Atom safety analysis.
Detects unsafe atom creation reachable from exported functions, atom creation in loops, unsafe deserialization, and dynamic code execution. The BEAM atom table is fixed-size and never garbage collected, making any path converting untrusted input to atoms a denial-of-service vector.
Output relations
All three relations are anchored at the offending call SITE — id is
the instruction, func the function containing it.
atom_exhaustion_risk(id, func, api)— unsafe atom creation reachable from an exported function.unsafe_deserialization_finding(id, func, api)—binary_to_termwithout:safeoption.code_injection_risk(id, func, api)—Code.eval_string/:os.cmdreachable from exports.
Finding severities
atom_exhaustion_risk—:warning. Whether the input is attacker influenced can't be decided statically; when it is, this is a node-killing DoS.unsafe_deserialization_finding—:error.binary_to_termwithout:safeon untrusted bytes interns unbounded atoms and materializes funs/ports/refs — a known remote DoS vector.code_injection_risk—:error. Dynamic evaluation reachable from the module's public surface is arbitrary code execution if any caller-controlled data flows in.