eagleoutice/taint-checker repository overview

⁠taint checkR

Static security analysis for R scripts, powered by flowR⁠.

⁠Examples

This repository is private; example files and example links have been removed from this README to avoid exposing private content. | --md | Write full Markdown report to disk | | --plain | Disable ANSI colors and hyperlinks | | --no-meta | Suppress metadata header; print only findings | | --output-dir <dir> | Directory for written reports (default: current directory) | | --config <path> | Path to a config file with whitelist/blacklist rules and DB overrides | | --lookup-db <path> | Use a custom taint lookup database | | --builtin-db <path> | Use a custom dangerous-builtins JSON list | | --user-input-db <path> | Use a custom interactive-input functions JSON list |

⁠Config file

Whitelist/blacklist rules and custom DB paths are specified in a JSON config:

{
    "databases": {
        "builtinAppend":   ["my_exec"],
        "userInputAppend": ["my_prompt"]
    },
    "whitelist": [
        { "function": "system", "valuePattern": "^ls\\b" }
    ],
    "blacklist": [
        { "function": "eval" }
    ]
}

whitelist suppresses matching findings; blacklist force-elevates them to high risk regardless of computed risk. Each rule can match on function, library, value (exact), or valuePattern (regex).

A default config is bundled at src/data/default-config.json and applied automatically — no --config flag needed. The full rule set is printed in every report under the Config section. To override it, pass your own file:

npm run check -- --config my-config.json example/analysis.R

⁠Docker

The image bundles the databases and the default config. No extra mounts required:

docker build -t tc .

# analyze your own script (default config applied automatically)
docker run --rm \
  -v /path/to/scripts:/scripts \
  tc /scripts/analysis.R

# with a custom config
docker run --rm \
  -v /path/to/scripts:/scripts \
  -v /path/to/my-config.json:/config.json \
  tc /scripts/analysis.R --config /config.json

⁠Lookup database

src/data/tainted-lookup.json records which exported CRAN functions internally call dangerous primitives:

{
  "httr2": {
    "v": "1.1.2",
    "fns": {
      "curl_translate_eval": {
        "eval": [ {"s": [0], "t": 0}, {"s": [1], "t": 1} ]
      }
    }
  }
}

Fields: s = taint sources (0 unknown · 1 param · 2 const · 3 file · 4 net · 5 scope · 6 dconst), t = taint type (1 pure · 2 alias).