update

Author: myfreess

moon.mod

@@ -5,7 +5,7 @@ version = "0.1.12"
 preferred_target = "wasm"
 
 import {
-  "moonbitlang/parser@0.3.7",
+  "moonbitlang/parser@0.3.8",
   "moonbit-community/yaml@0.0.4",
   "moonbit-community/chalk@0.0.1",
   "moonbitlang/lexer@0.3.7",

rule/compile/metavar_expr.mbt

@@ -60,10 +60,11 @@ fn MetavarRewriteContext::rewrite_expr(
         index_loc~,
         loc~,
       )
-    Array(exprs~, loc~) => Array(exprs=ctx.rewrite_expr_list(exprs), loc~)
+    Array(exprs~, is_iter~, loc~) =>
+      Array(exprs=ctx.rewrite_expr_list(exprs), is_iter~, loc~)
     Tuple(exprs~, loc~) => Tuple(exprs=ctx.rewrite_expr_list(exprs), loc~)
-    ArraySpread(elems~, loc~) =>
-      ArraySpread(elems=ctx.rewrite_spreadable_elems(elems), loc~)
+    ArraySpread(elems~, is_iter~, loc~) =>
+      ArraySpread(elems=ctx.rewrite_spreadable_elems(elems), is_iter~, loc~)
     Group(expr=inner, group~, loc~) =>
       Group(expr=ctx.rewrite_expr(inner), group~, loc~)
     Constraint(expr=inner, ty~, loc~) =>
@@ -150,6 +151,8 @@ fn MetavarRewriteContext::rewrite_expr(
         loc~,
       )
     Interp(elems~, loc~) => Interp(elems=ctx.rewrite_interp_elems(elems), loc~)
+    BytesInterp(elems~, loc~) =>
+      BytesInterp(elems=ctx.rewrite_interp_elems(elems), loc~)
     Is(expr=inner, pat~, loc~) =>
       Is(expr=ctx.rewrite_expr(inner), pat=ctx.rewrite_pattern(pat), loc~)
     Let(pattern~, expr=bound_expr, body~, loc~) =>
@@ -254,11 +257,12 @@ fn MetavarRewriteContext::rewrite_expr(
         label=ctx.rewrite_optional_label(label),
         loc~,
       )
-    ListComprehension(kind~, guard_~, body~, loc~) =>
+    ListComprehension(kind~, guard_~, body~, is_iter~, loc~) =>
       ListComprehension(
         kind~,
         guard_=ctx.rewrite_optional_expr(guard_),
         body=ctx.rewrite_expr(body),
+        is_iter~,
         loc~,
       )
     ProofLet(binder~, expr=inner, loc~) =>
@@ -271,10 +275,11 @@ fn MetavarRewriteContext::rewrite_expr(
       ProofAssert(expr=ctx.rewrite_expr(inner), loc~)
     Raise(err_value~, loc~) =>
       Raise(err_value=ctx.rewrite_expr(err_value), loc~)
-    TemplateWriting(expr=inner, template~, loc~) =>
+    TemplateWriting(expr=inner, template~, is_conditional~, loc~) =>
       TemplateWriting(
         expr=ctx.rewrite_expr(inner),
         template=ctx.rewrite_expr(template),
+        is_conditional~,
         loc~,
       )
     StaticAssert(asserts~, body~) =>

taint/engine.mbt

@@ -249,6 +249,18 @@ fn eval_expr(
           )
         None => normal_result(state, [])
       }
+    Expr_Lexscan =>
+      match node_child(expr, "expr") {
+        Some(scrutinee) =>
+          eval_lex_scan(
+            scrutinee,
+            node_child_items(expr, "cases"),
+            state,
+            spec,
+            findings,
+          )
+        None => normal_result(state, [])
+      }
     Expr_Try =>
       match node_child(expr, "body") {
         Some(body) =>
@@ -2049,6 +2061,56 @@ fn bind_lex_pattern(
   }
 }
 
