@clear-capabilities/agentic-security-scanner 0.195.8 → 0.195.10

package/src/language/haskell-guards.js

@@ -17,6 +17,9 @@
 // has the prefix. A weak guard is reported as a note on the finding and does not refute it.
 
 const CANON_CALLS = new Set(['System.Directory.canonicalizePath', 'System.Directory.makeAbsolute', 'System.FilePath.normalise']);
+import { HS_SANITIZERS } from './haskell-models.js';
+// the catalog's HTML escapers (blaze, lucid): the same list the taint catalog is generated from
+const CATALOG_HTML_ESCAPERS = new Set(HS_SANITIZERS.filter((s) => (s.appliesTo || []).includes('xss')).map((s) => `${s.module}.${s.name}`));
 const EXIT_CALLS = new Set(['Control.Exception.throwIO', 'Control.Exception.throw', 'System.Exit.die', 'System.Exit.exitFailure', 'System.Exit.exitWith', 'throwIO', 'throw', 'die', 'exitFailure', 'exitWith', 'error', 'fail', 'ioError', 'Control.Monad.Fail.fail']);
 const WHEN = new Set(['Control.Monad.when', 'when']);
 const UNLESS = new Set(['Control.Monad.unless', 'unless']);
@@ -336,10 +339,15 @@ export function judgeFinding(f, perFile) {
   const fam = FAMILY_BY_CWE[f.cwe];
   const ir = perFile && perFile[f.file];
   if (!fam || !ir || !f._funcQid || !f.callee) return { status: 'none' };
-  const fn = ir.functions.find((x) => x.qid === f._funcQid);
-  if (!fn) return { status: 'none' };
-  const sites = findSites(fn, f.callee, f.line);
-  if (!sites.length) return { status: 'none' };
+  // A finding found while analysing a CALLER (`_funcQid`) is located at the callee's line: the sink function is the one in the
+  // finding's file that has the call at that line (the caller first, then the others), the way haskell-trust.js locates it.
+  const direct = ir.functions.find((x) => x.qid === f._funcQid);
+  let fn = null; let sites = [];
+  for (const cand of [direct, ...ir.functions.filter((x) => x !== direct)].filter(Boolean)) {
+    const s = findSites(cand, f.callee, f.line);
+    if (s.length) { fn = cand; sites = s; break; }
+  }
+  if (!fn || !sites.length) return { status: 'none' };
   let weak = null;
   let first = null;
   for (const site of sites) {
@@ -354,7 +362,46 @@ export function judgeFinding(f, perFile) {
     const facts = [...site.facts, ...cfgBranchFacts(fn, site.nodeId), ...exitGuardFacts(fn, site.nodeId)];
     let refuted = null;
     if (fam === 'xss') {
-      const escapers = htmlEscapers(perFile);
+      // the project's own escapers plus the catalog's HTML escapers (blaze/lucid `toHtml`, `text`, ...): the taint walk records the latter on
+      // the path for the proof gate, but a sink argument built by a HELPER (`html (renderHtml (greeting name))`) is judged here, where the
+      // helper's body can be read: a helper that uses the parameter receiving the tainted value only under an escaper escapes it
+      const escapers = new Set([...htmlEscapers(perFile), ...CATALOG_HTML_ESCAPERS]);
+      const helperByName = (callee) => ir.functions.find((x) => x.name === callee || x.qid === callee || (x.qid || '').endsWith(`::${callee}`)) || null;
+      const paramEscaped = (helper, param, depth) => {
+        if (depth > 2) return false;
+        const under = (e, inEsc, d) => {
+          if (!e || typeof e !== 'object' || d > 40) return true;
+          if (e.kind === 'ident' && e.name === param) return inEsc;
+          if (e.kind === 'call' && typeof e.callee === 'string') {
+            if (escapers.has(e.callee)) return true;
+            const h = helperByName(e.callee);
+            if (h && Array.isArray(h.params)) {
+              // a nested helper: each argument that mentions the parameter must land on a parameter the nested helper escapes
+              return (e.args || []).every((a, i) => !identNames(a).has(param) || (h.params[i] && paramEscaped(h, h.params[i], depth + 1) && under(a, true, d + 1)));
+            }
+          }
+          for (const [, c] of exprChildren(e)) if (!under(c, inEsc, d + 1)) return false;
+          return true;
+        };
+        for (const n of nodeList(helper)) {
+          for (const k of ['source', 'value', 'cond']) if (n[k] && !under(n[k], false, 0)) return false;
+          if (Array.isArray(n.args)) for (const a of n.args) if (!under(a, false, 0)) return false;
+        }
+        return true;
+      };
+      const addHelperEscapers = (e, d) => {
+        if (!e || typeof e !== 'object' || d > 40) return;
+        if (e.kind === 'call' && typeof e.callee === 'string' && !escapers.has(e.callee)) {
+          const h = helperByName(e.callee);
+          if (h && Array.isArray(h.params) && (e.args || []).length) {
+            const taintedPositions = (e.args || []).map((a, i) => ([...identNames(a)].some((v) => vars.has(v) || derived.has(v)) ? i : -1)).filter((i) => i >= 0);
+            if (taintedPositions.length && taintedPositions.every((i) => h.params[i] && paramEscaped(h, h.params[i], 0))) escapers.add(e.callee);
+          }
+        }
+        for (const [, c] of exprChildren(e)) addHelperEscapers(c, d + 1);
+      };
+      addHelperEscapers(argExpr, 0);
+      for (const v of identNames(argExpr)) for (const n of nodeList(fn)) if (n.kind === 'assign' && n.target === v && n.source) addHelperEscapers(n.source, 0);
       const calls = [];
       const find = (e, d) => { if (!e || typeof e !== 'object' || d > 40) return; if (e.kind === 'call' && escapers.has(e.callee)) calls.push(e); for (const [, c] of exprChildren(e)) find(c, d + 1); };
       // the escaper may sit behind one or more local bindings (`page = ... path ...`, `path = escape (...)`): follow them, each once
@@ -507,6 +554,75 @@ export function waiHtmlContext(f, perFile) {
   return 'unknown';
 }
 
+// ── a request whose host is fixed ────────────────────────────────────────────
+// SSRF is the client choosing the HOST. A URL built as `fixedBase <> clientText` where the fixed part is a literal (or a constant bound to
+// one) that already names a scheme, a host and a "/" cannot reach another host: the client text lands in the path, query or fragment.
+// Likewise a request value built by http-conduit's modifiers (`setRequestQueryString q base`, `setRequestPath p base`, ...) over a fixed
+// base request keeps that base's host; the modifiers take the base as their LAST argument. A record update of such a value is judged by
+// its base unless it sets a field that names the host.
+const HOST_ANCHORED = /^[a-z][a-z0-9+.-]*:\/\/[^/@?#\s]+\/[^\s]*$/i;
+const REQUEST_BUILDERS = /(?:^|\.)(?:parseRequest|parseRequest_|parseUrlThrow|parseUrl|requestFromURI|requestFromURI_)$/;
+const REQUEST_MODIFIERS = /(?:^|\.)(?:setRequestQueryString|setRequestQuery|setQueryString|setRequestPath|setRequestBody|setRequestBodyLBS|setRequestBodyJSON|setRequestBodyURLEncoded|setRequestBodyFile|setRequestBodySource|setRequestHeader|setRequestHeaders|addRequestHeader|setRequestMethod|setRequestBasicAuth|setRequestBearerAuth|setRequestIgnoreStatus|setRequestResponseTimeout|setRequestCheckStatus|setRequestManager|urlEncodedBody|applyBasicAuth|applyBearerAuth)$/;
+const PEEL_WRAPPERS = /(?:^|\.)(?:liftIO|pure|return|unpack|pack|fromString|toStrict|fromStrict|encodeUtf8|decodeUtf8|toText|fromText)$/;
+const HOST_FIELD = /^(?:host|port|secure|url|uri|requestHost)$/i;
+
+function fixedHostRequest(f, perFile) {
+  if (!f || f.cwe !== 'CWE-918') return null;
+  const ir = perFile && perFile[f.file];
+  if (!ir || !f.callee) return null;
+  const direct = ir.functions.find((x) => x.qid === f._funcQid);
+  let fn = null; let sites = [];
+  for (const cand of [direct, ...ir.functions.filter((x) => x !== direct)].filter(Boolean)) {
+    const s = findSites(cand, f.callee, f.line);
+    if (s.length) { fn = cand; sites = s; break; }
+  }
+  if (!fn || !sites.length) return null;
+  const argIdx = Number.isInteger(f.argIndex) ? f.argIndex : 0;
+  // a local name bound once stands for its definition; a zero-parameter function of the module whose body is one literal is a constant
+  const localDef = (name) => { const defs = []; for (const n of nodeList(fn)) if (n.kind === 'assign' && n.target === name && n.source) defs.push(n.source); return defs.length === 1 ? defs[0] : null; };
+  const constDef = (name) => {
+    const bare = name.replace(/^.*\./, '');
+    const c = ir.functions.find((x) => (x.name === name || x.qid === name || (x.name || '').replace(/^.*\./, '') === bare) && (!Array.isArray(x.params) || x.params.length === 0));
+    if (!c) return null;
+    const rets = Object.values(c.cfg.nodes).filter((n) => n.kind === 'return' && n.value);
+    return rets.length === 1 ? rets[0].value : null;
+  };
+  let evidence = null;
+  const fixed = (e, seen, depth) => {
+    if (!e || typeof e !== 'object' || depth > 24) return false;
+    if (e.kind === 'literal') { const ok = typeof e.value === 'string' && HOST_ANCHORED.test(e.value); if (ok) evidence = e.value.replace(/^([a-z][a-z0-9+.-]*:\/\/[^/@?#\s]+\/).*$/i, '$1'); return ok; }
+    if (e.kind === 'ident') {
+      if (seen.has(e.name)) return false;
+      seen.add(e.name);
+      const d = localDef(e.name) || constDef(e.name);
+      return d ? fixed(d, seen, depth + 1) : false;
+    }
+    if (e.kind === 'union') return Array.isArray(e.branches) && e.branches.length > 0 && e.branches.every((b) => fixed(b, new Set(seen), depth + 1));
+    if (e.kind === 'object' && Array.isArray(e.props)) {
+      // a record update: `{ method = "POST" }` joined (as a union) with its base; a field that names the host makes it unknown
+      if (e.props.some((p) => HOST_FIELD.test(String(p.key || p.name || '')))) return false;
+      return e.object ? fixed(e.object, seen, depth + 1) : true;
+    }
+    if (e.kind === 'binary' && (e.op === '<>' || e.op === '++' || (e.hs && e.hs.concat))) return fixed(e.left, seen, depth + 1);
+    if (e.kind === 'call' && typeof e.callee === 'string') {
+      const args = e.args || [];
+      if (PEEL_WRAPPERS.test(e.callee) && args.length === 1) return fixed(args[0], seen, depth + 1);
+      if (REQUEST_BUILDERS.test(e.callee) && args.length >= 1) return fixed(args[args.length - 1], seen, depth + 1);
+      if (REQUEST_MODIFIERS.test(e.callee) && args.length >= 1) return fixed(args[args.length - 1], seen, depth + 1);
+      if (/(?:^|\.)(?:<\/>|combine|joinPath)$/.test(e.callee) && args.length === 2) return fixed(args[0], seen, depth + 1);
+    }
+    return false;
+  };
+  for (const site of sites) {
+    const arg = (site.call.args || [])[argIdx];
+    if (!arg) return null;
+    // a record update is a union of the base and the update: a union judged branch by branch above; an `object` branch with no base is the
+    // update alone, which is fixed when it names no host field, so the base branch decides
+    if (!fixed(arg, new Set(), 0)) return null;
+  }
+  return { kind: 'fixed-host-request', base: evidence };
+}
+
 export function applyHaskellGuards(findings, perFile) {
   const stats = { refuted: 0, weak: 0 };
   for (const f of findings || []) {
@@ -522,6 +638,16 @@ export function applyHaskellGuards(findings, perFile) {
       }
       if (ctx === 'unknown' && !f._htmlContextUnknown) { f._htmlContextUnknown = true; f.uncertainty = [...(f.uncertainty || []), { kind: 'unread-content-type', detail: 'the response headers at this call are not literal text, so whether the body is served as HTML was not read' }]; }
     } catch { /* judged below */ }
+    try {
+      const fh = fixedHostRequest(f, perFile);
+      if (fh && !f._fixedHost) {
+        f._fixedHost = true; f.severity = 'info';
+        f.controls = [...(f.controls || []), { kind: 'fixed-host-request', evidenceKind: 'source' }];
+        f.guardNote = { kind: 'fixed-host-request', reason: `the request's host is fixed by the literal${fh.base ? ` "${fh.base}"` : ''} the URL or base request starts from; the client's text can only choose the path, query or fragment, which is not a server-side request forgery (a path it chooses on that host is still worth a look)` };
+        stats.weak++;
+        continue;
+      }
+    } catch { /* judged below */ }
     try { promoteShellInterpreter(f, perFile); } catch { /* judged as an argument-injection below */ }
     try {
       const qp = quotedPositionals(f, perFile);

package/src/language/haskell-ir.js

@@ -148,14 +148,20 @@ function servantEndpointParams(mod, fn, sig, exported) {
   };
   const body = slice.slice(eq + 1);
   if (split(body, ':<|>').filter((p) => p.length).length !== 1) return [];
+  const parts = split(body, ':>').filter((p) => p.length);
+  // The endpoint's values are the LAST parameters of the handler: `orderServer conn ref` for `QueryParam "ref" Text` takes `conn` from the
+  // closure. Pair from the end (the same rule haskell-web.js applies); a handler with fewer parameters than the API names is not paired.
+  const reads = parts.filter((p) => p[0] && p[0].t === 'con' && (SERVANT_PRINCIPAL.has(p[0].v) || SERVANT_READS.has(p[0].v))).length;
+  const offset = fn.params.length - reads;
+  if (offset < 0) return [];
   const out = [];
   let idx = 0;
-  for (const part of split(body, ':>').filter((p) => p.length)) {
+  for (const part of parts) {
     const head = part[0];
     if (!head || head.t !== 'con') continue;
     const isPrincipal = SERVANT_PRINCIPAL.has(head.v);
     if (!isPrincipal && !SERVANT_READS.has(head.v)) continue;
-    const name = fn.params[idx];
+    const name = fn.params[offset + idx];
     idx++;
     if (isPrincipal || !name) continue;
     // the carried type is what follows the name string (or the content-type list for a body): its text decides whether it is text
@@ -163,7 +169,7 @@ function servantEndpointParams(mod, fn, sig, exported) {
     let rest = part.slice(lastStr >= 0 ? lastStr + 1 : 1);
     if (/^ReqBody/.test(head.v)) { const close = rest.findIndex((t) => t.t === 'sp' && t.v === ']'); rest = close >= 0 ? rest.slice(close + 1) : rest; }
     const type = rest.map((t) => t.v).join(' ').trim();
-    if (type && TEXT_LIKE.test(type.replace(/^\[\s*(.*)\s*\]$/, '[ $1 ]').replace(/\s+/g, ' '))) out.push({ index: idx - 1, name, decorator: 'hs:handler-param:servant' });
+    if (type && TEXT_LIKE.test(type.replace(/^\[\s*(.*)\s*\]$/, '[ $1 ]').replace(/\s+/g, ' '))) out.push({ index: offset + idx - 1, name, decorator: 'hs:handler-param:servant' });
   }
   return out;
 }

package/src/language/haskell-models.js

@@ -380,6 +380,8 @@ export const HS_LOG_SINKS = Object.freeze([
   ...E('Text.Printf', ['hPrintf']).map((e) => ({ ...e, argIndex: 1, argFrom: 1, channel: 'handle' })),
   ...E('Katip', ['logFM', 'logTM', 'logItem']).map((e) => ({ ...e, argIndex: 1, channel: 'logger' })),
   ...E('System.Log.Logger', ['debugM', 'infoM', 'noticeM', 'warningM', 'errorM', 'criticalM']).map((e) => ({ ...e, argIndex: 1, channel: 'logger' })),
+  // fast-logger: the logger set is argument 0, the message argument 1
+  ...E('System.Log.FastLogger', ['pushLogStr', 'pushLogStrLn']).map((e) => ({ ...e, argIndex: 1, channel: 'logger' })),
 ]);
 
 // Library surfaces the structural rules (haskell-security-rules.js) look for; registering them here makes
@@ -393,6 +395,9 @@ export const HS_RULE_APIS = Object.freeze([
   ...E('Crypto.Cipher.ChaChaPoly1305', ['nonce12', 'nonce8']),
   ...E('Crypto.KDF.PBKDF2', ['generate', 'fastPBKDF2_SHA1', 'fastPBKDF2_SHA256', 'fastPBKDF2_SHA512']),
   ...E('System.Random', ['randomRIO', 'randomIO', 'newStdGen', 'getStdGen', 'mkStdGen', 'randomR', 'random', 'randoms', 'randomRs', 'getStdRandom', 'uniformR', 'uniform', 'initStdGen']),
+  // mwc-random and splitmix are statistical generators, not CSPRNGs (createSystemRandom only seeds from the OS)
+  ...E('System.Random.MWC', ['uniformR', 'uniform', 'uniformRM', 'uniformM', 'createSystemRandom', 'create', 'initialize', 'withSystemRandom', 'withSystemRandomST']),
+  ...E('System.Random.SplitMix', ['nextWord64', 'nextInt', 'nextDouble', 'mkSMGen', 'newSMGen', 'initSMGen']),
   ...E('Crypto.Random', ['getRandomBytes']), ...E('System.Entropy', ['getEntropy']),
   ...E('Network.Wai', ['strictRequestBody', 'lazyRequestBody']),
   ...E('Data.Time.Clock.POSIX', ['getPOSIXTime']), ...E('Data.Time.Clock', ['getCurrentTime']), ...E('System.CPUTime', ['getCPUTime']),

package/src/language/haskell-security-rules.js

@@ -53,7 +53,11 @@ const ANY_HASH_CALLS = new Set([...WEAK_HASH_CALLS, 'Crypto.Hash.hash', 'Crypto.
 const WEAK_CIPHER_MODULES = new Set(['Crypto.Cipher.DES', 'Crypto.Cipher.RC4', 'Crypto.Cipher.RC2', 'Crypto.Cipher.Blowfish']);
 const ECB_CALLS = new Set(['Crypto.Cipher.Types.ecbEncrypt', 'Crypto.Cipher.Types.ecbDecrypt']);
 const IV_CALLS = new Set(['Crypto.Cipher.Types.makeIV', 'Crypto.Cipher.ChaChaPoly1305.nonce12', 'Crypto.Cipher.ChaChaPoly1305.nonce8']);
-const RANDOM_CALLS = new Set(['System.Random.randomRIO', 'System.Random.randomIO', 'System.Random.newStdGen', 'System.Random.getStdGen', 'System.Random.mkStdGen', 'System.Random.randomR', 'System.Random.random', 'System.Random.randoms', 'System.Random.randomRs', 'System.Random.getStdRandom', 'System.Random.uniformR', 'System.Random.uniform', 'System.Random.initStdGen']);
+const RANDOM_CALLS = new Set(['System.Random.randomRIO', 'System.Random.randomIO', 'System.Random.newStdGen', 'System.Random.getStdGen', 'System.Random.mkStdGen', 'System.Random.randomR', 'System.Random.random', 'System.Random.randoms', 'System.Random.randomRs', 'System.Random.getStdRandom', 'System.Random.uniformR', 'System.Random.uniform', 'System.Random.initStdGen',
+  // mwc-random is a statistical generator (multiply-with-carry); `createSystemRandom` only seeds it from the OS, its output is not a CSPRNG
+  'System.Random.MWC.uniformR', 'System.Random.MWC.uniform', 'System.Random.MWC.uniformRM', 'System.Random.MWC.uniformM', 'System.Random.MWC.createSystemRandom', 'System.Random.MWC.create', 'System.Random.MWC.initialize', 'System.Random.MWC.withSystemRandom', 'System.Random.MWC.withSystemRandomST',
+  // splitmix is the pure generator behind random
+  'System.Random.SplitMix.nextWord64', 'System.Random.SplitMix.nextInt', 'System.Random.SplitMix.nextDouble', 'System.Random.SplitMix.mkSMGen', 'System.Random.SplitMix.newSMGen', 'System.Random.SplitMix.initSMGen']);
 const BODY_CALLS = new Set(['Network.Wai.strictRequestBody', 'Network.Wai.lazyRequestBody', 'Web.Scotty.body', 'Web.Scotty.Trans.body', 'Network.Wai.Conduit.sourceRequestBody']);
 const SOCKET_READS = new Set(['Network.Socket.ByteString.recv', 'Network.Socket.ByteString.recvFrom', 'Network.Socket.ByteString.Lazy.recv']);
 const SET_COOKIE_HEADER = new Set(['Network.HTTP.Types.Header.hSetCookie', 'Network.HTTP.Types.hSetCookie']);
@@ -71,7 +75,8 @@ const isTrueLit = (e) => !!e && ((e.kind === 'literal' && /^true$/i.test(String(
 const TIME_SOURCES = new Set(['Data.Time.Clock.POSIX.getPOSIXTime', 'Data.Time.Clock.getCurrentTime', 'System.CPUTime.getCPUTime']);
 // A salt is deliberately absent: it must be unique, not unpredictable or secret (it is stored beside the hash), so a non-cryptographic generator
 // producing one is not a weakness the way it is for a token, nonce or key.
-const SECURITY_FN_SUBSTR = /(?:token|nonce|secret|otp|csrf|session|apikey|resetcode|passcode|verification)/i;
+// (`newKey`, `generateApiKey`, `mkKey`: a function that MAKES a key is security-shaped; `key` alone is not, it names map keys too)
+const SECURITY_FN_SUBSTR = /(?:token|nonce|secret|otp|csrf|session|apikey|resetcode|passcode|verification|(?:new|gen|generate|make|mk|create|issue|mint|fresh)_?(?:api_?)?key)/i;
 // Short credential words that would over-match as substrings (`spin`, `mapping`, `keyboard`): matched as whole camelCase / snake_case words.
 const SECURITY_WORDS = new Set(['pin', 'password', 'passwd', 'credential', 'credentials']);
 const SECURITY_FN = { test: (name) => SECURITY_FN_SUBSTR.test(name) || String(name).replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase().split(/[^a-z0-9]+/).some((w) => SECURITY_WORDS.has(w)) };
@@ -102,8 +107,64 @@ const SESSION_COOKIE = /(?:sess|sid|token|tok|auth|jwt|csrf|login|remember|secre
 const SECURITY_VAR = /^(?:.*(?:token|secret|nonce|otp|csrf|apikey|api_?key|sessionid|session_?key|sessiontoken|resettoken)[a-z0-9_']*|key|iv|sessionId|sid)$/i;
 const PASSWORD_VAR = /(?:^|[^a-z])(?:pass(?:word|wd|phrase)?|pwd|pw)(?:[^a-z]|$)|password/i;
 const LOW_ENTROPY = /(?:pass(?:word|wd|phrase)?|pwd|ssn|creditcard|cardnumber|cvv|\bpin\b)/i;
+// a variable whose name says it holds the HASH of a credential (`hashedPassword`, `passwordHash`, `tokenDigest`): the stored form, not the secret
+const HASH_NAMED = /(?:hash|digest)/i;
+// Every use of the identifier `n` inside `arg` is as the object of a member access whose field is not credential-shaped (`attemptUser attempt`).
+function usedOnlyAsNonSensitiveField(arg, n) {
+  let uses = 0; let fields = 0;
+  const visit = (e, parent, d) => {
+    if (!e || typeof e !== 'object' || d > 40) return;
+    if (e.kind === 'ident' && e.name === n) {
+      uses++;
+      if (parent && parent.kind === 'member' && parent.object === e && typeof parent.prop === 'string' && !SENSITIVE.test(parent.prop)) fields++;
+      return;
+    }
+    for (const k of Object.keys(e)) {
+      if (k === 'hs') continue;
+      const v = e[k];
+      if (Array.isArray(v)) { for (const x of v) visit(x, e, d + 1); } else if (v && typeof v === 'object') visit(v, e, d + 1);
+    }
+  };
+  visit(arg, null, 0);
+  return uses > 0 && uses === fields;
+}
+// a value that is a one-time code only in context: `code` is a security value where the function talks about a reset, a verification, an OTP
+const CONTEXT_CODE_VAR = /^(?:code|pin|passcode|otp)$/i;
+const CODE_CONTEXT = /reset|verif|otp|one.?time|activation|confirm|2fa|mfa|two.?factor/i;
+// A project function of this file whose every return value is a comparison, a conjunction or a boolean predicate (after `pure`/`return`).
+function returnsYesNo(fir, callee) {
+  const fn = (fir.functions || []).find((x) => x.name === callee || x.qid === callee || (x.qid || '').endsWith(`::${callee}`));
+  if (!fn) return false;
+  const rets = Object.values(fn.cfg.nodes).filter((n) => n.kind === 'return' && n.value);
+  if (!rets.length) return false;
+  return rets.every((n) => {
+    let e = n.value;
+    for (let i = 0; i < 6 && e && e.kind === 'call' && typeof e.callee === 'string' && /(?:^|\.)(?:pure|return|liftIO)$/.test(e.callee) && (e.args || []).length === 1; i++) e = e.args[0];
+    if (!e) return false;
+    if (e.kind === 'binary' && ['==', '/=', '!=', '&&', '||', '<', '>', '<=', '>='].includes(e.op)) return true;
+    if (e.kind === 'logical') return true;
+    if (e.kind === 'literal' && typeof e.value === 'boolean') return true;
+    return e.kind === 'call' && typeof e.callee === 'string' && /(?:^|\.)(?:not|elem|notElem|null|isJust|isNothing|any|all|and|or)$/.test(e.callee);
+  });
+}
+
+function fnMentions(fn, re) {
+  for (const n of Object.values(fn.cfg.nodes)) {
+    for (const k of ['source', 'value', 'cond']) {
+      if (!n[k]) continue;
+      for (const x of walk(n[k])) {
+        if (x.kind === 'literal' && typeof x.value === 'string' && re.test(x.value)) return true;
+        if (x.kind === 'call' && typeof x.callee === 'string' && re.test(x.callee)) return true;
+      }
+    }
+    if (n.kind === 'call' && typeof n.callee === 'string' && re.test(n.callee)) return true;
+    if (Array.isArray(n.args)) for (const a of n.args) for (const x of walk(a)) if (x.kind === 'literal' && typeof x.value === 'string' && re.test(x.value)) return true;
+  }
+  return false;
+}
 export const SENSITIVE = /(?:pass(?:word|wd|phrase)?|pwd|(?:^|[^a-z])pw(?:[^a-z]|$)|secret|token|api_?key|ssn|credit_?card|card_?number|cvv|authorization|bearer|private_?key|session_?id)/i;
-const REDACTOR = /(?:^|\.)(?:redact|mask|scrub|obfuscate|anonymi[sz]e|censor|length|null)$|(?:^|\.)(?:redact|mask|scrub|obfuscate|anonymi[sz]e|censor)/i;
+// (a helper that keeps only a few characters of the value, `lastFour`, `last4`, `fingerprint`, `takeEnd`, is a masking helper by its name too)
+const REDACTOR = /(?:^|\.)(?:redact|mask|scrub|obfuscate|anonymi[sz]e|censor|length|null|takeEnd|fingerprint|abbreviate|truncate)$|(?:^|\.)(?:redact|mask|scrub|obfuscate|anonymi[sz]e|censor|last(?:four|4|digits|chars)|fingerprint)/i;
 
 const kids = (e) => {
   const out = [];
@@ -115,6 +176,19 @@ const kids = (e) => {
   return out;
 };
 
+// Marks every node under an inlined helper's root with the helper's qid (`hs.inlineCtx`); idempotent, so a cached IR is marked once.
+function markInlined(e, ctx, depth) {
+  if (!e || typeof e !== 'object' || depth > 60) return;
+  const here = (e.hs && e.hs.inlinedFrom) || ctx;
+  if (here && !(e.hs && e.hs.inlineCtx)) e.hs = { ...(e.hs || {}), inlineCtx: here };
+  for (const k of Object.keys(e)) {
+    if (k === 'hs') continue;
+    const v = e[k];
+    if (Array.isArray(v)) { for (const x of v) markInlined(x, here, depth + 1); }
+    else if (v && typeof v === 'object') markInlined(v, here, depth + 1);
+  }
+}
+
 function* walk(e, depth = 0) {
   if (!e || typeof e !== 'object' || depth > 80) return;
   yield e;
@@ -257,6 +331,44 @@ function weakDigestUse(fn, node, hashCall, hashArgs, fnBase) {
   return reasons;
 }
 
+/**
+ * The migration shape: a fast password hash kept ONLY to verify hashes stored before a password KDF was introduced. True when every
+ * use of the function, in every file, is an operand of an equality (nothing new is stored with it) and a function that compares with
+ * it also computes a password KDF, directly or through one project function (`verify stored salt pw = if legacy stored then stored ==
+ * oldHash salt pw else stored == kdfHash salt pw`). The weak hash is still computed, so the finding is kept at `info` with this reason;
+ * a function that is also used to STORE a hash, or whose comparisons sit beside no KDF, is the full finding. Decided from the IR only,
+ * never from a name (`hashPasswordLegacy` is not evidence; the comparison and the KDF are).
+ */
+function legacyVerifierOnly(fn, ir, memo) {
+  if (memo.has(fn.qid)) return memo.get(fn.qid);
+  const allFns = Object.values(ir.perFile).flatMap((x) => x.functions || []);
+  const byQid = new Map(allFns.map((x) => [x.qid, x]));
+  const usesF = (e) => !!e.hs && ((e.kind === 'call' && e.hs.target === fn.qid) || e.hs.inlinedFrom === fn.qid);
+  const kdfCall = (c) => typeof c === 'string' && (STRONG_KDF.test(c) || PBKDF2_CALLS.has(c));
+  const hasKdf = (g, depth) => (g.calls || []).some((c) => kdfCall(c.callee) || (depth < 1 && c.hs && c.hs.target && c.hs.target !== g.qid && byQid.has(c.hs.target) && hasKdf(byQid.get(c.hs.target), depth + 1)));
+  let uses = 0; let compared = 0; let besideKdf = false;
+  const visit = (e, parent, g, depth) => {
+    if (!e || typeof e !== 'object' || depth > 60) return;
+    if (usesF(e)) {
+      uses++;
+      if (parent && parent.kind === 'binary' && EQUALITY_OPS.has(parent.op)) { compared++; if (hasKdf(g, 0)) besideKdf = true; }
+      return;     // under an inlined root the nodes are the helper's own body, not further uses of it
+    }
+    for (const k of Object.keys(e)) {
+      if (k === 'hs') continue;
+      const v = e[k];
+      if (Array.isArray(v)) { for (const x of v) visit(x, e, g, depth + 1); } else if (v && typeof v === 'object') visit(v, e, g, depth + 1);
+    }
+  };
+  for (const g of allFns) {
+    if (g.qid === fn.qid) continue;
+    for (const n of Object.values(g.cfg.nodes)) for (const root of [n.source, n.value, n.cond, ...(n.args || [])]) visit(root, null, g, 0);
+  }
+  const r = uses > 0 && compared === uses && besideKdf;
+  memo.set(fn.qid, r);
+  return r;
+}
+
 /**
  * @param {Record<string,string>} files path -> source (only Haskell files are read)
  * @param {object} [opts]
@@ -279,11 +391,14 @@ export function analyzeHaskellRules(files, opts = {}) {
     if (/import\s+(?:qualified\s+)?Network\.Wai\.Middleware\.RequestSizeLimit\b/.test(text) || /\brequestSizeLimitMiddleware\b/.test(text)) { requestLimit = { file, line: (text.split('\n').findIndex((l) => /RequestSizeLimit|requestSizeLimitMiddleware/.test(l)) + 1) || 1 }; break; }
   }
 
