@clear-capabilities/agentic-security-scanner 0.151.3 → 0.152.0

package/src/ir/parser-java.js

@@ -57,6 +57,18 @@ function exprFromCst(node) {
   }
   if (node.children) {
     // CST node with named children — recurse into the most informative one.
+    // Assignment: java-parser models `x = y` (and `x += y`) as a
+    // binaryExpression whose children are {unaryExpression (LHS),
+    // AssignmentOperator, expression (RHS)}. There is no BinaryOperator
+    // token, so this shape previously fell through to the generic
+    // "recurse the first child" branch and lowered to the LHS alone: every
+    // expression-statement assignment in a method body vanished from the CFG.
+    if (node.children.AssignmentOperator) {
+      const op = node.children.AssignmentOperator[0]?.image || '=';
+      const lhs = node.children.unaryExpression?.[0];
+      const rhs = node.children.expression?.[0];
+      return { kind: 'binary', op, left: exprFromCst(lhs), right: exprFromCst(rhs) };
+    }
     // Method invocation
     if (node.children.methodInvocation) return _methodInvocation(node.children.methodInvocation[0]);
     // `primary` is how java-parser actually models a call: the name lives in
@@ -118,11 +130,47 @@ function exprFromCst(node) {
       // own args ahead of the constructor's, preserving the outermost-first
       // convention.
       const ctorPrefix = prefix?.children?.newExpression?.[0]?.children?.unqualifiedClassInstanceCreationExpression?.[0];
+      // `(new X(args)).m(a)`: the parenthesized-constructor form Juliet's
+      // multi-file flow variants use for every cross-class sink call. The
+      // prefix is a parenthesisExpression wrapping the constructor, so
+      // neither the fqn nor the ctorPrefix branch below sees it and the
+      // chain used to lower to a bare `m` with the class name dropped.
+      // Seed the chain from the inner lowered constructor exactly like the
+      // direct `new X().m()` form so callgraph.js's `Class.method` index
+      // can resolve it.
+      const parenInner = prefix?.children?.parenthesisExpression?.[0]?.children?.expression?.[0];
+      let parenExpr = null;
+      // Tracks whether the chain so far is STILL exactly the bare
+      // constructor call with no method invoked on the result yet — cleared
+      // the moment the suffix loop below consumes a real
+      // methodInvocationSuffix. Only in that still-true state does the
+      // eventual return carry `isNew: true`, matching class-hierarchy.js's
+      // `typeOfVar` contract (`b.action(data)` for `A_81_base b = new
+      // A_81_bad();` needs the RHS lowered with isNew so allocation-typed
+      // dispatch can resolve `b`'s declared type); `(new B()).badSink(x)`
+      // must NOT carry it, since the resulting call IS `B.badSink`, not a
+      // constructor.
+      let isCtorSeed = false;
       if (fqn) {
         chainCallee = _flattenFqnToString(fqn);
       } else if (ctorPrefix) {
-        chainCallee = ctorPrefix.children?.classOrInterfaceTypeToInstantiate?.[0]?.children?.Identifier?.[0]?.image || '';
+        chainCallee = _ctorClassName(ctorPrefix);
         chainArgs = (ctorPrefix.children?.argumentList?.[0]?.children?.expression || []).map(exprFromCst);
+        isCtorSeed = true;
+      } else if (parenInner) {
+        parenExpr = exprFromCst(parenInner);
+        if (parenExpr.kind === 'call' && parenExpr.isNew) {
+          chainCallee = parenExpr.callee;
+          chainArgs = parenExpr.args || [];
+          isCtorSeed = true;
+        } else if (!suffixes.length) {
+          return parenExpr;
+        } else {
+          // `(a + b).toString()`: no textual receiver name exists. Carry the
+          // inner expression as an extra argument so its taint still reaches
+          // the chained call (recall-preserving, mirrors receiver-taint).
+          chainArgs = [parenExpr];
+        }
       }
       // No FQN/constructor prefix — e.g. `this.foo(x)`, `super.foo(x)`
       // (prefix is a keyword expression). chainCallee starts empty; the
@@ -140,16 +188,30 @@ function exprFromCst(node) {
           appendPending();
           const args = (inv.children?.argumentList?.[0]?.children?.expression || []).map(exprFromCst);
           chainArgs = chainArgs === null ? args : args.concat(chainArgs);
+          isCtorSeed = false; // a real method is now being invoked on the constructed object
           continue;
         }
         const ident = suf.children?.Identifier?.[0]?.image;
-        if (ident) pendingName.push(ident);
+        if (ident) { pendingName.push(ident); isCtorSeed = false; }
       }
       if (chainArgs !== null) {
         appendPending(); // a trailing member access after the last call (e.g. a field read)
-        return { kind: 'call', callee: chainCallee || 'unknown', args: chainArgs };
+        return { kind: 'call', callee: chainCallee || 'unknown', args: chainArgs, ...(isCtorSeed ? { isNew: true } : {}) };
       }
-      return exprFromCst(prefix);
+      // No call anywhere in the chain: a plain member read such as
+      // `this.inst` or `obj.field` (an fqn prefix already lowers to a member
+      // chain on its own; this covers the `this`/`super`/parenthesized
+      // prefix shapes whose member suffixes were previously discarded).
