find_taint_paths
Traces multi-hop call chains from annotation-based sources to dangerous sinks, pruning sanitized branches, to identify taint paths in code.
Instructions
Multi-hop taint path analysis from annotation-based sources to dangerous sinks.
Performs BFS forward through CALLS edges from all taint-source methods
(those annotated with @RequestParam, @PathVariable, @RequestBody, etc.)
up to max_depth hops. Sanitizer calls prune the branch. All distinct
call chains reaching a sink are returned.
Unlike find_taint_flows (single-hop, arg_pos=0 only), this tool finds
handler → service → sink chains of arbitrary depth up to max_depth.
Args:
repo_name: Repository to analyse.
max_depth: Maximum hop depth (default 5, capped at 10).
Returns:
List of dicts with keys:
source_method_fqn, source_annotations, sink_method_fqn, sink_type,
path_length, call_chain, sanitizer_pruned, file_path, line_start.
Empty list if no repo found, no sources, or no paths exist.Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| repo_name | Yes | ||
| max_depth | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |