@eagleoutice/flowr 2.10.3 → 2.10.4

package/README.md

@@ -24,7 +24,7 @@ It offers a wide variety of features, for example:
     
     ```shell
     $ docker run -it --rm eagleoutice/flowr # or npm run flowr 
-    flowR repl using flowR v2.10.2, R grammar v14 (tree-sitter engine)
+    flowR repl using flowR v2.10.3, R grammar v14 (tree-sitter engine)
     R> :query @linter "read.csv(\"/root/x.txt\")"
     ```
     
@@ -35,17 +35,17 @@ It offers a wide variety of features, for example:
     ```text
     Query: linter (2 ms)
        ╰ Deprecated Functions (deprecated-functions):
-           ╰ Metadata: totalCalls: 0, totalFunctionDefinitions: 0, searchTimeMs: 0, processTimeMs: 0
+           ╰ Metadata: totalCalls: 0, totalFunctionDefinitions: 0, searchTimeMs: 1, processTimeMs: 0
        ╰ File Path Validity (file-path-validity):
            ╰ certain:
                ╰ Path `/root/x.txt` at 1.1-23
-           ╰ Metadata: totalReads: 1, totalUnknown: 0, totalWritesBeforeAlways: 0, totalValid: 0, searchTimeMs: 1, processTimeMs: 0
+           ╰ Metadata: totalReads: 1, totalUnknown: 0, totalWritesBeforeAlways: 0, totalValid: 0, searchTimeMs: 0, processTimeMs: 0
        ╰ Seeded Randomness (seeded-randomness):
            ╰ Metadata: consumerCalls: 0, callsWithFunctionProducers: 0, callsWithAssignmentProducers: 0, callsWithNonConstantProducers: 0, callsWithOtherBranchProducers: 0, searchTimeMs: 0, processTimeMs: 0
        ╰ Absolute Paths (absolute-file-paths):
            ╰ certain:
                ╰ Path `/root/x.txt` at 1.1-23
-           ╰ Metadata: totalConsidered: 1, totalUnknown: 0, searchTimeMs: 0, processTimeMs: 0
+           ╰ Metadata: totalConsidered: 1, totalUnknown: 0, searchTimeMs: 1, processTimeMs: 0
        ╰ Unused Definitions (unused-definitions):
            ╰ Metadata: totalConsidered: 0, searchTimeMs: 0, processTimeMs: 0
        ╰ Naming Convention (naming-convention):
@@ -53,12 +53,12 @@ It offers a wide variety of features, for example:
        ╰ Network Functions (network-functions):
            ╰ Metadata: totalCalls: 0, totalFunctionDefinitions: 0, searchTimeMs: 0, processTimeMs: 0
        ╰ Dataframe Access Validation (dataframe-access-validation):
-           ╰ Metadata: numOperations: 0, numAccesses: 0, totalAccessed: 0, searchTimeMs: 0, processTimeMs: 1
+           ╰ Metadata: numOperations: 0, numAccesses: 0, totalAccessed: 0, searchTimeMs: 0, processTimeMs: 0
        ╰ Dead Code (dead-code):
            ╰ Metadata: consideredNodes: 5, searchTimeMs: 0, processTimeMs: 0
        ╰ Useless Loops (useless-loop):
            ╰ Metadata: numOfUselessLoops: 0, searchTimeMs: 0, processTimeMs: 0
-       ╰ Problematic eval (problematic-eval):
+       ╰ Problematic inputs (problematic-inputs):
            ╰ Metadata: searchTimeMs: 0, processTimeMs: 0
        ╰ Stop without call.=False argument (stop-call):
            ╰ Metadata: consideredNodes: 0, searchTimeMs: 0, processTimeMs: 0
@@ -86,15 +86,15 @@ It offers a wide variety of features, for example:
     
     _Results (prettified and summarized):_
     
-    Query: **linter** (3 ms)\
+    Query: **linter** (2 ms)\
        ╰ **Deprecated Functions** (deprecated-functions):\
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>totalCalls: 0, totalFunctionDefinitions: 0, searchTimeMs: 1, processTimeMs: 0</code>\
+    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>totalCalls: 0, totalFunctionDefinitions: 0, searchTimeMs: 0, processTimeMs: 0</code>\
     &nbsp;&nbsp;&nbsp;╰ **File Path Validity** (file-path-validity):\
     &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ certain:\
     &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ Path `/root/x.txt` at 1.1-23\
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>totalReads: 1, totalUnknown: 0, totalWritesBeforeAlways: 0, totalValid: 0, searchTimeMs: 0, processTimeMs: 0</code>\
+    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>totalReads: 1, totalUnknown: 0, totalWritesBeforeAlways: 0, totalValid: 0, searchTimeMs: 1, processTimeMs: 0</code>\
     &nbsp;&nbsp;&nbsp;╰ **Seeded Randomness** (seeded-randomness):\
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>consumerCalls: 0, callsWithFunctionProducers: 0, callsWithAssignmentProducers: 0, callsWithNonConstantProducers: 0, callsWithOtherBranchProducers: 0, searchTimeMs: 1, processTimeMs: 0</code>\
+    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>consumerCalls: 0, callsWithFunctionProducers: 0, callsWithAssignmentProducers: 0, callsWithNonConstantProducers: 0, callsWithOtherBranchProducers: 0, searchTimeMs: 0, processTimeMs: 0</code>\
     &nbsp;&nbsp;&nbsp;╰ **Absolute Paths** (absolute-file-paths):\
     &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ certain:\
     &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ Path `/root/x.txt` at 1.1-23\
@@ -104,24 +104,24 @@ It offers a wide variety of features, for example:
     &nbsp;&nbsp;&nbsp;╰ **Naming Convention** (naming-convention):\
     &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>numMatches: 0, numBreak: 0, searchTimeMs: 0, processTimeMs: 0</code>\
     &nbsp;&nbsp;&nbsp;╰ **Network Functions** (network-functions):\
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>totalCalls: 0, totalFunctionDefinitions: 0, searchTimeMs: 0, processTimeMs: 0</code>\
+    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>totalCalls: 0, totalFunctionDefinitions: 0, searchTimeMs: 0, processTimeMs: 1</code>\
     &nbsp;&nbsp;&nbsp;╰ **Dataframe Access Validation** (dataframe-access-validation):\
     &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>numOperations: 0, numAccesses: 0, totalAccessed: 0, searchTimeMs: 0, processTimeMs: 0</code>\
     &nbsp;&nbsp;&nbsp;╰ **Dead Code** (dead-code):\
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>consideredNodes: 5, searchTimeMs: 1, processTimeMs: 0</code>\
+    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>consideredNodes: 5, searchTimeMs: 0, processTimeMs: 0</code>\
     &nbsp;&nbsp;&nbsp;╰ **Useless Loops** (useless-loop):\
     &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>numOfUselessLoops: 0, searchTimeMs: 0, processTimeMs: 0</code>\
-    &nbsp;&nbsp;&nbsp;╰ **Problematic eval** (problematic-eval):\
+    &nbsp;&nbsp;&nbsp;╰ **Problematic inputs** (problematic-inputs):\
     &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>searchTimeMs: 0, processTimeMs: 0</code>\
     &nbsp;&nbsp;&nbsp;╰ **Stop without call.=False argument** (stop-call):\
     &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>consideredNodes: 0, searchTimeMs: 0, processTimeMs: 0</code>\
     &nbsp;&nbsp;&nbsp;╰ **Roxygen Arguments** (roxygen-arguments):\
     &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>searchTimeMs: 0, processTimeMs: 0</code>\
-    _All queries together required ≈3 ms (1ms accuracy, total 3 ms)_
+    _All queries together required ≈2 ms (1ms accuracy, total 2 ms)_
     
     <details> <summary style="color:gray">Show Detailed Results as Json</summary>
     
-    The analysis required _2.5 ms_ (including parsing and normalization and the query) within the generation environment.
+    The analysis required _2.2 ms_ (including parsing and normalization and the query) within the generation environment.
     
