@clear-capabilities/agentic-security-scanner 0.195.10 → 0.195.12

package/src/language/haskell-ir.js

@@ -43,6 +43,26 @@ const IO_NAMES = new Set(['putStr', 'putStrLn', 'print', 'getLine', 'getContents
 
 // name -> positions of the function, the collection and (folds) the seed.
 const BODY_SETTER = /^Network\.HTTP\.(?:Simple|Conduit|Client)\.setRequestBody(?:JSON|LBS|BS|URLEncoded|File)$/;
+// A mutable cell carries what was written to it: `writeIORef ref v` assigns the cell's variable, `readIORef ref` reads it, `modifyIORef ref f`
+// is `ref = f ref`. The same for MVar, TVar and STRef. Only a cell held in a LOCAL variable of the function that reads it is modelled
+// (created there, or handed in as a parameter): a cell written in one function and read in another is not followed (see the guide's limits).
+const CELL_OPS = Object.freeze({
+  'Data.IORef.writeIORef': 'write', 'Data.IORef.readIORef': 'read', 'Data.IORef.modifyIORef': 'modify', "Data.IORef.modifyIORef'": 'modify', 'Data.IORef.atomicWriteIORef': 'write',
+  'Control.Concurrent.MVar.putMVar': 'write', 'Control.Concurrent.MVar.takeMVar': 'read', 'Control.Concurrent.MVar.readMVar': 'read', 'Control.Concurrent.MVar.modifyMVar_': 'modify', 'Control.Concurrent.MVar.swapMVar': 'write',
+  'Control.Concurrent.putMVar': 'write', 'Control.Concurrent.takeMVar': 'read', 'Control.Concurrent.readMVar': 'read', 'Control.Concurrent.modifyMVar_': 'modify',
+  'Control.Concurrent.STM.writeTVar': 'write', 'Control.Concurrent.STM.readTVar': 'read', 'Control.Concurrent.STM.readTVarIO': 'read', 'Control.Concurrent.STM.modifyTVar': 'modify', "Control.Concurrent.STM.modifyTVar'": 'modify',
+  'Control.Concurrent.STM.TVar.writeTVar': 'write', 'Control.Concurrent.STM.TVar.readTVar': 'read', 'Control.Concurrent.STM.TVar.readTVarIO': 'read', 'Control.Concurrent.STM.TVar.modifyTVar': 'modify', "Control.Concurrent.STM.TVar.modifyTVar'": 'modify',
+  'Data.STRef.writeSTRef': 'write', 'Data.STRef.readSTRef': 'read', 'Data.STRef.modifySTRef': 'modify', "Data.STRef.modifySTRef'": 'modify',
+});
+// `instance Runner Shell`, `instance Show a => Runner (Box a)`: the type constructor the instance is for (the first constructor after the class name).
+function instanceTypeOf(inst) {
+  const head = String((inst && inst.headText) || '').replace(/^.*?=>\s*/, '');
+  const cls = inst && inst.name ? String(inst.name).replace(/[.*+?^${}()|[\]\\]/g, '\\$&') : null;
+  if (!cls) return null;
+  const after = head.replace(new RegExp(`^\\s*(?:[A-Z][\\w']*\\.)*${cls}(?![\\w'])`), '');
+  const m = /^[\s([]*(?:[A-Z][\w']*\.)*([A-Z][\w']*)/.exec(after);
+  return m ? m[1] : null;
+}
 const HOF = {
   map: { fn: 0, coll: 1, kind: 'map' }, fmap: { fn: 0, coll: 1, kind: 'map' }, concatMap: { fn: 0, coll: 1, kind: 'map' },
   traverse: { fn: 0, coll: 1, kind: 'traverse' }, mapM: { fn: 0, coll: 1, kind: 'traverse' },
@@ -232,6 +252,11 @@ function exportedLookup(proj, target, name, depth, seen) {
   if (depth > HS_IR_LIMITS.maxResolveDepth) return { kind: 'unknown', reason: 'resolution-depth-cap' };
   const next = new Set(seen); next.add(key);
   if (!target.exports) return target.defs.has(name) ? defResult(target, name) : null;
+  // A wildcard re-export of a module the project does not contain (`module CorePrelude` over `import CorePrelude hiding (..)`) can only say the
+  // name MIGHT come from there. It is kept as the fallback while the rest of the export list is searched: a definition the project holds, or a
+  // name an import lists, is the answer when one exists. IHP's preludes re-export `CorePrelude` first and `IHP.Controller.Param` later, and
+  // returning the possibility first made every `param` an unknown external name instead of the in-tree request read.
+  let fallback = null;
   for (const ex of target.exports) {
     if (ex.kind === 'var' && ex.name === name) return resolveGlobal(proj, target, name, ex.qual || null, depth + 1, next);
     if (ex.kind === 'type' && ex.all) {
@@ -245,11 +270,13 @@ function exportedLookup(proj, target, name, depth, seen) {
         if (imp.items && (imp.hiding ? imp.items.includes(name) : !imp.items.includes(name))) continue;
         const t2 = proj.modules.get(imp.module);
         const r = t2 ? exportedLookup(proj, t2, name, depth + 1, next) : { kind: 'external', module: imp.module, name, certain: !!(imp.items && !imp.hiding && imp.items.includes(name)) };
-        if (r) return r;
+        if (!r) continue;
+        if (r.kind === 'external' && !r.certain) { if (!fallback) fallback = r; continue; }
+        return r;
       }
     }
   }
-  return null;
+  return fallback;
 }
 
 // A top-level resolution (depth 0, nothing seen yet) is a pure function of the module table, which is complete before any function
@@ -285,7 +312,9 @@ function resolveGlobalUncached(proj, mod, name, qual, depth, seen) {
         const owner = r.kind === 'def' ? (r.def.kind === 'field' ? (proj.modules.get(r.mod)?.cons.get(r.def.con)?.type) : r.def.kind === 'method' ? r.def.cls : null) : null;
         if (!owner || !(imp.typeAll || []).includes(owner)) continue;
       }
-      if (r.kind === 'unknown') { unknownReason = r.reason; if (r.candidates) unknownCandidates = r.candidates; } else hits.push(r);
+      if (r.kind === 'unknown') { unknownReason = r.reason; if (r.candidates) unknownCandidates = r.candidates; }
+      else if (r.kind === 'external' && !r.certain) wildcard.push(r.module || imp.module);   // a re-export chain's "might come from there" is a possibility, not a hit that makes a definition ambiguous
+      else hits.push(r);
     } else if (qual || (imp.items && !imp.hiding && imp.items.includes(name))) hits.push({ kind: 'external', module: imp.module, name, certain: true });
     else wildcard.push(imp.module);   // includes `import M (T(..))` of a module we cannot read: possible, never certain
   }
@@ -560,6 +589,9 @@ class FnLowerer {
         for (const r of refs) this.noteRef(r, 'section', ln);
         return { kind: 'array', elements: [this.lowerExpr(e.e, ln)], hs: { section: e.op, partial: { remaining: 1 } } };
       }
+      // A Template Haskell splice in expression position: generated code the analysis never sees. The parser has already disclosed the
+      // `th-splice` boundary for the module, so this is not a lowering gap of the IR; the value is unknown.
+      case 'splice': return unknownExpr({ splice: true });
       default: this.diagnostics.push({ kind: 'lowering-gap', detail: e.t || 'unknown' }); return unknownExpr({ ast: e.t || 'unknown' });
     }
   }
@@ -590,6 +622,11 @@ class FnLowerer {
     const r = this.resolve(e.name, e.qual);
     if (r.kind === 'alias') return r.expr;
     if (r.kind === 'def' && r.def.kind === 'field') return { kind: 'ident', name: e.name, hs: { fieldSelector: r.name } };
+    if (r.kind === 'def' && r.def.kind === 'fun' && isKnownApi(r.mod, r.name)) {
+      // a modelled name the project itself defines (see applyVar): the registry's meaning, the definition still referenced
+      this.noteRef(r.qid, 'modelled-definition', ln);
+      return { kind: 'ident', name: `${r.mod}.${r.name}`, hs: { resolution: 'external', certain: true, modelledDefinition: r.qid } };
+    }
     if (r.kind === 'def' || r.kind === 'localfn') {
       this.noteRef(r.qid, 'reference', ln);
       return { kind: 'ident', name: this.canonical(r), hs: { functionRef: r.qid } };
@@ -683,10 +720,29 @@ class FnLowerer {
       if (f.name === 'uncurry' && argAsts.length === 2 && tup(argAsts[1])) return this.lowerApp(argAsts[0], tup(argAsts[1]), ln, via);
     }
     if (r.kind === 'def' && r.def.kind === 'field' && argAsts.length >= 1) {
+      // `exec ops x` where `ops` is a top-level constant record whose `exec` field holds a function: the application is of THAT function. The
+      // held function is found in the constant's record syntax (`Ops { exec = \x -> .. }` or `Ops { exec = pingHost }`); a positional
+      // construction, a field set by an update, or a record built at run time stay an indirect call.
+      const held = argAsts.length > 1 ? this.heldFieldFunction(r, argAsts[0], ln) : null;
+      if (held) {
+        const lowered = argAsts.slice(1).map((a) => ({ t: 'lowered', expr: this.lowerExpr(a, ln) }));
+        const savedMod = this.mod; const savedOverride = this.lineOverride;
+        this.lineOverride = this.lineOverride || ln; this.inlineDepth = (this.inlineDepth || 0) + 1; this.mod = held.mod;
+        try { return this.lowerApp(held.expr, lowered, ln, via); } finally { this.mod = savedMod; this.lineOverride = savedOverride; this.inlineDepth -= 1; }
+      }
       const obj = this.lowerExpr(argAsts[0], ln);
+      if (argAsts.length > 1) {
+        const viaField = this.applyFieldCandidates(r.def.con, r.name, argAsts.slice(1), ln, via);
+        if (viaField) return viaField;
+      }
       const mem = { kind: 'member', object: obj, prop: r.name };
       return argAsts.length === 1 ? mem : { kind: 'call', callee: '<indirect>', args: [mem, ...argAsts.slice(1).map((a) => this.lowerExpr(a, ln))], hs: { status: 'unknown', reason: 'field-applied' } };
     }
+    // `psUnkownHost host` where `psUnkownHost` was bound by a record pattern: the functions the project stores in that field.
+    if (r.kind === 'local' && r.field && argAsts.length) {
+      const viaField = this.applyFieldCandidates(r.field.con, r.field.name, argAsts, ln, via);
+      if (viaField) return viaField;
+    }
     const viaAlias = this.applyAlias(r, argAsts, ln, via);
     if (viaAlias) return viaAlias;
     let args = argAsts.map((a) => this.lowerExpr(a, ln));
@@ -700,7 +756,18 @@ class FnLowerer {
     if (selector) hs.selector = selector;
     let callee = f.qual ? `${f.qual}.${f.name}` : f.name;
     const arity = (r.kind === 'def' && r.def.kind === 'fun') ? r.def.arity : (r.kind === 'localfn' ? r.arity : -1);
-    if ((r.kind === 'def' && r.def.kind === 'fun') || r.kind === 'localfn') {
+    if (r.kind === 'def' && r.def.kind === 'fun' && isKnownApi(r.mod, r.name)) {
+      // The project defines a module the model registry models: the project IS the framework (a framework repository scanning itself) or
+      // carries a copy of it. The registry says what the name means to its caller (a request read, a sink, a sanitizer), which the
+      // definition's body, written in terms the registry does not model (an implicit request parameter, a parser over it), does not show.
+      // The call is lowered as the library call; the definition is still referenced, so it is never an uncalled entry point, and its own
+      // body is still analysed as a function of the project. Pinned both ways in test/haskell/haskell-taint-shapes.test.js.
+      this.noteRef(r.qid, 'modelled-definition', ln);
+      callee = `${r.mod}.${r.name}`;
+      hs.status = 'external'; hs.certain = true; hs.modelledDefinition = r.qid;
+      hs.effect = r.def.sig ? (r.def.sig.returnsIO ? 'io' : 'pure') : (IO_NAMES.has(f.name) ? 'io' : 'unknown');
+      if (hs.effect === 'io') this.sawIO = true;
+    } else if ((r.kind === 'def' && r.def.kind === 'fun') || r.kind === 'localfn') {
       callee = this.canonical(r);
       hs.status = 'resolved'; hs.target = r.qid;
       if (r.kind === 'def' && arity === args.length && arity > 0 && (this.inlineDepth || 0) < INLINE_MAX_DEPTH) {
@@ -722,6 +789,10 @@ class FnLowerer {
       hs.status = 'typeclass'; hs.cls = r.def.cls; hs.method = r.name; hs.target = r.qid;
       hs.candidates = this.proj.instancesOf(r.def.cls, r.name);
       hs.effect = 'unknown';
+      // `run Shell x`: an argument that is a constructor of a type with exactly one visible instance of the class names the instance, so the
+      // call is a call of that instance's method (a resolved edge, not a set of candidates). An argument of unknown type keeps the candidates.
+      const picked = this.dispatchInstance(r.def.cls, r.name, args);
+      if (picked) { callee = picked.name; hs.status = 'resolved'; hs.target = picked.qid; hs.dispatchedOn = picked.type; delete hs.candidates; }
     } else if (r.kind === 'param') {
       hs.status = 'param'; hs.paramIndex = r.index; hs.effect = 'unknown';
     } else if (r.kind === 'local') {
@@ -747,6 +818,10 @@ class FnLowerer {
       if (ctxTargets.some((t) => t.length)) hs.argTargets = ctxTargets;
     }
     const call = { kind: 'call', callee, args, line: ln, hs };
+    if (hs.status === 'external' || hs.status === 'builtin') {
+      const cell = this.lowerCellOp(callee, args, argAsts, ln, call);
+      if (cell) return cell;
+    }
     // `setRequestBodyJSON body req` returns the REQUEST with a body: the body's taint is a property of the body, and
     // must not make the request's URL tainted. The call still gets its own node so a sink on the body argument fires.
     if ((hs.status === 'external' || hs.status === 'builtin') && BODY_SETTER.test(callee) && args.length >= 2) {
@@ -757,6 +832,89 @@ class FnLowerer {
     return (hs.status === 'external' || hs.status === 'builtin') && isSourceApi(callee) ? this.sourceValue(call, ln) : call;
   }
 
+  // The instance a class-method call dispatches to, when an argument is a constructor (nullary, positional or record) of a type that has
+  // exactly one visible instance of the class. Several candidate types, or no constructor argument, is null (the candidates stay).
+  dispatchInstance(cls, method, args) {
+    const cands = this.proj.instancesOf(cls, method);
+    if (!cands.length) return null;
+    const types = new Set();
+    for (const a of args) {
+      const con = a && a.hs && a.hs.con;
+      if (!con) continue;
+      const c = this.mod.cons.get(con) || this.proj.findCon(con);
+      if (c && c.type) types.add(c.type);
+    }
+    if (types.size !== 1) return null;
+    const [type] = types;
+    const hits = cands.filter((q) => { const m = this.proj.instanceMeta.get(q); return m && m.type === type; });
+    if (hits.length !== 1) return null;
+    return { qid: hits[0], name: this.proj.instanceMeta.get(hits[0]).name, type };
+  }
+
+  // The function a record field of a top-level constant holds: `ops = Ops { exec = \x -> .. }` for `exec ops`. Returns the field's expression
+  // and the module it was written in, or null (the constant is not a single record literal, or the field is not set there).
+  heldFieldFunction(r, objAst, ln) {
+    if ((this.inlineDepth || 0) >= INLINE_MAX_DEPTH) return null;
+    const u = unparen(objAst);
+    if (!u || u.t !== 'var') return null;
+    const r0 = this.resolve(u.name, u.qual);
+    if (r0.kind !== 'def' || r0.def.kind !== 'fun' || r0.def.arity !== 0) return null;
+    const mod = this.proj.modules.get(r0.mod);
+    const fnAst = mod && mod.groups.funs.find((f) => f.name === r0.name);
+    if (!fnAst || fnAst.clauses.length !== 1) return null;
+    const c = fnAst.clauses[0];
+    if (c.pats.length || !c.rhs || (c.rhs.guards && c.rhs.guards.length) || (c.rhs.where && c.rhs.where.length) || !c.rhs.body) return null;
+    const body = unparen(c.rhs.body);
+    if (!body || body.t !== 'rec' || !body.con || body.con.name !== r.def.con) return null;
+    const fld = (body.fields || []).find((f) => !f.wildcard && f.name === r.name && f.e);
+    if (!fld) return null;
+    this.noteRef(r0.qid, 'reference', ln);
+    return { mod, expr: fld.e };
+  }
+
+  // A function held in a record field whose record is NOT a top-level constant (a parameter bound by `Con {..}`, a record built at run time):
+  // the application is the union of the functions the project stores in that field, found in every construction of the constructor
+  // (`Con { f = g }`, or `Con{..}` with `f <- pure g` / `f = g` in the building function; a `case`/`if` chooses among them; `pure`/`return` is
+  // peeled; `const <$> e` / `const e` is a function that ignores its argument). Any construction whose value cannot be classified (a lambda
+  // with captured locals, an arbitrary expression) leaves the call unresolved as before: a partial answer would hide a sink or invent one.
+  applyFieldCandidates(con, field, argAsts, ln, via) {
+    if (!con || !field || (this.inlineDepth || 0) >= INLINE_MAX_DEPTH) return null;
+    const cands = this.proj.fieldFunctionCandidates(con, field);
+    if (!cands.length || cands.some((c) => c.kind === 'opaque')) return null;
+    const lowered = argAsts.map((a) => ({ t: 'lowered', expr: this.lowerExpr(a, ln) }));
+    let out = null;
+    for (const c of cands) {
+      let v;
+      if (c.kind === 'ignores') v = unknownExpr({ fieldFunction: `${con}.${field}`, ignoresArguments: true });
+      else {
+        const savedMod = this.mod; const savedOverride = this.lineOverride;
+        this.lineOverride = this.lineOverride || ln; this.inlineDepth = (this.inlineDepth || 0) + 1; this.mod = c.mod;
+        try { v = this.lowerApp(c.expr, lowered, ln, via); } finally { this.mod = savedMod; this.lineOverride = savedOverride; this.inlineDepth -= 1; }
+      }
+      out = mkUnion(out, v);
+    }
+    if (out) out.hs = { ...(out.hs || {}), fieldFunction: `${con}.${field}`, candidates: cands.length };
+    return out;
+  }
+
+  // A mutable cell held in a local variable (see CELL_OPS): a write is an assignment of the cell's variable, a read is that variable, a modify is
+  // the function applied to it. Anything else (a cell that is not a local variable, a missing argument) is the plain call.
+  lowerCellOp(callee, args, argAsts, ln, call) {
+    const op = CELL_OPS[callee];
+    if (!op) return null;
+    const ref = args[0];
+    if (!ref || ref.kind !== 'ident' || !ref.name || ref.hs) return null;
+    this.sawIO = true;
+    if (op === 'read') return { kind: 'ident', name: ref.name };
+    if (op === 'write' && args.length >= 2) { this.cfg.add('assign', ln, { target: ref.name, source: args[1], hs: { demand: 'executed', cellWrite: callee } }); return call; }
+    if (op === 'modify' && argAsts.length >= 2) {
+      const applied = this.lowerApp(argAsts[1], [{ t: 'lowered', expr: { kind: 'ident', name: ref.name } }], ln, callee);
+      this.cfg.add('assign', ln, { target: ref.name, source: applied, hs: { demand: 'executed', cellWrite: callee } });
+      return call;
+    }
+    return null;
+  }
+
   // A modelled source read gets its own assignment node, so the evidence chain names the exact line the
   // untrusted data entered, even when the read sits inside a larger expression (`f =<< getLine`).
   sourceValue(call, ln) {
@@ -813,7 +971,8 @@ class FnLowerer {
     try {
       inl.params.forEach((name, i) => this.declare(name, { kind: 'alias', expr: loweredArgs[i] }));
       this.mod = calleeMod;
-      (this.inlinedCalls ||= []).push({ site: null, callee: this.canonical(r), args: [], line: ln, hs: { status: 'resolved', target: r.qid, effect: 'unknown', inlined: true, ...(via ? { via } : {}) } });
+      // the lowered arguments are kept on the edge: a rule asking what a helper's parameters receive reads them (haskell-security-rules.js requestTextParams)
+      (this.inlinedCalls ||= []).push({ site: null, callee: this.canonical(r), args: loweredArgs, line: ln, hs: { status: 'resolved', target: r.qid, effect: 'unknown', inlined: true, ...(via ? { via } : {}) } });
       const out = this.lowerExpr(inl.body, ln);
       return out && typeof out === 'object' ? { ...out, hs: { ...(out.hs || {}), inlinedFrom: r.qid } } : out;
     } finally {
@@ -1080,8 +1239,10 @@ class FnLowerer {
           const info = this.mod.cons.get(pat.con) || this.proj.findCon(pat.con);
           pat.args.forEach((x, i) => walk(x, { kind: 'member', object: s, prop: info && info.fields && info.fields[i] ? info.fields[i] : `${pat.con}.${i}` }));
           for (const f of pat.fields) {
-            if (f.wildcard) { for (const fld of (info && info.fields) || []) if (!pat.fields.some((g) => g.name === fld)) emit(fld, { kind: 'member', object: s, prop: fld }); }
-            else walk(f.pat, { kind: 'member', object: s, prop: f.name });
+            // A variable bound to a record field (`MkProxySettings {..}`, `Ops { exec = run }`) remembers which field it is, so applying it can be
+            // resolved to the functions the project stores in that field (see applyFieldCandidates).
+            if (f.wildcard) { for (const fld of (info && info.fields) || []) if (!pat.fields.some((g) => g.name === fld)) { emit(fld, { kind: 'member', object: s, prop: fld }); this.declare(fld, { kind: 'local', field: { con: pat.con, name: fld } }); } }
+            else { walk(f.pat, { kind: 'member', object: s, prop: f.name }); if (f.pat && f.pat.t === 'pvar') this.declare(f.pat.name, { kind: 'local', field: { con: pat.con, name: f.name } }); }
           }
           break;
         }
@@ -1297,6 +1458,7 @@ class Project {
     this.fns = [];
     this.byFile = new Map();
     this.instanceIndex = new Map(); // `${cls}.${method}` -> qids
+    this.instanceMeta = new Map();  // instance-method qid -> { type, name }: the type the instance is for and the function's call-graph name
     this.diagnostics = [];
   }
 
@@ -1328,6 +1490,83 @@ class Project {
     return this._recTypes;
   }
 
+  // The function values the project stores in field `field` of constructor `con`, over every construction in every module (see
+  // applyFieldCandidates). Each candidate is `{kind:'name', mod, expr}` (a name resolved where the construction is), `{kind:'ignores'}`
+  // (`const <$> e`, `fmap const e`, `const e`: the function ignores its argument) or `{kind:'opaque'}`. Bounded by a node budget per module.
+  fieldFunctionCandidates(con, field) {
+    const key = `${con}.${field}`;
+    if (!this._fieldCands) this._fieldCands = new Map();
+    if (this._fieldCands.has(key)) return this._fieldCands.get(key);
+    const out = [];
+    const walkAst = (n, visit, budget) => {
+      if (!n || typeof n !== 'object' || budget.n-- <= 0) return;
+      if (Array.isArray(n)) { for (const x of n) walkAst(x, visit, budget); return; }
+      if (typeof n.t === 'string') visit(n);
+      for (const k of Object.keys(n)) { const v = n[k]; if (v && typeof v === 'object') walkAst(v, visit, budget); }
+    };
+    // The expression bound to `name` inside the clause: a do-bind (`name <- e`), a `let`/`where` clause without parameters, or a pattern binding.
