@clear-capabilities/agentic-security-scanner 0.187.0 → 0.188.0

package/src/language/haskell-security-rules.js

@@ -15,6 +15,7 @@
 
 import { buildHaskellIR } from './haskell-ir.js';
 import { HS_LOG_SINKS, HS_MODEL_VERSION } from './haskell-models.js';
+import { codeOfLine } from './haskell-comments.js';
 
 export const HS_RULES_VERSION = 'haskell-security-rules/1';
 
@@ -68,7 +69,9 @@ const UNSAFE_CALLS = { 'System.IO.Unsafe.unsafePerformIO': 'unsafePerformIO', 'S
 const SECRET_KEY_CALLS = new Set(['Web.JWT.hmacSecret', 'Web.JWT.secret', 'Servant.Auth.Server.fromSecret', 'Web.ClientSession.initKey']);
 const isTrueLit = (e) => !!e && ((e.kind === 'literal' && /^true$/i.test(String(e.value))) || (e.kind === 'ident' && /(?:^|\.)True$/.test(e.name || '')));
 const TIME_SOURCES = new Set(['Data.Time.Clock.POSIX.getPOSIXTime', 'Data.Time.Clock.getCurrentTime', 'System.CPUTime.getCPUTime']);
-const SECURITY_FN_SUBSTR = /(?:token|nonce|secret|otp|csrf|session|salt|apikey|resetcode|passcode|verification)/i;
+// A salt is deliberately absent: it must be unique, not unpredictable or secret (it is stored beside the hash), so a non-cryptographic generator
+// producing one is not a weakness the way it is for a token, nonce or key.
+const SECURITY_FN_SUBSTR = /(?:token|nonce|secret|otp|csrf|session|apikey|resetcode|passcode|verification)/i;
 // Short credential words that would over-match as substrings (`spin`, `mapping`, `keyboard`): matched as whole camelCase / snake_case words.
 const SECURITY_WORDS = new Set(['pin', 'password', 'passwd', 'credential', 'credentials']);
 const SECURITY_FN = { test: (name) => SECURITY_FN_SUBSTR.test(name) || String(name).replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase().split(/[^a-z0-9]+/).some((w) => SECURITY_WORDS.has(w)) };
@@ -89,7 +92,7 @@ const EMPTINESS_CHECK = /(?:^|\.)(?:null|notNull|isEmpty|length|size|isJust|isNo
 const SESSION_COOKIE = /(?:sess|sid|token|tok|auth|jwt|csrf|login|remember|secret)/i;
 
 // What makes a bound variable security-shaped, and what makes a value sensitive for logging.
-const SECURITY_VAR = /^(?:.*(?:token|secret|nonce|salt|otp|csrf|apikey|api_?key|sessionid|session_?key|sessiontoken|resettoken)[a-z0-9_']*|key|iv|sessionId|sid)$/i;
+const SECURITY_VAR = /^(?:.*(?:token|secret|nonce|otp|csrf|apikey|api_?key|sessionid|session_?key|sessiontoken|resettoken)[a-z0-9_']*|key|iv|sessionId|sid)$/i;
 const PASSWORD_VAR = /(?:^|[^a-z])(?:pass(?:word|wd|phrase)?|pwd|pw)(?:[^a-z]|$)|password/i;
 const LOW_ENTROPY = /(?:pass(?:word|wd|phrase)?|pwd|ssn|creditcard|cardnumber|cvv|\bpin\b)/i;
 export const SENSITIVE = /(?:pass(?:word|wd|phrase)?|pwd|(?:^|[^a-z])pw(?:[^a-z]|$)|secret|token|api_?key|ssn|credit_?card|card_?number|cvv|authorization|bearer|private_?key|session_?id)/i;
@@ -128,6 +131,15 @@ const isLiteralLike = (e, depth = 0) => {
   return false;
 };
 
+// A concatenation of literals only (`"a=" <> "0" <> "; Path=/"`).
+const constantConcat = (e, depth = 0) => {
+  if (!e || depth > 12) return false;
+  if (e.kind === 'literal') return true;
+  if (e.kind === 'binary' && e.hs && e.hs.concat) return constantConcat(e.left, depth + 1) && constantConcat(e.right, depth + 1);
+  if (e.kind === 'call' && /(?:^|\.)(?:pack|fromString|encodeUtf8|fromStrict|toStrict)$/.test(e.callee || '') && e.args && e.args.length === 1) return constantConcat(e.args[0], depth + 1);
+  return false;
+};
+
 function fnNodes(fn) { return Object.values(fn.cfg.nodes); }
 
