + analyzer.checkMethodCumulativeTimeLimit = () => false + analyzer.processLibFuncTagPropagation = () => ({ matched: false }) + analyzer.buildCallArgs = (_node, values) => ({ args: values }) + analyzer.propagateReadWrapperReceiverTrace = () => {} + analyzer.isJavaBeanSetterCall = () => false + analyzer.getCalledMethodName = () => 'unknown' + analyzer.getReadWrapperReceiver = () => undefined + analyzer.resolveRuntimeValueRef = (value) => value + analyzer.mergeJavaCallResultType = () => {} + analyzer.executeWithSummary = (_scope, _fclos, _callInfo, _state, execute) => execute() + return analyzer +} + +const createInputValue = (): Value => { + const value = new PrimitiveValue('', 'payload', 'payload', 'string', 'Literal') + value.taint.addTag('JAVA_INPUT') + value.taint.addTraceToTag('JAVA_INPUT', { tag: 'SOURCE: ', file: 'Lifecycle.java', line: 20 }) + value.taint.markSource() + return value +} + +const createCallInfo = (value: Value) => ({ + callArgs: { args: [{ index: 0, value, kind: 'positional' as const }] }, + boundCall: { params: [{ index: 0, name: 'payload', value, provided: true, argIndexes: [0] }] }, + callsiteNode: node, +}) + +const createFunctionDecl = () => ({ + type: 'FunctionDefinition', + id: { type: 'Identifier', name: 'lifecycleFallback' }, + parameters: [{ type: 'Identifier', name: 'payload' }], + body: { type: 'Block', body: [] }, +}) + +const createLifecycleFallbackFclos = (analyzer: IntegrationAnalyzer, receiver: ObjectValue) => ({ + vtype: 'fclos', + sid: 'lifecycleFallback', + qid: 'bean.lifecycleFallback', + ast: { fdef: createFunctionDecl() }, + _this: receiver, + getThisObj: () => receiver, + runtime: { + execute: (_fclos: unknown, args: Value[]) => analyzer.processLibArgToRet(node, _fclos, args, { qid: 'scope' }, { pcond: [] }, createCallInfo(args[0])), + }, +}) + +const runSetterFallback = (analyzer: IntegrationAnalyzer, receiver: ObjectValue, input: Value): Value => { + const field = new ObjectValue('', { sid: 'name', qid: 'bean.name' }) + receiver.setFieldValue('name', field) + const setterNode = { + type: 'CallExpression', + callee: { type: 'MemberAccess', object: { type: 'Identifier', name: 'bean' }, property: { type: 'Identifier', name: 'setName' } }, + arguments: [{ type: 'Literal', value: 'payload' }], + loc: node.loc, + } + const setter = { + vtype: 'fclos', + sid: 'setName', + qid: 'bean.setName', + ast: { fdef: { type: 'FunctionDefinition', body: { type: 'Block', body: [] } } }, + _this: receiver, + getThisObj: () => receiver, + } + ;(analyzer as unknown as { symbolTable?: { register: (value: unknown) => string } }).symbolTable = { register: () => 'setter' } + ;(analyzer as unknown as { executeCall: () => undefined }).executeCall = () => undefined + analyzer.processInstruction = () => setter + analyzer.evaluateNestedCallArgument = () => input + analyzer.isJavaBeanSetterCall = () => true + analyzer.getCalledMethodName = () => 'setName' + analyzer.getReadWrapperReceiver = () => receiver + return analyzer.processCallExpression({ qid: 'scope' }, setterNode as never, { callstack: [], pcond: [], einfo: {} } as never) +} + +interface FakeAnalyzerState { + pruneInfoMap: { + aggressiveMode: boolean + sinkArray: unknown[] + otherSanitizerArray: unknown[] + } + lifecycleCallDepthPrunes: Array<{ callee: string; location: Record; depth: number }> +} + +type AnalyzerProbe = JavaAnalyzer & FakeAnalyzerState + +const createAnalyzer = (): AnalyzerProbe => { + const analyzer = Object.create(JavaAnalyzer.prototype) as AnalyzerProbe + analyzer.pruneInfoMap = { aggressiveMode: false, sinkArray: [], otherSanitizerArray: [] } + analyzer.lifecycleCallDepthPrunes = [] + return analyzer +} + +const stateAt = (depth: number): { callstack: unknown[] } => ({ callstack: Array.from({ length: depth }, () => ({})) }) + +const fclos = { qid: 'bean.target', sid: 'target' } +const node = { loc: { sourcefile: 'Lifecycle.java', start: { line: 12, column: 4 } } } + +describe('Spring lifecycle call-depth prune', () => { + it('preserves the aggressive baseline predicate before callback protection', () => { + const analyzer = createAnalyzer() + analyzer.pruneInfoMap.aggressiveMode = true + assert.strictEqual(analyzer.checkFclosCanPruneDuringInterpret(fclos, node, [{ vtype: 'fclos' }], stateAt(12), false), true) + assert.strictEqual(analyzer.checkFclosCanPruneDuringInterpret(fclos, { ...node, arguments: [{ type: 'FunctionDefinition' }] }, [], stateAt(12), false), true) + }) + + it('keeps calls before the configured threshold and prunes at the threshold', () => { + const analyzer = createAnalyzer() + assert.strictEqual(analyzer.checkFclosCanPruneDuringInterpret(fclos, node, [], stateAt(11), false), false) + assert.strictEqual(analyzer.checkFclosCanPruneDuringInterpret(fclos, node, [], stateAt(12), false), false) + analyzer.withLifecycleCallDepthPrune(() => { + assert.strictEqual(analyzer.checkFclosCanPruneDuringInterpret(fclos, node, [], stateAt(11), false), false) + assert.strictEqual(analyzer.checkFclosCanPruneDuringInterpret(fclos, node, [], stateAt(12), false), true) + }) + assert.deepStrictEqual(analyzer.getLifecycleCallDepthPrunes(), [{ callee: 'bean.target', location: node.loc, depth: 12 }]) + }) + + it('prunes invocation paths at the threshold, including callgraph-originated calls', () => { + const analyzer = createAnalyzer() + analyzer.withLifecycleCallDepthPrune(() => { + assert.strictEqual(analyzer.checkFclosCanPruneDuringInterpret(fclos, node, [], stateAt(12), true), true) + }) + assert.deepStrictEqual(analyzer.getLifecycleCallDepthPrunes(), [{ callee: 'bean.target', location: node.loc, depth: 12 }]) + }) + + it('keeps lifecycle callbacks protected even when the ordinary gate is disabled', () => { + const analyzer = createAnalyzer() + analyzer.withLifecycleCallDepthPrune(() => { + assert.strictEqual(analyzer.checkFclosCanPruneDuringInterpret(fclos, { ...node, arguments: [{ type: 'FunctionDefinition' }] }, [], stateAt(12), false), false) + assert.strictEqual(analyzer.checkFclosCanPruneDuringInterpret(fclos, node, [{ vtype: 'fclos' }], stateAt(12), false), false) + }) + assert.deepStrictEqual(analyzer.getLifecycleCallDepthPrunes(), []) + }) + + it('keeps callback and closure arguments executable before depth pruning', () => { + const analyzer = createAnalyzer() + const sequenceNode = { ...node, arguments: [{ type: 'Sequence' }] } + const functionNode = { ...node, arguments: [{ type: 'FunctionDefinition' }] } + const callback = { vtype: 'fclos' } + const classValue = { vtype: 'class' } + analyzer.withLifecycleCallDepthPrune(() => { + assert.strictEqual(analyzer.checkFclosCanPruneDuringInterpret(fclos, sequenceNode, [], stateAt(12), false), false) + assert.strictEqual(analyzer.checkFclosCanPruneDuringInterpret(fclos, functionNode, [], stateAt(12), false), false) + assert.strictEqual(analyzer.checkFclosCanPruneDuringInterpret(fclos, node, [callback], stateAt(12), false), false) + assert.strictEqual(analyzer.checkFclosCanPruneDuringInterpret(fclos, node, [classValue], stateAt(12), false), false) + }) + assert.deepStrictEqual(analyzer.getLifecycleCallDepthPrunes(), []) + }) + + it('restores