find_cross_service_taint
Trace taint paths from HTTP endpoint parameters to outgoing REST calls to detect cross-service injection vulnerabilities.
Instructions
Find taint paths from HTTP endpoint handler parameters to outgoing REST calls.
This is an Orihime-native equivalent of SonarQube Enterprise "Advanced SAST"
cross-service taint analysis.
A taint path is a call chain that starts at an HTTP endpoint handler method
(whose parameters are user-controlled: @RequestParam, @PathVariable, @RequestBody)
and ends at a method that issues an outgoing HTTP call (UNRESOLVED_CALL or
CALLS_REST edge). Intermediate hops are method CALLS edges.
Args:
repo_name: Repository to analyse.
max_depth: Maximum call-chain depth to traverse (default 6).
Returns:
List of dicts, each describing one taint path::
{
"source_handler_fqn": str, # endpoint handler method
"source_endpoint": str, # HTTP path e.g. GET /api/users/{id}
"sink_method_fqn": str, # method that makes the outgoing call
"sink_url_pattern": str, # URL pattern of the outgoing call
"sink_http_method": str, # GET/POST/...
"path_length": int, # number of hops
"call_chain": list, # [method_fqn, ...] from source to sink
}Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| repo_name | Yes | ||
| max_depth | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |