@clear-capabilities/agentic-security-scanner 0.134.0 → 0.136.9

package/src/ir/balanced-call.js

@@ -0,0 +1,55 @@
+// Shared by every hand-rolled regex IR parser (parser-cs.js, parser-go.js,
+// parser-php.js, parser-rb.js) for extracting a call's callee + argument
+// text without corruption when the call is followed by a chained member
+// access (`Sanitize(x).Trim()`, `$obj->clean($x)->trim()`).
+//
+// The naive pattern every one of those files used —
+// `/^(calleeRe)\s*\((.*)\)\s*$/s` — matches `(.*)` GREEDILY against the
+// LAST `)` in the string, not the one balancing the FIRST `(`. For a
+// chained call that swallows the chain's own parens into the argument
+// text (`Sanitize(x).Trim()` produced argsText = "x).Trim("), which then
+// fails to parse as any recognized expression shape in `_lowerExpr` and
+// falls through to `{kind:'unknown'}` — silently losing whatever
+// taint-relevant identifiers were inside the FIRST call's real argument
+// list, exactly the shape a wrapped-and-then-methodcalled sanitizer or
+// helper produces in real code.
+//
+// This scans forward from the first `(` tracking paren/bracket/brace
+// depth and string-literal state (so a `)` or `,` inside a nested call or
+// a string literal doesn't miscount) to find the REAL matching close
+// paren. It deliberately does NOT require that close paren to be the end
+// of the string — a trailing chain (`.Trim()`, `->trim()`, `::foo()`) is
+// simply left unconsumed rather than corrupting anything. Recovering the
+// first call's real signature is a strict improvement over the prior
+// choice between silent corruption and no match at all.
+export function matchBalancedCall(s, calleeRe) {
+  if (typeof s !== 'string') return null;
+  const m = calleeRe.exec(s);
+  if (!m || m.index !== 0) return null;
+  let i = m[0].length;
+  while (s[i] === ' ' || s[i] === '\t') i++;
+  if (s[i] !== '(') return null;
+  const openIdx = i;
+  let depth = 0;
+  let inStr = null;
+  let escape = false;
+  for (; i < s.length; i++) {
+    const c = s[i];
+    if (escape) { escape = false; continue; }
+    if (inStr) {
+      if (c === '\\') { escape = true; continue; }
+      if (c === inStr) inStr = null;
+      continue;
+    }
+    if (c === '"' || c === '\'') { inStr = c; continue; }
+    if (c === '(' || c === '[' || c === '{') { depth++; continue; }
+    if (c === ')' || c === ']' || c === '}') {
+      depth--;
+      if (depth === 0) break;
+      continue;
+    }
+  }
+  if (depth !== 0 || s[i] !== ')') return null; // unbalanced — refuse to guess
+  const callee = m[1] !== undefined ? m[1] : m[0];
+  return { callee, argsText: s.slice(openIdx + 1, i) };
+}

package/src/ir/ir-stats.js

@@ -4,7 +4,7 @@
 // language, how many of the files we claim to support did we actually turn
 // into IR? That is the difference between recognising an extension and
 // supporting a language, and it is the headline metric of the proof corpus
-// bench (docs/PROOF_CORPUS_PRD.md §5.4).
+// bench (the Proof Corpus PRD §5.4 (removed post-implementation)).
 //
 // Enable by setting AGENTIC_SECURITY_IR_STATS to an output path. The sidecar
 // deliberately contains NO timestamp so two runs over identical input produce

package/src/ir/parser-cpp.js

@@ -1,7 +1,7 @@
 // C / C++ IR frontend.
 //
 // Hand-rolled, following the parser-cs.js / parser-go.js template. See
-// docs/PROOF_CORPUS_PRD.md §6.3 for why this is not tree-sitter or libclang:
+// the Proof Corpus PRD §6.3 (removed post-implementation) for why this is not tree-sitter or libclang:
 // the build excludes the tree-sitter deps from the bundle, and libclang would
 // require native bindings plus a compile database we deliberately never build.
 //

