@clear-capabilities/agentic-security-scanner 0.136.2 → 0.137.0

package/src/ir/parser-js.js

@@ -63,11 +63,23 @@ function exprOf(n) {
       prop: n.computed ? (n.property?.value != null ? String(n.property.value) : '*') : (n.property?.name || '*'),
     };
     case 'CallExpression':
-    case 'OptionalCallExpression':
+    case 'OptionalCallExpression': return {
+      kind: 'call',
+      callee: exprOf(n.callee),
+      args: (n.arguments || []).map(exprOf),
+    };
+    // `new Foo()` is emitted as a call PLUS an `isNew: true` marker, matching
+    // what parser-java.js and parser-cs.js already emit. Without the marker a
+    // `new Foo()` is byte-identical in the IR to a plain `Foo()` call, and
+    // class-hierarchy.js's typeOfVar walker therefore typed `const x =
+    // SomeFactoryFn()` as class `SomeFactoryFn` — a fabricated type that then
+    // reaches the dataflow receiver-type gate and can suppress a real finding.
+    // Nothing else in the engine reads `isNew`, so this is purely additive.
     case 'NewExpression':     return {
       kind: 'call',
       callee: exprOf(n.callee),
       args: (n.arguments || []).map(exprOf),
+      isNew: true,
     };
     case 'BinaryExpression':  return { kind: 'binary', op: n.operator, left: exprOf(n.left), right: exprOf(n.right) };
     case 'LogicalExpression': return { kind: 'logical', op: n.operator, left: exprOf(n.left), right: exprOf(n.right) };
@@ -98,7 +110,22 @@ function lhsPath(n) {
   if (n.type === 'ThisExpression') return '_this_';
   if (n.type === 'MemberExpression') {
     const base = lhsPath(n.object);
-    const prop = n.computed ? '*' : (n.property?.name || '*');
+    // Stage 3 correctness audit (detection depth, path-feasibility): a
+    // computed WRITE with a literal key (`obj['secret'] = tainted`) used
+    // to collapse straight to the wildcard '*' — never trying to extract
+    // the literal, unlike exprOf's MemberExpression case just above,
+    // which DOES extract it for reads. That asymmetry meant a tainted
+    // write via bracket notation with a literal key produced access path
+    // "obj.*", while any later read of that same key (`obj.secret` or
+    // `obj['secret']`) resolves via exprOf to the specific path
+    // "obj.secret" — isCoveredBy has no wildcard semantics (`'*'` is a
+    // literal property name here, not a match-anything token), so the two
+    // paths never matched and the taint was silently unreachable from any
+    // correctly-computed read. Mirrors exprOf's extraction exactly so a
+    // write and a read of the same literal key always agree.
+    const prop = n.computed
+      ? (n.property?.value != null ? String(n.property.value) : '*')
+      : (n.property?.name || '*');
     if (!base) return null;
     return base + '.' + prop;
   }
@@ -136,18 +163,54 @@ export function parseJsFile(file, code) {
     const qid = fnQid(file, scopeName, name, line);
     const entryId = nextNodeId();
     const exitId  = nextNodeId();
+    const paramAnnotations = [];
     const fn = {
       qid, name: name || 'anon', line,
-      params: (params || []).map(p => {
+      // Plain strings, per the IR shape contract (ir/CLAUDE.md: "params:
+      // ['arg1', 'arg2', ...]") — every other parser (py, cs, rb, cpp, ...)
+      // already emits this shape. This one used to emit {name,kind[,props]}
+      // objects instead, which every consumer (access-paths.js's
+      // isCoveredBy, summaries.js's paramNames.indexOf, entryStateFromCall,
+      // the k=2 pass's `new Set(fn.params)`) silently failed to match against
+      // — Set/string-equality checks against an object never succeed, so
+      // mutated-parameter taint and context-sensitive entry states were both
+      // unconditionally inert for every JS/TS function. Nothing in src/
+      // reads a param's .kind or .props, so the richer shape bought nothing.
