@clear-capabilities/agentic-security-scanner 0.151.3 → 0.153.0

package/src/dataflow/summaries.js

@@ -91,9 +91,26 @@ export class SummaryCache {
   _key(qid, taintedParams, receiverType) {
     // P1.2: when a receiver type is provided, extend the cache key with
     // its hash. Backward-compatible: no receiverType → same key as before.
-    let base = `${qid}::${_hashState(taintedParams)}`;
-    // R2: append the caller qid when call-string sensitivity is enabled.
-    if (this._callString && this._callerCtx) base = `${base}@${this._callerCtx}`;
+    const stateHash = _hashState(taintedParams);
+    let base = `${qid}::${stateHash}`;
+    // R2: append the caller qid when call-string sensitivity is enabled —
+    // but ONLY for a NON-EMPTY entry state. The EMPTY-entry baseline is the
+    // one summary `engine.js`'s outer fixed-point pre-pass loop shares and
+    // progressively refines across BOTH multiple passes AND every call path
+    // that reaches a function with no tainted args — splitting it by caller
+    // breaks that sharing outright: a 3-hop empty-entry mutation chain
+    // (leaf mutates its own param unconditionally, mid calls leaf, top calls
+    // mid) stopped propagating entirely once enabled, confirmed via direct
+    // instrumentation, not a hypothetical concern — the pre-pass loop's own
+    // `bMid`/`cLeaf` iterations write to a caller-LESS key nothing else ever
+    // reads once a NESTED call from a different caller starts writing to a
+    // caller-SUFFIXED key instead. A non-empty entry state has no such
+    // shared-convergence dependency to begin with — the value-context cache
+    // (`AGENTIC_SECURITY_KCFA_MAX_CONTEXTS`) already computes each distinct
+    // tainted-arg shape independently, lazily, per call site, so adding a
+    // caller dimension there only ever narrows an already-isolated lookup,
+    // never disconnects a shared one.
+    if (this._callString && this._callerCtx && stateHash !== 'empty') base = `${base}@${this._callerCtx}`;
     if (!receiverType) return base;
     return `${base}::${hashReceiverType(receiverType)}`;
   }
@@ -103,7 +120,8 @@ export class SummaryCache {
   }
 
   set(qid, taintedParams, summary, receiverType) {
-    this._cache.set(this._key(qid, taintedParams, receiverType), summary);
+    const k = this._key(qid, taintedParams, receiverType);
+    this._cache.set(k, summary);
   }
 
   has(qid, taintedParams, receiverType) {
@@ -172,8 +190,16 @@ export class SummaryCache {
   // Helper: apply a summary to a caller's taint state given the call site's
   // argument bindings. Returns { calleeReturnTainted, mutated: Set of caller-side
   // var names that should become tainted because the callee mutated them }.
-  applyAtCallSite(summary, paramNames, callArgs, callerTaintedVars) {
-    if (!summary) return { returnTainted: false, mutated: new Set() };
+  // `receiverPath` (optional, next-gen taint capability #3): the caller-side
+  // access path of a receiver-qualified call's OWN receiver (`bad` for
+  // `bad.setData(x)`). When present and `summary.mutatedThisFields` is
+  // non-empty, also returns `mutatedThisPaths` — the receiver's own field
+  // paths (`bad.data`) to taint in the caller, mirroring `mutated` above but
+  // for the implicit `this` parameter instead of a declared one. Omitting
+  // `receiverPath` (every pre-existing call site) leaves `mutatedThisPaths`
+  // empty, so this is purely additive for callers that don't pass it.
+  applyAtCallSite(summary, paramNames, callArgs, callerTaintedVars, receiverPath) {
+    if (!summary) return { returnTainted: false, mutated: new Set(), mutatedThisPaths: new Set() };
     const mutated = new Set();
     if (summary.mutatedParams && summary.mutatedParams.size) {
       // Map each mutated parameter position back to the caller-side argument name.
@@ -184,7 +210,11 @@ export class SummaryCache {
         if (arg && arg.kind === 'ident') mutated.add(arg.name);
       }
     }
-    return { returnTainted: !!summary.returnTainted, mutated };
+    const mutatedThisPaths = new Set();
+    if (receiverPath && summary.mutatedThisFields && summary.mutatedThisFields.size) {
+      for (const field of summary.mutatedThisFields) mutatedThisPaths.add(`${receiverPath}.${field}`);
+    }
+    return { returnTainted: !!summary.returnTainted, mutated, mutatedThisPaths };
   }
 
   size() { return this._cache.size; }
@@ -208,6 +238,16 @@ function _summaryEq(a, b) {
   const bm = b.mutatedParams || new Set();
   if (am.size !== bm.size) return false;
   for (const p of am) if (!bm.has(p)) return false;
+  // Next-gen taint capability #3's `mutatedThisFields` is a THIRD summary
+  // field alongside `returnTainted`/`mutatedParams` — deliberately compared
+  // here too, not left out, per this function's own header comment above:
+  // omitting a field from this equality check is exactly how a fresher,
+  // more-refined summary can be silently discarded by the fixed-point loop
+  // while still being returned to its immediate caller.
+  const atf = a.mutatedThisFields || new Set();
+  const btf = b.mutatedThisFields || new Set();
+  if (atf.size !== btf.size) return false;
+  for (const f of atf) if (!btf.has(f)) return false;
   return true;
 }
 
@@ -244,10 +284,31 @@ export function entryStateFromCall(paramNames, callArgs, callerTaintedVars, isAr
     // ASSIGNED locals, not raw globals) took the member branch, found
     // nothing, and — being an else-if — never reached isArgTaintedExpr at
     // all. Confirmed via a real corpus fixture.
+    // PRD W2 (SARD_80_F1_EXECUTION_PRD.md) — an object argument whose FIELD
+    // was tainted before the call (`c.field = tainted; step(c);`) is a
+    // documented scope gap: entry-state granularity here is param-level,
+    // not per-access-path, so `c` itself was never marked tainted even
+    // though `c.field` genuinely is in the caller's field-sensitive lattice
+    // — the callee then reads `c.field` back out with no provenance at all.
+    // Found sampling real Juliet variant 67 false negatives (a tainted
+    // value stored into a `Container` object's field, the object passed
+    // whole to another function, the field read back out there). Widens
+    // the SAME direction this codebase already takes for "unknown-key
+    // container writes" and collection taint (dataflow/CLAUDE.md's own
+    // documented precedent): if ANY access path prefixed by this
+    // identifier is tainted, treat the whole object as tainted when it
+    // crosses a call boundary — over-approximating (a clean sibling field
+    // read downstream may falsely inherit taint) is the accepted direction
+    // for a security scanner, the same tradeoff every other "widen to the
+    // container" rule in this codebase already makes.
     let tainted = false;
     if (arg.kind === 'ident' && callerTaintedVars.has(arg.name)) {
       tainted = true;
-    } else if (arg.kind === 'member' && arg.object?.kind === 'ident') {
+    } else if (arg.kind === 'ident') {
+      const prefix = `${arg.name}.`;
+      for (const v of callerTaintedVars) { if (v.startsWith(prefix)) { tainted = true; break; } }
+    }
+    if (!tainted && arg.kind === 'member' && arg.object?.kind === 'ident') {
       const base = arg.object.name;
       if (callerTaintedVars.has(base) || callerTaintedVars.has(`${base}.${arg.prop}`)) tainted = true;
     }

package/src/engine.js

@@ -107,6 +107,8 @@ import { scanFileUpload } from './sast/file-upload.js';
 import { scanHostHeader } from './sast/host-header.js';
 import { scanPythonSinks } from './sast/python-sinks.js';
 import { scanCSharp } from './sast/csharp.js';
+import { scanCsharpCrossFile } from './sast/csharp-cross-file.js';
+import { computeJavaStructuralCrossFileSuppressions } from './sast/java-structural-cross-file.js';
 import { scanCpp } from './sast/cpp.js';
 import { scanJulietShape, applyJulietJavaSuppressions, applyJulietCsSuppressions } from './sast/juliet-shape.js';
 import { scanCppDataflow, _parseErrorCount as _cppDataflowParseErrors } from './sast/cpp-dataflow.js';
@@ -237,7 +239,6 @@ import { runCrossServiceTaint } from './dataflow/cross-service-taint.js';
 import { annotateRuntimeCorrelation } from './posture/runtime-correlation.js';
 import { applyLearnedCalibration } from './posture/triage-learning.js';
 import { annotateFormalVerification } from './dataflow/formal-verify.js';
-import { annotatePathFeasibility } from './dataflow/smt-feasibility.js';
 import { annotateProofGate } from './dataflow/proof-gate.js';
 import { applySanitizerGate } from './dataflow/sanitizer-gate.js';
 import { annotateFalsification } from './posture/falsification.js';
@@ -1551,7 +1552,11 @@ function _hasSsrfHostGuard(ctx) { return _guardMatchNearSinkIdentifier(ctx, _SSR
 // before `Path.Combine(..., filename)`) left the finding firing on the FIXED
 // revision. Safe to match on shape because _guardMatchNearSinkIdentifier
 // already requires the guard to name the same identifier as the sink.
-const _PATH_GUARD_RE = /\b(?:basename|GetFileName|secure_filename|sanitize_filename|send_from_directory|safe_join)\s*\(|\b(?:startsWith|startswith|StartsWith|HasPrefix)\s*\(|\bgetCanonicalPath\b|\btoRealPath\b|\bfilepath\s*\.\s*(?:Clean|Base|Abs)\b|\b(?:[Ee]nsure|[Vv]alidate|[Aa]ssert|[Rr]equire|[Vv]erify|[Cc]heck)\w{1,40}\s*\(/;
+// `starts_with`/`strip_prefix` (Rust's own snake_case naming) and
+// `canonicalize` (Rust's `Path::canonicalize`, the containment check's
+// resolve-then-compare half) join the existing camelCase/PascalCase forms —
+// same guard, a different language's naming convention.
+const _PATH_GUARD_RE = /\b(?:basename|GetFileName|secure_filename|sanitize_filename|send_from_directory|safe_join)\s*\(|\b(?:startsWith|startswith|StartsWith|HasPrefix|starts_with|strip_prefix)\s*\(|\bgetCanonicalPath\b|\btoRealPath\b|\bcanonicalize\s*\(|\bfilepath\s*\.\s*(?:Clean|Base|Abs)\b|\b(?:[Ee]nsure|[Vv]alidate|[Aa]ssert|[Rr]equire|[Vv]erify|[Cc]heck)\w{1,40}\s*\(/;
 function _hasPathGuard(ctx) { return _guardMatchNearSinkIdentifier(ctx, _PATH_GUARD_RE); }
 
