@clear-capabilities/agentic-security-scanner 0.136.2 → 0.136.9

package/src/ir/parser-go.js

@@ -22,6 +22,7 @@
 
 import * as crypto from 'node:crypto';
 import { callSitesFromCfg } from './call-sites.js';
+import { matchBalancedCall } from './balanced-call.js';
 
 const FUNC_RE = new RegExp(
   '(?:^|[\\n;{}])\\s*func\\s+' +
@@ -76,7 +77,11 @@ function _lowerExpr(text) {
   const s = String(text || '').trim();
   if (!s) return { kind: 'unknown' };
   if (/^fmt\.Sprintf\s*\(/.test(s)) {
-    const inner = s.slice(s.indexOf('(') + 1, s.lastIndexOf(')'));
+    // Same balanced-paren concern as the call patterns below — a chained
+    // call after fmt.Sprintf(...) (rare but not impossible via a wrapper)
+    // would otherwise have its args text swallow the chain's own parens.
+    const sprintf = matchBalancedCall(s, /^fmt\.Sprintf/);
+    const inner = sprintf ? sprintf.argsText : s.slice(s.indexOf('(') + 1, s.lastIndexOf(')'));
     const parts = _splitTopLevelCommas(inner).map(_lowerExpr);
     return { kind: 'tpl', parts };
   }
@@ -91,17 +96,30 @@ function _lowerExpr(text) {
   if (/^"/.test(s) || /^`/.test(s)) return { kind: 'literal', value: s };
   if (/^\d/.test(s)) return { kind: 'literal', value: s };
   if (/^(true|false|nil)\b/.test(s)) return { kind: 'literal', value: s };
-  // Call: foo.Bar(args) or Bar(args)
-  const callMatch = s.match(/^([\w.]+)\s*\((.*)\)\s*$/s);
+  // Call: foo.Bar(args) or Bar(args). matchBalancedCall finds the paren
+  // that actually balances the FIRST '(' — not the greedy-to-end-of-string
+  // match the old `/\((.*)\)\s*$/` used, which corrupted the argument text
+  // for a chained call (`Sanitize(x).Trim()` produced args="x).Trim(",
+  // which then fell through to {kind:'unknown'} and silently dropped x).
+  const callMatch = matchBalancedCall(s, /^([\w.]+)/);
   if (callMatch) {
-    const callee = callMatch[1];
-    const args = _splitTopLevelCommas(callMatch[2]).map(_lowerExpr);
-    return { kind: 'call', callee, args };
+    const args = _splitTopLevelCommas(callMatch.argsText).map(_lowerExpr);
+    return { kind: 'call', callee: callMatch.callee, args };
   }
-  // String concat with +
+  // String concat with + — a SECOND occurrence of the same check as above
+  // (line ~92), reached when the expression didn't match any branch in
+  // between (calls, literals, etc.). It's missing the `parts.length > 1`
+  // guard the first occurrence has: when the `+` sits inside an extra
+  // pair of parens (`("SELECT " + name)` — e.g. an over-parenthesized
+  // argument), `_splitTopLevelPlus` returns the input unchanged as ONE
+  // part (depth never returns to 0 at the `+`), and `.map(_lowerExpr)`
+  // then recurses on the IDENTICAL string forever — a stack overflow,
+  // uncaught here (only caught by buildProjectIR's per-file try/catch, so
+  // it surfaces only as "this file has no IR"). Same bug class, same fix,
+  // as parser-cs.js's `_splitTopLevelPlus` guard for `new Type(concat)`.
   if (s.includes('+') && /["'`]/.test(s)) {
-    const parts = _splitTopLevelPlus(s).map(_lowerExpr);
-    return { kind: 'tpl', parts };
+    const parts = _splitTopLevelPlus(s);
+    if (parts.length > 1) return { kind: 'tpl', parts: parts.map(_lowerExpr) };
   }
   // Member: a.b.c
   if (/^[A-Za-z_][\w.]*$/.test(s)) {
@@ -220,9 +238,9 @@ function _lowerStmt(stmt, line) {
     return { kind: 'assign', line, target: varDecl[1], source: _lowerExpr(varDecl[2]) };
   }
   // Statement-form call: obj.Method(args) or Method(args)
-  const cm = s.match(/^([\w.]+)\s*\((.*)\)\s*$/s);
+  const cm = matchBalancedCall(s, /^([\w.]+)/);
   if (cm) {
-    return { kind: 'call', line, callee: cm[1], args: _splitTopLevelCommas(cm[2]).map(_lowerExpr) };
+    return { kind: 'call', line, callee: cm.callee, args: _splitTopLevelCommas(cm.argsText).map(_lowerExpr) };
   }
   return null;
 }

package/src/ir/parser-java.js

@@ -58,6 +58,27 @@ function exprFromCst(node) {
     // CST node with named children — recurse into the most informative one.
     // Method invocation
     if (node.children.methodInvocation) return _methodInvocation(node.children.methodInvocation[0]);
+    // `primary` is how java-parser actually models a call: the name lives in
+    // primaryPrefix (an fqnOrRefType) and the invocation itself in
+    // primarySuffix.methodInvocationSuffix. Without this branch the fall-through
+    // below recursed into the prefix and returned the NAME — so
+    // `req.getParameter("q")` lowered to a member access, never a call, and no
+    // source or sink in the Java catalog could ever match.
+    if (node.children.primaryPrefix) {
+      const prefix = node.children.primaryPrefix[0];
+      const suffixes = node.children.primarySuffix || [];
+      const invocation = suffixes
+        .map(s => s.children?.methodInvocationSuffix?.[0])
+        .find(Boolean);
+      if (invocation) {
+        const fqn = prefix?.children?.fqnOrRefType?.[0];
+        const callee = fqn ? _flattenFqnToString(fqn) : 'unknown';
+        const args = (invocation.children?.argumentList?.[0]?.children?.expression || [])
+          .map(exprFromCst);
+        return { kind: 'call', callee, args };
+      }
+      return exprFromCst(prefix);
+    }
     // FQN ref
     if (node.children.fqnOrRefType) return _fqnExpr(node.children.fqnOrRefType[0]);
     if (node.children.unqualifiedClassInstanceCreationExpression) {
@@ -89,12 +110,37 @@ function exprFromCst(node) {
   return { kind: 'unknown' };
 }
 
+/**
+ * The identifier images of an `fqnOrRefType`, in order.
+ *
+ * java-parser does NOT put `Identifier` directly on `fqnOrRefType`. The real
+ * shape is fqnOrRefTypePartFirst / fqnOrRefTypePartRest → fqnOrRefTypePartCommon
+ * → Identifier, so reading `children.Identifier` returned nothing for every
+ * real-world expression and both callers below degraded to 'unknown'. The
+ * direct-Identifier form is still accepted as a fallback.
+ */
+function _fqnIdents(node) {
+  if (!node || !node.children) return [];
+  const direct = node.children.Identifier;
+  if (Array.isArray(direct) && direct.length) return direct.map(t => t.image);
+  const out = [];
+  const parts = [
+    ...(node.children.fqnOrRefTypePartFirst || []),
+    ...(node.children.fqnOrRefTypePartRest || []),
+  ];
+  for (const p of parts) {
+    const common = p.children?.fqnOrRefTypePartCommon?.[0];
+    const id = common?.children?.Identifier?.[0]?.image;
+    if (id) out.push(id);
+  }
+  return out;
+}
+
 function _fqnExpr(node) {
-  // java-parser fqnOrRefType has children { Identifier: [...] } sometimes
-  // and Dot tokens between them.
   if (!node || !node.children) return { kind: 'unknown' };
-  const ids = node.children.Identifier;
-  if (!ids || !ids.length) return { kind: 'unknown' };
+  const idImages = _fqnIdents(node);
+  if (!idImages.length) return { kind: 'unknown' };
+  const ids = idImages.map(image => ({ image }));
   let cur = { kind: 'ident', name: ids[0].image };
   for (let i = 1; i < ids.length; i++) {
     cur = { kind: 'member', object: cur, prop: ids[i].image };
@@ -118,10 +164,28 @@ function _methodInvocation(node) {
 }
 
 function _flattenFqnToString(node) {
-  if (!node || !node.children) return 'unknown';
-  const ids = node.children.Identifier;
-  if (!ids) return 'unknown';
-  return ids.map(t => t.image).join('.');
+  const ids = _fqnIdents(node);
+  return ids.length ? ids.join('.') : 'unknown';
+}
+
+// Descend to the first leaf token in a CST subtree and return its
+// startLine. java-parser (chevrotain) leaf tokens carry startLine directly;
+// rule nodes only carry `children`. Returns 0 when nothing is found (e.g.
+// an empty node), which callers already treat as "unknown".
+function _lineOf(node) {
+  if (!node) return 0;
+  if (Array.isArray(node)) {
+    for (const n of node) { const l = _lineOf(n); if (l) return l; }
+    return 0;
+  }
+  if (typeof node.startLine === 'number') return node.startLine;
+  if (node.children) {
+    for (const k of Object.keys(node.children)) {
+      const l = _lineOf(node.children[k]);
+      if (l) return l;
+    }
+  }
+  return 0;
 }
 
