@clear-capabilities/agentic-security-scanner 0.151.3 → 0.153.0

package/src/sast/ldap-injection.js

@@ -46,7 +46,20 @@ const FILTER_INLINE_RE = {
   go:   new RegExp(String.raw`\b(?:NewSearchRequest|SearchRequest|Search)\s*\([^)]*"\(\s*` + ATTR + String.raw`\s*=[^"]*"\s*\+\s*[A-Za-z_][\w.]*(?![\w.]*\s*\()`, 'g'),
   // C#: DirectorySearcher.Filter assigned a concat ("(uid=" + u) or an
   // interpolated string ($"(uid={u})").
-  cs:   new RegExp(String.raw`\bFilter\s*=\s*\$?@?"[^"]*\(\s*` + ATTR + String.raw`\s*=[^"]*(?:"\s*\+|\{)`, 'g'),
+  //
+  // SARD_80_F1 W4.C13 — this is the shape C#'s REAL Juliet corpus actually
+  // uses (`search.Filter = "(...) " + data + "))";`, a property ASSIGNMENT,
+  // not a call argument), confirmed via the public mirror
+  // (CWE90_LDAP_Injection__Connect_tcp_01.cs) — meaning it's THIS regex,
+  // not FILTER_VAR_RE.cs below, that needs the literal-suppression capture
+  // group: the identical filter line appears verbatim in bad() and
+  // GoodG2B(), only `data`'s source differs, same convention as every
+  // other language's Path B fix. Split into two top-level alternatives
+  // (concat form with a capturing group + trailing lookahead, vs.
+  // interpolation form uncaptured) instead of the previous single regex
+  // with an internal `"\s*\+|\{` alternation, since only the concat form's
+  // trailing identifier is safely checkable this way.
+  cs:   new RegExp(String.raw`\bFilter\s*=\s*\$?@?"[^"]*\(\s*` + ATTR + String.raw`\s*=[^"]*"\s*\+\s*([A-Za-z_][\w.]*)(?![\w.]*\s*\()(?=\s*(?:\+\s*["'][^"'\n]*["']\s*)?[);,])|\bFilter\s*=\s*\$?@?"[^"]*\(\s*` + ATTR + String.raw`\s*=[^"]*\{`, 'g'),
   // Ruby net-ldap: a filter built with #{} interpolation inside a search/
   // construct/filter call.
   rb:   new RegExp(String.raw`\.(?:search|filter|construct|equals)\s*\([^)]*\(\s*` + ATTR + String.raw`\s*=[^)]*#\{`, 'g'),
@@ -62,11 +75,30 @@ const FILTER_INLINE_RE = {
 // which is the *escaped* (safe) form — must not match.
 const FILTER_VAR_RE = {
   js:   new RegExp(String.raw`["'` + '`' + String.raw`]\s*\(\s*` + ATTR + String.raw`\s*=\s*["'` + '`' + String.raw`]?\s*(?:\+|\$\{)\s*[A-Za-z_$][\w.]*(?![\w.]*\s*\()`, 'g'),
-  java: new RegExp(String.raw`["']\s*\(\s*` + ATTR + String.raw`\s*=\s*["']?\s*\+\s*[A-Za-z_][\w.]*(?![\w.]*\s*\()`, 'g'),
+  // Captures the trailing identifier (group 1) so scanLdapInjection can check
+  // whether it's PROVABLY a hardcoded literal — Juliet's own convention
+  // (confirmed via the public mirror, CWE90_LDAP_Injection__Environment_01
+  // .java) keeps the IDENTICAL `"(cn=" + data + ")"` filter line in both
+  // bad() and goodG2B(), only swapping `data`'s source. The trailing
+  // lookahead mirrors java-structural.js's CWE-89 fix: only a SINGLE
+  // trailing term (optionally followed by one more literal segment, e.g.
+  // the closing `+ ")"`) is eligible for suppression — a second variable
+  // after it is left alone.
+  java: new RegExp(String.raw`["']\s*\(\s*` + ATTR + String.raw`\s*=\s*["']?\s*\+\s*([A-Za-z_][\w.]*)(?![\w.]*\s*\()(?=\s*(?:\+\s*["'][^"'\n]*["']\s*)?[);,])`, 'g'),
   py:   new RegExp(String.raw`["']\s*\(\s*` + ATTR + String.raw`\s*=\s*["']?\s*\+\s*[A-Za-z_][\w.]*(?![\w.]*\s*\()|[fF]["']\s*\(\s*` + ATTR + String.raw`\s*=\s*\{`, 'g'),
   php:  new RegExp(String.raw`["']\s*\(\s*` + ATTR + String.raw`\s*=\s*["']?\s*\.\s*\$[A-Za-z_]\w*`, 'g'),
   go:   new RegExp(String.raw`["']\s*\(\s*` + ATTR + String.raw`\s*=\s*["']?\s*\+\s*[A-Za-z_][\w.]*(?![\w.]*\s*\()`, 'g'),
-  cs:   new RegExp(String.raw`["']\s*\(\s*` + ATTR + String.raw`\s*=\s*["']?\s*\+\s*[A-Za-z_][\w.]*(?![\w.]*\s*\()|\$"[^"]*\(\s*` + ATTR + String.raw`\s*=\s*\{`, 'g'),
+  // SARD_80_F1 W4.C13 — capture group added to the concat alternative
+  // (mirroring `java`'s) so scanLDAPInjection can run the same
+  // hardcoded-literal check; the C# public mirror confirms Juliet's
+  // identical-line convention holds here too (CWE90_LDAP_Injection__
+  // Connect_tcp_01.cs keeps `search.Filter = "(...employeename=" + data +
+  // "))";` verbatim in both bad() and GoodG2B(), only data's source
+  // differs). The interpolation alternative (`$"...{`) is left uncaptured
+  // (m[1] undefined there is a no-op for `_nearestAssignIsLiteral`, which
+  // returns false on a falsy varName) since Juliet's own corpus uses the
+  // concat form exclusively for this shape.