 // Reflected-XSS output-encoding guard: an HTML escaper applied near the sink.
@@ -5007,7 +5012,17 @@ function scanJavaSAST(fp, raw) {
     // Per-family file-level predicate (custom logic). Returns truthy to suppress.
     if (typeof rule.fileSafePredicate === 'function' && rule.fileSafePredicate(cleaned, raw)) continue;
 
-    const sinkLine = cleaned.substring(0, sinkMatch.index).split('\n').length;
+    // Use the match's END, not its start: every sinkRe here terminates
+    // right at the sink call's own opening `(`, but a few (ldap-injection's
+    // `\bjavax.naming...\b[\s\S]{0,12000}?\w+\.search\(`) anchor on an EARLIER
+    // token (an import statement, or the first `DirContext` mention) and lazily
+    // span forward to the real call, which can be dozens of lines later. Using
+    // the start position reported the anchor's line (e.g. an `import` line) as
+    // the "vulnerable line" — a wrong, misleading finding location/snippet, and
+    // it also broke `dedupeFindingsWithEvidence`'s per-sink-line collapse with
+    // other detectors (ldap-injection.js, the IR-TAINT engine) that correctly
+    // report the real call site, since a stale anchor line never matches it.
+    const sinkLine = cleaned.substring(0, sinkMatch.index + sinkMatch[0].length).split('\n').length;
 