+    const bindingOf = (clause, name) => {
+      let found = null;
+      walkAst(clause, (n) => {
+        if (found) return;
+        if (n.t === 'sbind' && n.pat && n.pat.t === 'pvar' && n.pat.name === name) found = { e: n.e, bind: true };
+        else if (n.t === 'clause' && n.name === name && n.clause && !n.clause.pats.length && n.clause.rhs && n.clause.rhs.body && !(n.clause.rhs.guards && n.clause.rhs.guards.length)) found = { e: n.clause.rhs.body };
+        else if (n.t === 'patbind' && n.pat && n.pat.t === 'pvar' && n.pat.name === name && n.rhs && n.rhs.body) found = { e: n.rhs.body };
+      }, { n: 20000 });
+      return found;
+    };
+    const localsOf = (clause) => {
+      const names = new Set();
+      for (const p of clause.pats || []) for (const v of patternVars(p)) names.add(v);
+      walkAst(clause, (n) => {
+        if (n.t === 'sbind' && n.pat) for (const v of patternVars(n.pat)) names.add(v);
+        else if (n.t === 'clause' && n.name) names.add(n.name);
+        else if (n.t === 'lam') for (const p of n.params || []) for (const v of patternVars(p)) names.add(v);
+        else if (n.t === 'patbind' && n.pat) for (const v of patternVars(n.pat)) names.add(v);
+      }, { n: 20000 });
+      return names;
+    };
+    const isVar = (e, name) => { const u = unparen(e); return u && u.t === 'var' && !u.qual && u.name === name; };
+    const classify = (e, mod, locals, depth) => {
+      const u = unparen(e);
+      if (!u || depth > 6) { out.push({ kind: 'opaque' }); return; }
+      if (u.t === 'var') {
+        if (locals.has(u.name) && !u.qual) { out.push({ kind: 'opaque' }); return; }
+        const r = resolveGlobal(this, mod, u.name, u.qual || null);
+        if ((r.kind === 'def' && r.def.kind === 'fun') || r.kind === 'external' || r.kind === 'builtin') out.push({ kind: 'name', mod, expr: u });
+        else out.push({ kind: 'opaque' });
+        return;
+      }
+      if (u.t === 'op' && u.op === '$') { classify({ t: 'app', f: u.l, args: [u.r], line: u.line }, mod, locals, depth + 1); return; }
+      if (u.t === 'op' && u.op === '<$>' && isVar(u.l, 'const')) { out.push({ kind: 'ignores' }); return; }
+      if (u.t === 'app' && u.args.length === 1 && (isVar(u.f, 'pure') || isVar(u.f, 'return'))) { classify(u.args[0], mod, locals, depth + 1); return; }
+      if (u.t === 'app' && isVar(u.f, 'fmap') && u.args.length === 2 && isVar(u.args[0], 'const')) { out.push({ kind: 'ignores' }); return; }
+      if (u.t === 'app' && isVar(u.f, 'const') && u.args.length === 1) { out.push({ kind: 'ignores' }); return; }
+      if (u.t === 'case') { for (const a of u.alts || []) { if (a.rhs && a.rhs.guards && a.rhs.guards.length) for (const g of a.rhs.guards) classify(g.body, mod, locals, depth + 1); else classify(a.rhs && a.rhs.body, mod, locals, depth + 1); } return; }
+      if (u.t === 'if') { classify(u.a, mod, locals, depth + 1); classify(u.b, mod, locals, depth + 1); return; }
+      out.push({ kind: 'opaque' });
+    };
+    for (const mod of this.modules.values()) {
+      for (const f of (mod.groups && mod.groups.funs) || []) {
+        for (const c of f.clauses || []) {
+          const recs = [];
+          walkAst(c, (n) => { if (n.t === 'rec' && n.con && n.con.name === con) recs.push(n); }, { n: 20000 });
+          if (!recs.length) continue;
+          const locals = localsOf(c);
+          for (const r of recs) {
+            const explicit = (r.fields || []).find((x) => !x.wildcard && x.name === field);
+            if (explicit) { classify(explicit.e, mod, locals, 0); continue; }
+            if (!(r.fields || []).some((x) => x.wildcard)) continue;   // the field is not set here (a partial record): nothing is known about it
+            const b = bindingOf(c, field);
+            if (b) classify(b.e, mod, locals, 0); else out.push({ kind: 'opaque' });
+          }
+        }
+      }
+    }
+    this._fieldCands.set(key, out);
+    return out;
+  }
+
   // A definition by its qid (the last one in module order wins, as the linear scan it replaces did).
   defByQid(qid) {
     if (!this._defIndex) {
@@ -1467,7 +1706,11 @@ function buildHaskellIRUncached(fileContents) {
         const key = `${inst.name}.${f.name}`;
         if (!proj.instanceIndex.has(key)) proj.instanceIndex.set(key, []);
         proj.instanceIndex.get(key).push(qid);
-        instQids.push({ mod, inst, f, qid });
+        // the call-graph name carries the instance's type when it is known, so two instances of one class resolve to different functions by name
+        const type = instanceTypeOf(inst);
+        const name = `${mod.name}.$inst.${inst.name}${type ? `.${type}` : ''}.${f.name}`;
+        proj.instanceMeta.set(qid, { type, name });
+        instQids.push({ mod, inst, f, qid, name });
       }
     }
   }
@@ -1481,8 +1724,8 @@ function buildHaskellIRUncached(fileContents) {
       try { proj.addFn(lowerPatbind(proj, mod, pb)); } catch (err) { proj.diagnostics.push({ file: mod.file, line: pb.line, kind: 'ir-lowering-failure', detail: String(err && err.message) }); }
     }
   }
-  for (const { mod, inst, f, qid } of instQids) {
-    const info = { qid, name: `${mod.name}.$inst.${inst.name}.${f.name}`, line: f.line, parentName: `${mod.name}.$inst.${inst.name}.${f.name}` };
+  for (const { mod, inst, f, qid, name } of instQids) {
+    const info = { qid, name, line: f.line, parentName: name };
     try {
       const L = new FnLowerer(proj, mod, info, []);
       L.lowerClauses(f.clauses, f.line);

package/src/language/haskell-models.js

@@ -42,6 +42,7 @@ export const HS_PACKAGES = Object.freeze({
   'http-conduit': { modules: ['Network.HTTP.Simple', 'Network.HTTP.Conduit'], tested: ['2.3'] },
   wreq: { modules: ['Network.Wreq', 'Network.Wreq.Session'], tested: ['0.5'] },
   'blaze-html': { modules: ['Text.Blaze', 'Text.Blaze.Html', 'Text.Blaze.Html5', 'Text.Blaze.Internal'], tested: ['0.9'] },
+  'blaze-builder': { modules: ['Blaze.ByteString.Builder.Html.Utf8', 'Blaze.ByteString.Builder.Html.Word'], tested: ['0.4.4'] },
   lucid: { modules: ['Lucid', 'Lucid.Base'], tested: ['2.11'] },
   shakespeare: { modules: ['Text.Hamlet', 'Text.Shakespeare'], tested: ['2.0'] },
   text: { modules: ['Data.Text', 'Data.Text.IO', 'Data.Text.Lazy', 'Data.Text.Lazy.IO', 'Data.Text.Encoding'], tested: ['2.0'] },
@@ -347,6 +348,10 @@ san('Text.Blaze', ['toMarkup', 'toValue', 'text', 'string', 'lazyText'], ['xss']
 // Text.Blaze.Html5 and Html4 re-export the escaping combinators, and most files import the element module rather than Text.Blaze.Html
 for (const mod of ['Text.Blaze.Html5', 'Text.Blaze.Html4.Strict', 'Text.Blaze.Html4.Transitional', 'Text.Blaze.Html4.FrameSet', 'Text.Blaze.XHtml5', 'Text.Blaze.XHtml1.Strict']) san(mod, ['toHtml', 'toMarkup', 'toValue', 'text', 'string', 'lazyText', 'textValue', 'stringValue'], ['xss'], 'escapes &, <, >, quotes for HTML text/attribute context');
 san('Lucid', ['toHtml', 'toHtmlRaw_'], ['xss'], 'Lucid.toHtml escapes');
+// blaze-builder's HTML escapers (names read from the 0.4.4.1 Haddock index): a raw WAI body built from them is escaped text. keter's fix for
+// its reflected XSS (HSEC-2024-0001) is `toByteString . fromHtmlEscapedByteString` over the Host header.
