@clear-capabilities/agentic-security-scanner 0.128.1 → 0.130.0

package/src/dataflow/engine.js

@@ -30,10 +30,17 @@
 // Sinks: anywhere a CFG node calls a catalog-registered sink with a tainted
 // argument, we emit a finding.
 //
-// Sanitizers: a call to a catalog-registered sanitizer kills the taint on its
-// argument (the call's return value is treated as clean).
+// Sanitizers: NOT consulted by this walk. `matchSinkOrSanitizer()` returns
+// catalog hits of both kinds, but every consumer in this directory keeps only
+// `e.kind === 'sink'`; no `'sanitizer'` branch exists anywhere in dataflow/*.
+// Taint dies here only when a variable is re-assigned from a clean expression
+// (removePathAndDescendants, below) — which is orthogonal to whether the RHS
+// happens to be a catalog sanitizer. Recognising sanitizer entries at a call
+// site is open work; until it lands, treat the catalog's sanitizer half as
+// documentation consumed by other layers, not by this engine.
 
 import { matchSource, matchSinkOrSanitizer } from './catalog.js';
+import { functionRecord } from '../ir/callgraph.js';
 import { accessPathOf, isCoveredBy, addPath, removePathAndDescendants, joinSets as joinAccessSets, setsEqual as accessSetsEqual } from './access-paths.js';
 import { aliasesForVar } from './points-to.js';
 import { higherOrderTaintFlow } from './higher-order.js';
@@ -64,9 +71,54 @@ function _addPathAliasAware(state, path, callContext) {
 }
 
 let _activeConstantVars = null;
+// The file of the function currently being analyzed. Set at the top of
+// analyzeFunction (same context-threading pattern as _activeConstantVars
+// above) so exprIsSource/exprTaint/step can pass it to matchSource /
+// matchSinkOrSanitizer without plumbing it through every call signature.
+// It scopes language-specific catalog entries (currently just `cpp`) to
+// files of that language — see the header comment in catalog.js.
+let _currentFile = null;
+
+// Flatten a callee — which may be a plain dotted STRING (Go/PHP/Ruby/C++/
+// Python parsers all emit call targets this way) or an expression object
+// (JS/TS's `exprOf`-shaped `{kind:'ident',name}` / `{kind:'member',...}`) —
+// into a name `callGraph.resolve()` can look up. Mirrors the normalisation
+// catalog.js's matchSinkOrSanitizer/matchSource already apply to callees, so
+// the interprocedural resolve path and the catalog match agree on shape.
+// The string path is returned unchanged — languages that already flatten to
+// a string at parse time must keep working exactly as before.
+function _flattenCalleeName(calleeExpr) {
+  if (!calleeExpr) return null;
+  if (typeof calleeExpr === 'string') return calleeExpr;
+  if (calleeExpr.kind === 'ident') return calleeExpr.name || null;
+  if (calleeExpr.kind === 'member' && calleeExpr.prop) {
+    return (calleeExpr.object && calleeExpr.object.kind === 'ident')
+      ? `${calleeExpr.object.name}.${calleeExpr.prop}`
+      : calleeExpr.prop;
+  }
+  return null;
+}
+
+// Narrower than _flattenCalleeName: the name to hand to callGraph.resolve().
+// Only a bare identifier call (`helper()`) — or a pre-flattened STRING, which
+// is how the Go/PHP/Ruby/Python/C++ parsers already emit call targets —
+// genuinely identifies one resolvable function. A JS/TS *member* call
+// (`loader.read()`) does not: resolve()'s generic dotted-name fallback
+// strips a dotted name to its last segment and matches ANY same-named
+// function project-wide, inventing a call edge that may not exist (found in
+// engine-reconnect review — `loader.read()` resolved to an unrelated local
+// `read()`, producing 8 false positives on this repo's own hooks/scripts).
+// A missing edge here is a false negative; a wrong edge invents a data-flow
+// path that isn't there — refuse to guess.
+function _resolvableCalleeName(calleeExpr) {
+  if (!calleeExpr) return null;
+  if (typeof calleeExpr === 'string') return calleeExpr;
+  if (calleeExpr.kind === 'ident') return calleeExpr.name || null;
+  return null;
+}
 
