@clear-capabilities/agentic-security-scanner 0.151.3 → 0.153.0

package/src/ir/parser-js.js

@@ -80,6 +80,28 @@ function exprOf(n) {
     case 'StringLiteral':
     case 'BooleanLiteral':
     case 'NullLiteral':       return { kind: 'literal', value: n.value !== undefined ? n.value : null };
+    // Next-gen taint capability #2 (string/value abstract domain) — a regex
+    // LITERAL (`/^[a-z]+$/`) previously fell through to `{kind:'unknown'}`
+    // entirely: no case matched `RegExpLiteral`, so the ENTIRE pattern was
+    // lost before any downstream consumer (a guard-narrowing check, the
+    // existing `string-domain.js` lattice) ever saw it. This is why a
+    // pattern-based validation guard (`if (/^\d+$/.test(x)) sink(x)`) could
+    // never be recognized as safety-narrowing at all, regardless of how
+    // permissive or restrictive the pattern was — confirmed via a direct IR
+    // dump before this fix (the regex literal's own callee-object lowered to
+    // `{kind:'unknown'}`, not merely an unrecognized guard shape). Lowered
+    // to a `literal` node carrying the ACTUAL RegExp instance (safe here —
+    // this parser runs in-process, unlike the five hand-rolled parsers,
+    // which have no such runtime and store literal-only VALUES), tagged
+    // `isRegex: true` so a consumer can distinguish "this literal's value
+    // happens to be a RegExp" from a genuine string/number/boolean literal
+    // without doing an `instanceof` check itself. A malformed pattern (rare,
+    // Babel would normally reject it upstream) falls back to `unknown`
+    // rather than throwing mid-parse.
+    case 'RegExpLiteral': {
+      try { return { kind: 'literal', value: new RegExp(n.pattern, n.flags || ''), isRegex: true }; }
+      catch { return { kind: 'unknown' }; }
+    }
     case 'TemplateLiteral':   return { kind: 'tpl', parts: (n.expressions || []).map(exprOf) };
     case 'MemberExpression':  return {
       kind: 'member',

package/src/ir/parser-php.js

@@ -86,18 +86,19 @@ const FUNC_RE = new RegExp(
 // fix (see the `catch`/`finally` regression tests in
 // `test/parser-php-control-flow.test.js`, which fail without this change
 // and pass with it) — `_scanTryCatchFinally`'s balanced-brace scanning has
-// no competing bug to interact with. For `else` specifically, this
-// lookahead fix is still correct and necessary, but its OUTCOME is masked
-// in practice by `ifMatch`'s own separate, pre-existing, out-of-scope
-// greedy-capture bug (the then-body group unconditionally swallows
-// through to the else-body's own closing `}`, dropping the else body
-// regardless of whether a comment was ever involved — confirmed by
-// testing commit `735ef63`, before this task started, with an identical
-// comment-free else fixture: already broken then, for an unrelated
-// reason). `ifMatch` and `_scanTryCatchFinally` both already tolerate an
-// ordinary `\s*`/whitespace gap between `}` and the keyword; skipping
-// comments here too keeps this lookahead in sync with what those
-// recognizers can actually parse once the flush is correctly suppressed.
+// no competing bug to interact with. For `else`, this lookahead fix was
+// ORIGINALLY still correct but its outcome was masked by `ifMatch`'s own
+// separate greedy-capture bug — SARD_80_F1 W3.2 replaced that regex with
+// `_scanIfElse`, a balanced-brace scanner mirroring `_scanTryCatchFinally`'s
+// own technique (see that function's header comment for the full incident:
+// the old regex's then-body group unconditionally swallowed through to the
+// else-body's own closing `}`, which was worse than "drops the else body's
+// first statement" — it silently spliced the else body's REMAINING
+// statements onto the then-branch's own CFG chain with no real branch at
+// all, a correctness hazard once branch-scoped taint narrowing existed).
+// `else`/`catch`/`finally` now all parse via balanced-brace scanners with
+// no competing greedy-capture bug; this lookahead's comment-skip fix
+// applies uniformly to all three.
 function _continuationKeywordAhead(body, i) {
   let j = i + 1;
   let moved = true;
@@ -215,13 +216,12 @@ function _splitStatements(body) {
       //
       // EXCEPTION: do not flush when the next non-whitespace token is
       // `else`, `catch`, or `finally` — those must stay glued onto the
-      // SAME statement as the preceding `}` for `ifMatch` and the
+      // SAME statement as the preceding `}` for `_scanIfElse` and the
       // try/catch/finally recognizer in `_buildCfg` to see
       // `if (...) { ... } else { ... }` or
       // `try { ... } catch (...) { ... } finally { ... }` as one
-      // contiguous blob (`ifMatch` is anchored end-to-end with `$` and
-      // spans the whole construct; the try/catch/finally recognizer scans
-      // the whole construct by hand for the same reason). A blind
+      // contiguous blob (both scan the whole construct by hand, requiring
+      // it to arrive as a single, unsplit statement string). A blind
       // flush-on-every-`}` here would silently split `if`/`else` and
       // multi-clause `try` into two statements each, which is a strictly
       // WORSE regression than the "must be last statement in scope" bug
@@ -294,12 +294,12 @@ function _splitStatements(body) {
 // are kept, outermost-first — see parser-cs.js's twin function for why
 // (a first version that kept only the outermost broke a real chain shape
 // where the tainted value sits on an INNER call).