 /**
@@ -132,7 +196,7 @@ function _flattenFqnToString(node) {
  * `if` / `loop-header` node and the body falls through linearly. This is
  * coarser than the JS frontend; v2 will branch the succ array.
  */
-function buildCfgFromBody(bodyNode, line) {
+function buildCfgFromBody(bodyNode) {
   const nodes = {};
   const entry = nextNodeId();
   const exit = nextNodeId();
@@ -157,6 +221,14 @@ function buildCfgFromBody(bodyNode, line) {
   function walkStmts(stmtNode) {
     if (!stmtNode || !stmtNode.children) return;
     const kids = stmtNode.children;
+    // java-parser nests a `block` as block → blockStatements (PLURAL, an
+    // intermediate rule node) → blockStatement. Walking only `blockStatement`
+    // from the block node therefore descended into nothing and every method
+    // body lowered to an empty CFG — which is why Java had IR functions with
+    // entry/exit and no statements, and taint could never fire.
+    if (kids.blockStatements) {
+      for (const bss of kids.blockStatements) walkStmts(bss);
+    }
     // Block statement children
     if (kids.blockStatement) {
       for (const bs of kids.blockStatement) walkStmts(bs);
@@ -170,7 +242,7 @@ function buildCfgFromBody(bodyNode, line) {
             const target = d.children?.variableDeclaratorId?.[0]?.children?.Identifier?.[0]?.image;
             const initExpr = d.children?.variableInitializer?.[0]?.children?.expression?.[0];
             if (target) {
-              emit({ kind: 'assign', target, source: initExpr ? exprFromCst(initExpr) : { kind: 'unknown' }, line: line || 0, succ: [] });
+              emit({ kind: 'assign', target, source: initExpr ? exprFromCst(initExpr) : { kind: 'unknown' }, line: _lineOf(lv), succ: [] });
             }
           }
         }
@@ -186,34 +258,34 @@ function buildCfgFromBody(bodyNode, line) {
       const e = kids.expressionStatement[0]?.children?.statementExpression?.[0]?.children?.expression?.[0];
       if (e) {
         const expr = exprFromCst(e);
-        if (expr.kind === 'call') emit({ ...expr, line: line || 0, succ: [] });
+        if (expr.kind === 'call') emit({ ...expr, line: _lineOf(kids.expressionStatement[0]), succ: [] });
         else if (expr.kind === 'binary' && expr.op === '=') {
           // assignment expr `x = y;`
-          emit({ kind: 'assign', target: expr.left?.name || null, source: expr.right, line: line || 0, succ: [] });
+          emit({ kind: 'assign', target: expr.left?.name || null, source: expr.right, line: _lineOf(kids.expressionStatement[0]), succ: [] });
         }
       }
     }
     if (kids.returnStatement) {
       const r = kids.returnStatement[0];
       const expr = r.children?.expression?.[0];
-      emit({ kind: 'return', value: expr ? exprFromCst(expr) : null, line: line || 0, succ: [] });
+      emit({ kind: 'return', value: expr ? exprFromCst(expr) : null, line: _lineOf(r), succ: [] });
     }
     if (kids.throwStatement) {
       const t = kids.throwStatement[0];
       const expr = t.children?.expression?.[0];
-      emit({ kind: 'throw', value: expr ? exprFromCst(expr) : null, line: line || 0, succ: [] });
+      emit({ kind: 'throw', value: expr ? exprFromCst(expr) : null, line: _lineOf(t), succ: [] });
     }
     if (kids.ifStatement) {
       const i = kids.ifStatement[0];
       const cond = i.children?.expression?.[0];
-      emit({ kind: 'if', cond: cond ? exprFromCst(cond) : null, line: line || 0, succ: [] });
+      emit({ kind: 'if', cond: cond ? exprFromCst(cond) : null, line: _lineOf(i), succ: [] });
       // Then branch body falls through linearly; v1 simplification.
       for (const sub of (i.children?.statement || [])) walkStmts(sub);
     }
     if (kids.whileStatement) {
       const w = kids.whileStatement[0];
       const cond = w.children?.expression?.[0];
-      emit({ kind: 'loop-header', cond: cond ? exprFromCst(cond) : null, line: line || 0, succ: [] });
+      emit({ kind: 'loop-header', cond: cond ? exprFromCst(cond) : null, line: _lineOf(w), succ: [] });
       for (const sub of (w.children?.statement || [])) walkStmts(sub);
     }
   }
@@ -266,12 +338,17 @@ export async function parseJavaFile(file, raw) {
           const params = []; // params extraction deferred
           const body = md.children?.methodBody?.[0]?.children?.block?.[0];
           if (body) {
+            const methodLine = _lineOf(md);
             functions.push({
-              qid: `${file}::${className || 'class'}::${name}`,
+              // Sibling frontends (parser-js.js) suffix the qid with `@line`
+              // so overloaded/same-named methods don't collide — without it,
+              // callgraph.js's `functions.set(fn.qid, fn)` silently drops
+              // every overload but the last one declared.
+              qid: `${file}::${className || 'class'}::${name}@${methodLine}`,
               name: className ? `${className}.${name}` : name,
-              line: 0,
+              line: methodLine,
               params,
-              cfg: buildCfgFromBody(body, 0),
+              cfg: buildCfgFromBody(body),
               file,
             });
           }