 function exprTaint(expr, state) {
-  if (expr && expr.kind === 'member' && exprIsSource(expr)) return true;
+  if (expr && (expr.kind === 'member' || expr.kind === 'call') && exprIsSource(expr)) return true;
   if (!expr) return false;
   // Constant propagation: variables assigned from literals are never tainted
   if (expr.kind === 'ident' && _activeConstantVars && _activeConstantVars.has(expr.name)) return false;
@@ -155,14 +207,14 @@ function _sourcesReachingExpr(expr, _state, taintSources) {
 function exprIsSource(expr) {
   if (!expr) return null;
   if (expr.kind === 'member') {
-    const hit = matchSource(expr);
+    const hit = matchSource(expr, _currentFile);
     if (hit) return hit;
   }
   // R3 (PRD §5): call-shaped sources (r.FormValue(), r.URL.Query(), c.Query()).
   // Previously only member reads were recognized, so Go's call-style sources
   // never tainted the assignment target. matchSource now resolves call sources.
   if (expr.kind === 'call') {
-    const hit = matchSource(expr);
+    const hit = matchSource(expr, _currentFile);
     if (hit) return hit;
   }
   if (expr.kind === 'member' && expr.object) {
@@ -194,6 +246,78 @@ function literalSkeletonMatchesFamily(expr, cwe) {
   return true;
 }
 
