taint
Trace concrete source-to-sink taint paths in code graphs, leveraging Atropos models to show where untrusted input reaches dangerous sinks, with CWE and file:line for both ends.
Instructions
Taint witnesses from the Atropos catalog: where untrusted input actually reaches a dangerous sink through value flow. Folds the Atropos taint models (sources / sinks / summaries) onto this graph's exact nodes and runs propagation, returning each source->sink reach with the catalog model id, CWE, and file:line for both ends. atropos_connected rows are the ones a catalog fact drove (e.g. request -> urlopen SSRF); the rest are the engine's own generic-role reaches. Costs one whole-graph value-flow build on first call per graph (cached after). A no-op with a clear reason if the Atropos catalog is not checked out. Each witness carries source_id/sink_id, the exact graph node ids of the bound endpoints, plus path -- the ordered source->sink hops taint actually walked ({id,label,at} each). Adjudicate a witness from its path (read source at each hop); do NOT re-derive it with reaches, which follows a different edge set (VALUE_FLOWS_TO/POINTS_TO) and can return 0 hops for a pair taint reached over REACHING_DEF/summary edges. unwitnessed lists bound sinks/sources that took part in no reach -- feed those ids straight to sources_of/flow/reaches to trace why (on a C graph they mark where value-flow gaps sever the chain); no name resolution needed since the endpoint is often an external callee the name index can't seed.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| format | No | text (compact, default) | json (structured result page) | |
| atropos_only | No | only witnesses a catalog fact drove |