 // The text a concatenation spells out, in order, skipping the parts that are not literals (`"session_id=" <> sid <> "; Path=/"` -> `session_id=; Path=/`).
@@ -142,7 +154,80 @@ function literalTextOf(e, depth = 0) {
 function snippetOf(text, line) {
   if (!text || !Number.isInteger(line) || line < 1) return '';
   const l = text.split('\n')[line - 1];
-  return typeof l === 'string' ? l.trim().slice(0, 240) : '';
+  return typeof l === 'string' ? codeOfLine(l).slice(0, 240) : '';
+}
+
+// An unbounded read is a resource-exhaustion finding when the party that fills the input is not the operator. A handle opened on a
+// local file, a child process's pipe or a handle passed in is the operator's own (a file's size is what the file system says); a
+// socket or connection handle is filled by the peer. A read of standard input is the operator's in a program's own control flow, and
+// the caller's only in an entry point nothing in the analysed code calls (a library function handing back whatever its caller pipes in).
+const NETWORK_HANDLE_CALL = /(?:^|\.)(?:socketToHandle|connectTo|accept|acceptOn|openTCPConnection)$/;
+function readsOutsideInput(fn, callee, args, importsNetwork) {
+  const h = args && args[0];
+  const isStdin = !!h && h.kind === 'ident' && /(?:^|\.)stdin$/.test(h.name || '');
+  const handleRead = /hGetContents$/.test(callee) && !isStdin;
+  // the networking packages are not all in the model registry, so a call keeps its bare name; the module imports say which library it is
+  if (handleRead) return !!importsNetwork && (fn.calls || []).some((x) => typeof x.callee === 'string' && NETWORK_HANDLE_CALL.test(x.callee));
+  const hs = fn.hs || {};
+  return !hs.reached && !/(?:^|\.)main$/.test(fn.name || '');
+}
+
+const EQUALITY_OPS = new Set(['==', '/=', '!=']);
+const VERIFY_CALL = /(?:^|\.)(?:constEq|secureCompare|verify\w*|authenticate\w*|checkPassword|validate\w*|hmac\w*|sign\w*|jwt\w*|encode(?:Signed)?)$/i;
+// Whole camelCase / snake_case words: `sig` must not match `design`, `mac` must not match `machine`.
+const CREDENTIAL_WORDS = new Set(['token', 'secret', 'nonce', 'otp', 'csrf', 'apikey', 'session', 'signature', 'sig', 'mac', 'hmac', 'credential', 'credentials', 'auth', 'cookie', 'passcode', 'cert', 'fingerprint']);
+const CREDENTIAL_NAME = { test: (name) => String(name).replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase().split(/[^a-z0-9]+/).some((w) => CREDENTIAL_WORDS.has(w)) };
+
+/**
+ * Why a weak-hash call is a security matter: the list is empty when the digest is only an identifier or its use is not visible.
+ * Everything is read from the function's own IR (a value compared, bound to a credential-shaped name, hashing a secret-shaped value,
+ * handed to a signing or verifying call); nothing is read from comments or from the file's name.
+ */
+function weakDigestUse(fn, node, hashCall, hashArgs, fnBase) {
+  const reasons = [];
+  const nodes = Object.values(fn.cfg.nodes);
+  const exprsOf = (n) => [n.source, n.value, n.cond, ...(n.args || [])].filter(Boolean);
+  const hasNode = (x, target) => { for (const y of walk(x)) if (y === target) return true; return false; };
+  // 1. what is hashed
+  const hashed = (hashArgs || []).flatMap((a) => [...names(a)]).map((n) => n.replace(/^\./, ''));
+  if (hashed.some((n) => SENSITIVE.test(n) && !PASSWORD_VAR.test(n))) reasons.push('hashes a secret-shaped value');
+  // 2. values carrying the digest: the assignment target and everything derived from it
+  const carriers = new Set();
+  // the digest travels through formatting (`show`, `pack`, hex encoding, concatenation), not through an arbitrary call that merely receives it
+  const FORMAT = /(?:^|\.)(?:show|pack|unpack|take|drop|toLower|toUpper|showDigest|convertToBase|encode\w*|decode\w*|fromStrict|toStrict|toString|fromString|digestToHexByteString|toHex|hexlify|concat|append|map|fmap|fromText|toText)$/;
+  const flowsFrom = (e, depth = 0) => {
+    if (!e || depth > 10) return false;
+    if (e === hashCall) return true;
+    if (e.kind === 'ident') return carriers.has(e.name);
+    if (e.kind === 'binary' && e.hs && e.hs.concat) return flowsFrom(e.left, depth + 1) || flowsFrom(e.right, depth + 1);
+    if (e.kind === 'call' && typeof e.callee === 'string' && FORMAT.test(e.callee)) return (e.args || []).some((a) => flowsFrom(a, depth + 1));
+    if (e.kind === 'call' && e === hashCall) return true;
+    return false;
+  };
+  if (node.kind === 'assign' && node.target && node.source && flowsFrom(node.source)) carriers.add(node.target);
+  for (let round = 0; round < 8; round++) {
+    let grew = false;
+    for (const n of nodes) if (n.kind === 'assign' && n.target && n.source && !carriers.has(n.target) && flowsFrom(n.source)) { carriers.add(n.target); grew = true; }
+    if (!grew) break;
+  }
+  const carries = (x) => !!x && (flowsFrom(x) || [...names(x)].some((y) => carriers.has(y)));
+  let compared = false; let signed = false;
+  for (const n of nodes) {
+    for (const root of exprsOf(n)) {
+      for (const x of walk(root)) {
+        if (x.kind === 'binary' && EQUALITY_OPS.has(x.op) && (carries(x.left) || carries(x.right))) compared = true;
+        if (x.kind === 'call' && typeof x.callee === 'string' && VERIFY_CALL.test(x.callee) && (x.args || []).some((a) => carries(a))) signed = true;
+      }
+    }
+  }
+  if (compared) reasons.push('the digest is compared with another value');
+  if (signed) reasons.push('the digest is passed to a verifying or signing call');
+  // 3. what it becomes: a credential-shaped binding, or the result of a credential-shaped function
+  const bound = [...carriers].find((c) => CREDENTIAL_NAME.test(c) || SECURITY_VAR.test(c));
+  if (bound) reasons.push(`the digest is bound to \`${bound}\``);
+  const returned = nodes.some((n) => n.kind === 'return' && n.value && carries(n.value));
+  if (returned && (SECURITY_FN.test(fnBase) || CREDENTIAL_NAME.test(fnBase))) reasons.push(`the digest is the result of \`${fnBase}\``);
+  return reasons;
 }
 
