Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Rule reference

Every finding Nyx emits has a rule ID. This page enumerates the IDs that ship with scanner 0.5.0, grouped by family.

This page is written by hand and drifts against the code. Authoritative sources: src/patterns/<lang>.rs for AST patterns, src/labels/<lang>.rs for taint matchers, and src/auth_analysis/config.rs for auth rules. If a rule fires that isn’t listed here, the source file is right and this page is wrong.

If you’d rather browse rules interactively, nyx serve ships a Rules page that lists every loaded matcher with its language, kind, and capability:

Nyx Rules page: filterable list of 218 rules with language, kind (SOURCE/SANITIZER/SINK), capability, and finding count columns

ID format

PrefixDetectorExample
taint-*Taint analysistaint-unsanitised-flow (source 5:11)
cfg-*CFG structuralcfg-unguarded-sink, cfg-auth-gap
state-*State modelstate-use-after-close, state-resource-leak
<lang>.auth.*Auth analysisrs.auth.missing_ownership_check
<lang>.<category>.<name>AST patternsrs.memory.transmute, js.code_exec.eval

Language prefixes: rs, c, cpp, go, java, js, ts, py, php, rb.

Cross-language rules

Taint

One rule covers every source-to-sink flow. The parenthetical identifies the source location.

Rule IDSeverity
taint-unsanitised-flow (source L:C)Varies by source kind and sink capability

The matcher sets (sources, sanitizers, sinks, gated sinks) live per-language in src/labels/<lang>.rs. Language maturity gives per-language counts and what’s covered.

CFG structural

Rule IDSeverity
cfg-unguarded-sinkHigh/Medium
cfg-auth-gapHigh
cfg-unreachable-sinkMedium
cfg-unreachable-sanitizerLow
cfg-unreachable-sourceLow
cfg-error-fallthroughHigh/Medium
cfg-resource-leakMedium
cfg-lock-not-releasedMedium

State model

Rule IDSeverity
state-use-after-closeHigh
state-double-closeMedium
state-resource-leakMedium
state-resource-leak-possibleLow
state-unauthed-accessHigh

Auth analysis (Rust only, today)

Rule IDSeverity
rs.auth.missing_ownership_checkHigh
rs.auth.missing_ownership_check.taintHigh (gated by scanner.enable_auth_as_taint)

See auth.md for scope, the five sink-classes, and tuning.

AST patterns by language

Each language ships a tree-sitter pattern registry. Structural match on the pattern, no dataflow. Some patterns also have a Tier B heuristic guard (e.g. SQL execute must receive a concatenation, not a literal) noted in the registry.

The tables below are generated from src/patterns/<lang>.rs by tools/docgen. Run cargo run --features docgen --bin nyx-docgen after changing the registry to refresh them.

C: 8 patterns

Rule IDSeverityTierConfidence
c.cmdi.systemHighAHigh
c.memory.getsHighAHigh
c.memory.printf_no_fmtHighBMedium
c.memory.scanf_percent_sHighAHigh
c.memory.sprintfHighAHigh
c.memory.strcatHighAHigh
c.memory.strcpyHighAHigh
c.cmdi.popenMediumAHigh

C++: 9 patterns

Rule IDSeverityTierConfidence
cpp.cmdi.popenHighAHigh
cpp.cmdi.systemHighAHigh
cpp.memory.getsHighAHigh
cpp.memory.printf_no_fmtHighBMedium
cpp.memory.sprintfHighAHigh
cpp.memory.strcatHighAHigh
cpp.memory.strcpyHighAHigh
cpp.memory.const_castMediumAHigh
cpp.memory.reinterpret_castMediumAHigh

Go: 8 patterns

Rule IDSeverityTierConfidence
go.cmdi.exec_commandHighAHigh
go.transport.insecure_skip_verifyHighAHigh
go.deser.gob_decodeMediumAHigh
go.memory.unsafe_pointerMediumAHigh
go.secrets.hardcoded_keyMediumAHigh
go.sqli.query_concatMediumBMedium
go.crypto.md5LowAMedium
go.crypto.sha1LowAMedium

Java: 8 patterns

Rule IDSeverityTierConfidence
java.cmdi.runtime_execHighAHigh
java.deser.readobjectHighAHigh
java.reflection.class_fornameMediumAHigh
java.reflection.method_invokeMediumAHigh
java.sqli.execute_concatMediumBMedium
java.xss.getwriter_printMediumAHigh
java.crypto.insecure_randomLowAMedium
java.crypto.weak_digestLowAMedium

