Skip to content

v2.0.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Jul 03:28
v2.0.0
080cfa8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Batou v2.0.0 is the biggest release since the project went public: 2.5 months of engine development landed in one sync (#24) — 3,310 files, +474k lines.

Highlights

Cross-file taint analysis (14 languages)

Batou now builds a project call graph with per-language extractors and follows taint across file boundaries: a source in routes/users.js flowing through a helper to a sink in lib/db.js is caught end to end, with the full propagation path in the finding. Includes stored-state taint (instance fields, module globals) and cross-language HTTP service-boundary routes (a JS fetch feeding a Python Flask handler).

batou scan — whole-repo scanner

batou scan .                          # parallel scan, JSONL findings
batou scan --sarif --fail-on high .   # SARIF 2.1.0 out, CI gate (exit 3)

Scans a repo over a shared in-memory call graph with a cross-file finalize pass. SARIF output carries taint paths as codeFlows and stable fingerprints, ready for github/codeql-action/upload-sarif. Running batou scan once also arms the hook's incremental cross-file lane for that project.

ssaflow — second Go engine

A new SSA-based taint engine (golang.org/x/tools/go/ssa) runs alongside the AST walker: def-use chains, cross-function fixpoint summaries, and module-local cross-package analysis. On by default; BATOU_SSAFLOW=0 opts out.

Deeper analysis everywhere

  • Taint catalogs grew from 3,254 to 10,664 entries across 17 languages (Shell is new)
  • +58 regex rules; new perlast, shellast, and zigast analyzers
  • Major C/C++ analyzer expansion: use-after-free, double-free, TLS and libc hardening
  • Precision mechanisms: barrier guards, argument-shape and payload-position sink gating, sanitizer-aware cross-file walks

Suppression you can trust

  • batou:ignore reasons are now adjudicated: a suppression whose justification contradicts the finding's own dataflow is flagged (BATOU-SUPPRESS-UNJUSTIFIED)
  • gosec #nosec annotations are recognized

Benchmarks in-tree

A committed 13-language benchmark corpus plus six offline CVE ground-truth benches (real CVE repros, Log4Shell and Spring4Shell included) with make targets and a consolidated scorecard.

Install

brew install turenlabs/tap/batou && batou-setup

Full diff: v1.0.0...v2.0.0

Assets 7
Loading