Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
闭源系统半自动漏洞挖掘工具，针对 jar/war/zip 进行静态代码分析，输出从source到sink的可达路径。LLM将验证路径可达性，并根据上下文给出该路径可信分数
| Date | Stars |
|---|---|
| 2026-07-31 | 510 |
| 2026-08-04 | 510 |
| 2026-08-06 | 510 |
Today
— stars today
This week
— stars this week
This month
— stars this month
Momentum
0.0
growth rate 0.00%/day
# SinkFinder + LLM
### 功能说明
[闭源系统半自动漏洞挖掘工具](https://mp.weixin.qq.com/s/pKA0eG0B_yMkeV2-C1edWw)，针对 jar/war/zip 进行静态代码分析，增加 LLM 大模型能力验证路径可达性，LLM根据上下文代码环境判断该路径可信分数。
### 运行说明
参数说明：
```
_ _ __ _ _
(_) | | / _|(_) | |
___ _ _ __ | | __| |_ _ _ __ __| | ___ _ __
/ __|| || '_ \ | |/ /| _|| || '_ \ / _` | / _ \| '__|
\__ \| || | | || < | | | || | | || (_| || __/| |
|___/|_||_| |_||_|\_\|_| |_||_| |_| \__,_| \___||_|
2.0@medi0cr1ty
usage: SinkFinder
-cb,--class_exclusions <arg> 自定义class_exclusions规则，类黑名单
-ci,--class_inclusions <arg> 自定义class_inclusions规则，类白名单
-d,--depth <3> 指定递归查找深度
-h,--help 帮助
-jb,--jar_exclusions <arg> 自定义jar_exclusions规则，jar包黑名单
-ji,--jar_inclusions <arg> 自定义jar_inclusions规则，jar包白名单
-l,--llm 启用通义大模型能力
-lk,--llm_key <arg> 配置通义大模型 API KEY（sk-xxx）
-p,--path <arg> 指定目标分析路径，支持多个以,分隔
-r,--rule <rules.json> 指定Sink
JSON规则路径，初始化默认resources/rules.json
-s,--sink <arg> 自定义sink规则，可添加多个以,分隔
-scb,--sink_category_block <arg> 禁用sink规则类别
-sci,--sink_category_include <arg> 配置sink规则类别
```
* 配置均可通过运行参数进行覆盖
* 跑一次后会吐出 rule.json 配置文件， -r 可自定义配置
* LLM 能力需要配置通义的 APIKEY（默认不启用 LLM ）：
* 更新 rule.json 中 dashscope_api_key ;
* -lk 参数指定;
* 环境变量配置：export DASHSCOPE_API_KEY="sk-xxx"
参考运行命令：
```shell
java -jar SinkFinder-1.0-SNAPSHOT-jar-with-dependencies.jar -p 代码路径 -d 遍历路径递归深度 -ci 项目文件名
```
_运行结果保存在 logs 目录下：_
* Date_HighLLMRisk 开头的文件： 已过滤 source + LLM判断>7分 的路径
* Date_LLMDetail.md 文件：大模型结果细节
* Date_Risk 开头的文件：已过滤 source 的路径
* Date_OtherRisk 开头的文件：未走到 source 的其他结果
### 规则说明
符号 "*" 仅可用于 *_inclusions 相关的，表示允许所有。规则的白名单优先级高于黑名单。
rules.json 文件 Sink 方法名支持正则配置。但注意：不支持"()"符号，因为与方法参数支持的()冲突。
```angular2html
{
"depth": 3, // 遍历深度
"dashscope_api_key": "", // 通义API_KEY配置 [sk-xxx]
"path_exclusions": ["AndroidSDK",".idea","resources","java\\bin","META-INF"], // 文件路径黑名单，如设置为"test"，test/111.jar将不会被检索
"jar_name_inclusions": ["*"], // jar文件名白名单，如设置为"test"，将仅检索包含test字符的jar包
"jar_name_exclusions": ["SinkFinder","spring-","logback","lombok","META-INF","log4j","slf4j","tomcat-","mysql-connector-java","antlr-","commons-","dubbo-","jetty-","groovy-","netty-","collections-","jboss-","rxjava-","mybatis-","guava-","test","ehcache-","batik-"], // jar文件名黑名单
"class_inclusions": ["*"], // 类白名单，如设置为"test"，com.test将进行检索
"class_exclusions": ["logback","lombok"], // 类黑名单，如设置为"test"，com.test将无法检索
"sink_rules": [
{
"sink_name": "RCE",
"sink_desc": "任意代码执行漏洞",
"severity_level": "High",
"sinks": ["java.lang.Runtime:exec","java.lang.ProcessBuilder:<init>|start","javax.script.ScriptEngine:eval",
"javax.swing.plaf.synth.SynthLookAndFeel:load","com.googlecode.aviator.AviatorEvaluator:execute",
"org.mozilla.javascript.Context:evaluateString|evaluateReader","groovy.lang.GroovyShell:evaluate",
"org.springframework.scripting.bsh.BshScriptEvaluator:evaluate", "io.kubernetes.client.util.KubeConfig:loadKubeConfig",
"cn.hutool.core.util.RuntimeUtil:exec.*","cn.hutool.cron.CronUtil:schedule",
"cn.hutool.extra.expression.ExpressionUtil:eval","cn.hutool.script.ScriptUtil:eval|evalInvocable",
"cn.hutool.script.FullSupportScriptEngine:eval","cn.hutool.script.JavaScriptEngine:eval"]
}, {
"sink_name": "UNSERIALIZE",
"sink_desc": "反序列化漏洞",
"severity_level": "High",
"sinks": ["java.io.ObjectInputStream:readObject|readUnshared", "org.yaml.snakeyaml.Yaml:load","java.beans.XMLDecoder:readObject",
"org.apache.xmlrpc.parser.XmlRpcRequestParser:startElementExcerpt of 8,114 characters
Read on GitHub
56
23
Would you bet a product on this? Bounded 0–100 and slow moving.
matched fp:d37a03cc9c4fe326, llm:Description (Chinese): semi-automatic closed-source vulnerability mining tool; static analysis of jar/war/zip to output source-to-sink reachable paths; LLM verifies path reachability and gives trust score.
matched fp:d37a03cc9c4fe326, llm:Description (Chinese): semi-automatic closed-source vulnerability mining tool; static analysis of jar/war/zip to output source-to-sink reachable paths; LLM verifies path reachability and gives trust score.
matched fp:d37a03cc9c4fe326, llm:Description (Chinese): semi-automatic closed-source vulnerability mining tool; static analysis of jar/war/zip to output source-to-sink reachable paths; LLM verifies path reachability and gives trust score.