JavaScript: 22 patterns

Rule IDSeverityTierConfidence
js.code_exec.evalHighAHigh
js.code_exec.new_functionHighAHigh
js.config.cors_dynamic_originHighAMedium
js.code_exec.settimeout_stringMediumAHigh
js.config.insecure_session_httponlyMediumAHigh
js.config.reject_unauthorizedMediumAHigh
js.config.verbose_error_responseMediumAMedium
js.crypto.weak_hash_importMediumAMedium
js.prototype.extend_objectMediumAHigh
js.prototype.proto_assignmentMediumAHigh
js.secrets.fallback_secretMediumAMedium
js.xss.cookie_writeMediumAHigh
js.xss.document_writeMediumAHigh
js.xss.insert_adjacent_htmlMediumAHigh
js.xss.location_assignMediumAHigh
js.xss.outer_htmlMediumAHigh
js.config.insecure_session_samesiteLowAHigh
js.config.insecure_session_secureLowAMedium
js.crypto.math_randomLowAMedium
js.crypto.weak_hashLowAMedium
js.secrets.hardcoded_secretLowAMedium
js.transport.fetch_httpLowAMedium

PHP: 11 patterns

Rule IDSeverityTierConfidence
php.cmdi.systemHighAHigh
php.code_exec.assert_stringHighAHigh
php.code_exec.create_functionHighAHigh
php.code_exec.evalHighAHigh
php.code_exec.preg_replace_eHighAHigh
php.deser.unserializeHighAHigh
php.path.include_variableHighBMedium
php.sqli.query_concatMediumBMedium
php.crypto.md5LowAMedium
php.crypto.randLowAMedium
php.crypto.sha1LowAMedium

Python: 13 patterns

Rule IDSeverityTierConfidence
py.cmdi.os_popenHighAHigh
py.cmdi.os_systemHighAHigh
py.cmdi.subprocess_shellHighBMedium
py.code_exec.evalHighAHigh
py.code_exec.execHighAHigh
py.deser.pickle_loadsHighAHigh
py.deser.yaml_loadHighAHigh
py.code_exec.compileMediumAHigh
py.deser.shelve_openMediumAHigh
py.sqli.execute_formatMediumBMedium
py.xss.jinja_from_stringMediumAHigh
py.crypto.md5LowAMedium
py.crypto.sha1LowAMedium

Ruby: 11 patterns

Rule IDSeverityTierConfidence
rb.cmdi.backtickHighAHigh
rb.cmdi.system_interpHighAHigh
rb.code_exec.class_evalHighAHigh
rb.code_exec.evalHighAHigh
rb.code_exec.instance_evalHighAHigh
rb.deser.marshal_loadHighAHigh
rb.deser.yaml_loadHighAHigh
rb.reflection.constantizeMediumAHigh
rb.reflection.send_dynamicMediumBMedium
rb.ssrf.open_uriMediumAHigh
rb.crypto.md5LowAMedium

Rust: 13 patterns

Rule IDSeverityTierConfidence
rs.memory.copy_nonoverlappingHighAHigh
rs.memory.get_uncheckedHighAHigh
rs.memory.mem_zeroedHighAHigh
rs.memory.ptr_readHighAHigh
rs.memory.transmuteHighAHigh
rs.quality.unsafe_blockMediumAHigh
rs.quality.unsafe_fnMediumAHigh
rs.memory.mem_forgetLowAHigh
rs.memory.narrow_castLowAMedium
rs.quality.expectLowAHigh
rs.quality.panic_macroLowAHigh
rs.quality.todoLowAHigh
rs.quality.unwrapLowAHigh

TypeScript: 22 patterns

Rule IDSeverityTierConfidence
ts.code_exec.evalHighAHigh
ts.code_exec.new_functionHighAHigh
ts.config.cors_dynamic_originHighAMedium
ts.code_exec.settimeout_stringMediumAHigh
ts.config.insecure_session_httponlyMediumAHigh
ts.config.reject_unauthorizedMediumAHigh
ts.config.verbose_error_responseMediumAMedium
ts.crypto.weak_hash_importMediumAMedium
ts.prototype.proto_assignmentMediumAHigh
ts.secrets.fallback_secretMediumAMedium
ts.xss.document_writeMediumAHigh
ts.xss.insert_adjacent_htmlMediumAHigh
ts.xss.location_assignMediumAHigh
ts.xss.outer_htmlMediumAHigh
ts.config.insecure_session_samesiteLowAHigh
ts.config.insecure_session_secureLowAMedium
ts.crypto.math_randomLowAMedium
ts.crypto.weak_hashLowAMedium
ts.quality.any_annotationLowAMedium
ts.quality.as_anyLowAMedium
ts.secrets.hardcoded_secretLowAMedium
ts.xss.cookie_writeLowAMedium

Capability list for custom rules

nyx config add-rule --cap <name> and [analysis.languages.*.rules] in config accept:

env_var, html_escape, shell_escape, url_encode, json_parse, file_io, fmt_string, sql_query, deserialize, ssrf, code_exec, crypto, unauthorized_id, all

Source for both the enum and the to_cap mapping: src/labels/mod.rs (Cap) and src/utils/config.rs (CapName).