@clear-capabilities/agentic-security-scanner 0.136.9 → 0.137.1

package/src/ir/parser-java.js

@@ -22,6 +22,7 @@
 // when the shape is unfamiliar.
 
 import { blankComments } from '../sast/_comment-strip.js';
+import { callSitesFromCfg } from './call-sites.js';
 
 let _nodeIdSeq = 0;
 function nextNodeId() { return 'jn' + (++_nodeIdSeq); }
@@ -288,6 +289,160 @@ function buildCfgFromBody(bodyNode) {
       emit({ kind: 'loop-header', cond: cond ? exprFromCst(cond) : null, line: _lineOf(w), succ: [] });
       for (const sub of (w.children?.statement || [])) walkStmts(sub);
     }
+    if (kids.forStatement) {
+      const f = kids.forStatement[0];
+      // Both basicForStatement (`for(init;test;step)`) and
+      // enhancedForStatement (`for(T x : xs)`) wrap a `statement` child for
+      // the loop body — same shape whileStatement already walks. Confirmed
+      // via direct java-parser CST inspection (java-parser@3.0.1): each
+      // forStatement's `children` has exactly one of these two keys, never
+      // both, and each carries `statement` directly.
+      const basic = f.children?.basicForStatement?.[0];
+      const enhanced = f.children?.enhancedForStatement?.[0];
+      const inner = basic || enhanced;
+      const cond = basic?.children?.expression?.[0];
+      emit({ kind: 'loop-header', cond: cond ? exprFromCst(cond) : null, line: _lineOf(f), succ: [] });
+      // R8 Task 1 fix round 1: `for (T x : xs)` never bound `x` to `xs` —
+      // the loop body was reachable (the fix above) but the loop variable
+      // itself carried no taint provenance, so a genuinely tainted
+      // collection reaching a sink through the loop variable still
+      // couldn't fire. Confirmed via direct CST inspection:
+      // enhancedForStatement.children = {..., localVariableDeclaration,
+      // Colon, expression, ..., statement} — `localVariableDeclaration` is
+      // the loop var's declaration (same variableDeclaratorList shape used
+      // elsewhere in this file) and `expression` is the iterated
+      // collection. Mirrors the established pattern in parser-js.js's
+      // ForOfStatement handling (PRD R13(b)): synthesize
+      // `{kind:'assign', target: loopVar, source: iterExpr}` BEFORE
+      // recursing into the body, so any body statement reading the loop
+      // variable sees its taint provenance already established. Java's
+      // for-each always declares a fresh block-scoped variable (there is
+      // no bare-assignment form the way JS's `for (x of xs)` has), so —
+      // unlike parser-js.js — there is no pre-existing outer variable of
+      // the same name to protect with a post-loop kill; the Java CFG
+      // builder does not model block scoping elsewhere either, so adding
+      // one only for this binding would be new, inconsistent behavior
+      // rather than a fix for this gap.
+      if (enhanced) {
+        const lvd = enhanced.children?.localVariableDeclaration?.[0];
+        const declarator = lvd?.children?.variableDeclaratorList?.[0]?.children?.variableDeclarator?.[0];
+        const loopVar = declarator?.children?.variableDeclaratorId?.[0]?.children?.Identifier?.[0]?.image;
+        const iterExpr = enhanced.children?.expression?.[0];
+        if (loopVar) {
+          emit({ kind: 'assign', target: loopVar, source: iterExpr ? exprFromCst(iterExpr) : { kind: 'unknown' }, line: _lineOf(enhanced), succ: [] });
+        }
+      }
+      for (const sub of (inner?.children?.statement || [])) walkStmts(sub);
+    }
+    if (kids.doStatement) {
+      const d = kids.doStatement[0];
+      const cond = d.children?.expression?.[0];
+      emit({ kind: 'loop-header', cond: cond ? exprFromCst(cond) : null, line: _lineOf(d), succ: [] });
+      for (const sub of (d.children?.statement || [])) walkStmts(sub);
+    }
+    if (kids.tryStatement) {
+      const t = kids.tryStatement[0];
+      emit({ kind: 'noop', line: _lineOf(t), succ: [] });
+      // Plain `try { ... }` has direct `block`/`catches`/`finally` children.