the dynamic scope after nested and throwing callbacks', () => { + const analyzer = createAnalyzer() + assert.throws(() => analyzer.withLifecycleCallDepthPrune(() => { + assert.strictEqual(analyzer.checkFclosCanPruneDuringInterpret(fclos, node, [], stateAt(12), false), true) + analyzer.withLifecycleCallDepthPrune(() => { + assert.strictEqual(analyzer.checkFclosCanPruneDuringInterpret(fclos, node, [], stateAt(12), false), true) + }) + throw new Error('lifecycle failure') + }), /lifecycle failure/) + assert.strictEqual(analyzer.checkFclosCanPruneDuringInterpret(fclos, node, [], stateAt(12), false), false) + assert.strictEqual(analyzer.getLifecycleCallDepthPrunes().length, 2) + }) + + it('preserves fallback eligibility for sink propagation at the depth boundary', () => { + const analyzer = createAnalyzer() + const fallback = { qid: 'bean.fallback', ast: { fdef: { type: 'FunctionDefinition' } } } + analyzer.withLifecycleCallDepthPrune(() => { + assert.strictEqual(analyzer.checkFclosCanPruneDuringInterpret(fallback, node, [], stateAt(12), false), true) + }) + assert.strictEqual(analyzer.getLifecycleCallDepthPrunes()[0]?.callee, 'bean.fallback') + assert.strictEqual(analyzer.getLifecycleCallDepthPrunes()[0]?.depth, 12) + }) + + it('preserves fallback execution hook and ARG→RET taint at the depth boundary', () => { + const analyzer = createIntegrationAnalyzer() + let hookCalls = 0 + analyzer.checkerManager.checkAtFunctionCallBefore = () => { hookCalls += 1 } + const receiver = new ObjectValue('', { sid: 'bean', qid: 'bean' }) + const input = createInputValue() + const fallback = createLifecycleFallbackFclos(analyzer, receiver) + const fallbackNode = { ...node, callee: { type: 'MemberAccess' }, arguments: [{ type: 'Literal', value: 'payload' }] } + analyzer.withLifecycleCallDepthPrune(() => { + assert.strictEqual(analyzer.checkFclosCanPruneDuringInterpret(fallback, fallbackNode, [], stateAt(12), false), true) + analyzer.checkerManager.checkAtFunctionCallBefore() + const result = analyzer.processLibArgToRet(fallbackNode, fallback, [input], { qid: 'scope' }, { pcond: [] }, createCallInfo(input)) + assert.ok(result.taint?.isTaintedRec) + assert.ok(result.getMisc('buffer')?.includes(input)) + }) + assert.strictEqual(hookCalls, 1) + }) + + it('preserves setter receiver and field write-back after lifecycle depth pruning', () => { + const analyzer = createIntegrationAnalyzer() + const receiver = new ObjectValue('', { sid: 'bean', qid: 'bean' }) + const input = createInputValue() + const result = runSetterFallback(analyzer, receiver, input) + const field = receiver.getFieldValue('name', false) + assert.ok(result) + assert.ok(receiver.taint.isTaintedRec) + assert.ok(field?.taint?.isTaintedRec) + }) + + it('does not prune ordinary entrypoints when the lifecycle scope is inactive', () => { + const analyzer = createAnalyzer() + assert.strictEqual(analyzer.checkFclosCanPruneDuringInterpret(fclos, node, [], stateAt(50), false), false) + assert.strictEqual(analyzer.checkFclosCanPruneDuringInterpret(fclos, node, [], stateAt(50), true), false) + assert.deepStrictEqual(analyzer.getLifecycleCallDepthPrunes(), []) + }) +}) diff --git a/test/python/expect/pythonbenchmark-expect.result b/test/python/expect/pythonbenchmark-expect.result index abdeea70..d2534119 100644 --- a/test/python/expect/pythonbenchmark-expect.result +++ b/test/python/expect/pythonbenchmark-expect.result @@ -30,7 +30,7 @@ Trace: AffectedNodeName: taint_sink 24: CALL: taint_sink(x) /case/completeness/single_app_tracing/datatype/new_type/type_annotation_new_type_001_T.py - AffectedNodeName: taint_sink + AffectedNodeName: o 26: ARG PASS: def taint_sink(o): /case/completeness/single_app_tracing/datatype/new_type/type_annotation_new_type_001_T.py AffectedNodeName: os.system @@ -63,7 +63,7 @@ Trace: AffectedNodeName: taint_sink 17: CALL: taint_sink(sum) /case/completeness/single_app_tracing/datatype/primitives/type_annotation_complex_001_T.py - AffectedNodeName: taint_sink + AffectedNodeName: o 19: ARG PASS: def taint_sink(o): /case/completeness/single_app_tracing/datatype/primitives/type_annotation_complex_001_T.py AffectedNodeName: os.system @@ -812,9 +812,6 @@ Trace: /case/accuracy/flow_sensitive/asynchronous/asyncio_await_001_T.py AffectedNodeName: taint_src 12: ARG PASS: async def asyncio_await_001_T(taint_src): - /case/accuracy/flow_sensitive/asynchronous/asyncio_await_001_T.py - AffectedNodeName: process - 17: CALL RETURN: data = await process() /case/accuracy/flow_sensitive/asynchronous/asyncio_await_001_T.py AffectedNodeName: data 17: Var Pass: data = await process() @@ -2814,9 +2811,6 @@ Trace: /case/completeness/single_app_tracing/asynchronous_tracing/async_for/async_for_001_T.py AffectedNodeName: process 20: ARG PASS: async def process(): - /case/completeness/single_app_tracing/asynchronous_tracing/async_for/async_for_001_T.py - AffectedNodeName: async_generator - 21: CALL RETURN: async for item in async_generator(): # 使用 AsyncFor 进行异步迭代 /case/completeness/single_app_tracing/asynchronous_tracing/async_for/async_for_001_T.py AffectedNodeName: taint_sink 22: CALL: taint_sink(item) @@ -2985,12 +2979,6 @@ Trace: /case/completeness/single_app_tracing/class/complex_object/inheritance_class_001_T.py AffectedNodeName: obj 27: Var Pass: obj = Child(taint_src) - /case/completeness/single_app_tracing/class/complex_object/inheritance_class_001_T.py - AffectedNodeName: get_child_data - 28: CALL: taint_sink(obj.get_child_data()) # 通过子类方法访问父类属性 - /case/completeness/single_app_tracing/class/complex_object/inheritance_class_001_T.py - AffectedNodeName: obj - 28: ARG PASS: taint_sink(obj.get_child_data()) # 通过子类方法访问父类属性 /case/completeness/single_app_tracing/class/complex_object/inheritance_class_001_T.py AffectedNodeName: get_child_data 28: CALL RETURN: taint_sink(obj.get_child_data()) # 通过子类方法访问父类属性 @@ -2998,7 +2986,7 @@ Trace: AffectedNodeName: taint_sink 28: CALL: taint_sink(obj.get_child_data()) # 通过子类方法访问父类属性 /case/completeness/single_app_tracing/class/complex_object/inheritance_class_001_T.py - AffectedNodeName: taint_sink + AffectedNodeName: o 30: ARG PASS: def taint_sink(o): /case/completeness/single_app_tracing/class/complex_object/inheritance_class_001_T.py AffectedNodeName: os.system @@ -3138,12 +3126,6 @@ Trace: /case/completeness/single_app_tracing/class/simple_object/simple_object_005_T.py AffectedNodeName: int_box 25: Var Pass: int_box = Box(taint_src) - /case/completeness/single_app_tracing/class/simple_object/simple_object_005_T.py - AffectedNodeName: get_content - 26: CALL: taint_sink(int_box.get_content()) - /case/completeness/single_app_tracing/class/simple_object/simple_object_005_T.py - AffectedNodeName: int_box - 26: ARG PASS: taint_sink(int_box.get_content()) /case/completeness/single_app_tracing/class/simple_object/simple_object_005_T.py AffectedNodeName: get_content 26: CALL RETURN: taint_sink(int_box.get_content()) @@ -3151,7 +3133,7 @@ Trace: AffectedNodeName: taint_sink 26: CALL: taint_sink(int_box.get_content()) /case/completeness/single_app_tracing/class/simple_object/simple_object_005_T.py - AffectedNodeName: taint_sink + AffectedNodeName: o 29: ARG PASS: def taint_sink(o): /case/completeness/single_app_tracing/class/simple_object/simple_object_005_T.py AffectedNodeName: os.system @@ -7459,12 +7441,6 @@ Trace: /case/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T.py AffectedNodeName: process 13: CALL: A(taint_sink).set_name("_").clear_name().set_name(taint_src).process() - /case/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T.py - AffectedNodeName: A(taint_sink).set_name(_).clear_name().set_name(ta - 13: ARG PASS: A(taint_sink).set_name("_").clear_name().set_name(taint_src).process() - /case/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T.py - AffectedNodeName: process - 13: CALL: A(taint_sink).set_name("_").clear_name().set_name(taint_src).process() /case/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T.py AffectedNodeName: process 33: ARG PASS: def process(self): @@ -7472,7 +7448,7 @@ Trace: AffectedNodeName: taint_sink 34: CALL: self.taint_sink(self.name) # 使用保存的污染接收函数 /case/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T.py - AffectedNodeName: o + AffectedNodeName: taint_sink 16: ARG PASS: def taint_sink(o): /case/completeness/single_app_tracing/function_call/chained_call/chained_call_002_T.py AffectedNodeName: os.system @@ -8206,26 +8182,17 @@ Trace: /case/completeness/single_app_tracing/function_call/override/constructor_extends_001_T.py AffectedNodeName: derived 12: Var Pass: derived = DerivedClass(taint_src) - /case/completeness/single_app_tracing/function_call/override/constructor_extends_001_T.py - AffectedNodeName: process - 13: CALL: derived.process() - /case/completeness/single_app_tracing/function_call/override/constructor_extends_001_T.py - AffectedNodeName: derived - 13: ARG PASS: derived.process() /case/completeness/single_app_tracing/function_call/override/constructor_extends_001_T.py AffectedNodeName: get_data 31: CALL: taint_sink(self.get_data()) /case/completeness/single_app_tracing/function_call/override/constructor_extends_001_T.py AffectedNodeName: self 31: ARG PASS: taint_sink(self.get_data()) - /case/completeness/single_app_tracing/function_call/override/constructor_extends_001_T.py - AffectedNodeName: get_data - 31: CALL RETURN: taint_sink(self.get_data()) /case/completeness/single_app_tracing/function_call/override/constructor_extends_001_T.py AffectedNodeName: taint_sink 31: CALL: taint_sink(self.get_data()) /case/completeness/single_app_tracing/function_call/override/constructor_extends_001_T.py - AffectedNodeName: taint_sink + AffectedNodeName: o 34: ARG PASS: def taint_sink(o): /case/completeness/single_app_tracing/function_call/override/constructor_extends_001_T.py AffectedNodeName: os.system @@ -8245,26 +8212,17 @@ Trace: /case/completeness/single_app_tracing/function_call/override/constructor_extends_003_T.py AffectedNodeName: derived 31: Var Pass: derived = DerivedClass() - /case/completeness/single_app_tracing/function_call/override/constructor_extends_003_T.py - AffectedNodeName: process - 32: CALL: derived.process() - /case/completeness/single_app_tracing/function_call/override/constructor_extends_003_T.py - AffectedNodeName: derived - 32: ARG PASS: derived.process() /case/completeness/single_app_tracing/function_call/override/constructor_extends_003_T.py AffectedNodeName: get_data 28: CALL: taint_sink(self.get_data()) /case/completeness/single_app_tracing/function_call/override/constructor_extends_003_T.py AffectedNodeName: self 28: ARG PASS: taint_sink(self.get_data()) - /case/completeness/single_app_tracing/function_call/override/constructor_extends_003_T.py - AffectedNodeName: get_data - 28: CALL RETURN: taint_sink(self.get_data()) /case/completeness/single_app_tracing/function_call/override/constructor_extends_003_T.py AffectedNodeName: taint_sink 28: CALL: taint_sink(self.get_data()) /case/completeness/single_app_tracing/function_call/override/constructor_extends_003_T.py - AffectedNodeName: taint_sink + AffectedNodeName: data 36: ARG PASS: def taint_sink(data): /case/completeness/single_app_tracing/function_call/override/constructor_extends_003_T.py AffectedNodeName: os.system @@ -8554,12 +8512,6 @@ Trace: /case/completeness/single_app_tracing/variable_scope/private_variable/private_variable_001_T.py AffectedNodeName: o 23: Var Pass: o = A(data=taint_src) # 显式传递 taint_src - /case/completeness/single_app_tracing/variable_scope/private_variable/private_variable_001_T.py - AffectedNodeName: get_data - 24: CALL: taint_sink(o.get_data()) - /case/completeness/single_app_tracing/variable_scope/private_variable/private_variable_001_T.py - AffectedNodeName: o - 24: ARG PASS: taint_sink(o.get_data()) /case/completeness/single_app_tracing/variable_scope/private_variable/private_variable_001_T.py AffectedNodeName: get_data 24: CALL RETURN: taint_sink(o.get_data()) @@ -8567,7 +8519,7 @@ Trace: AffectedNodeName: taint_sink 24: CALL: taint_sink(o.get_data()) /case/completeness/single_app_tracing/variable_scope/private_variable/private_variable_001_T.py - AffectedNodeName: taint_sink + AffectedNodeName: o 27: ARG PASS: def taint_sink(o): /case/completeness/single_app_tracing/variable_scope/private_variable/private_variable_001_T.py AffectedNodeName: os.system diff --git a/test/python/test-memory-guard-unit.ts b/test/python/test-memory-guard-unit.ts index 111f127a..84729462 100644 --- a/test/python/test-memory-guard-unit.ts +++ b/test/python/test-memory-guard-unit.ts @@ -69,15 +69,15 @@ describe('memory-guard unit', function () { console.error('[unit] empty-flush OK: total=0, no sarif') }) - it('probeMemoryAndUpdate respects 200ms throttle and sets exceeded over limit', function () { - // 用极小 limit 模拟超阈 + it('probeMemoryAndUpdate respects 200ms throttle and sets exceeded over delta limit', function () { + // delta 模式：用极小 deltaLimitMb 模拟超阈 const state = createMemoryGuardState() state.enabled = true - state.limitMb = 0 // 1 byte limit — 任何 heapUsed 都超阈 + state.deltaLimitMb = 0 // 0 byte delta limit — 任何 delta 都超阈 resetForEntryPoint(state, 'test-ep', 0) // 第一次探测：超阈 → exceeded=true const first = probeMemoryAndUpdate(state, 0) - assert.strictEqual(first, true, 'first probe should exceed limit') + assert.strictEqual(first, true, 'first probe should exceed delta