+      params: (params || []).map((p, idx) => {
         if (!p) return null;
-        if (p.type === 'Identifier') return { name: p.name, kind: 'ident' };
-        if (p.type === 'ObjectPattern') return { name: '<obj>', kind: 'object-pattern',
-          props: p.properties.map(pp => ({
-            key: pp.key?.name || (pp.key?.value != null ? String(pp.key.value) : '*'),
-            alias: lhsPath(pp.value),
-          })) };
-        if (p.type === 'AssignmentPattern' && p.left?.type === 'Identifier') return { name: p.left.name, kind: 'ident' };
-        if (p.type === 'RestElement' && p.argument?.type === 'Identifier') return { name: p.argument.name, kind: 'rest' };
+        // NestJS/Angular-style parameter decorators (@Query(), @Body(), etc.)
+        // — Babel attaches these to the raw param node as `p.decorators`
+        // (or `p.left.decorators` for a defaulted param, e.g. `@Query() page
+        // = 1` — a very common NestJS idiom). This is a real array; every
+        // entry must be captured, not just the first, since stacked
+        // decorators (@Query() @SomeOtherDecorator() x) are legal and
+        // dropping later ones silently loses the source-relevant one.
+        //
+        // For a defaulted param, `p.type` is 'AssignmentPattern', never
+        // 'Identifier' — the identifier that actually carries the decorator
+        // and the name lives at `p.left`. The guard below must check THAT
+        // resolved node's type, not `p.type` unconditionally, or every
+        // defaulted-identifier decorated parameter silently loses its
+        // decorator (fix round 1, R14(a) Task 4).
+        const resolvedIdent = p.type === 'AssignmentPattern' ? p.left : p;
+        const decoratorNodes = p.decorators || (p.left && p.left.decorators) || [];
+        for (const d of decoratorNodes) {
+          const expr = d.expression;
+          const decoratorName = expr?.type === 'CallExpression' ? expr.callee?.name : expr?.name;
+          // Only record when the parameter itself resolves to a plain
+          // identifier — decorators on destructured params are rare and
+          // out of scope for this plan.
+          if (decoratorName && resolvedIdent?.type === 'Identifier') {
+            paramAnnotations.push({ index: idx, name: resolvedIdent.name, decorator: decoratorName });
+          }
+        }
+        if (p.type === 'Identifier') return p.name;
+        if (p.type === 'ObjectPattern') return '<obj>';
+        if (p.type === 'ArrayPattern') return '<arr>';
+        if (p.type === 'AssignmentPattern' && p.left?.type === 'Identifier') return p.left.name;
+        if (p.type === 'AssignmentPattern' && p.left?.type === 'ObjectPattern') return '<obj>';
+        if (p.type === 'AssignmentPattern' && p.left?.type === 'ArrayPattern') return '<arr>';
+        if (p.type === 'RestElement' && p.argument?.type === 'Identifier') return p.argument.name;
         return null;
       }).filter(Boolean),
       cfg: { entry: entryId, exit: exitId, nodes: new Map() },
@@ -157,6 +220,7 @@ export function parseJsFile(file, code) {
       writes: new Map(),
       file,
       _cursor: entryId, // current node ID — next addNode() links from here
+      ...(paramAnnotations.length ? { paramAnnotations } : {}),
     };
     fn.cfg.nodes.set(entryId, { id: entryId, kind: 'entry', succ: [], pred: [], line });
     fn.cfg.nodes.set(exitId,  { id: exitId,  kind: 'exit',  succ: [], pred: [], line });
@@ -189,6 +253,38 @@ export function parseJsFile(file, code) {
     return node.id;
   };
 
+  // Babel visits an IfStatement's consequent then its alternate as ordinary
+  // children of the same enter/exit pair, with no boundary hook between
+  // them — so fn._cursor was never reset before the alternate was
+  // traversed: the alternate's first node was linked as a successor of the
+  // CONSEQUENT's tail (a false predecessor edge corrupting any taint-state
+  // reasoning across the join) rather than a true second branch off the
+  // condition (also silently dropping the condition's "false" outgoing
+  // edge, which made applyPathFeasibility's constant-condition pruning
+  // treat the `if` as unconditional and delete its only edge).
+  //
+  // Called from the generic `Statement` visitor below AND from the top of
+  // every handler whose node type can itself be the direct (unbraced) root
+  // of an if's alternate (ReturnStatement, ThrowStatement, IfStatement for
+  // else-if chains, the loop statements, TryStatement) — Babel merges
+  // alias-derived and type-specific visitors for the same node but runs the
+  // type-specific one FIRST, so relying on the `Statement` alias alone
+  // misses every alternate root that also has its own specific handler.
+  // The one-shot flag makes the (redundant, second) `Statement` firing a
+  // safe no-op once the type-specific handler already did the reset.
+  const maybeResetAtAlternateBoundary = (fn, path) => {
+    const parent = path.parentPath && path.parentPath.node;
+    if (!parent || parent.type !== 'IfStatement' || parent.alternate !== path.node) return;
+    if (path.node._alternateBoundaryHandled) return;
+    path.node._alternateBoundaryHandled = true;
+    // fn._cursor is still the consequent's tail (or the condition node
+    // itself, if the consequent added none) — converge it into the join
+    // before abandoning it, then start the alternate from the condition,
+    // exactly like the consequent did.
+    linkCfg(fn, fn._cursor, parent._asJoin);
+    fn._cursor = parent._asCond;
+  };
+
   const recordWrite = (fn, target, source, nodeId) => {
     if (!target || typeof target !== 'string') return;
     if (!fn.writes.has(target)) fn.writes.set(target, []);
@@ -263,20 +359,77 @@ export function parseJsFile(file, code) {
 
         VariableDeclarator(path) {
           const fn = currentFn(); if (!fn) return;
+          // PRD R13(b): `for (const item of tainted)` is, structurally, also
+          // an ordinary VariableDeclarator (`item`, no `init`) — Babel visits
+          // it as a normal child of the ForOfStatement's `left` on the way
+          // into the loop body. Left to the general case below, this generic
+          // visit fires AFTER the loop visitor's enter() hook synthesizes
+          // `item = <iterated expr>`, re-assigning `item` from an absent
+          // `init` (source: unknown) and silently erasing the taint just
+          // synthesized. Skip it here ONLY for the simple-identifier shape
+          // the loop visitor actually owns and synthesizes for — a bare
+          // `for (const item of ...)` binding.
+          //
+          // A destructuring for-of binding (`for (const {a,b} of ...)` /
+          // `for (const [a,b] of ...)`) is explicitly NOT covered by the
+          // loop visitor's synthesis (see the ForOfStatement branch below —
+          // `loopVar` stays null and nothing is emitted for it), so it MUST
+          // fall through to the general destructuring handling further down
+          // in this same visitor. That handling was already here before this
+          // task and does something this guard must not break: it emits real
+          // taint-KILL assign nodes for each destructured name, which is what
+          // makes `let cmd = tainted; for (const {cmd} of SAFE) sink(cmd)`
+          // correctly clear cmd's stale outer taint. An earlier version of
+          // this guard matched on the ForOfStatement `left` alone (no
+          // Identifier check) and silently deleted those taint-kill nodes,
+          // producing a false positive on exactly that shadowing shape — see
+          // the regression test below.
+          const gpDecl = path.parentPath && path.parentPath.node;
+          const gpLoop = path.parentPath && path.parentPath.parentPath && path.parentPath.parentPath.node;
+          if (gpLoop && gpLoop.type === 'ForOfStatement' && gpLoop.left === gpDecl
+              && path.node.id?.type === 'Identifier') return;
           const id = lhsPath(path.node.id);
           if (!id) return;
           const initExpr = exprOf(path.node.init);
-          const nodeId = nextNodeId();
           const line = path.node.loc?.start?.line || 0;
-          addNode(fn, { id: nodeId, kind: 'assign', target: id, source: initExpr, line, succ: [], pred: [] });
-          if (typeof id === 'string') recordWrite(fn, id, initExpr, nodeId);
+          if (typeof id === 'string') {
+            const nodeId = nextNodeId();
+            addNode(fn, { id: nodeId, kind: 'assign', target: id, source: initExpr, line, succ: [], pred: [] });
+            recordWrite(fn, id, initExpr, nodeId);
+            return;
+          }
+          // Destructuring: `const {a, b: renamed} = obj;` / `const [a, b] = arr;`.
