Reading the graph

Nodes, boundary edges, and how to triage from the path a value took.

The graph is the part of Studio that a terminal report cannot give you: the project as a shape, with the crossings drawn on it.

Nodes are files

Each node is a file in your project. The graph is not a call graph of every function. It is the file-level view, which is the altitude at which "this file hands a value to that file" becomes visible.

Edges are crossings

The interesting edges are boundary edges: drawn where a value crosses from one side of a trust boundary to the other, and directed, because the direction is the whole point. A Server Component handing a value to a Client Component is not the same relationship as the reverse, and the analysis treats them differently.

A file with boundary edges into it is a file that receives values across a crossing. That is where to look first.

The strip on a boundary

Where a finding sits on a crossing, the boundary is drawn as a strip carrying the rule that fired and the sink expression. The strip is the anchor for everything else: it is what you select when you want to ask about one specific crossing rather than a file.

Triaging

The triage panel is where a finding stops being a report and becomes a decision. For a selected finding it carries:

• What fired: the rule, the sink, and the location.
• The path: the provenance the analysis recorded, nearest-to-sink first. This is the same list antra trace prints.
• What to do: follow the path to its source to see where the value entered, or accept the crossing.

The habit worth building

Read the path before you read the rule. The rule tells you what kind of crossing it is; the path tells you whether the value was ever actually dangerous. Most findings that look wrong at first glance are a sanitizer the analysis did not recognize, and the path is where that shows up: a step in the middle that clearly validates the value, which the config has not been told about.

Fix those by declaring the sanitizer in antra.config.json, not by suppressing the findings one at a time.

Related

• Trust boundaries: the model the edges encode.
• Findings and severity: the fields behind what you see in the panel.