stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity
Files
9b58589ba01342d5df7ab3bbfd7370cc970cdd21
git.stella-ops.org/docs/features/unchecked/scanner/symbol-mappers-for-net-jvm-node-python.md

3.9 KiB
Raw Blame History

Symbol Mappers for .NET/JVM/Node/Python

Module

Scanner

Status

IMPLEMENTED

Description

Symbol mapping with sink matchers and entrypoint classifiers exists for Java, Python, JavaScript, and Node ecosystems.

Implementation Details

  • Java Symbol Mapping:
    • src/Scanner/__Libraries/StellaOps.Scanner.CallGraph/Extraction/Java/JavaCallGraphExtractor.cs - JavaCallGraphExtractor building call graphs from Java bytecode
    • src/Scanner/__Libraries/StellaOps.Scanner.CallGraph/Extraction/Java/JavaSinkMatcher.cs - JavaSinkMatcher matching Java methods against known vulnerability sinks (e.g., SQL injection, command injection, deserialization)
    • src/Scanner/__Libraries/StellaOps.Scanner.CallGraph/Extraction/Java/JavaEntrypointClassifier.cs - JavaEntrypointClassifier classifying Java entrypoints (Spring Controllers, Servlets, main methods)
  • Python Symbol Mapping:
    • src/Scanner/__Libraries/StellaOps.Scanner.CallGraph/Extraction/Python/PythonCallGraphExtractor.cs - PythonCallGraphExtractor building call graphs from Python AST
    • src/Scanner/__Libraries/StellaOps.Scanner.CallGraph/Extraction/Python/PythonSinkMatcher.cs - PythonSinkMatcher matching Python functions against known vulnerability sinks
    • src/Scanner/__Libraries/StellaOps.Scanner.CallGraph/Extraction/Python/PythonEntrypointClassifier.cs - PythonEntrypointClassifier classifying Python entrypoints (Flask routes, Django views, CLI entry)
  • JavaScript Symbol Mapping:
    • src/Scanner/__Libraries/StellaOps.Scanner.CallGraph/Extraction/JavaScript/JavaScriptCallGraphExtractor.cs - JavaScriptCallGraphExtractor building call graphs from JavaScript/TypeScript
    • src/Scanner/__Libraries/StellaOps.Scanner.CallGraph/Extraction/JavaScript/JsSinkMatcher.cs - JsSinkMatcher matching JS functions against known vulnerability sinks
    • src/Scanner/__Libraries/StellaOps.Scanner.CallGraph/Extraction/JavaScript/JsEntrypointClassifier.cs - JsEntrypointClassifier classifying JavaScript entrypoints (Express routes, event handlers)
  • .NET Symbol Mapping:
    • src/Scanner/__Libraries/StellaOps.Scanner.CallGraph/Extraction/DotNet/DotNetCallGraphExtractor.cs - DotNetCallGraphExtractor building call graphs from .NET assemblies
  • PHP Symbol Mapping:
    • src/Scanner/__Libraries/StellaOps.Scanner.CallGraph/Extraction/Php/PhpCallGraphExtractor.cs - PhpCallGraphExtractor building call graphs from PHP
    • src/Scanner/__Libraries/StellaOps.Scanner.CallGraph/Extraction/Php/PhpSinkMatcher.cs - PhpSinkMatcher matching PHP functions against vulnerability sinks
    • src/Scanner/__Libraries/StellaOps.Scanner.CallGraph/Extraction/Php/PhpEntrypointClassifier.cs - PhpEntrypointClassifier classifying PHP entrypoints
  • Ruby Symbol Mapping:
    • src/Scanner/__Libraries/StellaOps.Scanner.CallGraph/Extraction/Ruby/RubyCallGraphExtractor.cs - RubyCallGraphExtractor building call graphs from Ruby
    • src/Scanner/__Libraries/StellaOps.Scanner.CallGraph/Extraction/Ruby/RubySinkMatcher.cs - RubySinkMatcher matching Ruby methods against vulnerability sinks
    • src/Scanner/__Libraries/StellaOps.Scanner.CallGraph/Extraction/Ruby/RubyEntrypointClassifier.cs - RubyEntrypointClassifier classifying Ruby entrypoints (Rails controllers, Rack apps)

E2E Test Plan

  • Extract a Java call graph and verify JavaSinkMatcher correctly identifies SQL injection sinks (e.g., Statement.executeQuery)
  • Verify JavaEntrypointClassifier correctly classifies Spring @RequestMapping methods as HTTP entrypoints
  • Extract a Python call graph and verify PythonSinkMatcher identifies dangerous function calls (e.g., eval, subprocess.call)
  • Verify JsSinkMatcher identifies Node.js sinks like child_process.exec and eval
  • Verify .NET call graph extraction handles both framework-dependent and self-contained applications
  • Verify all sink matchers and entrypoint classifiers produce deterministic results for the same input