+// Shared sink-matching logic for a call expression, regardless of whether
+// that call appears in statement position (`case 'call'`) or on an
+// assignment's right-hand side (`case 'assign'`). Split into two parts
+// (compute, then emit) so `case 'call'` can compute `cat`/`argTaints` at its
+// original position — BEFORE the mutated-param / Object.assign / array-taint
+// passes that follow it read and rely on those values, and that themselves
+// mutate `state` and `callContext._taintSources` in ways the finding-emission
+// step (further below, unchanged position) must observe — while still
+// sharing the actual matching + emission code with `case 'assign'`, which has
+// no such ordering constraint. Extracted rather than duplicated: this
+// repository has twice had a rule implemented at one call site and re-broken
+// by the next change.
+
+// calleeExpr / argExprs: the IR nodes for the call's callee and arguments.
+// state: the taint-state Set to evaluate argument taint against.
+// Returns { cat, argTaints }.
+function _matchCallCatalog(calleeExpr, argExprs, state) {
+  const cat = matchSinkOrSanitizer(calleeExpr, _currentFile);
+  const argTaints = (argExprs || []).map(a => exprTaint(a, state));
+  return { cat, argTaints };
+}
+
+// cat / argTaints: the result of _matchCallCatalog (computed by the caller,
+// at whatever point in its case is appropriate for its own state-mutation
+// ordering).
+// state: used only to attribute reaching sources to the tainted argument
+// expression (via callContext._taintSources, not the state Set itself).
+// line: source line to attach to any emitted finding.
+// Returns { findings }.
+function _sinkFindingsForCall(calleeExpr, argExprs, cat, argTaints, state, callContext, line) {
+  const findings = [];
+  if (cat) {
+    for (const e of cat) {
+      if (e.kind === 'sink' && (
+        e.argIndex === 'all' ? argTaints.some(Boolean) :
+        (typeof e.argIndex === 'number' && argTaints[e.argIndex])
+      )) {
+        const taintedArgIdx = e.argIndex === 'all'
+          ? argTaints.findIndex(Boolean) : e.argIndex;
+        const taintedArgExpr = (argExprs || [])[taintedArgIdx];
+        // String content analysis: skip if literal skeleton doesn't match injection family
+        if (e.vuln && taintedArgExpr && !literalSkeletonMatchesFamily(taintedArgExpr, e.vuln.cwe)) continue;
+        // Premortem #10: attribute the source for THIS sink to the
+        // source(s) that taint the actual argument expression — not the
+        // first source the worklist happened to record. We walk the
+        // expression's free vars / access paths against the recorded
+        // _taintSources and keep entries whose root variable still
+        // covers something in the expression.
+        const reachingSources = _sourcesReachingExpr(taintedArgExpr, state, callContext._taintSources);
+        const traceForThisFinding = reachingSources.length
+          ? reachingSources.slice(0, 5)
+          // Fallback: better to surface "no precise source" than the wrong source.
+          : [];
+        findings.push({
+          kind: 'taint',
+          sinkId: e.id,
+          vuln: e.vuln?.name || 'Tainted Sink',
+          severity: e.vuln?.severity || 'high',
+          cwe: e.vuln?.cwe || null,
+          remediation: e.vuln?.remediation || null,
+          line,
+          argIndex: taintedArgIdx,
+          callee: calleeExpr,
+          sourceProvenance: (traceForThisFinding[0]?.provenance) || null,
+          trace: traceForThisFinding,
+        });
+      }
+    }
+  }
+  return { findings };
+}
+
 // Apply a CFG node to a taint-state. Returns the new state + any finding emitted.
 function step(node, stateIn, callContext) {
   const state = new Set(stateIn);
@@ -209,6 +333,21 @@ function step(node, stateIn, callContext) {
     case 'assign': {
       const src = exprIsSource(node.source);
       const target = typeof node.target === 'string' ? node.target : null;
+      // Sink matching is additive to this case's existing source/target/taint
