taint

type Analyzer struct {
	// contains filtered or unexported fields
}

type Config struct {
	// Sources is the list of data origins that produce tainted values
	Sources []Source
	// Sinks is the list of dangerous functions that should not receive tainted data
	Sinks []Sink
	// Sanitizers is the list of functions that neutralize taint (optional)
	Sanitizers []Sanitizer
}

type Result struct {
	// Source is the origin of the tainted data
	Source Source
	// Sink is the dangerous function that receives the tainted data
	Sink Sink
	// SinkPos is the source code position of the sink call
	SinkPos token.Pos
	// Path is the sequence of functions from entry point to the sink
	Path []*ssa.Function
}

type RuleInfo struct {
	ID          string
	Description string
	Severity    string
	CWE         string
}

type Sanitizer struct {
	// Package is the import path (e.g., "path/filepath")
	Package string
	// Receiver is the type name for methods, or empty for package-level functions
	Receiver string
	// Method is the function or method name (e.g., "Clean")
	Method string
	// Pointer indicates whether the receiver is a pointer type
	Pointer bool
}

type Sink struct {
	// Package is the import path of the package containing the sink (e.g., "database/sql")
	Package string
	// Receiver is the type name for methods (e.g., "DB"), or empty for package-level functions
	Receiver string
	// Method is the function or method name that represents the sink (e.g., "Query")
	Method string
	// Pointer indicates whether the receiver is a pointer type (true for *Type methods)
	Pointer bool
	// CheckArgs specifies which argument positions to check for taint (0-indexed).
	// For method calls, Args[0] is the receiver.
	// If nil or empty, all arguments are checked.
	// Examples:
	//   - SQL methods: [1] - only check query string (Args[1]), skip receiver
	//   - fmt.Fprintf: [1,2,3,...] - skip writer (Args[0]), check format and data
	CheckArgs []int

	// ArgTypeGuards constrains argument types before treating a call as a sink.
	// Key is the zero-based argument index; value is the required type expressed
	// as "import/path.TypeName" (e.g. "net/http.ResponseWriter").
	// The sink only fires when every guarded argument's type implements (or equals)
	// the named interface/type. When empty, no type constraint is applied.
	ArgTypeGuards map[int]string
}

type Source struct {
	// Package is the import path of the package containing the source (e.g., "net/http")
	Package string
	// Name is the type or function name that produces tainted data (e.g., "Request" for type, "Get" for function)
	Name string
	// Pointer indicates whether the source is a pointer type (true for *Type)
	Pointer bool
	// IsFunc marks this source as a function/method that returns tainted data
	// (e.g., os.Getenv, os.ReadFile). When false, Source is treated as a type
	// that is only tainted when received as a function parameter from external callers.
	IsFunc bool
}