+  let currentFn = null;
+  const legacyMemo = new Map();
   const emit = (rule, file, line, extra = {}) => {
     const r = RULES[rule];
     const sev = extra.severity || r.severity;
     const f = {
       id: `hs-rule:${rule}:${file}:${line}`, severity: sev, file, line, vuln: extra.vuln || r.vuln, cwe: r.cwe,
+      _fnQid: currentFn ? currentFn.qid : null, ...(extra.inlineCtx ? { inlineCtx: extra.inlineCtx } : {}),
       description: `${extra.vuln || r.vuln}${extra.detail ? `: ${extra.detail}` : ''}`,
       remediation: r.remediation, parser: 'HS-RULES', family: r.family,
       language: 'haskell', capability: 'sast', analysisKind: 'application', evidenceKind: 'source',
@@ -306,6 +421,14 @@ export function analyzeHaskellRules(files, opts = {}) {
       }
     }
     for (const fn of fir.functions) {
+      currentFn = fn;
+      // A project helper the IR inlined at its call site (`digestFor (credPassword creds)` becomes the helper's body, rooted at a node with
+      // `hs.inlinedFrom`) is walked here as well as in the helper itself. Every node under such a root is marked with the helper's qid, so
+      // a rule that reports the same thing inside the helper can drop the call-site copy (the filter before the return).
+      for (const n of Object.values(fn.cfg.nodes)) {
+        for (const k of ['source', 'value', 'cond']) if (n[k]) markInlined(n[k], null, 0);
+        if (Array.isArray(n.args)) for (const a of n.args) markInlined(a, null, 0);
+      }
       if (fn.name.endsWith('.<module>')) continue;
       const bound = new Map();   // target var -> {callee, line}
       const sensitive = new Map(); // var -> {class:'low'|'high', hashed:boolean, line}
@@ -422,9 +545,13 @@ export function analyzeHaskellRules(files, opts = {}) {
               if (INPUT_READS.has(e.name) && !bounded && readsOutsideInput(fn, e.name, [], importsNetwork)) emit('hs-unbounded-input-read', file, node.line, { detail: `${e.name} reads everything`, confidence: 0.6 });
               continue;
             }
-            // a Set-Cookie header written by hand: `(hSetCookie, "session_id=" <> sid <> "; Path=/")`
-            if (e.kind === 'array' && e.hs && e.hs.tuple && e.elements.length === 2) {
-              const [k, v] = e.elements;
+            // a Set-Cookie header written by hand: `(hSetCookie, "session_id=" <> sid <> "; Path=/")`, or handed to a framework's header
+            // setter: Scotty `setHeader "Set-Cookie" ("session=" <> tok <> "; Path=/")`, Spock `setHeader`, Yesod `addHeader`
+            let cookiePair = null;
+            if (e.kind === 'array' && e.hs && e.hs.tuple && e.elements.length === 2) cookiePair = e.elements;
+            else if (e.kind === 'call' && typeof e.callee === 'string' && /(?:^|\.)(?:setHeader|addHeader|setResponseHeader|modifyHeader)$/.test(e.callee) && (e.args || []).length >= 2) cookiePair = [e.args[0], e.args[1]];
+            if (cookiePair) {
+              const [k, v] = cookiePair;
               const isSetCookie = k && ((k.kind === 'ident' && SET_COOKIE_HEADER.has(k.name)) || (k.kind === 'literal' && /^set-cookie$/i.test(String(k.value))) || (k.kind === 'call' && /(?:^|\.)(?:pack|fromString)$/.test(k.callee || '') && k.args && k.args[0] && k.args[0].kind === 'literal' && /^set-cookie$/i.test(String(k.args[0].value))));
               if (isSetCookie && v) {
                 const text = literalTextOf(v);
@@ -477,7 +604,10 @@ export function analyzeHaskellRules(files, opts = {}) {
             // scotty-cookie's helpers build a cookie that carries neither Secure nor HttpOnly
             if ((c === 'Web.Scotty.Cookie.setSimpleCookie' || c === 'Web.Scotty.Cookie.makeSimpleCookie') && args[0]) {
               const nm = args[0];
-              if (nm.kind !== 'literal' || SESSION_COOKIE.test(String(nm.value))) emit('hs-insecure-cookie', file, line, { detail: 'HttpOnly missing, Secure missing', evidence: { httpOnly: false, secure: false, helper: c } });
+              // A name that is a PARAMETER of this function is decided by the caller: the function is itself a cookie helper
+              // (scotty's own `setSimpleCookie n v`, `deleteCookie c`), and the call that passes a session name is the site to report.
+              const ownParam = nm.kind === 'ident' && Array.isArray(fn.params) && fn.params.includes(nm.name);
+              if (!ownParam && (nm.kind !== 'literal' || SESSION_COOKIE.test(String(nm.value)))) emit('hs-insecure-cookie', file, line, { detail: 'HttpOnly missing, Secure missing', evidence: { httpOnly: false, secure: false, helper: c } });
             }
             // a socket read repeated by a recursive loop, with no size test anywhere in it
             if (SOCKET_READS.has(c) && !hasSizeTest && !bounded && fn.calls.some((x) => x.callee === fn.name && x.hs && x.hs.target === fn.qid)) {
@@ -502,8 +632,13 @@ export function analyzeHaskellRules(files, opts = {}) {
               }
             }
             // password hashed with a fast hash
-            if (ANY_HASH_CALLS.has(c) && !STRONG_KDF.test(c) && args.some((a) => [...names(a)].some((n) => PASSWORD_VAR.test(n.replace(/^\./, ''))))) {
-              emit('hs-fast-password-hash', file, line, { detail: `${c} applied to a password-shaped value` });
+            // (a hash call the IR inlined from a project helper, `digestFor (credPassword creds)` at the comparison, is reported once, in the helper)
+            if (ANY_HASH_CALLS.has(c) && !STRONG_KDF.test(c) && !(e.hs && e.hs.inlinedFrom) && args.some((a) => [...names(a)].some((n) => PASSWORD_VAR.test(n.replace(/^\./, ''))))) {
+              if (!(e.hs && e.hs.inlineCtx) && legacyVerifierOnly(fn, ir, legacyMemo)) {
+                emit('hs-fast-password-hash', file, line, { severity: 'info', confidence: 0.5, detail: `${c} applied to a password-shaped value, in a function used only to verify hashes made before a migration (every use of it is an equality, beside a password KDF): re-hash with the KDF at the next successful login and remove it once no stored hash needs it`, inlineCtx: e.hs && e.hs.inlineCtx, evidence: { legacyVerifier: true } });
+              } else {
+                emit('hs-fast-password-hash', file, line, { detail: `${c} applied to a password-shaped value`, inlineCtx: e.hs && e.hs.inlineCtx });
+              }
             }
             if (PBKDF2_CALLS.has(c)) {
               for (const a of args) for (const x of walk(a)) if (x.kind === 'object') for (const p of x.props || []) if (p.key === 'iterCounts' && p.value && p.value.kind === 'literal' && typeof p.value.value === 'number' && p.value.value < 10000) {
@@ -514,7 +649,7 @@ export function analyzeHaskellRules(files, opts = {}) {
             if (ECB_CALLS.has(c)) emit('hs-ecb-mode', file, line, { detail: c });
             if (IV_CALLS.has(c) && args[0] && isLiteralLike(args[0])) emit('hs-static-iv', file, line, { detail: `${c} of a constant value` });
             // randomness bound to a security-shaped name
-            if (RANDOM_CALLS.has(c) && node.kind === 'assign' && SECURITY_VAR.test(node.target || '')) {
+            if (RANDOM_CALLS.has(c) && node.kind === 'assign' && (SECURITY_VAR.test(node.target || '') || (CONTEXT_CODE_VAR.test(node.target || '') && fnMentions(fn, CODE_CONTEXT)))) {
               emitRandom(line, { detail: `${c} result bound to \`${node.target}\``, evidence: { binding: node.target } });
             }
             if (RANDOM_CALLS.has(c) && SECURITY_FN.test(fnBase) && node.kind !== 'assign') {
@@ -562,6 +697,14 @@ export function analyzeHaskellRules(files, opts = {}) {
           for (const n of srcNames) if (sensitive.has(n)) { const s = sensitive.get(n); cls = { name: s.name, low: s.low }; hashed = hashed || s.hashed; }
           if (cls) {
             let cleared = false;
+            // a yes/no answer about the credential (`accepted <- checkCredentials attempt`, a comparison, a conjunction) carries no credential text
+            let root = src; for (let i = 0; i < 6 && root && root.kind === 'call' && typeof root.callee === 'string' && /(?:^|\.)(?:liftIO|pure|return|lift)$/.test(root.callee) && (root.args || []).length === 1; i++) root = root.args[0];
+            if (root && ((root.kind === 'binary' && ['==', '/=', '!=', '&&', '||', '<', '>', '<=', '>='].includes(root.op)) || root.kind === 'logical')) cleared = true;
+            // the binding says it holds a hash or digest (`hashedPassword <- hashPassword plain`): the stored form, whatever made it
+            if (HASH_NAMED.test(node.target || '')) cleared = true;
+            if (root && root.kind === 'call' && typeof root.callee === 'string' && /(?:^|\.)(?:not|elem|notElem|null|isJust|isNothing|any|all|and|or)$/.test(root.callee)) cleared = true;
+            // a project helper whose every return is such an answer (`checkCredentials a = pure (user a == "x" && password a == "y")`)
+            if (root && root.kind === 'call' && typeof root.callee === 'string' && returnsYesNo(fir, root.callee)) cleared = true;
             for (const x of walk(src)) {
               if (x.kind !== 'call' || typeof x.callee !== 'string') continue;
               if (REDACTOR.test(x.callee)) cleared = true;
@@ -600,13 +743,19 @@ export function analyzeHaskellRules(files, opts = {}) {
               for (const n of names(arg)) {
                 if (hit) break;
                 const bare = n.replace(/^\./, '');
-                if (sensitive.has(n)) hit = { ...sensitive.get(n), var: n };
-                else if (SENSITIVE.test(bare) && !/^[A-Z][A-Za-z0-9_.]*\./.test(n)) hit = { name: bare, low: LOW_ENTROPY.test(bare), hashed: false, var: n };
+                // a value built from a credential (`attempt = Attempt user password`) logged through a field that is not the credential
+                // (`attemptUser attempt`, lowered to a member of `attempt`) is that field, not the secret
+                if (sensitive.has(n) && !usedOnlyAsNonSensitiveField(arg, n)) hit = { ...sensitive.get(n), var: n };
+                // a name that says it holds a hash or digest of the credential (`hashedPassword`, `tokenDigest`) is the stored form, not the secret
+                else if (SENSITIVE.test(bare) && !/^[A-Z][A-Za-z0-9_.]*\./.test(n) && !HASH_NAMED.test(bare)) hit = { name: bare, low: LOW_ENTROPY.test(bare), hashed: false, var: n };
+                // the record itself, logged whole (`show attempt`), when one of its fields was built from a credential (`attempt.attemptPassword`)
+                else if (!sensitive.has(n)) { const field = [...sensitive.keys()].find((k) => k.startsWith(`${n}.`)); if (field && !usedOnlyAsNonSensitiveField(arg, n)) hit = { ...sensitive.get(field), name: field, var: n }; }
                 if (hit) break;
               }
               if (!hit) { const rec = wholeRecord(arg); if (rec) hit = { name: `${rec.type}.${rec.field}`, low: LOW_ENTROPY.test(rec.field), hashed: false, var: rec.name }; }
               if (hit && !isRedacted(arg)) {
                 emit('hs-sensitive-logging', file, e.line || node.line, {
+                  inlineCtx: e.hs && e.hs.inlineCtx,
                   severity: hit.hashed ? 'low' : 'high',
                   detail: hit.hashed ? `a fast hash of low-entropy \`${hit.name}\` reaches ${e.callee}` : `\`${hit.name}\` reaches ${e.callee}`,
                   evidence: { value: hit.name, via: hit.var, channel: sink.channel, hashed: hit.hashed },
@@ -639,5 +788,16 @@ export function analyzeHaskellRules(files, opts = {}) {
   const out = [];
   for (const f of findings) { if (seen.has(f.id)) continue; seen.add(f.id); out.push(f); }
   void notes; void opts;
-  return { findings: out, controls, notes };
+  // A call-site copy of a finding the helper itself reports (the helper's body was inlined at the call) is dropped; a call-site finding
+  // whose helper reports nothing (the password shape is visible only at the call) is kept.
+  // The kept finding lists the call sites it also covers (`alsoAt`), so a reviewer still sees every line of the one weakness.
+  const byKey = new Map(out.map((f) => [`${f.rule}|${f.file}|${f._fnQid}`, f]));
+  const deduped = out.filter((f) => {
+    const helper = f.inlineCtx && f._fnQid !== f.inlineCtx ? byKey.get(`${f.rule}|${f.file}|${f.inlineCtx}`) : null;
+    if (!helper) return true;
+    helper.alsoAt = [...(helper.alsoAt || []), { line: f.line, reason: 'the same helper inlined at this call' }];
+    return false;
+  });
+  for (const f of deduped) delete f._fnQid;
+  return { findings: deduped, controls, notes };
 }