+      // handling below: an assignment's RHS can itself be a sink call (e.g.
+      // `const rows = db.query(tainted)`), which previously went unreported
+      // because this case never consulted the catalog at all. Computed here,
+      // against the incoming (pre-mutation) `state`, mirroring how `case
+      // 'call'` computes its own cat/argTaints before its mutation passes —
+      // and pushed into the shared `findings` array so it survives every
+      // return path below, including the early interprocedural returns.
+      if (node.source && node.source.kind === 'call') {
+        const { cat: _sinkCat, argTaints: _sinkArgTaints } =
+          _matchCallCatalog(node.source.callee, node.source.args, state);
+        findings.push(..._sinkFindingsForCall(
+          node.source.callee, node.source.args, _sinkCat, _sinkArgTaints,
+          state, callContext, node.line).findings);
+      }
       // Constant propagation: track variables assigned from literals
       if (target && _activeConstantVars) {
         if (node.source && node.source.kind === 'literal') _activeConstantVars.set(target, node.source.value);
@@ -220,12 +359,20 @@ function step(node, stateIn, callContext) {
       // the return is tainted, taint the assignment target. This makes the
       // simplest cross-function flow (helper reads req.body and returns it)
       // visible to the engine — the case the cache was built for.
-      const calleeName = node.source && node.source.kind === 'call' && typeof node.source.callee === 'string'
-        ? node.source.callee : null;
+      const calleeName = node.source && node.source.kind === 'call'
+        ? _flattenCalleeName(node.source.callee) : null;
       if (target && calleeName && callContext._summaryCache && callContext._callGraph) {
         const _callerFile = (callContext._currentFnQid || '').split('::')[0] || undefined;
-        const resolved = callContext._callGraph.resolve ? callContext._callGraph.resolve(calleeName, _callerFile) : null;
-        const fn  = resolved && resolved.qid ? resolved : null;
+        const _resolvableName = node.source && node.source.kind === 'call'
+          ? _resolvableCalleeName(node.source.callee) : null;
+        // resolveKnownCallee: never guess via resolve()'s bare-tail
+        // fallback. _resolvableCalleeName already refuses JS member
+        // expressions, but a pre-flattened STRING callee (Go/PHP/Ruby/
+        // C++/Python parsers) can still be dotted, and only the resolver
+        // itself can tell — see callgraph.js.
+        const resolved = (_resolvableName && callContext._callGraph.resolveKnownCallee)
+          ? callContext._callGraph.resolveKnownCallee(_resolvableName, _callerFile) : null;
+        const fn  = functionRecord(callContext._callGraph, resolved);
         const qid = resolved && (resolved.qid || resolved);
         if (typeof qid === 'string') {
           // v0.66 — context-sensitive lookup. Build the entry-state from
@@ -277,7 +424,7 @@ function step(node, stateIn, callContext) {
               sum, paramNames, callArgs, callerTainted);
             for (const v of mutated.mutated) newState = addPath(newState, v);
           }
-          if (sum && sum.returnTainted) return { state: newState, findings: [] };
+          if (sum && sum.returnTainted) return { state: newState, findings };
         } else if (target && calleeName) {
           // Fallback: check builtin summaries for unresolved external calls
           const builtin = lookupBuiltinSummary(calleeName);
@@ -286,7 +433,7 @@ function step(node, stateIn, callContext) {
               newState = _addPathAliasAware(newState, target, callContext);
             } else if (!builtin.returnTainted) {
               newState = removePathAndDescendants(newState, target);
-              return { state: newState, findings: [] };
+              return { state: newState, findings };
             }
             if (builtin.mutatedParams && builtin.mutatedParams.size) {
               for (const idx of builtin.mutatedParams) {
@@ -325,16 +472,22 @@ function step(node, stateIn, callContext) {
 
