Exploring the index

Everything below reads the index of the current repository (-C DIR to read another one). Every command accepts --json or --jsonl for scripts, and --at REF to read an older snapshot (see History).

Symbols

inkdex search '*login*' --kind fn          # by name (glob, case-insensitive)
inkdex fn check_password                   # signature, parameters, metrics, calls
inkdex show app.auth.check_password        # one symbol in detail
inkdex ls app/auth.py                      # the symbols of a file
inkdex locate app/auth.py:40:13            # the innermost symbol at a position
inkdex grep users --class sql              # string literals: SQL, URLs, paths, shell…
inkdex markers --kind TODO,FIXME

Calls

inkdex callers app.auth.check_password                 # who calls it
inkdex callees app.views.login                         # what it calls, resolved or why not
inkdex callers check_password --depth 3 --format mermaid
inkdex path app.views.login app.db.connect             # shortest call paths between two functions
inkdex graph imports --cycles                          # import cycles (also `graph calls|types --format dot`)
inkdex imports app/auth.py
inkdex imported-by app/db.py

Routes and security

inkdex routes                                   # entry points: HTTP routes, CLI commands, jobs, listeners
inkdex routes --unauthenticated                 # entry points with no authentication found
inkdex sec sources --category 'http.*'          # where outside data enters
inkdex sec sinks --category 'sql.*'             # calls with an effect when their input is controlled
inkdex sec flows --to 'sql.*' --unsanitized --trace
inkdex sec summary app.db.get_user              # what each parameter of a function reaches, in words
inkdex sec secrets                              # secrets in string literals
inkdex sec crypto                               # crypto primitives and their parameters
inkdex search '*' --unauthenticated --has-sink 'exec.*'

A source is where data an attacker may control enters (a request parameter, a header, a message). A sink is a call with an effect when its input is controlled (a SQL query, a shell command, a file path). A flow goes from one to the other, across functions and files. --unsanitized keeps only the flows with nothing on the way that protects the sink.

Dependencies

inkdex deps list                 # declared, locked and used dependencies
inkdex deps list --unused        # declared but never imported
inkdex deps who requests         # which manifests declare a package

The query language

inkdex q combines all of the above in one line:

inkdex q 'fn name:*login* complexity:>10'
inkdex q 'fn entry -auth sink:sql.*'          # entry points without auth that reach SQL
inkdex q 'route method:POST -auth'
inkdex q 'secret provider:aws'

See Query language. inkdex repl gives the same language with completion.

Asking why

inkdex explain app/auth.py --line 11

It prints the parsed code around that line, the security facts on it, and how each call on it was resolved (or why it was not). It is the first thing to look at when a finding surprises you, or when one you expected is missing.