+  cs:   new RegExp(String.raw`["']\s*\(\s*` + ATTR + String.raw`\s*=\s*["']?\s*\+\s*([A-Za-z_][\w.]*)(?![\w.]*\s*\()(?=\s*(?:\+\s*["'][^"'\n]*["']\s*)?[);,])|\$"[^"]*\(\s*` + ATTR + String.raw`\s*=\s*\{`, 'g'),
   rb:   new RegExp(String.raw`["']\s*\(\s*` + ATTR + String.raw`\s*=[^"']*#\{`, 'g'),
   kt:   new RegExp(String.raw`["']\s*\(\s*` + ATTR + String.raw`\s*=\s*["']?\s*(?:\+|\$\{)\s*[A-Za-z_$][\w.]*(?![\w.]*\s*\()`, 'g'),
 };
@@ -88,6 +120,99 @@ const LDAP_ESCAPE_RE =
   /\b(?:ldap_escape|EscapeFilter|escape_filter_chars|escapeForLDAP|encodeForLDAP|escapeLDAPSearchFilter|LDAP_ESCAPE_FILTER)\b|\bNet::LDAP::Filter\b|\bEqualityFilter\b|\bfilters\.\w+\b/;
 
 function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
+
+// True when EVERY assignment to `varName` before `beforeIdx` (source order)
+// is a plain string-literal RHS, and at least one such assignment exists.
+// Same "backward assignment scan" shape as java-structural.js's
+// `_trailingIdentIsLiteral` (itself modeled on java-bench-extras.js's
+// CWE-259 check) — duplicated rather than imported, matching this
+// codebase's established per-module convention for this small a helper.
+//
+// SARD_80_F1 W4.C13 — this USED to check only the TEXTUALLY NEAREST
+// assignment, which is wrong for an if/else where each branch assigns the
+// same variable: `if (cond) data = Environment.GetEnvironmentVariable(...);
+// else data = "foo";` has its literal assignment (the else branch) textually
+// LAST, so the old "nearest" check wrongly concluded `data` was provably a
+// literal and suppressed a REAL vulnerability — found via a real corpus
+// regression during THIS EXACT fix's own verification (C# CWE90_LDAP_
+// Injection__Environment_12.cs's Bad() lost its true positive). Checking
+// EVERY preceding assignment (failing closed the moment any one of them is
+// non-literal) fixes that — but naively scanning the WHOLE FILE for prior
+// assignments introduced a SECOND regression the same verification pass
+// caught: Juliet's universal convention re-declares the source variable
+// FRESH in every method (`string data;` in Bad(), a completely separate
+// `string data;` in GoodG2B()), so a same-named variable in an EARLIER
+// method (e.g. Bad()'s own non-literal source assignment) would incorrectly
+// poison GoodG2B()'s own all-literal check. Scoping the scan to start at
+// the variable's most recent DECLARATION before `beforeIdx` (a `Type
+// varName;` or `Type varName = …;` statement) fixes both at once: within
+// one method's scope, every assignment must be literal (catches the
+// if/else case); across method boundaries, each method's own `data` is
+// scanned independently (catches the cross-method case). Falls back to
+// scanning from file-start when no declaration is found — strictly SAFER
+// than before (fewer assignments end up in scope, never more).
+// SARD_80_F1 W4.C17 — a bare-identifier RHS (`data = dataCopy;`) previously
+// failed this check outright, even when `dataCopy` was itself provably a
+// literal at that point — confirmed on the real corpus (C# Juliet's own
+// "make a copy of data within the same method" flow variant,
+// CWE90_LDAP_Injection__Environment_31.cs: GoodG2B() sets `data = "foo"` in
+// one block, copies it to `dataCopy`, then re-declares `data = dataCopy` in
+// a SECOND block before the sink — the one-hop copy defeated the
+// literal-RHS check, which only recognized a DIRECT `"literal"` string).
+// Now recurses ONE LEVEL (capped, cycle-guarded via `rhs !== varName`) into
+// a bare-identifier RHS, applying the exact same fail-closed "every
+// assignment must be literal" policy to the copied-from variable — this can
+// only ADD suppression where the old code returned false, never introduce a
+// new false negative the old code didn't already risk (a genuinely tainted
+// `dataCopy` still fails its own scan and propagates the non-literal verdict
+// back up).
+function _nearestAssignIsLiteral(code, varName, beforeIdx, _depth) {
+  if (!varName || varName.includes('.')) return false;
+  const depth = _depth || 0;
+  const escaped = varName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const declRe = new RegExp(`\\b[\\w<>[\\],.?]+\\s+${escaped}\\s*(?:=|;)`, 'g');
+  let scopeStart = 0, dm;
+  while ((dm = declRe.exec(code)) && dm.index < beforeIdx) scopeStart = dm.index;
+  const anyAssignRe = new RegExp(`\\b${escaped}\\s*=\\s*([^;]+);`, 'g');
+  anyAssignRe.lastIndex = scopeStart;
+  const literalRhsRe = /^"[^"]*"$/;
+  const bareIdentRe = /^[A-Za-z_]\w*$/;
+  let sawAny = false, m;
+  while ((m = anyAssignRe.exec(code)) && m.index < beforeIdx) {
+    sawAny = true;
+    const rhs = m[1].trim();
+    if (literalRhsRe.test(rhs)) continue;
+    // SARD_80_F1 W4.C37 — `null` is never attacker-controlled data (it is
+    // the ABSENCE of a value, not a value), so an assignment of `data =
+    // null;` can never make a later sink call injectable — treating it as a
+    // disqualifying non-literal was always wrong, independent of any dead-
+    // code/control-flow question. This exact shape is Juliet's own "if
+    // (CONST) { data = <literal-or-source> } else { data = null; }" dead-
+    // code idiom (confirmed via the public C# Juliet mirror's own
+    // CWE90_LDAP_Injection__Connect_tcp_04.cs), but the fix is sound as a
+    // general rule, not merely a benchmark-shape accommodation: BEFORE
+    // this fix, `_nearestAssignIsLiteral` recursed into "null" as if it
+    // might be a traceable bare-identifier variable (`bareIdentRe` matches
+    // it — "null" is alphabetic), found no declaration or assignment for a
+    // variable literally named `null`, and returned `false` from that dead
+    // end — which then disqualified the WHOLE candidate as "not provably
+    // literal" even when every OTHER real assignment was a hardcoded
+    // literal. This bug PRE-DATES and is INDEPENDENT of this session's
+    // parser-cs.js CFG work (confirmed via a direct, standalone call to
+    // `scanLDAPInjection` bypassing runScan/parser-cs.js entirely) — it was
+    // simply never exercised on a real corpus file until an unrelated CFG
+    // fix elsewhere changed which findings survive `engine.js`'s own
+    // downstream dedup, surfacing it. Skipping (not disqualifying, not
+    // affirming) a `null` RHS can only ever ADD suppression where the old
+    // code returned false, never remove a genuine tainted-source detection
+    // — a real source assignment (`data = sr.ReadLine();`, `data =
+    // Environment.GetEnvironmentVariable(...)`) is never itself `null`.
+    if (rhs === 'null') continue;
+    if (depth < 3 && rhs !== varName && bareIdentRe.test(rhs) && _nearestAssignIsLiteral(code, rhs, m.index, depth + 1)) continue;
+    return false;
+  }
+  return sawAny;
+}
 function _lang(fp) {
   if (/\.(?:js|jsx|ts|tsx|mjs|cjs)$/i.test(fp)) return 'js';
   if (/\.java$/i.test(fp)) return 'java';
@@ -140,6 +265,10 @@ export function scanLDAPInjection(fp, raw) {
     const re = new RegExp(FILTER_INLINE_RE[lang].source, FILTER_INLINE_RE[lang].flags);
     let m;
     while ((m = re.exec(code))) {
+      // SARD_80_F1 W4.C13 — C#'s DirectorySearcher.Filter shape goes
+      // through THIS path (a property assignment), not FILTER_VAR_RE, so
+      // the hardcoded-literal check belongs here for `cs`.
+      if (lang === 'cs' && _nearestAssignIsLiteral(code, m[1], m.index)) continue;
       const line = lineOf(raw, m.index);
       const key = `inline:${line}`;
       if (seen.has(key)) continue;
@@ -154,6 +283,7 @@ export function scanLDAPInjection(fp, raw) {
     const re = new RegExp(FILTER_VAR_RE[lang].source, FILTER_VAR_RE[lang].flags);
     let m;
     while ((m = re.exec(code))) {
+      if ((lang === 'java' || lang === 'cs') && _nearestAssignIsLiteral(code, m[1], m.index)) continue;
       const line = lineOf(raw, m.index);
       const key = `var:${line}`;
       if (seen.has(key)) continue;

package/src/sast/rust.js

@@ -63,6 +63,59 @@ const FINDINGS = [
     remediation: 'Define a typed struct with serde for the extractor: `#[derive(Deserialize)] struct UserPath { id: i64 }`. Typed extractors reject malformed input at the framework boundary instead of bubbling raw strings into your handlers.',
     infoOnly: true,
   },
+  {
+    id: 'rust-tls-verify-disabled', severity: 'high', cwe: 'CWE-295', family: 'tls-verification',
+    // reqwest::ClientBuilder::danger_accept_invalid_certs(true) /
+    // danger_accept_invalid_hostnames(true) — the method name itself says
+    // "danger"; this only fires on the literal `true` argument, since a
+    // variable/computed argument might legitimately gate it off in prod.
+    re: /\bdanger_accept_invalid_(?:certs|hostnames)\s*\(\s*true\s*\)/g,
+    vuln: 'TLS certificate/hostname verification disabled',
+    remediation: 'Remove `danger_accept_invalid_certs`/`danger_accept_invalid_hostnames` (or pass a variable that is `false` in production). If a private CA is the real problem, add its root with `Certificate::from_pem` + `.add_root_certificate(...)` instead of disabling verification.',
+  },
+  {
+    id: 'rust-weak-hash-md5', severity: 'medium', cwe: 'CWE-327', family: 'weak-crypto',
+    re: /\b(?:md5::compute|Md5::new|Md5::default)\s*\(/g,
+    vuln: 'Weak cryptographic hash — MD5',
+    remediation: 'MD5 is broken for any security purpose (collision-resistance, password storage, integrity). Use `sha2::Sha256` for integrity/fingerprinting or `argon2`/`bcrypt` for password hashing.',
+  },
+  {
+    id: 'rust-weak-hash-sha1', severity: 'medium', cwe: 'CWE-327', family: 'weak-crypto',
+    re: /\b(?:Sha1::new|Sha1::default|sha1::Sha1)\s*[:(]/g,
+    vuln: 'Weak cryptographic hash — SHA-1',
+    remediation: 'SHA-1 has practical collision attacks. Use `sha2::Sha256`/`Sha512` (or `blake3`) for anything security-relevant.',
+  },
+  {
+    id: 'rust-weak-cipher', severity: 'high', cwe: 'CWE-327', family: 'weak-crypto',
+    // des::Des / des::TdesEde3 (DES/3DES) and rc4::Rc4 — broken/deprecated
+    // ciphers still published as crates.
+    re: /\b(?:des::Des\b|des::TdesEde[23]\b|Rc4::new)\s*[:(<]/g,
+    vuln: 'Weak/broken cipher — DES/3DES/RC4',
+    remediation: 'Use an AEAD cipher from the `aes-gcm` or `chacha20poly1305` crates (`Aes256Gcm`, `ChaCha20Poly1305`). DES, 3DES and RC4 are all broken or deprecated for new use.',
+  },
+  {
+    id: 'rust-weak-rng-token', severity: 'high', cwe: 'CWE-338', family: 'weak-rng',
+    // rand::random()/thread_rng() feeding an identifier that names a
+    // token/secret/key/session — `rand`'s default RNG is NOT a CSPRNG-grade
+    // guarantee for security tokens the way `getrandom`/`OsRng` are treated
+    // in the ecosystem's own guidance; flag the security-sensitive naming
+    // context, not `rand::random()` in general (rolling dice is fine).
+    re: /\b(?:let|const)\s+(?:mut\s+)?\w*(?:token|secret|session|api_?key|password|nonce|salt|csrf)\w*\s*(?::[^=]+)?=\s*(?:rand::random|rand::thread_rng\s*\(\s*\)\.gen)\b/gi,
+    vuln: 'Weak randomness for a security-sensitive value (rand::random/thread_rng)',
+    remediation: 'Use `rand::rngs::OsRng` (or the `getrandom` crate) to seed tokens/session ids/keys — `rand::thread_rng()`/`rand::random()` are not documented as cryptographically secure. `let mut buf = [0u8; 32]; OsRng.fill_bytes(&mut buf);`',
+  },
+  {
+    id: 'rust-unsafe-raw-memory', severity: 'medium', cwe: 'CWE-119', family: 'memory-safety',
+    // transmute / from_raw_parts(_mut) / get_unchecked(_mut) — the classic
+    // unsafe memory-reinterpretation and bounds-skipping primitives. Scoped
+    // to occurrences that are themselves already inside an `unsafe` block
+    // in practice (transmute/from_raw_parts require it to compile at all;
+    // get_unchecked does not, so it's included for the same reason: it
+    // skips the bounds check the safe `[]` indexing performs).
+    re: /\b(?:std::mem::transmute|mem::transmute|std::slice::from_raw_parts(?:_mut)?|slice::from_raw_parts(?:_mut)?)\s*[:(<]|\.get_unchecked(?:_mut)?\s*\(/g,
+    vuln: 'Unsafe raw-memory operation (transmute/from_raw_parts/get_unchecked)',
+    remediation: 'Prefer safe alternatives where possible: `as` casts or `bytemuck`/`zerocopy` instead of `transmute`; `<[T]>::get(i)`/checked slicing instead of `get_unchecked`. If unsafe is unavoidable, document the exact invariant (length, alignment, lifetime) that makes it sound at this call site.',
+  },
 ];
 
 function lineOf(raw, idx) { return raw.substring(0, idx).split('\n').length; }
@@ -93,7 +146,11 @@ export function scanRust(fp, raw) {
         stride: rule.family === 'sql-injection' ? 'Tampering'
               : rule.family === 'command-injection' ? 'Elevation of Privilege'
               : rule.family === 'weak-rng' ? 'Spoofing'
+              : rule.family === 'weak-crypto' ? 'Information Disclosure'
+              : rule.family === 'tls-verification' ? 'Spoofing'
+              : rule.family === 'memory-safety' ? 'Denial of Service'
               : 'Information Disclosure',
+        family: rule.family,
         snippet: (raw.split('\n')[line - 1] || '').trim().slice(0, 200),
         remediation: rule.remediation,
         confidence: 0.85,

package/src/sast/xss-reflected-multilang.js

@@ -12,6 +12,7 @@
 // content-type, or a raw-superglobal echo) so plain-text responses don't fire.
 
 import { blankComments } from './_comment-strip.js';
+import { deadBranchRanges, isLineInDeadRange } from './java-ast-folding.js';
 
 const lineOf = (raw, idx) => raw.substring(0, idx).split('\n').length;
 
@@ -77,14 +78,242 @@ const LANGS = {
     // Servlet: response.getWriter().write/print/println(...) or a PrintWriter
     // `out`, building an HTML string ("<…") by concatenation. The concat (`"<…"
     // +`) is the reflected-XSS shape — a static literal has no `+`.
+    // Each pattern additionally captures a trailing `+ identifier)`/`+
+    // identifier;` tail — the SINGLE, LAST concatenated term, when the
+    // concatenation ends right there — mirroring java-structural.js's own
+    // SQL/cmd-injection capture shape, so `_nearestAssignIsLiteral` (below)
+    // can tell a real tainted variable from a hardcoded one. The capture
+    // also tolerates ONE simple method call chained directly onto that
+    // identifier (`data.replaceAll(...)`) — Juliet's own real corpus shape
+    // (confirmed via the public Java mirror,
+    // CWE80_XSS__CWE182_Servlet_File_01.java) is exactly this: `data =
+    // readerBuffered.readLine()` (tainted) vs `data = "foo"` (literal) in
+    // bad()/goodG2B() respectively, both then passed through the IDENTICAL
+    // `data.replaceAll("(<script>)", "")` before the sink — a call on a
+    // provably-literal receiver is still provably literal. The inner
+    // `(?:"[^"]*"|[^()])*` is quote-aware specifically so a literal paren
+    // INSIDE a string argument (like `"(<script>)"` above) doesn't
+    // terminate the match early — this taint-independent detector, having
+    // no taint model of its own, previously fired on both bad() and
+    // goodG2B() identically.
     sinks: [
-      /\.\s*(?:getWriter\s*\(\s*\)\s*\.\s*)?(?:write|print|println|append|format|printf)\s*\(\s*"<[^"\n]*"\s*\+/,
-      /\b(?:out|writer|pw|w)\s*\.\s*(?:write|print|println|append)\s*\(\s*"<[^"\n]*"\s*\+/,
+      /\.\s*(?:getWriter\s*\(\s*\)\s*\.\s*)?(?:write|print|println|append|format|printf)\s*\(\s*"<[^"\n]*"\s*\+(?:\s*([A-Za-z_]\w*)(?:\s*\.\s*[A-Za-z_]\w*\s*\((?:"[^"]*"|[^()])*\))?\s*(?=(?:\s*\+\s*"[^"\n]*"\s*)?[);]))?/,
+      /\b(?:out|writer|pw|w)\s*\.\s*(?:write|print|println|append)\s*\(\s*"<[^"\n]*"\s*\+(?:\s*([A-Za-z_]\w*)(?:\s*\.\s*[A-Za-z_]\w*\s*\((?:"[^"]*"|[^()])*\))?\s*(?=(?:\s*\+\s*"[^"\n]*"\s*)?[);]))?/,
     ],
     escaper: /\b(?:encodeForHTML|forHtml|forHtmlContent|htmlEscape|escapeHtml4?|StringEscapeUtils|HtmlUtils\.htmlEscape|Encode\.forHtml|ESAPI|OWASP)\b/,
   },
 };
 
+// SARD_80_F1 W4.J28 — Juliet's own "Control flow: if(true) and if(false)"
+// flow variant (its own file header names this explicitly) writes
+// `if (true) { data = "foo"; } else { /* CWE 561 Dead Code */ data = null; }`
+// (or the mirror image for `if (false)`) — the ELSE branch is PROVABLY
+// unreachable (a constant-condition, not a genuine runtime-dependent
+// branch), but a plain backward-scan just finds
+// "the textually nearest assignment", which is the DEAD branch's `data =
+// null;` here (textually last), so it never recognizes `data` as the
+// literal it always actually is.
