nyx - Multi-language static analysis with cross-file tai

项目说明

<di="center">
<img src="assets/nyx-readme-header.png" alt="NYX" width="640"/>

A local-first security scanner with sandboxed dynamic and a browser UI. Scan your repo and triage in your browser, with no cloud and no account.

![crates.io]()
![License: GPL v3]()
![Rust 1.88+]()
![CI]()
![Docs]()

English · 简体中文
</div>

<p align="center"><img src="assets/screenshots/demo.gif" alt="Nyx UI walkthrough: empty Welcome state, kicking off a scan, the populated o with Health Score, drilling into a HIGH finding's flow , then the triage flow" width="900"/></p>

---

Scan locally, browse locally

Nyx runs cross-language taint analysis on your repository, then Medium or higher confidence findings by running small sandboxed harnesses against the real code. Results are served to a React UI bound to 127.0.0.1. You get se, static e, dynamic , and a step-by-step flow that walks the dataflow from source → sanitizer → sink. Triage decisions persist to .nyx/triage.json, which commits alongside your code so the team shares one triage state.

E stays on your machine: loopback-only bind, host-header enforcement, CSRF on every mutation, no remote telemetry, no login.

<p align="center"><img src="assets/screenshots/o.png" alt="O dashboard for a small JS app: Health Score C 78 with the fi breakdown (Se pressure, Confidence quality, Trend, Triage co, Regression resistance), 3 findings detected, OWASP A03 and A02 buckets, confidence distribution and issue category bars, top affected files" width="900"/></p>

---

What's in the UI

| Page | What it shows |
|---|---|
| O | Dashboard: finding counts by se, top offenders, engine profile summary |
| Findings | Browsable list with se badges, triage status, rule filter, language filter |
| Finding detail | Flow-path with numbered steps (source → sanitizer → sink), dynamic , code snippets, e, cross-file markers, triage dropdown |
| Triage | Bulk update states (open, in, fixed, false_positi, suppressed), audit trail, import/export JSON |
| Explorer | File tree with per-file symbol list and finding o |
| Scans | Run history, metrics, diff two scans to see what changed |
| Rules | Built-in and custom rules per language; add rules from the UI |
| Config | Li editor; reload without restart |

nyx serve flags: --port <N> (default 9700), --host <addr> (loopback only: 127.0.0.1, localhost, or ::1), --no-browser. See [server] in nyx.conf for persistent settings, and the Browser UI guide for the page-by-page UI tour and security model.

---

CLI for CI

The same engine runs headless for CI pipelines. SARIF output uploads directly to GitHub Code Scanning.

<p align="center"><img src="assets/screenshots/cli-scan.gif" alt="nyx scan console output: HIGH taint findings across a JS and Python file with source → sink arrows" width="820"/></p>

Forward cross-file taint runs in every profile. Symex and the demand-dri walk are opt-in. Turn them on either via --engine-profile deep, or indi (--symex, --backwards-analysis). See the CLI reference for the full toggle matrix.

GitHub Action

Inputs: path, , format (sarif|json|console), fail-on, args, token. Outputs: finding-count, sarif-file, exit-code, nyx-. Linux and macOS runners (x86_64, ARM64).

---

Install

Cargo (recommended):

Pre-built binaries: Grab the archive for your platform from Releases, against SHA256SUMS (and the detached SHA256SUMS.asc GPG signature, when present), unzip, and drop nyx on your PATH.

From source:

Requires stable Rust 1.88+. The frontend is compiled and embedded in the binary at build time, so there is no separate install step for nyx serve.

