@clear-capabilities/agentic-security-scanner 0.137.1 → 0.139.1

package/src/dataflow/engine.js

@@ -65,6 +65,27 @@ import { resolveMethod, classOfVar } from '../ir/class-hierarchy.js';
 // AGENTIC_SECURITY_POINTS_TO=1).
 function _addPathAliasAware(state, path, callContext) {
   let s = addPath(state, path);
+  // T3.3 — a write through an UNKNOWN key taints the whole container.
+  //
+  // `parser-js.js` lowers a computed write whose key is not a literal
+  // (`bag[k] = tainted`) to the access path `bag.*`, and — as that parser's own
+  // comment states — `'*'` is a LITERAL property name here, not a
+  // match-anything token. `isCoveredBy` only propagates DOWN from a prefix, so
+  // `bag.*` covers nothing: a later read of `bag.anything` resolves to a
+  // different path entirely and the taint is unreachable from every correctly
+  // computed read.
+  //
+  // Since the key is statically unknown, the write may have landed on ANY
+  // property, so the sound abstraction is the container itself. Widening to the
+  // base is what makes the value observable again, and it is the same
+  // over-approximate direction the lattice already takes at branch joins.
+  //
+  // Scoped deliberately to a TRAILING `.*`. An interior wildcard
+  // (`bag.*.inner`) still describes a definite final property and does not
+  // justify tainting the root.
+  if (typeof path === 'string' && path.length > 2 && path.endsWith('.*')) {
+    s = addPath(s, path.slice(0, -2));
+  }
   const pt = callContext && callContext._pointsTo;
   const fnQid = callContext && callContext._currentFnQid;
   if (!pt || !fnQid || typeof path !== 'string') return s;
@@ -268,7 +289,7 @@ function _nestedCallReturnTainted(calleeExpr, argExprs, state, callContext) {
   const { qid, fn } = target;
   const paramNames = (fn && Array.isArray(fn.params)) ? fn.params : [];
   const entry = paramNames.length
-    ? entryStateFromCall(paramNames, argExprs || [], state)
+    ? entryStateFromCall(paramNames, argExprs || [], state, (a) => exprTaint(a, state, callContext))
     : new Set();
   let sum = callContext._summaryCache.get(qid, entry);
   if (!sum && fn && fn.cfg) {
@@ -294,8 +315,32 @@ function _nestedCallReturnTainted(calleeExpr, argExprs, state, callContext) {
   return !!(sum && sum.returnTainted);
 }
 
+// Taint-recall PRD (80%): is a call's own RECEIVER tainted? Handles the two
+// distinct shapes this codebase's IR frontends use for a call's `callee`:
+// parser-js.js (Babel) emits a structured {kind:'member', object, prop}
+// node, so the receiver is `callee.object`, checked via a normal exprTaint
+// recursion. parser-cs.js/parser-go.js/parser-kt.js/parser-php.js/
+// parser-rb.js/parser-java.js/parser-py.js instead emit a flat, dot-joined
+// STRING callee ("it.toString", "user.getName") — there is no sub-expression
+// to recurse into, so the receiver is recovered by slicing off the string
+// after its LAST '.' and checking that prefix directly against the access-
+// path lattice via `isCoveredBy` (handles both a bare var and a longer
+// chain, e.g. "req.session.user.toString" -> receiver "req.session.user").
+function _calleeReceiverTainted(callee, state, callContext) {
+  if (!callee) return false;
+  if (typeof callee === 'string') {
+    const idx = callee.lastIndexOf('.');
+    if (idx <= 0) return false;
+    return isCoveredBy(state, callee.slice(0, idx));
+  }
+  if (callee.kind === 'member' && callee.object) {
+    return exprTaint(callee.object, state, callContext);
+  }
+  return false;
+}
+
 function exprTaint(expr, state, callContext) {
-  if (expr && (expr.kind === 'member' || expr.kind === 'call') && exprIsSource(expr)) return true;
+  if (expr && (expr.kind === 'member' || expr.kind === 'call' || expr.kind === 'ident') && exprIsSource(expr)) return true;
   if (!expr) return false;
   // Constant propagation: variables assigned from literals are never tainted
   if (expr.kind === 'ident' && _activeConstantVars && _activeConstantVars.has(expr.name)) return false;
@@ -314,12 +359,44 @@ function exprTaint(expr, state, callContext) {
     case 'object':            return (expr.props || []).some(p => exprTaint(p.value, state, callContext));
     case 'array':             return (expr.elements || []).some(e => exprTaint(e, state, callContext));
     case 'call': {
-      // The call's own arguments (unchanged from before) OR — PRD R10 — the
-      // resolved callee's own return-taint summary. Args-tainted is checked
-      // FIRST and short-circuits: it's the cheap, no-resolve-attempt case and
-      // was already correct.