+//
+// SARD_80_F1 W5.32 — originally patched with this file's OWN narrow regex
+// (matching only `if(true)`/`if(false)`, then widened to also match
+// `if(5==5)`/`if(5!=5)`) — found investigating a NEW fp this exact gap
+// exposed once an unrelated fix (a Java parser bug, W5.32's own
+// StringTokenizer fix) let the deep taint engine correctly detect `bad()`'s
+// real vulnerability for the first time: the resulting dedup/clustering
+// reshuffle stopped accidentally folding this ALREADY-PRESENT, independent
+// XSS-ML false positive into the genuine finding, exposing a real,
+// pre-existing gap rather than introducing one. That narrow regex approach
+// only ever covered 2 of the many dead-code idioms this real corpus uses
+// (checked directly: 04-14/21/22a/31/41/42/45/51b/52c/54e/61a/66b-74b all
+// remained as fps) — rather than keep extending a second, independent
+// regex-based dead-branch detector, this now consumes `java-ast-folding.js`'s
+// existing `deadBranchRanges`/`isLineInDeadRange` — the SAME shared,
+// AST-based (not regex-based) mechanism `java-bench-extras.js` and
+// `java-structural.js` already use, which ALREADY resolves literal
+// true/false, private-static-final fields, effectively-final fields,
+// literal-vs-literal int comparisons, and zero-arg/single-return same-class
+// helper calls (W4.J33-36/W5.27's own incrementally-built capability) — one
+// shared mechanism, extended once, every consumer benefits, matching this
+// whole session's established pattern. The backward-scan now simply SKIPS any assignment whose line falls in a dead
+// range, rather than relying on a pre-blanked copy of the source text.
+// Cross-file variants (the lettered-suffix families) remain correctly
+// out of scope — `deadBranchRanges` is single-file, same boundary as
+// every other interprocedural mechanism in this codebase.
+
+// SARD_80_F1 W5.33 — this file's OWN backward-only "nearest assignment"
+// check (formerly `_trailingIdentIsLiteral`) had none of the interprocedural
+// resolution `java-bench-extras.js` already built for the identical Juliet
+// idioms (W4.J37-39): a value returned from a same-file helper
+// (`data = goodG2BSource();`), a same-method copy chain (`dataCopy = data;`
+// … `data = dataCopy;`), or an argument passed to a helper that receives it
+// as a PARAMETER rather than a local assignment. Confirmed via a real-corpus
+// sweep of this file's own remaining CWE-80 fp list (Flow Variants 31/41/42/
+// 45 — no lettered suffix, genuinely same-file) that these are exactly the
+// gap. Rather than re-derive a THIRD independent copy of this logic (a
+// second copy, in java-structural.js, was already ported once at W5.23),
+// this ports the same three functions verbatim in their already-ReDoS-fixed
+// form (W4.J39 — the "return type prefix" lazy `\s`-inclusive character
+// class that caused a confirmed hang was dropped entirely in the source
+// this was copied from; reintroducing it here would reintroduce the exact
+// same hang against Juliet's own large blanked-comment header blocks).
+// `_nearestAssignIsLiteral` is the direct, same-signature replacement for
+// this file's own former `_trailingIdentIsLiteral` at the one call site
+// below. Same-file only, matching every other interprocedural mechanism in
+// this codebase — the lettered-suffix (cross-file) variants remain
+// correctly out of scope.
+const _CALLEE_RETURN_LITERAL_CACHE_DEPTH = 4;
+function _resolveCalleeReturnIsLiteral(content, calleeName, deadRanges, _depth) {
+  const depth = _depth || 0;
+  if (depth >= _CALLEE_RETURN_LITERAL_CACHE_DEPTH) return false;
+  const escapedCallee = calleeName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const declRe = new RegExp(`\\b${escapedCallee}\\s*\\([^)]*\\)\\s*(?:throws\\s+[\\w.,\\s]+)?\\s*\\{`, 'g');
+  const dm = declRe.exec(content);
+  if (!dm) return false;
+  const bodyStart = dm.index + dm[0].length;
+  let braceDepth = 1, i = bodyStart;
+  while (i < content.length && braceDepth > 0) {
+    if (content[i] === '{') braceDepth++;
+    else if (content[i] === '}') braceDepth--;
+    i++;
+  }
+  const body = content.slice(bodyStart, i - 1);
+  const returnRe = /\breturn\s+([^;]+);/g;
+  const returns = [];
+  let rm;
+  while ((rm = returnRe.exec(body))) returns.push({ expr: rm[1].trim(), idx: bodyStart + rm.index });
+  if (returns.length !== 1) return false; // ambiguous (0 or 2+ returns) — fail closed
+  const { expr, idx } = returns[0];
+  if (/^"[^"]*"$/.test(expr)) return true;
+  if (/^[A-Za-z_]\w*$/.test(expr)) {
+    return _nearestAssignIsLiteral(content, expr, idx, deadRanges, depth + 1);
+  }
+  return false;
+}
+
+// Balanced top-level comma split (paren/bracket/brace-aware, quote-aware).
