fix(stuff): wip

♬ Park Jeong Eun - Here He Is

Author: Mte90

Cargo.toml

@@ -89,6 +89,10 @@ tree-sitter-rust = "0.23"
 tree-sitter-python = "0.23"
 tree-sitter-javascript = "0.23"
 tree-sitter-php = "0.23"
+tree-sitter-go = "0.23"
+tree-sitter-java = "0.23"
+tree-sitter-ruby = "0.23"
+tree-sitter-c-sharp = "0.23"
 
 # Static analysis support
 

config.example.toml

@@ -102,8 +102,8 @@ enable_cve_bootstrap = true
 enable_variant_search = true
 # Domain-routed hunt prompts: select per-attack-class prompt modules from
 # prompts/hunt/ based on the target's languages during LLM discovery
-# Default: false
-enable_hunt_prompts = false
+# Default: true
+enable_hunt_prompts = true
 
 # LLM configuration with per-phase settings
 [llm]

docs/architecture.md

@@ -122,7 +122,7 @@ See technique #5 in [`docs/argus-analysis.md`](argus-analysis.md).
 
 ### Domain-Routed Hunt Prompts (Discovery Phase)
 
-Per-attack-class prompt modules from `prompts/hunt/` (injection, auth, authz_absence, xss, path_traversal, crypto, resource, deserialization, memory_safety) selected by target languages and appended to discovery prompts. Each module includes scope/lane discipline sections; the verification prompt has a skeptical self-refutation gate + untrusted-content framing.
+Per-attack-class prompt modules from `prompts/hunt/` (injection, auth, authz_absence, xss, path_traversal, crypto, resource, deserialization, memory_safety) selected by target languages and appended to discovery prompts. Each module includes scope/lane discipline sections; the verification prompt has a skeptical self-refutation gate + untrusted-content framing. Hunt prompts are enabled by default (`enable_hunt_prompts = true`).
 
 Configured via `[scanner.performance] enable_hunt_prompts = true`.
 

docs/configuration.md

@@ -673,15 +673,26 @@ Per-attack-class prompt modules from `prompts/hunt/` selected by target language
 
 | Field | Type | Default | Description |
 |-------|------|---------|-------------|
-| `enable_hunt_prompts` | bool | `false` | Enable domain-routed hunt prompts |
+| `enable_hunt_prompts` | bool | `true` | Enable domain-routed hunt prompts |
 
 ```toml
 [scanner.performance]
-enable_hunt_prompts = false
+enable_hunt_prompts = true
 ```
 
 Available modules: `injection.md`, `auth.md`, `authz_absence.md`, `xss.md`, `path_traversal.md`, `crypto.md`, `resource.md`, `deserialization.md`, `memory_safety.md`.
 
+### Taint rules are derived from the project languages
+
+Taint rules are always merged from the project languages (python, javascript/typescript, go, php, c/cpp, java, ruby, csharp). Explicit `custom_rules` no longer suppress them; when a rule id exists in both, the explicit one wins.
+
+CWE classes covered per language:
+- **SQLi**: CWE-89 (all languages)
+- **Command injection**: CWE-78 (all languages)
+- **Path traversal**: CWE-22 (all languages)
+- **Deserialization**: CWE-502 (php, java, csharp)
+- **Code injection**: CWE-94 (ruby)
+
 ### Exploit Synthesis (T3.2)
 
 Automated exploit generation to verify findings. Runs in sandboxed Docker containers.