-      if ((expr.args || []).some(a => exprTaint(a, state, callContext))) return true;
-      return _nestedCallReturnTainted(expr.callee, expr.args, state, callContext);
+      // The call's own arguments OR — PRD R10 — the resolved callee's own
+      // return-taint summary. Taint-recall PRD (80%): this used to
+      // short-circuit on args-tainted and SKIP _nestedCallReturnTainted
+      // entirely — but that call's real job isn't just the boolean it
+      // returns, it's the _mergeSummaryFindings side effect that surfaces
+      // the CALLEE's own internal sink findings (e.g. `return
+      // helper(taintedArg)` where `helper`'s body itself contains
+      // `sink(param)`). Short-circuiting on "args are tainted" (the
+      // overwhelmingly common interprocedural shape — a tainted value IS
+      // usually passed as an argument) silently dropped exactly the
+      // findings this mechanism exists to surface. Confirmed via direct
+      // fixture debugging (PHP: `$name = get_name(); return
+      // find_user($doc, $name);` produced zero findings until this fix,
+      // even though find_user's own body has a cataloged sink fed by
+      // $name) — not language-specific, this is generic exprTaint logic.
+      // Both sides always evaluated now (no short-circuit either
+      // direction) so the merge always runs when a call expression is
+      // visited; _resolveCalleeForSummary + SummaryCache make repeat
+      // resolution/computation for the same (qid, entry-state) cheap.
+      const argsTainted = (expr.args || []).some(a => exprTaint(a, state, callContext));
+      const nestedTainted = _nestedCallReturnTainted(expr.callee, expr.args, state, callContext);
+      // Taint-recall PRD (80%): a call's RECEIVER can itself be tainted
+      // independent of its arguments — `tainted.toString()`, `tainted.trim()`,
+      // `it.getBytes()` — and neither argsTainted (there are no/unrelated
+      // args) nor nestedTainted (that resolves a FUNCTION-NAME callee via the
+      // call graph; a bare method name like "toString" never resolves) sees
+      // it. Confirmed via `req.getBytes()` (Java @RequestBody InputStream) and
+      // the general shape this codebase's five hand-rolled parsers all
+      // produce for a chained call: `expr.callee` there is a flat DOT-JOINED
+      // STRING ("it.toString"), not a structured {kind:'member', object,
+      // prop} node like parser-js.js emits — so the two shapes need distinct
+      // handling. Deliberately receiver-taint-propagates for ANY call on a
+      // tainted receiver (not just no-arg ones): `tainted.replace(a,b)`'s
+      // receiver taint matters exactly as much as `tainted.toString()`'s, and
+      // this is already OR'd with argsTainted so it only WIDENS recall,
+      // matching this engine's recall-preserving precedent everywhere else.
+      const receiverTainted = _calleeReceiverTainted(expr.callee, state, callContext);
+      return argsTainted || nestedTainted || receiverTainted;
     }
     case 'unknown':           return false;
     default:                  return false;
@@ -396,6 +473,24 @@ function exprIsSource(expr) {
     const hit = matchSource(expr, _currentFile);
     if (hit) return hit;
   }
+  // Taint-recall PRD (80%): bare-identifier GLOBAL sources — PHP's $_GET/
+  // $_POST/$_REQUEST/$_SERVER, Ruby's params/cookies/session/ENV, JS's
+  // location — referenced DIRECTLY (not first assigned to a local, not a
+  // member-read off them) were completely unreachable here. matchSource
+  // itself has always supported a bare-ident branch (GLOBAL_INDEX lookup by
+  // the identifier's own name), but neither this function nor exprTaint's
+  // early check ever called it for expr.kind === 'ident' — only
+  // 'member'/'call'. So `header("X: " . $_GET)` (or any shape where a
+  // global is read directly rather than through member/subscript access)
+  // never tainted anything, no matter how the value was actually used.
+  // Confirmed via a real corpus fixture whose PHP parser also mis-splits
+  // `$_GET["trace"]`'s string literal, leaving a bare `$_GET` ident in a
+  // template's parts — this fix makes that residue still count, which is
+  // the right behavior regardless of that separate mis-split bug.
+  if (expr.kind === 'ident') {
+    const hit = matchSource(expr, _currentFile);
+    if (hit) return hit;
+  }
   if (expr.kind === 'member' && expr.object) {
     return exprIsSource(expr.object);
   }
@@ -404,7 +499,6 @@ function exprIsSource(expr) {
 
 const _SQL_KEYWORDS = /\b(SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE|UNION|WHERE|FROM|JOIN|INTO|VALUES|SET|EXEC|EXECUTE)\b/i;
 const _HTML_META = /[<>'"&]|innerHTML|outerHTML|document\.write/;
-const _SHELL_META = /[;|`$(){}]|&&|\|\|/;
 
 function _literalPartsOfExpr(expr) {
   if (!expr) return [];
@@ -421,7 +515,25 @@ function literalSkeletonMatchesFamily(expr, cwe) {
   if (!joined.trim()) return true;
   if (cwe === 'CWE-89' || cwe === 'CWE-943') return _SQL_KEYWORDS.test(joined);
   if (cwe === 'CWE-79') return _HTML_META.test(joined);
-  if (cwe === 'CWE-78') return _SHELL_META.test(joined);
+  // Taint-recall PRD (80%): CWE-78 (command injection) deliberately does NOT
+  // require the STATIC portion of the concat to contain a shell
+  // metacharacter. The SQL/HTML checks above make sense because their sinks
+  // (a generic `.raw()`/`.query()` call, an `innerHTML` assignment) can
+  // legitimately carry non-SQL, non-HTML strings — the skeleton check filters
+  // those out. Command-injection's sink catalog has no such ambiguity: every
+  // CWE-78 entry (`os.system`, `subprocess.call`, `Runtime.exec`,
+  // `child_process.exec`, …) is an unambiguous shell-execution API, so a
+  // tainted argument reaching one is inherently suspicious regardless of what
+  // the static prefix looks like. Requiring a metacharacter in the STATIC
+  // portion gets the vulnerability backwards: the textbook shape is
+  // `exec("ping " + host)` — the attacker supplies the metacharacter via the
+  // TAINTED value, not the template, so the static prefix is legitimately
+  // metacharacter-free in the overwhelmingly common case. Confirmed this was
+  // blocking CVE-2016-10033-java-cmdi's exact real-world shape; found while
+  // investigating this PRD's Java chained-call fix and left deferred until
+  // now, when the corpus's Tier 2/3 audit showed it plausibly gates a large
+  // fraction of the whole command-injection family, not just one entry.
+  if (cwe === 'CWE-78') return true;
   return true;
 }
 
@@ -503,7 +615,7 @@ function _sanitizersForExpr(expr, callContext) {
 // expression (via callContext._taintSources, not the state Set itself).
 // line: source line to attach to any emitted finding.
 // Returns { findings }.
-function _sinkFindingsForCall(calleeExpr, argExprs, cat, argTaints, state, callContext, line) {
+function _sinkFindingsForCall(calleeExpr, argExprs, cat, argTaints, state, callContext, line, callKwargs) {
   const findings = [];
   if (cat) {
     for (const e of cat) {
@@ -516,6 +628,57 @@ function _sinkFindingsForCall(calleeExpr, argExprs, cat, argTaints, state, callC
         const taintedArgExpr = (argExprs || [])[taintedArgIdx];
         // String content analysis: skip if literal skeleton doesn't match injection family
         if (e.vuln && taintedArgExpr && !literalSkeletonMatchesFamily(taintedArgExpr, e.vuln.cwe)) continue;
+        // Taint-recall PRD (80%): `match.requireLiteralArg` — a precision
+        // gate for sinks whose danger depends on a SIBLING argument's
+        // literal value, not the tainted one. Go's `exec.Command(path,
+        // args...)` is only actually shell-interpreted (so a metacharacter
+        // in a tainted arg is dangerous) when `path` is "/bin/sh"/"bash"/
+        // "sh" and the next arg is "-c" — the array-execve form
+        // (`exec.Command("ping", "-c", "1", host)`) never invokes a shell
+        // at all, so `host` becomes one opaque argv element regardless of
+        // its content and is SAFE even when tainted. `argIndex: 'all'`
+        // alone can't express this (it only asks "is ANY arg tainted", not
+        // "is the INVOCATION FORM itself dangerous"). Fails CLOSED on
+        // precision: if the checked arg isn't a literal at all (a
+        // variable — we can't statically know its value), the requirement
+        // is NOT satisfied, same direction proof-gate.js and every other
+        // precision annotator in this codebase take when evidence is
+        // simply unavailable rather than affirmatively clean.
+        if (e.match && e.match.requireLiteralArg) {
+          const { index, pattern } = e.match.requireLiteralArg;
+          const checkArg = (argExprs || [])[index];
+          if (!checkArg || checkArg.kind !== 'literal' || !new RegExp(pattern).test(String(checkArg.value))) continue;
+        }
+        // `match.requireKeyword` — the KEYWORD-argument analogue of the
+        // positional gate above, for languages where the dangerous form is
+        // selected by a named argument rather than a positional literal.
+        //
+        // Python's `subprocess.run(cmd, shell=True)` is command injection;
+        // `subprocess.run([cmd], capture_output=True)` is an argv-array
+        // execve that cannot be, however tainted `cmd` is. requireLiteralArg
+        // cannot express the difference — it matches a POSITIONAL literal,
+        // and shell is a keyword. Measured cost of not having this: enabling
+        // the argparse CLI source surfaced 15 findings across 9 of this
+        // repository's own hand-reviewed scripts, on argv-array calls,
+        // labelled "shell=True".
+        //
+        // Fails CLOSED exactly like requireLiteralArg: a keyword that is
+        // absent, or present but not a statically-known literal matching the
+        // pattern, does NOT satisfy the requirement.
+        if (e.match && e.match.requireKeyword) {
+          const { name, pattern } = e.match.requireKeyword;
+          // A `**opts` splat means the keyword set is not enumerable: we
+          // cannot prove `shell` is absent, so we must not suppress. Failing
+          // closed here would be a FALSE NEGATIVE on a genuinely exploitable
+          // call — bench/cve-replay/deep/py-interproc-cmdi-shape exists
+          // precisely to pin that case (`subprocess.call(cmd, **SHELL_OPTS)`)
+          // and caught this the first time the gate was written without it.
+          const enumerable = !(callKwargs && callKwargs['**']);
+          if (enumerable) {
+            const kw = callKwargs && callKwargs[name];
+            if (!kw || kw.kind !== 'literal' || !new RegExp(pattern).test(String(kw.value))) continue;
+          }
+        }
         // Premortem #10: attribute the source for THIS sink to the
         // source(s) that taint the actual argument expression — not the
         // first source the worklist happened to record. We walk the
@@ -552,6 +715,36 @@ function _sinkFindingsForCall(calleeExpr, argExprs, cat, argTaints, state, callC
   return { findings };
 }
 
+// Taint-recall PRD (80%): a sink call NESTED inside another call's own
+// argument (`render(File.read(tainted))`, Rails' idiomatic wrap-and-render
+// pattern) was invisible to sink-matching entirely. `_sinkFindingsForCall`
+// only ever checks the CFG NODE'S OWN callee/args — a node representing
+// `render(...)` never independently examines whether one of `render`'s OWN
+// arguments is itself a sink-shaped call expression. Confirmed via a real
+// corpus fixture: `File.read` is a correctly-cataloged sink and `name` a
+// correctly-cataloged source, but nested one level inside `render`'s own
+// arg list, neither `case 'call'` nor `case 'assign'` ever checked it — the
+// exact "sink nested inside another call's own argument" limitation
+// documented in this PRD's Ruby/C#/Go/Kotlin corpus notes, now closed for
+// the general case rather than left as a permanent gap. Recall-preserving:
+// walks every arg looking for a nested call expression, checks each
+// independently against the catalog, and recurses further (an arg's arg
+// can itself be a call) — bounded by JS's own call-stack depth on
+// pathologically deep expressions, no explicit cap needed at this level of
+// real-world nesting. Deliberately does NOT re-check the TOP-LEVEL call
+// itself (the caller already did that via its own _matchCallCatalog +
+// _sinkFindingsForCall), so this never duplicates a finding.
