gitnexus-taint-analysis

Taint analysis tracks how untrusted data flows from sources to sinks using control-flow graphs and reaching definitions. It is needed when reviewing code for security vulnerabilities or understanding interprocedural data dependencies across function calls.

To debug false positives in source to sink data-flow findings, examine the program dependence graph output and the layered taint analysis build order. Tracing reaching definitions and interprocedural control-flow edges helps isolate which layer introduces the incorrect path.

Reviewing interprocedural taint code requires understanding the layered build order of the analysis subsystem. Examine how each layer contributes to control-flow graphs and reaching definitions to extend source-to-sink data-flow tracking accurately.

A program dependence graph models both data and control dependencies between program statements. It provides the structural substrate needed to trace source-to-sink data-flow paths and reason about reaching definitions during interprocedural taint analysis.

Interprocedural taint analysis produces false negatives when reaching definitions or control-flow edges are incomplete across function boundaries. Debugging requires reviewing the interprocedural taint code and verifying the layered build order to locate missing source-to-sink paths.