@clear-capabilities/agentic-security-scanner 0.151.3 → 0.152.0

package/src/sast/java-bench-extras.js

@@ -54,7 +54,9 @@ const SETX_RE = /\.\s*set(?:String|Int|Long|Object|Date|Timestamp|Boolean|Float|
 // ─── New-rule patterns ────────────────────────────────────────────────────
 
 // CWE-601: response.sendRedirect(<tainted-or-non-literal>)
-const SEND_REDIRECT_RE = /\b(?:response|resp|res)\s*\.\s*sendRedirect\s*\(\s*([^)]+)\)/g;
+// Exported for java-structural-cross-file.js (W5.42) — the same sink
+// matching, reused to re-derive candidate findings for cross-file checking.
+export const SEND_REDIRECT_RE = /\b(?:response|resp|res)\s*\.\s*sendRedirect\s*\(\s*([^)]+)\)/g;
 
 // CWE-319: cleartext transmission of sensitive information.
 //
@@ -75,6 +77,18 @@ const SEND_REDIRECT_RE = /\b(?:response|resp|res)\s*\.\s*sendRedirect\s*\(\s*([^
 const INSECURE_URL_LITERAL_RE = /\bnew\s+URL\s*\(\s*"http:\/\/[^"]*"\s*\)/g;
 const INSECURE_URL_CONCAT_RE = /\bnew\s+URL\s*\(\s*"http:\/\/[^"]*"\s*\+\s*\w/g;
 const RAW_SOCKET_RE = /\bnew\s+Socket\s*\(\s*[^)]+\)/g;
+// SARD_80_F1 W4.J29 — `RAW_SOCKET_RE` only matches the CLIENT side
+// (`new Socket(host, port)`); Juliet's `listen_tcp_*` descriptor family
+// (confirmed against the public mirror,
+// `CWE319_Cleartext_Tx_Sensitive_Info__listen_tcp_driverManager_01.java`)
+// is the SERVER side instead — `ServerSocket listener = new
+// ServerSocket(port); Socket socket = listener.accept();` — which never
+// constructs a `Socket` directly at all, so it was a total blackout for
+// this whole descriptor family (82 of 176 CWE-319 test-split entries,
+// confirmed by grouping the false negatives by descriptor base name).
+// `.accept()` always returns a `Socket`, the identical "got a raw,
+// unencrypted socket" moment `new Socket(...)` already fires on.
+const SERVERSOCKET_ACCEPT_RE = /\.accept\s*\(\s*\)/g;
 
 // "Sensitive-data context" — file contains any of these identifiers.
 // Variable names like `password`, `passwd`, `secret`, `token`, `cred`, etc.
@@ -93,6 +107,467 @@ const SENSITIVE_COOKIE_RE = /\bnew\s+Cookie\s*\(\s*"(?:session|sess|token|auth|j
 // Match `new Cookie(literal, NON_LITERAL_VAR)` regardless of cookie name.
 const RESPONSE_SPLITTING_COOKIE_RE = /\bnew\s+Cookie\s*\(\s*"[^"]*"\s*,\s*([A-Za-z_]\w*)\s*\)/g;
 
+// CWE-259: hard-coded password reaching a credential parameter. Juliet's
+// canonical shape (confirmed via the public mirror, all three sink variants):
+// a String variable is set to a HARDCODED LITERAL, then used — by NAME, not
+// inline — as the password/credential argument of one of these APIs. This is
+// the inverse of ordinary taint detection: the finding fires when the value
+// is PROVABLY a constant, not when it's tainted, so the taint engine's own
+// sink-matching (which fires on TAINTED args) structurally cannot express it.
+//
+//   DriverManager.getConnection(url, user, data)        — data used bare
+//   new KerberosKey(principal, data.toCharArray(), ...) — data.toCharArray()
+//   new PasswordAuthentication(user, data.toCharArray())— data.toCharArray()
+//
+// Each regex captures the credential identifier (stripping a trailing
+// `.toCharArray()` where present).
+const HARDCODED_PW_DRIVERMANAGER_RE = /\bDriverManager\s*\.\s*getConnection\s*\([^,]+,[^,]+,\s*([A-Za-z_]\w*)\s*\)/g;
+const HARDCODED_PW_KERBEROSKEY_RE = /\bnew\s+KerberosKey\s*\([^,]+,\s*([A-Za-z_]\w*)\s*\.\s*toCharArray\s*\(\s*\)/g;
+const HARDCODED_PW_PASSWORDAUTH_RE = /\bnew\s+PasswordAuthentication\s*\([^,]+,\s*([A-Za-z_]\w*)\s*\.\s*toCharArray\s*\(\s*\)/g;
+
+/**
+ * True when the NEAREST assignment to `varName` before `beforeIdx` (source
+ * order, not lexical scope — see the header comment above `scanJavaBenchExtras`'s
+ * CWE-259 block for why a backward nearest-assignment scan is enough to stay
+ * correctly scoped to the enclosing method without a full method-boundary
+ * parse) is a string-literal assignment, not a call/variable/concat RHS.
+ * Deliberately conservative: a variable never assigned at all (`beforeIdx`
+ * before any assignment) returns false, same direction as every other
+ * evidence-required check in this codebase.