+      if (pendingName.length) {
+        let cur = parenExpr || exprFromCst(prefix);
+        for (const p of pendingName) cur = { kind: 'member', object: cur, prop: p };
+        return cur;
+      }
+      return parenExpr || exprFromCst(prefix);
+    }
+    if (node.children.parenthesisExpression) {
+      const inner = node.children.parenthesisExpression[0]?.children?.expression?.[0];
+      if (inner) return exprFromCst(inner);
     }
     // Taint-recall PRD (80%): a cast expression — `(String) xp.evaluate(...)`,
     // `(int) computeVal(x)` — was falling through to the generic "recurse the
@@ -175,7 +237,7 @@ function exprFromCst(node) {
     if (node.children.fqnOrRefType) return _fqnExpr(node.children.fqnOrRefType[0]);
     if (node.children.unqualifiedClassInstanceCreationExpression) {
       const ci = node.children.unqualifiedClassInstanceCreationExpression[0];
-      const callee = (ci.children?.classOrInterfaceTypeToInstantiate?.[0]?.children?.Identifier?.[0]?.image) || 'new';
+      const callee = _ctorClassName(ci) || 'new';
       // Taint-recall PRD (80%): args was hardcoded to [] — every
       // `new X(arg1, arg2)` constructor call lowered with its arguments
       // silently discarded, so a sink modeled as a constructor call
@@ -260,6 +322,231 @@ function _fqnIdents(node) {
   return out;
 }
 
+const _ASSIGN_OPS = new Set(['=', '+=', '-=', '*=', '/=', '%=', '&=', '|=', '^=', '<<=', '>>=', '>>>=']);
+function _isAssignment(expr) {
+  return !!expr && expr.kind === 'binary' && _ASSIGN_OPS.has(expr.op);
+}
+
+// Dotted access-path string for a member chain rooted at an identifier or
+// `this`; null when the chain is rooted at something with no name (a call
+// result, a literal).
+function _memberPath(expr) {
+  if (!expr) return null;
+  if (expr.kind === 'ident') return expr.name;
+  if (expr.kind === 'member') {
+    const base = _memberPath(expr.object);
+    return base ? `${base}.${expr.prop}` : null;
+  }
+  return null;
+}
+
+// Targets for one lowered assignment LHS. See emitAssignment for why a
+// field write yields a bare alias alongside its qualified path.
+function _assignTargets(left) {
+  const path = _memberPath(left);
+  if (!path) return [];
+  if (!path.includes('.')) return [path];
+  const segs = path.split('.');
+  const out = [path];
+  if (segs.length === 2 && (segs[0] === 'this' || /^[A-Z]/.test(segs[0]))) out.push(segs[1]);
+  return out;
+}
+
+// { name, line, bases, fields } for one class/interface declaration node.
+// `classType` (extends) and each `interfaceType` (implements) both bottom
+// out at a plain `Identifier` array — a fully-qualified supertype
+// (`extends java.util.AbstractList`) yields multiple Identifier tokens, of
+// which only the LAST is the actual type name, matching `_ctorClassName`'s
+// same convention. Field names come from every `fieldDeclaration`'s
+// `variableDeclaratorList` directly under `classBody` — one declaration can
+// name several comma-separated fields (`private String inst, other;`).
+function _classRecord(node, name) {
+  const bases = [];
+  const extendsIds = node.children?.classExtends?.[0]?.children?.classType?.[0]?.children?.Identifier;
+  if (Array.isArray(extendsIds) && extendsIds.length) bases.push(extendsIds[extendsIds.length - 1].image);
+  const interfaceTypes = node.children?.classImplements?.[0]?.children?.interfaceTypeList?.[0]?.children?.interfaceType || [];
+  for (const it of interfaceTypes) {
+    const ids = it.children?.classType?.[0]?.children?.Identifier;
+    if (Array.isArray(ids) && ids.length) bases.push(ids[ids.length - 1].image);
+  }
+  const fields = [];
+  const classBody = node.children?.classBody?.[0];
+  for (const cbd of classBody?.children?.classBodyDeclaration || []) {
+    const fd = cbd.children?.classMemberDeclaration?.[0]?.children?.fieldDeclaration?.[0];
+    const declarators = fd?.children?.variableDeclaratorList?.[0]?.children?.variableDeclarator || [];
+    for (const d of declarators) {
+      const fname = d.children?.variableDeclaratorId?.[0]?.children?.Identifier?.[0]?.image;
+      if (fname) fields.push(fname);
+    }
+  }
+  return { name, line: _lineOf(node), bases, fields };
+}
+
+// W2 (SARD_80_F1_EXECUTION_PRD.md) — exception-message taint (was the
+// documented-but-deferred "Try/catch -> exception-flow scaffolding (P3.4
+// will model)" gap at the top of this file). Juliet's CWE-81 "XSS Error
+// Message" idiom throws a `new Exception(tainted)` inside a `try` and
+// reflects it back via `catch (Exception e) { ...e.getMessage()... }` —
+// completely invisible without this, since `throw`/`catch` is pure
+// control flow in this IR with no data link between the thrown value and
+// the caught variable. Recursively collects every `throwStatement`'s
+// expression anywhere within a CST subtree (permissive: does not match
+// the thrown type against the catch clause's declared type, since
+// Juliet's dominant shape is one throw + one matching catch per method,
+// and a wrong-type over-match only widens recall, it can't fabricate a
+// source that wasn't already tainted). Does not descend into a nested
+// class or lambda body (a distinct scope with its own catch semantics).
