基于 Tree-sitter 的静态漏洞扫描器，支持模式匹配和污点流分析。

• 利用 AST 感知规则扫描源码安全漏洞。
• 支持模式匹配模式和污点模式（源头到汇聚跟踪）。
• 处理多文件项目并支持并行执行。
• 以文本、JSON 或 CSV 格式输出发现结果。
• 按扩展名加载内置规则包，并支持基于文件的自定义规则。

目前不支持：Razor（.cshtml）、C/C++（.c、.h）。

前置条件

从源码构建

git clone https://github.com/Corgea/Sighthound.git cd Sighthound cargo build --release

二进制文件路径：target/release/sighthound

适用于 Linux 容器的发行版导出

DOCKER_BUILDKIT=1 docker build
--target export
--output type=local,dest=./sighthound_release
.

或者运行 ./build_all_platforms.sh。

用法

自动检测语言并运行内置规则

cargo run --bin sighthound -- /path/to/project

指定语言和自定义规则路径

cargo run --bin sighthound -- /path/to/project python rules/python

仅污点分析并以 JSON 输出

cargo run --bin sighthound -- --taint-analysis --output-format json /path/to/project > findings.json

CLI 形式：

sighthound [OPTIONS] <ROOT_DIR> [LANGUAGE] [RULES_PATH]

运行 sighthound --help 查看完整选项列表。

规则

规则采用 RON 格式编写，支持两种模式：

• mode: "search" 用于模式匹配
• mode: "taint" 用于源头/汇聚/净化器分析

开始使用

核心命令：

make check # fix + format + lint + test + suppression report make pre-commit # staged Rust files (hook) make pre-push # push gate checks make ci # strict CI pipeline

额外质量关卡：

make complexity make audit make acceptance cargo harness coverage --min=0 cargo harness crap --max=30

局限性

• 动态代码路径中的运行时漏洞可能被遗漏。
• 超大文件可能增加扫描时间。
• 多文件污点分析已支持，但仍需进一步加固。

Tree-sitter based static vulnerability scanner with pattern matching and taint-flow analysis.

• Scans source code for security issues using AST-aware rules.
• Supports pattern mode and taint mode (source to sink tracking).
• Handles multi-file projects and parallel execution.
• Outputs findings as text, JSON, or CSV.
• Loads embedded rule packs by file extension, with optional file-based custom rules.

Not currently supported: Razor (.cshtml), C/C++ (.c, .h).

Prerequisites:

Build from source:

git clone https://github.com/Corgea/Sighthound.git
cd Sighthound
cargo build --release

Binary path: target/release/sighthound

Linux-container-compatible release export:

DOCKER_BUILDKIT=1 docker build \
  --target export \
  --output type=local,dest=./sighthound_release \
  .

Or run ./build_all_platforms.sh.

# Auto-detect languages and run embedded rules
cargo run --bin sighthound -- /path/to/project

# Explicit language + custom rules path
cargo run --bin sighthound -- /path/to/project python rules/python

# Taint-only scan and JSON output
cargo run --bin sighthound -- --taint-analysis --output-format json /path/to/project > findings.json

CLI shape:

sighthound [OPTIONS] <ROOT_DIR> [LANGUAGE] [RULES_PATH]

Run sighthound --help for the full option list.

Rules are written in RON and support both:

• mode: "search" for pattern matching
• mode: "taint" for source/sink/sanitizer analysis

Start here:

Core commands:

make check        # fix + format + lint + test + suppression report
make pre-commit   # staged Rust files (hook)
make pre-push     # push gate checks
make ci           # strict CI pipeline

Additional quality gates:

make complexity
make audit
make acceptance
cargo harness coverage --min=0
cargo harness crap --max=30

• Runtime-only vulnerabilities in dynamic code paths may be missed.
• Very large files can increase scan time.
• Multi-file taint is supported but still an area to harden further.