@clear-capabilities/agentic-security-scanner 0.195.23 → 0.195.25

package/src/lineage/source-seeding.js

@@ -30,6 +30,25 @@ import { emptyState, addIdentity } from './field-identity.js';
 import { reclassifySource } from './source-registry.js';
 import { classifyDataElementName } from './classification.js';
 import { dataElementId } from './ids.js';
+import { matchLineageSource } from './lineage-source-catalog.js';
+
+// ── Seed kinds (GA-03.1, 0.195.24) ──────────────────────────────────────────
+//
+// `entry`: the identity is placed in the function's ENTRY state at
+// `seedPath` (a member-shaped source such as `req.body.card_number`, whose
+// path is stable for the whole function). This is §3's original mechanism.
+//
+// `after-node`: the identity is placed at `seedPath` in the state leaving
+// CFG node `nodeId`, by `engine.js`'s worklist through `ctx.seedAfterNode`.
+// Used for a CALL-shaped source assigned straight to a variable
+// (`const record = fs.readFileSync(p)`, `const ssn = prompt('SSN')`,
+// `const data = res.json()`): the call has no access path, so an entry seed
+// has nowhere to land, and the value only exists in the target variable
+// AFTER the assignment (an entry seed at the target would be killed by the
+// assignment's own strong update). Before 0.195.24 every such match was
+// recorded in `unseedable[]`; a call-shaped source anywhere else (nested
+// inside another call's arguments, returned directly) still is.
+export const SEED_KINDS = Object.freeze(['entry', 'after-node']);
 
 // ── §3.1: where the matched expressions come from ──────────────────────────
 //
@@ -169,6 +188,26 @@ export function planSeeds(callGraph, { repository, maxSeeds, maxNodes, signal, d
     if (seeds.length >= seedCap) { stopReason = 'seeding-limit'; continue; }
     if (nodesVisited >= nodeCap) { stopReason = 'seeding-limit'; continue; }
     functionsScanned += 1;
+    const fnSeeds = [];
+    const mint = ({ nid, node, entry, decision, seedPath, seedKind }) => {
+      const canonicalName = seedPath.slice(seedPath.lastIndexOf('.') + 1);
+      const seed = {
+        file: fn.file, qid: fn.qid, nodeId: nid, line: node.line ?? null,
+        entryId: entry.id, seedPath, canonicalName, seedKind,
+        category: decision.category, coverageStatus: decision.coverageStatus,
+        externality: decision.externality, reason: decision.reason,
+        // §3.4's minting rule. `canonicalName` alone is forbidden by
+        // PRD §10.4; the discriminator carries the system proxy
+        // (repository + file), the access path, and the category.
+        // Function scope (`qid`) is deliberately NOT in the
+        // discriminator (§3.4).
+        dataElementId: dataElementId(canonicalName, [repository, fn.file, seedPath, decision.category ?? '']),
+        dataClasses: classifyDataElementName(canonicalName).classes,
+      };
+      seeds.push(seed);
+      fnSeeds.push(seed);
+      return seed;
+    };
     for (const [nid, node] of Object.entries(fn.cfg?.nodes ?? {})) {
       nodesVisited += 1;
       if (seeds.length >= seedCap) { stopReason = 'seeding-limit'; break; }
@@ -176,10 +215,21 @@ export function planSeeds(callGraph, { repository, maxSeeds, maxNodes, signal, d
       for (const root of exprRoots(node)) walkExpr(root, (e, p) => { if (p) parentOf.set(e, p); });
       for (const root of exprRoots(node)) {
         walkExpr(root, (e) => {
-          const entry = matchSource(e, fn.file);
+          // The main taint catalog first (unchanged), then the lineage-only
+          // catalog for the JavaScript collection points the main catalog
+          // deliberately does not treat as taint sources.
+          const entry = matchSource(e, fn.file) ?? matchLineageSource(e, fn.file);
           if (!entry) return;
           const decision = reclassifySource(entry);
-          const seedPath = seedPathFor(e, parentOf);
+          let seedPath = seedPathFor(e, parentOf);
+          let seedKind = 'entry';
+          if (!seedPath && node.kind === 'assign' && node.source === e && typeof node.target === 'string') {
+            // A call-shaped source that IS the whole right-hand side of an
+            // assignment: the value lands in the target, so seed the target
+            // once the node has run (see SEED_KINDS).
+            seedPath = node.target;
+            seedKind = 'after-node';
+          }
           if (!seedPath) {
             unseedable.push({
               file: fn.file, qid: fn.qid, nodeId: nid, line: node.line ?? null,
@@ -187,23 +237,24 @@ export function planSeeds(callGraph, { repository, maxSeeds, maxNodes, signal, d
             });
             return;
           }
-          const canonicalName = seedPath.slice(seedPath.lastIndexOf('.') + 1);
-          seeds.push({
-            file: fn.file, qid: fn.qid, nodeId: nid, line: node.line ?? null,
-            entryId: entry.id, seedPath, canonicalName,
-            category: decision.category, coverageStatus: decision.coverageStatus,
-            externality: decision.externality, reason: decision.reason,
-            // §3.4's minting rule. `canonicalName` alone is forbidden by
-            // PRD §10.4; the discriminator carries the system proxy
-            // (repository + file), the access path, and the category.
-            // Function scope (`qid`) is deliberately NOT in the
-            // discriminator (§3.4).
-            dataElementId: dataElementId(canonicalName, [repository, fn.file, seedPath, decision.category ?? '']),
-            dataClasses: classifyDataElementName(canonicalName).classes,
-          });
+          mint({ nid, node, entry, decision, seedPath, seedKind });
         });
       }
     }
+    // GA-03.1 (0.195.24): a container seed read through an ALIAS. §3.2's
+    // rule extends a match outward only through member accesses enclosing
+    // it in the SAME statement, so `const body = req.body;` seeds the
+    // container `req.body` (data element `body`, no classes) and the later
+    // `body.card_number` read is a field nothing seeded. Follow the alias
+    // within the function: an assignment of a pure access path that starts
+    // at a container seed (or at an earlier alias of one) names an alias,
+    // and every outermost pure member read rooted at an alias mints the
+    // field seed on the ORIGINAL container path. The alias assignment's own
+    // byPath forwarding (`engine.js`, the structure-preserving `ident` and
+    // `member` cases) then carries the field identity through the hop.
+    // Bounded: the alias table is rebuilt at most four rounds (one per
+    // hop of chained aliases) and a wildcard segment is never seeded.
+    if (fnSeeds.length) extendThroughAliases(fn, fnSeeds, mint);
   }
   const notScanned = functionsTotal - functionsScanned;
   const completion = {
@@ -219,6 +270,71 @@ export function planSeeds(callGraph, { repository, maxSeeds, maxNodes, signal, d
   return { seeds, unseedable, completion };
 }
 