package/src/ir/parser-cs.js

@@ -27,6 +27,7 @@
 
 import * as crypto from 'node:crypto';
 import { callSitesFromCfg } from './call-sites.js';
+import { matchBalancedCall } from './balanced-call.js';
 
 const METHOD_RE = new RegExp(
   '(?:^|[\\s;{}])(?:public|private|protected|internal|static|virtual|override|async|sealed|abstract|new|readonly|partial)' +
@@ -80,17 +81,69 @@ function _lowerExpr(text) {
     if (parts.length === 1) return { kind: 'ident', name: parts[0] };
     return _buildMemberChain(parts);
   }
-  // Call: foo.bar(args) or Bar(args). Find the LAST '(' at depth 0.
-  const callMatch = s.match(/^([\w.]+)\s*\((.*)\)\s*$/s);
+  // Object creation: `new Type(args)` — lowered to a call so taint flows into
+  // constructor arguments. Without this branch the expression fell through to
+  // the concat heuristic below, and because the `+` sits INSIDE the parens
+  // `_splitTopLevelPlus` returned the input unchanged, so that branch recursed
+  // on the identical string until the stack blew. `buildProjectIR` catches
+  // per-file, so the crash surfaced only as "this file has no IR" — 12 of 21 C#
+  // corpus entries, and the catalog's own `cs-sqlcommand` rule ("SQL Injection
+  // (new SqlCommand with concatenated user input)") could never fire.
+  const newMatch = matchBalancedCall(s, /^new\s+([\w.]+)/);
+  if (newMatch) {
+    const callee = newMatch.callee.split('.').pop();
+    const args = _splitTopLevelCommas(newMatch.argsText).map(_lowerExpr);
+    return { kind: 'call', callee, args, isNew: true };
+  }
+  // Call: foo.bar(args) or Bar(args). matchBalancedCall finds the paren
+  // that actually balances the FIRST '(' — not the greedy-to-end-of-string
+  // match the old `/\((.*)\)\s*$/` used, which corrupted the argument text
+  // for a chained call (`Sanitize(x).Trim()` produced argsText="x).Trim(",
+  // which then fell through to {kind:'unknown'} and silently dropped x).
+  const callMatch = matchBalancedCall(s, /^([\w.]+)/);
   if (callMatch) {
-    const callee = callMatch[1];
-    const args = _splitTopLevelCommas(callMatch[2]).map(_lowerExpr);
-    return { kind: 'call', callee, args };
+    const args = _splitTopLevelCommas(callMatch.argsText).map(_lowerExpr);
+    return { kind: 'call', callee: callMatch.callee, args };
   }
   // String concat / interpolation — heuristic.
+  //
+  // The `parts.length > 1` guard is load-bearing, not defensive tidiness: when
+  // the `+` is nested inside parens or brackets, `_splitTopLevelPlus` returns
+  // the input as a single part, and mapping `_lowerExpr` over it recurses on the
+  // identical string forever. Any future expression form that reaches here
+  // unsplit would otherwise reintroduce the same stack overflow.
   if (s.includes('+') && /["']/.test(s)) {
-    const parts = _splitTopLevelPlus(s).map(_lowerExpr);
-    return { kind: 'tpl', parts };
+    const rawParts = _splitTopLevelPlus(s);
+    if (rawParts.length > 1) return { kind: 'tpl', parts: rawParts.map(_lowerExpr) };
+  }
+  // Stage 3 correctness audit (detection depth, per-language-IR):
+  // interpolated strings ($"id={id}", $@"...", @$"...") were entirely
+  // unrecognized by every branch above — not even treated as an opaque
+  // literal, since nothing here tested for the leading `$` prefix — so
+  // they fell all the way through to {kind:'unknown'}, silently dropping
+  // any interpolated variable's taint. This is exactly
+  // `new SqlCommand($"SELECT ... WHERE id={id}", conn)`, one of the most
+  // common real C# SQL-injection shapes. `{expr}` / `{expr:format}` are
+  // lowered into a template, same shape as the `+`-concat branch above.
+  if (/^\$@?"/.test(s) || /^@\$"/.test(s)) {
+    const bodyStart = s.indexOf('"') + 1;
+    const inner = s.slice(bodyStart, -1);
+    const re = /\{([^{}:]+)(?::[^{}]*)?\}/g;
+    let lastIndex = 0;
+    const parts = [];
+    let matched = false;
+    let m;
+    while ((m = re.exec(inner)) !== null) {
+      matched = true;
+      if (m.index > lastIndex) parts.push({ kind: 'literal', value: inner.slice(lastIndex, m.index) });
+      parts.push(_lowerExpr(m[1].trim()));
+      lastIndex = re.lastIndex;
+    }
+    if (matched) {
+      if (lastIndex < inner.length) parts.push({ kind: 'literal', value: inner.slice(lastIndex) });
+      return { kind: 'tpl', parts };
+    }
+    return { kind: 'literal', value: s };
   }
   if (/^"|^@"/.test(s)) return { kind: 'literal', value: s };
   if (/^\d/.test(s))   return { kind: 'literal', value: s };
@@ -169,9 +222,9 @@ function _lowerStmt(stmt, line) {
     return { kind: 'assign', line, target, source: _lowerExpr(sourceText) };
   }
   // statement-form call
-  const cm = s.match(/^([A-Za-z_][\w.]*)\s*\((.*)\)\s*$/s);
+  const cm = matchBalancedCall(s, /^([A-Za-z_][\w.]*)/);
   if (cm) {
-    return { kind: 'call', line, callee: cm[1], args: _splitTopLevelCommas(cm[2]).map(_lowerExpr) };
+    return { kind: 'call', line, callee: cm.callee, args: _splitTopLevelCommas(cm.argsText).map(_lowerExpr) };
   }
   return { kind: 'unknown', line, text: s };
 }