     In general, the JSON contains the Ids of the nodes in question as they are present in the normalized AST or the dataflow graph of flowR.
     Please consult the [Interface](https://github.com/flowr-analysis/flowr/wiki/Interface) wiki page for more information on how to get those.
@@ -138,7 +138,7 @@ It offers a wide variety of features, for example:
             ".meta": {
               "totalCalls": 0,
               "totalFunctionDefinitions": 0,
-              "searchTimeMs": 1,
+              "searchTimeMs": 0,
               "processTimeMs": 0
             }
           },
@@ -161,7 +161,7 @@ It offers a wide variety of features, for example:
               "totalUnknown": 0,
               "totalWritesBeforeAlways": 0,
               "totalValid": 0,
-              "searchTimeMs": 0,
+              "searchTimeMs": 1,
               "processTimeMs": 0
             }
           },
@@ -173,7 +173,7 @@ It offers a wide variety of features, for example:
               "callsWithAssignmentProducers": 0,
               "callsWithNonConstantProducers": 0,
               "callsWithOtherBranchProducers": 0,
-              "searchTimeMs": 1,
+              "searchTimeMs": 0,
               "processTimeMs": 0
             }
           },
@@ -220,7 +220,7 @@ It offers a wide variety of features, for example:
               "totalCalls": 0,
               "totalFunctionDefinitions": 0,
               "searchTimeMs": 0,
-              "processTimeMs": 0
+              "processTimeMs": 1
             }
           },
           "dataframe-access-validation": {
@@ -237,7 +237,7 @@ It offers a wide variety of features, for example:
             "results": [],
             ".meta": {
               "consideredNodes": 5,
-              "searchTimeMs": 1,
+              "searchTimeMs": 0,
               "processTimeMs": 0
             }
           },
@@ -249,7 +249,7 @@ It offers a wide variety of features, for example:
               "processTimeMs": 0
             }
           },
-          "problematic-eval": {
+          "problematic-inputs": {
             "results": [],
             ".meta": {
               "searchTimeMs": 0,
@@ -273,11 +273,11 @@ It offers a wide variety of features, for example:
           }
         },
         ".meta": {
-          "timing": 3
+          "timing": 2
         }
       },
       ".meta": {
-        "timing": 3
+        "timing": 2
       }
     }
     ```
@@ -342,7 +342,7 @@ It offers a wide variety of features, for example:
     
     ```shell
     $ docker run -it --rm eagleoutice/flowr # or npm run flowr 
-    flowR repl using flowR v2.10.2, R grammar v14 (tree-sitter engine)
+    flowR repl using flowR v2.10.3, R grammar v14 (tree-sitter engine)
     R> :query @static-slice (11@sum) file://test/testfiles/example.R
     ```
     
@@ -356,7 +356,7 @@ It offers a wide variety of features, for example:
     N <- 10
     for(i in 1:(N-1)) sum <- sum + i + w
     sum
-    All queries together required ≈3 ms (1ms accuracy, total 3 ms)
+    All queries together required ≈2 ms (1ms accuracy, total 2 ms)
     ```
     
     
@@ -390,7 +390,7 @@ It offers a wide variety of features, for example:
          
 
 * 🚀 **fast call-graph, data-, and control-flow graphs**\
-  Within just [<i><span title="This measurement is automatically fetched from the latest benchmark!">100.4 ms</span></i> (as of Apr 2, 2026)](https://flowr-analysis.github.io/flowr/wiki/stats/benchmark), 
+  Within just [<i><span title="This measurement is automatically fetched from the latest benchmark!">104.1 ms</span></i> (as of Apr 7, 2026)](https://flowr-analysis.github.io/flowr/wiki/stats/benchmark), 
   _flowR_ can analyze the data- and control-flow of the average real-world R&nbsp;script. See the [benchmarks](https://flowr-analysis.github.io/flowr/wiki/stats/benchmark) for more information,
   and consult the [wiki pages](https://github.com/flowr-analysis/flowr/wiki/dataflow-graph) for more details on the [dataflow graphs](https://github.com/flowr-analysis/flowr/wiki/dataflow-graph) as well as [call graphs](https://github.com/flowr-analysis/flowr/wiki/dataflow-graph#perspectives-cg).
 
@@ -426,7 +426,7 @@ It offers a wide variety of features, for example:
     
     ```shell
     $ docker run -it --rm eagleoutice/flowr # or npm run flowr 
-    flowR repl using flowR v2.10.2, R grammar v14 (tree-sitter engine)
+    flowR repl using flowR v2.10.3, R grammar v14 (tree-sitter engine)
     R> :dataflow* test/testfiles/example.R
     ```
     

package/documentation/wiki-linter.js

@@ -124,7 +124,7 @@ df[6, "value"]
     rule(knownParser, 'useless-loop', 'UselessLoopConfig', 'USELESS_LOOP', 'lint-useless-loop', 'for(i in c(1)) { print(i) }', tagTypes);
     rule(knownParser, 'stop-call', 'StopWithCallConfig', 'STOP_WITH_CALL_ARG', 'lint-stop-call', 'stop(42)', tagTypes);
     rule(knownParser, 'roxygen-arguments', 'RoxygenArgsConfig', 'ROXYGEN_ARGS', 'lint-roxygen-arguments', '#\' A function with two parameters, but only only one documented\n#\' @param a A variable\nf = function(a, b){return a;}', tagTypes);
-    rule(knownParser, 'problematic-eval', 'ProblematicEvalConfig', 'PROBLEMATIC_EVAL', 'lint-problematic-eval', `
+    rule(knownParser, 'problematic-inputs', 'ProblematicInputsConfig', 'PROBLEMATIC_INPUTS', 'lint-problematic-inputs', `
 function(x) {
 	eval(x)
 }

package/linter/linter-rules.d.ts

@@ -78,7 +78,7 @@ export declare const LintingRules: {
                     readonly type: "assignment";
                     readonly name: ".Random.seed";
                 }];
-                readonly randomnessConsumers: readonly ["jitter", "sample", "sample.int", "arima.sim", "kmeans", "princomp", "rcauchy", "rchisq", "rexp", "rgamma", "rgeom", "rlnorm", "rlogis", "rmultinom", "rnbinom", "rnorm", "rpois", "runif", "pointLabel", "some", "rbernoulli", "rdunif", "generateSeedVectors"];
+                readonly randomnessConsumers: readonly ["jitter", "sample", "sample.int", "arima.sim", "kmeans", "princomp", "rcauchy", "rchisq", "rexp", "rgamma", "rgeom", "rlnorm", "rlogis", "rmultinom", "rnbinom", "rnorm", "rpois", "runif", "pointLabel", "some", "rbernoulli", "rdunif", "generateSeedVectors", "rbeta", "rf", "rhyper", "rweibull", "rt", "rvonmises", "rwilcox", "rxor", "rhyper", "rmvnorm", "rsignrank", "randomForest", "permuted", "permute", "shuffle", "shuffleSet", "data_shuffle", "sample_frac", "sample_n", "slice_sample"];
             };
             readonly tags: readonly [import("./linter-tags").LintingRuleTag.Robustness, import("./linter-tags").LintingRuleTag.Reproducibility];
             readonly certainty: import("./linter-format").LintingRuleCertainty.BestEffort;
@@ -196,7 +196,7 @@ export declare const LintingRules: {
             readonly certainty: import("./linter-format").LintingRuleCertainty.BestEffort;
             readonly description: "Marks network functions that execute network operations, such as downloading files or making HTTP requests.";
             readonly defaultConfig: {
-                readonly fns: readonly ["read.table", "read.csv", "read.csv2", "read.delim", "read.delim2", "readRDS", "download.file", "url", "GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "content", "handle", "get_callback", "VERB", "fread", "gzcon", "readlines", "source", "load", "curl_download", "curl_fetch_memory", "getURL", "getForm", "read_html", "html_nodes", "html_text", "fromJSON", "read.xlsx", "drive_download", "drive_get", "s3read_using", "s3write_using", "storage_download", "AnnotationHub", "ExperimentHub"];
+                readonly fns: readonly ["read.table", "read.csv", "read.csv2", "read.delim", "read.delim2", "readRDS", "download.file", "url", "GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "content", "handle", "get_callback", "VERB", "fread", "gzcon", "readlines", "readLines", "source", "load", "curl_download", "curl_fetch_memory", "getURL", "getForm", "read_html", "read_xml", "html_nodes", "html_text", "fromJSON", "read.xlsx", "drive_download", "drive_get", "s3read_using", "s3write_using", "storage_download", "AnnotationHub", "ExperimentHub", "scan", "socketConnection", "request", "curl"];
                 readonly onlyTriggerWithArgument: RegExp;
             };
         };
@@ -281,28 +281,28 @@ export declare const LintingRules: {
             };
         };
     };
-    readonly 'problematic-eval': {
-        readonly createSearch: (config: import("./rules/problematic-eval").ProblematicEvalConfig) => import("../search/flowr-search-builder").FlowrSearchBuilder<"from-query", [], import("../r-bridge/lang-4.x/ast/model/processing/decorate").ParentInformation, import("../search/flowr-search").FlowrSearchElements<import("../r-bridge/lang-4.x/ast/model/processing/decorate").ParentInformation, import("../search/flowr-search").FlowrSearchElement<import("../r-bridge/lang-4.x/ast/model/processing/decorate").ParentInformation>[]>>;
-        readonly processSearchResult: (elements: import("../search/flowr-search").FlowrSearchElements<import("../r-bridge/lang-4.x/ast/model/processing/decorate").ParentInformation, import("../search/flowr-search").FlowrSearchElement<import("../r-bridge/lang-4.x/ast/model/processing/decorate").ParentInformation>[]>, _config: import("./rules/problematic-eval").ProblematicEvalConfig, data: {