+const MAX_ALIAS_ROUNDS = 4;
+
+/** `JSON.parse(x)` / `JSON.stringify(x)` → x (one level); anything else unchanged. */
+function unwrapJsonRoundTrip(e) {
+  if (e && e.kind === 'call' && e.callee && e.callee.kind === 'member' && (e.callee.prop === 'parse' || e.callee.prop === 'stringify')
+    && e.callee.object && e.callee.object.kind === 'ident' && e.callee.object.name === 'JSON' && Array.isArray(e.args) && e.args.length) return e.args[0];
+  return e;
+}
+
+/** `(fn, fnSeeds, mint)`: see the comment at the call site in `planSeeds`. */
+function extendThroughAliases(fn, fnSeeds, mint) {
+  const nodes = Object.entries(fn.cfg?.nodes ?? {});
+  const containers = fnSeeds.filter((s) => s.seedKind === 'entry');
+  if (!containers.length) return;
+  const containerFor = (p) => containers.find((s) => p === s.seedPath || p.startsWith(`${s.seedPath}.`)) ?? null;
+  // ident -> { basePath, seed }: the container path the alias stands for.
+  const aliases = new Map();
+  const resolve = (p) => {
+    if (!p || p.includes('*')) return null;
+    const root = p.slice(0, p.indexOf('.') === -1 ? p.length : p.indexOf('.'));
+    const a = aliases.get(root);
+    if (a) return { basePath: a.basePath + p.slice(root.length), seed: a.seed };
+    const c = containerFor(p);
+    return c ? { basePath: p, seed: c } : null;
+  };
+  for (let round = 0; round < MAX_ALIAS_ROUNDS; round++) {
+    let changed = false;
+    for (const [, node] of nodes) {
+      if (node.kind !== 'assign' || typeof node.target !== 'string' || node.target.includes('.') || node.target.includes('*')) continue;
+      if (aliases.has(node.target)) continue;
+      // GA-03.3: a JSON round trip keeps the container's structure (the
+      // same rule engine.js applies), so `const s = JSON.stringify(req.body)`
+      // and `const back = JSON.parse(s)` are aliases of the container too.
+      const r = resolve(accessPathOf(unwrapJsonRoundTrip(node.source)));
+      if (!r) continue;
+      aliases.set(node.target, r);
+      changed = true;
+    }
+    if (!changed) break;
+  }
+  if (!aliases.size) return;
+  const minted = new Set(fnSeeds.map((s) => s.seedPath));
+  for (const [, node] of nodes) {
+    const parentOf = new Map();
+    for (const root of exprRoots(node)) walkExpr(root, (e, p) => { if (p) parentOf.set(e, p); });
+    for (const root of exprRoots(node)) {
+      walkExpr(root, (e) => {
+        if (e.kind !== 'member') return;
+        const parent = parentOf.get(e);
+        if (parent && parent.kind === 'member' && parent.object === e) return; // not outermost
+        const p = accessPathOf(e);
+        if (!p || p.includes('*')) return;
+        const root = p.slice(0, p.indexOf('.'));
+        const a = aliases.get(root);
+        if (!a) return;
+        const fieldPath = a.basePath + p.slice(root.length);
+        if (fieldPath === a.seed.seedPath || minted.has(fieldPath)) return;
+        minted.add(fieldPath);
+        const site = fn.cfg.nodes[a.seed.nodeId];
+        mint({ nid: a.seed.nodeId, node: site ?? node, entry: { id: a.seed.entryId }, decision: a.seed, seedPath: fieldPath, seedKind: 'entry' });
+      });
+    }
+  }
+}
+
 // ── §3.5: seedEntryStateFactory — the driver.js opts.seedEntryState hook ──
 
 /**
@@ -233,6 +349,7 @@ export function planSeeds(callGraph, { repository, maxSeeds, maxNodes, signal, d
 export function seedEntryStateFactory(seeds) {
   const byQid = new Map();
   for (const s of seeds) {
+    if (s.seedKind === 'after-node') continue;
     if (!byQid.has(s.qid)) byQid.set(s.qid, []);
     byQid.get(s.qid).push(s);
   }
@@ -244,3 +361,22 @@ export function seedEntryStateFactory(seeds) {
     return st;
   };
 }
+
+/**
+ * Builds the `ctx.seedAfterNode(qid, nodeId) -> [{path, id}] | undefined`
+ * function `engine.js`'s worklist consults after every CFG node (GA-03.1,
+ * 0.195.24): the `after-node` seeds of that function, grouped by node.
+ * Keyed by `qid` rather than bound to one function so the same function
+ * works for a callee analysed through `createCallSummaryResolver`.
+ */
+export function seedAfterNodeFactory(seeds) {
+  const byKey = new Map();
+  for (const s of seeds) {
+    if (s.seedKind !== 'after-node') continue;
+    const k = `${s.qid}\u0000${s.nodeId}`;
+    if (!byKey.has(k)) byKey.set(k, []);
+    byKey.get(k).push({ path: s.seedPath, id: s.dataElementId });
+  }
+  if (!byKey.size) return undefined;
+  return (qid, nodeId) => byKey.get(`${qid}\u0000${nodeId}`);
+}