presets/go.toml

@@ -55,61 +55,12 @@ rules:
     pattern-either:
       - pattern: exec.Command($CMD)
       - pattern: exec.CommandContext($CTX, $CMD)
-
-  - id: go-taint-sqli-high
-    languages: [go]
-    mode: taint
-    severity: ERROR
-    message: >
-      User input flows into database query without sanitization, SQL injection risk.
-    metadata:
-      cwe:
-        - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command"
-    pattern-sources:
-      - pattern: r.URL.Query().Get($KEY)
-      - pattern: r.FormValue($KEY)
-      - pattern: r.PostFormValue($KEY)
-    pattern-sinks:
-      - pattern: db.Query($SQL)
-      - pattern: db.Exec($SQL)
-      - pattern: db.QueryRow($SQL)
-      - pattern: db.Prepare($SQL)
-
-  - id: go-taint-cmdi-high
-    languages: [go]
-    mode: taint
-    severity: ERROR
-    message: >
-      User input flows into command execution without sanitization, command injection risk.
-    metadata:
-      cwe:
-        - "CWE-78: Improper Neutralization of Special Elements used in an OS Command"
-    pattern-sources:
-      - pattern: r.URL.Query().Get($KEY)
-    pattern-sinks:
-      - pattern: exec.Command($CMD)
-
-  - id: go-taint-path-traversal-high
-    languages: [go]
-    mode: taint
-    severity: ERROR
-    message: >
-      User input flows into file operations without validation, path traversal risk.
-    metadata:
-      cwe:
-        - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory"
-    pattern-sources:
-      - pattern: r.URL.Query().Get($KEY)
-    pattern-sinks:
-      - pattern: os.Open($PATH)
-      - pattern: os.ReadFile($PATH)
-      - pattern: os.Create($PATH)
-      - pattern: os.Remove($PATH)
 ''']
 
 [scanner.performance]
 enable_variant_search = true
 enable_cve_bootstrap = true
+enable_hunt_prompts = true
 
 [llm]
 temperature = 0.2

presets/javascript.toml

@@ -87,62 +87,12 @@ rules:
       cwe:
         - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
     pattern: crypto.createHash("md5", $VAR)
-
-  - id: js-taint-sqli-high
-    languages: [javascript, typescript]
-    mode: taint
-    severity: ERROR
-    message: >
-      User input flows into database query without sanitization, SQL injection risk.
-    metadata:
-      cwe:
-        - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command"
-    pattern-sources:
-      - pattern: req.query[$X]
-      - pattern: req.body[$X]
-      - pattern: req.params[$X]
-    pattern-sinks:
-      - pattern: db.query($SQL)
-      - pattern: connection.query($SQL)
-      - pattern: pool.query($SQL)
-
-  - id: js-taint-cmdi-high
-    languages: [javascript, typescript]
-    mode: taint
-    severity: ERROR
-    message: >
-      User input flows into command execution without sanitization, command injection risk.
-    metadata:
-      cwe:
-        - "CWE-78: Improper Neutralization of Special Elements used in an OS Command"
-    pattern-sources:
-      - pattern: req.query[$X]
-      - pattern: req.body[$X]
-    pattern-sinks:
-      - pattern: child_process.exec($CMD)
-      - pattern: execSync($CMD)
-
-  - id: js-taint-path-traversal-high
-    languages: [javascript, typescript]
-    mode: taint
-    severity: ERROR
-    message: >
-      User input flows into file operations without validation, path traversal risk.
-    metadata:
-      cwe:
-        - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory"
-    pattern-sources:
-      - pattern: req.query[$X]
-      - pattern: req.params[$X]
-    pattern-sinks:
-      - pattern: fs.readFile($PATH)
-      - pattern: fs.writeFile($PATH, $DATA)
-      - pattern: fs.unlink($PATH)
 ''']
 
 [scanner.performance]
 enable_variant_search = true
 enable_cve_bootstrap = true
+enable_hunt_prompts = true
 