     // Optional precision filter: when the rule is taint-aware, extract the
     // sink call's argument expression and check whether a tainted variable
@@ -6372,6 +6387,9 @@ const _VULN_FAMILY_PREFIX = [
   ['SQL Injection', 'sql-injection'],
   ['Command Injection', 'command-injection'],
   ['Code Injection', 'code-injection'],
+  ['LDAP Injection', 'ldap-injection'],
+  ['XPath Injection', 'xpath-injection'],
+  ['Local/Remote File Inclusion', 'code-injection'],
   ['Reflected XSS', 'xss'],
   ['Stored XSS', 'xss'],
   ['DOM XSS', 'xss'],
@@ -6383,6 +6401,18 @@ const _VULN_FAMILY_PREFIX = [
   ['Prototype Pollution', 'prototype-pollution'],
   ['IDOR', 'idor'],
   ['Potential IDOR', 'idor'],
+  // SARD_80_F1 W5.13 — must precede the generic 'AuthZ:' catch-all below: a
+  // CWE-862 (Missing Authorization) finding from authz.js's PHP IDOR
+  // detector also starts with "AuthZ:", and this array's first-match-wins
+  // iteration would otherwise sweep it into the SAME 'idor' family as every
+  // OTHER authz.js pattern (JWT/OAuth/session-fixation/CWE-639), overriding
+  // finding-defaults.js's own correct CWE-862 -> 'missing-authz' mapping —
+  // confirmed as the exact reason a genuinely firing, correctly-CWE-tagged
+  // finding never scored a tp (dedupeFindingsWithEvidence runs before the
+  // finding-defaults backfill and stamps `f.family` first).
+  ['AuthZ: raw SQL where-by-id from request input without an ownership check', 'missing-authz'],
+  ['AuthZ: fopen() on request-supplied path/id without an ownership check', 'missing-authz'],
+  ['AuthZ: XPath query built from request input without an ownership check', 'missing-authz'],
   ['AuthZ:', 'idor'],
   ['MD5/SHA1', 'weak-crypto'],
   ['Weak Cryptographic Hash', 'weak-crypto'],
@@ -6396,6 +6426,41 @@ const _VULN_FAMILY_PREFIX = [
   ['OpenSSH Private Key', 'hardcoded-secret'],
   ['Password in URL', 'hardcoded-secret'],
   ['OAuth Authorization Code Theft', 'open-redirect'],
+  // SARD_80_F1 W4: every IR-TAINT open-redirect catalog sink names its own
+  // API in the vuln string ("Open Redirect (Controller.Redirect)",
+  // "Open Redirect (response.sendRedirect)", "Open Redirect (flask.redirect)",
+  // "Open Redirect (Rails redirect_to)", ...) — with no prefix entry here,
+  // each one fell through to the generic auto-slug fallback and got its OWN
+  // unique family string, distinct from open-redirect.js's/csharp.js's
+  // explicit `family: 'open-redirect'`. Two detectors correctly finding the
+  // SAME real vulnerability at the SAME line then failed to collapse via
+  // dedupeFindingsWithEvidence's (file, sink-line, family) key, producing an
+  // extra unmatched/scored FP — the exact bug class found in W4.J15 for
+  // Java's LDAP rule, here caused by family-string divergence instead of a
+  // wrong line. Found via the C# public mirror: CWE601_Open_Redirect__Web_
+  // QueryString_Web_01.cs's resp.Redirect(data) produced both a `CSHARP`
+  // finding (family 'open-redirect') and an `IR-TAINT` finding (family
+  // 'open-redirect-controller-redirect') at the identical line.
+  ['Open Redirect', 'open-redirect'],
+  // Same bug, same fix, found by checking every other injection family with
+  // BOTH a structural detector AND IR-TAINT catalog sinks for the identical
+  // divergence: every CWE-113 IR-TAINT sink's vuln string starts with "HTTP
+  // Response Splitting" (12 catalog entries across Java/JS/PHP/Go/C#), with
+  // no prefix entry here — each fell through to its own unique auto-slug
+  // family, distinct from `response-splitting.js`'s explicit
+  // `family: 'response-splitting'`. Verified directly: a Java servlet
+  // `response.setHeader("X-User", request.getParameter(name))` probe produced
+  // both a `RESPONSE-SPLITTING` finding (family 'response-splitting') and an
+  // `IR-TAINT` finding (family 'http-response-splitting-header-injection') at
+  // the identical line. CWE-113 has carried this session's largest persistent
+  // fp counts (399 on Java dev, 348 on C# train, per W4.C1) and this exact
+  // duplicate-detection mechanism was never checked as a contributing cause
+  // during the earlier sanitizer-focused CWE-113 investigation (commit
+  // 4f41daec) — distinct from `test/benchmark/expected.json`'s `_familyMap`
+  // (the SEPARATE table that resolves scoring family from vuln text and
+  // already maps this same prefix to 'header-hardening'; this table only
+  // controls ENGINE-level dedup, not scoring attribution).
+  ['HTTP Response Splitting', 'response-splitting'],
   ['Synchronous Blocking I/O', 'dos-sync-io'],
   ['Missing Timeout', 'dos-no-timeout'],
   ['GraphQL Missing Query', 'graphql-dos'],
@@ -9116,6 +9181,25 @@ function _deterministicFileTimings(timings) {
   }
   const annotatedComponents=components.map(c=>{const key=`${c.ecosystem}:${c.name}:${c.version}`;const vulns=vulnsByKey[key]||[];const riKey=c.ecosystem==='maven'&&c.group?`maven:${c.group}/${c.name}`:`${c.ecosystem}:${c.name}`;const ri=registryInfo.get(riKey)||{};const latestVersion=ri.latestVersion||'';const vd=(ri.versions||{})[c.version]||{};const isDeprecated=typeof vd.deprecated==='string'&&vd.deprecated.length>0;const deprecationMessage=isDeprecated?vd.deprecated:'';const isOutdated=!isDeprecated&&typeof vd.outdated==='string'&&vd.outdated.length>0;const outdatedMessage=isOutdated?vd.outdated:'';const license=ri.license||vd.license||'';return{...c,vulns,hasVulns:vulns.length>0,hasAttackPath:attackResult.flagged.has(key),attackPaths:attackResult.pathsByKey.get(key)||[],latestVersion,isDeprecated,deprecationMessage,isOutdated,outdatedMessage,license};});
   aF.push(...(runDetector(_detectorErrors,'<project>','scanDbTaintCrossFile',()=>scanDbTaintCrossFile(fc))||[]));
+  aF.push(...(runDetector(_detectorErrors,'<project>','scanCsharpCrossFile',()=>scanCsharpCrossFile(fc))||[]));
+  // SARD_80_F1 W5.41/W5.42 — unlike the ADD-only cross-file passes above,
+  // this one SUPPRESSES an already-emitted java-structural.js or
+  // java-bench-extras.js finding when every real caller (checked project-
+  // wide within the finding's own directory) agrees the concatenated/
+  // redirected value is a literal. See java-structural-cross-file.js's own
+  // header comment for the full design and W5.40's EXECUTION_STATUS.md
+  // entry for the root-cause investigation.
+  {
+    const _jsCrossSuppress = runDetector(_detectorErrors,'<project>','computeJavaStructuralCrossFileSuppressions',()=>computeJavaStructuralCrossFileSuppressions(fc));
+    if (_jsCrossSuppress && _jsCrossSuppress.size) {
+      for (let _i = aF.length - 1; _i >= 0; _i--) {
+        const _f = aF[_i];
+        if (_f && typeof _f.id === 'string' && (_f.id.startsWith('java-struct-') || _f.id.startsWith('java-extras:open-redirect:')) && _jsCrossSuppress.has(`${_f.file}:${_f.line}`)) {
+          aF.splice(_i, 1);
+        }
+      }
+    }
+  }
   aF.push(...(runDetector(_detectorErrors,'<project>','scanStoredPromptInjectionCrossFile',()=>scanStoredPromptInjectionCrossFile(fc))||[]));
   // Roadmap #8 — tree-sitter sinks for long-tail languages (opt-in,
   // AGENTIC_SECURITY_TREE_SITTER=1; degrades to no-op without the optional dep).
@@ -9754,11 +9838,16 @@ function _deterministicFileTimings(timings) {
     if (process.env.AGENTIC_SECURITY_FORMAL === '1') {
       await _runAnnotator("annotateFormalVerification", async () => { await annotateFormalVerification(finalFindings, fc, {}); });
     }
-    // SMT path feasibility: Z3-backed proof of reachability. Opt-in via
-    // AGENTIC_SECURITY_SMT_FEASIBILITY=1.
-    if (process.env.AGENTIC_SECURITY_SMT_FEASIBILITY === '1') {
-      await _runAnnotator("annotatePathFeasibility", async () => { await annotatePathFeasibility(finalFindings, {}); });
-    }
+    // SMT path feasibility (`AGENTIC_SECURITY_SMT_FEASIBILITY`) was retired:
+    // its predicate encoder read `f.chain`/`f.taintPath` as a sequential
+    // source-to-sink path, but those fields are actually a flat list of
+    // SOURCES reaching the sink (`_sourcesReachingExpr`), never a path —
+    // confirmed by direct code reading, never fixed by real data. It also
+    // mutated `f.severity` directly on an 'unsat' verdict, violating this
+    // codebase's own recall-preserving-demotion convention that every other
+    // proof gate here follows (see `dataflow/CLAUDE.md`). Superseded by the
+    // real backward-slice-driven mechanism: `dataflow/exploit-prover.js`'s
+    // `proveExploits`, opt-in via `AGENTIC_SECURITY_SYMEXEC=1`.
     // Privacy / PII taint: emits pii-exposure findings + DPIA artifact.
     // FR-405 (assurance-hardening PRD): _privacyIrBacked is declared at
     // function scope above the AGENTIC_SECURITY_NO_INTEGRATION block, not
@@ -10276,7 +10365,27 @@ function _deterministicFileTimings(timings) {
   // SCA-SAST correlation: link SAST findings to SCA vulnerable packages