+      // Try-with-resources (`try (Resource r = ...) { ... }` — the idiomatic
+      // JDBC shape) wraps in a distinct `tryWithResourcesStatement`
+      // intermediate node, and — confirmed via direct CST inspection, this
+      // is the one place the plan's illustrative code was wrong — that
+      // intermediate node carries its OWN `block`/`catches`/`finally`
+      // children; a plain tryStatement's outer `children` is just
+      // `{ tryWithResourcesStatement: [...] }` with nothing else, so
+      // reading `catches`/`finally` off the outer `t` (as the plan's draft
+      // did) silently drops the catch/finally bodies of every
+      // try-with-resources block. `container` below picks the node that
+      // actually owns them.
+      const twr = t.children?.tryWithResourcesStatement?.[0];
+      const container = twr || t;
+      if (twr) {
+        const resSpec = twr.children?.resourceSpecification?.[0];
+        // resourceSpecification -> resourceList -> resource[] -> each a
+        // localVariableDeclaration-shaped resource; reuse the existing
+        // localVariableDeclarationStatement lowering shape directly rather
+        // than duplicating it, by walking each resource as if it were one.
+        const resources = resSpec?.children?.resourceList?.[0]?.children?.resource || [];
+        for (const r of resources) {
+          const vdecl = r.children?.localVariableDeclaration?.[0] || r;
+          const declarators = vdecl?.children?.variableDeclaratorList?.[0]?.children?.variableDeclarator || [];
+          for (const d of declarators) {
+            const target = d.children?.variableDeclaratorId?.[0]?.children?.Identifier?.[0]?.image;
+            const initExpr = d.children?.variableInitializer?.[0]?.children?.expression?.[0] || d.children?.expression?.[0];
+            if (target) emit({ kind: 'assign', target, source: initExpr ? exprFromCst(initExpr) : { kind: 'unknown' }, line: _lineOf(r), succ: [] });
+          }
+        }
+      }
+      const bodyBlock = container.children?.block?.[0];
+      if (bodyBlock) walkStmts(bodyBlock);
+      const catches = container.children?.catches?.[0]?.children?.catchClause || [];
+      for (const cc of catches) {
+        const cblock = cc.children?.block?.[0];
+        if (cblock) walkStmts(cblock);
+      }
+      // Confirmed via direct CST inspection: the key is `finally`, no
+      // trailing underscore, in both the plain and try-with-resources
+      // shapes (java-parser@3.0.1).
+      const fin = container.children?.finally?.[0];
+      const finBlock = fin?.children?.block?.[0];
+      if (finBlock) walkStmts(finBlock);
+    }
+    if (kids.switchStatement) {
+      const sw = kids.switchStatement[0];
+      const cond = sw.children?.expression?.[0];
+      emit({ kind: 'if', cond: cond ? exprFromCst(cond) : null, line: _lineOf(sw), succ: [] });
+      const swBlock = sw.children?.switchBlock?.[0];
+      // Classic colon-form (`case 1: ...; break;`).
+      const groups = swBlock?.children?.switchBlockStatementGroup || [];
+      for (const g of groups) {
+        const bss = g.children?.blockStatements?.[0];
+        if (bss) walkStmts(bss);
+      }
+      // R8 Task 1 fix round 1: arrow-form (`case 1 -> ...;`, Java 14+) is a
+      // structurally distinct grammar rule — confirmed via direct CST
+      // inspection (java-parser@3.0.1) — not an alternate reading of
+      // switchBlockStatementGroup. A switchBlock's children carry EITHER
+      // switchBlockStatementGroup (colon-form) OR switchRule (arrow-form),
+      // never both (Java's grammar forbids mixing them in one switch
+      // block), so this is a separate, independent branch rather than a
+      // fallback path. Each switchRule carries exactly one body-shape key:
+      // `expression` (`case 1 -> sink(x);`), `block`
+      // (`case 1 -> { ...; }`), or `throwStatement`
+      // (`case 1 -> throw new X();`). Before this fix arrow-form switches
+      // fell through this whole branch producing zero walked statements —
+      // confirmed 0 IR-TAINT findings for the idiomatic modern-Java shape.