     case 'call': {
       // 1. Catalog match: sanitizer, sink, or just an external/unresolved call.
-      const cat = matchSinkOrSanitizer(node.callee);
-      const argTaints = (node.args || []).map(a => exprTaint(a, state));
+      // Computed here (before the mutation passes below) so that argTaints
+      // reflects the pre-mutation state, exactly as before this logic was
+      // extracted into _matchCallCatalog/_sinkFindingsForCall.
+      const { cat, argTaints } = _matchCallCatalog(node.callee, node.args, state);
       // v0.66 — apply mutated-param taint at plain (non-assign) call sites.
       // Object.assign(target, tainted) → target becomes tainted in caller.
-      if (callContext._summaryCache && callContext._callGraph
-          && typeof node.callee === 'string') {
+      const _plainCallCalleeName = _flattenCalleeName(node.callee);
+      if (callContext._summaryCache && callContext._callGraph && _plainCallCalleeName) {
         const _callerFile = (callContext._currentFnQid || '').split('::')[0] || undefined;
-        const resolved = callContext._callGraph.resolve
-          ? callContext._callGraph.resolve(node.callee, _callerFile) : null;
-        const fn  = resolved && resolved.qid ? resolved : null;
+        const _resolvableName = _resolvableCalleeName(node.callee);
+        // resolveKnownCallee: see the comment at the sibling call site above
+        // — a pre-flattened dotted STRING callee must not be guessed via
+        // resolve()'s bare-tail fallback.
+        const resolved = (_resolvableName && callContext._callGraph.resolveKnownCallee)
+          ? callContext._callGraph.resolveKnownCallee(_resolvableName, _callerFile) : null;
+        const fn  = functionRecord(callContext._callGraph, resolved);
         const qid = resolved && (resolved.qid || resolved);
         if (typeof qid === 'string' && fn && Array.isArray(fn.params)) {
           const paramNames = fn.params;
@@ -376,7 +529,7 @@ function step(node, stateIn, callContext) {
       // Built-in mutation functions: Object.assign(target, ...sources),
       // _.merge(target, ...sources), etc. When any source arg is tainted,
       // taint the target in the caller's scope.
-      const calleeName = typeof node.callee === 'string' ? node.callee : null;
+      const calleeName = _plainCallCalleeName;
       if (calleeName && /^(?:Object\.assign|_\.merge|_\.extend|_\.defaultsDeep|_\.defaults|Object\.defineProperties?)$/.test(calleeName)) {
         const targetArg = (node.args || [])[0];
         const sourceArgsTainted = argTaints.slice(1).some(Boolean);
@@ -405,44 +558,7 @@ function step(node, stateIn, callContext) {
         const _arrRecv = accessPathOf(node.callee.object);
         if (_arrRecv) state.add(_arrRecv);
       }
-      if (cat) {
-        for (const e of cat) {
-          if (e.kind === 'sink' && (
-            e.argIndex === 'all' ? argTaints.some(Boolean) :
-            (typeof e.argIndex === 'number' && argTaints[e.argIndex])
-          )) {
-            const taintedArgIdx = e.argIndex === 'all'
-              ? argTaints.findIndex(Boolean) : e.argIndex;
-            const taintedArgExpr = (node.args || [])[taintedArgIdx];
-            // String content analysis: skip if literal skeleton doesn't match injection family
-            if (e.vuln && taintedArgExpr && !literalSkeletonMatchesFamily(taintedArgExpr, e.vuln.cwe)) continue;
-            // Premortem #10: attribute the source for THIS sink to the
-            // source(s) that taint the actual argument expression — not the
-            // first source the worklist happened to record. We walk the
-            // expression's free vars / access paths against the recorded
-            // _taintSources and keep entries whose root variable still
-            // covers something in the expression.
-            const reachingSources = _sourcesReachingExpr(taintedArgExpr, state, callContext._taintSources);
-            const traceForThisFinding = reachingSources.length
-              ? reachingSources.slice(0, 5)
-              // Fallback: better to surface "no precise source" than the wrong source.
-              : [];
-            findings.push({
-              kind: 'taint',
-              sinkId: e.id,
-              vuln: e.vuln?.name || 'Tainted Sink',
-              severity: e.vuln?.severity || 'high',
-              cwe: e.vuln?.cwe || null,
-              remediation: e.vuln?.remediation || null,
-              line: node.line,
-              argIndex: taintedArgIdx,
-              callee: node.callee,
-              sourceProvenance: (traceForThisFinding[0]?.provenance) || null,
-              trace: traceForThisFinding,
-            });
-          }
-        }
-      }
+      findings.push(..._sinkFindingsForCall(node.callee, node.args, cat, argTaints, state, callContext, node.line).findings);
       // 2. P1.3 — higher-order taint flow. When the call is `arr.map(fn)` or
       //    `promise.then(fn)` and the receiver is tainted, propagate taint
       //    into the callback's first parameter. v1: we propagate AT THE
@@ -452,7 +568,7 @@ function step(node, stateIn, callContext) {
       const hoFlow = (() => {
         // Heuristic receiver-tainted check: if the callee string is
         // "<recv>.<method>", check whether <recv> is in state.
-        const callee = typeof node.callee === 'string' ? node.callee : null;
+        const callee = _plainCallCalleeName;
         if (!callee) return null;
         const dot = callee.lastIndexOf('.');
         if (dot <= 0) return null;
@@ -526,6 +642,7 @@ function analyzeFunction(fn, entryState, callContext) {
   inStates.set(fn.cfg.entry, new Set(entryState));
   work.push(fn.cfg.entry);
   _activeConstantVars = new Map();
+  _currentFile = fn.file || null;
   // v0.70 #2 — points-to context for the step() transfer. Setting it here
   // (instead of plumbing through step's signature) keeps the worklist loop
   // unchanged and lets `step` consult `aliasesForVar` when callContext._pointsTo
@@ -583,7 +700,7 @@ function analyzeFunction(fn, entryState, callContext) {
       for (const [nid, ctx] of ictx) {
         const node = nodes[nid];
         if (!node || node.kind !== 'call') continue;
-        const cat = matchSinkOrSanitizer(node.callee);
+        const cat = matchSinkOrSanitizer(node.callee, _currentFile);
         const sink = cat && cat.find((e) => e.kind === 'sink');
         if (!sink) continue;
         const inS = inStates.get(nid) || new Set();
@@ -783,8 +900,12 @@ export function runTaintEngine(perFileIR, callGraph, opts = {}) {
       if (Date.now() > deadlineMs) break;
       const inv = hoInvocations[hi];
       if (!inv.callee || !inv.taintedParam) continue;
-      const resolved = callGraph.resolve ? callGraph.resolve(inv.callee, fn && fn.file) : null;
-      const cbFn = resolved && resolved.qid ? resolved : null;
+      // inv.callee is always a bare ident (only cb.kind === 'ident' pushes a
+      // higher-order invocation — see the push site above), so resolve()'s
+      // bare-tail guess never triggers here either way; resolveKnownCallee
+      // for consistency with the other call-graph lookups in this file.
+      const resolved = callGraph.resolveKnownCallee ? callGraph.resolveKnownCallee(inv.callee, fn && fn.file) : null;
+      const cbFn = functionRecord(callGraph, resolved);
       if (!cbFn || !cbFn.params || !cbFn.params.length) continue;
       const cbEntry = new Set([cbFn.params[inv.paramIndex || 0]]);
       let cbSummary = summaryCache.get(cbFn.qid, cbEntry);

