Circle-IR
Security vulnerability detection powered by taint analysis
Initializing analyzer...
Java Code
package com.example; import javax.servlet.http.*; import java.sql.*; public class UserController extends HttpServlet { public void doGet(HttpServletRequest request, HttpServletResponse response) { // User input from HTTP parameter String userId = request.getParameter("id"); // Direct string concatenation - SQL injection! String query = "SELECT * FROM users WHERE id = '" + userId + "'"; try { Connection conn = DriverManager.getConnection("jdbc:mysql://localhost/db"); Statement stmt = conn.createStatement(); // Vulnerable: executing unsanitized query ResultSet rs = stmt.executeQuery(query); while (rs.next()) { response.getWriter().println(rs.getString("name")); } } catch (Exception e) { e.printStackTrace(); } } }
Analyze Code
Analysis Results
Summary
Circle-IR JSON
Click "Analyze Code" to start...
Circle-IR output will appear here after analysis...
How It Works
Parsing
- Tree-sitter WASM parses Java code into an AST
IR Extraction
- Extracts types, method calls, CFG, and DFG
Taint Analysis
- Identifies sources (user input) and sinks (dangerous operations)
Flow Detection
- Traces data flow from sources to sinks
No server required - all analysis happens locally in your browser!