+          // Emit one REAL 'assign' CFG node per bound name — not just a
+          // recordWrite() bookkeeping entry — because the taint engine's
+          // step() 'assign' case reads `node.target` directly and requires
+          // a plain string (`typeof node.target === 'string'`); the single
+          // node this used to emit had target=the whole {kind:'object-
+          // pattern'|'array-pattern', ...} OBJECT, which step() always
+          // treated as `target=null` — so taint from `obj`/`arr` never
+          // reached ANY destructured binding, for every project that uses
+          // this extremely common pattern. fn.writes/recordWrite (used
+          // below too) is bookkeeping nothing in dataflow/ ever reads;
+          // only real CFG nodes matter to the walk.
           if (id && typeof id === 'object' && id.kind === 'object-pattern') {
-            // x = { foo: a, bar: b } — emit one write per property.
             for (const p of id.props) {
               const alias = typeof p.alias === 'string' ? p.alias : null;
               if (!alias) continue;
-              recordWrite(fn, alias, { kind: 'member', object: initExpr, prop: p.key }, nodeId);
+              const memberSrc = { kind: 'member', object: initExpr, prop: p.key };
+              const nodeId = nextNodeId();
+              addNode(fn, { id: nodeId, kind: 'assign', target: alias, source: memberSrc, line, succ: [], pred: [] });
+              recordWrite(fn, alias, memberSrc, nodeId);
             }
+            return;
+          }
+          if (id && typeof id === 'object' && id.kind === 'array-pattern') {
+            id.elements.forEach((el, i) => {
+              const alias = typeof el === 'string' ? el : null;
+              if (!alias) return; // elision (`const [, b] = arr`) or nested pattern — not modeled
+              const memberSrc = { kind: 'member', object: initExpr, prop: String(i) };
+              const nodeId = nextNodeId();
+              addNode(fn, { id: nodeId, kind: 'assign', target: alias, source: memberSrc, line, succ: [], pred: [] });
+              recordWrite(fn, alias, memberSrc, nodeId);
+            });
           }
         },
 
@@ -298,7 +451,29 @@ export function parseJsFile(file, code) {
           const parent = path.parent;
           if (parent && (parent.type === 'VariableDeclarator' || parent.type === 'AssignmentExpression')) return;
           const calleeExpr = exprOf(path.node.callee);
-          const args = (path.node.arguments || []).map(exprOf);
+          // An inline arrow/function-expression argument (`arr.map(x => ...)`)
+          // becomes {kind:'function-value', qid} instead of exprOf's generic
+          // {kind:'unknown'} fallback (exprOf has no case for either node
+          // type) — dataflow/higher-order.js's calleeIsResolvableCallback and
+          // engine.js's higher-order-invocation push site both special-case
+          // 'function-value', but nothing ever produced one for JS/TS, so
+          // higher-order taint flow only ever worked for a by-reference
+          // callback (`arr.map(processItem)`), never the far more common
+          // inline-callback shape. The qid is computed to match EXACTLY what
+          // this same node's own ArrowFunctionExpression/FunctionExpression
+          // visitor (below) will independently compute when Babel's
+          // traversal reaches it: for a function literal passed directly as
+          // a call argument, none of that visitor's naming heuristics
+          // (VariableDeclarator/AssignmentExpression/ObjectProperty parent)
+          // match, so it always resolves to name 'anon' scoped under the
+          // CURRENT function — exactly what's available here.
+          const args = (path.node.arguments || []).map(a => {
+            if (a && (a.type === 'ArrowFunctionExpression' || a.type === 'FunctionExpression')) {
+              const argLine = a.loc?.start?.line || 1; // matches enterFn's own fallback
+              return { kind: 'function-value', qid: fnQid(file, fn.name, 'anon', argLine) };
+            }
+            return exprOf(a);
+          });
           const line = path.node.loc?.start?.line || 0;
           const nodeId = nextNodeId();
           addNode(fn, { id: nodeId, kind: 'call', callee: calleeExpr, args, line, succ: [], pred: [] });
@@ -313,6 +488,7 @@ export function parseJsFile(file, code) {
 
         ReturnStatement(path) {
           const fn = currentFn(); if (!fn) return;
+          maybeResetAtAlternateBoundary(fn, path);
           const expr = path.node.argument ? exprOf(path.node.argument) : null;
           const nodeId = nextNodeId();
           const line = path.node.loc?.start?.line || 0;
@@ -322,12 +498,30 @@ export function parseJsFile(file, code) {
           linkCfg(fn, nodeId, fn.cfg.exit);
         },
 
+        // Fires for every statement node, via Babel's built-in "Statement"
+        // alias — the fallback path for whichever concrete type an if's
+        // `alternate` turns out to be when that type has no specific
+        // handler of its own (BlockStatement, ExpressionStatement,
+        // VariableDeclaration, ...). Types that DO have a specific handler
+        // below (ReturnStatement, IfStatement, the loop statements,
+        // TryStatement) call `maybeResetAtAlternateBoundary` themselves,
+        // since Babel runs a node's type-specific visitor BEFORE its
+        // alias-derived one for the same node — relying on this alone would
+        // miss those cases entirely.