   try{for(const f of finalFindings){if(!f.chain||!f.chain.length)continue;const src=f.chain[0]?.label||'';for(const sc of supplyChain){if(sc.type!=='vulnerable_dep')continue;if(src.includes(sc.name)||f.vuln?.toLowerCase().includes(sc.name)){f.scaCorrelation={osvId:sc.osvId,package:sc.name,version:sc.version,confirmed:true};sc.sastConfirmed=true;break;}}}}catch(_){}
   // Multi-sink chain detection: group findings by source variable
-  try{const srcGroups=new Map();for(const f of finalFindings){const src=f.chain?.[0]?.label;if(!src)continue;if(!srcGroups.has(src))srcGroups.set(src,[]);srcGroups.get(src).push(f);}for(const[src,group]of srcGroups){if(group.length<2)continue;const groupId=`multi-sink:${src}:${group.length}`;for(const f of group)f._multiSinkGroupId=groupId;finalFindings.push({id:groupId,file:group[0].file,line:group[0].line,vuln:`Multi-Sink Taint Chain — ${src} reaches ${group.length} sinks`,severity:group.some(f=>f.severity==='critical')?'critical':'high',cwe:'CWE-20',parser:'MULTI-SINK',confidence:0.85,sinks:group.map(f=>({file:f.file,line:f.line,vuln:f.vuln})),_aggregated:true});}}catch(_){}
+  // SARD_80_F1 W4.J22/J23: this aggregate previously ALWAYS pushed a brand
+  // new finding hardcoding cwe:'CWE-20' with no `family`, regardless of what
+  // the grouped sinks actually were. When every sink in the group shares one
+  // real family/CWE — the common case: several sinks along the same
+  // injection-class chain, e.g. the same tainted var reaching two
+  // db.query() calls — that new finding duplicated a per-sink finding
+  // ALREADY in `finalFindings` at the identical (file, line, family, cwe):
+  // a first attempt here just relabeled the aggregate to the shared
+  // family/CWE, expecting it to collapse via dedupeFindingsWithEvidence's
+  // (file, sink-line, family) key — but this pass runs AFTER dedupe
+  // (line ~9467), so the relabeled duplicate was never actually removed; a
+  // real corpus A/B confirmed zero net fp movement, only a relabel. Fixed
+  // properly: in the homogeneous case, don't push a second finding at all —
+  // attach the chain metadata (source + full sink list) onto the existing
+  // per-sink finding instead, so the "one source, N sinks" information
+  // survives without a duplicate, separately-scored finding. Only a
+  // genuinely mixed-CWE chain (a real, distinct "multiple vulnerability
+  // classes from one source" finding, not a duplicate of any single
+  // existing finding) still gets its own standalone finding, tagged with
+  // the honest generic CWE-20/'multi-sink-taint-chain' label.
+  try{const srcGroups=new Map();for(const f of finalFindings){const src=f.chain?.[0]?.label;if(!src)continue;if(!srcGroups.has(src))srcGroups.set(src,[]);srcGroups.get(src).push(f);}for(const[src,group]of srcGroups){if(group.length<2)continue;const groupId=`multi-sink:${src}:${group.length}`;for(const f of group)f._multiSinkGroupId=groupId;const sharedFamily=group.every(f=>f.family&&f.family===group[0].family)?group[0].family:null;const sharedCwe=group.every(f=>f.cwe&&f.cwe===group[0].cwe)?group[0].cwe:null;const sinks=group.map(f=>({file:f.file,line:f.line,vuln:f.vuln}));if(sharedFamily&&sharedCwe){for(const f of group)f.multiSinkChain={source:src,sinkCount:group.length,sinks};continue;}finalFindings.push({id:groupId,file:group[0].file,line:group[0].line,vuln:`Multi-Sink Taint Chain — ${src} reaches ${group.length} sinks`,severity:group.some(f=>f.severity==='critical')?'critical':'high',cwe:'CWE-20',family:'multi-sink-taint-chain',parser:'MULTI-SINK',confidence:0.85,sinks,_aggregated:true});}}catch(_){}
   // SCA transitive dedup: collapse duplicate CVEs across dep chains
   try{const osvGroups=new Map();for(const sc of supplyChain){if(sc.type!=='vulnerable_dep'||!sc.osvId)continue;if(!osvGroups.has(sc.osvId))osvGroups.set(sc.osvId,[]);osvGroups.get(sc.osvId).push(sc);}for(const[osvId,group]of osvGroups){if(group.length<=1)continue;const primary=group.find(s=>s.isDirect)||group[0];primary.dependents=group.filter(s=>s!==primary).map(s=>({name:s.name,version:s.version,depChain:s.depChain,isDirect:s.isDirect}));primary._transitiveDeduped=group.length-1;for(const dup of group){if(dup!==primary)dup._deduplicatedInto=primary.osvId;}supplyChain.splice(0,supplyChain.length,...supplyChain.filter(s=>!s._deduplicatedInto));}}catch(_){}
   // ── World-class post-scan artifact emitters ──────────────────────────