limit') assert.strictEqual(state.exceeded, true) // 后续节流窗口内调用：cached exceeded=true const next = probeMemoryAndUpdate(state, 100) @@ -88,11 +88,37 @@ describe('memory-guard unit', function () { it('disabled guard never aborts', function () { const state = createMemoryGuardState() state.enabled = false - state.limitMb = 0 + state.deltaLimitMb = 0 resetForEntryPoint(state, 'test-ep', 0) const r = probeMemoryAndUpdate(state, 0) assert.strictEqual(r, false, 'disabled guard should never abort') assert.strictEqual(state.exceeded, false) console.error('[unit] disabled-guard OK') }) + + it('probeMemoryAndUpdate returns false when baselineHeapBytes is 0 (processModule guard)', function () { + // processModule 阶段未 reset baseline，guard 不生效，避免误杀 entrypoint 收集 + const state = createMemoryGuardState() + state.enabled = true + state.deltaLimitMb = 0 + // 不调 resetForEntryPoint，baselineHeapBytes 保持 0 + assert.strictEqual(state.baselineHeapBytes, 0) + const r = probeMemoryAndUpdate(state, 0) + assert.strictEqual(r, false, 'guard should not abort when baseline is 0') + assert.strictEqual(state.exceeded, false) + console.error('[unit] baseline-zero-guard OK') + }) + + it('createMemoryGuardState reads deltaLimitMb from Config', function () { + const Config = require('../../src/config') + const original = Config.entrypointMemoryLimitDeltaMB + try { + Config.entrypointMemoryLimitDeltaMB = 999 + const state = createMemoryGuardState() + assert.strictEqual(state.deltaLimitMb, 999, 'deltaLimitMb should read from Config.entrypointMemoryLimitDeltaMB') + console.error('[unit] createMemoryGuardState config-read OK') + } finally { + Config.entrypointMemoryLimitDeltaMB = original + } + }) }) \ No newline at end of file diff --git a/test/python/test-tornado-application-subclass.ts b/test/python/test-tornado-application-subclass.ts new file mode 100644 index 00000000..1baa25a9 --- /dev/null +++ b/test/python/test-tornado-application-subclass.ts @@ -0,0 +1,695 @@ +import * as assert from 'assert' +import * as fs from 'fs' +import * as os from 'os' +import * as path from 'path' +import { beforeEach, describe, it } from 'mocha' +import { + getUniqueTornadoHandlerApplication, + isTornadoFrameworkCall, + registerTornadoHandlerApplication, + resetTornadoHandlerApplications, +} from '../../src/checker/taint/python/tornado-util' + +const PythonAnalyzer = require('../../src/engine/analyzer/python/common/python-analyzer') as typeof import('../../src/engine/analyzer/python/common/python-analyzer') +const Parser = require('../../src/engine/parser/parser') as typeof import('../../src/engine/parser/parser') +const Config = require('../../src/config') as typeof import('../../src/config') + +const REPO_ROOT = path.resolve(__dirname, '../..') +const UAST4PY_PATH = process.env.UAST4PY_PATH || path.join(REPO_ROOT, 'deps/uast4py/uast4py') + +type ResolvedClass = { + id?: string + qid?: string + sid?: string + ast?: { + cdef?: { + id?: { + name?: string + } + } + } + super?: { + qid?: string + sid?: string + node_module?: boolean + } +} + +type ResolvedClassObservation = { + className?: string + qid?: string + sid?: string + superQid?: string + superNodeModule?: boolean +} + +type CallHookNode = { + callee?: { + type?: string + name?: string + property?: { + name?: string + } + } +} + +type CallHookObservation = { + fclos?: { + qid?: string + node_module?: boolean + super?: { + qid?: string + node_module?: boolean + } + } +} + +type AnalyzerHarness = { + fileList: string[] + options: unknown + pyAstParseManager: Record + topScope: ImportScope + checkerManager: { + checkAtFunctionCallAfter: ( + analyzer: unknown, + scope: unknown, + node: CallHookNode, + state: unknown, + observation: CallHookObservation, + ) => void + } + preProcess: (directory: string) => Promise + preProcess4SingleFile: (source: string, fileName: string) => void + processImportDirect: (scope: unknown, node: unknown, state: unknown) => ResolvedValue + processModule: (ast: unknown, fileName: string) => unknown + resolveClassInheritance: (classValue: ResolvedClass, state: unknown) => void +} + +type ParsedCallObservation = { + qid?: string + nodeModule?: boolean + superQid?: string + superNodeModule?: boolean +} + +function analyzeTornadoApplicationCall(source: string): ParsedCallObservation[] { + const sourceDir = fs.mkdtempSync(path.join(os.tmpdir(), 'yasa-python-tornado-call-')) + const sourceFile = path.join(sourceDir, 'entry.py') + try { + fs.writeFileSync(sourceFile, source) + const previousMainDir = Config.maindir + const previousMainDirPrefix = Config.maindirPrefix + try { + Config.maindir = sourceDir + Config.maindirPrefix = `${sourceDir}/` + const analyzer = new PythonAnalyzer({ + checkerIds: [], + checkerPackIds: [], + printers: [], + language: 'python', + uastSDKPath: UAST4PY_PATH, + }) as unknown as AnalyzerHarness + const observed: ParsedCallObservation[] = [] + const checkAtFunctionCallAfter = analyzer.checkerManager.checkAtFunctionCallAfter.bind(analyzer.checkerManager) + analyzer.checkerManager.checkAtFunctionCallAfter = (callAnalyzer, scope, node, state, observation): void => { + const isApplicationCall = + (node.callee?.type === 'Identifier' && node.callee.name === 'Application') || + (node.callee?.type === 'MemberAccess' && node.callee.property?.name === 'Application') + if (isApplicationCall) { + observed.push({ + qid: observation.fclos?.qid, + nodeModule: observation.fclos?.node_module, + superQid: observation.fclos?.super?.qid, + superNodeModule: observation.fclos?.super?.node_module, + }) + } + checkAtFunctionCallAfter(callAnalyzer, scope, node, state, observation) + } + analyzer.preProcess4SingleFile(source, sourceFile) + return observed + } finally { + Config.maindir = previousMainDir + Config.maindirPrefix = previousMainDirPrefix + } + } finally { + fs.rmSync(sourceDir, { recursive: true, force: true }) + } +} + +type ResolvedValue = { + qid?: string + sid?: string + node_module?: boolean + getMemberValue?: (name: string) => ResolvedValue | null +} + +type ImportObservation = { + qid?: string + sid?: string + nodeModule?: boolean + root?: ResolvedValue +} + +type ImportScope = { + getMemberValue?: (name: string) => ResolvedValue | null +} + +function memberValue(root: ResolvedValue | undefined, path: string[]): ResolvedValue | undefined { + return path.reduce((value, property) => value?.getMemberValue?.