+function _collectThrowExprs(node, out, depth = 0) {
+  if (!node || typeof node !== 'object' || depth > 40) return;
+  if (node.name === 'throwStatement') {
+    const expr = node.children?.expression?.[0];
+    if (expr) out.push(exprFromCst(expr));
+    return;
+  }
+  if (node.name === 'classDeclaration' || node.name === 'lambdaExpression') return;
+  for (const k of Object.keys(node.children || {})) {
+    const arr = node.children[k];
+    if (!Array.isArray(arr)) continue;
+    for (const child of arr) _collectThrowExprs(child, out, depth + 1);
+  }
+}
+
+// The simple class name of a `new X(...)` expression. A fully-qualified
+// instantiation (`new java.util.LinkedList<String>()`) carries one Identifier
+// token per package segment plus the class, so taking the FIRST token
+// yielded "java"; the class is always the LAST segment, and type arguments
+// live under a separate typeArgumentsOrDiamond child that is simply not
+// consulted.
+// Ported from parser-cs.js's identical mechanism (see its own header comment
+// for the full rationale). Closes Juliet's dominant abstract/interface
+// dispatch idiom (flow variants 81/82): `A_81_base b = new A_81_bad();
+// b.action(data);` lowers `b.action`'s callee to the local-variable-named
+// string `"b.action"`, which `callgraph.js`'s `classMethods` index (keyed by
+// real class name, `"A_81_bad.action"`) can never match. Since a variable's
+// constructed type is unambiguous within one function (once assigned via a
+// `{kind:'call', isNew:true}` source — see emitAssignment/isCtorSeed above),
+// rewriting `b.action` to `A_81_bad.action` in place lets the EXISTING
+// project-wide `classMethods` index resolve it with no engine changes.
+// Refuses to guess when a variable is (re)assigned two distinct constructed
+// types in the same function, matching this file's own `bareTailInFile`
+// ambiguity-refusal convention elsewhere.
+// SARD_80_F1 W2.3 — JDK collection/container types are NEVER entries in
+// `callgraph.js`'s `classMethods` index (that index is built from this
+// PROJECT's own `ir.classes`, never JDK builtins), so class-qualifying a
+// call to one of these buys the dispatch-resolution mechanism nothing —
+// while actively BREAKING collection-element taint tracking. Found via a
+// direct CFG dump: `ArrayList<String> list = new ArrayList<>(); list.add(data);
+// for (String s : list) { sink(s); }` rewrites `list.add` to `ArrayList.add`
+// (mutating the callee string in place, so the taint engine's mutator rule
+// — engine.js's `_MUTATORS` — records the taint under the FAKE receiver key
+// "ArrayList" instead of the real variable "list"), but the for-each's own
+// synthesized loop-variable binding (`s = list`, a bare IDENTIFIER
+// reference, never itself a `call` node) is NEVER touched by this rewrite —
+// there is no callee to rewrite on a bare ident. The write and the read end
+// up keyed on two DIFFERENT names ("ArrayList" vs "list"), and the taint is
+// silently lost. `map.values()`-style for-each reads happened to keep
+// working by accident: that read is ALSO a call (`map.values()` also gets
+// rewritten to `LinkedHashMap.values()`), so write and read stay
+// consistently (if wrongly) keyed on the same class name — a coincidence
+// that does not hold for the far more common bare-variable for-each shape.
+//
+// SARD_80_F1 W5.32 — the SAME defect class, for a NON-container JDK utility
+// wrapper: `StringTokenizer tok = new StringTokenizer(request.getQueryString(),
+// "&"); data = tok.nextToken();` (Juliet's dominant "parse a request field
+// without getParameter()" source idiom, used across dozens of CWE test-case
+// families) rewrites `tok.nextToken` to `StringTokenizer.nextToken` for the
+// exact reason given above — `StringTokenizer` is never a project class, so
+// the rewrite buys `classMethods` nothing, while `_calleeReceiverTainted`
+// (engine.js) can no longer recognize `tok` as tainted, since the taint state
+// was recorded under the variable name, not the class name. Confirmed via a
+// direct CFG dump reproducing the exact bug (`tok.nextToken` silently became
+// `StringTokenizer.nextToken`), then a real real-corpus `runScan` reproduction
+// showing zero findings before the fix. Generalizing the FIX from "containers
+// only" to "any well-known JDK/stdlib type with no chance of being a project
+// class" rather than special-casing `StringTokenizer` alone, since this is
+// evidence that the whole rewrite mechanism's risk applies to any non-project
+// class, not just collections — this list covers the other common
+// wrapper/reader/parser JDK types whose own methods return or carry data
+// derived from a tainted constructor argument, the same shape that made
+// `StringTokenizer` a real gap.
+const _JDK_CONTAINER_TYPES = /^(?:List|ArrayList|LinkedList|Vector|Stack|CopyOnWriteArrayList|Map|HashMap|LinkedHashMap|TreeMap|Hashtable|ConcurrentHashMap|Properties|Set|HashSet|LinkedHashSet|TreeSet|CopyOnWriteArraySet|Queue|Deque|ArrayDeque|PriorityQueue|ConcurrentLinkedQueue|ConcurrentLinkedDeque|BlockingQueue|LinkedBlockingQueue|Collection|StringTokenizer|Scanner|BufferedReader|InputStreamReader|StringReader|StringBuilder|StringBuffer|ObjectInputStream|ObjectOutputStream|PrintWriter|PrintStream)$/;
+
+function _localVarConstructedTypes(nodes) {
+  const varTypes = new Map(); // varName -> className | null (ambiguous)
+  for (const node of Object.values(nodes)) {
+    if (node.kind !== 'assign') continue;
+    const src = node.source;
+    if (!src || src.kind !== 'call' || !src.isNew || typeof src.callee !== 'string') continue;
+    if (_JDK_CONTAINER_TYPES.test(src.callee)) continue;
+    const varName = node.target;
+    if (!varName || varName.includes('.')) continue; // only a bare local, never a field-write target
+    if (varTypes.has(varName)) {
+      if (varTypes.get(varName) !== src.callee) varTypes.set(varName, null);
+    } else {
+      varTypes.set(varName, src.callee);
+    }
+  }
+  // A local's DECLARED type (`PrintWriter out = response.getWriter();`) is
+  // deliberately NOT folded into this rewrite. This function's rewrite is a
+  // destructive STRING REPLACEMENT of the callee (`out.println` -> literally
+  // `PrintWriter.println`) applied everywhere the call appears — and MANY
+  // existing catalog entries key `match.receiver` on the ORIGINAL variable
+  // NAME convention (e.g. an XPath sink scoped to `receiver: '^(?:xp|xpath)$'`
+  // for `XPath xp = XPathFactory.newInstance().newXPath(); xp.evaluate(...)`).
+  // A first attempt folded declared types in here and broke that exact case
+  // (`test/java-taint-flow.test.js`'s cast-wrapped XPath test went from firing
+  // to silent) — confirmed by direct regression, not theorized. Declared-type
+  // resolution belongs in `class-hierarchy.js`'s `typeOfVar` instead (see its
+  // `fn.paramTypes` seeding below `buildClassHierarchy`), which is consulted
+  // ADDITIVELY via `match.receiverTypeIn`/`_receiverTypeConfirms` — a type
+  // match there can only ADD a finding a name-based entry missed, never
+  // replace the string a name-based entry still needs to see.
+  return varTypes;
+}
+
+function _rewriteVarTypeCallees(expr, varTypes) {
+  if (!expr || typeof expr !== 'object') return;
+  if (expr.kind === 'call') {
+    if (typeof expr.callee === 'string') {
+      const dot = expr.callee.indexOf('.');
+      if (dot > 0) {
+        const varName = expr.callee.slice(0, dot);
+        const cls = varTypes.get(varName);
+        if (cls) expr.callee = `${cls}${expr.callee.slice(dot)}`;
+      }
+    }
+    if (Array.isArray(expr.args)) for (const a of expr.args) _rewriteVarTypeCallees(a, varTypes);
+    return;
+  }
+  if (expr.kind === 'member') { _rewriteVarTypeCallees(expr.object, varTypes); return; }
+  if (expr.kind === 'binary' || expr.kind === 'logical') {
+    _rewriteVarTypeCallees(expr.left, varTypes); _rewriteVarTypeCallees(expr.right, varTypes); return;
+  }
+  if (expr.kind === 'tpl' && Array.isArray(expr.parts)) { for (const p of expr.parts) _rewriteVarTypeCallees(p, varTypes); return; }
+  if (expr.kind === 'union' && Array.isArray(expr.branches)) { for (const b of expr.branches) _rewriteVarTypeCallees(b, varTypes); return; }
+  if (expr.kind === 'array' && Array.isArray(expr.elements)) { for (const e of expr.elements) _rewriteVarTypeCallees(e, varTypes); return; }
+}
+
+function _applyVarTypeRewrite(nodes) {
+  const varTypes = _localVarConstructedTypes(nodes);
+  let any = false;
+  for (const t of varTypes.values()) if (t) { any = true; break; }
+  if (!any) return;
+  for (const node of Object.values(nodes)) {
+    if (node.kind === 'call') _rewriteVarTypeCallees(node, varTypes);
+    else if (node.kind === 'assign') _rewriteVarTypeCallees(node.source, varTypes);
+    else if (node.kind === 'return' || node.kind === 'throw') _rewriteVarTypeCallees(node.value, varTypes);
+    else if (node.kind === 'if') _rewriteVarTypeCallees(node.cond, varTypes);
+  }
+}
+
+// The simple class name of a `new X(...)` expression.
+function _ctorClassName(ci) {
+  const ids = ci?.children?.classOrInterfaceTypeToInstantiate?.[0]?.children?.Identifier;
+  if (!Array.isArray(ids) || !ids.length) return '';
+  return ids[ids.length - 1].image || '';
+}
+
 function _fqnExpr(node) {
   if (!node || !node.children) return { kind: 'unknown' };
   const idImages = _fqnIdents(node);
@@ -340,6 +627,40 @@ function buildCfgFromBody(bodyNode) {
     return id;
   }
 
+  // Lower one assignment expression (already through exprFromCst) to CFG
+  // assign node(s). A compound operator (`+=`) reads the target too, so its
+  // source is a tpl of [target, rhs], the same shape string interpolation
+  // lowers to. Field writes emit a bare alias next to the qualified target:
+  // `this.f = v` is read back as `f` elsewhere in the class, and a
+  // class-qualified static (`A.sf = v`) is read back as `sf`. An array
+  // element write taints the whole array (its read lowers to the array
+  // identifier, so the element-level path would never match).
+  function emitAssignment(expr, line) {
+    const targets = _assignTargets(expr.left);
+    if (!targets.length) return;
+    const source = expr.op === '='
+      ? expr.right
+      : { kind: 'tpl', parts: [expr.left, expr.right] };
+    for (const target of targets) emit({ kind: 'assign', target, source, line, succ: [] });
+  }
+
+  // `while ((line = r.readLine()) != null)` and the if-form: the assignment
+  // lives inside the condition expression, not in a statement of its own.
+  // Emit every assignment nested in the condition subtree ahead of the
+  // header node so the bound variable carries the call's taint into the
+  // body.
+  function emitCondAssignments(condCst, line) {
+    if (!condCst || typeof condCst !== 'object') return;
+    if (condCst.children?.AssignmentOperator) {
+      const expr = exprFromCst(condCst);
+      if (_isAssignment(expr)) emitAssignment(expr, line);
+      return;
+    }
+    for (const k of Object.keys(condCst.children || {})) {
+      for (const c of condCst.children[k]) emitCondAssignments(c, line);
+    }
+  }
+
   walkStmts(bodyNode);
 
   function walkStmts(stmtNode) {
@@ -362,11 +683,30 @@ function buildCfgFromBody(bodyNode) {
         const vdecl = lv.children?.localVariableDeclaration?.[0];
         const declarators = vdecl?.children?.variableDeclaratorList?.[0]?.children?.variableDeclarator;
         if (declarators) {
+          // Declared TYPE (not just name) — same PRD W2.5 rationale and CST
+          // path as `paramTypes` above, one level down (`localVariableType`
+          // instead of a `formalParameter`'s `variableParaRegularParameter`).
+          // A local declared as an INTERFACE/supertype (`PrintWriter out =
+          // response.getWriter();`) is exactly Java's dominant "get a writer,
+          // then use it" idiom — `_localVarConstructedTypes` below only ever
+          // sees an `isNew` constructor call, so this shape's receiver type
+          // (needed for `writer.println(x)` to resolve against a catalog
+          // sink keyed on the PrintWriter type) was completely invisible.
+          // `var` (Java 10+ inference) is not a real type name and is
+          // skipped, same as the `isVar` guard the hand-rolled parsers use
+          // elsewhere in this codebase.
+          const declTypeIds = vdecl?.children?.localVariableType?.[0]?.children?.unannType?.[0]
+            ?.children?.unannReferenceType?.[0]?.children?.unannClassOrInterfaceType?.[0]
+            ?.children?.unannClassType?.[0]?.children?.Identifier;
+          const rawDeclType = Array.isArray(declTypeIds) && declTypeIds.length ? declTypeIds[declTypeIds.length - 1]?.image : undefined;
+          const declType = rawDeclType && rawDeclType !== 'var' ? rawDeclType : undefined;
           for (const d of declarators) {
             const target = d.children?.variableDeclaratorId?.[0]?.children?.Identifier?.[0]?.image;
             const initExpr = d.children?.variableInitializer?.[0]?.children?.expression?.[0];
             if (target) {
-              emit({ kind: 'assign', target, source: initExpr ? exprFromCst(initExpr) : { kind: 'unknown' }, line: _lineOf(lv), succ: [] });
+              const node = { kind: 'assign', target, source: initExpr ? exprFromCst(initExpr) : { kind: 'unknown' }, line: _lineOf(lv), succ: [], decl: true };
+              if (declType) node.declaredType = declType;
+              emit(node);
             }
           }
         }
@@ -382,11 +722,9 @@ function buildCfgFromBody(bodyNode) {
       const e = kids.expressionStatement[0]?.children?.statementExpression?.[0]?.children?.expression?.[0];
       if (e) {
         const expr = exprFromCst(e);
-        if (expr.kind === 'call') emit({ ...expr, line: _lineOf(kids.expressionStatement[0]), succ: [] });
-        else if (expr.kind === 'binary' && expr.op === '=') {
-          // assignment expr `x = y;`
-          emit({ kind: 'assign', target: expr.left?.name || null, source: expr.right, line: _lineOf(kids.expressionStatement[0]), succ: [] });
-        }
+        const line = _lineOf(kids.expressionStatement[0]);
+        if (expr.kind === 'call') emit({ ...expr, line, succ: [] });
+        else if (_isAssignment(expr)) emitAssignment(expr, line);
       }
     }
     if (kids.returnStatement) {
@@ -402,13 +740,58 @@ function buildCfgFromBody(bodyNode) {
     if (kids.ifStatement) {
       const i = kids.ifStatement[0];
       const cond = i.children?.expression?.[0];
-      emit({ kind: 'if', cond: cond ? exprFromCst(cond) : null, line: _lineOf(i), succ: [] });
-      // Then branch body falls through linearly; v1 simplification.
-      for (const sub of (i.children?.statement || [])) walkStmts(sub);
+      emitCondAssignments(cond, _lineOf(i));
+      const ifNodeId = emit({ kind: 'if', cond: cond ? exprFromCst(cond) : null, line: _lineOf(i), succ: [] });
+      // PRD W2 (SARD_80_F1_EXECUTION_PRD.md) — real branch + join, not a
+      // linear fall-through. The "v1 simplification" this replaces walked
+      // BOTH the then- and else-statement children (java-parser's
+      // ifStatement.children.statement is [thenStmt, elseStmt] in source
+      // order, confirmed via direct CST inspection) onto the SAME shared
+      // chain — so an else branch's assignment unconditionally overwrote
+      // whatever the then branch had just tainted, with no notion that the
+      // two are ALTERNATIVES. Found investigating why a real, verified
+      // taint chain (System.getenv/BufferedReader.readLine() -> concat ->
+      // sink) produced zero findings the instant it was wrapped in
+      // Juliet's own `if (true) { <tainted> } else { data = null; }`
+      // idiom — used throughout the ENTIRE corpus for control-flow-gated
+      // flow variants, so this was silently destroying an unknown but
+      // likely large fraction of Java's real recall, not a narrow gap.
+      // The then-branch starts right after the if-node (already linked by
+      // the emit() above); the else-branch is a SEPARATE second edge off
+      // the SAME if-node, not a continuation of the then-branch's tail.
+      // Both (and the no-else "condition false" case) converge on one
+      // synthetic join node, so a downstream read sees the union of what
+      // either branch could have left tainted — the same recall-preserving
+      // over-approximation every other control-flow join in this codebase
+      // relies on (case/when arms, try/catch/finally).
+      const stmts = i.children?.statement || [];
+      const thenStmt = stmts[0];
+      const elseStmt = stmts[1];
+      prev = ifNodeId;
+      if (thenStmt) walkStmts(thenStmt);
+      const thenExit = prev;
+      let elseExit = ifNodeId;
+      if (elseStmt) {
+        prev = ifNodeId;
+        walkStmts(elseStmt);
+        elseExit = prev;
+      }
+      const joinId = nextNodeId();
+      nodes[joinId] = { id: joinId, kind: 'noop', succ: [] };
+      const linkToJoin = (fromId) => {
+        if (!nodes[fromId]) return;
+        nodes[fromId].succ = nodes[fromId].succ || [];
+        if (!nodes[fromId].succ.includes(joinId)) nodes[fromId].succ.push(joinId);
+      };
+      linkToJoin(thenExit);
+      if (elseStmt) linkToJoin(elseExit);
+      else linkToJoin(ifNodeId); // no else: condition-false falls straight to the join
+      prev = joinId;
     }
     if (kids.whileStatement) {
       const w = kids.whileStatement[0];
       const cond = w.children?.expression?.[0];
+      emitCondAssignments(cond, _lineOf(w));
       emit({ kind: 'loop-header', cond: cond ? exprFromCst(cond) : null, line: _lineOf(w), succ: [] });
       for (const sub of (w.children?.statement || [])) walkStmts(sub);
     }
@@ -460,6 +843,7 @@ function buildCfgFromBody(bodyNode) {
     if (kids.doStatement) {
       const d = kids.doStatement[0];
       const cond = d.children?.expression?.[0];
+      emitCondAssignments(cond, _lineOf(d));
       emit({ kind: 'loop-header', cond: cond ? exprFromCst(cond) : null, line: _lineOf(d), succ: [] });
       for (const sub of (d.children?.statement || [])) walkStmts(sub);
     }
@@ -499,8 +883,35 @@ function buildCfgFromBody(bodyNode) {
       }
       const bodyBlock = container.children?.block?.[0];
       if (bodyBlock) walkStmts(bodyBlock);
+      const throwExprs = [];
+      if (bodyBlock) _collectThrowExprs(bodyBlock, throwExprs);
       const catches = container.children?.catches?.[0]?.children?.catchClause || [];
       for (const cc of catches) {
+        // Exception-message taint: bind the catch variable to whatever was
+        // thrown in the try body BEFORE walking the catch block, so a
+        // read of it inside (e.g. `e.getMessage()`) sees real taint via the
+        // engine's existing generic tainted-call-argument/receiver-taint
+        // mechanism — no catalog or engine change needed, since a `new
+        // Exception(x)` constructor call is already lowered to an ordinary
+        // `call` node and `exprTaint`'s case 'call' already treats a
+        // tainted arg as tainting the call's own result. `isNew` is
+        // stripped from each cloned expr: left as `true`, `_localVarConstructedTypes`
+        // (W2.5's abstract-dispatch fix, above) treats this assign as
+        // establishing `exceptCWE81`'s "constructed type" as `Exception`
+        // and rewrites every later `exceptCWE81.getMessage()` call to the
+        // class-qualified `Exception.getMessage` — which is correct for
+        // dispatch resolution but destroys the variable-name receiver this
+        // fix needs `_calleeReceiverTainted` to see. Confirmed via direct
+        // CFG dump: without stripping `isNew`, the rewrite fires and the
+        // probe fixture stays at zero findings even with the assign in place.