package/src/ir/CLAUDE.md

@@ -31,7 +31,8 @@ consumed by `scanner/src/dataflow/` for taint analysis.
 
 **Two further gaps found while building the corpus entry above, NOT fixed (out of scope for trailing-lambda body recursion, routed around instead — same pattern as Java's chained-call CFG bug):** (a) a call with NO args made on a tainted receiver via a dotted callee string — e.g. `it.toString()`, `tainted.trim()` — does not inherit the receiver's taint. `engine.js`'s `exprTaint` for `case 'call'` checks only `expr.args` and the resolved callee's own return-taint summary (`_nestedCallReturnTainted`); a callee string like `"it.toString"` is never parsed back into a member expression to ask whether its OWN receiver (`it`) is tainted. This is not Kotlin-specific (any language whose IR lowers a method call to a bare dotted-string callee has the same exposure), so a real fix belongs in `engine.js`, not here. (b) `call.parameters` (Ktor's own cataloged `member`-type source) does not propagate taint through a subsequent `.getAll(...)` call made on top of it — `call.parameters.getAll("id")` reads as untainted, because the catalog entry matches a bare property READ, not a call whose receiver is that property. Both gaps were discovered via a fixture that initially used these exact shapes and silently produced zero findings; each was routed around (by using a no-transform binding and a `call`-type source instead) rather than fixed, to keep this task scoped to CFG body recursion. **Taint-recall PRD (80%) Tier 5: `kt-file-readtext`/`kt-url-readtext` catalog cross-collision.** Found via `CVE-2022-22965-kt-ssrf`: both entries were unscoped bare `callee: 'readText'` (path-traversal and SSRF sinks sharing the identical last-segment name), so a single `URL(url).readText()` call fired BOTH — the correct SSRF finding and a spurious Path Traversal finding on the same line. Fixed with receiver scoping (`^File` / `^URL`), the same precision pattern `match.receiver` uses throughout this catalog. Guarded by `test/catalog-path-ssrf-p3.test.js`; required updating `test/phase2-scoping.test.js`'s existing `matchSinkOrSanitizer('readText', 'A.java')` call (a bare string with no receiver context, which the new requirement correctly rejects) to a realistic dotted-string shape (`'File.readText'`). |
 | C / C++  | `parser-cpp.js`       | Hand-rolled parser (functions, qualified names, CFG lowering). Dispatched by extension (`c/cc/cpp/cxx/h/hh/hpp/hxx`) in both `buildProjectIR` and `buildProjectIRAsync`. |
-| Long-tail (rust/solidity/go/swift/dart) | `tree-sitter-loader.js` | **Optional** `web-tree-sitter` + `tree-sitter-wasms` (ABI-pinned 0.20.8 ↔ 0.1.13), lazy + degrades when absent. Powers `sast/tree-sitter-sinks.js` (opt-in via `AGENTIC_SECURITY_TREE_SITTER=1`). Marked `--external` in the build so the committed bundle never embeds WASM. |
+| Rust     | `parser-rust.js`      | Hand-rolled, the `parser-go.js`/`parser-cs.js` pattern (preprocess: comments blanked, `::` paths flattened to dots, turbofish/`?`/`.await` stripped; then statement-split + recursive CFG build). **SARD 80% F1 push, first-class from day one — no prior IR existed for Rust at all** (only the opt-in, WASM-based `tree-sitter-loader.js` long-tail path below, which nothing in the taint engine consumes). Models: `fn` items (free/impl/trait, qualifiers, generics, `impl Type` methods named `Type.method`), `let`/destructuring/compound-assign, method chains (args accumulated innermost-first, so `Command::new("sh").arg("-c").arg(x)` has the literal program name at arg 0 regardless of the chain's terminal method), macros (`format!`/`write!`/etc. lower to a template with inline `{ident}` and positional args; `vec!` to an array; every other macro keeps its own `name!` callee so `sqlx::query!` — the compile-checked, parameterized macro — never collides with the `query` sink); `if`/`if let`/`while`/`while let`/`loop`/`for`/`match` (pattern bindings assigned from the scrutinee) including expression-position control flow (`let x = match … {}` yields a `union` of the branch tails); trailing closures inlined with their parameter bound to the receiver; extractor-typed parameters (`Query(q): Query<P>`) and route-attributed handlers (`#[get("/<x>")]`) emit `fn.paramAnnotations`. **`.unwrap()`/`.expect(msg)` are popped from the chain, not just taint-transparent** — leaving them in shifts the terminal segment away from the real sink name (`sqlx::query(&sql).fetch_all(pool).await.unwrap()` would otherwise end in `.unwrap`, never `.fetch_all`, and no catalog entry could ever match it), the same "terminal segment shift" defect class documented for Go/Java/Kotlin above; a macro-only statement whose sole continuation is a popped `.unwrap()` (`write!(w, "…", x).unwrap();`) still counts as a call, tracked via a separate `_baseIsCall` flag so it doesn't fall through to "no call happened here" once the passthrough is gone. Three self-scan-flagged regexes (`(?:#\[[^\]]*\]\s*)+`, the attribute-skip pattern, appearing at three call sites) match the "optional/quantified group flanked by `\s*`" ReDoS heuristic shape but are linear by construction — each iteration is bounded by the mandatory literal `#[`…`]`, no shared character class exists for the engine to backtrack across — confirmed by direct timing (50 000 back-to-back attributes, 200 000 non-matching whitespace chars: both single-digit milliseconds), not merely asserted; see the comment at `_parseParams` in `parser-rust.js`. Guarded by `test/parser-rust.test.js` (CFG shape) and `test/rust-taint-flow.test.js` (end-to-end taint flow + precision cases). **Measured `bench/layer-recall` impact: 0 → 5/5 (100%) whole-corpus, 0 → 3/3 (100%) deep-tier** on first measurement — the corpus is small and every entry is annotation-sourced (axum/actix/rocket extractor parameters route directly into `paramAnnotations`), so 100% reflects the corpus's own composition, not general Rust ecosystem coverage; see `docs/METRICS.md`'s own disclosure. |
+| Long-tail (solidity/go/swift/dart) | `tree-sitter-loader.js` | **Optional** `web-tree-sitter` + `tree-sitter-wasms` (ABI-pinned 0.20.8 ↔ 0.1.13), lazy + degrades when absent. Powers `sast/tree-sitter-sinks.js` (opt-in via `AGENTIC_SECURITY_TREE_SITTER=1`). Marked `--external` in the build so the committed bundle never embeds WASM. Rust's own tree-sitter grammar remains loadable here too (unaffected by `parser-rust.js` existing), but the hand-rolled parser above is what feeds the taint engine — this path is now redundant for Rust specifically, kept only because removing a language from `tree-sitter-sinks.js`'s opt-in surface is out of scope for this change. |
 