package/src/ir/parser-js.js

@@ -98,7 +98,22 @@ function lhsPath(n) {
   if (n.type === 'ThisExpression') return '_this_';
   if (n.type === 'MemberExpression') {
     const base = lhsPath(n.object);
-    const prop = n.computed ? '*' : (n.property?.name || '*');
+    // Stage 3 correctness audit (detection depth, path-feasibility): a
+    // computed WRITE with a literal key (`obj['secret'] = tainted`) used
+    // to collapse straight to the wildcard '*' — never trying to extract
+    // the literal, unlike exprOf's MemberExpression case just above,
+    // which DOES extract it for reads. That asymmetry meant a tainted
+    // write via bracket notation with a literal key produced access path
+    // "obj.*", while any later read of that same key (`obj.secret` or
+    // `obj['secret']`) resolves via exprOf to the specific path
+    // "obj.secret" — isCoveredBy has no wildcard semantics (`'*'` is a
+    // literal property name here, not a match-anything token), so the two
+    // paths never matched and the taint was silently unreachable from any
+    // correctly-computed read. Mirrors exprOf's extraction exactly so a
+    // write and a read of the same literal key always agree.
+    const prop = n.computed
+      ? (n.property?.value != null ? String(n.property.value) : '*')
+      : (n.property?.name || '*');
     if (!base) return null;
     return base + '.' + prop;
   }
@@ -138,16 +153,25 @@ export function parseJsFile(file, code) {
     const exitId  = nextNodeId();
     const fn = {
       qid, name: name || 'anon', line,
+      // Plain strings, per the IR shape contract (ir/CLAUDE.md: "params:
+      // ['arg1', 'arg2', ...]") — every other parser (py, cs, rb, cpp, ...)
+      // already emits this shape. This one used to emit {name,kind[,props]}
+      // objects instead, which every consumer (access-paths.js's
+      // isCoveredBy, summaries.js's paramNames.indexOf, entryStateFromCall,
+      // the k=2 pass's `new Set(fn.params)`) silently failed to match against
+      // — Set/string-equality checks against an object never succeed, so
+      // mutated-parameter taint and context-sensitive entry states were both
+      // unconditionally inert for every JS/TS function. Nothing in src/
+      // reads a param's .kind or .props, so the richer shape bought nothing.
       params: (params || []).map(p => {
         if (!p) return null;
-        if (p.type === 'Identifier') return { name: p.name, kind: 'ident' };
-        if (p.type === 'ObjectPattern') return { name: '<obj>', kind: 'object-pattern',
-          props: p.properties.map(pp => ({
-            key: pp.key?.name || (pp.key?.value != null ? String(pp.key.value) : '*'),
-            alias: lhsPath(pp.value),
-          })) };
-        if (p.type === 'AssignmentPattern' && p.left?.type === 'Identifier') return { name: p.left.name, kind: 'ident' };
-        if (p.type === 'RestElement' && p.argument?.type === 'Identifier') return { name: p.argument.name, kind: 'rest' };
+        if (p.type === 'Identifier') return p.name;
+        if (p.type === 'ObjectPattern') return '<obj>';
+        if (p.type === 'ArrayPattern') return '<arr>';
+        if (p.type === 'AssignmentPattern' && p.left?.type === 'Identifier') return p.left.name;
+        if (p.type === 'AssignmentPattern' && p.left?.type === 'ObjectPattern') return '<obj>';
+        if (p.type === 'AssignmentPattern' && p.left?.type === 'ArrayPattern') return '<arr>';
+        if (p.type === 'RestElement' && p.argument?.type === 'Identifier') return p.argument.name;
         return null;
       }).filter(Boolean),
       cfg: { entry: entryId, exit: exitId, nodes: new Map() },
@@ -189,6 +213,38 @@ export function parseJsFile(file, code) {
     return node.id;
   };
 