-function _followChain(s, endIdx, calleeSoFar, argsSoFar) {
+function _followChain(s, endIdx, calleeSoFar, argsSoFar, isNew) {
   const rest = s.slice(endIdx);
   const m = rest.match(/^(?:->|::)(\w+)/);
-  if (!m) return { kind: 'call', callee: calleeSoFar, args: argsSoFar };
+  if (!m) return { kind: 'call', callee: calleeSoFar, args: argsSoFar, isNew };
   const outer = matchBalancedCall(rest, /^(?:->|::)(\w+)/);
-  if (!outer) return { kind: 'call', callee: calleeSoFar, args: argsSoFar };
+  if (!outer) return { kind: 'call', callee: calleeSoFar, args: argsSoFar, isNew };
   const outerArgs = _splitTopLevelCommas(outer.argsText).map(_lowerExpr);
   return _followChain(rest, outer.endIdx, `${calleeSoFar}.${outer.callee}`, outerArgs.concat(argsSoFar));
 }
@@ -307,6 +307,35 @@ function _followChain(s, endIdx, calleeSoFar, argsSoFar) {
 function _lowerExpr(text) {
   const s = String(text || '').trim();
   if (!s) return { kind: 'unknown' };
+  // SARD PHP corpus: the backtick shell-execution operator (`` `cmd` ``,
+  // equivalent to shell_exec()) is a completely distinct delimiter from a
+  // double-quoted string and had NO recognizer at all — it fell through
+  // every branch below to {kind:'unknown'}, silently dropping the shell
+  // command (and any interpolated taint inside it) entirely. This is this
+  // corpus's single most common command-injection shape (83 of 224 bad
+  // dev-split cases use it as their first source assignment). Lowered to a
+  // synthetic call (`__php_backtick_exec__`, an identifier real PHP code
+  // can never actually name a dotted method) carrying the interpolated
+  // command as its sole argument — same convention as parser-rb.js's
+  // `__ruby_backtick_exec__` and this file's own `__php_echo__`. Reuses the
+  // double-quoted interpolation scanner below (backticks interpolate `$var`/
+  // `{$expr}` exactly like double-quoted strings do in PHP).
+  const btLiteral = s.match(/^`((?:[^`\\]|\\.)*)`$/);
+  if (btLiteral) {
+    const inner = btLiteral[1];
+    const re = /\{(\$[^}]+)\}|(\$[A-Za-z_]\w*(?:->[A-Za-z_]\w*|\[[^\]]+\])?)/g;
+    let lastIndex = 0;
+    const parts = [];
+    let m;
+    while ((m = re.exec(inner)) !== null) {
+      if (m.index > lastIndex) parts.push({ kind: 'literal', value: inner.slice(lastIndex, m.index) });
+      parts.push(_lowerExpr(m[1] !== undefined ? m[1] : m[2]));
+      lastIndex = re.lastIndex;
+    }
+    if (lastIndex < inner.length) parts.push({ kind: 'literal', value: inner.slice(lastIndex) });
+    const cmd = parts.length === 1 ? parts[0] : { kind: 'tpl', parts };
+    return { kind: 'call', callee: '__php_backtick_exec__', args: [cmd] };
+  }
   // Stage 3 correctness audit (detection depth, per-language-IR): PHP
   // double-quoted strings interpolate variables directly
   // ("SELECT ... WHERE id=$id", "hi {$user->name}") — single-quoted
@@ -375,8 +404,90 @@ function _lowerExpr(text) {
     }
     return cur;
   }
+  // General array/subscript READ: `$var[key]`, `$this->prop[key]`, and
+  // repeated subscripts (`$arr[0][1]`) — anything reaching here is NOT one
+  // of the special-cased superglobals above. SARD_80_F1 W5.9 — before this,
+  // ordinary PHP array/property-array access had NO lowering at all
+  // (fell through every branch to `{kind:'unknown'}`, discarding whatever
+  // taint the subscripted value carried entirely). A literal string/int key
+  // becomes that literal `prop`; a computed key (a variable, an expression)
+  // widens to `'*'`, the SAME "unknown-key writes widen to the container"
+  // convention documented in dataflow/CLAUDE.md — the base object is
+  // marked tainted as a whole rather than guessing which element. Mirrors
+  // `_subscriptTargetPath` below (the WRITE side), including its `.`-not-
+  // `->` separator convention, and its same "no nested brackets inside one
+  // key" scope limit.
+  {
+    const sub = s.match(/^(\$[\w]+(?:->[\w]+)*)((?:\[[^\[\]]*\])+)$/);
+    if (sub) {
+      let cur = _lowerExpr(sub[1]);
+      const segs = sub[2].match(/\[[^\[\]]*\]/g) || [];
+      for (const seg of segs) {
+        const keyText = seg.slice(1, -1).trim();
+        const litKey = keyText.match(/^"([^"]*)"$/) || keyText.match(/^'([^']*)'$/);
+        const prop = litKey ? litKey[1] : (/^\d+$/.test(keyText) ? keyText : '*');
+        cur = { kind: 'member', object: cur, prop };
+      }
+      return cur;
+    }
+  }
   // Variable
   if (/^\$[A-Za-z_]\w*$/.test(s)) return { kind: 'ident', name: s };
+  // Object creation: `new ClassName(args)` (namespace-qualified names allowed,
+  // `\` separator) — lowered to a call so a constructor's own args carry
+  // taint AND so `class-hierarchy.js#typeOfVar` can seed `$var`'s declared
+  // type from `isNew:true`, the same mechanism parser-cs.js/parser-java.js
+  // already rely on. Without this, `$temp = new Input(); $temp->getInput()`
+  // lowered `new Input()` to {kind:'unknown'} (this file had NO `new`
+  // recognizer at all before this fix — confirmed by IR dump, not assumed),
+  // so `$temp`'s type was never known and `$temp->getInput()` could never be
+  // resolved to `Input::getInput`'s own return-taint summary — invisible to
+  // every PHP corpus case that reads a tainted value back out through an
+  // object method (`object/directGet`, `object/classicGet`, and any
+  // ARRAY-wrapping variant of the same shape, per the SARD PHP suite's own
+  // published generator source, `input.xml`). Zero-arg `new ClassName` (no
+  // parens at all — valid PHP) is handled too, matching PHP's actual grammar
+  // rather than assuming C#/Java's mandatory-parens convention.
+  const newMatch = matchBalancedCall(s, /^new\s+([\w\\]+)/);
+  if (newMatch) {
+    const callee = newMatch.callee.split(/[\\.]/).pop();
+    const args = _splitTopLevelCommas(newMatch.argsText).map(_lowerExpr);
+    return _followChain(s, newMatch.endIdx, callee, args, true);
+  }
+  const bareNew = s.match(/^new\s+([\w\\]+)\s*$/);
+  if (bareNew) {
+    const callee = bareNew[1].split(/[\\.]/).pop();
+    return { kind: 'call', callee, args: [], isNew: true };
+  }
+  // SARD_80_F1 W5.13 — `include`/`require`(`_once`)? as an EXPRESSION, not a
+  // statement. `_lowerStmt` above already recognizes this construct when it
+  // IS the entire statement, but the real public SARD PHP suite generator's
+  // own CWE-98 (File Inclusion) shape — confirmed via
+  // `stivalet/PHP-Vuln-test-suite-generator`'s own `construction.xml`
+  // (`$var = include("'". $tainted . ".php'");`) — assigns the include
+  // EXPRESSION to a variable, so it's lowered as an ordinary assignment's
+  // RHS through `_lowerExpr`, never through `_lowerStmt`'s statement-form
+  // branch at all. Without this, the generic function-call matcher below
+  // treated `include(...)` as an ordinary call literally named "include" —
+  // never matching the catalog's `__php_include__`-keyed sink
+  // (`php-include-lfi`) — a total, structural blackout for this exact,
+  // real-corpus shape (this benchmark's entire CWE-98 family, tp=0 despite
+  // five prior dedicated investigation cycles this session, none of which
+  // had yet examined this specific "include used as an expression" shape).
+  // Lowered identically to `_lowerStmt`'s own handling so both forms land
+  // on the same synthetic callee.
+  const includeCall = matchBalancedCall(s, /^(?:include|require)(?:_once)?\b/);
+  if (includeCall) {
+    const args = _splitTopLevelCommas(includeCall.argsText).map(_lowerExpr);
+    return { kind: 'call', callee: '__php_include__', args: args.length ? [args[0]] : [] };
+  }
+  // Paren-free form used as an expression (rare but valid PHP, e.g.
+  // `if (include $page . ".php") { … }`) — mirrors `_lowerStmt`'s own
+  // paren-free handling for the statement form.
+  const includeBare = s.match(/^(?:include|require)(?:_once)?\s+(.+)$/);
+  if (includeBare) {
+    return { kind: 'call', callee: '__php_include__', args: [_lowerExpr(includeBare[1])] };
+  }
   // Method call: $obj->method(args) or ClassName::method(args).
   // matchBalancedCall finds the paren that actually balances the FIRST
   // '(' — not the greedy-to-end-of-string match the old `/\((.*)\)\s*$/`
@@ -468,6 +579,28 @@ function _splitTopLevelDot(s) {
   return out;
 }
 
+// SARD_80_F1 W5.9 — converts a PHP subscript-assignment LHS text
+// (`$arr[1]`, `$this->input[1]`, `$arr['key']`) into the same dot-joined
+// access-path string `_lowerExpr`'s general-subscript READ branch (and
+// `accessPathOf`) compute for the equivalent read, so a later read of the
+// same location can find the taint this write recorded. Returns null when
+// `lhs` doesn't match the single-non-nested-bracket-key shape this covers
+// (the caller's own regex already filters most of this, but a defensive
+// re-check here keeps this function safe to call standalone).
+function _subscriptTargetPath(lhs) {
+  const m = lhs.match(/^(\$[\w]+(?:->[\w]+)*)((?:\[[^\[\]]*\])+)$/);
+  if (!m) return null;
+  const base = m[1].replace(/->/g, '.');
+  const segs = (m[2].match(/\[[^\[\]]*\]/g) || []).map((seg) => {
+    const keyText = seg.slice(1, -1).trim();
+    const litKey = keyText.match(/^"([^"]*)"$/) || keyText.match(/^'([^']*)'$/);
+    if (litKey) return litKey[1];
+    if (/^\d+$/.test(keyText)) return keyText;
+    return '*';
+  });
+  return [base, ...segs].join('.');
+}
+
 function _lowerStmt(stmt, line) {
   const s = stmt.trim();
   if (!s || s.startsWith('//') || s.startsWith('#')) return null;
@@ -491,10 +624,71 @@ function _lowerStmt(stmt, line) {
     const rest = s.replace(/^(?:echo|print)\s*/, '');
     return { kind: 'call', line, callee: '__php_echo__', args: _splitTopLevelCommas(rest).map(_lowerExpr) };
   }
+  // `include`/`require`/`include_once`/`require_once` are PHP LANGUAGE
+  // CONSTRUCTS, not function calls — `include $page . ".php";` (the common,
+  // paren-free form) has no `(` immediately after the keyword, and even the
+  // parenthesized form never reaches the statement-form call regex below
+  // because these keywords aren't ordinary identifiers to that regex's own
+  // exclusion (PHP itself reserves them). Lowered to a synthetic call
+  // (`__php_include__`), same convention as `__php_echo__` above.
+  if (/^(?:include|require)(?:_once)?\b/.test(s)) {
+    const rest = s.replace(/^(?:include|require)(?:_once)?\s*/, '').replace(/^\((.*)\)$/, '$1');
+    return { kind: 'call', line, callee: '__php_include__', args: [_lowerExpr(rest)] };
+  }
+  // A bare backtick expression as its OWN statement (not assigned to a
+  // variable) matches none of the branches below — matchBalancedCall's
+  // callee regex requires an identifier/`$var` prefix, which a backtick
+  // literal isn't. Delegate straight to _lowerExpr, same fix parser-rb.js
+  // needed for the identical shape.
+  if (/^`/.test(s)) {
+    const call = _lowerExpr(s);
+    if (call.kind === 'call') return { kind: 'call', line, callee: call.callee, args: call.args };
+  }
+  // Array/subscript WRITE: `$arr[key] = value;`, `$this->prop[key] = value;`,
+  // repeated subscripts (`$arr[0][1] = value;`). SARD_80_F1 W5.9 — before
+  // this, the whole STATEMENT fell through every branch in this function
+  // (the plain-assign regex below requires a target of nothing but
+  // `[\w]`/`->`, which a trailing `[...]` never satisfies) and vanished
+  // from the CFG entirely — not even an `unknown`-kind node, just gone, so
+  // `$arr[1] = $_GET['x'];` had NO observable effect on `$arr` at all. Must
+  // run BEFORE the plain-assign regex (mutually exclusive targets, but this
+  // is the more specific pattern). Builds the SAME dot-joined access-path
+  // string as an equivalent READ (`_lowerExpr`'s general-subscript branch,
+  // and `accessPathOf` for the member-expression form), via
+  // `_subscriptTargetPath` — a literal key becomes that literal path
+  // segment; a computed key widens to `'*'` (dataflow/CLAUDE.md's
+  // "unknown-key writes widen to the container" convention, applied here
+  // at the parser level since there is no other lowering path for this at
+  // all). Scoped to a single non-nested-bracket key per subscript (i.e. not
+  // `$arr[$obj[0]]`) — the overwhelmingly common shape; anything more
+  // exotic simply doesn't match and falls through unchanged.
+  {
+    const subAssign = s.match(/^(\$[\w]+(?:->[\w]+)*(?:\[[^\[\]]*\])+)\s*=\s*(.+)$/s);
+    if (subAssign) {
+      const targetPath = _subscriptTargetPath(subAssign[1]);
+      if (targetPath) return { kind: 'assign', line, target: targetPath, source: _lowerExpr(subAssign[2]) };
+    }
+  }
   // Assignment: $var = expr
+  //
+  // SARD_80_F1 W5.9 — a member-chain target (`$this->input = …`) kept its
+  // literal `->` separator in `target`, but `accessPathOf` (access-paths.js)
+  // computes a READ of the same property as a DOT-joined string
+  // (`${base}.${prop}`) — `member` is the universal IR expression shape
+  // every parser in this tree uses, and `.` is the one separator the whole
+  // engine (isCoveredBy, addPath, removePathAndDescendants) understands.
+  // So `$this->input = $_GET[...]; $x = $this->input;` taints the WRITE
+  // under the key `"$this->input"` but the READ looks up `"$this.input"` —
+  // two different strings that can never match. This made every PHP
+  // object-property taint round-trip fail, even same-scope, same-line-
+  // adjacent ones (found while investigating the SARD PHP corpus's
+  // persistent CWE-91/98 tp=0 — its own generator source uses exactly this
+  // shape, an object wrapping `$_GET` in a property, for a common `input`
+  // source variant). Normalizing `->` to `.` here is the ONLY change
+  // needed: every downstream consumer already speaks dot-paths.
   const assign = s.match(/^(\$[\w]+(?:->[\w]+)*)\s*=\s*(.+)$/s);
   if (assign) {
-    return { kind: 'assign', line, target: assign[1], source: _lowerExpr(assign[2]) };
+    return { kind: 'assign', line, target: assign[1].replace(/->/g, '.'), source: _lowerExpr(assign[2]) };
   }
   // Statement-form call
   const call = matchBalancedCall(s, /^(\$[\w]+(?:->[\w]+)*|[A-Za-z_][\w]*(?:::[\w]+)*)/);
@@ -562,9 +756,85 @@ function _lineAt(src, idx) {
   return line;
 }
 
-function _qid(file, name, line, body) {
+function _qid(file, name, line, body, className) {
   const sha = crypto.createHash('sha256').update(body).digest('hex').slice(0, 8);
-  return `${file}::${name}@${line}#${sha}`;
+  return className ? `${file}::${className}::${name}@${line}#${sha}` : `${file}::${name}@${line}#${sha}`;
+}
+
+// SARD 80% F1 push — this parser had NO class-boundary tracking at all
+// (confirmed: no prior `class` recognizer of any kind existed in this
+// file). Every method's `qid` was a flat `file::name@line#sha`, never the
+// two-segment `file::ClassName::name@line` shape `callgraph.js`'s
+// `classMethods` index looks for (via its own `::(\w+)::(\w+)@` regex) —
+// so a call like `$obj->method()` on a variable whose constructed type IS
+// known (via `new ClassName()`, see `_lowerExpr`'s own `new` fix above)
+// could still never resolve to the actual method's taint summary, because
+// there was no class-qualified qid for it to resolve TO. `ir.classes`
+// itself is deliberately NOT populated here (unlike Java/C#): `callgraph.js`
+// already falls back to an uppercase-first-letter heuristic
+// (`/^[A-Z]/.test(m[1])`) when a file has no `ir.classes`, and ordinary PHP
+// class-naming convention satisfies that trivially — building a full
+// `ir.classes` array (bases/fields/etc.) for a heuristic that already
+// works would be scope creep beyond what this specific gap needs.
+// Deliberately narrow, matching this file's own documented scope
+// boundary: plain `class Name { ... }` only — traits, interfaces, and
+// anonymous classes (already out of scope for this whole parser, per the
+// file header) are not tracked, so a method inside one of those still
+// gets an unqualified qid exactly as before this fix (no regression,
+// simply no new resolution for a shape this parser never modeled).
+const CLASS_RE = /\bclass\s+([A-Za-z_]\w*)(?:\s+extends\s+[A-Za-z_][\w\\]*)?(?:\s+implements\s+[\w\\,\s]+)?\s*\{/g;
+function _findClassRegions(code) {
+  const regions = [];
+  CLASS_RE.lastIndex = 0;
+  let cm;
+  while ((cm = CLASS_RE.exec(code)) !== null) {
+    const openBrace = cm.index + cm[0].length - 1;
+    const extracted = _extractBody(code, openBrace);
+    if (!extracted) continue;
+    regions.push({ name: cm[1], start: openBrace, end: extracted.end });
+  }
+  return regions;
+}
+// SARD_80_F1 W5.10 — declared field names for one class region, feeding
+// `ir.classes[].fields` so `dataflow/engine.js`'s cross-method field-taint
+// pass (SARD_80_F1_SCANNER_PRD.md Juliet flow variants 45/65-68) can tell a
+// field write (`$this->input = $_GET[...];` in one method) apart from an
+// ordinary same-named LOCAL in a different method, and taint a sibling
+// method's read of it. That pass is entirely language-agnostic and already
+// explicitly designed to cover PHP (per its own comment: "confirmed by
+// direct probing... none of `sf = data;`, `this.inst = data;` ever
+// populated it, for any language") — the ONLY missing piece for PHP was
+// `ir.classes` itself, never emitted at all before this (W1.1 closed PHP's
+// method-CALL-resolution gap WITHOUT it, via a narrower workaround; this is
+// the real thing, needed for a DIFFERENT consumer). `public`/`private`/
+// `protected`/`var`, each an accessibility keyword that is ONLY valid PHP
+// syntax at class-member-declaration position — never as an ordinary
+// statement inside a method body — so a whole-class-body regex scan is
+// safe without needing to separately exclude nested method bodies.
+const CLASS_FIELD_RE = /\b(?:public|private|protected|var)\s+(?:static\s+)?(?:\?[\w\\]+\s+)?\$(\w+)/g;
+function _extractClassFields(code, region) {
+  const body = code.slice(region.start, region.end);
+  const fields = [];
+  let fm;
+  CLASS_FIELD_RE.lastIndex = 0;
+  // Bare (no `$`) — matches every other language's field-name convention in
+  // `ir.classes[].fields` (C#/Java field names never carry a sigil); the
+  // `$`-sigil is PHP-specific and is instead accounted for on the
+  // consuming side (dataflow/engine.js's `$this.` prefix check), the same
+  // place `_this_.`/`this.` are already handled per-language.
+  while ((fm = CLASS_FIELD_RE.exec(body)) !== null) fields.push(fm[1]);
+  return fields;
+}
+function _classNameAt(regions, idx) {
+  // `idx >= r.start`, not `>`: FUNC_RE's own leading boundary alternation
+  // (`(?:^|[\n;{}]|<\?php|<\?)`) can match the class's own opening `{`
+  // itself as the function match's boundary token when a method is the
+  // FIRST statement in the class body (no blank line/comment between
+  // `class Foo{` and the method) — confirmed by direct index inspection,
+  // not assumed: `m.index` lands exactly ON `r.start` in that shape, and a
+  // strict `>` silently excluded the very first method of every class.
+  for (const r of regions) if (idx >= r.start && idx < r.end) return r.name;
+  return null;
 }
 
 // FUNC_RE's leading alternation `(?:^|[\n;{}]|<\?php|<\?)` matches a single
@@ -797,6 +1067,116 @@ function _scanTryCatchFinally(s) {
 // blank line (or, at module level, any blanked-out function span — see
 // `_blankSpans`) that preceded a statement, which is exactly what made
 // module-level PHP findings report the wrong source line.
+// Find the ')' that balances the '(' at `openIdx`, string/paren-aware.
+function _findMatchingParen(s, openIdx) {
+  let depth = 0, inStr = null, escape = false;
+  for (let i = openIdx; i < s.length; i++) {
+    const c = s[i];
+    if (escape) { escape = false; continue; }
+    if (inStr) {
+      if (c === '\\') { escape = true; continue; }
+      if (c === inStr) inStr = null;
+      continue;
+    }
+    if (c === '"' || c === '\'') { inStr = c; continue; }
+    if (c === '(') depth++;
+    else if (c === ')') { depth--; if (depth === 0) return i; }
+  }
+  return -1;
+}
+
+// SARD PHP corpus: `if (($value = fgets($handle, 4096)) == false) { ... }` —
+// an assignment embedded inside an if/while CONDITION, PHP's dominant real-
+// world idiom for reading a file/stream line by line (238 of 995 dev-split
+// cases use exactly this shape). `_lowerStmt`'s assignment regex only
+// matches statement-position assignments, so `$value` never got a real
+// assign CFG node — the source read was invisible regardless of what
+// catalog entries exist for the RHS callee. Extracts every `($var = expr)`
+// sub-expression from a condition's text (balanced-paren aware, so nested
+// calls like `fgets($handle, 4096)` don't confuse the scan), replacing each
+// with the bare target variable so the boolean test itself still lowers
+// normally (`$value == false`), and returns the extracted assignments to be
+// emitted as real CFG nodes immediately before the if/while node.
+// SARD_80_F1 W3.2 — `ifMatch`'s regex-based then/else split
+// (`\{([\s\S]*)\}(?:\s*else\s*\{([\s\S]*)\})?`) has a genuine, previously
+// UNDERSTATED greedy-capture bug, already documented in ir/CLAUDE.md as
+// "drops the else-body's first statement" — but the real behavior is worse
+// than that description: `[\s\S]*` being greedy with no brace-depth
+// awareness means the THEN group ALWAYS swallows the ENTIRE remaining text
+// (including the literal `} else {` text and the whole else body) whenever
+// such an all-consuming parse is grammatically valid, which it always is
+// (the else-clause is optional). The else body's statements don't just lose
+// their first line — they get lowered as a plain SEQUENTIAL CONTINUATION of
+// the then-branch's own CFG chain, with NO independent branch at all. This
+// was invisible as long as both branches always carried the SAME taint
+// state (the common case before branch-scoped narrowing existed), but
+// becomes a genuine false-negative hazard once a branch CAN carry a
+// narrower state than its sibling (guard-predicate narrowing, `case 'if'`
+// in dataflow/engine.js): the else-branch's own sink would incorrectly
+// inherit the THEN branch's narrowed (guard-passed) taint state instead of
+// the real, unnarrowed one. Fixed with a balanced-brace scanner mirroring
+// `_scanTryCatchFinally`'s already-correct technique (that function's own
+// comment notes it "has no greedy-capture issue" for exactly this reason).
+// Deliberately does NOT handle `else if (...) { ... }` (no braces around a
+// chained if) — same pre-existing, documented scope boundary the old regex
+// never covered either (elseif/else-if chains stay unsupported).
+function _scanIfElse(s) {
+  const head = /^if\s*\(/.exec(s);
+  if (!head) return null;
+  const parenStart = head[0].length - 1;
+  const parenEnd = _findMatchingParen(s, parenStart);
+  if (parenEnd < 0) return null;
+  const condText = s.slice(parenStart + 1, parenEnd);
+  let i = parenEnd + 1;
+  i += (/^\s*/.exec(s.slice(i)) || [''])[0].length;
+  if (s[i] !== '{') return null;
+  const thenBodyOffset = i + 1;
+  const thenEnd = _matchBraceBlock(s, i);
+  if (thenEnd < 0) return null;
+  const thenBody = s.slice(thenBodyOffset, thenEnd - 1);
+  i = thenEnd;
+
+  let elseBody = null;
+  let elseBodyOffset = -1;
+  {
+    let j = i + (/^\s*/.exec(s.slice(i)) || [''])[0].length;
+    const em = /^else\s*/.exec(s.slice(j));
+    if (em) {
+      const afterElse = j + em[0].length;
+      if (s[afterElse] === '{') {
+        const bodyOffset = afterElse + 1;
+        const bodyEnd = _matchBraceBlock(s, afterElse);
+        if (bodyEnd < 0) return null;
+        elseBody = s.slice(bodyOffset, bodyEnd - 1);
+        elseBodyOffset = bodyOffset;
+        i = bodyEnd;
+      }
+      // else-if (no braces): leave `i` unadvanced — the trailing-content
+      // check below will reject the match and the caller falls back to
+      // whatever the old regex path did for this shape (also unsupported).
+    }
+  }
+  if (s.slice(i).trim() !== '') return null;
+  return { condText, thenBody, thenBodyOffset, elseBody, elseBodyOffset };
+}
+
+function _hoistCondAssign(cond) {
+  const assigns = [];
+  let s = cond;
+  const re = /\(\s*(\$[A-Za-z_]\w*(?:->[A-Za-z_]\w*)*)\s*=(?!=)\s*/;
+  let guard = 0;
+  let m;
+  while (guard++ < 5 && (m = re.exec(s)) !== null) {
+    const openIdx = m.index;
+    const closeIdx = _findMatchingParen(s, openIdx);
+    if (closeIdx === -1) break;
+    const exprText = s.slice(openIdx + m[0].length, closeIdx);
+    assigns.push({ target: m[1], source: _lowerExpr(exprText) });
+    s = s.slice(0, openIdx) + m[1] + s.slice(closeIdx + 1);
+  }
+  return { assigns, cond: s };
+}
+
 function _buildCfg(bodyText, nodes, prevId, startLine, depth = 0) {
   if (depth > 12) return prevId;
   const stmts = _splitStatements(bodyText);
@@ -817,25 +1197,31 @@ function _buildCfg(bodyText, nodes, prevId, startLine, depth = 0) {
     // back to `s` (fix round 1 also missed that a comment anywhere inside
     // `s` — not just inside the header — undercounts newlines the same
     // way; that half is fixed by `_splitStatements` now pushing a `\n`
-    // for every newline a skipped comment displaces, above). A `d`-flagged
-    // regex exposes each capture group's real character offset within
-    // `s` via `.indices`, so `_countNewlines(s, offset)` gives the body's
-    // EXACT absolute line regardless of how many lines the header itself
-    // spans or how many comments precede the body — the same precise
-    // per-clause technique the try/catch/finally recognizer below already
-    // uses (there, offsets come from the balanced-brace scanner instead
-    // of regex `.indices`, same principle).
-    const ifMatch = s.match(/^if\s*\((.+?)\)\s*\{([\s\S]*)\}(?:\s*else\s*\{([\s\S]*)\})?\s*$/ds);
-    if (ifMatch) {
-      const ifNode = _addNode(nodes, { kind: 'if', cond: _lowerExpr(ifMatch[1]), line });
-      _linkNodes(nodes, prev, ifNode);
+    // for every newline a skipped comment displaces, above). SARD_80_F1
+    // W3.2 replaced the old regex here with `_scanIfElse` (see its own
+    // header comment for the full incident writeup), a balanced-brace
+    // scanner giving REAL character offsets for the then/else bodies —
+    // `_countNewlines(s, offset)` from those offsets gives the EXACT
+    // absolute line regardless of header/comment line-count, same
+    // per-clause technique the try/catch/finally recognizer below uses.
+    const ifElse = _scanIfElse(s);
+    if (ifElse) {
+      const { assigns: ifAssigns, cond: ifCond } = _hoistCondAssign(ifElse.condText);
+      let condPrev = prev;
+      for (const a of ifAssigns) {
+        const aNode = _addNode(nodes, { kind: 'assign', target: a.target, source: a.source, line });
+        _linkNodes(nodes, condPrev, aNode);
+        condPrev = aNode;
+      }
+      const ifNode = _addNode(nodes, { kind: 'if', cond: _lowerExpr(ifCond), line });
+      _linkNodes(nodes, condPrev, ifNode);
       const join = _addNode(nodes, { kind: 'noop', line });
-      const thenStartLine = line + _countNewlines(s, ifMatch.indices[2][0]);
-      const thenTail = _buildCfg(ifMatch[2], nodes, ifNode, thenStartLine, depth + 1);
+      const thenStartLine = line + _countNewlines(s, ifElse.thenBodyOffset);
+      const thenTail = _buildCfg(ifElse.thenBody, nodes, ifNode, thenStartLine, depth + 1);
       _linkNodes(nodes, thenTail, join);
-      if (ifMatch[3]) {
-        const elseStartLine = line + _countNewlines(s, ifMatch.indices[3][0]);
-        const elseTail = _buildCfg(ifMatch[3], nodes, ifNode, elseStartLine, depth + 1);
+      if (ifElse.elseBody !== null) {
+        const elseStartLine = line + _countNewlines(s, ifElse.elseBodyOffset);
+        const elseTail = _buildCfg(ifElse.elseBody, nodes, ifNode, elseStartLine, depth + 1);
         _linkNodes(nodes, elseTail, join);
       } else {
         _linkNodes(nodes, ifNode, join);
@@ -846,10 +1232,17 @@ function _buildCfg(bodyText, nodes, prevId, startLine, depth = 0) {
 
     const whileMatch = s.match(/^while\s*\((.+?)\)\s*\{([\s\S]*)\}\s*$/ds);
     if (whileMatch) {
+      const { assigns: whileAssigns } = _hoistCondAssign(whileMatch[1]);
       const header = _addNode(nodes, { kind: 'loop-header', line });
       _linkNodes(nodes, prev, header);
+      let condPrev = header;
+      for (const a of whileAssigns) {
+        const aNode = _addNode(nodes, { kind: 'assign', target: a.target, source: a.source, line });
+        _linkNodes(nodes, condPrev, aNode);
+        condPrev = aNode;
+      }
       const bodyStartLine = line + _countNewlines(s, whileMatch.indices[2][0]);
-      const bodyTail = _buildCfg(whileMatch[2], nodes, header, bodyStartLine, depth + 1);
+      const bodyTail = _buildCfg(whileMatch[2], nodes, condPrev, bodyStartLine, depth + 1);
       _linkNodes(nodes, bodyTail, header);
       const join = _addNode(nodes, { kind: 'noop', line });
       _linkNodes(nodes, header, join);
@@ -937,11 +1330,13 @@ export function parsePhpFile(file, code) {
 
   const functions = [];
   const spans = []; // {start, end}: source ranges fully consumed by a matched function (signature through closing brace)
+  const classRegions = _findClassRegions(code);
   FUNC_RE.lastIndex = 0;
   _nid = 0;
   let m;
   while ((m = FUNC_RE.exec(code)) !== null) {
     const name = m[1];
+    const className = _classNameAt(classRegions, m.index);
     const paramsText = m[2] || '';
     const params = paramsText.split(',').map(p => {
       const t = p.trim();
@@ -979,8 +1374,8 @@ export function parsePhpFile(file, code) {
     _linkNodes(nodes, tail, exit);
     const cfg = { entry, exit, nodes };
     functions.push({
-      qid: _qid(file, name, startLine, extracted.body),
-      name, line: startLine, params, file,
+      qid: _qid(file, name, startLine, extracted.body, className),
+      name: className ? `${className}.${name}` : name, line: startLine, params, file,
       cfg,
       calls: callSitesFromCfg(cfg),
     });
@@ -1028,5 +1423,13 @@ export function parsePhpFile(file, code) {
     topLevel = modQid;
   }
 
-  return functions.length ? { file, functions, topLevel } : null;
+  // SARD_80_F1 W5.10 — `ir.classes` (declared field names only; no
+  // `bases`/`extends` yet — this codepath's one consumer so far,
+  // dataflow/engine.js's cross-method field-taint pass, doesn't need it,
+  // and PHP's inheritance chain isn't otherwise tracked. Purely additive:
+  // `buildClassHierarchy` already merges `ir.classes` across every parser
+  // that emits it, uniformly).
+  const classes = classRegions.map((r) => ({ name: r.name, line: _lineAt(code, r.start), fields: _extractClassFields(code, r) }));
+
+  return functions.length ? { file, functions, topLevel, classes } : null;
 }