 /**
@@ -186,6 +271,7 @@ export function analyzeHaskellRules(files, opts = {}) {
   };
 
   for (const [file, fir] of Object.entries(ir.perFile)) {
+    const importsNetwork = (fir.imports || []).some((im) => /^Network(?:\.|$)/.test(im.module));
     // imports of obsolete primitives (type-directed use is not resolved: disclosed on the finding)
     for (const imp of fir.imports || []) {
       if (WEAK_CIPHER_MODULES.has(imp.module)) {
@@ -199,7 +285,14 @@ export function analyzeHaskellRules(files, opts = {}) {
 
       const fnBase = fn.name.replace(/^.*\./, '');
       // text-typed parameters of an exported function, and every local value derived from them
-      const derivedText = new Set([...((fn.hs && fn.hs.textParams) || []), ...((fn.hs && fn.hs.inputParams) || [])]);
+      // A parameter a web framework hands to a handler IS request input wherever the handler is registered. Any other exported
+      // function's text parameter is "caller-supplied" only while nothing in the analysed code calls the function: once something does,
+      // its parameters take the values those callers pass (a check the taint engine makes per call), and a rule that does not follow
+      // calls cannot say the text comes from outside.
+      const fnHs = fn.hs || {};
+      const strongParam = new Set((fnHs.paramSources || []).filter((p) => /^hs:handler-param:/.test(p.decorator || '')).map((p) => p.name));
+      const entryLike = !fnHs.reached;
+      const derivedText = new Set([...(fnHs.textParams || []).filter((n) => strongParam.has(n) || entryLike), ...(entryLike ? (fnHs.inputParams || []) : [])]);
       if (derivedText.size) {
         for (let round = 0; round < 8; round++) {
           let grew = false;
@@ -255,7 +348,7 @@ export function analyzeHaskellRules(files, opts = {}) {
               if (TIME_SOURCES.has(e.name) && SECURITY_FN.test(fnBase)) emitRandom(node.line, { vuln: 'Clock value used as a security value', detail: `${e.name} feeds \`${fnBase}\``, evidence: { function: fnBase, source: e.name } });
               // a generator named as the whole value of a security-shaped action (`newCsrfToken = randomIO`): no call is written, the name is the call
               if (RANDOM_CALLS.has(e.name) && SECURITY_FN.test(fnBase) && !(e.hs && e.hs.functionRef)) emitRandom(node.line, { detail: `${e.name} feeds \`${fnBase}\``, evidence: { function: fnBase, source: e.name } });
-              if (INPUT_READS.has(e.name) && !bounded) emit('hs-unbounded-input-read', file, node.line, { detail: `${e.name} reads everything`, confidence: 0.6 });
+              if (INPUT_READS.has(e.name) && !bounded && readsOutsideInput(fn, e.name, [], importsNetwork)) emit('hs-unbounded-input-read', file, node.line, { detail: `${e.name} reads everything`, confidence: 0.6 });
               continue;
             }
             // a Set-Cookie header written by hand: `(hSetCookie, "session_id=" <> sid <> "; Path=/")`
@@ -268,7 +361,8 @@ export function analyzeHaskellRules(files, opts = {}) {
                 const sessionLike = !nm || SESSION_COOKIE.test(nm[1]);
                 const secure = /;\s*Secure\b/i.test(text); const httpOnly = /;\s*HttpOnly\b/i.test(text);
                 // an attribute string that is not written here (a rendered cookie value) cannot be judged: only a cookie whose text is visible is
-                if (text && sessionLike && (!secure || !httpOnly)) emit('hs-insecure-cookie', file, e.line || node.line, { detail: `${!httpOnly ? 'HttpOnly missing' : ''}${!httpOnly && !secure ? ', ' : ''}${!secure ? 'Secure missing' : ''}`, evidence: { httpOnly, secure, cookie: nm ? nm[1] : null } });
+                // a header value that is entirely constant text (`authn=0` written to clear a login) carries no per-user credential
+                if (text && sessionLike && !isLiteralLike(v) && !constantConcat(v) && (!secure || !httpOnly)) emit('hs-insecure-cookie', file, e.line || node.line, { detail: `${!httpOnly ? 'HttpOnly missing' : ''}${!httpOnly && !secure ? ', ' : ''}${!secure ? 'Secure missing' : ''}`, evidence: { httpOnly, secure, cookie: nm ? nm[1] : null } });
               }
             }
             if (e.kind === 'object' && e.hs && e.hs.update && Array.isArray(e.props)) {
@@ -324,7 +418,17 @@ export function analyzeHaskellRules(files, opts = {}) {
             // weak hash
             if (WEAK_HASH_CALLS.has(c) || (c === 'Crypto.Hash.hashWith' && args[0] && args[0].kind === 'literal' && WEAK_ALGO_CONS.has(args[0].value))) {
               const pw = args.some((a) => [...names(a)].some((n) => PASSWORD_VAR.test(n)));
-              if (!pw) emit('hs-weak-hash', file, line, { detail: c });
+              // MD5 and SHA-1 are broken for collision and preimage resistance, which only matters where an attacker gains from a
+              // collision: a digest that is VERIFIED (compared with an expected value), that authenticates or signs, that hashes a
+              // secret, or that is a credential. A digest that only NAMES something (a file name, a cache key, a bookmark, an ETag) is
+              // an identifier, and a hash helper handed on to callers says nothing about its use: neither is a finding.
+              if (!pw) {
+                const use = weakDigestUse(fn, node, e, args, fnBase);
+                // The API identity is always reported (a reviewer wants to know where MD5/SHA-1 is computed); it is a vulnerability
+                // finding only where a use that depends on the hash's strength is visible. Otherwise it is an `info` note.
+                if (use.length) emit('hs-weak-hash', file, line, { detail: `${c}: ${use.join('; ')}`, evidence: { call: c, use } });
+                else emit('hs-weak-hash', file, line, { severity: 'info', confidence: 0.4, detail: `${c}: no use that depends on the digest's collision or preimage resistance is visible (it may only name or key something)`, evidence: { call: c, use: [] } });
+              }
             }
             // password hashed with a fast hash
             if (ANY_HASH_CALLS.has(c) && !STRONG_KDF.test(c) && args.some((a) => [...names(a)].some((n) => PASSWORD_VAR.test(n.replace(/^\./, ''))))) {
@@ -346,7 +450,7 @@ export function analyzeHaskellRules(files, opts = {}) {
               emitRandom(line, { detail: `${c} feeds \`${fnBase}\``, evidence: { function: fnBase, source: c } });
             }
             if (TIME_SOURCES.has(c) && SECURITY_FN.test(fnBase)) emitRandom(line, { vuln: 'Clock value used as a security value', detail: `${c} feeds \`${fnBase}\``, evidence: { function: fnBase, source: c } });
-            if (INPUT_READS.has(c) && !bounded) emit('hs-unbounded-input-read', file, line, { detail: `${c} reads everything`, confidence: 0.6 });
+            if (INPUT_READS.has(c) && !bounded && readsOutsideInput(fn, c, args, importsNetwork)) emit('hs-unbounded-input-read', file, line, { detail: `${c} reads everything`, confidence: 0.6 });
             // an allocation whose size is parsed caller text and is not clamped
             if (ALLOCATORS.has(c) && args[0] && mentionsText(args[0]) && callsIn(args[0]).some((x) => /(?:^|\.)(?:read|readMaybe|readEither)$/.test(x.callee)) && !callsIn(args[0]).some((x) => CLAMPS.test(x.callee))) {
               emit('hs-unbounded-allocation', file, line, { detail: `${c} sized by parsed caller text`, evidence: { allocator: c } });
@@ -369,7 +473,7 @@ export function analyzeHaskellRules(files, opts = {}) {
               if (yes) emit('hs-xml-entity-substitution', file, line, { detail: 'withSubstDTDEntities yes' });
             }
             // boundaries
-            if (UNSAFE_CALLS[c]) {
+            if (Object.hasOwn(UNSAFE_CALLS, c)) {
               const b = UNSAFE_CALLS[c];
               emit('hs-unsafe-io-boundary', file, line, { vuln: `Unsafe boundary: ${b}`, confidence: 0.5, modelNote: BOUNDARIES[b], detail: BOUNDARIES[b] });
             }

