v2.0.0

[shivasurya]

v2.0.0 — Cross-File Dataflow Analysis 🚀

Code Pathfinder v2.0.0 is here. Cross-file taint analysis with custom rules written in Python. Define sources, sinks, and sanitizers — the engine traces data flows across files and function boundaries automatically. The biggest engine upgrade since the project started.

📖 Full announcement blog post

🔬 Cross-File Taint Analysis

• Variable Dependency Graph (VDG) with inter-procedural taint transfer summaries
• scope="global" — one flag to enable cross-file dataflow in any rule
  • Source in app.py, sink in db.py — detected automatically

🧠 QueryType Engine

• Type-constrained matching — match cursor.execute() only on actual sqlite3.Cursor instances
• .tracks(N) — filter to specific argument positions
• Typeshed integration — resolve inherited methods and third-party types via CDN

🛡️ 190 Security Rules

• 158 Python + 37 Docker + 10 Docker Compose. Rule Registry

⚡ CI/CD

• GitHub Action with PR summary comments, inline review annotations, and diff-aware scanning.

📜 AGPL-3.0 → Apache-2.0

More permissive license. Added CLA for contributors.

---

Give it a try

  brew install shivasurya/tap/pathfinder
  pathfinder scan --ruleset python/all --project .

---

This discussion was created from the release v2.0.0.