@clear-capabilities/agentic-security-scanner 0.137.0 → 0.139.0

package/src/ir/parser-java.js

@@ -68,24 +68,125 @@ function exprFromCst(node) {
     if (node.children.primaryPrefix) {
       const prefix = node.children.primaryPrefix[0];
       const suffixes = node.children.primarySuffix || [];
-      const invocation = suffixes
-        .map(s => s.children?.methodInvocationSuffix?.[0])
-        .find(Boolean);
-      if (invocation) {
-        const fqn = prefix?.children?.fqnOrRefType?.[0];
-        const callee = fqn ? _flattenFqnToString(fqn) : 'unknown';
-        const args = (invocation.children?.argumentList?.[0]?.children?.expression || [])
-          .map(exprFromCst);
-        return { kind: 'call', callee, args };
+      // Taint-recall PRD (80%): java-parser models a CHAIN
+      // (`X().Y().Z(tainted)`) as ONE primary node with a FLAT array of
+      // primarySuffix entries — each is EITHER a methodInvocationSuffix
+      // (a `(...)` call) OR a {Dot, Identifier} member-access pair, in
+      // source order. The old code used `.find(Boolean)` to grab the
+      // FIRST methodInvocationSuffix in the whole array and stopped there
+      // — for `DocumentBuilderFactory.newInstance().newDocumentBuilder()
+      // .parse(s)` this returned just the `newInstance()` call with
+      // args: [], silently dropping `.newDocumentBuilder().parse(s)`
+      // entirely (confirmed via a real corpus fixture; the same shape
+      // also explains the earlier-documented, never-fixed
+      // `Runtime.getRuntime().exec(...)` gap). Now walks every suffix in
+      // order, building the callee name from member-access suffixes and,
+      // at each invocation suffix, folding that call's args into the
+      // running result — outermost-first (the LATEST call's own args are
+      // prepended), same convention as _followChain in the other 5
+      // hand-rolled parsers, so an existing `argIndex: 0` catalog entry
+      // keyed to the outermost call is unaffected while `argIndex: 'all'`
+      // can still find taint an inner call in the chain carried.
+      let chainCallee = '';
+      let chainArgs = null;
+      const fqn = prefix?.children?.fqnOrRefType?.[0];
+      // Taint-recall PRD (80%): a `new X(args)` CONSTRUCTOR starting the
+      // chain (`new URL(url).openStream()`) is a DIFFERENT CST shape than
+      // an fqnOrRefType prefix — `prefix.children.fqnOrRefType` is absent,
+      // so `fqn` above is undefined and, before this fix, BOTH the
+      // constructor's own class name AND its own arguments were silently
+      // dropped: `chainCallee` stayed empty and the suffix walk below only
+      // ever contributes the CHAINED method's name, producing a callee
+      // like bare "openStream" with the constructor's tainted argument
+      // nowhere in the IR at all — not misattributed, genuinely absent, a
+      // strictly worse failure than the terminal-segment-shift class this
+      // PRD fixes elsewhere with a receiver-scoped catalog entry (there is
+      // no catalog fix possible for taint the IR never represents).
+      // Confirmed via a real corpus fixture (CVE-2019-3799-spring-ssrf-
+      // shape). The actual CST path is one level deeper than the analogous
+      // fqnOrRefType check above: `primaryPrefix.children.newExpression[0]
+      // .children.unqualifiedClassInstanceCreationExpression[0]` — found by
+      // dumping `prefix.children` directly rather than guessing (the
+      // standalone, NON-chained `new X(args)` branch further below reaches
+      // `unqualifiedClassInstanceCreationExpression` straight off `node`,
+      // one level shallower, which is what made the wrapping `newExpression`
+      // layer easy to miss here). Seeds `chainCallee` with the class name
+      // and `chainArgs` with the constructor's OWN args (same
+      // argumentList.expression shape that standalone branch already
+      // extracts) — the suffix loop's existing `chainArgs === null ? args :
+      // args.concat(chainArgs)` then correctly prepends each chained call's
+      // own args ahead of the constructor's, preserving the outermost-first
+      // convention.
+      const ctorPrefix = prefix?.children?.newExpression?.[0]?.children?.unqualifiedClassInstanceCreationExpression?.[0];
+      if (fqn) {
+        chainCallee = _flattenFqnToString(fqn);
+      } else if (ctorPrefix) {
+        chainCallee = ctorPrefix.children?.classOrInterfaceTypeToInstantiate?.[0]?.children?.Identifier?.[0]?.image || '';
+        chainArgs = (ctorPrefix.children?.argumentList?.[0]?.children?.expression || []).map(exprFromCst);
+      }
+      // No FQN/constructor prefix — e.g. `this.foo(x)`, `super.foo(x)`
+      // (prefix is a keyword expression). chainCallee starts empty; the
+      // walk below supplies the real name from the first member-access
+      // suffix.
+      let pendingName = [];
+      const appendPending = () => {
+        if (!pendingName.length) return;
+        chainCallee = chainCallee ? `${chainCallee}.${pendingName.join('.')}` : pendingName.join('.');
+        pendingName = [];
+      };
+      for (const suf of suffixes) {
+        const inv = suf.children?.methodInvocationSuffix?.[0];
+        if (inv) {
+          appendPending();
+          const args = (inv.children?.argumentList?.[0]?.children?.expression || []).map(exprFromCst);
+          chainArgs = chainArgs === null ? args : args.concat(chainArgs);
+          continue;
+        }
+        const ident = suf.children?.Identifier?.[0]?.image;
+        if (ident) pendingName.push(ident);
+      }
+      if (chainArgs !== null) {
+        appendPending(); // a trailing member access after the last call (e.g. a field read)
+        return { kind: 'call', callee: chainCallee || 'unknown', args: chainArgs };
       }
       return exprFromCst(prefix);
     }
+    // Taint-recall PRD (80%): a cast expression — `(String) xp.evaluate(...)`,
+    // `(int) computeVal(x)` — was falling through to the generic "recurse the
+    // first child" branch below, which for a castExpression's shape hits its
+    // own `primaryPrefix.children.castExpression` sub-node with no dedicated
+    // branch, and beneath THAT the raw `LBrace`/`LParen` token sorts first in
+    // key order — silently corrupting the parse into `{kind:'ident',
+    // name:'('}` and losing the entire operand (the actual call, and
+    // whatever tainted argument it carried). Confirmed via a real corpus
+    // fixture (CVE-2018-1320-xpath-injection). Casts are semantically
+    // transparent for taint purposes — unwrap to the operand, reference-type
+    // (`(String) x` → unaryExpressionNotPlusMinus) or primitive
+    // (`(int) x` → unaryExpression) shaped.
+    if (node.children.castExpression) {
+      const ce = node.children.castExpression[0];
+      const rtc = ce.children?.referenceTypeCastExpression?.[0];
+      const pc = ce.children?.primitiveCastExpression?.[0];
+      const operand = rtc?.children?.unaryExpressionNotPlusMinus?.[0]
+        || pc?.children?.unaryExpression?.[0];
+      if (operand) return exprFromCst(operand);
+    }
     // FQN ref
     if (node.children.fqnOrRefType) return _fqnExpr(node.children.fqnOrRefType[0]);
     if (node.children.unqualifiedClassInstanceCreationExpression) {
       const ci = node.children.unqualifiedClassInstanceCreationExpression[0];
       const callee = (ci.children?.classOrInterfaceTypeToInstantiate?.[0]?.children?.Identifier?.[0]?.image) || 'new';
-      return { kind: 'call', callee, isNew: true, args: [] };
+      // Taint-recall PRD (80%): args was hardcoded to [] — every
+      // `new X(arg1, arg2)` constructor call lowered with its arguments
+      // silently discarded, so a sink modeled as a constructor call
+      // (argIndex-based) could never see a tainted constructor argument
+      // regardless of catalog correctness. Same argumentList.expression
+      // shape the methodInvocationSuffix branch above already extracts
+      // from. Confirmed via a real corpus fixture
+      // (`new ByteArrayInputStream(xml)` feeding `b.parse(...)`).
+      const args = (ci.children?.argumentList?.[0]?.children?.expression || [])
+        .map(exprFromCst);
+      return { kind: 'call', callee, isNew: true, args };
     }
     if (node.children.literal) return exprFromCst(node.children.literal[0]);
     if (node.children.Identifier) return { kind: 'ident', name: node.children.Identifier[0].image };

package/src/ir/parser-js.js

@@ -99,10 +99,50 @@ function exprOf(n) {
     case 'ArrayExpression':   return { kind: 'array', elements: (n.elements || []).map(exprOf) };
     case 'SpreadElement':     return exprOf(n.argument);
     case 'ThisExpression':    return { kind: 'ident', name: '_this_' };
+    // Taint-recall PRD (80%) Tier 3: JSX had ZERO IR modeling at all — every
+    // JSXElement fell through to {kind:'unknown'}, so `return <div
+    // dangerouslySetInnerHTML={{__html: html}} />` (React's canonical XSS
+    // sink, and the shape of a real corpus miss) silently dropped `html`'s
+    // taint entirely. Deliberately narrow: only the `dangerouslySetInnerHTML`
+    // attribute is extracted (found on this element or, recursively, any
+    // descendant — the attribute can sit on a nested element, not just the
+    // one directly returned) and lowered to a synthetic call
+    // (`__jsx_dangerously_set_inner_html__`) carrying the `__html` object
+    // property's value, so the existing `react-dangerouslySetInnerHTML`
+    // member-write sink's SIBLING call-shaped catalog entry can target it.
+    // Full JSX modeling (arbitrary attributes, children, expressions) is
+    // explicitly out of scope — children are React-auto-escaped by default,
+    // so `<div>{unsafeText}</div>` is not itself a vulnerability the way
+    // `dangerouslySetInnerHTML` is.
+    case 'JSXElement': {
+      const found = _findDangerouslySetInnerHTML(n);
+      if (found) return { kind: 'call', callee: '__jsx_dangerously_set_inner_html__', args: [exprOf(found)] };
+      return { kind: 'unknown' };
+    }
     default:                   return { kind: 'unknown' };
   }
 }
 
+function _findDangerouslySetInnerHTML(jsxElement) {
+  const attrs = jsxElement?.openingElement?.attributes || [];
+  for (const attr of attrs) {
+    if (attr.type !== 'JSXAttribute' || attr.name?.name !== 'dangerouslySetInnerHTML') continue;
+    const val = attr.value;
+    if (val?.type !== 'JSXExpressionContainer') continue;
+    const obj = val.expression;
+    if (obj?.type !== 'ObjectExpression') continue;
+    const htmlProp = (obj.properties || []).find(p => p.type === 'ObjectProperty' && (p.key?.name === '__html' || p.key?.value === '__html'));
+    if (htmlProp) return htmlProp.value;
+  }
+  for (const child of jsxElement?.children || []) {
+    if (child.type === 'JSXElement') {
+      const nested = _findDangerouslySetInnerHTML(child);
+      if (nested) return nested;
+    }
+  }
+  return null;
+}
+
 // Reduce a Babel LHS node to a string path used as a dataflow variable key.
 function lhsPath(n) {
   if (!n) return null;

package/src/ir/parser-kt.js

@@ -67,6 +67,7 @@
 
 import * as crypto from 'node:crypto';
 import { callSitesFromCfg } from './call-sites.js';
+import { matchBalancedCall } from './balanced-call.js';
 
 const FUN_RE = new RegExp(
   '(?:^|[\\s;{}])(?:public|private|internal|protected|inline|suspend|tailrec|operator|infix|open|abstract|override|final|external)?' +
@@ -169,6 +170,25 @@ function _buildMemberChain(parts) {
   return cur;
 }
 
+// Taint-recall PRD (80%): same architectural fix as parser-cs.js/
+// parser-go.js/parser-php.js/parser-rb.js — a chained call
+// (`ScriptEngineManager().getEngineByName("js").eval(userCode)`) previously
+// stopped at (or, here, actively corrupted the parse at) the FIRST call,
+// leaving `.method(args)` continuations unconsumed or garbled. Args from
+// EVERY level are kept, outermost-first — a first version kept only the
+// outermost, which broke `xp.compile(taintedExpr).evaluate(doc,
+// XPathConstants.NODESET)`: the tainted value sits on the INNER call
+// (.compile), not the final one, and keeping only the outer args (doc,
+// NODESET) silently dropped it — see parser-cs.js's twin function for the
+// full reasoning.
+function _followChain(s, endIdx, calleeSoFar, argsSoFar) {
+  const rest = s.slice(endIdx);
+  const outer = matchBalancedCall(rest, /^\.(\w+)/);
+  if (!outer) return { kind: 'call', callee: calleeSoFar, args: argsSoFar };
+  const outerArgs = _splitTopLevelCommas(outer.argsText).map(_lowerExpr);
+  return _followChain(rest, outer.endIdx, `${calleeSoFar}.${outer.callee}`, outerArgs.concat(argsSoFar));
+}
+
 function _lowerExpr(text) {
   const s = String(text || '').trim();
   if (!s) return { kind: 'unknown' };
@@ -192,14 +212,42 @@ function _lowerExpr(text) {
     if (parts.length === 1) return { kind: 'ident', name: parts[0] };
     return _buildMemberChain(parts);
   }
-  // Call
-  const callMatch = s.match(/^([\w.]+)\s*\((.*)\)\s*$/s);
+  // Taint-recall PRD (80%): subscript/bracket access (`map[key]`,
+  // `call.parameters["q"]`) had NO recognizer at all — Kotlin's
+  // `operator fun get(key)` bracket syntax, used pervasively for Maps,
+  // arrays, and (critically) Ktor's `call.parameters[...]`, fell through
+  // every branch below to {kind:'unknown'}, silently dropping the value —
+  // and any taint on it — entirely. Lowered to the same synthetic `'[]'`
+  // prop convention parser-go.js's own Indexing branch uses: the base
+  // (everything before the first top-level `[`) becomes a real member
+  // chain, wrapped in one more member layer with `prop: '[]'`. This is
+  // what lets a cataloged MEMBER source on the base (e.g. `call.parameters`
+  // — `kt-ktor-parameters`) still taint the subscripted read: `exprIsSource`
+  // recurses into `expr.object` when the outer member itself doesn't match,
+  // landing on the base member it already knows.
+  const subscriptMatch = s.match(/^([A-Za-z_][\w.]*)\[(.+)\]$/s);
+  if (subscriptMatch) {
+    const parts = subscriptMatch[1].split('.');
+    const base = parts.length === 1 ? { kind: 'ident', name: parts[0] } : _buildMemberChain(parts);
+    return { kind: 'member', object: base, prop: '[]' };
+  }
+  // Call. Taint-recall PRD (80%): this used to be the naive
+  // `/^([\w.]+)\s*\((.*)\)\s*$/s` pattern every OTHER hand-rolled parser
+  // (cs/go/php/rb) also started with and has since moved off of —
+  // `(.*)` matches GREEDILY against the LAST `)` in the string, not the
+  // one balancing the FIRST `(`, so a chained call
+  // (`ScriptEngineManager().getEngineByName("js").eval(userCode)`)
+  // corrupted the args text into garbage rather than just dropping the
+  // chain. Kotlin never got migrated to matchBalancedCall when the other
+  // four were — confirmed via a real corpus fixture (this exact
+  // ScriptEngineManager shape). Now uses the same balanced-scan +
+  // chain-following approach: only the OUTERMOST call's own arguments are
+  // kept (see parser-cs.js's _followChain comment for why), each level's
+  // name dot-joined into one callee string.
+  const callMatch = matchBalancedCall(s, /^([\w.]+)/);
   if (callMatch) {
-    return {
-      kind: 'call',
-      callee: callMatch[1],
-      args: _splitTopLevelCommas(callMatch[2]).map(_lowerExpr),
-    };
+    const args = _splitTopLevelCommas(callMatch.argsText).map(_lowerExpr);
+    return _followChain(s, callMatch.endIdx, callMatch.callee, args);
   }
   // Concat
   if (s.includes('+') && /["']/.test(s)) {
@@ -227,9 +275,13 @@ function _lowerStmt(stmt, line) {
   if (assign && !/[=!<>]=/.test(s.slice(0, s.indexOf('=')+1).slice(0, -1))) {
     return { kind: 'assign', line, target: assign[1], source: _lowerExpr(assign[2]) };
   }
-  // Statement-form call
-  const cm = s.match(/^([\w.]+)\s*\((.*)\)\s*$/s);
-  if (cm) return { kind: 'call', line, callee: cm[1], args: _splitTopLevelCommas(cm[2]).map(_lowerExpr) };
+  // Statement-form call — same matchBalancedCall + chain-following as the
+  // expression-form case above (Taint-recall PRD 80%).
+  const cm = matchBalancedCall(s, /^([\w.]+)/);
+  if (cm) {
+    const chained = _followChain(s, cm.endIdx, cm.callee, _splitTopLevelCommas(cm.argsText).map(_lowerExpr));
+    return { kind: 'call', line, callee: chained.callee, args: chained.args };
+  }
   // R8: trailing-lambda call — `recv.method(args)? { lambda }`, Kotlin's
   // idiomatic collection-operator / scope-function syntax
   // (`xs.forEach { x -> … }`, `xs.reduce(0) { acc, x -> … }`). Without this
@@ -399,6 +451,43 @@ function _linkNodes(nodes, src, dst) {
 const HEADER_RE = /^(if|while|for|when|else\s+if|else|do|try|catch|finally)\b/;
 const NEEDS_COND_RE = /^(?:if|while|when|else if|catch)$/;
 