package/src/dataflow/ifds.js

@@ -28,6 +28,7 @@
 // engine is gated on the CVE-replay regression corpus.
 
 import { matchSource, matchSinkOrSanitizer } from './catalog.js';
+import { functionRecord } from '../ir/callgraph.js';
 
 // Special bottom fact: "no taint yet, but reachable." Every node propagates
 // 0̂ → 0̂ to mark reachability, then layers domain facts on top.
@@ -129,10 +130,10 @@ function _exprAccessPath(expr) {
 
 // Sink detection at call nodes. Returns a list of sink-finding records
 // {sinkId, vuln, severity, cwe, line} when `fact` reaches a sink arg.
-function _detectSinkAtCall(node, fact) {
+function _detectSinkAtCall(node, fact, file = null) {
   if (!node || node.kind !== 'call') return [];
   if (fact === ZERO) return [];
-  const cat = matchSinkOrSanitizer(node.callee);
+  const cat = matchSinkOrSanitizer(node.callee, file);
   if (!cat) return [];
   const findings = [];
   const args = node.args || [];
@@ -251,14 +252,18 @@ export class IFDSSolver {
     if (!node) return;
     // Emit findings if this is a sink.
     if (node.kind === 'call') {
-      for (const f of _detectSinkAtCall(node, currentFact)) {
+      for (const f of _detectSinkAtCall(node, currentFact, fn && fn.file)) {
         this.findings.push({ ...f, _fnQid: fn.qid, _entryFact: entryFact });
       }
       // v0.73 — interprocedural call: if the callee is resolved AND we
       // can derive an entry fact for it, look up (or queue) its summary
       // and apply the resulting exit facts at the return site.
-      const resolved = this.callGraph.resolve ? this.callGraph.resolve(node.callee) : null;
-      const callee = resolved && resolved.qid ? resolved : null;
+      // resolveKnownCallee (not resolve): never invent an edge from a dotted
+      // name's last segment. `fn.file` enables the same-file preference — a
+      // bare `handler` would otherwise bind to whichever file iterates first.
+      const resolved = this.callGraph.resolveKnownCallee
+        ? this.callGraph.resolveKnownCallee(node.callee, fn && fn.file) : null;
+      const callee = functionRecord(this.callGraph, resolved);
       if (callee && callee.cfg) {
         const calleeEntryFact = _entryFactForCall(node, currentFact, callee);
         // Seed the callee at its entry with the derived fact.

package/src/dataflow/index.js

@@ -173,9 +173,21 @@ export function runDeepAnalysis(perFileIR, callGraph, opts = {}) {
     if (callGraph && callGraph.functions) {
       for (const fn of callGraph.functions.values()) {
         if (!Array.isArray(fn.calls)) continue;
-        for (const callee of fn.calls) {
-          if (!callers[callee]) callers[callee] = [];
-          callers[callee].push(fn.qid);
+        for (const c of fn.calls) {
+          // fn.calls entries are objects ({site, callee, args, line}); using one
+          // as an object key stringifies it to "[object Object]" and collapses
+          // every entry into a single bogus bucket. Key by the RESOLVED qid so
+          // this map is queryable by the qids the worklist actually uses.
+          const name = c && typeof c === 'object' ? c.callee : c;
+          if (!name) continue;
+          // resolveKnownCallee (not resolve): a raw fn.calls name may be a
+          // flattened member-call string ("loader.read"); the plain
+          // resolve() would guess via its bare-tail fallback and invent an
+          // edge to an unrelated same-named function. See callgraph.js.
+          const qid = callGraph.resolveKnownCallee ? callGraph.resolveKnownCallee(name, fn.file) : null;
+          if (!qid) continue;
+          if (!callers[qid]) callers[qid] = [];
+          callers[qid].push(fn.qid);
         }
       }
     }