+      const rules = swBlock?.children?.switchRule || [];
+      for (const r of rules) {
+        const rblock = r.children?.block?.[0];
+        if (rblock) { walkStmts(rblock); continue; }
+        const rthrow = r.children?.throwStatement?.[0];
+        if (rthrow) {
+          const texpr = rthrow.children?.expression?.[0];
+          emit({ kind: 'throw', value: texpr ? exprFromCst(texpr) : null, line: _lineOf(rthrow), succ: [] });
+          continue;
+        }
+        const rexpr = r.children?.expression?.[0];
+        if (rexpr) {
+          const expr = exprFromCst(rexpr);
+          if (expr.kind === 'call') emit({ ...expr, line: _lineOf(r), succ: [] });
+          else if (expr.kind === 'binary' && expr.op === '=') {
+            emit({ kind: 'assign', target: expr.left?.name || null, source: expr.right, line: _lineOf(r), succ: [] });
+          }
+        }
+      }
+    }
+    // Bare nested block `{ ... }` with no leading keyword. The
+    // `statementWithoutTrailingSubstatement` branch above already recurses
+    // into each such node via walkStmts; confirmed via direct CST
+    // inspection that a bare block lands as
+    // `statementWithoutTrailingSubstatement[0].children.block[0]`, so this
+    // branch — which fires for any node with a `block` child, not just
+    // this one — picks it up on the recursive call without a dedicated
+    // bare-block branch.
+    if (kids.block) {
+      for (const b of kids.block) walkStmts(b);
+    }
   }
 
   if (nodes[prev]) {
@@ -335,10 +490,56 @@ export async function parseJavaFile(file, raw) {
           const name = md.children?.methodHeader?.[0]?.children?.methodDeclarator?.[0]?.children?.Identifier?.[0]?.image
             || md.children?.methodDeclarator?.[0]?.children?.Identifier?.[0]?.image
             || 'anonymous';
-          const params = []; // params extraction deferred
+          // Parameter list + annotations live in the same CST subtree, so
+          // both are extracted in one walk (PRD R14(a) Task 5). Mirrors the
+          // dual-path fallback pattern used above for `name`: depending on
+          // which `k` matched in the outer loop, the params live nested
+          // under a `methodHeader` node OR directly under `methodDeclarator`.
+          const fpl = md.children?.methodHeader?.[0]?.children?.methodDeclarator?.[0]?.children?.formalParameterList?.[0]
+            || md.children?.methodDeclarator?.[0]?.children?.formalParameterList?.[0];
+          const paramAnnotations = [];
+          const params = (fpl?.children?.formalParameter || []).map((fp, idx) => {
+            // Regular parameters nest under `variableParaRegularParameter`.
+            // Varargs (`String... args`) instead use a distinct
+            // `variableArityParameter` node that this walk doesn't extract
+            // from — `vp` is undefined, so this degrades gracefully to a
+            // dropped (not corrupted/crashed) parameter, matching the
+            // codebase's existing "degrade gracefully rather than throw"
+            // convention for shapes that aren't cleanly extractable. Array
+            // types (`String[] args`) are unaffected — the `[]` lives in
+            // `unannType`, not the identifier, so `variableDeclaratorId`
+            // still yields a clean name.
+            const vp = fp.children?.variableParaRegularParameter?.[0];
+            const paramName = vp?.children?.variableDeclaratorId?.[0]?.children?.Identifier?.[0]?.image || null;
+            // Java allows multiple stacked annotations on one parameter
+            // (`@NotNull @RequestParam String q`), each its own
+            // `variableModifier` entry — loop over all of them, not just
+            // the first, or a stacked annotation is silently dropped (the
+            // same class of bug Task 3's C# regex needed a fix round for).
+            const variableModifiers = vp?.children?.variableModifier || [];
+            for (const vm of variableModifiers) {
+              const ann = vm.children?.annotation?.[0];
+              // `typeName.children.Identifier` is an array of ALL
+              // dot-separated segments for a fully-qualified annotation
+              // (`@org.springframework.web.bind.annotation.RequestParam`
+              // yields ['org','springframework','web','bind','annotation',
+              // 'RequestParam']) — the simple annotation name is the LAST
+              // segment, not the first. Taking [0] previously recorded the
+              // package root ("org") as the decorator name, a silent wrong
+              // value rather than the honest drop the C#/JS sibling parsers
+              // produce for the same shape (fix round 1, R14(a) Task 5).