+// Taint-engine PRD P1: trailing-lambda body recursion. Detects the START of
+// a `recv.method(args)? { … }` call — deliberately NOT the whole statement
+// (the pre-P1 `_lowerStmt` trigger's `[\s\S]*\}\s*$` greedy tail is exactly
+// what mis-captured a chained `xs.filter { … }.forEach { … }` as one big
+// opaque lambda with the wrong callee). `_matchDelim` finds the REAL
+// matching `}` from here, the same balanced-scan primitive every keyword
+// branch below already uses.
+//
+// Split into two alternatives — no-args and with-args — rather than one
+// optional group between two `\s*`s: `bench:self-scan:check` caught this
+// exact shape as a genuine quadratic ReDoS (confirmed by direct timing:
+// 40000 whitespace chars with no trailing `{` took ~1s), the identical
+// defect class this file's own R8 task already fixed once (see the CLAUDE.md
+// note on the sibling `decl` regex) and parser-cs.js's `attrRegex` fixed the
+// same way. Each alternative has its own capture group for the callee name
+// (`m[1]`/`m[2]`); only one is ever set.
+const TRAILING_LAMBDA_TRIGGER_RE = /^([\w.]+)\s*\{|^([\w.]+)\s*(\([^()]*\))\s*\{/;
+
+// Stdlib scope functions whose lambda receives the RECEIVER (or an element
+// of it) as its own parameter — these get a synthesized taint-binding
+// assign before the body is recursed into, mirroring the for-loop's
+// loop-variable binding immediately below. `reduce`/`fold` pass BOTH an
+// accumulator and an element; this codebase's recall-preserving doctrine
+// (favor a false positive over a silent false negative — see catalog.js's
+// sanitizer-recording comment for the same tradeoff) argues for binding
+// every declared param to the receiver rather than trying to disambiguate
+// which one is the actual element.
+//
+// Deliberately EXCLUDED: `apply`/`run` — these pass the receiver as an
+// IMPLICIT `this`, not a named/`it` lambda parameter (`T.() -> R`, not
+// `T.(T) -> R`), so there is nothing to bind here without modeling
+// implicit-receiver member calls. Their bodies are still recursed into
+// below (so an already-tainted OUTER variable referenced inside still
+// works), just without receiver-as-param binding — a real, documented
+// scope boundary, not a silent gap.
+const LAMBDA_BINDABLE_METHODS = new Set(['forEach', 'map', 'filter', 'reduce', 'fold', 'use', 'let', 'also']);
+
 // R8: recursive statement handler. `s` is ONE element returned by
 // `_splitStatements` — which, because Kotlin's splitter (unlike C#'s) does
 // not flush on a `}` reaching depth 0, may itself be a CHAIN of glued
@@ -422,6 +511,61 @@ function _consumeChunk(s, abs0, nodes, prevId, funcStartLine, lineStarts, depth)
     const rest = s.slice(skipTo);
     const hm = rest.match(HEADER_RE);
     if (!hm) {
+      // Taint-engine PRD P1: trailing-lambda body recursion. Checked before
+      // falling through to a leaf statement — `HEADER_RE` never matches an
+      // identifier-starting trailing-lambda call, so there is no ambiguity
+      // between the two triggers.
+      const lambdaMatch = rest.match(TRAILING_LAMBDA_TRIGGER_RE);
+      if (lambdaMatch) {
+        const braceIdxInS = skipTo + lambdaMatch[0].length - 1; // index of '{' within s
+        const closeRel = _matchDelim(s, braceIdxInS, '{', '}');
+        if (closeRel !== -1) {
+          first = false;
+          const callee = lambdaMatch[1] || lambdaMatch[2];
+          const parenGroup = lambdaMatch[3] || null;
+          const argsText = parenGroup ? parenGroup.slice(1, -1) : '';
+          const callArgs = argsText ? _splitTopLevelCommas(argsText).map(_lowerExpr) : [];
+          const line = _lineForAbs(lineStarts, funcStartLine, abs0 + skipTo);
+          const callId = _addNode(nodes, { kind: 'call', line, callee, args: callArgs });
+          _linkNodes(nodes, prev, callId);
+          prev = callId;
+
+          const dot = callee.lastIndexOf('.');
+          // A leading-dot callee (`.forEach { … }`, the second link of a
+          // CHAINED trailing lambda like `xs.filter{}.forEach{}`) yields an
+          // empty receiver here — deliberately falls into the same
+          // no-binding path as .apply/.run below, since there is no real
+          // identifier to bind from (the true receiver is the previous
+          // lambda's return value, which this file does not model as a
+          // synthetic variable). The call site and body are still captured.
+          const receiver = dot > 0 ? callee.slice(0, dot) : null;
+          const method = dot >= 0 ? callee.slice(dot + 1) : callee;
+
+          const bodyInner = s.slice(braceIdxInS + 1, closeRel);
+          const bodyAbs0 = abs0 + braceIdxInS + 1;
+
+          if (receiver && LAMBDA_BINDABLE_METHODS.has(method)) {
+            const arrowIdx = _findTopLevelArrow(bodyInner);
+            const paramNames = arrowIdx >= 0
+              ? bodyInner.slice(0, arrowIdx).split(',').map(p => p.trim()).filter(p => /^[A-Za-z_]\w*$/.test(p))
+              : ['it'];
+            for (const p of paramNames) {
+              const assignId = _addNode(nodes, { kind: 'assign', line, target: p, source: _lowerExpr(receiver) });
+              _linkNodes(nodes, prev, assignId);
+              prev = assignId;
+            }
+            const recurseFrom = arrowIdx >= 0 ? arrowIdx + 2 : 0;
+            prev = _buildCfg(bodyInner.slice(recurseFrom), nodes, prev, funcStartLine, lineStarts, bodyAbs0 + recurseFrom, depth + 1);
+          } else {
+            // .apply/.run, a chained continuation, or an unlisted scope
+            // function: body still reachable, no param binding.
+            prev = _buildCfg(bodyInner, nodes, prev, funcStartLine, lineStarts, bodyAbs0, depth + 1);
+          }
+          pos = closeRel + 1;
+          if (pos >= s.length || depth > 12) return prev;
+          continue;
+        }
+      }
       if (first) {
         return _lowerLeafOrBlock(s, abs0, nodes, prev, funcStartLine, lineStarts, depth);
       }
@@ -618,6 +762,45 @@ function _lineAt(src, idx) {
   return line;
 }
 
+// Taint-recall PRD (80%): Kotlin's null-safety `?.` operator is invisible to
+// every regex-based matcher in this file — the callee-matching regexes
+// (`[\w.]+`-style), the plain-dotted-ident check, the trailing-lambda
+// trigger, and `_followChain`'s continuation regex all key off a character
+// class that excludes `?`. Unlike `::` (parser-rb.js) or a chain
+// continuation, this is NOT limited to a later segment of a chain — the
+// safe-call operator can appear on the very FIRST segment of an expression
+// (`str?.trim()`, `xs?.forEach { … }`, even a bare property read `x?.y`),
+// so patching individual regexes one at a time would miss call sites this
+// file doesn't yet enumerate. Normalized once, globally, at the very top of
+// the parse pipeline instead: string-literal-aware (so `"a?.b"` inside a
+// literal string is left untouched) and strips only the `?` immediately
+// before a `.` (so the elvis operator `?:` and a bare nullable-type marker
+// `String?` are both unaffected — neither is followed by `.`). Dropping the
+// `?` (not replacing with a same-length filler) is safe for this file's
+// line-number bookkeeping specifically because `_lineStarts`/`_lineAt`/
+// `_lineForOffset` are all purely newline-position-based — removing a
+// non-newline character can shift a later character's COLUMN but never its
+// LINE, and column offsets are never relied on anywhere in this file.
+function _stripSafeCallOperator(code) {
+  let out = '';
+  let inStr = null;
+  let escape = false;
+  for (let i = 0; i < code.length; i++) {
+    const c = code[i];
+    if (escape) { out += c; escape = false; continue; }
+    if (inStr) {
+      out += c;
+      if (c === '\\') { escape = true; continue; }
+      if (c === inStr) inStr = null;
+      continue;
+    }
+    if (c === '"' || c === '\'') { inStr = c; out += c; continue; }
+    if (c === '?' && code[i + 1] === '.') { out += '.'; i++; continue; }
+    out += c;
+  }
+  return out;
+}
+
 function _qid(file, name, line, body) {
   const sha = crypto.createHash('sha256').update(body).digest('hex').slice(0, 8);
   return `${file}::${name}@${line}#${sha}`;
@@ -625,6 +808,7 @@ function _qid(file, name, line, body) {
 
 export function parseKotlinFile(file, code) {
   if (!file || typeof code !== 'string') return null;
+  code = _stripSafeCallOperator(code);
   const functions = [];
   FUN_RE.lastIndex = 0;
   let m;

package/src/ir/parser-php.js

@@ -167,6 +167,19 @@ function _splitStatements(body) {
       if (i < body.length) { push('\n'); curLine++; }
       continue;
     }
+    // Taint-recall PRD (80%): PHP's THIRD line-comment form — `#`-comments
+    // were entirely invisible to this splitter (only `//`/`/* */` were
+    // handled), so a `#`-comment's text was treated as literal code:
+    // string-toggling apostrophes, brace/paren/bracket depth corruption,
+    // and — if it happened to contain a stray `;` — a bogus statement
+    // boundary. PHP 8 attributes (`#[Attribute]`) use the same leading `#`
+    // but are NOT a comment, so `#[` is excluded (checked via the next
+    // character) exactly like `_extractBody`'s twin fix does.
+    if (c === '#' && body[i + 1] !== '[') {
+      while (i < body.length && body[i] !== '\n') i++;
+      if (i < body.length) { push('\n'); curLine++; }
+      continue;
+    }
     if (c === '/' && body[i + 1] === '*') {
       // Block comment (incl. PHPDoc, e.g. `/** @param string $x */`).
       // Skip to the matching `*/`, counting any newlines crossed so line
@@ -271,6 +284,26 @@ function _splitStatements(body) {
   return out;
 }
 
+// Taint-recall PRD (80%): same architectural fix as parser-cs.js/
+// parser-go.js — a chained call (`sanitize($x)->encode()`, or a real sink
+// shape like `$xp->query(...)` reached through a chain) previously stopped
+// at the FIRST balanced call, leaving `->method(args)` unconsumed. `callee`
+// arrives already normalized to dots (->/:: both become "."), so the
+// continuation check looks for a literal "->" or "::" in the SOURCE text
+// (PHP's own syntax) even though the join uses ".". Args from EVERY level
+// are kept, outermost-first — see parser-cs.js's twin function for why
+// (a first version that kept only the outermost broke a real chain shape
+// where the tainted value sits on an INNER call).
+function _followChain(s, endIdx, calleeSoFar, argsSoFar) {
+  const rest = s.slice(endIdx);
+  const m = rest.match(/^(?:->|::)(\w+)/);
+  if (!m) return { kind: 'call', callee: calleeSoFar, args: argsSoFar };
+  const outer = matchBalancedCall(rest, /^(?:->|::)(\w+)/);
+  if (!outer) return { kind: 'call', callee: calleeSoFar, args: argsSoFar };
+  const outerArgs = _splitTopLevelCommas(outer.argsText).map(_lowerExpr);
+  return _followChain(rest, outer.endIdx, `${calleeSoFar}.${outer.callee}`, outerArgs.concat(argsSoFar));
+}
+
 function _lowerExpr(text) {
   const s = String(text || '').trim();
   if (!s) return { kind: 'unknown' };
@@ -285,8 +318,25 @@ function _lowerExpr(text) {
   // common real PHP SQL-injection shapes. Simple (`$var`, `$var->prop`,
   // `$var[key]`) and complex (`{$expr}`) interpolation forms are both
   // lowered into a template, same shape as the `.`-concat branch below.
-  if (/^"/.test(s) && s.includes('$')) {
-    const inner = s.slice(1, -1);
+  // Taint-recall PRD (80%): the old guard (`/^"/.test(s) && s.includes('$')`)
+  // treated ANY string simply STARTING with `"` and containing a `$`
+  // ANYWHERE as a self-contained double-quoted literal, then blindly sliced
+  // off the first and last characters as its quotes (`s.slice(1, -1)`).
+  // For a concat expression like `"SELECT ... id = " . $id` — arguably the
+  // single most common real-world PHP SQL-injection shape — `s` starts
+  // with `"` and contains a `$` (in `$id`, OUTSIDE the string, after the
+  // `.`), so this branch fired and treated the WHOLE concat expression's
+  // text as interpolation content: `inner` became `SELECT ... id = " . $i`
+  // (sliced off the true FIRST character and the true LAST character,
+  // neither of which bounds the actual string literal), corrupting both
+  // the literal text and truncating `$id` to `$i`. Now requires the ENTIRE
+  // trimmed expression to be exactly one closed double-quoted literal
+  // (anchored start AND end) before treating it as interpolation-only —
+  // `"literal" . $var` fails this (trailing ` . $var` breaks the end
+  // anchor) and correctly falls through to the concat branch below instead.
+  const dqLiteral = s.match(/^"((?:[^"\\]|\\.)*)"$/);
+  if (dqLiteral && s.includes('$')) {
+    const inner = dqLiteral[1];
     const re = /\{(\$[^}]+)\}|(\$[A-Za-z_]\w*(?:->[A-Za-z_]\w*|\[[^\]]+\])?)/g;
     let lastIndex = 0;
     const parts = [];
@@ -303,7 +353,16 @@ function _lowerExpr(text) {
       return { kind: 'tpl', parts };
     }
   }
-  if (/^"/.test(s) || /^'/.test(s)) return { kind: 'literal', value: s };
+  // Taint-recall PRD (80%): same unanchored-prefix defect as the
+  // interpolation branch above, one layer down — `/^"/.test(s)` only checks
+  // that `s` STARTS with a quote, not that it IS (only) a closed literal.
+  // For `"literal" . $id`, this fallback used to catch what the (now fixed)
+  // interpolation branch missed and swallow the ENTIRE concat expression —
+  // trailing ` . $id` included — into one opaque literal `value` string,
+  // silently dropping `$id`'s taint just as badly, only one level later.
+  // Anchored at both ends so a genuinely unclosed/concatenated string falls
+  // through to the concat branch below instead of being misread as whole.
+  if (/^"(?:[^"\\]|\\.)*"$/.test(s) || /^'(?:[^'\\]|\\.)*'$/.test(s)) return { kind: 'literal', value: s };
   if (/^\d/.test(s)) return { kind: 'literal', value: s };
   if (/^(true|false|null|NULL)\b/.test(s)) return { kind: 'literal', value: s };
   // Superglobals
@@ -328,12 +387,13 @@ function _lowerExpr(text) {
   if (methodCall) {
     const callee = methodCall.callee.replace(/->/g, '.').replace(/::/g, '.');
     const args = _splitTopLevelCommas(methodCall.argsText).map(_lowerExpr);
-    return { kind: 'call', callee, args };
+    return _followChain(s, methodCall.endIdx, callee, args);
   }
   // Function call: func(args)
   const funcCall = matchBalancedCall(s, /^([A-Za-z_][\w]*)/);
   if (funcCall) {
-    return { kind: 'call', callee: funcCall.callee, args: _splitTopLevelCommas(funcCall.argsText).map(_lowerExpr) };
+    const args = _splitTopLevelCommas(funcCall.argsText).map(_lowerExpr);
+    return _followChain(s, funcCall.endIdx, funcCall.callee, args);
   }
   // Concat with .
   //
@@ -418,6 +478,19 @@ function _lowerStmt(stmt, line) {
   if (/^throw\b/.test(s)) {
     return { kind: 'throw', line, value: _lowerExpr(s.replace(/^throw\s+/, '')) };
   }
+  // Taint-recall PRD (80%): `echo`/`print` are PHP LANGUAGE CONSTRUCTS, not
+  // function calls — `echo "<div>" . $_GET['q'] . "</div>";` has no `(`
+  // immediately after the keyword, so the statement-form call regex below
+  // never matched it, and the entire echoed expression (including any
+  // reflected taint) was silently dropped. `echo` can take multiple
+  // comma-separated expressions; lowered to a synthetic call
+  // (`__php_echo__`) carrying each as an argument, so a normal callee-keyed
+  // catalog sink can target it exactly like any other call-shaped sink —
+  // same convention as parser-rb.js's `__ruby_backtick_exec__`.
+  if (/^(?:echo|print)\b/.test(s)) {
+    const rest = s.replace(/^(?:echo|print)\s*/, '');
+    return { kind: 'call', line, callee: '__php_echo__', args: _splitTopLevelCommas(rest).map(_lowerExpr) };
+  }
   // Assignment: $var = expr
   const assign = s.match(/^(\$[\w]+(?:->[\w]+)*)\s*=\s*(.+)$/s);
   if (assign) {
@@ -427,11 +500,26 @@ function _lowerStmt(stmt, line) {
   const call = matchBalancedCall(s, /^(\$[\w]+(?:->[\w]+)*|[A-Za-z_][\w]*(?:::[\w]+)*)/);
   if (call) {
     const callee = call.callee.replace(/->/g, '.').replace(/::/g, '.');
-    return { kind: 'call', line, callee, args: _splitTopLevelCommas(call.argsText).map(_lowerExpr) };
+    const chained = _followChain(s, call.endIdx, callee, _splitTopLevelCommas(call.argsText).map(_lowerExpr));
+    return { kind: 'call', line, callee: chained.callee, args: chained.args };
   }
   return null;
 }
 