package/src/dataflow/points-to.js

@@ -1,3 +1,5 @@
+import { functionRecord } from '../ir/callgraph.js';
+
 // Steensgaard points-to / alias analysis (v0.70 #2).
 //
 // Unification-based, near-linear pointer analysis. The classical reference
@@ -247,8 +249,12 @@ export function buildPointsTo(perFileIR, callGraph) {
     for (const nid of Object.keys(fn.cfg.nodes)) {
       const node = fn.cfg.nodes[nid];
       if (!node || node.kind !== 'call') continue;
-      const resolved = callGraph.resolve ? callGraph.resolve(node.callee) : null;
-      const target = resolved && resolved.qid ? resolved : null;
+      // resolveKnownCallee (not resolve): never invent an edge from a dotted
+      // name's last segment. `fn.file` enables the same-file preference — a
+      // bare `handler` would otherwise bind to whichever file iterates first.
+      const resolved = callGraph.resolveKnownCallee
+        ? callGraph.resolveKnownCallee(node.callee, fn && fn.file) : null;
+      const target = functionRecord(callGraph, resolved);
       if (!target || !Array.isArray(target.params)) continue;
       const args = node.args || [];
       for (let i = 0; i < target.params.length && i < args.length; i++) {

package/src/dataflow/proof-gate.js

@@ -48,6 +48,13 @@ export function verdictForFinding(f) {
     const sanitizers = (f.provenanceProof && f.provenanceProof.sanitizers) || [];
     return { verdict: 'proven-clean', reason: sanitizers.length ? `parameterized via ${sanitizers.join(', ')}` : 'sql-parameterizer-on-path' };
   }
+  // sanitizer-gate.js — same "proven-clean" demotion, generalised beyond SQL to
+  // every family the catalog's `appliesTo` tags cover (xss, url, cmd, ...).
+  // Purely additive: it never overrides f.provenClean above.
+  if (f.sanitized === true) {
+    const sanitizers = (f.sanitizerProof && f.sanitizerProof.sanitizers) || [];
+    return { verdict: 'proven-clean', reason: sanitizers.length ? `sanitized via ${sanitizers.join(', ')}` : 'sanitizer-on-path' };
+  }
   if (f._provenUnreachable === true) {
     return { verdict: 'proven-infeasible', reason: f._provenUnreachableReason || 'sanitizer-excludes-metacharacters' };
   }