+///|
+fn lex_scan_pattern_bound_roots(pattern : @untyped_ast.Node) -> Array[String] {
+  let roots : Array[String] = []
+  add_lex_scan_pattern_bound_roots(roots, pattern)
+  roots
+}
+
+///|
+fn add_lex_scan_pattern_bound_roots(
+  roots : Array[String],
+  pattern : @untyped_ast.Node,
+) -> Unit {
+  match pattern.kind {
+    LexScanCasePattern_Binder =>
+      if node_first_child(pattern) is Some(binder) {
+        add_binder_root_name(roots, binder)
+      }
+    LexScanCasePattern_Pattern =>
+      if node_first_child(pattern) is Some(pat) {
+        add_regex_pattern_bound_roots(roots, pat)
+      }
+    LexScanCasePattern_Wildcard => ()
+    _ => ()
+  }
+}
+
+///|
+fn bind_lex_scan_pattern(
+  pattern : @untyped_ast.Node,
+  value : TaintTree,
+  state : TaintState,
+) -> TaintState {
+  match pattern.kind {
+    LexScanCasePattern_Binder =>
+      if node_first_child(pattern) is Some(binder) {
+        bind_binder(binder, value, state)
+      } else {
+        state
+      }
+    LexScanCasePattern_Pattern =>
+      if node_first_child(pattern) is Some(pat) {
+        bind_regex_pattern(pat, value, state)
+      } else {
+        state
+      }
+    LexScanCasePattern_Wildcard => state
+    _ => state
+  }
+}
+
 ///|
 fn regex_pattern_bound_roots(pattern : @untyped_ast.Node) -> Array[String] {
   let roots : Array[String] = []
@@ -2405,6 +2467,90 @@ fn eval_lex_case(
   restore_result_scoped_roots(result, pattern_result.state, roots)
 }
 
+///|
+fn eval_lex_scan(
+  scrutinee : @untyped_ast.Node,
+  cases : Array[@untyped_ast.Node],
+  state : TaintState,
+  spec : TaintSpec,
+  findings : Array[SinkFinding],
+) -> EvalResult {
+  let scrutinee_result = eval_expr(scrutinee, state, spec, findings)
+  if scrutinee_result.flow != FlowNormal {
+    return scrutinee_result
+  }
+  let normal_states : Array[TaintState] = []
+  let mut branch_value : TaintTree = []
+  let exit_states : Array[TaintState] = []
+  let mut exit_flow = FlowNormal
+  let mut exit_value : TaintTree = []
+  for case in cases {
+    let case_result = eval_lex_scan_case(
+      case,
+      scrutinee_result.value,
+      scrutinee_result.state,
+      spec,
+      findings,
+    )
+    if case_result.flow == FlowNormal {
+      normal_states.push(case_result.state)
+      branch_value = tree_merge(branch_value, case_result.value)
+    } else {
+      if exit_states.is_empty() {
+        exit_flow = case_result.flow
+        exit_value = case_result.value
+      }
+      exit_states.push(case_result.state)
+    }
+  }
+  if normal_states.length() > 0 {
+    normal_result(state_merge_all(normal_states), branch_value)
+  } else if exit_states.length() > 0 {
+    flow_result(exit_flow, state_merge_all(exit_states), exit_value)
+  } else {
+    normal_result(scrutinee_result.state, [])
+  }
+}
+
+///|
+fn eval_lex_scan_case(
+  case : @untyped_ast.Node,
+  value : TaintTree,
+  base_state : TaintState,
+  spec : TaintSpec,
+  findings : Array[SinkFinding],
+) -> EvalResult {
+  let pattern = match node_child(case, "pat") {
+    Some(pattern) => pattern
+    None => return normal_result(base_state, [])
+  }
+  let body = match node_child(case, "body") {
+    Some(body) => body
+    None => return normal_result(base_state, [])
+  }
+  let roots = lex_scan_pattern_bound_roots(pattern)
+  let bound = bind_lex_scan_pattern(pattern, value, base_state)
+  let result = if node_optional_child(case, "guard") is Some(guard_expr) {
+    let guard_result = eval_condition_scope(guard_expr, bound, spec, findings)
+    if guard_result.flow == FlowNormal {
+      restore_result_scoped_roots(
+        eval_expr(body, guard_result.true_state, spec, findings),
+        guard_result.base_state,
+        guard_result.bound_roots,
+      )
+    } else {
+      {
+        state: guard_result.base_state,
+        value: guard_result.value,
+        flow: guard_result.flow,
+      }
+    }
+  } else {
+    eval_expr(body, bound, spec, findings)
+  }
+  restore_result_scoped_roots(result, base_state, roots)
+}
+
 ///|
 fn eval_try(
   body : @untyped_ast.Node,
@@ -2856,7 +3002,7 @@ fn eval_unknown_expr(
         }
         None => normal_result(state, [])
       }
-    Expr_Interp =>
+    Expr_Interp | Expr_BytesInterp =>
       eval_interp_elems(node_child_items(expr, "elems"), state, spec, findings)
     Expr_Map => {
       let mut current = state

taint/taint_test.mbt

@@ -451,6 +451,49 @@ test "taint engine match case binder shadows outer root in case body" {
   assert_eq(result.findings.length(), 0)
 }
 
+///|
+test "taint engine lexscan binder receives scrutinee taint" {
+  let source =
+    #|fn sample(input) {
+    #|  lexscan input {
+    #|    item => sink(item);
+    #|    _ => ()
+    #|  }
+    #|}
+    #|
+  let result = analyze_single_entry_sink(source, "input")
+  assert_eq(result.findings.length(), 1)
+}
+
+///|
+test "taint engine lexscan regex alias feeds guard pattern binding" {
+  let source =
+    #|fn sample(input) {
+    #|  lexscan input {
+    #|    re"." as item if item is Some(part) => sink(part);
+    #|    _ => ()
+    #|  }
+    #|}
+    #|
+  let result = analyze_single_entry_sink(source, "input")
+  assert_eq(result.findings.length(), 1)
+}
+
+///|
+test "taint engine restores lexscan binder before following expression" {
+  let source =
+    #|fn sample(input, clean) {
+    #|  lexscan clean {
+    #|    input => sink(input);
+    #|    _ => ()
+    #|  };
+    #|  sink(input)
+    #|}
+    #|
+  let result = analyze_single_entry_sink(source, "input")
+  assert_eq(result.findings.length(), 1)
+}
+
 ///|
 test "taint engine restores catch binder before following expression" {
   let source =

untyped_ast/contains_unshadowed.mbt

@@ -21,6 +21,7 @@ fn contains_unshadowed_node(node : Node, id : String, shadowed~ : Bool) -> Bool
     Expr_ForEach => contains_foreach_unshadowed(node, id, shadowed)
     Expr_Match => contains_match_unshadowed(node, id, shadowed)
     Expr_Lexmatch => contains_lexmatch_unshadowed(node, id, shadowed)
+    Expr_Lexscan => contains_lexscan_unshadowed(node, id, shadowed)
     Expr_ListComprehension =>
       contains_list_comprehension_unshadowed(node, id, shadowed)
     Expr_Function => contains_expr_function_unshadowed(node, id, shadowed)
@@ -164,6 +165,16 @@ fn contains_lexmatch_unshadowed(
   contains_case_list_unshadowed(node, "cases", "pat", id, shadowed)
 }
 
+///|
+fn contains_lexscan_unshadowed(
+  node : Node,
+  id : String,
+  shadowed : Bool,
+) -> Bool {
+  contains_named_child_unshadowed(node, "expr", id, shadowed) ||
+  contains_case_list_unshadowed(node, "cases", "pat", id, shadowed)
+}
+
 ///|
 fn contains_list_comprehension_unshadowed(
   node : Node,