+ */
+// SARD_80_F1 W4.J33 — Juliet's own "if(true){…} else{ x = null; }" / "if
+// (false){ x = null; } else {…}" dead-code idiom (its own in-source comment:
+// "INCIDENTAL: CWE 561 Dead Code, the code below will never run but ensure
+// [x] is initialized before the Sink to avoid compiler errors") is used
+// across dozens of CWEs and flow variants (confirmed via the public mirror
+// — the SAME idiom this session already fixed for C#'s CFG at W4.C28,
+// manifesting here as a text-scan bug instead of a CFG bug). This backward,
+// text-order-only scan for "the nearest assignment before the sink" has no
+// notion of dead code: `if (true) { data = "foo"; } else { data = null; }`
+// puts the LITERAL assignment first and the DEAD `data = null;` second —
+// textually LATER, so `lastAnyEnd` (computed from ANY assignment) lands on
+// the dead one, `lastLiteralEnd !== lastAnyEnd` fails, and a genuinely safe
+// goodG2B() variant using this exact idiom was never recognized as
+// literal-only, leaving a real false positive uncorrected (confirmed via
+// the public mirror's own `CWE601_Open_Redirect__Servlet_connect_tcp_02
+// .java`'s `goodG2B2()`). Fixed by reusing the ALREADY-EXISTING, real
+// AST-based `deadBranchRanges`/`isLineInDeadRange` (java-ast-folding.js,
+// already used by `applyJavaBenchSuppressions` for a different purpose) to
+// skip any assignment whose line falls inside a provably-dead branch when
+// computing `lastAnyEnd` — the literal assignment inside the LIVE branch is
+// then correctly recognized as the value that actually reaches the sink.
+// `deadRanges` is optional (empty array when the caller has none, or on a
+// parse failure) so every existing call site keeps its old, more
+// conservative behavior unless it opts in.
+// SARD_80_F1 W4.J37 — Juliet's "data returned from one method to another in
+// the same class" flow variants (its own template naming: sources-sink-41+,
+// the exact sibling idiom to the argument-passing one W4.J33's own header
+// comment already documents) route a PROVABLY-literal value through a
+// same-file helper's RETURN value instead of a direct assignment:
+// `private String goodG2BSource() { return "foo"; } ... String data =
+// goodG2BSource(); response.sendRedirect(data);` — confirmed against the
+// public mirror's own `CWE601_Open_Redirect__Servlet_connect_tcp_42.java`.
+// `_nearestAssignIsLiteral`'s own backward scan sees `data = goodG2BSource()`
+// as a NON-literal "any assignment" (the RHS is a call, not a quoted
+// string), so `lastLiteralEnd !== lastAnyEnd` correctly-by-its-own-rules
+// fails closed — except the callee ALWAYS returns a literal, so the value
+// genuinely is safe. Deliberately narrow and bounded, matching this file's
+// existing conservative-evidence-required convention: only a callee with
+// EXACTLY ONE `return` statement in its own body is resolved (multiple
+// returns are ambiguous — fails closed, never guessed); the returned
+// expression must itself be a literal OR a bare identifier that recurses
+// through this SAME resolution (bounded by `_depth`, matching the codebase's
+// established recursion-guard convention elsewhere) — never a call, concat,
+// or ternary, which all fail closed. Same-file only: `content` is always
+// this one file's own text, so there is no cross-file resolution risk here.
+const _CALLEE_RETURN_LITERAL_CACHE_DEPTH = 4;
+function _resolveCalleeReturnIsLiteral(content, calleeName, deadRanges, _depth) {
+  const depth = _depth || 0;
+  if (depth >= _CALLEE_RETURN_LITERAL_CACHE_DEPTH) return false;
+  const escapedCallee = calleeName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  // W4.J39 — a confirmed, severe ReDoS: the ORIGINAL pattern here matched a
+  // "return type" prefix via a LAZY character class that itself included
+  // `\s` (`[\w.<>\[\],\s]+?`). Comment-blanked content (`scanJavaBenchExtras`
+  // always calls `_resolveCalleeReturnIsLiteral` — and everything downstream
+  // of it — with `blankComments(raw)`, never `raw`) turns Juliet's own
+  // large header comment blocks into a LONG run of blanked whitespace, and
+  // a lazy quantifier whose OWN character class includes `\s` backtracks
+  // catastrophically trying every possible split point inside that run —
+  // confirmed via direct reproduction (hangs indefinitely on a real, small
+  // 8KB corpus file; the exact same shape hung a live full-corpus scan for
+  // 30+ minutes on a single small CWE before it was caught and killed).
+  // Fixed by dropping the "return type" prefix match ENTIRELY: since the
+  // callee NAME is already known, a bare `\bcalleeName\s*(...)  {` search
+  // is exactly as identifying (a call site is never immediately followed
+  // by `{`) without ever touching a `\s`-inclusive lazy quantifier.