+function _nestedSinkFindings(argExprs, state, callContext, line) {
+  const findings = [];
+  for (const arg of (argExprs || [])) {
+    if (!arg || arg.kind !== 'call') continue;
+    const { cat, argTaints } = _matchCallCatalog(arg.callee, arg.args, state, callContext);
+    findings.push(..._sinkFindingsForCall(arg.callee, arg.args, cat, argTaints, state, callContext, line).findings);
+    findings.push(..._nestedSinkFindings(arg.args, state, callContext, line));
+  }
+  return findings;
+}
+
 // PRD R13(a): finding shape for a member-write sink match (el.innerHTML =
 // tainted). Distinct from _sinkFindingsForCall because there is no call
 // argument list to index into — the "argument" of interest is the whole
@@ -639,7 +832,8 @@ function step(node, stateIn, callContext) {
           _matchCallCatalog(node.source.callee, node.source.args, state, callContext);
         findings.push(..._sinkFindingsForCall(
           node.source.callee, node.source.args, _sinkCat, _sinkArgTaints,
-          state, callContext, node.line).findings);
+          state, callContext, node.line, node.source.kwargs).findings);
+        findings.push(..._nestedSinkFindings(node.source.args, state, callContext, node.line));
       }
       // PRD R13(a): the assignment TARGET can itself be a sink shape
       // (el.innerHTML = tainted) — additive to the RHS-call-sink check
@@ -694,7 +888,7 @@ function step(node, stateIn, callContext) {
           const callArgs = (node.source.args || []);
           const paramNames = (fn && Array.isArray(fn.params)) ? fn.params : [];
           const entry = paramNames.length
-            ? entryStateFromCall(paramNames, callArgs, callerTainted)
+            ? entryStateFromCall(paramNames, callArgs, callerTainted, (a) => exprTaint(a, callerTainted, callContext))
             : new Set();
           let sum = callContext._summaryCache.get(qid, entry);
           if (!sum && fn && fn.cfg) {
@@ -825,7 +1019,7 @@ function step(node, stateIn, callContext) {
         if (typeof qid === 'string' && fn && Array.isArray(fn.params)) {
           const paramNames = fn.params;
           const entry = paramNames.length
-            ? entryStateFromCall(paramNames, node.args || [], state)
+            ? entryStateFromCall(paramNames, node.args || [], state, (a) => exprTaint(a, state, callContext))
             : new Set();
           let sum = callContext._summaryCache.get(qid, entry);
           // FR-SEM-2: context-sensitive lazy compute at the plain-call site,
@@ -882,21 +1076,56 @@ function step(node, stateIn, callContext) {
           });
         }
       }
-      // R4 (PRD §5): array-element taint. A mutating array method (push/unshift/
-      // splice/fill/copyWithin) called with a tainted argument taints the
-      // receiver array; an index read (a[0] → access path "a.0") is then covered
-      // by the receiver prefix. Object-property taint already flows via the
-      // access-path lattice — this closes the array case.
-      if (node.callee && node.callee.kind === 'member' && typeof node.callee.prop === 'string'
-          && /^(?:push|unshift|splice|fill|copyWithin)$/.test(node.callee.prop)
-          && Array.isArray(argTaints) && argTaints.some(Boolean)) {
+      // R4 (PRD §5) + T3.3: collection-element taint. A mutating collection
+      // method called with a tainted argument taints the receiver; an index or
+      // key read (`a[0]` → access path "a.0", `m.get(k)` → receiver taint via
+      // _calleeReceiverTainted) is then covered by the receiver prefix.
+      // Object-property taint already flows via the access-path lattice — this
+      // closes the container case.
+      //
+      // R4 covered JS arrays only, in both of its dimensions, and T3.3 widens
+      // each:
+      //   - METHODS: keyed collections mutate through `set`/`add`, and the
+      //     non-JS containers through `append`/`extend`/`insert`/`update`/
+      //     `addAll`/`putAll`/`put`. These are writes exactly as `push` is.
+      //   - CALLEE SHAPE: the `callee.kind === 'member'` test only ever matched
+      //     `parser-js.js` (Babel), the one frontend emitting a structured
+      //     callee. The seven hand-rolled parsers emit a flat dot-joined STRING
+      //     ("items.append"), so Python/Ruby/PHP/Go/Java/C#/Kotlin containers
+      //     never matched at all — measured: python's `items.append(tainted)`
+      //     produced no IR-TAINT finding, and only a PY-SAST pattern rule
+      //     caught the sink, which masked the taint-layer miss entirely. Same
+      //     frontend duality `_calleeReceiverTainted` documents and handles.
+      //
+      // `add`/`put` are deliberately NOT extended to bare-name calls: the
+      // receiver is what gets tainted, so a call with no receiver has nothing
+      // to taint and is skipped by both branches below.
+      if (Array.isArray(argTaints) && argTaints.some(Boolean)) {
+        // `__setitem__` is not a method anyone writes: `parser-py.js` lowers a
+        // subscript assignment (`bag['k'] = v`, `arr[i] = v`) to a CALL node
+        // with that flat callee rather than to an assign node with a member
+        // target, so it reaches this rule instead of the assign path. The
+        // matching read lowers to `bag.[]`, already covered by the tainted
+        // receiver prefix.
+        const _MUTATORS = /^(?:push|unshift|splice|fill|copyWithin|set|add|append|extend|insert|update|addAll|putAll|put|__setitem__)$/;
         // Mutate the state Set IN PLACE (the binding is const; the call case
-        // returns this same Set ref). Avoids touching the unrelated mutated-param
-        // paths in this case, keeping the blast radius to array-element taint only.
-        const _arrRecv = accessPathOf(node.callee.object);
-        if (_arrRecv) state.add(_arrRecv);
+        // returns this same Set ref). Avoids touching the unrelated
+        // mutated-param paths in this case, keeping the blast radius to
+        // collection-element taint only.
+        let _recv = null;
+        if (node.callee && node.callee.kind === 'member' && typeof node.callee.prop === 'string'
+            && _MUTATORS.test(node.callee.prop)) {
+          _recv = accessPathOf(node.callee.object);
+        } else if (typeof _plainCallCalleeName === 'string') {
+          const _dot = _plainCallCalleeName.lastIndexOf('.');
+          if (_dot > 0 && _MUTATORS.test(_plainCallCalleeName.slice(_dot + 1))) {
+            _recv = _plainCallCalleeName.slice(0, _dot);
+          }
+        }
+        if (_recv) state.add(_recv);
       }
-      findings.push(..._sinkFindingsForCall(node.callee, node.args, cat, argTaints, state, callContext, node.line).findings);
+      findings.push(..._sinkFindingsForCall(node.callee, node.args, cat, argTaints, state, callContext, node.line, node.kwargs).findings);
+      findings.push(..._nestedSinkFindings(node.args, state, callContext, node.line));
       // 2. P1.3 — higher-order taint flow. When the call is `arr.map(fn)` or
       //    `promise.then(fn)` and the receiver is tainted, propagate taint
       //    into the callback's first parameter. v1: we propagate AT THE
@@ -960,6 +1189,25 @@ function step(node, stateIn, callContext) {
     }
 
     case 'return': {
+      // Taint-engine PRD P1: `return sink(x)` was invisible — this only ever
+      // asked whether the returned value is TAINTED (for interprocedural
+      // callers, below), never whether the call expression itself is a sink.
