📄️ Request Engine
The request engine is responsible for parsing the steps of a rule with type request. Following is an example of what the headers of a rule would look like:
📄️ AST Engine
The AST engine is responsible for parsing the steps of a rule with type ast. Following is an example of what the headers of a rule would look like:
📄️ CS-MAST-S Engine
The CS-MAST-S engine matches rules of type cs-mast-s. Each step contains a CS-MAST-S PHC signature string and fires if that structural hash is found anywhere in the chunk's AST. This engine is designed for regression detection: once a vulnerability is confirmed (for example by an AST rule), extract its CS-MAST-S signature and embed it in a cs-mast-s rule to track whether the same code reappears in future builds.
📄️ taintwire engine
The taintwire engine runs rules of type taintwire. It loads the chunks in mapped.json into taintwire graphs, which hold each chunk's syntax tree, scopes and value flow, and runs the rule's Cypher queries against them. A rule names a source query and a sink query, and the engine reports the sinks that a source value flows into, following variables, function arguments and return values.