Why I Built a Deterministic CPG-to-Nuclei Compiler in Rust

说明与用途

自动化安全测试代理经常依赖LLM生成低级模板，导致错误和状态更改。Rust编译器将代码属性图转换为正确的Nuclei YAML，在隔离的Docker容器中验证，消除这些问题。

问题

Automated security testing agents often rely on LLMs to generate low-level exploit templates, leading to trial‑and‑error, hallucinated syntax, high execution costs, and state‑mutation issues that require manual cleanup.

结果

The compiler produced a verified, enterprise‑safe LFI template for CVE‑2024‑51483, eliminating database artifacts and reducing manual cleanup.

工作流

• 1. Source code (C/C++, Java, Go, Python) is parsed into a Joern CPG.
• 2. The Rust engine extracts DataFlowSlice and SSA paths to compute taint graphs.
• 3. The compiler generates 0‑error Nuclei YAML templates.
• 4. The Docker harness runs the template to produce TP/TN proofs before PR submission.
• 5. The PR is submitted only after successful verification.

证据

The Rust engine parses Joern CPG schemas and Single Static Assignment (SSA) dataflow paths to compute taint graphs natively in Rust, generating 0%-error Nuclei YAML templates in milliseconds with minimal memory overhead.

来源

Using my compiled harness, I standardized an enterprise-safe lifecycle: Snapshot, Execute, Teardown.

来源