package/src/language/haskell-trust.js

@@ -0,0 +1,268 @@
+// Trust-boundary adjudication of Haskell taint findings.
+//
+// A taint finding says "data from a SOURCE reaches a SINK". Whether that is a vulnerability depends on whether the party that controls the
+// source is a different party from the one the program runs for. This module reads the origins the taint engine recorded for each finding
+// (`sourceRoots`, or the evidence chain) and decides, from code facts only, which side of that line they sit on:
+//
+//   attacker-reachable    a request, a socket, a header, a cookie, a remote response: the peer is not the operator
+//   operator-controlled   command-line arguments and environment variables (the person who starts the process chooses them), and, in a
+//                         command-line program, standard input and the files it is pointed at: no boundary is crossed. The finding
+//                         is lowered to `info`, never dropped
+//   api-contract          the value is a parameter of an exported function that nothing in the analysed code calls, and the function
+//                         hands it WHOLE (or as the root it appends fixed text to) to a path or command operation: a thin wrapper.
+//                         The caller chose what to read or run, and the wrapper has no fixed part to escape from. Lowered to `info`
+//   entry-parameter       a parameter of such a function used inside a larger value the function builds: its own construction, kept
+//   data-input            standard input or a file's content in a service or a library: data the program processes, kept
+//   unattributed          the engine recorded no origin: kept
+//
+// A command-line program is one reached only from `main`s whose reachable modules import no server framework or socket library
+// (`entryRole` in haskell-ir.js). The role is a fact about the call graph, not about a name or a path.
+//
+// Nothing here reads a comment, a name or a path: the inputs are the recorded origins, the lowered expression at the sink and the
+// parameter annotations the IR derived from the signature.
+
+import { findSites, identNames } from './haskell-guards.js';
+
+export const TRUST_VERDICTS = Object.freeze(['attacker-reachable', 'operator-controlled', 'api-contract', 'entry-parameter', 'data-input', 'unattributed']);
+
+const OPERATOR = new Set(['cli', 'env']);
+const EXTERNAL = new Set(['http-body', 'url-param', 'path-param', 'header', 'cookie', 'network']);
+const DATA = new Set(['stdin', 'file-read']);
+const WEAK_PARAM_LABEL = /\(caller-controlled\)$/;
+const WRAPPER_FAMILIES = new Set(['CWE-78', 'CWE-88']);
+const CONVERSIONS = /(?:^|\.)(?:pack|unpack|fromString|toString|show|encodeUtf8|decodeUtf8|toStrict|fromStrict|toText|unpackFS|fromText)$/;
+const PATH_JOIN = /(?:^|\.)(?:<\/>|combine|joinPath|<\.>)$/;
+// list plumbing that only lays the parameters out as text (`unwords args`, `concatMap (' ':) args`): no fixed words are added
+const LIST_LAYOUT = /(?:^|\.)(?:unwords|unlines|intercalate|concatMap|concat|map|fmap)$/;
+const SPEC_CTORS = new Set(['System.Process.shell', 'System.Process.proc', 'System.Process.Typed.shell', 'System.Process.Typed.proc']);
+const hasAlnum = (v) => /[A-Za-z0-9]/.test(String(v));
+
+function rootsOf(f) {
+  // A hop through a function's return that names no origin behind it (`interproc`, `param`) is not an origin.
+  if (Array.isArray(f.sourceRoots) && f.sourceRoots.length) return f.sourceRoots.filter((r) => r && r.provenance !== 'interproc' && r.provenance !== 'param').map((r) => ({ label: r.label, provenance: r.provenance || null, ...(r.file ? { file: r.file } : {}), ...(Number.isInteger(r.line) ? { line: r.line } : {}) }));
+  const out = [];
+  for (const c of f.chain || []) {
+    if (!c || !c.label || c.kind === 'sink') continue;
+    if (c.provenance === 'interproc' || c.provenance === 'param') continue;
+    out.push({ label: c.label, provenance: c.provenance || null });
+  }
+  if (!out.length && f.source && f.source.label && !/^(?:interproc-return:|parameter )/.test(f.source.label)) out.push({ label: f.source.label, provenance: f.sourceProvenance || null });
+  return out;
+}
+
+const classOf = (r) => {
+  if (r.provenance && OPERATOR.has(r.provenance)) return 'operator';
+  if (r.provenance && EXTERNAL.has(r.provenance)) return 'external';
+  if (r.provenance && DATA.has(r.provenance)) return 'data';