package/src/ir/parser-go.js

@@ -22,6 +22,7 @@
 
 import * as crypto from 'node:crypto';
 import { callSitesFromCfg } from './call-sites.js';
+import { matchBalancedCall } from './balanced-call.js';
 
 const FUNC_RE = new RegExp(
   '(?:^|[\\n;{}])\\s*func\\s+' +
@@ -76,7 +77,11 @@ function _lowerExpr(text) {
   const s = String(text || '').trim();
   if (!s) return { kind: 'unknown' };
   if (/^fmt\.Sprintf\s*\(/.test(s)) {
-    const inner = s.slice(s.indexOf('(') + 1, s.lastIndexOf(')'));
+    // Same balanced-paren concern as the call patterns below — a chained
+    // call after fmt.Sprintf(...) (rare but not impossible via a wrapper)
+    // would otherwise have its args text swallow the chain's own parens.
+    const sprintf = matchBalancedCall(s, /^fmt\.Sprintf/);
+    const inner = sprintf ? sprintf.argsText : s.slice(s.indexOf('(') + 1, s.lastIndexOf(')'));
     const parts = _splitTopLevelCommas(inner).map(_lowerExpr);
     return { kind: 'tpl', parts };
   }
@@ -91,17 +96,30 @@ function _lowerExpr(text) {
   if (/^"/.test(s) || /^`/.test(s)) return { kind: 'literal', value: s };
   if (/^\d/.test(s)) return { kind: 'literal', value: s };
   if (/^(true|false|nil)\b/.test(s)) return { kind: 'literal', value: s };
-  // Call: foo.Bar(args) or Bar(args)
-  const callMatch = s.match(/^([\w.]+)\s*\((.*)\)\s*$/s);
+  // Call: foo.Bar(args) or Bar(args). matchBalancedCall finds the paren
+  // that actually balances the FIRST '(' — not the greedy-to-end-of-string
+  // match the old `/\((.*)\)\s*$/` used, which corrupted the argument text
+  // for a chained call (`Sanitize(x).Trim()` produced args="x).Trim(",
+  // which then fell through to {kind:'unknown'} and silently dropped x).
+  const callMatch = matchBalancedCall(s, /^([\w.]+)/);
   if (callMatch) {
-    const callee = callMatch[1];
-    const args = _splitTopLevelCommas(callMatch[2]).map(_lowerExpr);
-    return { kind: 'call', callee, args };
+    const args = _splitTopLevelCommas(callMatch.argsText).map(_lowerExpr);
+    return { kind: 'call', callee: callMatch.callee, args };
   }
-  // String concat with +
+  // String concat with + — a SECOND occurrence of the same check as above
+  // (line ~92), reached when the expression didn't match any branch in
+  // between (calls, literals, etc.). It's missing the `parts.length > 1`
+  // guard the first occurrence has: when the `+` sits inside an extra
+  // pair of parens (`("SELECT " + name)` — e.g. an over-parenthesized
+  // argument), `_splitTopLevelPlus` returns the input unchanged as ONE
+  // part (depth never returns to 0 at the `+`), and `.map(_lowerExpr)`
+  // then recurses on the IDENTICAL string forever — a stack overflow,
