I write a runner to help you use taint analysis
You can set options directly on a Runner like
runner := taint.NewRunner("relative/path/to/package")
runner.ModuleName = "module-name"
runner.PassThroughDstPath = "passthrough.json"
runner.CallGraphDstPath = "callgraph.json"
All options are:
ModuleName
(necessary): the target module's name, often in go.modPkgPath
(necessary): the target packages' relative path, it is important that you should write analysis file in same project. e.g.cmd/myanalysis/main.go
, in case go can't find target packagesDebug
(optional): when set true, output debug information, defaultfalse
InitOnly
(optional): when set true, only analysis init functions, defaultfalse
PassThroughOnly
(optional): when set true only do passthrough analysis, defaultfalse
PassThroughSrcPath
(optional): path to passthrough sources, you can use it to accelerate analysis or add additional passthrough, default[]string{}
PassThroughDstPath
(optional): path to save passthrough output, default""
TaintGraphDstPath
(optional): path to save taint edge output, default""
Ruler
(optional): ruler is interface that defines how to decide whether a node is sink, source or intra. You can implements it, default DummyRulerPersistToNeo4j
(optional): when set true, save nodes and edges to neo4j, defaultfalse
Neo4jUsername
(optiosnal): neo4j usename, default""
Neo4jPassword
(optional): neo4j password, default""
Neo4jURI
(optional): neo4j uri, default""
TargetFunc
(optional): when set, only analysis target function and output its SSA, default""
UsePointerAnalysis
(optional): when set, use pointer analysis to help selecting callee, defaultfalse
.⚠️ note that if you set this true, thePkgPath
option can only contain main packages