+        Statement: {
+          enter(path) {
+            const fn = currentFn(); if (!fn) return;
+            maybeResetAtAlternateBoundary(fn, path);
+          },
+        },
+
         IfStatement: {
           enter(path) {
             // We model branches by inserting a noop "join" after the if; both
             // branches link to it. Without this, the linear cursor model would
             // miss that statements after the if are reachable from either branch.
             const fn = currentFn(); if (!fn) return;
+            maybeResetAtAlternateBoundary(fn, path);
             const condNodeId = nextNodeId();
             const joinId = nextNodeId();
             const line = path.node.loc?.start?.line || 0;
@@ -335,7 +529,6 @@ export function parseJsFile(file, code) {
             fn.cfg.nodes.set(joinId, { id: joinId, kind: 'noop', succ: [], pred: [], line });
             path.node._asJoin = joinId;
             path.node._asCond = condNodeId;
-            path.node._asBranchSavedCursor = fn._cursor; // == condNodeId
           },
           exit(path) {
             const fn = currentFn(); if (!fn) return;
@@ -344,9 +537,10 @@ export function parseJsFile(file, code) {
             if (!joinId || !condId) return;
             // The visitor visited the body of the if — Babel's body visit ran
             // *after* the enter(), so fn._cursor now points to the tail of the
-            // consequent. Connect it to the join, then if no else branch
-            // existed, connect the cond directly to the join (representing
-            // the "false" edge).
+            // consequent (or, thanks to maybeResetAtAlternateBoundary, of the
+            // alternate when one exists). Connect it to the join, then if no
+            // else branch existed, connect the cond directly to the join
+            // (representing the "false" edge).
             linkCfg(fn, fn._cursor, joinId);
             if (!path.node.alternate) linkCfg(fn, condId, joinId);
             fn._cursor = joinId;
@@ -359,6 +553,7 @@ export function parseJsFile(file, code) {
         'WhileStatement|ForStatement|DoWhileStatement|ForInStatement|ForOfStatement': {
           enter(path) {
             const fn = currentFn(); if (!fn) return;
+            maybeResetAtAlternateBoundary(fn, path);
             const headerId = nextNodeId();
             const exitId = nextNodeId();
             const line = path.node.loc?.start?.line || 0;
@@ -366,6 +561,64 @@ export function parseJsFile(file, code) {
             fn.cfg.nodes.set(exitId, { id: exitId, kind: 'noop', succ: [], pred: [], line });
             path.node._loopHeader = headerId;
             path.node._loopExit = exitId;
+            // PRD R13(b): for-of's binding variable is never connected to the
+            // iterated expression, so `for (const x of tainted) sink(x)` reads
+            // x as {kind:'unknown'} — clean. Synthesize an assign binding the
+            // loop variable to the iterated expression, exactly as the
+            // Python-CST/Go/PHP parsers already do for their own for-each
+            // constructs (parser-py.helper.py, parser-go.js, parser-php.js).
+            // Conservative, matching this file's own stated doctrine for
+            // loops in general ("any iteration could taint X"): the WHOLE
+            // loop variable is tainted if the iterable is tainted, not a
+            // specific element — element-level precision isn't modeled here
+            // any more than it is for the rest of this file's loop handling.
+            // Scoped to ForOfStatement only — While/For/DoWhile/ForIn have no
+            // "loop variable bound to an iterated collection" shape and must
+            // see zero behavior change from this addition.