+  // uncaught here (only caught by buildProjectIR's per-file try/catch, so
+  // it surfaces only as "this file has no IR"). Same bug class, same fix,
+  // as parser-cs.js's `_splitTopLevelPlus` guard for `new Type(concat)`.
   if (s.includes('+') && /["'`]/.test(s)) {
-    const parts = _splitTopLevelPlus(s).map(_lowerExpr);
-    return { kind: 'tpl', parts };
+    const parts = _splitTopLevelPlus(s);
+    if (parts.length > 1) return { kind: 'tpl', parts: parts.map(_lowerExpr) };
   }
   // Member: a.b.c
   if (/^[A-Za-z_][\w.]*$/.test(s)) {
@@ -220,9 +238,9 @@ function _lowerStmt(stmt, line) {
     return { kind: 'assign', line, target: varDecl[1], source: _lowerExpr(varDecl[2]) };
   }
   // Statement-form call: obj.Method(args) or Method(args)
-  const cm = s.match(/^([\w.]+)\s*\((.*)\)\s*$/s);
+  const cm = matchBalancedCall(s, /^([\w.]+)/);
   if (cm) {
-    return { kind: 'call', line, callee: cm[1], args: _splitTopLevelCommas(cm[2]).map(_lowerExpr) };
+    return { kind: 'call', line, callee: cm.callee, args: _splitTopLevelCommas(cm.argsText).map(_lowerExpr) };
   }
   return null;
 }

package/src/ir/parser-java.js

@@ -58,6 +58,27 @@ function exprFromCst(node) {
     // CST node with named children — recurse into the most informative one.
     // Method invocation
     if (node.children.methodInvocation) return _methodInvocation(node.children.methodInvocation[0]);
+    // `primary` is how java-parser actually models a call: the name lives in
+    // primaryPrefix (an fqnOrRefType) and the invocation itself in
+    // primarySuffix.methodInvocationSuffix. Without this branch the fall-through
+    // below recursed into the prefix and returned the NAME — so
+    // `req.getParameter("q")` lowered to a member access, never a call, and no
+    // source or sink in the Java catalog could ever match.
+    if (node.children.primaryPrefix) {
+      const prefix = node.children.primaryPrefix[0];
+      const suffixes = node.children.primarySuffix || [];
+      const invocation = suffixes
+        .map(s => s.children?.methodInvocationSuffix?.[0])
+        .find(Boolean);
+      if (invocation) {
+        const fqn = prefix?.children?.fqnOrRefType?.[0];
+        const callee = fqn ? _flattenFqnToString(fqn) : 'unknown';
+        const args = (invocation.children?.argumentList?.[0]?.children?.expression || [])
+          .map(exprFromCst);
+        return { kind: 'call', callee, args };
+      }
+      return exprFromCst(prefix);
+    }
     // FQN ref
     if (node.children.fqnOrRefType) return _fqnExpr(node.children.fqnOrRefType[0]);
     if (node.children.unqualifiedClassInstanceCreationExpression) {
@@ -89,12 +110,37 @@ function exprFromCst(node) {
   return { kind: 'unknown' };
 }
 