+  if (WEAK_PARAM_LABEL.test(String(r.label || ''))) return 'weak-param';
+  return 'other';
+};
+
+// The expression a sink was handed, with the conversions that only change its type (`unpack`, `fromString`, `show`) peeled off.
+function peel(e, depth = 0) {
+  while (e && e.kind === 'call' && depth++ < 8 && typeof e.callee === 'string' && CONVERSIONS.test(e.callee) && (e.args || []).length === 1) e = e.args[0];
+  return e;
+}
+
+// Flatten a concatenation / path join into its operands, left to right.
+function operandsOf(e, out = [], depth = 0, resolve = null) {
+  e = peel(e);
+  if (!e || depth > 12) { out.push(e); return out; }
+  if (resolve && e.kind === 'ident') { const r = resolve(e); if (r && r !== e) return operandsOf(r, out, depth + 1, resolve); }
+  if (e.kind === 'binary' && e.hs && e.hs.concat) { operandsOf(e.left, out, depth + 1, resolve); operandsOf(e.right, out, depth + 1, resolve); return out; }
+  if (e.kind === 'binary' && (e.op === '</>' || e.op === '<>' || e.op === '++')) { operandsOf(e.left, out, depth + 1, resolve); operandsOf(e.right, out, depth + 1, resolve); return out; }
+  if (e.kind === 'call' && typeof e.callee === 'string' && PATH_JOIN.test(e.callee) && (e.args || []).length === 2) { operandsOf(e.args[0], out, depth + 1, resolve); operandsOf(e.args[1], out, depth + 1, resolve); return out; }
+  out.push(e);
+  return out;
+}
+
+/**
+ * Is the sink argument a value the function merely passes on? True when every non-literal operand is one of `params` (or list plumbing over
+ * them) and either (a) nothing in the value is fixed text that names something (only separators), or (b) for a path, the parameter is the
+ * LEFTMOST operand, so it chooses the whole location and the fixed tail is only a file name inside it.
+ */
+export function isPassThrough(arg, params, family, resolve = null) {
+  const ops = operandsOf(arg, [], 0, resolve);
+  if (!ops.length || ops.some((o) => !o)) return false;
+  const dyn = ops.filter((o) => o.kind !== 'literal');
+  if (!dyn.length) return false;
+  // a dynamic operand is acceptable when it is made only of parameters and separators (a list laid out as text, a member of a parameter)
+  const ok = (o, depth = 0) => {
+    if (!o || depth > 10) return false;
+    if (o.kind === 'literal') return !hasAlnum(o.value);
+    if (o.kind === 'ident') return params.has(o.name);
+    if (o.kind === 'member') return ok(o.object, depth + 1);
+    if (o.kind === 'array') return o.elements.length > 0 && o.elements.every((x) => ok(x, depth + 1));
+    if (o.kind === 'call' && typeof o.callee === 'string' && LIST_LAYOUT.test(o.callee)) return (o.args || []).length > 0 && o.args.every((x) => ok(x, depth + 1));
+    return false;
+  };
+  if (!dyn.every((o) => ok(o))) return false;
+  const namedLiteral = ops.some((o) => o.kind === 'literal' && hasAlnum(o.value));
+  if (!namedLiteral) return true;
+  return family === 'path' && ops[0].kind === 'ident' && params.has(ops[0].name);
+}
+
+function weakParamsOf(fn) {
+  const out = new Set();
+  for (const a of fn.paramAnnotations || []) if (a && a.decorator === 'hs:caller-controlled' && a.name) out.add(a.name);
+  return out;
+}
+
+// A local name bound exactly once (`let cmd = exe <> " " <> args`) stands for its definition when the sink argument is judged.
+function localResolver(fn) {
+  const defs = new Map();
+  for (const n of Object.values(fn.cfg.nodes)) if (n.kind === 'assign' && typeof n.target === 'string' && n.source) defs.set(n.target, [...(defs.get(n.target) || []), n.source]);
+  const params = new Set(Array.isArray(fn.params) ? fn.params : []);
+  return (e) => (e && e.kind === 'ident' && !params.has(e.name) && defs.has(e.name) && defs.get(e.name).length === 1 ? defs.get(e.name)[0] : e);
+}
+
+const fnByQid = (perFile, qid) => {
+  if (!qid) return null;
+  const file = String(qid).split('::')[0];
+  const ir = perFile && perFile[file];
+  return ir ? ir.functions.find((x) => x.qid === qid) || null : null;
+};
+
+// The role the IR gave the function the finding was found in: `cli` (reached only from mains that import no server framework), `service`, or
+// `library` (no main reaches it, or the walk could not).
+function roleOf(f, perFile) {
+  const fn = fnByQid(perFile, f._funcQid);
+  return (fn && fn.hs && fn.hs.entryRole) || 'library';
+}
+
+// The function that holds the sink call, and the sink's argument expressions there. A finding found while analysing a CALLER (its `_funcQid`) is
