@clear-capabilities/agentic-security-scanner 0.151.3 → 0.152.0

package/src/sast/java-ast-folding.js

@@ -240,11 +240,38 @@ function evalUnary(node, scope) {
   return value;
 }
 
+// SARD_80_F1 W5.27 — Juliet's own "Control flow: if(privateReturnsTrue())
+// and if(privateReturnsFalse())" idiom (Flow Variant 08/11, confirmed via
+// the public Java mirror's own `CWE601_Open_Redirect__Servlet_connect_tcp_08
+// .java`) branches on a CALL to a same-class, zero-arg, single-`return
+// true;`/`return false;`-bodied private helper, not a literal/field the
+// existing constant evaluator already resolves. A bare method-call suffix
+// used to unconditionally fail evaluation (the comment below explains why
+// that's still correct for anything with arguments or a non-trivial body) —
+// this narrowly recognizes the ONE resolvable shape (a bare, zero-arg call
+// whose target method was pre-folded into `scope` by
+// `_collectClassMethodConstants`, namespaced so a call `f()` can never be
+// confused with a plain variable reference `f`) and falls through to the
+// existing UNKNOWN behavior for everything else — an unresolvable callee,
+// an argument list, or a chained `.field`/`.method()`/`[idx]` continuation.
 function evalPrimary(node, scope) {
   if (!node) return UNKNOWN;
   const ch = node.children || {};
   const prefix = ch.primaryPrefix?.[0];
   if (!prefix) return UNKNOWN;
+  if (ch.primarySuffix && ch.primarySuffix.length === 1) {
+    const invocation = ch.primarySuffix[0].children?.methodInvocationSuffix?.[0];
+    if (invocation && !invocation.children?.argumentList) {
+      const fr = prefix.children?.fqnOrRefType?.[0];
+      const parts = fr?.children?.fqnOrRefTypePartFirst || [];
+      if (parts.length === 1) {
+        const ident = parts[0].children?.fqnOrRefTypePartCommon?.[0]?.children?.Identifier?.[0]?.image;
+        const key = ident && `()${ident}`;
+        if (key && scope.has(key)) return scope.get(key);
+      }
+    }
+    return UNKNOWN;
+  }
   const value = evalPrimaryPrefix(prefix, scope);
   // Suffix chains (.field, .method(), [idx]) make evaluation fail.
   if (ch.primarySuffix && ch.primarySuffix.length > 0) {
@@ -363,7 +390,25 @@ function walkStatement(stmtNode, scope, out) {
     return;
   }
 
-  // Loop bodies, try, etc. — descend but don't bind constants.
+  // Loop bodies, try, etc. — descend but don't bind constants. Any variable
+  // REASSIGNED somewhere inside (a try body's `data = readerBuffered.
+  // readLine();` is the canonical case — Juliet's own dominant idiom:
+  // `T x = null; try { x = source(); } catch (...) {} if (x != null) {
+  // sink(x); }`) must be invalidated in `scope` first, or a later `if (x !=
+  // null)` after the block still sees the STALE pre-block value (`null`)
+  // and gets constant-folded to a permanently-dead branch — silently
+  // deleting the taint finding inside it. Confirmed via SARD_80_F1's CWE-83
+  // URLConnection variants: every one of them uses exactly this shape with
+  // a `null` initializer (File-sourced variants happen to initialize with
+  // `""` instead, which sidesteps the bug by accident — `"" != null` folds
+  // to constant-TRUE, marking the absent else-branch dead instead of the
+  // sink-bearing then-branch). Deliberately conservative in the OPPOSITE
+  // direction from the rest of this file's folding: when this walker
+  // cannot prove what happens to a variable, it must NOT keep trusting a
+  // value that may already be stale, since silently marking a live branch
+  // dead is a false negative — far worse than the lost folding opportunity
+  // of a still-cleared-but-actually-unreachable branch.
+  for (const name of _collectAssignedNames(stmtNode)) scope.delete(name);
   for (const key of Object.keys(ch)) {
     const arr = ch[key];
     if (Array.isArray(arr)) for (const child of arr) {
@@ -372,6 +417,44 @@ function walkStatement(stmtNode, scope, out) {
   }
 }
 