(property) ?? undefined, root) +} + +function observeCachedImportScopes(): ImportObservation[] { + const sourceDir = fs.mkdtempSync(path.join(os.tmpdir(), 'yasa-python-import-cache-')) + const sourceFile = path.join(sourceDir, 'entry.py') + try { + const source = [ + 'import tornado.web', + '', + 'class Container:', + ' import tornado.web', + ].join('\n') + fs.writeFileSync(sourceFile, source) + const previousMainDir = Config.maindir + const previousMainDirPrefix = Config.maindirPrefix + try { + Config.maindir = sourceDir + Config.maindirPrefix = `${sourceDir}/` + const analyzer = new PythonAnalyzer({ + checkerIds: [], + checkerPackIds: [], + printers: [], + language: 'python', + uastSDKPath: UAST4PY_PATH, + }) as unknown as AnalyzerHarness + const scopes: ImportScope[] = [] + const processImportDirect = analyzer.processImportDirect.bind(analyzer) + analyzer.processImportDirect = (scope, node, state): ResolvedValue => { + scopes.push(scope as ImportScope) + return processImportDirect(scope, node, state) + } + analyzer.preProcess4SingleFile(source, sourceFile) + return [...new Set(scopes)].map((scope) => { + const root = scope.getMemberValue?.('tornado') ?? undefined + const value = memberValue(root, ['web']) + return { qid: value?.qid, sid: value?.sid, nodeModule: value?.node_module, root } + }) + } finally { + Config.maindir = previousMainDir + Config.maindirPrefix = previousMainDirPrefix + } + } finally { + fs.rmSync(sourceDir, { recursive: true, force: true }) + } +} + +function observeImport( + source: string, + lexicalRoot: string, + memberPath: string[] = [], + localFiles: Record = {}, +): ImportObservation { + const sourceDir = fs.mkdtempSync(path.join(os.tmpdir(), 'yasa-python-import-')) + const sourceFile = path.join(sourceDir, 'entry.py') + try { + fs.writeFileSync(sourceFile, source) + for (const [relativeFile, contents] of Object.entries(localFiles)) { + const target = path.join(sourceDir, relativeFile) + fs.mkdirSync(path.dirname(target), { recursive: true }) + fs.writeFileSync(target, contents) + } + const previousMainDir = Config.maindir + const previousMainDirPrefix = Config.maindirPrefix + try { + Config.maindir = sourceDir + Config.maindirPrefix = `${sourceDir}/` + const analyzer = new PythonAnalyzer({ + checkerIds: [], + checkerPackIds: [], + printers: [], + language: 'python', + uastSDKPath: UAST4PY_PATH, + }) as unknown as AnalyzerHarness + for (const relativeFile of Object.keys(localFiles)) { + const target = path.join(sourceDir, relativeFile) + analyzer.fileList.push(target) + analyzer.pyAstParseManager[target] = Parser.parseSingleFile(target, analyzer.options) + } + let lexicalScope: ImportScope | undefined + const processImportDirect = analyzer.processImportDirect.bind(analyzer) + analyzer.processImportDirect = (scope, node, state): ResolvedValue => { + lexicalScope = scope as ImportScope + return processImportDirect(scope, node, state) + } + analyzer.preProcess4SingleFile(source, sourceFile) + const root = lexicalScope?.getMemberValue?.(lexicalRoot) ?? undefined + const value = memberValue(root, memberPath) + return { qid: value?.qid, sid: value?.sid, nodeModule: value?.node_module, root } + } finally { + Config.maindir = previousMainDir + Config.maindirPrefix = previousMainDirPrefix + } + } finally { + fs.rmSync(sourceDir, { recursive: true, force: true }) + } +} + +async function observeLoadedLocalDottedImport(): Promise { + const sourceDir = fs.mkdtempSync(path.join(os.tmpdir(), 'yasa-python-loaded-import-')) + const sourceFile = path.join(sourceDir, 'entry.py') + const localModule = path.join(sourceDir, 'localpkg', 'submodule.py') + try { + fs.mkdirSync(path.dirname(localModule), { recursive: true }) + fs.writeFileSync(sourceFile, 'import localpkg.submodule\n') + fs.writeFileSync(localModule, 'class Target:\n pass\n') + const previousMainDir = Config.maindir + const previousMainDirPrefix = Config.maindirPrefix + try { + Config.maindir = sourceDir + Config.maindirPrefix = `${sourceDir}/` + const analyzer = new PythonAnalyzer({ + checkerIds: [], + checkerPackIds: [], + printers: [], + language: 'python', + uastSDKPath: UAST4PY_PATH, + }) as unknown as AnalyzerHarness + let lexicalScope: ImportScope | undefined + const processImportDirect = analyzer.processImportDirect.bind(analyzer) + analyzer.processImportDirect = (scope, node, state): ResolvedValue => { + lexicalScope = scope as ImportScope + return processImportDirect(scope, node, state) + } + await analyzer.preProcess(sourceDir) + const root = lexicalScope?.getMemberValue?.('localpkg') ?? undefined + const value = memberValue(root, ['submodule']) + return { qid: value?.qid, nodeModule: value?.node_module, root } + } finally { + Config.maindir = previousMainDir + Config.maindirPrefix = previousMainDirPrefix + } + } finally { + fs.rmSync(sourceDir, { recursive: true, force: true }) + } +} + +function observeUnloadedLocalDottedImport(): ImportObservation { + const sourceDir = fs.mkdtempSync(path.join(os.tmpdir(), 'yasa-python-unloaded-import-')) + const sourceFile = path.join(sourceDir, 'entry.py') + const localModule = path.join(sourceDir, 'localpkg', 'submodule.py') + try { + fs.mkdirSync(path.dirname(localModule), { recursive: true }) + fs.writeFileSync(sourceFile, 'import localpkg.submodule\n') + fs.writeFileSync(localModule, 'class Target:\n pass\n') + const previousMainDir = Config.maindir + const previousMainDirPrefix = Config.maindirPrefix + try { + Config.maindir = sourceDir + Config.maindirPrefix = `${sourceDir}/` + const analyzer = new PythonAnalyzer({ + checkerIds: [], + checkerPackIds: [], + printers: [], + language: 'python', + uastSDKPath: UAST4PY_PATH, + }) as unknown as AnalyzerHarness + analyzer.fileList.push(localModule) + analyzer.preProcess4SingleFile(fs.readFileSync(sourceFile, 'utf8'), sourceFile) + const root = analyzer.topScope.value.localpkg + return { qid: root?.value?.submodule?.qid, nodeModule: root?.value?.submodule?.node_module, root } + } finally { + Config.maindir = previousMainDir + Config.maindirPrefix = previousMainDirPrefix + } + } finally { + fs.rmSync(sourceDir, { recursive: true, force: true }) + } +} + +function analyzeClass(source: string, className: string): ResolvedClassObservation | undefined { + const sourceDir = fs.mkdtempSync(path.join(os.tmpdir(), 'yasa-python-inheritance-')) + const sourceFile = path.join(sourceDir, 'entry.py') + try { + fs.writeFileSync(sourceFile, source) + return analyzeClassFile(source, sourceFile, className, sourceDir) + } finally { + fs.rmSync(sourceDir, { recursive: true, force: true }) + } +} + +function analyzeFixtureClass(sourceFile: string, className: string): ResolvedClassObservation | undefined { + return analyzeClassFile(fs.readFileSync(sourceFile, 'utf8'), sourceFile, className, path.dirname(sourceFile)) +} + +function analyzeClassFile(source: string, sourceFile: string, className: string, mainDir: string): ResolvedClassObservation | undefined { + const previousMainDir = Config.maindir + const previousMainDirPrefix = Config.maindirPrefix + try { + Config.maindir = mainDir + Config.maindirPrefix = `${mainDir}/` + const analyzer = new PythonAnalyzer({ + checkerIds: [], + checkerPackIds: [], + printers: [], + language: 'python', + uastSDKPath: UAST4PY_PATH, + }) as unknown as AnalyzerHarness + const resolved: ResolvedClass[] = [] + const resolveClassInheritance = analyzer.resolveClassInheritance.bind(analyzer) + analyzer.resolveClassInheritance = (classValue, state): void => { + resolveClassInheritance(classValue, state) + resolved.push(classValue) + } + analyzer.preProcess4SingleFile(source, sourceFile) + const classValue = resolved.find((candidate) => candidate.ast?.cdef?.id?.name === className) ?? resolved.at(-1) + if (!classValue) return undefined + return { + className: classValue.ast?.cdef?.id?.name, + qid: classValue.qid, + sid: classValue.sid, + superQid: classValue.super?.qid, + superNodeModule: classValue.super?.node_module, + } + } finally { + Config.maindir = previousMainDir + Config.maindirPrefix = previousMainDirPrefix + } +} + +type CallExpression = { + type: 'CallExpression' + callee: { + type: 'Identifier' + name: string + } +} + +type CallableValue = { + node_module?: boolean + qid?: string + sid?: string + super?: CallableValue + ast?: { + node?: { type?: string } + cdef?: { type?: string } + } +} + +type TornadoApplicationInstance = { + setFieldValue: (name: string, value: unknown) => void +} + +type PythonAnalyzerTornadoInjector = { + injectTornadoApplication: (instance: TornadoApplicationInstance, handler: CallableValue) => void +} + +type TornadoTaintLifecycle = { + triggerAtStartOfAnalyze: (analyzer: unknown, scope: unknown, node: unknown, state: unknown, info: unknown) => void +} + +const TornadoTaintChecker = require('../../src/checker/taint/python/tornado-taint-checker') as new (...args: unknown[]) => TornadoTaintLifecycle + +function injectTornadoApplication(instance: TornadoApplicationInstance, handler: CallableValue): void { + const prototype = PythonAnalyzer.prototype as PythonAnalyzerTornadoInjector + prototype.injectTornadoApplication.call(prototype, instance, handler) +} + +function call(targetName: string): CallExpression { + return { + type: 'CallExpression', + callee: { type: 'Identifier', name: targetName }, + } +} + +function directTornadoApplication(): CallableValue { + return { node_module: true, qid: 'tornado.web.Application' } +} + +function localApplicationSubclass(superclass: CallableValue = directTornadoApplication()): CallableValue { + return { + qid: 'app.LocalApplication', + ast: { node: { type: 'ClassDefinition' } }, + super: superclass, + } +} + +describe('Python dotted import provenance', () => { + it('preserves the canonical external root chain for a dotted import', function () { + this.timeout(30000) + const imported = observeImport('import tornado.web', 'tornado', ['web']) + + assert.strictEqual(imported.nodeModule, true) + assert.ok(imported.qid?.endsWith('tornado.web')) + assert.strictEqual(imported.root?.getMemberValue?.('web')?.node_module, true) + assert.ok(imported.root?.getMemberValue?.('web')?.qid?.endsWith('tornado.web')) + }) + + it('rebinds a cached dotted import into every lexical scope', function () { + this.timeout(30000) + const imports = observeCachedImportScopes() + + assert.strictEqual(imports.length, 2) + for (const imported of imports) { + assert.strictEqual(imported.nodeModule, true) + assert.ok(imported.qid?.endsWith('tornado.web')) + assert.strictEqual(imported.root?.getMemberValue?.('web')?.node_module, true) + } + assert.notStrictEqual(imports[0].root, imports[1].root) + }) + + it('binds a dotted import alias to the terminal module only', function () { + this.timeout(30000) + const imported = observeImport('import tornado.web as tw', 'tw') + + assert.strictEqual(imported.nodeModule, true) + assert.ok(imported.qid?.endsWith('tornado.web')) + assert.strictEqual(imported.root?.getMemberValue?.('web'), null) + }) + + it('retains terminal aliases without creating a root hierarchy', function () { + this.timeout(30000) + const aliases = ['x', '别名'] + + for (const alias of aliases) { + const imported = observeImport(`import tornado.web as ${alias}`, alias) + + assert.strictEqual(imported.nodeModule, true) + assert.ok(imported.qid?.endsWith('tornado.web')) + assert.strictEqual(imported.root?.getMemberValue?.('web'), null) + } + }) + + it('retains escaped-continuation aliases without creating a root hierarchy', function () { + this.timeout(30000) + const imported = observeImport('import tornado.web as \\\n x', 'x') + + assert.strictEqual(imported.nodeModule, true) + assert.ok(imported.qid?.endsWith('tornado.web')) + assert.strictEqual(imported.root?.getMemberValue?.('web'), null) + }) + + it('keeps from-import provenance exact', function () { + this.timeout(30000) + const imported = observeImport('from tornado.web import Application', 'Application') + + assert.strictEqual(imported.nodeModule, true) + assert.ok(imported.qid?.endsWith('tornado.web.Application')) + }) + + it('preserves every external segment in a three-segment dotted import', function () { + this.timeout(30000) + const imported = observeImport('import tornado.httputil.HTTPHeaders', 'tornado', ['httputil', 'HTTPHeaders']) + + assert.strictEqual(imported.nodeModule, true) + assert.ok(imported.qid?.endsWith('tornado.httputil.HTTPHeaders')) + assert.strictEqual(imported.root?.getMemberValue?.('httputil')?.node_module, true) + assert.strictEqual(imported.root?.getMemberValue?.('httputil')?.getMemberValue?.('HTTPHeaders')?.node_module, true) + }) + + it('keeps a fully preprocessed project-local dotted import local', async function () { + this.timeout(30000) + const imported = await observeLoadedLocalDottedImport() + + assert.strictEqual(imported.nodeModule, undefined) + assert.notStrictEqual(imported.qid, 'localpkg') + }) + + it('does not inject external metadata for an unloaded local dotted import', function () { + this.timeout(30000) + const imported = observeUnloadedLocalDottedImport() + + assert.strictEqual(imported.nodeModule, undefined) + assert.notStrictEqual(imported.root?.qid, 'localpkg') + }) +}) + +describe('Parsed Tornado Application call provenance', () => { + it('preserves external provenance at a parsed from-import Application call', function () { + this.timeout(30000) + const observed = analyzeTornadoApplicationCall([ + 'from tornado.web import Application', + 'app = Application([])', + ].join('\n')) + + assert.strictEqual(observed.length, 1) + assert.strictEqual(observed[0].nodeModule, true) + assert.ok(observed[0].qid?.endsWith('tornado.web.Application')) + }) + + it('preserves external provenance at a parsed qualified Application call', function () { + this.timeout(30000) + const observed = analyzeTornadoApplicationCall([ + 'import tornado.web', + 'app = tornado.web.Application([])', + ].join('\n')) + + assert.strictEqual(observed.length, 1) + assert.strictEqual(observed[0].nodeModule, true, JSON.stringify(observed)) + assert.ok(observed[0].qid?.endsWith('tornado.web.Application'), JSON.stringify(observed)) + }) + + it('preserves the direct external superclass at a