+  const declRe = new RegExp(`\\b${escapedCallee}\\s*\\([^)]*\\)\\s*(?:throws\\s+[\\w.,\\s]+)?\\s*\\{`, 'g');
+  const dm = declRe.exec(content);
+  if (!dm) return false;
+  const bodyStart = dm.index + dm[0].length;
+  let braceDepth = 1, i = bodyStart;
+  while (i < content.length && braceDepth > 0) {
+    if (content[i] === '{') braceDepth++;
+    else if (content[i] === '}') braceDepth--;
+    i++;
+  }
+  const body = content.slice(bodyStart, i - 1);
+  const returnRe = /\breturn\s+([^;]+);/g;
+  const returns = [];
+  let rm;
+  while ((rm = returnRe.exec(body))) returns.push({ expr: rm[1].trim(), idx: bodyStart + rm.index });
+  if (returns.length !== 1) return false; // ambiguous (0 or 2+ returns) — fail closed
+  const { expr, idx } = returns[0];
+  if (/^"[^"]*"$/.test(expr)) return true;
+  if (/^[A-Za-z_]\w*$/.test(expr)) {
+    return _nearestAssignIsLiteral(content, expr, idx, deadRanges, depth + 1);
+  }
+  return false;
+}
+
+// Balanced top-level comma split (paren/bracket/brace-aware, quote-aware —
+// an argument like `"a, b"` or `foo(1, 2)` must not be split on its OWN
+// internal commas). Deliberately simple: no need to track Java generics'
+// `<...>` nesting specifically, since angle brackets never appear in a
+// plain call argument list the way they do in a type declaration.
+function _splitTopLevelCommas(text) {
+  const parts = [];
+  let depth = 0, cur = '', inStr = null;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (inStr) {
+      cur += c;
+      if (c === '\\') { cur += text[++i] || ''; continue; }
+      if (c === inStr) inStr = null;
+      continue;
+    }
+    if (c === '"' || c === "'") { inStr = c; cur += c; continue; }
+    if (c === '(' || c === '[' || c === '{') depth++;
+    else if (c === ')' || c === ']' || c === '}') depth--;
+    if (c === ',' && depth === 0) { parts.push(cur); cur = ''; continue; }
+    cur += c;
+  }
+  if (cur.trim() !== '' || parts.length) parts.push(cur);
+  return parts;
+}
+
+// SARD_80_F1 W4.J38 — the sibling gap to W4.J33's own parameter-boundary
+// guard (see that guard's own header comment on the "data passed as an
+// argument from one method to another" idiom). That guard assumes the
+// CALLER's own literal assignment appears textually BEFORE the callee
+// method in the file — the common case — but Juliet's own file layout does
+// NOT guarantee this: confirmed via the public mirror's own
+// `CWE601_Open_Redirect__Servlet_connect_tcp_41.java`, where `goodG2BSink`
+// (the method actually containing the sink call) is DEFINED BEFORE its own
+// caller `goodG2B` (which supplies the literal argument) — so `goodG2B`'s
+// `data = "foo";` sits AFTER `goodG2BSink`'s own sink call in raw file
+// text, structurally invisible to ANY backward-only scan, however it's
+// tuned. Rather than trying to special-case "look forward too" inside the
+// backward scan above, this takes a completely different, WHOLE-FILE
+// approach once the backward scan has already failed: find the METHOD that
+// encloses `beforeIdx`, determine `varName`'s own PARAMETER POSITION in
+// that method's signature, then check every real call site of that method
+// (matched by bare name — Juliet's own same-class private-helper
+// convention, mirroring `_resolveCalleeReturnIsLiteral`'s identical same-
+// file-only scope) for a literal at the SAME argument position. Fails
+// closed at every step: zero real call sites found, an arity mismatch, or
+// ANY call site supplying a non-literal at that position all return
+// `false` — this only ever ADDS a positive signal when literally every
+// known caller agrees, never guesses from a single ambiguous data point.
+// The declared class name of `content` itself — see java-structural.js's
+// own identical copy of this helper (W5.41/W5.42) for the full rationale.
+function _ownClassName(content) {
+  const m = /\bclass\s+([A-Za-z_]\w*)/.exec(content);
+  return m ? m[1] : null;
+}
+
+// See java-structural.js's own identical copy of this helper (W5.45) for
+// the full rationale.
+function _enclosingMethodSpan(text, idx) {
+  const methodDeclRe = /\b(?!if\b|for\b|while\b|switch\b|catch\b|synchronized\b|do\b|else\b|return\b|new\b)([A-Za-z_]\w*)\s*\([^)]*\)\s*(?:throws\s+[\w.,\s]+)?\s*\{/g;
+  let best = null, m;
+  while ((m = methodDeclRe.exec(text)) && m.index < idx) best = m;
+  if (!best) return null;
+  const openIdx = best.index + best[0].length - 1;
+  let depth = 1, i = openIdx + 1;
+  while (i < text.length && depth > 0) {
+    if (text[i] === '{') depth++;
+    else if (text[i] === '}') depth--;
+    i++;
+  }
+  if (i <= idx) return null;
+  return { start: openIdx, end: i };
+}
+
+// SARD_80_F1 W5.42 — the SAME cross-file gap W5.41 fixed in java-structural.js,
+// ported here: Juliet's Flow Variant 51+ ("data passed as an argument from
+// one method to another in a DIFFERENT class") splits caller/callee across
+// two physical files in the same directory, invisible to a same-file-only
+// search. `siblingFiles` (optional; `{code, deadRanges}` for other `.java`
+// files in the same directory) is a fallback consulted ONLY when the
+// same-file search finds zero real call sites — `scanJavaBenchExtras`'s own
+// ordinary call never supplies it, so its behavior is unchanged. The
+// cross-file fallback ALSO requires the call site to construct THIS sink's
+// own declared class (`new ClassName()).method(`), not just call a
+// same-named method — see java-structural.js's own W5.41 header comment for
+// why a bare method-name match is unsound here (Juliet reuses the same
+// generic method names identically across thousands of unrelated files in
+// the same directory, a collision blind scrambling preserves by design).
