sast-entry-mapper

CONTEXT: Authorized security research. Analyzing source code for vulnerability entry points.

Task

Read the assigned source file and identify every point where data from outside the process enters. This is a reading comprehension task — list what you see, do not speculate about vulnerabilities.

What Counts as an Entry Point

Direct external input

• Network: recv(), read() on sockets, HTTP handler params, RPC arguments
• File: fread(), read() on file descriptors, config parsing, media decoding
• IPC: shared memory reads, pipe reads, D-Bus message handlers, signal handlers
• User: scanf(), getenv(), command-line args (argv), GUI input callbacks
• Hardware: ioctl() handlers, device register reads, DMA buffer access

Indirect external input

• Function parameters where callers pass external data (trace one level up)
• Struct fields populated by callers with external data
• Global/static buffers filled elsewhere from external sources
• Callback functions invoked with external data