+function _splitTopLevelCommas(text) {
+  const parts = [];
+  let depth = 0, cur = '', inStr = null;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (inStr) {
+      cur += c;
+      if (c === '\\') { cur += text[++i] || ''; continue; }
+      if (c === inStr) inStr = null;
+      continue;
+    }
+    if (c === '"' || c === "'") { inStr = c; cur += c; continue; }
+    if (c === '(' || c === '[' || c === '{') depth++;
+    else if (c === ')' || c === ']' || c === '}') depth--;
+    if (c === ',' && depth === 0) { parts.push(cur); cur = ''; continue; }
+    cur += c;
+  }
+  if (cur.trim() !== '' || parts.length) parts.push(cur);
+  return parts;
+}
+
+function _resolveParamLiteralViaAllCallSites(content, varName, beforeIdx, deadRanges, _depth) {
+  const depth0 = _depth || 0;
+  if (depth0 >= _CALLEE_RETURN_LITERAL_CACHE_DEPTH) return false;
+  const escapedVar = varName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const methodDeclRe = /\b(?!if\b|for\b|while\b|switch\b|catch\b|synchronized\b|do\b|else\b|return\b|new\b)([A-Za-z_]\w*)\s*\(([^)]*)\)\s*(?:throws\s+[\w.,\s]+)?\s*\{/g;
+  let enclosing = null, dm;
+  while ((dm = methodDeclRe.exec(content)) && dm.index < beforeIdx) enclosing = dm;
+  if (!enclosing) return false;
+  const methodName = enclosing[1];
+  const params = _splitTopLevelCommas(enclosing[2]).map(p => p.trim()).filter(Boolean);
+  const paramIdx = params.findIndex((p) => new RegExp(`\\b${escapedVar}$`).test(p));
+  if (paramIdx === -1) return false; // varName isn't actually a param of the enclosing method
+  const escapedMethod = methodName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const callRe = new RegExp(`\\b${escapedMethod}\\s*\\(`, 'g');
+  let cm, sawRealCallSite = false;
+  while ((cm = callRe.exec(content))) {
+    const argsStart = cm.index + cm[0].length;
+    let braceDepth = 1, i = argsStart;
+    while (i < content.length && braceDepth > 0) {
+      if (content[i] === '(') braceDepth++;
+      else if (content[i] === ')') braceDepth--;
+      i++;
+    }
+    const afterClose = content.slice(i).match(/^\s*(\{|throws)/);
+    if (afterClose) continue; // this is the method's OWN declaration, not a call site
+    const args = _splitTopLevelCommas(content.slice(argsStart, i - 1)).map((a) => a.trim());
+    if (paramIdx >= args.length) return false; // arity mismatch — bail conservatively
+    sawRealCallSite = true;
+    const argExpr = args[paramIdx];
+    if (/^"[^"]*"$/.test(argExpr)) continue; // this caller's own argument is a direct literal
+    if (/^[A-Za-z_]\w*$/.test(argExpr) && _nearestAssignIsLiteral(content, argExpr, cm.index, deadRanges, depth0 + 1)) continue;
+    return false; // a non-literal (or unresolvable) caller exists
+  }
+  return sawRealCallSite;
+}
+
+// SARD_80_F1 W5.34 — Juliet Flow Variant 45: a value passed as a private
+// class member variable between two methods of the same class. See
+// java-bench-extras.js's own header comment on the identical, canonical
+// copy of this function for the full idiom and precision reasoning. Only
+// resolves when `varName` is confirmed to be an actual field declaration
+// (access-modifier-qualified — never valid on a local variable or
+// parameter).