parsed local Application call', function () { + this.timeout(30000) + const observed = analyzeTornadoApplicationCall([ + 'import tornado.web', + '', + 'class Application(tornado.web.Application):', + ' pass', + '', + 'app = Application([])', + ].join('\n')) + + assert.strictEqual(observed.length, 1) + assert.strictEqual(observed[0].nodeModule, undefined) + assert.strictEqual(observed[0].superNodeModule, true) + assert.ok(observed[0].superQid?.endsWith('tornado.web.Application')) + }) +}) + +describe('Tornado handler Application registration', () => { + const handler = (): CallableValue => ({ + qid: 'app.Handler', + ast: { node: { type: 'ClassDefinition' } }, + }) + + beforeEach(() => { + resetTornadoHandlerApplications() + }) + + it('injects the application for one registered handler application', () => { + const application = { qid: 'app.one' } + const fields = new Map() + registerTornadoHandlerApplication(handler(), application) + + injectTornadoApplication({ setFieldValue: (name, value): void => fields.set(name, value) }, handler()) + + assert.strictEqual(fields.get('application'), application) + }) + + it('does not inject an application when a handler has no registration', () => { + const fields = new Map() + + injectTornadoApplication({ setFieldValue: (name, value): void => fields.set(name, value) }, handler()) + + assert.strictEqual(fields.has('application'), false) + }) + + it('fails closed without injection when a handler belongs to multiple applications', () => { + const fields = new Map() + registerTornadoHandlerApplication(handler(), { qid: 'app.one' }) + registerTornadoHandlerApplication(handler(), { qid: 'app.two' }) + + injectTornadoApplication({ setFieldValue: (name, value): void => fields.set(name, value) }, handler()) + + assert.strictEqual(fields.has('application'), false) + }) + + it('clears registrations at the next analysis lifecycle start', () => { + const checker = new TornadoTaintChecker({}) + registerTornadoHandlerApplication(handler(), { qid: 'previous.app' }) + + checker.triggerAtStartOfAnalyze(undefined, undefined, undefined, undefined, undefined) + + assert.strictEqual(getUniqueTornadoHandlerApplication(handler()), undefined) + }) +}) + +describe('Tornado Application subclass provenance', () => { + it('resolves qualified external and local direct bases without creating self-cycles', function () { + this.timeout(30000) + const qualifiedApplication = analyzeClass([ + 'import tornado.web', + '', + 'class Application(tornado.web.Application):', + ' pass', + ].join('\n'), 'Application') + const selfReferentialApplication = analyzeClass([ + 'class Application(Application):', + ' pass', + ].join('\n'), 'Application') + const child = analyzeClass([ + 'class Base:', + ' pass', + '', + 'class Child(Base):', + ' pass', + ].join('\n'), 'Child') + + assert.strictEqual(qualifiedApplication?.superQid, '.entry.tornado.web.Application') + assert.strictEqual(qualifiedApplication?.superNodeModule, true) + assert.strictEqual(selfReferentialApplication?.superQid, undefined) + assert.strictEqual(child?.superQid, '.entry.Base') + }) + + it('accepts a direct external Application', () => { + assert.strictEqual(isTornadoFrameworkCall(call('Application'), 'Application', directTornadoApplication()), true) + }) + + it('accepts a local class whose immediate resolved base is tornado.web.Application', () => { + assert.strictEqual(isTornadoFrameworkCall(call('Application'), 'Application', localApplicationSubclass()), true) + }) + + it('rejects a same-named local class with no base', () => { + assert.strictEqual( + isTornadoFrameworkCall(call('Application'), 'Application', { qid: 'app.Application', ast: { node: { type: 'ClassDefinition' } } }), + false, + ) + }) + + it('rejects a local class with an unresolved parent', () => { + assert.strictEqual(isTornadoFrameworkCall(call('Application'), 'Application', localApplicationSubclass({ qid: 'app.Base' })), false) + }) + + it('rejects a direct external Tornado class other than Application', () => { + assert.strictEqual(isTornadoFrameworkCall(call('Application'), 'Application', { node_module: true, qid: 'tornado.web.Other' }), false) + }) + + it('rejects a local class whose immediate base is another Tornado class', () => { + assert.strictEqual( + isTornadoFrameworkCall(call('Application'), 'Application', localApplicationSubclass({ node_module: true, qid: 'tornado.web.Other' })), + false, + ) + }) + + it('rejects non-ClassDefinition values with a matching direct super', () => { + assert.strictEqual( + isTornadoFrameworkCall(call('Application'), 'Application', { qid: 'app.NotAClass', ast: { node: { type: 'FunctionDefinition' } }, super: directTornadoApplication() }), + false, + ) + }) + + it('rejects a local Application subclass when evaluating another target', () => { + assert.strictEqual(isTornadoFrameworkCall(call('RequestHandler'), 'RequestHandler', localApplicationSubclass()), false) + }) + + it('rejects a multi-inheritance value whose retained direct super is not Tornado Application', () => { + const tornadoBase = directTornadoApplication() + assert.strictEqual( + isTornadoFrameworkCall( + call('Application'), + 'Application', + localApplicationSubclass({ node_module: true, qid: 'app.FinalBase', super: tornadoBase }), + ), + false, + ) + }) +}) diff --git a/test/rules-basic-handler/test-sink-util-go-qid-fallback.ts b/test/rules-basic-handler/test-sink-util-go-qid-fallback.ts new file mode 100644 index 00000000..dc37be48 --- /dev/null +++ b/test/rules-basic-handler/test-sink-util-go-qid-fallback.ts @@ -0,0 +1,165 @@ +/** + * Go `http.Client.*` 实例方法 sink 匹配的 qid fallback 需要兼容 Go 包路径 `/` 分隔符。 + * + * Go qid 形如 `net/http.Client.Do`，rule.fsig 形如 `http.Client.Do`， + * 直接 `endsWith` 因前导字符 `/` ≠ `.` 失配； + * 修复方案：把 `cleanQid` 中的 `/` 归一化为 `.` 后再做 `endsWith` 比较。 + */ +import { describe, it } from 'mocha' +import * as assert from 'assert' +const { matchEmptyCalleeTypeInstanceMethod } = require('../../src/checker/taint/common-kit/sink-util') + +interface AstNode { + type: string + [key: string]: any +} + +function id(name: string): AstNode { + return { type: 'Identifier', name } +} + +function member(obj: AstNode, propName: string): AstNode { + return { + type: 'MemberAccess', + object: obj, + property: { type: 'Identifier', name: propName }, + } +} + +/** + * 构造 `client.Do(req)` 形式的 callExpr + fclos。 + * - callExpr.type = 'MemberAccess'，property = 'Do' + * - fclos.property = 'Do' + * - fclos.qid 由测试用例控制（Go 包路径用 `/` 分隔） + * - fclos.object.rtype.definiteType = N/A（rtype 解析缺失场景，强制走 qid fallback） + * - fclos.rtype.definiteType = N/A + */ +function mockClientDoCall(qid: string): { callExpr: AstNode; fclos: any } { + const receiver = id('client') + return { + callExpr: member(receiver, 'Do'), + fclos: { + object: { + rtype: { definiteType: id('N/A'), vagueType: id('client') }, + }, + property: id('Do'), + rtype: { definiteType: id('N/A') }, + qid, + }, + } +} + +describe('sink-util × Go qid fallback 包路径分隔符兼容', () => { + describe('matchEmptyCalleeTypeInstanceMethod qid fallback', () => { + it('QF-1: Go 包路径 qid `net/http.Client.Do` + fsig `http.Client.Do` → 命中', () => { + const { callExpr, fclos } = mockClientDoCall('net/http.Client.Do') + const rule = { args: ['0'], attribute: ['GoSsrf'], calleeType: '', fsig: 'http.Client.Do' } + assert.strictEqual(matchEmptyCalleeTypeInstanceMethod(callExpr, fclos, rule), true) + }) + + it('QF-2: Go 包路径 qid `net/http.Client.Get` + fsig `http.Client.Get` → 命中', () => { + const callExpr = member(id('client'), 'Get') + const fclos = { + object: { rtype: { definiteType: id('N/A'), vagueType: id('client') } }, + property: id('Get'), + rtype: { definiteType: id('N/A') }, + qid: 'net/http.Client.Get', + } + const rule = { args: ['0'], attribute: ['GoSsrf'], calleeType: '', fsig: 'http.Client.Get' } + assert.strictEqual(matchEmptyCalleeTypeInstanceMethod(callExpr, fclos, rule), true) + }) + + it('QF-3: Go 包路径 qid `net/http.Client.Post` + fsig `http.Client.Post` → 命中', () => { + const callExpr = member(id('client'), 'Post') + const fclos = { + object: { rtype: { definiteType: id('N/A'), vagueType: id('client') } }, + property: id('Post'), + rtype: { definiteType: id('N/A') }, + qid: 'net/http.Client.Post', + } + const rule = { args: ['0'], attribute: ['GoSsrf'], calleeType: '', fsig: 'http.Client.Post' } + assert.strictEqual(matchEmptyCalleeTypeInstanceMethod(callExpr, fclos, rule), true) + }) + + it('QF-4: Go 包路径 qid `net/http.Client.Head` + fsig `http.Client.Head` → 命中', () => { + const callExpr = member(id('client'), 'Head') + const fclos = { + object: { rtype: { definiteType: id('N/A'), vagueType: id('client') } }, + property: id('Head'), + rtype: { definiteType: id('N/A') }, + qid: 'net/http.Client.Head', + } + const rule = { args: ['0'], attribute: ['GoSsrf'], calleeType: '', fsig: 'http.Client.Head' } + assert.strictEqual(matchEmptyCalleeTypeInstanceMethod(callExpr, fclos, rule), true) + }) + + it('QF-5: Go 包路径 qid `net/http.Client.PostForm` + fsig `http.Client.PostForm` → 命中', () => { + const callExpr = member(id('client'), 'PostForm') + const fclos = { + object: { rtype: { definiteType: id('N/A'), vagueType: id('client') } }, + property: id('PostForm'), + rtype: { definiteType: id('N/A') }, + qid: 'net/http.Client.PostForm', + } + const rule = { args: ['0'], attribute: ['GoSsrf'], calleeType: '', fsig: 'http.Client.PostForm' } + assert.strictEqual(matchEmptyCalleeTypeInstanceMethod(callExpr, fclos, rule), true) + }) + + it('QF-6: 修复前失配验证 — qid 含 `` 标记被清掉后仍保留 `/` 分隔符路径', () => { + const { callExpr, fclos } = mockClientDoCall('net/http.Client.Do') + const rule = { args: ['0'], attribute: ['GoSsrf'], calleeType: '', fsig: 'http.Client.Do' } + assert.strictEqual(matchEmptyCalleeTypeInstanceMethod(callExpr, fclos, rule), true) + }) + + it('QF-7: 深层包路径 qid `example.com/pkg/sub/http.Client.Do` + fsig `http.Client.Do` → 命中', () => { + const { callExpr, fclos } = mockClientDoCall('example.com/pkg/sub/http.Client.Do') + const rule = { args: ['0'], attribute: ['GoSsrf'], calleeType: '', fsig: 'http.Client.Do' } + assert.strictEqual(matchEmptyCalleeTypeInstanceMethod(callExpr, fclos, rule), true) + }) + + it('QF-8: qid 方法名与 fsig 不匹配 → 不命中', () => { + const { callExpr, fclos } = mockClientDoCall('net/http.Client.Do') + const rule = { args: ['0'], attribute: ['GoSsrf'], calleeType: '', fsig: 'http.Client.Get' } + // propertyName='Do' vs methodName='Get' → L382 直接 return false + assert.strictEqual(matchEmptyCalleeTypeInstanceMethod(callExpr, fclos, rule), false) + }) + + it('QF-9: qid 类型名与 fsig 不匹配 → 不命中', () => { + const { callExpr, fclos } = mockClientDoCall('net/http.OtherClient.Do') + const rule = { args: ['0'], attribute: ['GoSsrf'], calleeType: '', fsig: 'http.Client.Do' } + assert.strictEqual(matchEmptyCalleeTypeInstanceMethod(callExpr, fclos, rule), false) + }) + + it('QF-10: 非 `/` 分隔符 qid（Java/Python 形式）不受影响', () => { + // Java qid 形如 `com.example.HttpClient.doRequest`，无 `/` + const callExpr = member(id('client'), 'doRequest') + const fclos = { + object: { rtype: { definiteType: id('N/A'), vagueType: id('client') } }, + property: id('doRequest'), + rtype: { definiteType: id('N/A') }, + qid: 'com.example.HttpClient.doRequest', + } + const rule = { args: ['0'], attribute: ['JavaSsrf'], calleeType: '', fsig: 'HttpClient.doRequest' } + assert.strictEqual(matchEmptyCalleeTypeInstanceMethod(callExpr, fclos, rule), true) + }) + + it('QF-11: calleeType 不为空 → L375 直接 return false，qid fallback 不跑', () => { + const { callExpr, fclos } = mockClientDoCall('net/http.Client.Do') + const rule = { args: ['0'], attribute: ['GoSsrf'], calleeType: '*http.Client', fsig: 'http.Client.Do' } + assert.strictEqual(matchEmptyCalleeTypeInstanceMethod(callExpr, fclos, rule), false) + }) + + it('QF-12: fsig 不含点 → L375 直接 return false，qid fallback 不跑', () => { + const { callExpr, fclos } = mockClientDoCall('net/http.Client.Do') + const rule = { args: ['0'], attribute: ['GoSsrf'], calleeType: '', fsig: 'Do' } + assert.strictEqual(matchEmptyCalleeTypeInstanceMethod(callExpr, fclos, rule), false) + }) + + it('QF-13: callExpr 不是 MemberAccess → return false', () => { + const callExpr = { type: 'Identifier', name: 'Do' } + const fclos = mockClientDoCall('net/http.Client.Do').fclos + const rule = { args: ['0'], attribute: ['GoSsrf'], calleeType: '', fsig: 'http.Client.Do' } + assert.strictEqual(matchEmptyCalleeTypeInstanceMethod(callExpr, fclos, rule), false) + }) + }) +}) diff --git a/test/spring-entrypoint-runner.test.ts b/test/spring-entrypoint-runner.test.ts index 2855da52..e4ee92f4 100644 --- a/test/spring-entrypoint-runner.test.ts +++ b/test/spring-entrypoint-runner.test.ts @@ -252,3 +252,21 @@ describe('Spring production entrypoint runner seam', () => { assert.strictEqual(budget?.allocationMs, 500_000) }) }) + + +describe('Spring timeout lifecycle ordering', () => { + it('records timeout enqueue after execute returns', () => { + const events: string[] = [] + const plan = createDeadlinePlan({ outerDeadline: 1000, finalizationReserveMs: 0, exitReserveMs: 0 }, () => 0) + type TimeoutState = { entryPointDeadline?: number; entryPointClock?: () => number; entryPointTimeoutLatch?: { timedOut: boolean; trip(): boolean; reset(): void } } + const state: TimeoutState = {} + runAllocatedAttempt({ + plan, remainingAttempts: 1, configuredCapMs: 600, state, clock: () => 0, + execute: () => { events.push('execute'); state.entryPointTimeoutLatch.trip() }, + after: () => events.push('after'), + enqueueTimeout: () => events.push('enqueue'), + overload: overload('timeout'), entryPoint: { id: 1 }, args: [], + }) + assert.deepStrictEqual(events, ['execute', 'after', 'enqueue']) + }) +})