+// located at the callee's line; the sink function is the one in the finding's file that has the call at that line.
+function locateSink(perFile, f) {
+  const ir = perFile && perFile[f.file];
+  if (!ir || !f.callee) return null;
+  const direct = fnByQid(perFile, f._funcQid);
+  const candidates = direct && direct.file === f.file ? [direct, ...ir.functions.filter((x) => x !== direct)] : ir.functions;
+  for (const fn of candidates) {
+    const sites = findSites(fn, f.callee, f.line);
+    if (sites.length) return { fn, sites };
+  }
+  return null;
+}
+
+/**
+ * Is this finding a thin wrapper's pass-through? `weakParams` are the caller-controlled parameters of the function the engine analysed. When the
+ * sink sits in a callee, the callee must itself hand its own parameter on whole, and every call of it from the analysed function must pass
+ * values built only from that function's caller-controlled parameters (one hop; a longer chain is not judged).
+ */
+function passThroughVerdict(perFile, f) {
+  if (!WRAPPER_FAMILIES.has(f.cwe)) return null;
+  const family = f.cwe === 'CWE-22' ? 'path' : 'cmd';
+  const sink = locateSink(perFile, f);
+  if (!sink) return null;
+  const argIdx = Number.isInteger(f.argIndex) ? f.argIndex : 0;
+  let args = sink.sites.map((s) => (s.call.args || [])[argIdx]).filter(Boolean);
+  // A process is started from a SPEC value (`createProcess ((shell cmd) { cwd = d })`): what decides the verdict is what the spec constructor
+  // was handed, so the constructor's own arguments are judged instead of the record update around it.
+  const specArgs = [];
+  const findSpecs = (e, d = 0) => {
+    if (!e || typeof e !== 'object' || d > 20) return;
+    if (e.kind === 'call' && typeof e.callee === 'string' && SPEC_CTORS.has(e.callee)) { for (const a of (e.args || []).slice(0, 2)) if (a) specArgs.push(a); return; }
+    for (const k of ['left', 'right', 'object', 'value']) if (e[k] && typeof e[k] === 'object') findSpecs(e[k], d + 1);
+    for (const k of ['args', 'elements', 'branches']) if (Array.isArray(e[k])) e[k].forEach((x) => findSpecs(x, d + 1));
+    if (Array.isArray(e.props)) for (const p of e.props) findSpecs(p && p.value, d + 1);
+  };
+  for (const a of args) findSpecs(a);
+  if (specArgs.length) args = specArgs;
+  if (!args.length) return null;
+  const analysed = fnByQid(perFile, f._funcQid);
+  if (!analysed) return null;
+  if (sink.fn.qid === analysed.qid) {
+    const weak = weakParamsOf(analysed);
+    if (!weak.size) return null;
+    const own = new Set(Array.isArray(analysed.params) ? analysed.params : []);
+    const res = localResolver(analysed);
+    return args.every((a) => isPassThrough(a, own, family, res)) && args.some((a) => { const seen = new Set(); const walkIds = (e, d = 0) => { if (!e || d > 12) return; if (e.kind === 'ident') seen.add(e.name); for (const k of ['left', 'right', 'object', 'value']) if (e[k] && typeof e[k] === 'object') walkIds(e[k], d + 1); for (const k of ['args', 'elements']) if (Array.isArray(e[k])) e[k].forEach((x) => walkIds(x, d + 1)); }; let x = a; for (let i = 0; i < 4; i++) { const r = res(x); if (r === x) break; x = r; } walkIds(x); return [...seen].some((n) => weak.has(n)); }) ? 'direct' : null;
+  }
+  // the sink is in a callee
+  const own = new Set(Array.isArray(sink.fn.params) ? sink.fn.params : []);
+  const ownVars = [...new Set(args.flatMap((a) => [...identNames(a)]))];
+  if (!own.size || !ownVars.length || !ownVars.every((v) => own.has(v)) || !args.every((a) => isPassThrough(a, own, family))) return null;
+  const weak = weakParamsOf(analysed);
+  if (!weak.size) return null;
+  const calls = findCallsTo(analysed, sink.fn);
+  if (!calls.length) return null;
+  const used = new Set(ownVars);
+  for (const call of calls) {
+    for (let i = 0; i < (call.args || []).length; i++) {
+      const p = sink.fn.params[i];
+      if (!p || !used.has(p)) continue;
+      const a = call.args[i];
+      if (!a) return null;
+      if (a.kind === 'literal') continue;
+      if (!isPassThrough(a, weak, family)) return null;
+    }
+  }
+  return 'chain';
+}
+
+function findCallsTo(fn, target) {
+  const out = [];
+  const visit = (e, d) => {
+    if (!e || typeof e !== 'object' || d > 50) return;
+    if (e.kind === 'call' && e.callee === target.name) out.push(e);
+    for (const k of ['left', 'right', 'object', 'value', 'callee']) if (e[k] && typeof e[k] === 'object') visit(e[k], d + 1);
+    for (const k of ['args', 'elements', 'branches', 'parts']) if (Array.isArray(e[k])) for (const x of e[k]) visit(x, d + 1);
+    if (Array.isArray(e.props)) for (const p of e.props) visit(p && p.value, d + 1);
+  };
+  for (const n of Object.values(fn.cfg.nodes)) {
+    if (n.kind === 'call' && n.callee === target.name) out.push({ kind: 'call', callee: n.callee, args: n.args || [] });
+    for (const k of ['source', 'value', 'cond']) if (n[k]) visit(n[k], 0);
+    if (Array.isArray(n.args)) for (const a of n.args) visit(a, 0);
+  }
+  return out;
+}
+
+/**
+ * Stamps `trustBoundary` on every Haskell IR-TAINT finding and lowers to `info` the verdicts that name no boundary crossed
+ * (`operator-controlled`, `api-contract`). Mutates the findings; returns counts.
+ */
+export function applyTrustBoundary(findings, perFile) {
+  const stats = { attackerReachable: 0, operatorControlled: 0, apiContract: 0, entryParameter: 0, dataInput: 0, unattributed: 0 };
+  for (const f of findings || []) {
+    if (!f || f.parser !== 'IR-TAINT' || !/\.(?:l?hs|hsc)$/i.test(String(f.file || ''))) continue;
+    const roots = rootsOf(f);
+    const classes = new Set(roots.map(classOf));
+    const role = roleOf(f, perFile);
+    let verdict;
+    let reason;
+    let inferred = false;
+    if (classes.has('external')) { verdict = 'attacker-reachable'; reason = 'a request, socket, header, cookie or remote response supplies the value'; }
+    else if (roots.length && [...classes].every((c) => c === 'operator')) {
+      verdict = 'operator-controlled';
+      reason = 'only command-line arguments or environment variables supply the value; whoever starts the program chooses them, so no trust boundary is crossed';
+    } else if (roots.length && role === 'cli' && roots.every((r) => r.provenance === 'file-read' || OPERATOR.has(r.provenance))) {
+      verdict = 'operator-controlled';
+      reason = 'the function belongs to a command-line program (reached from a main that imports no server framework) and the value comes from files the person running it pointed the program at, or from its arguments and environment; standard input is not covered by this rule';
+    } else if (classes.has('data')) { verdict = 'data-input'; reason = 'standard input or file content supplies the value'; }
+    else if (classes.has('weak-param')) {
+      verdict = 'entry-parameter';
+      reason = 'a parameter of an exported function that nothing in the analysed code calls';
+      const pt = passThroughVerdict(perFile, f);
+      if (pt) { verdict = 'api-contract'; reason = 'the function hands its parameter on whole (or as the root of a fixed tail) to a path or command operation: a thin wrapper, whose caller chose what to read or run'; }
+    } else if (!roots.length && role === 'cli') {
+      // No origin was recorded. Every external origin the model knows (a request, a socket, a remote response) is recorded when it is read, so
+      // an empty record in a command-line program means the value came from the operator's side: its arguments, environment, files or
+      // configuration reached the sink through a path the engine could not attribute. Stated as an inference on the finding.
+      verdict = 'operator-controlled';
+      reason = 'no origin was recorded for the tainted value and the function belongs to a command-line program; no request, socket or remote-response read feeds it (inferred, not proven)';
+      inferred = true;
+    } else { verdict = 'unattributed'; reason = roots.length ? 'the recorded origins are not classified' : 'the engine recorded no origin for the value'; }
+
+    f.trustBoundary = { verdict, reason, role, ...(inferred ? { inferred: true } : {}), roots: roots.slice(0, 5) };
+    const key = verdict.replace(/-(\w)/g, (_, c) => c.toUpperCase());
+    stats[key] = (stats[key] || 0) + 1;
+    if ((verdict === 'operator-controlled' || verdict === 'api-contract') && !f._trustLowered) {
+      f._trustLowered = true;
+      f.originalSeverity = f.originalSeverity || f.severity;
+      f.severity = 'info';
+      f.controls = [...(f.controls || []), { kind: verdict === 'operator-controlled' ? 'operator-controlled-input' : 'api-contract-wrapper', evidenceKind: 'source' }];
+      f.guardNote = { kind: verdict, reason };
+    }
+  }
+  return stats;
+}