+              const identifiers = ann?.children?.typeName?.[0]?.children?.Identifier;
+              const decoratorName = identifiers?.length ? identifiers[identifiers.length - 1]?.image : undefined;
+              if (decoratorName && paramName) {
+                paramAnnotations.push({ index: idx, name: paramName, decorator: decoratorName });
+              }
+            }
+            return paramName;
+          }).filter(Boolean);
           const body = md.children?.methodBody?.[0]?.children?.block?.[0];
           if (body) {
             const methodLine = _lineOf(md);
+            const cfg = buildCfgFromBody(body);
             functions.push({
               // Sibling frontends (parser-js.js) suffix the qid with `@line`
               // so overloaded/same-named methods don't collide — without it,
@@ -348,8 +549,10 @@ export async function parseJavaFile(file, raw) {
               name: className ? `${className}.${name}` : name,
               line: methodLine,
               params,
-              cfg: buildCfgFromBody(body),
+              cfg,
               file,
+              calls: callSitesFromCfg(cfg),
+              ...(paramAnnotations.length ? { paramAnnotations } : {}),
             });
           }
         }

package/src/ir/parser-js.js

@@ -63,11 +63,23 @@ function exprOf(n) {
       prop: n.computed ? (n.property?.value != null ? String(n.property.value) : '*') : (n.property?.name || '*'),
     };
     case 'CallExpression':
-    case 'OptionalCallExpression':
+    case 'OptionalCallExpression': return {
+      kind: 'call',
+      callee: exprOf(n.callee),
+      args: (n.arguments || []).map(exprOf),
+    };
+    // `new Foo()` is emitted as a call PLUS an `isNew: true` marker, matching
+    // what parser-java.js and parser-cs.js already emit. Without the marker a
+    // `new Foo()` is byte-identical in the IR to a plain `Foo()` call, and
+    // class-hierarchy.js's typeOfVar walker therefore typed `const x =
+    // SomeFactoryFn()` as class `SomeFactoryFn` — a fabricated type that then
+    // reaches the dataflow receiver-type gate and can suppress a real finding.
+    // Nothing else in the engine reads `isNew`, so this is purely additive.
     case 'NewExpression':     return {
       kind: 'call',
       callee: exprOf(n.callee),
       args: (n.arguments || []).map(exprOf),
+      isNew: true,
     };
     case 'BinaryExpression':  return { kind: 'binary', op: n.operator, left: exprOf(n.left), right: exprOf(n.right) };
     case 'LogicalExpression': return { kind: 'logical', op: n.operator, left: exprOf(n.left), right: exprOf(n.right) };
@@ -151,6 +163,7 @@ export function parseJsFile(file, code) {
     const qid = fnQid(file, scopeName, name, line);
     const entryId = nextNodeId();
     const exitId  = nextNodeId();
+    const paramAnnotations = [];
     const fn = {
       qid, name: name || 'anon', line,
       // Plain strings, per the IR shape contract (ir/CLAUDE.md: "params:
@@ -163,8 +176,34 @@ export function parseJsFile(file, code) {
       // mutated-parameter taint and context-sensitive entry states were both
       // unconditionally inert for every JS/TS function. Nothing in src/
       // reads a param's .kind or .props, so the richer shape bought nothing.
-      params: (params || []).map(p => {
+      params: (params || []).map((p, idx) => {
         if (!p) return null;
+        // NestJS/Angular-style parameter decorators (@Query(), @Body(), etc.)
+        // — Babel attaches these to the raw param node as `p.decorators`
+        // (or `p.left.decorators` for a defaulted param, e.g. `@Query() page
+        // = 1` — a very common NestJS idiom). This is a real array; every
+        // entry must be captured, not just the first, since stacked
+        // decorators (@Query() @SomeOtherDecorator() x) are legal and
+        // dropping later ones silently loses the source-relevant one.
+        //
+        // For a defaulted param, `p.type` is 'AssignmentPattern', never
+        // 'Identifier' — the identifier that actually carries the decorator
+        // and the name lives at `p.left`. The guard below must check THAT
+        // resolved node's type, not `p.type` unconditionally, or every
+        // defaulted-identifier decorated parameter silently loses its
+        // decorator (fix round 1, R14(a) Task 4).