 [llm]
 temperature = 0.2

presets/oss-python.toml

@@ -40,63 +40,9 @@ exclude_paths = [
 
 [scanner.semgrep]
 rulesets = ["p/python", "p/bandit", "p/security"]
-custom_rules = ['''
-rules:
-  - id: py-taint-sqli-high
-    languages: [python]
-    mode: taint
-    severity: ERROR
-    message: >
-      User input flows into database query without sanitization, SQL injection risk.
-    metadata:
-      cwe:
-        - "CWE-89: Improper Neutralization of Special Elements used in an SQL Command"
-    pattern-sources:
-      - pattern: request.args.get($KEY)
-      - pattern: request.form.get($KEY)
-      - pattern: request.values.get($KEY)
-      - pattern: request.json.get($KEY)
-    pattern-sinks:
-      - pattern: cursor.execute($SQL)
-      - pattern: session.execute($SQL)
-      - pattern: db.execute($SQL)
-
-  - id: py-taint-cmdi-high
-    languages: [python]
-    mode: taint
-    severity: ERROR
-    message: >
-      User input flows into command execution without sanitization, command injection risk.
-    metadata:
-      cwe:
-        - "CWE-78: Improper Neutralization of Special Elements used in an OS Command"
-    pattern-sources:
-      - pattern: request.args.get($KEY)
-      - pattern: request.form.get($KEY)
-    pattern-sinks:
-      - pattern: subprocess.call($CMD, shell=True)
-      - pattern: subprocess.Popen($CMD, shell=True)
-      - pattern: os.system($CMD)
-
-  - id: py-taint-path-traversal-high
-    languages: [python]
-    mode: taint
-    severity: ERROR
-    message: >
-      User input flows into file operations without validation, path traversal risk.
-    metadata:
-      cwe:
-        - "CWE-22: Improper Limitation of a Pathname to a Restricted Directory"
-    pattern-sources:
-      - pattern: request.args.get($KEY)
-      - pattern: request.form.get($KEY)
-    pattern-sinks:
-      - pattern: open($PATH)
-      - pattern: os.open($PATH, $MODE)
-''']
 
 [scanner.performance]
-
+enable_hunt_prompts = true
 [llm]
 enable_llm_cache = true
 

src/config/phases.rs

@@ -90,6 +90,10 @@ pub const DEFAULT_ENABLE_MERGE_ORDER_DETECTION: bool = true;
 pub fn default_enable_merge_order_detection() -> bool {
     DEFAULT_ENABLE_MERGE_ORDER_DETECTION
 }
+pub const DEFAULT_ENABLE_HUNT_PROMPTS: bool = true;
+pub fn default_enable_hunt_prompts() -> bool {
+    DEFAULT_ENABLE_HUNT_PROMPTS
+}
 /// Normalization tier for confidence calibration.
 #[derive(Debug, Clone, serde::Deserialize, serde::Serialize, PartialEq, Default)]
 pub enum NormalizationTier {

src/config/scanner.rs

@@ -112,7 +112,7 @@ pub struct PerformanceSettings {
     pub enable_merge_order_detection: bool,
     /// Domain-routed hunt prompts: select per-attack-class prompt modules
     /// from the target's languages during LLM discovery
-    #[serde(default)]
+    #[serde(default = "crate::config::default_enable_hunt_prompts")]
     pub enable_hunt_prompts: bool,
     /// Never-submit pattern filter - heavily penalizes findings matching known false-positive patterns
     #[serde(default = "crate::config::default_never_submit_enabled")]
@@ -149,7 +149,7 @@ impl Default for PerformanceSettings {
             enable_variant_search: crate::config::default_enable_variant_search(),
             enable_absence_detection: crate::config::default_enable_absence_detection(),
             enable_merge_order_detection: crate::config::default_enable_merge_order_detection(),
-            enable_hunt_prompts: false,
+            enable_hunt_prompts: crate::config::default_enable_hunt_prompts(),
             never_submit_enabled: crate::config::default_never_submit_enabled(),
             never_submit_multiplier: crate::config::default_never_submit_multiplier(),
             variant_search_patterns: Vec::new(),

src/llm_analysis.rs

@@ -114,6 +114,7 @@ fn is_function_like(kind: &str) -> bool {
             | "method_definition"
             | "function_declaration"
             | "function_item"
+            | "method"
     )
 }
 
@@ -708,6 +709,10 @@ fn tree_sitter_language(language: &str) -> Option<tree_sitter::Language> {
         "python" => Some(tree_sitter_python::LANGUAGE.into()),
         "javascript" | "typescript" | "tsx" => Some(tree_sitter_javascript::LANGUAGE.into()),
         "php" => Some(tree_sitter_php::LANGUAGE_PHP.into()),
+        "go" => Some(tree_sitter_go::LANGUAGE.into()),
+        "java" => Some(tree_sitter_java::LANGUAGE.into()),
+        "ruby" => Some(tree_sitter_ruby::LANGUAGE.into()),
+        "csharp" | "c#" | "cs" => Some(tree_sitter_c_sharp::LANGUAGE.into()),
         _ => None,
     }
 }