+/**
+ * The identifier images of an `fqnOrRefType`, in order.
+ *
+ * java-parser does NOT put `Identifier` directly on `fqnOrRefType`. The real
+ * shape is fqnOrRefTypePartFirst / fqnOrRefTypePartRest → fqnOrRefTypePartCommon
+ * → Identifier, so reading `children.Identifier` returned nothing for every
+ * real-world expression and both callers below degraded to 'unknown'. The
+ * direct-Identifier form is still accepted as a fallback.
+ */
+function _fqnIdents(node) {
+  if (!node || !node.children) return [];
+  const direct = node.children.Identifier;
+  if (Array.isArray(direct) && direct.length) return direct.map(t => t.image);
+  const out = [];
+  const parts = [
+    ...(node.children.fqnOrRefTypePartFirst || []),
+    ...(node.children.fqnOrRefTypePartRest || []),
+  ];
+  for (const p of parts) {
+    const common = p.children?.fqnOrRefTypePartCommon?.[0];
+    const id = common?.children?.Identifier?.[0]?.image;
+    if (id) out.push(id);
+  }
+  return out;
+}
+
 function _fqnExpr(node) {
-  // java-parser fqnOrRefType has children { Identifier: [...] } sometimes
-  // and Dot tokens between them.
   if (!node || !node.children) return { kind: 'unknown' };
-  const ids = node.children.Identifier;
-  if (!ids || !ids.length) return { kind: 'unknown' };
+  const idImages = _fqnIdents(node);
+  if (!idImages.length) return { kind: 'unknown' };
+  const ids = idImages.map(image => ({ image }));
   let cur = { kind: 'ident', name: ids[0].image };
   for (let i = 1; i < ids.length; i++) {
     cur = { kind: 'member', object: cur, prop: ids[i].image };
@@ -118,10 +164,28 @@ function _methodInvocation(node) {
 }
 
 function _flattenFqnToString(node) {
-  if (!node || !node.children) return 'unknown';
-  const ids = node.children.Identifier;
-  if (!ids) return 'unknown';
-  return ids.map(t => t.image).join('.');
+  const ids = _fqnIdents(node);
+  return ids.length ? ids.join('.') : 'unknown';
+}
+
+// Descend to the first leaf token in a CST subtree and return its
+// startLine. java-parser (chevrotain) leaf tokens carry startLine directly;
+// rule nodes only carry `children`. Returns 0 when nothing is found (e.g.
+// an empty node), which callers already treat as "unknown".
+function _lineOf(node) {
+  if (!node) return 0;
+  if (Array.isArray(node)) {
+    for (const n of node) { const l = _lineOf(n); if (l) return l; }
+    return 0;
+  }
+  if (typeof node.startLine === 'number') return node.startLine;
+  if (node.children) {
+    for (const k of Object.keys(node.children)) {
+      const l = _lineOf(node.children[k]);
+      if (l) return l;
+    }
+  }
+  return 0;
 }
 