+    readonly 'problematic-inputs': {
+        readonly createSearch: (config: import("./rules/problematic-inputs").ProblematicInputsConfig) => import("../search/flowr-search-builder").FlowrSearchBuilder<"from-query", [], import("../r-bridge/lang-4.x/ast/model/processing/decorate").ParentInformation, import("../search/flowr-search").FlowrSearchElements<import("../r-bridge/lang-4.x/ast/model/processing/decorate").ParentInformation, import("../search/flowr-search").FlowrSearchElement<import("../r-bridge/lang-4.x/ast/model/processing/decorate").ParentInformation>[]>>;
+        readonly processSearchResult: (elements: import("../search/flowr-search").FlowrSearchElements<import("../r-bridge/lang-4.x/ast/model/processing/decorate").ParentInformation, import("../search/flowr-search").FlowrSearchElement<import("../r-bridge/lang-4.x/ast/model/processing/decorate").ParentInformation>[]>, _config: import("./rules/problematic-inputs").ProblematicInputsConfig, data: {
             normalize: import("../r-bridge/lang-4.x/ast/model/processing/decorate").NormalizedAst;
             dataflow: import("../dataflow/info").DataflowInformation;
             cfg: import("../control-flow/control-flow-graph").ControlFlowInformation;
             analyzer: import("../project/flowr-analyzer").ReadonlyFlowrAnalysisProvider;
         }) => Promise<{
-            results: import("./rules/problematic-eval").ProblematicEvalResult[];
-            ".meta": import("./rules/problematic-eval").ProblematicEvalMetadata;
+            results: import("./rules/problematic-inputs").ProblematicInputsResult[];
+            ".meta": import("./rules/problematic-inputs").ProblematicInputsMetadata;
         }>;
         readonly prettyPrint: {
-            readonly query: (result: import("./rules/problematic-eval").ProblematicEvalResult) => string;
-            readonly full: (result: import("./rules/problematic-eval").ProblematicEvalResult) => string;
+            readonly query: (result: import("./rules/problematic-inputs").ProblematicInputsResult) => string;
+            readonly full: (result: import("./rules/problematic-inputs").ProblematicInputsResult) => string;
         };
         readonly info: {
-            readonly name: "Problematic eval";
-            readonly description: "Detects uses of eval-like functions whose inputs are not statically constant. Prints the computed input-sources for the eval and flags usages that depend on non-constant/trusted inputs.";
+            readonly name: "Problematic inputs";
+            readonly description: "Detects uses of configured dynamic calls (e.g. eval, system) whose inputs are not statically constant. Prints the computed input-sources for the call and flags usages that depend on non-constant/trusted inputs.";
             readonly tags: readonly [import("./linter-tags").LintingRuleTag.Security, import("./linter-tags").LintingRuleTag.Smell, import("./linter-tags").LintingRuleTag.Readability, import("./linter-tags").LintingRuleTag.Performance];
             readonly certainty: import("./linter-format").LintingRuleCertainty.BestEffort;
             readonly defaultConfig: {
-                readonly considerAsEval: "^eval$";
+                readonly consider: readonly ["^eval$", "^system$", "^system2$", "^shell$"];
             };
         };
     };

package/linter/linter-rules.js

@@ -13,7 +13,7 @@ const useless_loop_1 = require("./rules/useless-loop");
 const network_functions_1 = require("./rules/network-functions");
 const stop_with_call_arg_1 = require("./rules/stop-with-call-arg");
 const roxygen_arguments_1 = require("./rules/roxygen-arguments");
-const problematic_eval_1 = require("./rules/problematic-eval");
+const problematic_inputs_1 = require("./rules/problematic-inputs");
 /**
  * The registry of currently supported linting rules.
  * A linting rule can be executed on a dataflow pipeline result using {@link executeLintingRule}.
@@ -29,7 +29,7 @@ exports.LintingRules = {
     'dataframe-access-validation': dataframe_access_validation_1.DATA_FRAME_ACCESS_VALIDATION,
     'dead-code': dead_code_1.DEAD_CODE,
     'useless-loop': useless_loop_1.USELESS_LOOP,
-    'problematic-eval': problematic_eval_1.PROBLEMATIC_EVAL,
+    'problematic-inputs': problematic_inputs_1.PROBLEMATIC_INPUTS,
     'stop-call': stop_with_call_arg_1.STOP_WITH_CALL_ARG,
     'roxygen-arguments': roxygen_arguments_1.ROXYGEN_ARGS
 };