+// Taint-recall PRD (80%): `_extractBody` used to have ZERO comment
+// awareness — worse than `_splitStatements` below, which at least skips
+// `//`/`/* */` (though not `#`). An apostrophe inside ANY comment (`//`,
+// `#`, or `/* */`) — "don't", "it's", "won't", all extremely common in real
+// PHP — toggled `inStr` exactly as if a string literal had started. Every
+// `{`/`}` from that point on was then invisible to depth-tracking until a
+// SECOND apostrophe was found (typically much later, or never), so `depth`
+// either never returns to 0 (the function's body extraction fails outright,
+// returning `null` — silently dropping the ENTIRE FILE's IR, since a single
+// failed top-level function match corrupts every span downstream of it) or
+// returns to 0 at the wrong `}` (extracting a truncated or over-extended
+// body). Now skips all three PHP comment forms exactly like
+// `_splitStatements` already does for `//`/`/* */`, plus `#` (PHP 8
+// attributes `#[...]` are NOT a comment — checked via the next character).
 function _extractBody(src, openBrace) {
   let depth = 1;
   let i = openBrace + 1;
@@ -445,6 +533,20 @@ function _extractBody(src, openBrace) {
       if (c === inStr) inStr = null;
       i++; continue;
     }
+    if (c === '/' && src[i + 1] === '/') {
+      while (i < src.length && src[i] !== '\n') i++;
+      continue;
+    }
+    if (c === '#' && src[i + 1] !== '[') {
+      while (i < src.length && src[i] !== '\n') i++;
+      continue;
+    }
+    if (c === '/' && src[i + 1] === '*') {
+      i += 2;
+      while (i < src.length && !(src[i] === '*' && src[i + 1] === '/')) i++;
+      if (i < src.length) i += 2;
+      continue;
+    }
     if (c === '"' || c === '\'') { inStr = c; i++; continue; }
     if (c === '{') depth++;
     else if (c === '}') depth--;