+        const resolvedIdent = p.type === 'AssignmentPattern' ? p.left : p;
+        const decoratorNodes = p.decorators || (p.left && p.left.decorators) || [];
+        for (const d of decoratorNodes) {
+          const expr = d.expression;
+          const decoratorName = expr?.type === 'CallExpression' ? expr.callee?.name : expr?.name;
+          // Only record when the parameter itself resolves to a plain
+          // identifier — decorators on destructured params are rare and
+          // out of scope for this plan.
+          if (decoratorName && resolvedIdent?.type === 'Identifier') {
+            paramAnnotations.push({ index: idx, name: resolvedIdent.name, decorator: decoratorName });
+          }
+        }
         if (p.type === 'Identifier') return p.name;
         if (p.type === 'ObjectPattern') return '<obj>';
         if (p.type === 'ArrayPattern') return '<arr>';
@@ -181,6 +220,7 @@ export function parseJsFile(file, code) {
       writes: new Map(),
       file,
       _cursor: entryId, // current node ID — next addNode() links from here
+      ...(paramAnnotations.length ? { paramAnnotations } : {}),
     };
     fn.cfg.nodes.set(entryId, { id: entryId, kind: 'entry', succ: [], pred: [], line });
     fn.cfg.nodes.set(exitId,  { id: exitId,  kind: 'exit',  succ: [], pred: [], line });
@@ -319,6 +359,35 @@ export function parseJsFile(file, code) {
 
         VariableDeclarator(path) {
           const fn = currentFn(); if (!fn) return;
+          // PRD R13(b): `for (const item of tainted)` is, structurally, also
+          // an ordinary VariableDeclarator (`item`, no `init`) — Babel visits
+          // it as a normal child of the ForOfStatement's `left` on the way
+          // into the loop body. Left to the general case below, this generic
+          // visit fires AFTER the loop visitor's enter() hook synthesizes
+          // `item = <iterated expr>`, re-assigning `item` from an absent
+          // `init` (source: unknown) and silently erasing the taint just
+          // synthesized. Skip it here ONLY for the simple-identifier shape
+          // the loop visitor actually owns and synthesizes for — a bare
+          // `for (const item of ...)` binding.
+          //
+          // A destructuring for-of binding (`for (const {a,b} of ...)` /
+          // `for (const [a,b] of ...)`) is explicitly NOT covered by the
+          // loop visitor's synthesis (see the ForOfStatement branch below —
+          // `loopVar` stays null and nothing is emitted for it), so it MUST
+          // fall through to the general destructuring handling further down
+          // in this same visitor. That handling was already here before this
+          // task and does something this guard must not break: it emits real
+          // taint-KILL assign nodes for each destructured name, which is what
+          // makes `let cmd = tainted; for (const {cmd} of SAFE) sink(cmd)`
+          // correctly clear cmd's stale outer taint. An earlier version of
+          // this guard matched on the ForOfStatement `left` alone (no
+          // Identifier check) and silently deleted those taint-kill nodes,
+          // producing a false positive on exactly that shadowing shape — see
+          // the regression test below.
+          const gpDecl = path.parentPath && path.parentPath.node;
+          const gpLoop = path.parentPath && path.parentPath.parentPath && path.parentPath.parentPath.node;
+          if (gpLoop && gpLoop.type === 'ForOfStatement' && gpLoop.left === gpDecl
+              && path.node.id?.type === 'Identifier') return;
           const id = lhsPath(path.node.id);
           if (!id) return;
           const initExpr = exprOf(path.node.init);
@@ -492,6 +561,64 @@ export function parseJsFile(file, code) {
             fn.cfg.nodes.set(exitId, { id: exitId, kind: 'noop', succ: [], pred: [], line });
             path.node._loopHeader = headerId;
             path.node._loopExit = exitId;
+            // PRD R13(b): for-of's binding variable is never connected to the
+            // iterated expression, so `for (const x of tainted) sink(x)` reads
+            // x as {kind:'unknown'} — clean. Synthesize an assign binding the
+            // loop variable to the iterated expression, exactly as the
+            // Python-CST/Go/PHP parsers already do for their own for-each
+            // constructs (parser-py.helper.py, parser-go.js, parser-php.js).