package/src/language/haskell-trust.js

@@ -10,7 +10,11 @@
 //                         is lowered to `info`, never dropped
 //   api-contract          the value is a parameter of an exported function that nothing in the analysed code calls, and the function
 //                         hands it WHOLE (or as the root it appends fixed text to) to a path or command operation: a thin wrapper.
-//                         The caller chose what to read or run, and the wrapper has no fixed part to escape from. Lowered to `info`
+//                         The caller chose what to read or run, and the wrapper has no fixed part to escape from. Lowered to `info`.
+//                         Path operations joined this way since 0.195.9: `renderFile path = responseFile .. path` and
+//                         `store path = readFile (cs path)` were 2 of the 29 flagged path sites on the real-code sets and no true
+//                         positive had that shape; a parameter spliced UNDER a fixed directory (`"/srv/" ++ name`) is still kept,
+//                         because the function chose the directory and lets the caller leave it
 //   entry-parameter       a parameter of such a function used inside a larger value the function builds: its own construction, kept
 //   data-input            standard input or a file's content in a service or a library: data the program processes, kept
 //   unattributed          the engine recorded no origin: kept
@@ -30,10 +34,13 @@ const EXTERNAL = new Set(['http-body', 'url-param', 'path-param', 'header', 'coo
 const DATA = new Set(['stdin', 'file-read']);
 const WEAK_PARAM_LABEL = /\(caller-controlled\)$/;
 // CWE-918 is deliberately NOT a wrapper family: `fetch url = parseRequest url >>= httpNoBody` is pinned as a finding in
-// test/haskell/haskell-generalization.test.js (a URL the caller chooses is the SSRF shape of the development sets), the same way path
-// wrappers are kept. unseen-v4 labels that shape safe when the URL is configuration; that disagreement is recorded, not decided here.
-const WRAPPER_FAMILIES = new Set(['CWE-78', 'CWE-88']);
-const CONVERSIONS = /(?:^|\.)(?:pack|unpack|fromString|toString|show|encodeUtf8|decodeUtf8|toStrict|fromStrict|toText|unpackFS|fromText)$/;
+// test/haskell/haskell-generalization.test.js (a URL the caller chooses is the SSRF shape of the development sets). unseen-v4 labels
+// that shape safe when the URL is configuration; that disagreement is recorded, not decided here. CWE-22 joined the set in 0.195.9
+// (see the header): the synthetic development sets label `load name = readFile name` vulnerable, the real-code sets label every such
+// site a false positive, and the real code won; a parameter under a fixed directory is still `entry-parameter`.
+const WRAPPER_FAMILIES = new Set(['CWE-78', 'CWE-88', 'CWE-22']);
+// `cs`/`convertString` (string-conversions) and `toS` (protolude) change the type of a text value and nothing else
+const CONVERSIONS = /(?:^|\.)(?:pack|unpack|fromString|toString|show|encodeUtf8|decodeUtf8|toStrict|fromStrict|toText|unpackFS|fromText|cs|convertString|toS|toSL|toST)$/;
 const PATH_JOIN = /(?:^|\.)(?:<\/>|combine|joinPath|<\.>)$/;
 // list plumbing that only lays the parameters out as text (`unwords args`, `concatMap (' ':) args`): no fixed words are added
 const LIST_LAYOUT = /(?:^|\.)(?:unwords|unlines|intercalate|concatMap|concat|map|fmap)$/;
@@ -261,9 +268,14 @@ export function applyTrustBoundary(findings, perFile) {
     else if (roots.length && [...classes].every((c) => c === 'operator')) {
       verdict = 'operator-controlled';
       reason = 'only command-line arguments or environment variables supply the value; whoever starts the program chooses them, so no trust boundary is crossed';
-    } else if (roots.length && role === 'cli' && roots.every((r) => r.provenance === 'file-read' || OPERATOR.has(r.provenance))) {
+    } else if (roots.length && role === 'cli' && roots.every((r) => r.provenance === 'file-read' || OPERATOR.has(r.provenance) || (f.cwe === 'CWE-22' && r.provenance === 'stdin'))) {
+      // Standard input counts here for a PATH operation only: a command-line program reading a file name from its own standard input
+      // is the person at the keyboard naming a file (14 of the 29 flagged path sites on the real-code sets, every one a false positive).
+      // A command built from standard input stays reported (`getLine >>= callCommand`, pinned in test/haskell/haskell-trust-boundary.test.js).
       verdict = 'operator-controlled';
-      reason = 'the function belongs to a command-line program (reached from a main that imports no server framework) and the value comes from files the person running it pointed the program at, or from its arguments and environment; standard input is not covered by this rule';
+      reason = f.cwe === 'CWE-22' && roots.some((r) => r.provenance === 'stdin')
+        ? 'the function belongs to a command-line program (reached from a main that imports no server framework) and the file it works on is named by the person running it: on its standard input, in files it was pointed at, or in its arguments and environment'
+        : 'the function belongs to a command-line program (reached from a main that imports no server framework) and the value comes from files the person running it pointed the program at, or from its arguments and environment; standard input is covered by this rule only for a path operation';
     } else if (classes.has('data')) { verdict = 'data-input'; reason = 'standard input or file content supplies the value'; }
     else if (classes.has('weak-param')) {
       verdict = 'entry-parameter';