+/** Bare local-variable name of a `unaryExpression` node used as an
+ *  assignment target, or null when it's not a simple identifier (a member
+ *  write / array-index write can't alias a tracked local, so there is
+ *  nothing in `scope` for it to invalidate). Mirrors evalPrimaryPrefix's
+ *  own bare-identifier extraction but for a WRITE position rather than a
+ *  read, so it does not require the name to already be in scope. */
+function _bareAssignTargetName(unaryNode) {
+  const primary = unaryNode?.children?.primary?.[0];
+  const prefix = primary?.children?.primaryPrefix?.[0];
+  if (!prefix || (primary.children?.primarySuffix?.length || 0) > 0) return null;
+  const fr = prefix.children?.fqnOrRefType?.[0];
+  const parts = fr?.children?.fqnOrRefTypePartFirst || [];
+  if (parts.length !== 1) return null;
+  return parts[0].children?.fqnOrRefTypePartCommon?.[0]?.children?.Identifier?.[0]?.image || null;
+}
+
+/** Recursively collect every local-variable name assigned (`x = …`, `x +=
+ *  …`, `x++`/`x--`/`++x`/`--x`) anywhere in `node`'s subtree. Grammar shapes
+ *  confirmed directly against java-parser's own CST: a `binaryExpression`
+ *  with an `AssignmentOperator` child is `=`/`+=`/`-=`/etc. (LHS in its
+ *  `unaryExpression` child); a `unaryExpression` with a `UnarySuffixOperator`
+ *  or `UnaryPrefixOperator` child is `x++`/`x--`/`++x`/`--x`. */
+function _collectAssignedNames(node, out) {
+  out = out || new Set();
+  if (!node || typeof node !== 'object') return out;
+  if (node.name === 'binaryExpression' && node.children?.AssignmentOperator) {
+    const name = _bareAssignTargetName(node.children.unaryExpression?.[0]);
+    if (name) out.add(name);
+  } else if (node.name === 'unaryExpression'
+    && (node.children?.UnarySuffixOperator || node.children?.UnaryPrefixOperator)) {
+    const name = _bareAssignTargetName(node);
+    if (name) out.add(name);
+  }
+  const ch = node.children;
+  if (ch) for (const key of Object.keys(ch)) for (const child of ch[key]) _collectAssignedNames(child, out);
+  return out;
+}
+
 function captureLocalDecl(lvdNode, scope) {
   if (!lvdNode) return;
   const ch = lvdNode.children || {};
@@ -424,6 +507,7 @@ function walkSwitch(switchNode, scope, out) {
   // For each switchBlockStatementGroup, check if its case label matches `v`.
   const groups = blockNode.children?.switchBlockStatementGroup || [];
   let matchedAny = false;
+  const defaultGroups = [];
   for (const g of groups) {
     const labels = g.children?.switchLabel || [];
     let groupMatches = false;
@@ -433,7 +517,24 @@ function walkSwitch(switchNode, scope, out) {
         // default — matches if nothing else does (decided after)
         continue;
       }
-      const labelExpr = lblCh.caseConstant?.[0]?.children?.expression?.[0]
+      // PRD W2 (SARD_80_F1_EXECUTION_PRD.md) — `caseConstant`'s own CST
+      // child is `conditionalExpression`, not `expression` (confirmed via
+      // direct java-parser CST inspection: `caseConstant.children` is
+      // exactly `{conditionalExpression: [...]}`). The stale `expression`
+      // key made `labelExpr` undefined for EVERY colon-form case label,
+      // which made `groupMatches` false for every real case — including
+      // ones that DO match the scrutinee — so `walkSwitch` marked the
+      // LIVE, matching case as "unreachable" and left the genuinely-dead
+      // `default` untouched: exactly backwards. Found investigating why a
+      // real, verified taint chain reaching a sink AFTER a
+      // `switch(6){case 6:<tainted>;break;default:safe;break;}` (Juliet's
+      // own constant-switch idiom) produced zero findings — the tainted
+      // assignment's own line was being reported as "dead code" and
+      // suppressed via `applyJavaBenchSuppressions`'s source-line check.
+      // `evalExpr` already handles a bare `conditionalExpression` node
+      // directly (see its own dispatch above), so no other change is
+      // needed once the correct child key is read.
+      const labelExpr = lblCh.caseConstant?.[0]?.children?.conditionalExpression?.[0]
         || lblCh.caseLabelElement?.[0]?.children?.expression?.[0];
       if (!labelExpr) continue;
       const lv = evalExpr(labelExpr, scope);
@@ -442,23 +543,179 @@ function walkSwitch(switchNode, scope, out) {
     if (groupMatches) matchedAny = true;
     else {
       // Group does NOT match scrutinee → its block is dead (unless default and nothing else matched).
-      // We'll resolve default later. For now, conservatively skip "default-only" groups.
+      // Resolved in a second pass below, once every group's own match state
+      // is known (a "default"-only group's own dead-ness depends on whether
+      // ANY OTHER group in the switch matched — information not available
+      // until the whole switch has been scanned once).
       const onlyDefault = labels.every(l => l.children?.Default);
-      if (onlyDefault) continue;
+      if (onlyDefault) { defaultGroups.push(g); continue; }
       const r = rangeOf(g);
       if (r) out.push({ startLine: r.startLine, endLine: r.endLine, reason: 'unreachable case (switch on constant)' });
     }
   }
+  // SARD_80_F1 W5.35 — `matchedAny` was computed above but never actually
+  // consulted: the comment here said "we'll resolve default later," but
+  // nothing ever did, leaving `default:` permanently exempt from dead-code
+  // marking regardless of whether some OTHER case explicitly matched the
+  // scrutinee. Confirmed via a real-corpus fp (Juliet's own Flow Variant 15,
+  // `switch(6){case 6: data="foo"; default: data=null;}` — `case 6` matches
+  // 6, so `default` is provably dead, but the pre-fix code never marked it,
+  // leaving `_trailingIdentIsLiteral`'s backward scan seeing the DEAD
+  // `default: data=null;` as the "textually nearest" assignment instead of
+  // the genuinely-live `case 6: data="foo";`). Now that every group's own
+  // match state is known, a `default`-only group is dead exactly when some
+  // OTHER group explicitly matched — the one case this function can prove
+  // unreachable with total confidence, since Java guarantees at most one
+  // group runs per switch execution.
+  if (matchedAny) {
+    for (const g of defaultGroups) {
+      const r = rangeOf(g);
+      if (r) out.push({ startLine: r.startLine, endLine: r.endLine, reason: 'unreachable default (switch on constant, another case matched)' });
+    }
+  }
+}
+
+
+// SARD_80_F1 W4.J34 — `final` FIELD constant propagation (this file's own
+// header comment already scoped "non-final field" as out-of-scope,
+// implying a same-class FINAL field was always intended to be in scope,
+// just not yet implemented). Juliet's own "Flow Variant 04: Control flow:
+// if(PRIVATE_STATIC_FINAL_TRUE) and if(PRIVATE_STATIC_FINAL_FALSE)" (used
+// across dozens of CWEs, confirmed via the public Java Juliet mirror's own
+// `CWE601_Open_Redirect__Servlet_connect_tcp_04.java`) is IDENTICAL to the
+// already-modeled literal `if(true)/if(false)` idiom (Flow Variant 02),
+// except the condition is a reference to a `private static final boolean`
+// FIELD rather than the literal keyword — every method body previously
+// started dead-branch analysis with a fresh EMPTY scope (`new Map()`),
+// so `evalPrimaryPrefix`'s own `scope.has(ident)` check could never
+// resolve the field reference, and the entire Flow-Variant-04 family was
+// invisible to this constant-folding pass, leaving a genuinely dead
+// `else { data = null; }` branch counted as live and (via the SAME
+// mechanism already fixed for Variant 02 at W4.J33) defeating any
+// downstream "nearest assignment" precision heuristic built on top of it.
+// Deliberately scoped to `final` fields ONLY (checked via the field's own
+// `fieldModifier` CST children, never inferred from naming convention) —
+// a NON-final field could legitimately be reassigned elsewhere (a setter,
+// another method), and treating its declared initializer as an eternal
+// constant would risk marking a genuinely LIVE branch as dead, a false
+// NEGATIVE this session has been careful never to introduce. `static` is
+// not required (an instance-level `private final boolean x = true;` is
+// equally a real compile-time constant once the object exists, and Juliet
+// itself only ever uses `static final` for this idiom, so the distinction
+// is moot in practice but the fix is correct either way).
+// SARD_80_F1 W4.J36 — Juliet's OWN variant family for this idiom goes well
+// beyond the literal (`02`) and `static final` (`04`) forms already
+// modeled: Flow Variant 05 ("if(privateTrue) and if(privateFalse)") uses a
+// plain, NON-static, NON-final `private boolean privateTrue = true;`
+// instance field, and Variant 07 ("if(privateFive==5) and
+// if(privateFive!=5)") compares a non-final `private int` field against a
+// literal with `==`/`!=` (confirmed via the public Java Juliet mirror's own
+// `CWE601_Open_Redirect__Servlet_connect_tcp_05.java`/`_07.java`) — both
+// already fall out of `evalBinary`'s existing equality-operator support
+// for free, once the field itself resolves to a value at all. A bare
+// non-final field is NOT a compile-time constant in general (W4.J34's own
+// header comment on why `final` is required), but Java's real "effectively
+// final" concept — a variable assigned exactly once, wherever that
+// assignment happens to sit — covers this shape soundly: if `privateTrue`
+// is written to nowhere else in the WHOLE FILE besides its own declaration,
+// it can never actually change, so folding it is exactly as safe as
+// folding a real `final` field. Checked with a deliberately simple,
+// conservative TEXT scan (`_isEffectivelyFinal`) rather than a full CST
+// call-graph/alias analysis: counting `\bname\s*=(?!=)` occurrences across
+// the ENTIRE source (not just this class) can only ever OVER-count (an
+// unrelated same-named field/local elsewhere in the file, or in another
+// class in the same file) — which only means the optimization is missed,
+// never that a genuinely-reassigned field gets folded. That failure mode
+// is the same "safe in the conservative direction" shape every dead-branch
+// check in this file already uses.
+function _isEffectivelyFinal(source, fieldName) {
+  if (!source || !fieldName) return false;
+  const escaped = fieldName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const assignRe = new RegExp(`\\b${escaped}\\s*=(?!=)`, 'g');
+  const matches = source.match(assignRe) || [];
+  return matches.length <= 1;
+}
+
+// Unwraps a `blockStatement` CST node down to a `returnStatement`, following
+// the same `statement` / `statementWithoutTrailingSubstatement` nesting
+// `walkStatement` already unwraps elsewhere in this file — or returns null
+// for anything else (an ambiguous body is left alone, not guessed at).
+function _asReturnStatement(blockStatement) {
+  let node = blockStatement?.children?.statement?.[0]
+    || blockStatement?.children?.statementWithoutTrailingSubstatement?.[0];
+  while (node) {
+    if (node.children?.returnStatement) return node.children.returnStatement[0];
+    node = node.children?.statement?.[0] || node.children?.statementWithoutTrailingSubstatement?.[0];
+  }
+  return null;
 }
 
+// SARD_80_F1 W5.27 — see `evalPrimary`'s own header comment for the full
+// incident writeup. Folds a same-class, zero-parameter method whose ENTIRE
+// body is EXACTLY one `return <expr>;` statement into the SAME class-scoped
+// constants map `_collectClassConstants` already builds for `final`/
+// effectively-final fields — namespaced under `()<name>` so a method call
+// `f()` can never collide with, or be confused with, a plain field/local
+// reference `f`. Deliberately conservative in every dimension already
+// established by this file's sibling folders: a method with ANY parameter
+// is skipped (a caller-supplied argument could change the outcome, breaking
+// "always returns the same value"); a body with more than one statement is
+// ambiguous and skipped (mirrors `_resolveCalleeReturnIsLiteral`'s identical
+// "exactly one return" requirement in `java-bench-extras.js`, the same
+// interprocedural-constant precedent applied here to conditions instead of
+// assignments); the return expression is evaluated through the ALREADY-
+// collected field-constants map, so `return SOME_FINAL_FIELD;` also resolves
+// correctly, but a return of anything else (a call, a computed expression)
+// correctly stays `UNKNOWN` and is not folded.
+function _collectClassMethodConstants(classBody, consts) {
+  const decls = classBody?.children?.classBodyDeclaration || [];
+  for (const bd of decls) {
+    const method = bd.children?.classMemberDeclaration?.[0]?.children?.methodDeclaration?.[0];
+    if (!method) continue;
+    const declarator = method.children?.methodHeader?.[0]?.children?.methodDeclarator?.[0];
+    if (!declarator || declarator.children?.formalParameterList) continue;
+    const name = declarator.children?.Identifier?.[0]?.image;
+    if (!name) continue;
+    const block = method.children?.methodBody?.[0]?.children?.block?.[0];
+    const stmts = block?.children?.blockStatements?.[0]?.children?.blockStatement || [];
+    if (stmts.length !== 1) continue;
+    const returnStmt = _asReturnStatement(stmts[0]);
+    const exprNode = returnStmt?.children?.expression?.[0];
+    if (!exprNode) continue;
+    const value = evalExpr(exprNode, consts);
+    if (value !== UNKNOWN) consts.set(`()${name}`, value);
+  }
+}
+
+function _collectClassConstants(classBody, source) {
+  const consts = new Map();
+  const decls = classBody?.children?.classBodyDeclaration || [];
+  for (const bd of decls) {
+    const fd = bd.children?.classMemberDeclaration?.[0]?.children?.fieldDeclaration?.[0];
+    if (!fd) continue;
+    const isFinal = (fd.children?.fieldModifier || []).some(m => m.children?.Final);
+    const declarators = fd.children?.variableDeclaratorList?.[0]?.children?.variableDeclarator || [];
+    for (const d of declarators) {
+      const name = d.children?.variableDeclaratorId?.[0]?.children?.Identifier?.[0]?.image;
+      const initExpr = d.children?.variableInitializer?.[0]?.children?.expression?.[0];
+      if (!name || !initExpr) continue;
+      if (!isFinal && !_isEffectivelyFinal(source, name)) continue;
+      const value = evalExpr(initExpr, consts);
+      if (value !== UNKNOWN) consts.set(name, value);
+    }
+  }
+  return consts;
+}
 
 // ─── Public API ───────────────────────────────────────────────────────────
 
 /** Walk every method body anywhere in the type hierarchy (including inner
  *  classes, interfaces, anonymous classes). Recursive. */
-function walkClassBody(classBody, out) {
+function walkClassBody(classBody, out, source) {
   if (!classBody) return;
   const decls = classBody.children?.classBodyDeclaration || [];
+  const classConsts = _collectClassConstants(classBody, source);
+  _collectClassMethodConstants(classBody, classConsts);
   for (const bd of decls) {
     const member = bd.children?.classMemberDeclaration?.[0];
     if (!member) continue;
@@ -468,20 +725,20 @@ function walkClassBody(classBody, out) {
     if (memCh.methodDeclaration) {
       const method = memCh.methodDeclaration[0];
       const block = method.children?.methodBody?.[0]?.children?.block?.[0];
-      if (block) walkBlock(block, new Map(), out);
+      if (block) walkBlock(block, new Map(classConsts), out);
     }
 
     // Constructors
     if (memCh.constructorDeclaration) {
       const ctor = memCh.constructorDeclaration[0];
       const block = ctor.children?.constructorBody?.[0];
-      if (block) walkBlock(block, new Map(), out);
+      if (block) walkBlock(block, new Map(classConsts), out);
     }
 
     // Nested class / interface
     if (memCh.classDeclaration) {
       const cd = memCh.classDeclaration[0];
-      walkClassDeclaration(cd, out);
+      walkClassDeclaration(cd, out, source);
     }
     if (memCh.interfaceDeclaration) {
       const id = memCh.interfaceDeclaration[0];
@@ -490,12 +747,12 @@ function walkClassBody(classBody, out) {
   }
 }
 
-function walkClassDeclaration(cd, out) {
+function walkClassDeclaration(cd, out, source) {
   if (!cd) return;
   const ncd = cd.children?.normalClassDeclaration?.[0];
   if (ncd) {
     const body = ncd.children?.classBody?.[0];
-    walkClassBody(body, out);
+    walkClassBody(body, out, source);
   }
   // Enums and records also have bodies that may contain methods.
   const ed = cd.children?.enumDeclaration?.[0];
@@ -547,7 +804,7 @@ export function deadBranchRanges(source) {
     const tds = cu?.children?.typeDeclaration || [];
     for (const td of tds) {
       const cd = td.children?.classDeclaration?.[0];
-      if (cd) walkClassDeclaration(cd, out);
+      if (cd) walkClassDeclaration(cd, out, source);
       const id = td.children?.interfaceDeclaration?.[0];
       if (id) walkInterfaceDeclaration(id, out);
     }