package/linter/rules/network-functions.d.ts

@@ -31,7 +31,7 @@ export declare const NETWORK_FUNCTIONS: {
         readonly certainty: LintingRuleCertainty.BestEffort;
         readonly description: "Marks network functions that execute network operations, such as downloading files or making HTTP requests.";
         readonly defaultConfig: {
-            readonly fns: readonly ["read.table", "read.csv", "read.csv2", "read.delim", "read.delim2", "readRDS", "download.file", "url", "GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "content", "handle", "get_callback", "VERB", "fread", "gzcon", "readlines", "source", "load", "curl_download", "curl_fetch_memory", "getURL", "getForm", "read_html", "html_nodes", "html_text", "fromJSON", "read.xlsx", "drive_download", "drive_get", "s3read_using", "s3write_using", "storage_download", "AnnotationHub", "ExperimentHub"];
+            readonly fns: readonly ["read.table", "read.csv", "read.csv2", "read.delim", "read.delim2", "readRDS", "download.file", "url", "GET", "POST", "PUT", "DELETE", "PATCH", "HEAD", "content", "handle", "get_callback", "VERB", "fread", "gzcon", "readlines", "readLines", "source", "load", "curl_download", "curl_fetch_memory", "getURL", "getForm", "read_html", "read_xml", "html_nodes", "html_text", "fromJSON", "read.xlsx", "drive_download", "drive_get", "s3read_using", "s3write_using", "storage_download", "AnnotationHub", "ExperimentHub", "scan", "socketConnection", "request", "curl"];
             readonly onlyTriggerWithArgument: RegExp;
         };
     };

package/linter/rules/network-functions.js

@@ -29,8 +29,14 @@ exports.NETWORK_FUNCTIONS = {
         certainty: linter_format_1.LintingRuleCertainty.BestEffort,
         description: 'Marks network functions that execute network operations, such as downloading files or making HTTP requests.',
         defaultConfig: {
-            fns: ['read.table', 'read.csv', 'read.csv2', 'read.delim', 'read.delim2', 'readRDS', 'download.file', 'url', 'GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'HEAD', 'content', 'handle', 'get_callback', 'VERB', 'fread', 'gzcon', 'readlines', 'source', 'load', 'curl_download', 'curl_fetch_memory', 'getURL', 'getForm', 'read_html', 'html_nodes', 'html_text', 'fromJSON', 'read.xlsx', 'drive_download', 'drive_get', 's3read_using', 's3write_using', 'storage_download', 'AnnotationHub', 'ExperimentHub'],
-            onlyTriggerWithArgument: /^(https?|ftps?|file):\/\//
+            fns: [
+                'read.table', 'read.csv', 'read.csv2', 'read.delim', 'read.delim2', 'readRDS', 'download.file', 'url', 'GET', 'POST', 'PUT',
+                'DELETE', 'PATCH', 'HEAD', 'content', 'handle', 'get_callback', 'VERB', 'fread', 'gzcon', 'readlines', 'readLines', 'source', 'load', 'curl_download',
+                'curl_fetch_memory', 'getURL', 'getForm', 'read_html', 'read_xml', 'html_nodes', 'html_text', 'fromJSON', 'read.xlsx', 'drive_download', 'drive_get',
+                's3read_using', 's3write_using', 'storage_download', 'AnnotationHub', 'ExperimentHub', 'scan',
+                'socketConnection', 'request', 'curl'
+            ],
+            onlyTriggerWithArgument: /^(https?|ftps?):\/\//
         }
     }
 };