+function _resolveParamLiteralViaAllCallSites(content, varName, beforeIdx, deadRanges, _depth, siblingFiles) {
+  const depth0 = _depth || 0;
+  if (depth0 >= _CALLEE_RETURN_LITERAL_CACHE_DEPTH) return false;
+  const escapedVar = varName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  // Excludes Java's control-flow keywords, which have the IDENTICAL
+  // `keyword (...) {` textual shape as a method declaration (`if (x) {`,
+  // `for (...) {`, `while (...) {`, `switch (...) {`, `catch (...) {`,
+  // `synchronized (...) {`) and would otherwise be picked up as a fake
+  // "enclosing method" — confirmed the hard way: a bare `if (data != null)
+  // {` immediately inside a real sink method matched this regex FIRST,
+  // silently replacing the genuine enclosing method as `enclosing`.
+  //
+  // W4.J39 — a confirmed, severe ReDoS, the SAME defect class as
+  // `_resolveCalleeReturnIsLiteral`'s own `declRe` (see that function's own
+  // fix comment for the full reproduction): the ORIGINAL pattern here ALSO
+  // matched a "return type" prefix via a LAZY, `\s`-inclusive character
+  // class (`[\w.<>[\],\s]+?`), which backtracks catastrophically over the
+  // long blanked-whitespace runs `blankComments()` leaves where Juliet's
+  // own large header comments used to be. Fixed the same way: the "return
+  // type" prefix is never actually READ by this function (only the
+  // captured NAME and PARAMS matter), so it's dropped entirely — a bare
+  // `\b(?!keyword)IDENT\s*(...) {` search identifies a method declaration
+  // exactly as well, without ever touching a `\s`-inclusive lazy quantifier.
+  const methodDeclRe = /\b(?!if\b|for\b|while\b|switch\b|catch\b|synchronized\b|do\b|else\b|return\b|new\b)([A-Za-z_]\w*)\s*\(([^)]*)\)\s*(?:throws\s+[\w.,\s]+)?\s*\{/g;
+  let enclosing = null, dm;
+  while ((dm = methodDeclRe.exec(content)) && dm.index < beforeIdx) enclosing = dm;
+  if (!enclosing) return false;
+  const methodName = enclosing[1];
+  const params = _splitTopLevelCommas(enclosing[2]).map(p => p.trim()).filter(Boolean);
+  const paramIdx = params.findIndex((p) => new RegExp(`\\b${escapedVar}$`).test(p));
+  if (paramIdx === -1) return false; // varName isn't actually a param of the enclosing method
+  const escapedMethod = methodName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
+  function _checkCallAt(searchText, searchDeadRanges, matchIndex, matchEnd) {
+    const argsStart = matchEnd;
+    let braceDepth = 1, i = argsStart;
+    while (i < searchText.length && braceDepth > 0) {
+      if (searchText[i] === '(') braceDepth++;
+      else if (searchText[i] === ')') braceDepth--;
+      i++;
+    }
+    const afterClose = searchText.slice(i).match(/^\s*(\{|throws)/);
+    if (afterClose) return 'skip'; // this is the method's OWN declaration, not a call site
+    const args = _splitTopLevelCommas(searchText.slice(argsStart, i - 1)).map((a) => a.trim());
+    if (paramIdx >= args.length) return 'fail'; // arity mismatch — bail conservatively
+    const argExpr = args[paramIdx];
+    if (/^"[^"]*"$/.test(argExpr)) return 'ok'; // this caller's own argument is a direct literal
+    // The caller's argument is itself a bare identifier (Juliet's own
+    // idiom: `data = "foo"; goodG2BSink(data, ...);` — the LITERAL sits on
+    // the variable one step back from the call site, not at the call site
+    // itself). Resolve it the SAME way any other candidate literal is
+    // resolved — recursing through `_nearestAssignIsLiteral` itself,
+    // scoped to the CALL SITE's own position. Bounded by the shared
+    // recursion-depth guard.
+    if (/^[A-Za-z_]\w*$/.test(argExpr) && _nearestAssignIsLiteral(searchText, argExpr, matchIndex, searchDeadRanges, depth0 + 1, siblingFiles)) return 'ok';
+    return 'fail'; // a non-literal (or unresolvable) caller exists
+  }
+
+  function scanCallSitesIn(searchText, searchDeadRanges, classNameFilter) {
+    let sawRealCallSite = false;
+    if (classNameFilter) {
+      const inlineRe = new RegExp(`\\bnew\\s+${classNameFilter}\\s*\\(\\s*\\)\\s*\\)?\\s*\\.\\s*${escapedMethod}\\s*\\(`, 'g');
+      let cm;
+      while ((cm = inlineRe.exec(searchText))) {
+        const r = _checkCallAt(searchText, searchDeadRanges, cm.index, cm.index + cm[0].length);
+        if (r === 'skip') continue;
+        if (r === 'fail') return 'fail';
+        sawRealCallSite = true;
+      }
+      // SARD_80_F1 W5.45 — see java-structural.js's own identical fix for
+      // the full incident writeup: Juliet's abstract-dispatch caller
+      // convention is a TWO-STATEMENT pattern (`<BaseType> <var> = new
+      // <ConcreteClass>();` then later `<var>.<method>(...)`), not the
+      // inline one above. The variable's own call search is bounded to its
+      // DECLARING method's own body span (via `_enclosingMethodSpan`)
+      // since Juliet routinely reuses the same local variable name
+      // ("baseObject") across sibling bad()/goodG2B()/goodB2G() methods.