+san('Blaze.ByteString.Builder.Html.Utf8', ['fromHtmlEscapedChar', 'fromHtmlEscapedString', 'fromHtmlEscapedShow', 'fromHtmlEscapedText', 'fromHtmlEscapedLazyText'], ['xss'], 'escapes &, <, >, quotes for HTML text/attribute context', { package: 'blaze-builder' });
+san('Blaze.ByteString.Builder.Html.Word', ['fromHtmlEscapedWord', 'fromHtmlEscapedWordList', 'fromHtmlEscapedByteString', 'fromHtmlEscapedLazyByteString'], ['xss'], 'escapes &, <, >, quotes for HTML text/attribute context', { package: 'blaze-builder' });
 san('System.FilePath', ['takeFileName', 'takeBaseName'], ['path'], 'drops every directory component');
 san('System.FilePath.Posix', ['takeFileName', 'takeBaseName'], ['path'], 'drops every directory component');
 // A function whose result is a number or a boolean cannot carry caller text: nothing of the argument survives (`show (length x)`).
@@ -398,6 +403,13 @@ export const HS_RULE_APIS = Object.freeze([
   // mwc-random and splitmix are statistical generators, not CSPRNGs (createSystemRandom only seeds from the OS)
   ...E('System.Random.MWC', ['uniformR', 'uniform', 'uniformRM', 'uniformM', 'createSystemRandom', 'create', 'initialize', 'withSystemRandom', 'withSystemRandomST']),
   ...E('System.Random.SplitMix', ['nextWord64', 'nextInt', 'nextDouble', 'mkSMGen', 'newSMGen', 'initSMGen']),
+  // mutable cells (haskell-ir.js CELL_OPS): named here so the IR qualifies them whichever wildcard imports a module has
+  ...E('Data.IORef', ['newIORef', 'readIORef', 'writeIORef', 'modifyIORef', "modifyIORef'", 'atomicWriteIORef']),
+  ...E('Control.Concurrent.MVar', ['newMVar', 'newEmptyMVar', 'putMVar', 'takeMVar', 'readMVar', 'modifyMVar_', 'swapMVar']),
+  ...E('Control.Concurrent', ['newMVar', 'newEmptyMVar', 'putMVar', 'takeMVar', 'readMVar', 'modifyMVar_']),
+  ...E('Control.Concurrent.STM', ['atomically', 'newTVar', 'newTVarIO', 'readTVar', 'readTVarIO', 'writeTVar', 'modifyTVar', "modifyTVar'"]),
+  ...E('Control.Concurrent.STM.TVar', ['newTVar', 'newTVarIO', 'readTVar', 'readTVarIO', 'writeTVar', 'modifyTVar', "modifyTVar'"]),
+  ...E('Data.STRef', ['newSTRef', 'readSTRef', 'writeSTRef', 'modifySTRef', "modifySTRef'"]),
   ...E('Crypto.Random', ['getRandomBytes']), ...E('System.Entropy', ['getEntropy']),
   ...E('Network.Wai', ['strictRequestBody', 'lazyRequestBody']),
   ...E('Data.Time.Clock.POSIX', ['getPOSIXTime']), ...E('Data.Time.Clock', ['getCurrentTime']), ...E('System.CPUTime', ['getCPUTime']),
@@ -441,8 +453,8 @@ export const HS_WEB_FRAMEWORKS = Object.freeze({
   yesod: { modules: ['Yesod', 'Yesod.Core', 'Yesod.Auth'], package: 'yesod', tested: ['1.6'] },
 });
 export const HS_WEB_APIS = Object.freeze([
-  ...E('Web.Scotty', ['get', 'post', 'put', 'delete', 'patch', 'options', 'addroute', 'matchAny', 'middleware', 'scotty', 'scottyApp', 'status', 'finish', 'raise', 'raiseStatus', 'redirect', 'text', 'json', 'html', 'file', 'setHeader', 'header', 'headers', 'param', 'params', 'captureParam', 'queryParam', 'formParam', 'body', 'jsonData', 'files', 'rescue', 'liftIO', 'notFound']),
-  ...E('Web.Scotty.Trans', ['get', 'post', 'put', 'delete', 'patch', 'middleware', 'scottyT', 'status', 'finish', 'raise', 'raiseStatus', 'redirect', 'text', 'json', 'html', 'header', 'param', 'captureParam', 'queryParam', 'formParam', 'body', 'jsonData']),
+  ...E('Web.Scotty', ['get', 'post', 'put', 'delete', 'patch', 'options', 'addroute', 'matchAny', 'middleware', 'scotty', 'scottyApp', 'status', 'finish', 'raise', 'raiseStatus', 'redirect', 'text', 'json', 'html', 'file', 'setHeader', 'header', 'headers', 'param', 'params', 'captureParam', 'queryParam', 'formParam', 'body', 'jsonData', 'files', 'rescue', 'liftIO', 'notFound', 'setMaxRequestBodySize']),
+  ...E('Web.Scotty.Trans', ['get', 'post', 'put', 'delete', 'patch', 'middleware', 'scottyT', 'status', 'finish', 'raise', 'raiseStatus', 'redirect', 'text', 'json', 'html', 'header', 'param', 'captureParam', 'queryParam', 'formParam', 'body', 'jsonData', 'setMaxRequestBodySize']),
   ...E('Network.Wai', ['pathInfo', 'requestMethod', 'requestHeaders', 'responseLBS', 'queryString', 'rawPathInfo']),
   ...E('Network.Wai.Handler.Warp', ['run', 'runSettings']),
   ...E('Network.HTTP.Types', ['status200', 'status201', 'status400', 'status401', 'status403', 'status404', 'unauthorized401', 'forbidden403', 'methodGet', 'methodPost', 'methodPut', 'methodDelete', 'hAuthorization', 'hCookie']),

package/src/language/haskell-parser.js

@@ -1131,7 +1131,10 @@ function analyze(source, file, dialect, ctx, res) {
         put(it.exprStart, seg.slice(it.exprStart, it.close));
         put(it.close, ')');
       }
-      put(interps[interps.length - 1].close + 1, ')');   // closes the application; the char after the last `}` is template text or the `|` of `|]`
+      // Closes the application at the `|` of the closing `|]`: always inside the segment and never a newline. (It used to go at the character
+      // after the last `}`, which is a newline when the interpolation ends its line, so the paren was dropped and the enclosing function failed
+      // to parse: every hledger-web handler whose last `^{widget}` ended a line lost its calls.)