 ## Python parser — dual-path with auto fallback
 

package/src/ir/balanced-call.js

@@ -22,12 +22,44 @@
 // simply left unconsumed rather than corrupting anything. Recovering the
 // first call's real signature is a strict improvement over the prior
 // choice between silent corruption and no match at all.
-export function matchBalancedCall(s, calleeRe) {
+export function matchBalancedCall(s, calleeRe, opts) {
   if (typeof s !== 'string') return null;
   const m = calleeRe.exec(s);
   if (!m || m.index !== 0) return null;
   let i = m[0].length;
   while (s[i] === ' ' || s[i] === '\t') i++;
+  // SARD_80_F1 W2.3 follow-up (opt-in via `opts.skipGenerics`, used only by
+  // parser-cs.js): C#'s `new List<string>()` / `new Dictionary<string,
+  // int>()` has a generic type-argument list BETWEEN the class name and the
+  // constructor's own `(`. Without this, `new\s+([\w.]+)` matches only
+  // "List", the character right after it is `<` (not `(`), and the whole
+  // match fails — the constructor call silently lowers to `{kind:'unknown'}`
+  // instead of a proper `isNew:true` call, which is why `List<T>` (C#'s
+  // dominant MODERN collection idiom, unlike the non-generic `ArrayList`
+  // fixed alongside this) never even reached the collection-taint mutator
+  // rule at all. Deliberately opt-in, not the default: `<`/`>` are also
+  // comparison operators, and Go/PHP/Ruby (this helper's other three
+  // callers) have no equivalent "generic-args-before-a-call" shape, so
+  // widening the default here would be pure unvalidated risk for them.
+  // Scans for BALANCED angle brackets only (handles nested generics like
+  // `Dictionary<string, List<int>>`); if it doesn't find a clean balanced
+  // `<...>` immediately here, this leaves `i` untouched and falls through
+  // to the ordinary `(`-required check below, same as before this existed.
+  if (opts && opts.skipGenerics && s[i] === '<') {
+    let j = i + 1;
+    let depth = 1;
+    while (j < s.length && depth > 0) {
+      if (s[j] === '<') depth++;
+      else if (s[j] === '>') depth--;
+      else if (s[j] === '(' || s[j] === ')' || s[j] === ';') { depth = -1; break; } // not a generic-args list — bail
+      j++;
+    }
+    if (depth === 0) {
+      let k = j;
+      while (s[k] === ' ' || s[k] === '\t') k++;
+      if (s[k] === '(') i = k;
+    }
+  }
   if (s[i] !== '(') return null;
   const openIdx = i;
   let depth = 0;

package/src/ir/callgraph.js

@@ -59,16 +59,40 @@ export function buildCallGraph(perFileIR, fileContents) {
   // missing one.
   const bareTailInFile = new Map(); // file -> Map<bareTail, qid|null>
 
+  // PRD W1 (SARD_80_F1_EXECUTION_PRD.md) — `--scramble-identifiers` renames
+  // every class to a lowercase `case_<hash>` token, so the qid's middle
+  // `::ClassName::` segment no longer starts with an uppercase letter even
+  // though it IS still a real, structurally-declared class. Wherever a
+  // file's own parser emits real `ir.classes` facts (Java/C#, today —
+  // Python/PHP/Ruby/Go/Kotlin don't yet, tracked as W1.1), trust THAT
+  // instead of a capitalization guess: a name is a real class if and only
+  // if it was independently parsed as a class declaration, which is exactly
+  // as true under scrambled names as under real ones (the class-declaration
+  // parser doesn't care about capitalization either). Falls back to the old
+  // PascalCase heuristic for files whose language doesn't emit ir.classes
+  // yet, so nothing regresses ahead of W1.1 landing per-language.
+  const knownClassNamesByFile = new Map();
+  for (const file of Object.keys(perFileIR || {})) {
+    const ir = perFileIR[file];
+    if (ir && Array.isArray(ir.classes) && ir.classes.length) {
+      knownClassNamesByFile.set(file, new Set(ir.classes.map(c => c.name)));
+    }
+  }
+
   for (const file of Object.keys(perFileIR || {})) {
     const ir = perFileIR[file];
     if (!ir || !ir.functions) continue;
     byNameInFile.set(file, new Map());
     bareTailInFile.set(file, new Map());
+    const knownClasses = knownClassNamesByFile.get(file);
     for (const fn of ir.functions) {
       functions.set(fn.qid, fn);
       byNameInFile.get(file).set(fn.name, fn.qid);
-      const m = fn.qid.match(/::([A-Z]\w*)::(\w+)@/);
-      if (m) classMethods.set(`${m[1]}.${m[2]}`, fn.qid);
+      const m = fn.qid.match(/::(\w+)::(\w+)@/);
+      if (m) {
+        const isRealClass = knownClasses ? knownClasses.has(m[1]) : /^[A-Z]/.test(m[1]);
+        if (isRealClass) classMethods.set(`${m[1]}.${m[2]}`, fn.qid);
+      }
       if (fn.name && fn.name.includes('.')) {
         const tail = fn.name.split('.').pop();
         const fileMap = bareTailInFile.get(file);