+        if (throwExprs.length) {
+          const paramName = cc.children?.catchFormalParameter?.[0]?.children?.variableDeclaratorId?.[0]?.children?.Identifier?.[0]?.image;
+          if (paramName) {
+            const cloned = throwExprs.map(e => ({ ...e, isNew: false }));
+            const source = cloned.length === 1 ? cloned[0] : { kind: 'union', branches: cloned };
+            emit({ kind: 'assign', target: paramName, source, line: _lineOf(cc), succ: [] });
+          }
+        }
         const cblock = cc.children?.block?.[0];
         if (cblock) walkStmts(cblock);
       }
@@ -514,13 +925,34 @@ function buildCfgFromBody(bodyNode) {
     if (kids.switchStatement) {
       const sw = kids.switchStatement[0];
       const cond = sw.children?.expression?.[0];
-      emit({ kind: 'if', cond: cond ? exprFromCst(cond) : null, line: _lineOf(sw), succ: [] });
+      const swHeaderId = emit({ kind: 'if', cond: cond ? exprFromCst(cond) : null, line: _lineOf(sw), succ: [] });
       const swBlock = sw.children?.switchBlock?.[0];
+      // PRD W2 (SARD_80_F1_EXECUTION_PRD.md) — same defect class as the
+      // if/else fix directly above: each case group was walked onto the
+      // SAME shared linear chain, so `case 6: <tainted>; break;` and a
+      // later `default: data = null; break;` (Juliet's own constant-switch
+      // idiom, `switch(6){case 6:...break;default:...break;}`) fell
+      // through into each other exactly like if/else's then/else did.
+      // Every case group now starts as its OWN edge off the switch-header
+      // node (mirroring this codebase's existing case/when convention —
+      // see parser-rb.js/parser-py-cst.js's own case-arm handling, "every
+      // arm reachable directly from the construct's own entry point") and
+      // converges on one shared join node. Deliberately does not model
+      // fall-through-without-break between adjacent cases (rare in
+      // practice, and no other switch/case/when handling in this codebase
+      // models it either) — every case is treated as an independent
+      // alternative, which is recall-preserving even for the (uncommon)
+      // real fall-through case: the taint that WOULD have carried over is
+      // simply also visible via that case's own reachability from the
+      // header, just not chained through its neighbor.
+      const caseExits = [];
       // Classic colon-form (`case 1: ...; break;`).
       const groups = swBlock?.children?.switchBlockStatementGroup || [];
       for (const g of groups) {
         const bss = g.children?.blockStatements?.[0];
+        prev = swHeaderId;
         if (bss) walkStmts(bss);
+        caseExits.push(prev);
       }
       // R8 Task 1 fix round 1: arrow-form (`case 1 -> ...;`, Java 14+) is a
       // structurally distinct grammar rule — confirmed via direct CST
@@ -537,12 +969,16 @@ function buildCfgFromBody(bodyNode) {
       // confirmed 0 IR-TAINT findings for the idiomatic modern-Java shape.
       const rules = swBlock?.children?.switchRule || [];
       for (const r of rules) {
+        prev = swHeaderId;
         const rblock = r.children?.block?.[0];
-        if (rblock) { walkStmts(rblock); continue; }
+        if (rblock) { walkStmts(rblock); caseExits.push(prev); continue; }
         const rthrow = r.children?.throwStatement?.[0];
         if (rthrow) {
           const texpr = rthrow.children?.expression?.[0];
           emit({ kind: 'throw', value: texpr ? exprFromCst(texpr) : null, line: _lineOf(rthrow), succ: [] });
+          // A throw never falls through to the join — matches this
+          // codebase's existing (elsewhere-tolerated) convention of not
+          // adding a successor after a return/throw node.
           continue;
         }
         const rexpr = r.children?.expression?.[0];
@@ -553,7 +989,21 @@ function buildCfgFromBody(bodyNode) {
             emit({ kind: 'assign', target: expr.left?.name || null, source: expr.right, line: _lineOf(r), succ: [] });
           }
         }
+        caseExits.push(prev);
       }
+      // Join: every case's exit (colon- or arrow-form) converges here,
+      // same as if/else's join above. A switch with zero case groups at
+      // all falls the header straight through to the join.