+      const declRe = new RegExp(`\\b[A-Za-z_]\\w*(?:<[^;()]*>)?\\s+([A-Za-z_]\\w*)\\s*=\\s*new\\s+${classNameFilter}\\s*\\(\\s*\\)\\s*;`, 'g');
+      let dm;
+      while ((dm = declRe.exec(searchText))) {
+        const varName2 = dm[1];
+        const span = _enclosingMethodSpan(searchText, dm.index);
+        const searchWithin = span ? searchText.slice(span.start, span.end) : searchText;
+        const offset = span ? span.start : 0;
+        const escapedVarName = varName2.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const varCallRe = new RegExp(`\\b${escapedVarName}\\s*\\.\\s*${escapedMethod}\\s*\\(`, 'g');
+        let vm;
+        while ((vm = varCallRe.exec(searchWithin))) {
+          const r = _checkCallAt(searchText, searchDeadRanges, offset + vm.index, offset + vm.index + vm[0].length);
+          if (r === 'skip') continue;
+          if (r === 'fail') return 'fail';
+          sawRealCallSite = true;
+        }
+      }
+    } else {
+      const callRe = new RegExp(`\\b${escapedMethod}\\s*\\(`, 'g');
+      let cm;
+      while ((cm = callRe.exec(searchText))) {
+        const r = _checkCallAt(searchText, searchDeadRanges, cm.index, cm.index + cm[0].length);
+        if (r === 'skip') continue;
+        if (r === 'fail') return 'fail';
+        sawRealCallSite = true;
+      }
+    }
+    return sawRealCallSite ? 'ok' : 'none';
+  }
+
+  const sameFileResult = scanCallSitesIn(content, deadRanges, null);
+  if (sameFileResult === 'fail') return false;
+  let sawRealCallSite = sameFileResult === 'ok';
+  if (siblingFiles && siblingFiles.length) {
+    const ownClass = _ownClassName(content);
+    if (ownClass) {
+      const escapedClass = ownClass.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+      for (const sib of siblingFiles) {
+        const r = scanCallSitesIn(sib.code, sib.deadRanges, escapedClass);
+        if (r === 'fail') return false;
+        if (r === 'ok') sawRealCallSite = true;
+      }
+    }
+  }
+  return sawRealCallSite;
+}
+
+// SARD_80_F1 W5.34 — see the call site's own header comment for the full
+// idiom (Juliet Flow Variant 45: a value passed as a private class member
+// variable between two methods of the same class). Only resolves when
+// `varName` is confirmed to be an actual FIELD declaration — matched via an
+// access-modifier prefix (`private`/`protected`/`public`), syntax that is
+// valid ONLY on a class/interface member in Java, never on a local variable
+// or a method parameter, so this can't misfire on an unrelated same-named
+// local. Requires EVERY assignment to the field anywhere in the file
+// (statement order doesn't matter here — unlike a backward scan, this reads
+// the field as a whole-file invariant) to resolve to a literal, recursing
+// through the same `_nearestAssignIsLiteral` machinery for a bare-identifier
+// RHS (`dataGoodG2B = data;`, itself resolved at ITS OWN position so the
+// recursive scan only sees what was visible at the time of that assignment).
+// Fails closed: no recognizable field declaration, zero assignments found,
+// or ANY assignment resolving to something other than a literal all return
+// false.
+function _resolveFieldLiteralViaAllAssignments(content, varName, deadRanges, _depth) {
+  const depth0 = _depth || 0;
+  if (depth0 >= _CALLEE_RETURN_LITERAL_CACHE_DEPTH) return false;
+  const escaped = varName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const fieldDeclRe = new RegExp(`\\b(?:private|protected|public)\\s+[\\w<>\\[\\],.\\s]+\\b${escaped}\\s*(?:=\\s*[^;]+)?;`);
+  if (!fieldDeclRe.test(content)) return false; // not a recognizable field declaration
+  const ranges = deadRanges || [];
+  const assignRe = new RegExp(`\\b${escaped}\\s*=\\s*([^;]+);`, 'g');
+  const lineOf = (idx) => content.substring(0, idx).split('\n').length;
+  let sawAssignment = false, m;
+  while ((m = assignRe.exec(content))) {
+    if (ranges.length && isLineInDeadRange(lineOf(m.index), ranges)) continue;
+    sawAssignment = true;
+    const rhs = m[1].trim();
+    if (/^"[^"]*"$/.test(rhs)) continue; // this assignment is a direct literal
+    if (/^[A-Za-z_]\w*$/.test(rhs) && rhs !== varName
+      && _nearestAssignIsLiteral(content, rhs, m.index, ranges, depth0 + 1)) continue;
+    return false; // a non-literal (or unresolvable) assignment exists somewhere
+  }
+  return sawAssignment;
+}
+
+// Exported for java-structural-cross-file.js (W5.42) — see
+// _resolveParamLiteralViaAllCallSites's own header comment for `siblingFiles`.