+  // Babel visits an IfStatement's consequent then its alternate as ordinary
+  // children of the same enter/exit pair, with no boundary hook between
+  // them — so fn._cursor was never reset before the alternate was
+  // traversed: the alternate's first node was linked as a successor of the
+  // CONSEQUENT's tail (a false predecessor edge corrupting any taint-state
+  // reasoning across the join) rather than a true second branch off the
+  // condition (also silently dropping the condition's "false" outgoing
+  // edge, which made applyPathFeasibility's constant-condition pruning
+  // treat the `if` as unconditional and delete its only edge).
+  //
+  // Called from the generic `Statement` visitor below AND from the top of
+  // every handler whose node type can itself be the direct (unbraced) root
+  // of an if's alternate (ReturnStatement, ThrowStatement, IfStatement for
+  // else-if chains, the loop statements, TryStatement) — Babel merges
+  // alias-derived and type-specific visitors for the same node but runs the
+  // type-specific one FIRST, so relying on the `Statement` alias alone
+  // misses every alternate root that also has its own specific handler.
+  // The one-shot flag makes the (redundant, second) `Statement` firing a
+  // safe no-op once the type-specific handler already did the reset.
+  const maybeResetAtAlternateBoundary = (fn, path) => {
+    const parent = path.parentPath && path.parentPath.node;
+    if (!parent || parent.type !== 'IfStatement' || parent.alternate !== path.node) return;
+    if (path.node._alternateBoundaryHandled) return;
+    path.node._alternateBoundaryHandled = true;
+    // fn._cursor is still the consequent's tail (or the condition node
+    // itself, if the consequent added none) — converge it into the join
+    // before abandoning it, then start the alternate from the condition,
+    // exactly like the consequent did.
+    linkCfg(fn, fn._cursor, parent._asJoin);
+    fn._cursor = parent._asCond;
+  };
+
   const recordWrite = (fn, target, source, nodeId) => {
     if (!target || typeof target !== 'string') return;
     if (!fn.writes.has(target)) fn.writes.set(target, []);
@@ -266,17 +322,45 @@ export function parseJsFile(file, code) {
           const id = lhsPath(path.node.id);
           if (!id) return;
           const initExpr = exprOf(path.node.init);
-          const nodeId = nextNodeId();
           const line = path.node.loc?.start?.line || 0;
-          addNode(fn, { id: nodeId, kind: 'assign', target: id, source: initExpr, line, succ: [], pred: [] });
-          if (typeof id === 'string') recordWrite(fn, id, initExpr, nodeId);
+          if (typeof id === 'string') {
+            const nodeId = nextNodeId();
+            addNode(fn, { id: nodeId, kind: 'assign', target: id, source: initExpr, line, succ: [], pred: [] });
+            recordWrite(fn, id, initExpr, nodeId);
+            return;
+          }
+          // Destructuring: `const {a, b: renamed} = obj;` / `const [a, b] = arr;`.
+          // Emit one REAL 'assign' CFG node per bound name — not just a
+          // recordWrite() bookkeeping entry — because the taint engine's
+          // step() 'assign' case reads `node.target` directly and requires
+          // a plain string (`typeof node.target === 'string'`); the single
+          // node this used to emit had target=the whole {kind:'object-
+          // pattern'|'array-pattern', ...} OBJECT, which step() always
+          // treated as `target=null` — so taint from `obj`/`arr` never
+          // reached ANY destructured binding, for every project that uses
+          // this extremely common pattern. fn.writes/recordWrite (used
+          // below too) is bookkeeping nothing in dataflow/ ever reads;
+          // only real CFG nodes matter to the walk.
           if (id && typeof id === 'object' && id.kind === 'object-pattern') {
-            // x = { foo: a, bar: b } — emit one write per property.
             for (const p of id.props) {
               const alias = typeof p.alias === 'string' ? p.alias : null;
               if (!alias) continue;
-              recordWrite(fn, alias, { kind: 'member', object: initExpr, prop: p.key }, nodeId);
+              const memberSrc = { kind: 'member', object: initExpr, prop: p.key };
+              const nodeId = nextNodeId();
+              addNode(fn, { id: nodeId, kind: 'assign', target: alias, source: memberSrc, line, succ: [], pred: [] });
+              recordWrite(fn, alias, memberSrc, nodeId);
             }
+            return;
+          }
+          if (id && typeof id === 'object' && id.kind === 'array-pattern') {
+            id.elements.forEach((el, i) => {
+              const alias = typeof el === 'string' ? el : null;
+              if (!alias) return; // elision (`const [, b] = arr`) or nested pattern — not modeled
+              const memberSrc = { kind: 'member', object: initExpr, prop: String(i) };
+              const nodeId = nextNodeId();
+              addNode(fn, { id: nodeId, kind: 'assign', target: alias, source: memberSrc, line, succ: [], pred: [] });
+              recordWrite(fn, alias, memberSrc, nodeId);
+            });
           }
         },
 
@@ -298,7 +382,29 @@ export function parseJsFile(file, code) {
           const parent = path.parent;
           if (parent && (parent.type === 'VariableDeclarator' || parent.type === 'AssignmentExpression')) return;
           const calleeExpr = exprOf(path.node.callee);
-          const args = (path.node.arguments || []).map(exprOf);
+          // An inline arrow/function-expression argument (`arr.map(x => ...)`)
+          // becomes {kind:'function-value', qid} instead of exprOf's generic
+          // {kind:'unknown'} fallback (exprOf has no case for either node
+          // type) — dataflow/higher-order.js's calleeIsResolvableCallback and
+          // engine.js's higher-order-invocation push site both special-case
+          // 'function-value', but nothing ever produced one for JS/TS, so
+          // higher-order taint flow only ever worked for a by-reference
+          // callback (`arr.map(processItem)`), never the far more common
+          // inline-callback shape. The qid is computed to match EXACTLY what
+          // this same node's own ArrowFunctionExpression/FunctionExpression
+          // visitor (below) will independently compute when Babel's
+          // traversal reaches it: for a function literal passed directly as
+          // a call argument, none of that visitor's naming heuristics
+          // (VariableDeclarator/AssignmentExpression/ObjectProperty parent)
+          // match, so it always resolves to name 'anon' scoped under the
+          // CURRENT function — exactly what's available here.
+          const args = (path.node.arguments || []).map(a => {
+            if (a && (a.type === 'ArrowFunctionExpression' || a.type === 'FunctionExpression')) {
+              const argLine = a.loc?.start?.line || 1; // matches enterFn's own fallback
+              return { kind: 'function-value', qid: fnQid(file, fn.name, 'anon', argLine) };
+            }
+            return exprOf(a);
+          });
           const line = path.node.loc?.start?.line || 0;
           const nodeId = nextNodeId();
           addNode(fn, { id: nodeId, kind: 'call', callee: calleeExpr, args, line, succ: [], pred: [] });
@@ -313,6 +419,7 @@ export function parseJsFile(file, code) {
 
         ReturnStatement(path) {
           const fn = currentFn(); if (!fn) return;
+          maybeResetAtAlternateBoundary(fn, path);
           const expr = path.node.argument ? exprOf(path.node.argument) : null;
           const nodeId = nextNodeId();
           const line = path.node.loc?.start?.line || 0;
@@ -322,12 +429,30 @@ export function parseJsFile(file, code) {
           linkCfg(fn, nodeId, fn.cfg.exit);
         },
 