+      const swJoinId = nextNodeId();
+      nodes[swJoinId] = { id: swJoinId, kind: 'noop', succ: [] };
+      const linkSwToJoin = (fromId) => {
+        if (!nodes[fromId]) return;
+        nodes[fromId].succ = nodes[fromId].succ || [];
+        if (!nodes[fromId].succ.includes(swJoinId)) nodes[fromId].succ.push(swJoinId);
+      };
+      if (caseExits.length) { for (const ex of caseExits) linkSwToJoin(ex); }
+      else linkSwToJoin(swHeaderId);
+      prev = swJoinId;
     }
     // Bare nested block `{ ... }` with no leading keyword. The
     // `statementWithoutTrailingSubstatement` branch above already recurses
@@ -594,6 +1044,15 @@ export async function parseJavaFile(file, raw) {
   if (!cst) return null;
 
   const functions = [];
+  // Class records for class-hierarchy analysis: `bases` (extends + all
+  // implements names) feeds abstract/interface-receiver dispatch (Juliet
+  // flow variants 81/82 — `A_81_base b = new A_81_bad(); b.action(data)`
+  // needs to know A_81_bad extends A_81_base to resolve the call), `fields`
+  // (instance and static declared names) lets cross-method taint tell a
+  // field write (`sf = data;`, live across the whole class) apart from an
+  // unrelated local variable of the same name in another method. Same
+  // optional per-file shape `parser-cpp.js` already attaches.
+  const classes = [];
   // Walk the CST for methodDeclaration nodes.
   function walkForMethods(node, className) {
     if (!node || !node.children) return;
@@ -605,6 +1064,7 @@ export async function parseJavaFile(file, raw) {
           const newClassName = child.children?.typeIdentifier?.[0]?.children?.Identifier?.[0]?.image
             || child.children?.Identifier?.[0]?.image
             || className;
+          if (newClassName) classes.push(_classRecord(child, newClassName));
           walkForMethods(child, newClassName);
           continue;
         }
@@ -621,6 +1081,7 @@ export async function parseJavaFile(file, raw) {
           const fpl = md.children?.methodHeader?.[0]?.children?.methodDeclarator?.[0]?.children?.formalParameterList?.[0]
             || md.children?.methodDeclarator?.[0]?.children?.formalParameterList?.[0];
           const paramAnnotations = [];
+          const paramTypes = {};
           const params = (fpl?.children?.formalParameter || []).map((fp, idx) => {
             // Regular parameters nest under `variableParaRegularParameter`.
             // Varargs (`String... args`) instead use a distinct
@@ -634,6 +1095,24 @@ export async function parseJavaFile(file, raw) {
             // still yields a clean name.
             const vp = fp.children?.variableParaRegularParameter?.[0];
             const paramName = vp?.children?.variableDeclaratorId?.[0]?.children?.Identifier?.[0]?.image || null;
+            // PRD W2.5 (SARD_80_F1_EXECUTION_PRD.md) — declared parameter
+            // TYPE, not just name. Juliet's dominant abstract/interface
+            // dispatch idiom passes the constructed object as a PARAMETER
+            // (`void helper(BaseType b, String data) { b.action(data); }`),
+            // not a local `new` assignment — `_localVarConstructedTypes`
+            // above only ever sees the latter, so this shape's receiver type
+            // was completely unknown to every downstream resolver. Only a
+            // simple class/interface type name is extracted (the
+            // `unannClassType` leaf of `unannType`); a primitive
+            // (`unannPrimitiveType`) or array/generic type some CST shapes
+            // don't reduce to a single Identifier here degrades to
+            // undefined, same graceful-drop convention as the varargs case
+            // above.
+            const typeIds = vp?.children?.unannType?.[0]?.children?.unannReferenceType?.[0]
+              ?.children?.unannClassOrInterfaceType?.[0]?.children?.unannClassType?.[0]
+              ?.children?.Identifier;
+            const paramType = Array.isArray(typeIds) && typeIds.length ? typeIds[typeIds.length - 1]?.image : undefined;
+            if (paramName && paramType) paramTypes[paramName] = paramType;
             // Java allows multiple stacked annotations on one parameter
             // (`@NotNull @RequestParam String q`), each its own
             // `variableModifier` entry — loop over all of them, not just
@@ -663,6 +1142,7 @@ export async function parseJavaFile(file, raw) {
           if (body) {
             const methodLine = _lineOf(md);
             const cfg = buildCfgFromBody(body);
+            _applyVarTypeRewrite(cfg.nodes);
             functions.push({
               // Sibling frontends (parser-js.js) suffix the qid with `@line`
               // so overloaded/same-named methods don't collide — without it,
@@ -676,6 +1156,7 @@ export async function parseJavaFile(file, raw) {
               file,
               calls: callSitesFromCfg(cfg),
               ...(paramAnnotations.length ? { paramAnnotations } : {}),
+              ...(Object.keys(paramTypes).length ? { paramTypes } : {}),
             });
           }
         }
@@ -685,5 +1166,5 @@ export async function parseJavaFile(file, raw) {
   }
   walkForMethods(cst, null);
 
-  return { file, functions, topLevel: null };
+  return { file, functions, topLevel: null, ...(classes.length ? { classes } : {}) };
 }