+export function _nearestAssignIsLiteral(content, varName, beforeIdx, deadRanges, _calleeDepth, siblingFiles) {
+  if ((_calleeDepth || 0) >= _CALLEE_RETURN_LITERAL_CACHE_DEPTH) return false;
+  const ranges = deadRanges || [];
+  const escaped = varName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const literalRe = new RegExp(`\\b${escaped}\\s*=\\s*"[^"]*"\\s*;`, 'g');
+  const anyAssignRe = new RegExp(`\\b${escaped}\\s*=\\s*([^;]+);`, 'g');
+  const lineOf = (idx) => content.substring(0, idx).split('\n').length;
+  let lastLiteralEnd = -1, m;
+  while ((m = literalRe.exec(content)) && m.index < beforeIdx) {
+    if (ranges.length && isLineInDeadRange(lineOf(m.index), ranges)) continue;
+    lastLiteralEnd = m.index + m[0].length;
+  }
+  let lastAnyEnd = -1, lastAnyRhs = null, lastAnyIdx = -1;
+  while ((m = anyAssignRe.exec(content)) && m.index < beforeIdx) {
+    if (ranges.length && isLineInDeadRange(lineOf(m.index), ranges)) continue;
+    lastAnyEnd = m.index + m[0].length;
+    lastAnyRhs = m[1].trim();
+    lastAnyIdx = m.index;
+  }
+  // W4.J37 — the nearest assignment's own RHS is a bare same-file call
+  // (`data = goodG2BSource();`, no receiver, no args needing evaluation):
+  // resolve whether that callee ALWAYS returns a literal before falling
+  // through to the stricter "must equal the nearest literal assignment"
+  // check below, which a call-shaped RHS can never satisfy on its own.
+  if (lastAnyRhs && /^[A-Za-z_]\w*\s*\([^()]*\)$/.test(lastAnyRhs)) {
+    const calleeName = lastAnyRhs.slice(0, lastAnyRhs.indexOf('(')).trim();
+    if (_resolveCalleeReturnIsLiteral(content, calleeName, ranges, _calleeDepth)) return true;
+  }
+  // W4.J38 — the nearest assignment's own RHS is a bare identifier "copy"
+  // of ANOTHER variable (`dataCopy = data;` … later `String data =
+  // dataCopy;`) — Juliet's own "make a copy of data within the same
+  // method" flow variant. Resolve the COPIED-FROM variable the same way,
+  // recursively, at THIS assignment's own position (not `beforeIdx`) so the
+  // recursive scan sees only what was visible AT THE TIME of the copy, not
+  // anything assigned later. Bounded by the shared recursion-depth guard;
+  // excludes `null` explicitly (never a candidate literal — mirrors
+  // ldap-injection.js's own W4.C37 precedent for the identical reasoning).
+  if (lastAnyRhs && lastAnyRhs !== 'null' && /^[A-Za-z_]\w*$/.test(lastAnyRhs) && lastAnyRhs !== varName) {
+    if (_nearestAssignIsLiteral(content, lastAnyRhs, lastAnyIdx, ranges, (_calleeDepth || 0) + 1, siblingFiles)) return true;
+  }
+  if (lastLiteralEnd === -1 || lastLiteralEnd !== lastAnyEnd) {
+    // W4.J38 — before failing closed, check whether `varName` is a
+    // PARAMETER of the method enclosing `beforeIdx` and, if so, whether
+    // EVERY real call site of that method supplies a literal at the
+    // matching argument position. See _resolveParamLiteralViaAllCallSites's
+    // own header comment for why this is a DIFFERENT idiom than the
+    // paramRe guard below (a caller whose own literal sits AFTER the sink
+    // method in raw file text — invisible to any backward-only scan).
+    //
+    // W5.34 — a SIBLING idiom to both W4.J38 shapes above: Juliet's own
+    // "Flow Variant 45: data passed as a private class member variable from
+    // one function to another in the same class" (confirmed via the public
+    // mirror's own CWE80_XSS__CWE182_Servlet_getQueryString_Servlet_45.java)
+    // writes `dataGoodG2B = data;` in ONE method and reads it back via
+    // `String data = dataGoodG2B;` in a DIFFERENT method. The read's own
+    // recursive resolution correctly identifies `dataGoodG2B` as a bare
+    // identifier and recurses into it — but if the WRITER method
+    // (`goodG2B()`) is textually declared AFTER the reader method
+    // (`goodG2BSink()`), which Juliet's own file layout does not guarantee
+    // either way, the field's only assignment sits AFTER `beforeIdx` and is
+    // invisible to a backward-only scan, exactly the same "forward
+    // reference" problem `_resolveParamLiteralViaAllCallSites` exists to
+    // solve for parameters — just for a FIELD instead of an argument.
+    // `_resolveFieldLiteralViaAllAssignments` is that same fix for fields:
+    // it only fires when `varName` is confirmed to be an actual field
+    // declaration (an access-modifier-qualified declaration, syntax no
+    // local variable or parameter can carry), then requires EVERY
+    // assignment to it anywhere in the file to resolve to a literal.
