#CFG structural analysis

Nyx builds an intra-procedural control-flow graph per function and checks structural properties: whether sinks are guarded by sanitizers or validators, whether web handlers check authentication, whether resources are released on all exit paths, and whether error paths terminate before reaching dangerous code.

These detectors use dominator analysis. A guard dominates a sink when the guard must execute before the sink on every path from entry.

#Rule IDs

Rule ID	Severity
cfg-unguarded-sink	High/Medium
cfg-auth-gap	High
cfg-unreachable-sink	Medium
cfg-unreachable-sanitizer	Low
cfg-unreachable-source	Low
cfg-error-fallthrough	High/Medium
cfg-resource-leak	Medium
cfg-lock-not-released	Medium

#What it detects

cfg-unguarded-sink: A sink call (system, eval, Command::new, db.execute, etc.) is reachable from function entry without passing through any guard or sanitizer that matches the sink's capability.

cfg-auth-gap: A function identified as a web handler (by parameter naming conventions like req, res, ctx, request, language-dependent) reaches a privileged sink (shell execution, file I/O) without a preceding authentication call.

cfg-unreachable-*: Sinks, sanitizers, or sources in dead code. Usually signals a refactoring error that silently disabled security-relevant logic.

cfg-error-fallthrough: An error-handling branch (null check, error-return check) does not terminate. Execution falls through to a dangerous operation on the error path.

cfg-resource-leak, cfg-lock-not-released: A resource acquisition (File::open, fopen, socket, Lock) is not matched by a release on every exit path from the function.

#What it can't detect

• Inter-procedural guards. Middleware-level auth, helper functions that internally call auth, and cleanup performed in a caller are invisible.
• Dynamic dispatch. Virtual calls, function pointers, closures resolve to no specific callee.
• Correctness of guards. The detector checks a guard dominates the sink. It cannot check the guard is correct. A no-op if true {} would suppress the finding.
• Custom validation logic. Only recognised guard names are checked. if password == expected is not a recognised guard.
• Cross-function resource flows. If a file handle opens in one function and closes in another, the opener gets flagged as a leak. This is the largest source of FPs on factory-pattern code.

#Common false positives

Scenario	Why	Mitigation
Framework middleware auth	Handler doesn't call auth directly	Expected; suppress with severity filter or exclude handlers
RAII / defer cleanup	Implicit release not visible to CFG (partially handled for Rust Drop and Go defer)	Known limitation
Custom guard name	Function not in the recognised guard list	Add it as a sanitizer rule in config
Test handlers	Intentional lack of auth	Default non-prod downgrade reduces severity; or exclude test dirs

#Common false negatives

Scenario	Why
Auth in a called helper	Cross-function guards not tracked
Type-system guards	Rust AuthenticatedUser<T> wrappers, typestate patterns not analysed
Cleanup in finally/ensure/defer in callers	Cross-function cleanup not tracked

#Tuning

#Recognised guard names

Nyx accepts these patterns as dominating guards:

Pattern	Applies to
validate*, sanitize*	All sinks
check_*, verify_*, assert_*	All sinks
shell_escape	Shell sinks
html_escape	HTML/XSS sinks
url_encode	URL sinks
which	Shell execution (binary lookup)

#Recognised auth names

Pattern	Language
is_authenticated, require_auth, check_permission, authorize, authenticate, require_login, check_auth, verify_token, validate_token	Cross-language
middleware.auth, auth.required	Go
isAuthenticated, checkPermission, hasAuthority, hasRole	Java

For Rust auth checks (require_*, ownership equality, row-level checks), see auth.md.

#Custom guards

[[analysis.languages.python.rules]]
matchers = ["validate_request", "check_csrf"]
kind = "sanitizer"
cap  = "all"

#Custom auth functions

[[analysis.languages.javascript.rules]]
matchers = ["ensureLoggedIn", "requirePermission"]
kind = "sanitizer"
cap  = "all"

#Examples

Unguarded sink:

func handler(w http.ResponseWriter, r *http.Request) {
    cmd := r.URL.Query().Get("cmd")
    exec.Command("sh", "-c", cmd).Run()  // cfg-unguarded-sink
}

Auth gap:

app.get('/admin/delete', (req, res) => {
    // No auth call
    db.execute("DELETE FROM users WHERE id = " + req.params.id);  // cfg-auth-gap
});

Resource leak:

void process() {
    FILE *f = fopen("data.txt", "r");
    if (error) {
        return;           // cfg-resource-leak: f not closed on this path
    }
    fclose(f);
}