+      put(seg.length - 2, ')');
       const text = chars.join('');
       if (text.length !== seg.length) continue;
       b.kind = 'quasiquote-hamlet';

package/src/language/haskell-security-rules.js

@@ -87,6 +87,54 @@ const BOUNDING = /(?:^|\.)(?:take|takeE|isolate|hGetSome|hGet|splitAt|limit|limi
 const REQUEST_PROVENANCE = new Set(['url-param', 'path-param', 'http-body', 'header', 'cookie', 'upload']);
 // wai-extra's `requestSizeCheck (Just n) req` wraps the request so the body read after it fails past n bytes: a bound on every body read of the function.
 const WAI_SIZE_CHECK = /(?:^|\.)requestSizeCheck$/;
+// scotty's global body limit: `setMaxRequestBodySize kb` in the ScottyM block answers every body read of the application it builds with a 413.
+const SCOTTY_BODY_LIMIT = /^Web\.Scotty(?:\.Trans)?\.setMaxRequestBodySize$/;
+
+// Request text handed to a project helper: in `deleteEnum tableId list`, where the caller's `tableId` was read from the request, the helper's
+// first parameter carries caller text for the partial-function, allocation and bounding rules (which do not follow calls themselves). Decided
+// from the IR's RESOLVED call targets and the caller's own request reads, one hop per round, bounded rounds; a parameter the IR could not name
+// (`$arg0`, a pattern) is skipped. Returns qid -> Set of parameter names.
+function requestTextParams(ir) {
+  const byQid = new Map();
+  for (const fir of Object.values(ir.perFile)) for (const fn of fir.functions) byQid.set(fn.qid, fn);
+  const out = new Map();
+  const requestRead = (c) => { const s = sourceInfo(c.callee); return !!s && REQUEST_PROVENANCE.has(s.provenance); };
+  const callsIn = (e) => { const r = []; for (const x of walk(e)) if (x.kind === 'call' && typeof x.callee === 'string') r.push(x); return r; };
+  for (let round = 0; round < 4; round++) {
+    let grew = false;
+    for (const fn of byQid.values()) {
+      const from = new Set(out.get(fn.qid) || []);
+      for (let k = 0; k < 8; k++) {
+        let g = false;
+        for (const n of fnNodes(fn)) {
+          if (n.kind !== 'assign' || !n.target || !n.source) continue;
+          if (!from.has(n.target) && (callsIn(n.source).some(requestRead) || [...names(n.source)].some((x) => from.has(x)))) { from.add(n.target); g = true; }
+        }
+        if (!g) break;
+      }
+      const derived = (e) => [...names(e)].some((x) => from.has(x)) || callsIn(e).some(requestRead);
+      const mark = (x) => {
+        if (!x || !x.hs) return;
+        // a call with every argument, or a partial application (`updateSchema (deleteEnum tableId)`: the IR keeps the supplied arguments as elements)
+        const target = x.kind === 'call' && x.hs.status === 'resolved' ? x.hs.target : (x.kind === 'array' && x.hs.partial ? x.hs.partial.target : null);
+        if (!target) return;
+        const callee = byQid.get(target);
+        if (!callee || callee === fn || !Array.isArray(callee.params)) return;
+        ((x.kind === 'call' ? x.args : x.elements) || []).forEach((a, i) => {
+          const p = callee.params[i];
+          if (!p || typeof p !== 'string' || p.startsWith('$') || !derived(a)) return;
+          if (!out.has(callee.qid)) out.set(callee.qid, new Set());
+          if (!out.get(callee.qid).has(p)) { out.get(callee.qid).add(p); grew = true; }
+        });
+      };
+      for (const n of fnNodes(fn)) for (const ex of [n.value, n.source, n.cond, ...(n.args || [])]) if (ex) for (const x of walk(ex)) mark(x);
+      // a helper the IR inlined at its call site keeps its edge, with the arguments, on `fn.calls`
+      for (const c of fn.calls || []) if (c && c.hs && c.hs.inlined) mark(c);
+    }
+    if (!grew) break;
+  }
+  return out;
+}
 // `replicateM n getLine` reads n lines: the count is an allocation (and an input loop) sized by whoever supplied n.
 const ALLOCATORS = new Set(['replicate', 'Prelude.replicate', 'Data.List.replicate', 'Data.ByteString.replicate', 'Data.ByteString.Char8.replicate', 'Data.ByteString.Lazy.replicate', 'Data.Text.replicate', 'Data.Vector.replicate', 'Control.Monad.replicateM', 'Control.Monad.replicateM_', 'Data.Vector.replicateM', 'Data.List.genericReplicate']);
 const CLAMPS = /^(?:(?:Prelude|Data\.Ord)\.)?(?:min|clamp)$/;
@@ -391,6 +439,20 @@ export function analyzeHaskellRules(files, opts = {}) {
     if (/import\s+(?:qualified\s+)?Network\.Wai\.Middleware\.RequestSizeLimit\b/.test(text) || /\brequestSizeLimitMiddleware\b/.test(text)) { requestLimit = { file, line: (text.split('\n').findIndex((l) => /RequestSizeLimit|requestSizeLimitMiddleware/.test(l)) + 1) || 1 }; break; }
   }
 
+  const requestParams = requestTextParams(ir);
+  // A ScottyM block that calls setMaxRequestBodySize bounds every body read of the application it builds: certain for a body read in the SAME
+  // function (an inline route) and for a handler the block references; a block elsewhere in the project is a control whose reach is not verified
+  // (the finding stays, at low, as for the wai middleware).