package/src/lineage/summaries.js

@@ -1,4 +1,4 @@
-import { hashState, emptyState, addIdentity } from './field-identity.js';
+import { hashState, emptyState, addIdentity, joinStates } from './field-identity.js';
 import {
   resolveExprIdentities, residualFlat, analyzeFunctionFieldIdentity,
   argumentContext, callInvocationId, calleeRecorder,
@@ -425,7 +425,8 @@ export function applyAtCallSite(summary, paramNames, callArgs) {
 // integration will pass a resolver backed by `scanner/src/ir/callgraph.js`
 // instead, without this function (or `resolveExprIdentities`) needing to
 // change at all.
-export function createCallSummaryResolver(cache, lookupCallee) {
+export function createCallSummaryResolver(cache, lookupCallee, resolverOpts = {}) {
+  const seedEntryState = typeof resolverOpts.seedEntryState === 'function' ? resolverOpts.seedEntryState : null;
   return function resolveCallSummary(calleeExpr, callArgs, callerState, ctx) {
     const resolved = lookupCallee(calleeExpr);
     if (!resolved) return null;
@@ -435,7 +436,18 @@ export function createCallSummaryResolver(cache, lookupCallee) {
     // own header comment) — this call site forwards the caller's `ctx`
     // unmodified; the hazard cannot reappear here because the strip
     // happens one level down, not at each call site.
-    const entryState = entryStateFromCall(fn.params, callArgs, callerState, ctx);
+    const boundState = entryStateFromCall(fn.params, callArgs, callerState, ctx);
+    // GA-03.1 (0.195.24): the callee's OWN source seeds are facts about
+    // expressions in its body (`req.body.card_number` is a source wherever
+    // `extractCard` is called from), so they hold under every entry context,
+    // not only the driver's top-level one. Join them onto the call-derived
+    // state. The cache key is the JOINED state, so a clean call site and the
+    // driver's own analysis of the callee share one key and one summary;
+    // DESIGN_GRAPH_BUILDER.md §3.6's rule stands: no seeded summary is ever
+    // stored under the empty-entry key. The bind hops below enumerate only
+    // the call-derived half (`boundState`): a seed is not an argument.
+    const ownSeeds = seedEntryState ? seedEntryState(fn) : null;
+    const entryState = ownSeeds ? joinStates(boundState, ownSeeds) : boundState;
     // §13.2's first half: the callee's own entry context, computed once so
     // both the bind hop below and the return-direction wrapper at the
     // bottom of this function can reference the exact same value.
@@ -454,7 +466,7 @@ export function createCallSummaryResolver(cache, lookupCallee) {
     // C4 would collide this binding's target with any caller-local
     // variable of the same name (Decision 5's bug class).
     if (ctx?.recordHop) {
-      for (const [path, ids] of entryState) {
+      for (const [path, ids] of boundState) {
         for (const id of ids) {
           ctx.recordHop({
             kind: 'write-out', subKind: 'call-arg-bind',
@@ -508,6 +520,10 @@ export function createCallSummaryResolver(cache, lookupCallee) {
             ...(ctx.correlationVersion === 2 ? { correlationVersion: 2 } : null),
           }
         : { resolveCallSummary };
+      // GA-03.1 (0.195.24): the callee's after-node seeds are body facts
+      // too (source-seeding.js, SEED_KINDS); the hook is keyed by qid, so
+      // forwarding the caller's is exact.
+      if (ctx?.seedAfterNode) calleeCtx.seedAfterNode = ctx.seedAfterNode;
       const result = analyzeFunctionFieldIdentity(fn, es, calleeCtx);
       return summaryFromAnalysisResult(result);
     });
@@ -524,7 +540,7 @@ export function createCallSummaryResolver(cache, lookupCallee) {
     // under §2.2's rule (or, when there is no path-shaped argument, as
     // edge-forming in its own right) — never dropped either way.
     if (summary?.degradedReason && ctx?.recordHop) {
-      for (const [, ids] of entryState) {
+      for (const [, ids] of boundState) {
         for (const id of ids) {
           ctx.recordHop({
             kind: 'production', subKind: 'call-resolved',