package/src/dataflow/sanitizer-gate.js

@@ -0,0 +1,89 @@
+// Generalised, recall-preserving sanitizer gate.
+//
+// The catalog carries 65 sanitizer entries tagged by family via `appliesTo`
+// (sql, xss, url, cmd). Before this module only `appliesTo: ['sql']` was ever
+// consumed — by proven-clean.js — so a correctly sanitized xss/url/cmd flow was
+// still reported at full confidence. That is a pure false-positive source.
+//
+// This gate NEVER removes a finding. It sets `sanitized` plus a proof object and
+// lets the existing proof gate in engine.js do the demotion, exactly as
+// proven-clean.js does. That matters because a mislabelled sanitizer would
+// otherwise hide a real vulnerability: the C/C++ work found strncpy and snprintf
+// tagged effect:'strip' when they bound length rather than sanitising content.
+
+import { CATALOG } from './catalog.js';
+
+// Map a finding to a sanitizer family using its CWE first (stable) and its vuln
+// text second (human-authored, so only a fallback).
+const _CWE_FAMILY = {
+  'CWE-89': 'sql',
+  'CWE-79': 'xss',
+  'CWE-78': 'cmd',
+  'CWE-22': 'url',
+  'CWE-918': 'url',
+  'CWE-601': 'url',
+};
+
+const _TEXT_FAMILY = [
+  [/sql/i, 'sql'],
+  [/xss|cross-site scripting/i, 'xss'],
+  [/command injection/i, 'cmd'],
+  [/path traversal|ssrf|redirect/i, 'url'],
+];
+
+export function familyOfFinding(f) {
+  if (!f) return null;
+  if (f.cwe && _CWE_FAMILY[f.cwe]) return _CWE_FAMILY[f.cwe];
+  const text = `${f.vuln || ''} ${f.family || ''}`;
+  for (const [re, fam] of _TEXT_FAMILY) if (re.test(text)) return fam;
+  return null;
+}
+
+// callee name → set of families it sanitizes, built once from the catalog.
+let _index = null;
+function _sanitizerIndex() {
+  if (_index) return _index;
+  _index = new Map();
+  for (const e of CATALOG) {
+    if (!e || e.kind !== 'sanitizer') continue;
+    const callee = e.match && e.match.type === 'call' ? e.match.callee : null;
+    if (!callee) continue;
+    const fams = Array.isArray(e.appliesTo) ? e.appliesTo : [];
+    const cur = _index.get(callee) || new Set();
+    for (const f of fams) cur.add(f);
+    _index.set(callee, cur);
+  }
+  return _index;
+}
+
+export function _sanitizerFamilies() {
+  const out = new Set();
+  for (const fams of _sanitizerIndex().values()) for (const f of fams) out.add(f);
+  return [...out].sort();
+}
+
+// ctx.sanitizersOnPath: { [findingId]: string[] } — callee names observed on the
+// flow that produced the finding. The engine supplies it; when absent the gate
+// is a no-op, which keeps this safe to call unconditionally.
+export function applySanitizerGate(findings, ctx) {
+  const list = Array.isArray(findings) ? findings : [];
+  const onPath = (ctx && ctx.sanitizersOnPath) || null;
+  if (!onPath) return list;
+  const index = _sanitizerIndex();
+
+  for (const f of list) {
+    const fam = familyOfFinding(f);
+    if (!fam) continue;
+    const observed = onPath[f.id] || onPath[f.stableId];
+    if (!Array.isArray(observed) || !observed.length) continue;
+    const matching = observed.filter(name => {
+      const fams = index.get(name);
+      return fams && fams.has(fam);
+    });
+    if (!matching.length) continue;
+    // Label only. The proof gate decides what to do with the label.
+    f.sanitized = true;
+    f.sanitizerProof = { sanitizers: matching, family: fam };
+  }
+  return list;
+}

package/src/dataflow/tabulation.js

@@ -49,7 +49,7 @@ export function enumerateSinks(perFileIR, callGraph) {
     for (const nid of Object.keys(cfg.nodes)) {
       const node = cfg.nodes[nid];
       if (!node || node.kind !== 'call') continue;
-      const cat = matchSinkOrSanitizer(node.callee);
+      const cat = matchSinkOrSanitizer(node.callee, fn.file || null);
       if (!cat) continue;
       for (const e of cat) {
         if (e.kind !== 'sink') continue;
@@ -84,8 +84,19 @@ export function reachabilitySliceFromSinks(sinks, callGraph, maxCallerDepth = MA
   const callersOf = new Map();
   for (const fn of callGraph.functions.values()) {
     for (const callee of (fn.calls || [])) {
-      if (!callersOf.has(callee.callee)) callersOf.set(callee.callee, []);
-      callersOf.get(callee.callee).push(fn.qid);
+      // callee.callee is a SOURCE-LEVEL name ("b.fill"); the worklist below
+      // looks this map up by qid, so keying by the name means the lookup can
+      // never match. Resolve to a qid first.
+      const name = callee && typeof callee === 'object' ? callee.callee : callee;
+      if (!name) continue;
+      // resolveKnownCallee (not resolve): callee.callee may be a flattened
+      // member-call string ("loader.read"); the plain resolve() would guess
+      // via its bare-tail fallback and invent an edge to an unrelated
+      // same-named function. See callgraph.js.
+      const qid = callGraph.resolveKnownCallee ? callGraph.resolveKnownCallee(name, fn.file) : null;
+      if (!qid) continue;
+      if (!callersOf.has(qid)) callersOf.set(qid, []);
+      callersOf.get(qid).push(fn.qid);
     }
   }