+      // JS is accidentally immune (Babel emits a redundant standalone 'call'
+      // node for every CallExpression, including ones nested in a return
+      // argument, so case 'call' above already caught it there). Every
+      // hand-rolled parser does not do that, so `return
+      // File.ReadAllText(path)` — idiomatic ASP.NET Core — was structurally
+      // blind. Mirrors case 'call''s sink-check exactly; deliberately does
+      // NOT mirror its summary-cache/mutation/higher-order machinery, which
+      // is about a callee's OWN internal findings and mutated params — an
+      // unrelated concern from whether this return statement's own call
+      // expression is directly a sink.
+      if (node.value && node.value.kind === 'call') {
+        const { cat, argTaints } = _matchCallCatalog(node.value.callee, node.value.args, state, callContext);
+        findings.push(..._sinkFindingsForCall(
+          node.value.callee, node.value.args, cat, argTaints, state, callContext, node.line, node.value.kwargs).findings);
+        findings.push(..._nestedSinkFindings(node.value.args, state, callContext, node.line));
+      }
       if (exprTaint(node.value, state, callContext)) {
         callContext._returnTainted = true;
       }

package/src/dataflow/summaries.js

@@ -214,20 +214,45 @@ function _summaryEq(a, b) {
 // Build the entry-taint-state for a callee from a call site:
 //   given the callee's param names + the caller's tainted-var set + the
 //   call args, return a Set of param names that are tainted at entry.
-export function entryStateFromCall(paramNames, callArgs, callerTaintedVars) {
+//
+// `isArgTaintedExpr` (optional) — Taint-recall PRD (80%): the ident/member
+// checks above only recognize an arg that is (or reads off) an ALREADY
+// state-tracked local variable. A source used directly INLINE as a call
+// argument — `helper(request.getParameter("id"))`, never first assigned to
+// a local — has no entry in `callerTaintedVars` at all (that set tracks
+// variable PROVENANCE via assignment, not "is this arbitrary expression a
+// source when evaluated"), so it was silently invisible here even though
+// the engine's own exprTaint/exprIsSource would recognize it immediately.
+// Confirmed via a real corpus fixture: `find_user($doc, $_GET['name'])`
+// with no intermediate variable produced zero interprocedural findings.
+// Callers pass a closure over their own exprTaint (this module has no
+// access to matchSource/exprIsSource — engine.js does) rather than this
+// module reaching across the layering boundary. Falls back to the
+// ident/member-only checks above when not provided, so every other caller
+// of this function is unaffected.
+export function entryStateFromCall(paramNames, callArgs, callerTaintedVars, isArgTaintedExpr) {
   const out = new Set();
   if (!Array.isArray(paramNames) || !Array.isArray(callArgs)) return out;
   for (let i = 0; i < paramNames.length && i < callArgs.length; i++) {
     const arg = callArgs[i];
     if (!arg) continue;
+    // Each check is independent — arg SHAPE (ident vs. member) selecting a
+    // branch must not skip the fallback when that branch's own membership
+    // check comes back false. An earlier version used if/else-if keyed on
+    // shape alone, so `helper($_GET['name'])` (a member arg whose base
+    // "$_GET" is never itself in callerTaintedVars — that set tracks
+    // ASSIGNED locals, not raw globals) took the member branch, found
+    // nothing, and — being an else-if — never reached isArgTaintedExpr at
+    // all. Confirmed via a real corpus fixture.
+    let tainted = false;
     if (arg.kind === 'ident' && callerTaintedVars.has(arg.name)) {
-      out.add(paramNames[i]);
+      tainted = true;
     } else if (arg.kind === 'member' && arg.object?.kind === 'ident') {
       const base = arg.object.name;
-      if (callerTaintedVars.has(base) || callerTaintedVars.has(`${base}.${arg.prop}`)) {
-        out.add(paramNames[i]);
-      }
+      if (callerTaintedVars.has(base) || callerTaintedVars.has(`${base}.${arg.prop}`)) tainted = true;
     }
+    if (!tainted && typeof isArgTaintedExpr === 'function' && isArgTaintedExpr(arg)) tainted = true;
+    if (tainted) out.add(paramNames[i]);
   }
   return out;
 }