+    return _resolveParamLiteralViaAllCallSites(content, varName, beforeIdx, deadRanges, _calleeDepth, siblingFiles)
+      || _resolveFieldLiteralViaAllAssignments(content, varName, deadRanges, _calleeDepth);
+  }
+  // Juliet's "data passed as an argument from one method to another" flow
+  // variants (its own template naming: sources-sink-41+) sink INSIDE A
+  // HELPER method that receives the value as a formal PARAMETER, not a
+  // local assignment — `private void goodG2BSink(String data) { …
+  // DriverManager.getConnection(url, user, data); }`. A backward scan for
+  // "nearest assignment to `data`" then crosses OUT of that helper and into
+  // whichever CALLER happens to have last assigned a same-named `data`
+  // textually earlier in the file — frequently `bad()`'s own hardcoded
+  // literal, even when the ACTUAL call reaching this specific helper came
+  // from the SAFE `goodG2B()` path. A parameter declaration for `varName`
+  // that is MORE RECENT than the literal assignment means we've crossed a
+  // method boundary the assignment can't have followed us through, so the
+  // value here is actually unknown (determined by whichever caller this
+  // is) — fails closed, same direction as every other evidence-required
+  // check in this file.
+  const paramRe = new RegExp(`\\([^()]*\\b[\\w.<>\\[\\]]+\\s+${escaped}\\s*[,)]`, 'g');
+  let lastParamEnd = -1;
+  while ((m = paramRe.exec(content)) && m.index < beforeIdx) lastParamEnd = m.index + m[0].length;
+  return lastParamEnd <= lastLiteralEnd;
+}
+
 // Generic tainted-context indicator: file contains a known source.
 // Includes Juliet's connect_tcp / Environment / Property variants.
 const TAINTED_CONTEXT_RE = /\bSystem\.getenv\s*\(|\bSystem\.getProperty\s*\(|\brequest\s*\.\s*get(?:Parameter|Header|InputStream|Reader|QueryString|Cookies)\b|\bnew\s+Socket\s*\(|\b\w+\s*\.\s*getInputStream\s*\(\s*\)|\.readLine\s*\(\s*\)/;
@@ -511,6 +986,11 @@ export function scanJavaBenchExtras(file, raw) {
   if (!JAVA_EXT.test(file) || !raw || raw.length > 500_000) return [];
   const content = blankComments(raw);
   const findings = [];
+  // See _nearestAssignIsLiteral's own header comment (W4.J33): lets that
+  // helper skip an assignment inside a provably-dead if(true)/if(false)
+  // branch when deciding whether the value reaching a sink is literal-only.
+  let deadRanges = [];
+  try { deadRanges = deadBranchRanges(raw); } catch { /* parse error → no AST info */ }
 
   function lineOf(idx) { return content.substring(0, idx).split('\n').length; }
   function isTainted(arg) { return TAINTED_HINT.test(arg); }
@@ -521,8 +1001,24 @@ export function scanJavaBenchExtras(file, raw) {
   let m;
   while ((m = SEND_REDIRECT_RE.exec(content))) {
     const arg = (m[1] || '').trim();
+    // SARD_80_F1 W5.35 — a sink call sitting INSIDE a provably-dead branch
+    // (Juliet's "switch(8){case 7: <tainted sendRedirect>}" idiom, Flow
+    // Variant 15's goodB2G shapes — case 7 never matches scrutinee 8) is
+    // unreachable regardless of whether the argument is tainted: the
+    // literal-check below can never suppress it, since the value genuinely
+    // IS tainted, just unreachable. `deadRanges` was already computed for
+    // that literal check; nothing had checked it against the SINK's own
+    // line until now.
+    if (deadRanges.length && isLineInDeadRange(lineOf(m.index), deadRanges)) continue;
     // Literal-only arg: suppress. Tainted-looking arg: flag.
     if (/^"[^"]*"$/.test(arg)) continue;  // pure literal — safe
+    // Same literal-blindness class already fixed for SQLi/LDAP/XSS
+    // (W4.J12/J13/J21), never ported here: Juliet's own convention keeps the
+    // IDENTICAL `response.sendRedirect(data)` sink line in both `bad()` and
+    // `goodG2B()`, only swapping `data`'s source — confirmed against the
+    // public mirror (`CWE601_Open_Redirect__Servlet_PropertiesFile_01.java`:
+    // `data = "foo";` in `goodG2B()`, then `response.sendRedirect(data);`).
+    if (/^[A-Za-z_]\w*$/.test(arg) && _nearestAssignIsLiteral(content, arg, m.index, deadRanges)) continue;
     findings.push({
       id: id('java-extras:open-redirect', lineOf(m.index), m.index),
       kind: 'sast',
@@ -571,12 +1067,18 @@ export function scanJavaBenchExtras(file, raw) {
   }
 
   // Pattern C: raw outbound Socket reading sensitive data. Matches Juliet's
-  // connect_tcp_* / listen_tcp_* / send_* CWE-319 variants.
+  // connect_tcp_* / send_* CWE-319 variants.
   if (fileHasSensitiveContext && fileHasSocketRead) {
     RAW_SOCKET_RE.lastIndex = 0;
     while ((m = RAW_SOCKET_RE.exec(content))) {
       emitCwe319(lineOf(m.index), m.index, 'cleartext Socket with sensitive-data context');
     }
+    // Pattern C2: server-side ServerSocket.accept() — Juliet's listen_tcp_*
+    // variants (see SERVERSOCKET_ACCEPT_RE's header comment).