---

Languages

All 10 languages parse and run through the full pipeline, but rule depth and engine co are uneven. Benchmark F1 on the synthetic corpus at tests/benchmark/ground_truth.json is 100% across all ten languages at the last measured baseline (see tests/benchmark/RESULTS.md), so F1 alone no longer separates the tiers. Tiering reflects rule depth, gated-sink co, and structural idioms the synthetic corpus does not fully stress:

| Tier | Languages | F1 | Use as a CI gate? |
|---|---|---|---|
| Stable | Python, Ja, TypeScript | 100% | Yes |
| Beta | Java, PHP, Ruby, Rust, Go | 100% | Yes, with light FP triage |
| Preview | C, C++ | 100% on synthetic corpus | No. STL container flow, builder chains, and inline class member functions are tracked, but deep pointer aliasing and function pointers are not. Pair with clang-tidy or Clang Static Analyzer |

All real-C fire and the corpus carries zero open FPs at the recorded baseline (P=R=F1=1.000). Per-dimension detail and known blind spots live on the Language maturity page.

against real CVEs

The corpus also holds a small set of /patched pairs extracted from published ad, so the benchmark floor is defended by regression protection on demonstrably real bugs rather than just synthetic analogues. Nyx fires on the file and emits zero findings on the patched file for each pair.

| CVE | Project | Language | Class |
|---|---|---|---|
| C | Ray | Python | Command injection |
| C | PyYAML | Python | Deserialization |
| C | mongo-express | Ja | Code execution (eval) |
| C | Strapi | Ja | Code execution (SSTI) |
| C | Parse Server | Ja | SSRF |
| C | follow-redirects | TypeScript | SSRF |
| GHSA-4x48-cgf9-q33f | Novu | TypeScript | SSRF |
| C | Payload CMS | TypeScript | SQL injection |
| C | hashicorp/go-getter | Go | Command injection |
| C | owncast | Go | Path tra |
| C | owncast | Go | SSRF |
| C | daptin | Go | SQL injection |
| C | Apache Commons Collections | Java | Deserialization |
| C | Apache Solr | Java | Command injection |
| C | SnakeYAML | Java | Deserialization |
| C | Apache Commons Text | Java | Code execution |
| GHSA-h8cj-hpmg-636v | Appsmith | Java | SQL injection |
| C | Ruby on Rails | Ruby | Deserialization |
| C | Rake | Ruby | Command injection |
| C | CarrierWave | Ruby | SSRF |
| C | rswag-api | Ruby | Path tra |
| C | PHPUnit | PHP | Code execution (eval) |
| C | Laravel | PHP | Deserialization |
| C | tar-rs | Rust | Path tra |
| C | cargo | Rust | Path tra |
| C | Rust stdlib | Rust | Command injection |
| C | sudo-rs | Rust | Path tra |
| C | gitoxide | Rust | Command injection |
| C | matrix-rust-sdk | Rust | SQL injection |
| C | ImageMagick (ImageTragick) | C | Command injection |
| C | sudo (pwfeedback) | C | Memory safety |
| C | ZeroMQ libzmq | C++ | Memory safety |
| C | Protocol Buffers | C++ | Memory safety |
| C | geopandas | Python | SQL injection |
| C | LMDeploy | Python | SSRF |

Fixtures li tests/benchmark/c/ with upstream attribution headers.

<!--

Real-world findings

---

How it works

Two passes over the filesystem, with an optional SQLite index to skip unchanged files:

1. Pass 1: parse each file , build an intra-procedural CFG (petgraph), lower to pruned SSA (Cytron phi insertion o frontiers), and export per-function summaries (source/sanitizer/sink caps, taint transforms, points-to, callees).
2. Summary merge: union all per-file summaries into a GlobalSummaries map.
3. Pass 2: re-analyze each file with cross-file context under bounded context sensitivity (k=1 inlining for intra-file callees, SCC fixpoint capped at 64 iterations, and summary fallback for callees above the inline body-size cap). A forward dataflow worklist propagates taint through the SSA lattice with guaranteed con. Call-graph SCCs iterate to fixed-point (within the cap) so mutually recursi get accurate summaries.
4. Rank, dedupe, , emit: findings are scored by se × e strength × source-kind exploitability. Medium or higher confidence findings are dynamically by default, then results are emitted to console, JSON, SARIF, and the browser UI.