+        // Fires for every statement node, via Babel's built-in "Statement"
+        // alias — the fallback path for whichever concrete type an if's
+        // `alternate` turns out to be when that type has no specific
+        // handler of its own (BlockStatement, ExpressionStatement,
+        // VariableDeclaration, ...). Types that DO have a specific handler
+        // below (ReturnStatement, IfStatement, the loop statements,
+        // TryStatement) call `maybeResetAtAlternateBoundary` themselves,
+        // since Babel runs a node's type-specific visitor BEFORE its
+        // alias-derived one for the same node — relying on this alone would
+        // miss those cases entirely.
+        Statement: {
+          enter(path) {
+            const fn = currentFn(); if (!fn) return;
+            maybeResetAtAlternateBoundary(fn, path);
+          },
+        },
+
         IfStatement: {
           enter(path) {
             // We model branches by inserting a noop "join" after the if; both
             // branches link to it. Without this, the linear cursor model would
             // miss that statements after the if are reachable from either branch.
             const fn = currentFn(); if (!fn) return;
+            maybeResetAtAlternateBoundary(fn, path);
             const condNodeId = nextNodeId();
             const joinId = nextNodeId();
             const line = path.node.loc?.start?.line || 0;
@@ -335,7 +460,6 @@ export function parseJsFile(file, code) {
             fn.cfg.nodes.set(joinId, { id: joinId, kind: 'noop', succ: [], pred: [], line });
             path.node._asJoin = joinId;
             path.node._asCond = condNodeId;
-            path.node._asBranchSavedCursor = fn._cursor; // == condNodeId
           },
           exit(path) {
             const fn = currentFn(); if (!fn) return;
@@ -344,9 +468,10 @@ export function parseJsFile(file, code) {
             if (!joinId || !condId) return;
             // The visitor visited the body of the if — Babel's body visit ran
             // *after* the enter(), so fn._cursor now points to the tail of the
-            // consequent. Connect it to the join, then if no else branch
-            // existed, connect the cond directly to the join (representing
-            // the "false" edge).
+            // consequent (or, thanks to maybeResetAtAlternateBoundary, of the
+            // alternate when one exists). Connect it to the join, then if no
+            // else branch existed, connect the cond directly to the join
+            // (representing the "false" edge).
             linkCfg(fn, fn._cursor, joinId);
             if (!path.node.alternate) linkCfg(fn, condId, joinId);
             fn._cursor = joinId;
@@ -359,6 +484,7 @@ export function parseJsFile(file, code) {
         'WhileStatement|ForStatement|DoWhileStatement|ForInStatement|ForOfStatement': {
           enter(path) {
             const fn = currentFn(); if (!fn) return;
+            maybeResetAtAlternateBoundary(fn, path);
             const headerId = nextNodeId();
             const exitId = nextNodeId();
             const line = path.node.loc?.start?.line || 0;
@@ -379,11 +505,16 @@ export function parseJsFile(file, code) {
         },
 
         TryStatement: {
-          enter() { /* approximate try/catch as sequential — taint flows through both */ },
+          enter(path) {
+            const fn = currentFn(); if (!fn) return;
+            maybeResetAtAlternateBoundary(fn, path);
+            /* approximate try/catch as sequential — taint flows through both */
+          },
         },
 
         ThrowStatement(path) {
           const fn = currentFn(); if (!fn) return;
+          maybeResetAtAlternateBoundary(fn, path);
           const expr = exprOf(path.node.argument);
           const nodeId = nextNodeId();
           const line = path.node.loc?.start?.line || 0;

package/src/ir/parser-php.js

@@ -19,6 +19,7 @@
 
 import * as crypto from 'node:crypto';
 import { callSitesFromCfg } from './call-sites.js';
+import { matchBalancedCall } from './balanced-call.js';
 