+  const scottyLimitFns = [];
+  for (const fir of Object.values(ir.perFile)) for (const fn of fir.functions) if ((fn.calls || []).some((c) => typeof c.callee === 'string' && SCOTTY_BODY_LIMIT.test(c.callee))) scottyLimitFns.push(fn);
+  const scottyLimitFor = (fn) => {
+    if (!scottyLimitFns.length) return null;
+    if (scottyLimitFns.includes(fn)) return { certain: true, fn };
+    const refs = (g) => new Set([...((g.hs && g.hs.refs) || []).map((r) => r.target), ...(g.calls || []).map((c) => c.hs && c.hs.target).filter(Boolean)]);
+    const g = scottyLimitFns.find((x) => refs(x).has(fn.qid));
+    return g ? { certain: true, fn: g } : { certain: false, fn: scottyLimitFns[0] };
+  };
+
   let currentFn = null;
   const legacyMemo = new Map();
   const emit = (rule, file, line, extra = {}) => {
@@ -446,8 +508,10 @@ export function analyzeHaskellRules(files, opts = {}) {
       // A value READ from the request inside the function (`raw <- param "page"`, `body <- strictRequestBody req`, `lookup h (requestHeaders req)`)
       // is caller-supplied text wherever the function sits: the framework's own read says who supplied it, so no parameter label is needed.
       const requestRead = (c) => { const s = sourceInfo(c.callee); return !!s && REQUEST_PROVENANCE.has(s.provenance); };
-      const derivedText = new Set([...(fnHs.textParams || []).filter((n) => strongParam.has(n) || entryLike), ...(entryLike ? (fnHs.inputParams || []) : [])]);
-      const fromRequest = new Set();
+      // a parameter a caller fills with request-derived text (`requestTextParams`) is caller text here too, whatever this function's own label
+      const helperParams = requestParams.get(fn.qid) || new Set();
+      const derivedText = new Set([...(fnHs.textParams || []).filter((n) => strongParam.has(n) || entryLike), ...(entryLike ? (fnHs.inputParams || []) : []), ...helperParams]);
+      const fromRequest = new Set(helperParams);
       for (let round = 0; round < 8; round++) {
         let grew = false;
         for (const n of fnNodes(fn)) {
@@ -592,9 +656,14 @@ export function analyzeHaskellRules(files, opts = {}) {
               if (e.hs.con === 'VerifyNone' && e.kind === 'literal' && importsFrom(['OpenSSL.Session'])) emit('hs-tls-validation-disabled', file, e.line || node.line, { detail: 'OpenSSL verification mode VerifyNone', evidence: { mode: 'VerifyNone' } });
             }
             // `xs !! n` raises on a short list: a partial function, written as an operator, applied to caller-supplied text
-            if (e.kind === 'binary' && e.op === '!!' && e.left && mentionsText(e.left) && !isTested([e.left])) {
-              emit('hs-partial-function-on-input', file, e.line || node.line, { detail: '!! on a caller-supplied list', evidence: { partial: '!!' } });
-              continue;
+            // (an INDEX from caller text is the same flaw, `list !! tableId`: out of range raises; a relational test on the index in this function covers it)
+            if (e.kind === 'binary' && e.op === '!!' && e.left && e.right) {
+              const listText = mentionsText(e.left) && !isTested([e.left]);
+              const indexText = !listText && mentionsText(e.right) && !isTested([e.right]) && ![...names(e.right)].some((v) => sizeTestedVars.has(v));
+              if (listText || indexText) {
+                emit('hs-partial-function-on-input', file, e.line || node.line, { detail: listText ? '!! on a caller-supplied list' : '!! with a caller-supplied index', evidence: { partial: '!!' }, inlineCtx: e.hs && e.hs.inlineCtx });
+                continue;
+              }
             }
             if (e.kind !== 'call' || typeof e.callee !== 'string') continue;
             const c = e.callee;
@@ -663,12 +732,18 @@ export function analyzeHaskellRules(files, opts = {}) {
               emit('hs-unbounded-allocation', file, line, { detail: `${c} sized by parsed caller text`, evidence: { allocator: c } });
             }
             // a partial function applied to caller text: one malformed value raises an uncaught exception
-            if (PARTIALS.has(c) && args.some((a) => mentionsText(a)) && !isTested(args)) emit('hs-partial-function-on-input', file, line, { detail: `${c} on caller-supplied input`, evidence: { partial: c } });
+            if (PARTIALS.has(c) && args.some((a) => mentionsText(a)) && !isTested(args)) emit('hs-partial-function-on-input', file, line, { detail: `${c} on caller-supplied input`, evidence: { partial: c }, inlineCtx: e.hs && e.hs.inlineCtx });
             // a session/token cookie assembled without HttpOnly or Secure
             if (c === 'Web.Cookie.defaultSetCookie') { /* handled on the record update below */ }
             // unbounded body
             if (BODY_CALLS.has(c) && !sizeChecked && !(c === 'Network.Wai.Conduit.sourceRequestBody' && bounded)) {
-              if (requestLimit) {
+              const scottyLimit = /^Web\.Scotty/.test(c) ? scottyLimitFor(fn) : null;
+              if (scottyLimit && scottyLimit.certain) {
+                controls.push({ kind: 'scotty-body-limit', file: scottyLimit.fn.file, line: scottyLimit.fn.line, appliesTo: `${file}:${line}`, verified: true });
+              } else if (scottyLimit) {
+                controls.push({ kind: 'scotty-body-limit', file: scottyLimit.fn.file, line: scottyLimit.fn.line, appliesTo: `${file}:${line}`, verified: false });
+                emit('hs-unbounded-request-body', file, line, { severity: 'low', confidence: 0.4, detail: c, uncertainty: [{ kind: 'unresolved-import', detail: `a scotty body limit is set (${scottyLimit.fn.file}:${scottyLimit.fn.line}); that this handler is registered in that application is not verified` }] });
+              } else if (requestLimit) {
                 controls.push({ kind: 'request-size-limit', file: requestLimit.file, line: requestLimit.line, appliesTo: `${file}:${line}`, verified: false });
                 emit('hs-unbounded-request-body', file, line, { severity: 'low', confidence: 0.4, detail: c, uncertainty: [{ kind: 'unresolved-import', detail: `a request-size-limit middleware exists (${requestLimit.file}:${requestLimit.line}); that it wraps this handler is not verified` }] });
               } else emit('hs-unbounded-request-body', file, line, { detail: c });