+            // Conservative, matching this file's own stated doctrine for
+            // loops in general ("any iteration could taint X"): the WHOLE
+            // loop variable is tainted if the iterable is tainted, not a
+            // specific element — element-level precision isn't modeled here
+            // any more than it is for the rest of this file's loop handling.
+            // Scoped to ForOfStatement only — While/For/DoWhile/ForIn have no
+            // "loop variable bound to an iterated collection" shape and must
+            // see zero behavior change from this addition.
+            if (path.node.type === 'ForOfStatement') {
+              const leftNode = path.node.left;
+              const declId = leftNode && leftNode.type === 'VariableDeclaration'
+                ? leftNode.declarations[0]?.id
+                : leftNode;
+              // Only the simple `for (const x of ...)` / `for (x of ...)`
+              // shape is synthesized. A destructuring binding
+              // (`for (const {a,b} of ...)`) has no single flat target name
+              // lhsPath-style logic could bind to — left unsynthesized rather
+              // than guessed at, matching this codebase's "refuse rather than
+              // invent an edge" doctrine elsewhere (see _resolvableCalleeName
+              // in dataflow/engine.js for the same principle applied to call
+              // resolution).
+              const loopVar = declId && declId.type === 'Identifier' ? declId.name : null;
+              if (loopVar) {
+                const iterExpr = exprOf(path.node.right);
+                const bindId = nextNodeId();
+                addNode(fn, { id: bindId, kind: 'assign', target: loopVar, source: iterExpr, line, succ: [], pred: [] });
+                // `for (const x of ...)` / `for (let x of ...)` declares a
+                // BLOCK-SCOPED binding: a same-named `x` outside the loop is a
+                // different variable and must be completely unaffected by
+                // whatever the loop's `x` held. This engine's taint model has
+                // no block scoping, so the synthesized binding above would
+                // otherwise flow past the loop's exit and over-taint an outer
+                // `x` (proven: `let item='safe'; for (const item of req.body
+                // .items){} eval(item)` reported a Code Injection finding that
+                // pre-R13(b) code correctly reported as clean — the generic
+                // VariableDeclarator visitor used to emit `assign x <-
+                // {kind:'unknown'}` here, a taint KILL, and the guard above now
+                // suppresses it for exactly this shape). Record the name so
+                // exit() can re-emit that kill AFTER the loop, restoring the
+                // pre-existing behavior for post-loop reads while keeping the
+                // new in-loop taint flow.
+                //
+                // Deliberately NOT done for the bare-assignment form
+                // (`for (x of ...)`, leftNode is not a VariableDeclaration):
+                // that binding is not block-scoped, it reuses an existing
+                // outer `x`, and its value legitimately survives the loop —
+                // killing it there would itself be a regression.
+                if (leftNode && leftNode.type === 'VariableDeclaration') {
+                  path.node._loopBindVar = loopVar;
+                }
+              }
+            }
           },
           exit(path) {
             const fn = currentFn(); if (!fn) return;
@@ -501,6 +628,26 @@ export function parseJsFile(file, code) {
             linkCfg(fn, fn._cursor, headerId); // back-edge
             linkCfg(fn, headerId, exitId);     // exit edge
             fn._cursor = exitId;
+            // See the _loopBindVar comment in enter(): restore the taint KILL
+            // that the ForOfStatement VariableDeclarator guard suppresses, so
+            // a block-scoped for-of binding's synthesized taint cannot leak
+            // past the loop onto a same-named outer variable. Emitted AFTER
+            // `fn._cursor = exitId` so it sits on the loop's normal exit path
+            // (header -> exit-noop -> kill -> whatever follows the loop) and
+            // therefore runs once on the way out — never inside the body, so
+            // in-loop taint reachability is unchanged.
+            if (path.node._loopBindVar) {
+              const killId = nextNodeId();
+              addNode(fn, {
+                id: killId,
+                kind: 'assign',
+                target: path.node._loopBindVar,
+                source: { kind: 'unknown' },
+                line: path.node.loc?.start?.line || 0,
+                succ: [],
+                pred: [],
+              });
+            }
           },
         },