package/src/language/haskell-web.js

@@ -19,6 +19,7 @@
 //     is recorded as `unknown` coverage, never as protected and never omitted.
 
 import { buildHaskellIR, lowerHandlerExpr, resolveName } from './haskell-ir.js';
+import { codeOfLine } from './haskell-comments.js';
 import { qualifyAmbiguous, HS_WEB_FRAMEWORKS, HS_WEB_MODEL_VERSION, modelStatus } from './haskell-models.js';
 
 export const HS_WEB_RULES_VERSION = 'haskell-web-rules/1';
@@ -1055,7 +1056,7 @@ function emitFindings(ctx, result, yesodAuthz) {
     const vs = result.versionStatus[R.framework];
     const untested = vs && vs.status !== 'tested';
     if (untested) extra = { ...extra, confidence: (extra.confidence ?? 0.75) * 0.8, uncertainty: [...(extra.uncertainty || []), { kind: 'untested-model', detail: `${vs.package} ${vs.version || '(version unknown)'} is not in the tested set (${vs.tested.join(', ')}); the route model is applied best-effort` }] };
-    const snip = (text.split('\n')[line - 1] || '').trim().slice(0, 240);
+    const snip = codeOfLine(text.split('\n')[line - 1] || '').slice(0, 240);
     out.push({
       id: `hs-web:${rule}:${R.file}:${line}:${R.method}:${R.path}`, severity: extra.severity || r.severity, file: R.file, line, vuln: r.vuln, cwe: r.cwe,
       description: `${r.vuln}: ${R.method} ${R.path} (${R.framework})${extra.detail ? ` - ${extra.detail}` : ''}`,

package/src/sast/cloud-iam.js

@@ -363,7 +363,9 @@ export function scanCloudIam(fp, raw) {
   if (!raw || raw.length > 500_000) return [];
   const out = [];
   const seen = new Set();
-  const isJson = /\.json$/i.test(fp) || raw.trimStart().startsWith('{');
+  // A file is JSON by its extension or because it OPENS like a JSON object: a brace, then a quoted key or a closing brace. A bare leading `{` is not
+  // enough: a Haskell module that starts with a `{-# LANGUAGE ... #-}` pragma (or a `{- ... -}` comment) begins with one too, and its prose was read as policy.
+  const isJson = /\.json$/i.test(fp) || /^\s*\{\s*(?:"|\})/.test(raw.slice(0, 4096));
   const isYaml = /\.(?:yaml|yml)$/i.test(fp);
   const isBicep = /\.bicep$/i.test(fp);
   const isTf = /\.tf$/i.test(fp);