The line/window-scoped tradeoff you called out is the right thing to flag, and the case that bites in real codebases is usually a DAO or repository wrapper - the query lives in get_by_id(user_id) two files away from the request handler, so the taint never crosses back into the same function window and sqlfence stays quiet on exactly the pattern that ships in most services with a data layer. Worth documenting as a known gap rather than letting a clean run imply full coverage - I'd rather a linter say "can't tell, wrapped call" on that shape than go silent on it.
Really appreciate this - and you've named the exact case that matters most: the query living in get_by_id() in the data layer, one or two hops from the handler, is precisely where intraprocedural taint goes quiet. You're right that a clean run shouldn't be read as full coverage there.
Two things I'm taking from this:
I'll document the wrapped-call / cross-function boundary as an explicit known gap in the README, so a green result never over-promises.
I like your "can't tell, wrapped call" idea a lot - surfacing a low-confidence "tainted value crosses a function boundary here" note is far more honest than silence. Tracking it as a planned signal (likely opt-in so it stays low-noise).
Thanks for pushing on the honesty of the output - that's the part I most want to get right.
Mihai_LeanZero
Atlassian consultant and Forge developer at LeanZero. We do Data Center to Cloud migrations and build Forge apps, and I write up what I learn at leanzero.net.
The line/window-scoped tradeoff you called out is the right thing to flag, and the case that bites in real codebases is usually a DAO or repository wrapper - the query lives in get_by_id(user_id) two files away from the request handler, so the taint never crosses back into the same function window and sqlfence stays quiet on exactly the pattern that ships in most services with a data layer. Worth documenting as a known gap rather than letting a clean run imply full coverage - I'd rather a linter say "can't tell, wrapped call" on that shape than go silent on it.