+function _resolveFieldLiteralViaAllAssignments(content, varName, deadRanges, _depth) {
+  const depth0 = _depth || 0;
+  if (depth0 >= _CALLEE_RETURN_LITERAL_CACHE_DEPTH) return false;
+  const escaped = varName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const fieldDeclRe = new RegExp(`\\b(?:private|protected|public)\\s+[\\w<>\\[\\],.\\s]+\\b${escaped}\\s*(?:=\\s*[^;]+)?;`);
+  if (!fieldDeclRe.test(content)) return false;
+  const ranges = deadRanges || [];
+  const assignRe = new RegExp(`\\b${escaped}\\s*=\\s*([^;]+);`, 'g');
+  const lineOf_ = (idx) => content.substring(0, idx).split('\n').length;
+  let sawAssignment = false, m;
+  while ((m = assignRe.exec(content))) {
+    if (ranges.length && isLineInDeadRange(lineOf_(m.index), ranges)) continue;
+    sawAssignment = true;
+    const rhs = m[1].trim();
+    if (/^"[^"]*"$/.test(rhs)) continue;
+    if (/^[A-Za-z_]\w*$/.test(rhs) && rhs !== varName
+      && _nearestAssignIsLiteral(content, rhs, m.index, ranges, depth0 + 1)) continue;
+    return false;
+  }
+  return sawAssignment;
+}
+
+function _nearestAssignIsLiteral(content, varName, beforeIdx, deadRanges, _calleeDepth) {
+  if (!varName) return false;
+  if ((_calleeDepth || 0) >= _CALLEE_RETURN_LITERAL_CACHE_DEPTH) return false;
+  const ranges = deadRanges || [];
+  const escaped = varName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const literalRe = new RegExp(`\\b${escaped}\\s*=\\s*"[^"]*"\\s*;`, 'g');
+  const anyAssignRe = new RegExp(`\\b${escaped}\\s*=\\s*([^;]+);`, 'g');
+  const lineOf = (idx) => content.substring(0, idx).split('\n').length;
+  let lastLiteralEnd = -1, m;
+  while ((m = literalRe.exec(content)) && m.index < beforeIdx) {
+    if (ranges.length && isLineInDeadRange(lineOf(m.index), ranges)) continue;
+    lastLiteralEnd = m.index + m[0].length;
+  }
+  let lastAnyEnd = -1, lastAnyRhs = null, lastAnyIdx = -1;
+  while ((m = anyAssignRe.exec(content)) && m.index < beforeIdx) {
+    if (ranges.length && isLineInDeadRange(lineOf(m.index), ranges)) continue;
+    lastAnyEnd = m.index + m[0].length;
+    lastAnyRhs = m[1].trim();
+    lastAnyIdx = m.index;
+  }
+  if (lastAnyRhs && /^[A-Za-z_]\w*\s*\([^()]*\)$/.test(lastAnyRhs)) {
+    const calleeName = lastAnyRhs.slice(0, lastAnyRhs.indexOf('(')).trim();
+    if (_resolveCalleeReturnIsLiteral(content, calleeName, ranges, _calleeDepth)) return true;
+  }
+  if (lastAnyRhs && lastAnyRhs !== 'null' && /^[A-Za-z_]\w*$/.test(lastAnyRhs) && lastAnyRhs !== varName) {
+    if (_nearestAssignIsLiteral(content, lastAnyRhs, lastAnyIdx, ranges, (_calleeDepth || 0) + 1)) return true;
+  }
+  if (lastLiteralEnd === -1 || lastLiteralEnd !== lastAnyEnd) {
+    return _resolveParamLiteralViaAllCallSites(content, varName, beforeIdx, deadRanges, _calleeDepth)
+      || _resolveFieldLiteralViaAllAssignments(content, varName, deadRanges, _calleeDepth);
+  }
+  const paramRe = new RegExp(`\\([^()]*\\b[\\w.<>\\[\\]]+\\s+${escaped}\\s*[,)]`, 'g');
+  let lastParamEnd = -1;
+  while ((m = paramRe.exec(content)) && m.index < beforeIdx) lastParamEnd = m.index + m[0].length;
+  return lastParamEnd <= lastLiteralEnd;
+}
+
 export function scanXssReflectedMultilang(fp, raw) {
   if (!raw || raw.length > 500_000) return [];
   let lang = null;
@@ -93,13 +322,33 @@ export function scanXssReflectedMultilang(fp, raw) {
 
   const code = blankComments(raw, /\.rb$/i.test(fp) ? 'py' : (/\.(?:php|phtml)$/i.test(fp) ? 'php' : undefined));
   const lines = code.split('\n');
+  let deadRanges = [];
+  if (lang === LANGS.java) { try { deadRanges = deadBranchRanges(code); } catch { deadRanges = []; } }
   const findings = [];
   const seen = new Set();
 
+  let lineStartOffset = 0;
   for (let i = 0; i < lines.length; i++) {
     const line = lines[i];
+    const thisLineStart = lineStartOffset;
+    lineStartOffset += line.length + 1; // +1 for the '\n' _splitStatements-style join consumed
     if (lang.escaper.test(line)) continue;
-    if (!lang.sinks.some((re) => re.test(line))) continue;
+    let sinkMatch = null;
+    for (const re of lang.sinks) {
+      const m = line.match(re);
+      if (m) { sinkMatch = m; break; }
+    }
+    if (!sinkMatch) continue;
+    // SARD_80_F1 W5.35 — a sink call sitting INSIDE a provably-dead branch
+    // (Juliet's "switch(8){case 7: <tainted sink>}" idiom) is unreachable
+    // regardless of whether the value reaching it is tainted — the
+    // literal-check below can never suppress this shape, since the value
+    // genuinely IS tainted, just unreachable.
+    if (lang === LANGS.java && deadRanges.length && isLineInDeadRange(i + 1, deadRanges)) continue;
+    // SARD_80_F1 W3.x — a captured trailing identifier (Java's sink patterns
+    // only) that's provably a hardcoded literal at this point is not a real
+    // XSS flow; see `_nearestAssignIsLiteral`'s header comment.
+    if (lang === LANGS.java && sinkMatch[1] && _nearestAssignIsLiteral(code, sinkMatch[1], thisLineStart + sinkMatch.index, deadRanges)) continue;
     const ln = i + 1;
     const id = `xss-reflected:${fp}:${ln}`;
     if (seen.has(id)) continue;