feat-fix: eval hook

Author: MaxAtoms

src/taint-analysis/builder/taint-analysis.ts

@@ -25,6 +25,8 @@ export interface FnCallHookInfo {
 	role:       TaintRole | undefined;
 	/** The AST node representing the function call */
 	node:       RNamedFunctionCall<ParentInformation>;
+	/** Whether the function call had an explicit mapping */
+	wasMapped:  boolean;
 	/** The abstract domain value at this point (the outgoing/resolved taint) */
 	value:      AnyAbstractDomain;
 	/** Resolves the incoming taint of any argument node at this call, regardless of mapping rules */
@@ -144,7 +146,7 @@ export class TaintAnalysis<Defs extends readonly string[] = []> {
 
 	private wrapFnCallHook(fn: FnCallHook | undefined, name: string, dfg: DataflowGraph, ctx: ReadOnlyFlowrAnalyzerContext): TaintVisitorHook {
 		return fn
-			? ({ node, value, projectArg, call, role }) => fn({ name, node, value, projectArg, call, dfg, ctx, role })
+			? ({ node, value, wasMapped, projectArg, call, role }) => fn({ name, node, value, wasMapped, projectArg, call, dfg, ctx, role })
 			: () => {};
 	}
 }

src/taint-analysis/eval/instrumentation.ts

@@ -74,7 +74,7 @@ export class TaintAnalysisInstrumentation {
 		return this._trace;
 	}
 
-	fnCallHook = ({ name, node, value, projectArg, call, dfg, ctx, role }: FnCallHookInfo) => {
+	fnCallHook = ({ name, node, value, wasMapped, projectArg, call, dfg, ctx, role }: FnCallHookInfo) => {
 		const fnCallInfo = this.addFile(name, node);
 		const localTargets = satisfiesCallTargets(call, dfg, CallTargets.OnlyLocal);
 		const cds = call.cds?.map(cd => resolveControlDependency(cd, dfg));
@@ -86,7 +86,7 @@ export class TaintAnalysisInstrumentation {
 			...(localTargets === 'no' ? {} : { localTargets }),
 			...(cds?.length ? { cds, inEveryBranch: happensInEveryBranch(call.cds) } : {}),
 		};
-		if(value) {
+		if(wasMapped) {
 			fnCallInfo.mappedCalls.push({ ...callInfo, taint: value.toJSON(), role });
 		} else {
 			fnCallInfo.unmappedCalls.push(callInfo);

src/taint-analysis/taint-visitor.ts

@@ -63,7 +63,7 @@ export class TaintInferenceVisitor<Domain extends AnyAbstractDomain> extends Abs
 		const { value, role } = resolveFnCallToTaint(node, mappings, this.domain, this.projectArg, this.config.dfg, this.config.ctx);
 		this.currentState.set(node.info.id, value);
 
-		this.config.fnCallHook({ node, value, projectArg: this.projectArg, call, role: role });
+		this.config.fnCallHook({ node, value, wasMapped: mappings.length > 0, projectArg: this.projectArg, call, role: role });
 	}
 
 	protected isUnsupportedFunctionCall(_nodeId: NodeId): boolean {