 /**
@@ -132,7 +196,7 @@ function _flattenFqnToString(node) {
  * `if` / `loop-header` node and the body falls through linearly. This is
  * coarser than the JS frontend; v2 will branch the succ array.
  */
-function buildCfgFromBody(bodyNode, line) {
+function buildCfgFromBody(bodyNode) {
   const nodes = {};
   const entry = nextNodeId();
   const exit = nextNodeId();
@@ -157,6 +221,14 @@ function buildCfgFromBody(bodyNode, line) {
   function walkStmts(stmtNode) {
     if (!stmtNode || !stmtNode.children) return;
     const kids = stmtNode.children;
+    // java-parser nests a `block` as block → blockStatements (PLURAL, an
+    // intermediate rule node) → blockStatement. Walking only `blockStatement`
+    // from the block node therefore descended into nothing and every method
+    // body lowered to an empty CFG — which is why Java had IR functions with
+    // entry/exit and no statements, and taint could never fire.
+    if (kids.blockStatements) {
+      for (const bss of kids.blockStatements) walkStmts(bss);
+    }
     // Block statement children
     if (kids.blockStatement) {
       for (const bs of kids.blockStatement) walkStmts(bs);
@@ -170,7 +242,7 @@ function buildCfgFromBody(bodyNode, line) {
             const target = d.children?.variableDeclaratorId?.[0]?.children?.Identifier?.[0]?.image;
             const initExpr = d.children?.variableInitializer?.[0]?.children?.expression?.[0];
             if (target) {
-              emit({ kind: 'assign', target, source: initExpr ? exprFromCst(initExpr) : { kind: 'unknown' }, line: line || 0, succ: [] });
+              emit({ kind: 'assign', target, source: initExpr ? exprFromCst(initExpr) : { kind: 'unknown' }, line: _lineOf(lv), succ: [] });
             }
           }
         }
@@ -186,34 +258,34 @@ function buildCfgFromBody(bodyNode, line) {
       const e = kids.expressionStatement[0]?.children?.statementExpression?.[0]?.children?.expression?.[0];
       if (e) {
         const expr = exprFromCst(e);
-        if (expr.kind === 'call') emit({ ...expr, line: line || 0, succ: [] });
+        if (expr.kind === 'call') emit({ ...expr, line: _lineOf(kids.expressionStatement[0]), succ: [] });
         else if (expr.kind === 'binary' && expr.op === '=') {
           // assignment expr `x = y;`
-          emit({ kind: 'assign', target: expr.left?.name || null, source: expr.right, line: line || 0, succ: [] });
+          emit({ kind: 'assign', target: expr.left?.name || null, source: expr.right, line: _lineOf(kids.expressionStatement[0]), succ: [] });
         }
       }
     }
     if (kids.returnStatement) {
       const r = kids.returnStatement[0];
       const expr = r.children?.expression?.[0];
-      emit({ kind: 'return', value: expr ? exprFromCst(expr) : null, line: line || 0, succ: [] });
+      emit({ kind: 'return', value: expr ? exprFromCst(expr) : null, line: _lineOf(r), succ: [] });
     }
     if (kids.throwStatement) {
       const t = kids.throwStatement[0];
       const expr = t.children?.expression?.[0];
-      emit({ kind: 'throw', value: expr ? exprFromCst(expr) : null, line: line || 0, succ: [] });
+      emit({ kind: 'throw', value: expr ? exprFromCst(expr) : null, line: _lineOf(t), succ: [] });
     }
     if (kids.ifStatement) {
       const i = kids.ifStatement[0];
       const cond = i.children?.expression?.[0];
-      emit({ kind: 'if', cond: cond ? exprFromCst(cond) : null, line: line || 0, succ: [] });
+      emit({ kind: 'if', cond: cond ? exprFromCst(cond) : null, line: _lineOf(i), succ: [] });
       // Then branch body falls through linearly; v1 simplification.
       for (const sub of (i.children?.statement || [])) walkStmts(sub);
     }
     if (kids.whileStatement) {
       const w = kids.whileStatement[0];
       const cond = w.children?.expression?.[0];
-      emit({ kind: 'loop-header', cond: cond ? exprFromCst(cond) : null, line: line || 0, succ: [] });
+      emit({ kind: 'loop-header', cond: cond ? exprFromCst(cond) : null, line: _lineOf(w), succ: [] });
       for (const sub of (w.children?.statement || [])) walkStmts(sub);
     }
   }
@@ -266,12 +338,17 @@ export async function parseJavaFile(file, raw) {
           const params = []; // params extraction deferred
           const body = md.children?.methodBody?.[0]?.children?.block?.[0];
           if (body) {
+            const methodLine = _lineOf(md);
             functions.push({
-              qid: `${file}::${className || 'class'}::${name}`,
+              // Sibling frontends (parser-js.js) suffix the qid with `@line`
+              // so overloaded/same-named methods don't collide — without it,
+              // callgraph.js's `functions.set(fn.qid, fn)` silently drops
+              // every overload but the last one declared.
+              qid: `${file}::${className || 'class'}::${name}@${methodLine}`,
               name: className ? `${className}.${name}` : name,
-              line: 0,
+              line: methodLine,
               params,
-              cfg: buildCfgFromBody(body, 0),
+              cfg: buildCfgFromBody(body),
               file,
             });
           }