+    SERVERSOCKET_ACCEPT_RE.lastIndex = 0;
+    while ((m = SERVERSOCKET_ACCEPT_RE.exec(content))) {
+      emitCwe319(lineOf(m.index), m.index, 'cleartext ServerSocket.accept() with sensitive-data context');
+    }
   }
 
   // CWE-315 — sensitive Cookie without secure flag
@@ -653,6 +1155,32 @@ export function scanJavaBenchExtras(file, raw) {
     }
   }
 
+  // CWE-259 — hardcoded password reaching a credential parameter. See the
+  // header comment above the regex constants for the three sink shapes and
+  // why this fires on PROVABLE-CONSTANT values rather than tainted ones.
+  const cwe259Lines = new Set();
+  function emitHardcodedPassword(varName, matchIndex) {
+    const L = lineOf(matchIndex);
+    if (cwe259Lines.has(L)) return;
+    if (!_nearestAssignIsLiteral(content, varName, matchIndex, deadRanges)) return;
+    cwe259Lines.add(L);
+    findings.push({
+      id: id('java-extras:hardcoded-password', L, matchIndex),
+      kind: 'sast',
+      severity: 'high',
+      vuln: 'Hardcoded Password used as credential',
+      cwe: 'CWE-259', stride: 'Information Disclosure',
+      file, line: L,
+      snippet: content.substring(content.lastIndexOf('\n', matchIndex)+1, content.indexOf('\n', matchIndex)).trim().slice(0, 200),
+      remediation: 'Never hardcode credentials. Load them from a secrets manager or environment variable at runtime.',
+    });
+  }
+  for (const re of [HARDCODED_PW_DRIVERMANAGER_RE, HARDCODED_PW_KERBEROSKEY_RE, HARDCODED_PW_PASSWORDAUTH_RE]) {
+    re.lastIndex = 0;
+    let hm;
+    while ((hm = re.exec(content))) emitHardcodedPassword(hm[1], hm.index);
+  }
+
   return findings;
 }
 

package/src/sast/java-deserialization.js

@@ -81,6 +81,29 @@ import { blankComments } from './_comment-strip.js';
 
 function _lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
 
+// SARD_80_F1_SCANNER_PRD.md Juliet Java audit: `hasOIS` (file-wide) plus a
+// bare `\w+.readObject()` anywhere in the same file was measured at 122 FPs
+// on real corpus fixtures — the file-wide check does not require the CALL's
+// own receiver to be the tracked ObjectInputStream variable, so a file that
+// merely constructs an OIS somewhere (even for a genuinely unrelated
+// CWE's own source idiom) makes every OTHER bare `.readObject()` call in
+// the file match too, regardless of that call's own receiver type. Track
+// the actual variable name(s) assigned from `new ObjectInputStream(...)`
+// and require the receiver to be one of them — real correlation between
+// the construction and the call, not file-wide co-occurrence.
+const OIS_VAR_RE = /\bObjectInputStream\s+(\w+)\s*=\s*new\s+ObjectInputStream\b|\b(\w+)\s*=\s*new\s+ObjectInputStream\b/g;
+
+function _objectInputStreamVars(code) {
+  const vars = new Set();
+  let m;
+  const re = new RegExp(OIS_VAR_RE.source, OIS_VAR_RE.flags);
+  while ((m = re.exec(code))) {
+    const name = m[1] || m[2];
+    if (name) vars.add(name);
+  }
+  return vars;
+}
+
 export function scanJavaDeserialization(fp, raw) {
   if (!/\.(?:java|kt|kts|scala|groovy|gradle)$/i.test(fp)) return [];
   if (!raw || raw.length > 500_000) return [];
@@ -89,6 +112,7 @@ export function scanJavaDeserialization(fp, raw) {
   // one, a bare .readObject() call is almost certainly RMI/JDBC/socket noise
   // unrelated to native serialization gadgets.
   const hasOIS = /\bnew\s+ObjectInputStream\b/.test(code);
+  const oisVars = _objectInputStreamVars(code);
   // Pre-pass for XStream — gate the broad `.fromXML(` regex.
   const hasXStream = /\bXStream\b|\bxstream\.|com\.thoughtworks\.xstream/.test(code);
   const findings = [];
@@ -104,8 +128,13 @@ export function scanJavaDeserialization(fp, raw) {
       if (p.requireOIS && !hasOIS) continue;
       // For the ObjectInputStream pattern, the second branch (bare \w+.readObject)
       // only fires when there's an OIS in the file AND the method receiver isn't
-      // obviously a JDBC ResultSet (rs/results/rset names).
-      if (p.requireOIS && m[1] && /^(?:rs|result|results|rset|resultset)$/i.test(m[1])) continue;
+      // obviously a JDBC ResultSet (rs/results/rset names) AND the receiver is
+      // actually a variable this file constructed as an ObjectInputStream —
+      // real correlation, not just file-wide co-occurrence (see oisVars above).
+      if (p.requireOIS && m[1]) {
+        if (/^(?:rs|result|results|rset|resultset)$/i.test(m[1])) continue;
+        if (!oisVars.has(m[1])) continue;
+      }
       const line = _lineOf(raw, m.index);
       push({
         id: `java-deser:${fp}:${line}:${p.name.replace(/\s+/g, '_')}`,