gitnexus-taint-analysis

To debug missing taint flows, analyze the GitNexus program analysis subsystem to review reaching definitions and intra/inter-procedural data flow logic. This helps identify gaps in control-flow graph traversal or source-to-sink connections within the PDG output.

Inter-procedural taint analysis tracks data flow across function boundaries using control-flow graphs (CFG) and program dependence graphs (PDG). It maps how untrusted inputs propagate as reaching definitions from sources to sinks throughout the entire program call graph.

Extending data flow sources and sinks involves modifying the GitNexus taint analysis subsystem. Developers reason about the control-flow graph to integrate new entry and exit points, ensuring the PDG accurately captures the updated source-to-sink data flow paths.

Yes, you can trace reaching definitions for intra-procedural data flow. The expertise covers both intra and inter-procedural taint analysis, allowing you to reason about local control-flow graphs and variable definitions within individual function scopes.

The best way to review program dependence graph (PDG) generation is by deeply analyzing the GitNexus subsystem code that constructs control-flow graphs and reaching definitions. This ensures accurate source-to-sink taint propagation mapping during inter-procedural analysis.