 const FUNC_RE = new RegExp(
   '(?:^|[\\n;{}]|<\\?php|<\\?)\\s*' +
@@ -66,6 +67,35 @@ function _splitStatements(body) {
 function _lowerExpr(text) {
   const s = String(text || '').trim();
   if (!s) return { kind: 'unknown' };
+  // Stage 3 correctness audit (detection depth, per-language-IR): PHP
+  // double-quoted strings interpolate variables directly
+  // ("SELECT ... WHERE id=$id", "hi {$user->name}") — single-quoted
+  // strings never do. This must run BEFORE the generic string-literal
+  // fallback just below, which otherwise treated ANY quoted string
+  // (including a double-quoted one containing a live variable) as an
+  // opaque clean literal — silently dropping the interpolated variable's
+  // taint. This is exactly `"SELECT ... WHERE id=$id"`, one of the most
+  // common real PHP SQL-injection shapes. Simple (`$var`, `$var->prop`,
+  // `$var[key]`) and complex (`{$expr}`) interpolation forms are both
+  // lowered into a template, same shape as the `.`-concat branch below.
+  if (/^"/.test(s) && s.includes('$')) {
+    const inner = s.slice(1, -1);
+    const re = /\{(\$[^}]+)\}|(\$[A-Za-z_]\w*(?:->[A-Za-z_]\w*|\[[^\]]+\])?)/g;
+    let lastIndex = 0;
+    const parts = [];
+    let matched = false;
+    let m;
+    while ((m = re.exec(inner)) !== null) {
+      matched = true;
+      if (m.index > lastIndex) parts.push({ kind: 'literal', value: inner.slice(lastIndex, m.index) });
+      parts.push(_lowerExpr(m[1] !== undefined ? m[1] : m[2]));
+      lastIndex = re.lastIndex;
+    }
+    if (matched) {
+      if (lastIndex < inner.length) parts.push({ kind: 'literal', value: inner.slice(lastIndex) });
+      return { kind: 'tpl', parts };
+    }
+  }
   if (/^"/.test(s) || /^'/.test(s)) return { kind: 'literal', value: s };
   if (/^\d/.test(s)) return { kind: 'literal', value: s };
   if (/^(true|false|null|NULL)\b/.test(s)) return { kind: 'literal', value: s };
@@ -81,17 +111,22 @@ function _lowerExpr(text) {
   }
   // Variable
   if (/^\$[A-Za-z_]\w*$/.test(s)) return { kind: 'ident', name: s };
-  // Method call: $obj->method(args) or ClassName::method(args)
-  const methodCall = s.match(/^(\$[\w]+(?:->[\w]+)*|[A-Za-z_][\w]*(?:::[\w]+)*)\s*\((.*)\)\s*$/s);
+  // Method call: $obj->method(args) or ClassName::method(args).
+  // matchBalancedCall finds the paren that actually balances the FIRST
+  // '(' — not the greedy-to-end-of-string match the old `/\((.*)\)\s*$/`
+  // used, which corrupted the argument text for a chained call
+  // (`sanitize($x)->trim()` produced args="$x)->trim(", which then fell
+  // through to {kind:'unknown'} and silently dropped $x).
+  const methodCall = matchBalancedCall(s, /^(\$[\w]+(?:->[\w]+)*|[A-Za-z_][\w]*(?:::[\w]+)*)/);
   if (methodCall) {
-    const callee = methodCall[1].replace(/->/g, '.').replace(/::/g, '.');
-    const args = _splitTopLevelCommas(methodCall[2]).map(_lowerExpr);
+    const callee = methodCall.callee.replace(/->/g, '.').replace(/::/g, '.');
+    const args = _splitTopLevelCommas(methodCall.argsText).map(_lowerExpr);
     return { kind: 'call', callee, args };
   }
   // Function call: func(args)
-  const funcCall = s.match(/^([A-Za-z_][\w]*)\s*\((.*)\)\s*$/s);
+  const funcCall = matchBalancedCall(s, /^([A-Za-z_][\w]*)/);
   if (funcCall) {
-    return { kind: 'call', callee: funcCall[1], args: _splitTopLevelCommas(funcCall[2]).map(_lowerExpr) };
+    return { kind: 'call', callee: funcCall.callee, args: _splitTopLevelCommas(funcCall.argsText).map(_lowerExpr) };
   }
   // Concat with .
   if (s.includes('.') && /["'\$]/.test(s)) {
@@ -170,10 +205,10 @@ function _lowerStmt(stmt, line) {
     return { kind: 'assign', line, target: assign[1], source: _lowerExpr(assign[2]) };
   }
   // Statement-form call
-  const call = s.match(/^(\$[\w]+(?:->[\w]+)*|[A-Za-z_][\w]*(?:::[\w]+)*)\s*\((.*)\)\s*$/s);
+  const call = matchBalancedCall(s, /^(\$[\w]+(?:->[\w]+)*|[A-Za-z_][\w]*(?:::[\w]+)*)/);
   if (call) {
-    const callee = call[1].replace(/->/g, '.').replace(/::/g, '.');
-    return { kind: 'call', line, callee, args: _splitTopLevelCommas(call[2]).map(_lowerExpr) };
+    const callee = call.callee.replace(/->/g, '.').replace(/::/g, '.');
+    return { kind: 'call', line, callee, args: _splitTopLevelCommas(call.argsText).map(_lowerExpr) };
   }
   return null;
 }