Detector families: taint (cross-file source→sink, with cap-specific rule classes for SQLi, XSS, command/code exec, deserialization, SSRF, path tra, format string, crypto, LDAP injection, XPath injection, HTTP header / response splitting, open redirect, ser template injection, XXE, prototype pollution, data exfiltration, and the auth fold-in), CFG structural (auth gaps, unguarded sinks, resource leaks), state model (use-after-close, double-close, must-leak, unauthed-access), AST patterns (tree-sitter structural match). Full detector docs: Detectors.

---

findings dynamically

Static analysis says a sink is reachable. Dynamic tries to prove it. With -- (on by default), Nyx builds a small harness around each Medium-or-higher finding, runs it in a sandbox against a curated payload corpus, and stamps a onto the finding.

A finding is Confirmed only when an attacker-controlled payload fires the sink *and* a paired benign control stays clean. That differential rule, plus beha oracles (a template that renders 49, a deserializer that resolves a gadget class, a redirect that leaves the origin), keeps the from confirming on an echoed string. Sinks behind a recognized guard demote to ConfirmedWithKnownGuard; sinks reached without a completed exploit chain land as PartiallyConfirmed.

Co spans 18 capability classes and 120+ registered adapters across all ten languages (Flask, Django, Express, NestJS, Spring, Rails, Laravel, Gin, Axum, and more), with per-language build pools and copy-on-write workdirs to keep the per-finding cost low. Confirmed findings write a hermetic repro bundle with a reproduce.sh. Runs are deterministic: every payload is seeded from the spec hash.

Backends: Docker (preferred, network-blocked by default) or an in-process runner with --harden {standard,strict}. Full matrix, oracle list, and limitations: Dynamic .

---

Configuration

Config merges nyx.conf (defaults) and nyx.local (your o) from the platform config directory (~/.config/nyx/ on Linux, ~/Library/Application Support/nyx/ on macOS, %APPDATA%\nyx\config\ on Windows).

Or add rules interactively: nyx config add-rule --lang ja --matcher escapeHtml --kind sanitizer --cap html_escape. Caps: env_var, html_escape, shell_escape, url_encode, json_parse, file_io, fmt_string, sql_query, deserialize, ssrf, data_exfil, code_exec, crypto, unauthorized_id, ldap_injection, xpath_injection, header_injection, open_redirect, ssti, xxe, prototype_pollution, all. Full schema: Configuration. Run nyx rules list to browse the registry from the terminal.

---

Status

Under acti. APIs, detector behavior, and configuration options may change between releases. Rule-level F1 on the synthetic corpus is the CI regression floor; per-language detail lives in tests/benchmark/RESULTS.md.

Taint analysis is interprocedural. Persisted per-function SSA summaries carry per-return-path transforms and parameter-granularity points-to, and call-graph SCCs (including SCCs that span files) iterate to a joint fixed-point. The default balanced profile also runs k=1 context-sensiti for intra-file callees. Symex (with cross-file and interprocedural frames) and the demand-dri walk are opt-in. Enable them indi with --symex and --backwards-analysis, or together with --engine-profile deep.

Limitations:

---

Documentation

Browse the full docs site at nyxscan.dev/docs.

---

Contributing

Contributions are welcome.

Nyx is open source and will always have a fully open-source core. To support long-term de and keep the project sustainable, contributors may be asked to sign a Contributor License Agreement before their first merged contribution.

Run sh scripts/check.sh before submitting. See CONTRIBUTING.md for the full guide, including how to add rules and support new languages. Open an issue for crashes, panics, or suspicious results; attach a minimal snippet and the Nyx .

---

AI Disclosure

As with any static analyzer, findings against your own corpus before using Nyx as a CI gate.

---

License

GNU General Public License v3.0 or later (GPL-3.0-or-later). The optional smt feature bundles Z3 (MIT-licensed); distributors of binaries built with --features smt should include Z3's license in their attribution. Full text in LICENSE; third-party dependencies in THIRDPARTY-LICENSES.html.

项目信息

开发语言：Rust

Star 数：40

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Multi-language static analysis with cross-file taint tracking. Scan your repo, triage findings in your browser, commit triage state with your code. No cloud, no account.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。