package/src/language/haskell-web.js

@@ -38,8 +38,12 @@ const SCOTTY_METHODS = { get: 'GET', post: 'POST', put: 'PUT', delete: 'DELETE',
 const SENSITIVE_PREFIX = ['Database.', 'System.Process.', 'System.Directory.', 'Prelude.readFile', 'Prelude.writeFile', 'Prelude.appendFile', 'System.IO.', 'Network.HTTP.Simple.', 'Network.HTTP.Client.'];
 const PERSIST_FNS = new Set(['get', 'getBy', 'selectFirst', 'selectList', 'insert', 'insert_', 'update', 'updateWhere', 'delete', 'deleteWhere', 'replace', 'runDB', 'getJust', 'upsert']);
 const GUARD_PRIMITIVES = new Set(['Yesod.Core.requireAuthId', 'Yesod.Core.requireAuth', 'Yesod.Auth.requireAuthId', 'Yesod.Auth.requireAuth', 'Yesod.requireAuthId', 'Yesod.requireAuth', 'Network.Wai.Middleware.HttpAuth.basicAuth']);
-const CREDENTIAL_HEADER = /^(?:authorization|cookie|x-api-key|x-auth-token|x-access-token)$/i;
+// a header that carries the caller's credential: the standard two, and the custom names projects give a token or session header
+const CREDENTIAL_HEADER = /^(?:authorization|cookie|x-api-key|x-api-token|x-auth-token|x-auth|x-access-token|x-session(?:-(?:id|token|key))?|x-token|x-user-token|x-csrf-token|x-xsrf-token)$/i;
 const ADMIN_PATH = /(?:^|\/)(?:admin|internal|manage|superuser)(?:\/|$|:)/i;
+// an authentication endpoint (sign-in, registration, password reset, logout, an OAuth callback) is public by construction
+const AUTH_ENDPOINT_PATH = /(?:^|\/)(?:login|log-in|sign-?in|sign-?up|signup|register|registration|logout|log-out|sign-?out|password\/(?:reset|forgot)|reset-password|forgot-password|password-reset|oauth|callback|token|auth|authenticate|session)(?:\/|$|:|\.)/i;
+const AUTH_ENDPOINT_NAME = /(?:login|signin|signup|register|logout|signout|resetpassword|passwordreset|forgotpassword|authenticate)/i;
 const ROLE_CALL = /(?:^|\.)(?:isAdmin|hasRole|requireAdmin|checkRole|hasPermission|requireRole|requirePermission|isSuperuser)$/i;
 const OWNER_CALL = /(?:^|\.)(?:checkOwner|ownedBy|belongsTo|isOwner|requireOwner|authorizeOwner)$/i;
 const CSRF_CALL = /csrf|xsrf/i;
@@ -1160,8 +1164,11 @@ function emitFindings(ctx, result, yesodAuthz) {
     if (!R.handler || R.handler.kind === 'unknown') continue;
     const writes = WRITE_METHODS.has(R.method) || R.method === 'ANY';
     const privileged = ADMIN_PATH.test(R.path) || /admin/i.test(R.handler.name || '');
+    // An authentication endpoint is public by construction: the request that signs in, registers or starts a password reset carries no
+    // session yet. Its own flaws (a weak hash, a predictable code) are other families' findings; a missing-auth finding on it is noise.
+    const authEndpoint = AUTH_ENDPOINT_PATH.test(R.path || '') || AUTH_ENDPOINT_NAME.test(R.handler.name || '');
     if (R.auth.status === 'late') emit('hs-route-late-auth', R, { detail: R.auth.evidence[0].order === 'unknown' ? `the rejection ${R.auth.evidence[0].callee} cannot be shown to run before the first sensitive operation (${R.auth.evidence[0].reason})` : `guard ${R.auth.evidence[0].callee} runs after the first sensitive operation`, evidence: R.auth.evidence });
-    else if (R.auth.status === 'none' && (writes || privileged) && !(R.framework === 'yesod' && R.yesodExplicitPublic && !writes)) {
+    else if (R.auth.status === 'none' && (writes || privileged) && !authEndpoint && !(R.framework === 'yesod' && R.yesodExplicitPublic && !writes)) {
       const how = R.method === 'ANY' ? 'any method' : writes ? 'state-changing method' : 'privileged path';
       if (R.sensitive !== false) emit('hs-route-missing-auth', R, { severity: writes ? 'high' : 'medium', detail: how });
       // No database, file or process call is visible, but the handler calls something the engine cannot see into (a project function, a