+            if (path.node.type === 'ForOfStatement') {
+              const leftNode = path.node.left;
+              const declId = leftNode && leftNode.type === 'VariableDeclaration'
+                ? leftNode.declarations[0]?.id
+                : leftNode;
+              // Only the simple `for (const x of ...)` / `for (x of ...)`
+              // shape is synthesized. A destructuring binding
+              // (`for (const {a,b} of ...)`) has no single flat target name
+              // lhsPath-style logic could bind to — left unsynthesized rather
+              // than guessed at, matching this codebase's "refuse rather than
+              // invent an edge" doctrine elsewhere (see _resolvableCalleeName
+              // in dataflow/engine.js for the same principle applied to call
+              // resolution).
+              const loopVar = declId && declId.type === 'Identifier' ? declId.name : null;
+              if (loopVar) {
+                const iterExpr = exprOf(path.node.right);
+                const bindId = nextNodeId();
+                addNode(fn, { id: bindId, kind: 'assign', target: loopVar, source: iterExpr, line, succ: [], pred: [] });
+                // `for (const x of ...)` / `for (let x of ...)` declares a
+                // BLOCK-SCOPED binding: a same-named `x` outside the loop is a
+                // different variable and must be completely unaffected by
+                // whatever the loop's `x` held. This engine's taint model has
+                // no block scoping, so the synthesized binding above would
+                // otherwise flow past the loop's exit and over-taint an outer
+                // `x` (proven: `let item='safe'; for (const item of req.body
+                // .items){} eval(item)` reported a Code Injection finding that
+                // pre-R13(b) code correctly reported as clean — the generic
+                // VariableDeclarator visitor used to emit `assign x <-
+                // {kind:'unknown'}` here, a taint KILL, and the guard above now
+                // suppresses it for exactly this shape). Record the name so
+                // exit() can re-emit that kill AFTER the loop, restoring the
+                // pre-existing behavior for post-loop reads while keeping the
+                // new in-loop taint flow.
+                //
+                // Deliberately NOT done for the bare-assignment form
+                // (`for (x of ...)`, leftNode is not a VariableDeclaration):
+                // that binding is not block-scoped, it reuses an existing
+                // outer `x`, and its value legitimately survives the loop —
+                // killing it there would itself be a regression.
+                if (leftNode && leftNode.type === 'VariableDeclaration') {
+                  path.node._loopBindVar = loopVar;
+                }
+              }
+            }
           },
           exit(path) {
             const fn = currentFn(); if (!fn) return;
@@ -375,15 +628,40 @@ export function parseJsFile(file, code) {
             linkCfg(fn, fn._cursor, headerId); // back-edge
             linkCfg(fn, headerId, exitId);     // exit edge
             fn._cursor = exitId;
+            // See the _loopBindVar comment in enter(): restore the taint KILL
+            // that the ForOfStatement VariableDeclarator guard suppresses, so
+            // a block-scoped for-of binding's synthesized taint cannot leak
+            // past the loop onto a same-named outer variable. Emitted AFTER
+            // `fn._cursor = exitId` so it sits on the loop's normal exit path
+            // (header -> exit-noop -> kill -> whatever follows the loop) and
+            // therefore runs once on the way out — never inside the body, so
+            // in-loop taint reachability is unchanged.
+            if (path.node._loopBindVar) {
+              const killId = nextNodeId();
+              addNode(fn, {
+                id: killId,
+                kind: 'assign',
+                target: path.node._loopBindVar,
+                source: { kind: 'unknown' },
+                line: path.node.loc?.start?.line || 0,
+                succ: [],
+                pred: [],
+              });
+            }
           },
         },
 
         TryStatement: {
-          enter() { /* approximate try/catch as sequential — taint flows through both */ },
+          enter(path) {
+            const fn = currentFn(); if (!fn) return;
+            maybeResetAtAlternateBoundary(fn, path);
+            /* approximate try/catch as sequential — taint flows through both */
+          },
         },
 
         ThrowStatement(path) {
           const fn = currentFn(); if (!fn) return;
+          maybeResetAtAlternateBoundary(fn, path);
           const expr = exprOf(path.node.argument);
           const nodeId = nextNodeId();
           const line = path.node.loc?.start?.line || 0;