gitnexus-taint-analysis

Taint propagation traces how data flows from sources to sinks by navigating the control flow graph and program dependence graph. It applies strict data-flow sequencing and monotone propagation for reproducible findings.

Interprocedural taint analysis composes function-level summaries across the call graph to reveal source-to-sink taint propagation paths. It satisfies a summary-based model to track flows between functions.

Taint explain outputs illuminate source-to-sink data flows by detailing the propagation path. Reviewing these outputs helps developers verify sanitizer handling and trace intra-procedural data-flow traces.

Intra-procedural taint analysis traces data-flow from sources to sinks within a single function. It identifies whether tainted input reaches a sink and verifies if sanitizers interrupt the propagation path.

Extending to interprocedural analysis requires composing function-level taint summaries across the call graph. This ensures deterministic data-flow sequencing is maintained when tracing paths between callers and callees.

Inconsistent findings occur when propagation is not deterministic and monotone. The analysis requires strict data-flow sequencing and a summary-based interprocedural model to guarantee reproducible taint propagation results.