package/linter/rules/{problematic-eval.d.ts → problematic-inputs.d.ts}

@@ -6,39 +6,37 @@ import type { InputSources } from '../../queries/catalog/input-sources-query/sim
 /**
  * Describes a linting result for a problematic eval usage, including the location of the eval call and the computed input sources that lead to it.
  */
-export interface ProblematicEvalResult extends LintingResult {
+export interface ProblematicInputsResult extends LintingResult {
+    name: string;
     loc: SourceLocation;
     sources: InputSources;
 }
-export interface ProblematicEvalConfig extends MergeableRecord {
-    /**
-     * All calls that should be considered to be valid eval entry points, this will be interpreted as a Regex!
-     */
-    considerAsEval: string;
+export interface ProblematicInputsConfig extends MergeableRecord {
+    consider?: string | string[];
 }
-export type ProblematicEvalMetadata = MergeableRecord;
-export declare const PROBLEMATIC_EVAL: {
-    readonly createSearch: (config: ProblematicEvalConfig) => import("../../search/flowr-search-builder").FlowrSearchBuilder<"from-query", [], import("../../r-bridge/lang-4.x/ast/model/processing/decorate").ParentInformation, import("../../search/flowr-search").FlowrSearchElements<import("../../r-bridge/lang-4.x/ast/model/processing/decorate").ParentInformation, import("../../search/flowr-search").FlowrSearchElement<import("../../r-bridge/lang-4.x/ast/model/processing/decorate").ParentInformation>[]>>;
-    readonly processSearchResult: (elements: import("../../search/flowr-search").FlowrSearchElements<import("../../r-bridge/lang-4.x/ast/model/processing/decorate").ParentInformation, import("../../search/flowr-search").FlowrSearchElement<import("../../r-bridge/lang-4.x/ast/model/processing/decorate").ParentInformation>[]>, _config: ProblematicEvalConfig, data: {
+export type ProblematicInputsMetadata = MergeableRecord;
+export declare const PROBLEMATIC_INPUTS: {
+    readonly createSearch: (config: ProblematicInputsConfig) => import("../../search/flowr-search-builder").FlowrSearchBuilder<"from-query", [], import("../../r-bridge/lang-4.x/ast/model/processing/decorate").ParentInformation, import("../../search/flowr-search").FlowrSearchElements<import("../../r-bridge/lang-4.x/ast/model/processing/decorate").ParentInformation, import("../../search/flowr-search").FlowrSearchElement<import("../../r-bridge/lang-4.x/ast/model/processing/decorate").ParentInformation>[]>>;
+    readonly processSearchResult: (elements: import("../../search/flowr-search").FlowrSearchElements<import("../../r-bridge/lang-4.x/ast/model/processing/decorate").ParentInformation, import("../../search/flowr-search").FlowrSearchElement<import("../../r-bridge/lang-4.x/ast/model/processing/decorate").ParentInformation>[]>, _config: ProblematicInputsConfig, data: {
         normalize: import("../../r-bridge/lang-4.x/ast/model/processing/decorate").NormalizedAst;
         dataflow: import("../../dataflow/info").DataflowInformation;
         cfg: import("../../control-flow/control-flow-graph").ControlFlowInformation;
         analyzer: import("../../project/flowr-analyzer").ReadonlyFlowrAnalysisProvider;
     }) => Promise<{
-        results: ProblematicEvalResult[];
-        ".meta": ProblematicEvalMetadata;
+        results: ProblematicInputsResult[];
+        ".meta": ProblematicInputsMetadata;
     }>;
     readonly prettyPrint: {
-        readonly query: (result: ProblematicEvalResult) => string;
-        readonly full: (result: ProblematicEvalResult) => string;
+        readonly query: (result: ProblematicInputsResult) => string;
+        readonly full: (result: ProblematicInputsResult) => string;
     };
     readonly info: {
-        readonly name: "Problematic eval";
-        readonly description: "Detects uses of eval-like functions whose inputs are not statically constant. Prints the computed input-sources for the eval and flags usages that depend on non-constant/trusted inputs.";
+        readonly name: "Problematic inputs";
+        readonly description: "Detects uses of configured dynamic calls (e.g. eval, system) whose inputs are not statically constant. Prints the computed input-sources for the call and flags usages that depend on non-constant/trusted inputs.";
         readonly tags: readonly [LintingRuleTag.Security, LintingRuleTag.Smell, LintingRuleTag.Readability, LintingRuleTag.Performance];
         readonly certainty: LintingRuleCertainty.BestEffort;
         readonly defaultConfig: {
-            readonly considerAsEval: "^eval$";
+            readonly consider: readonly ["^eval$", "^system$", "^system2$", "^shell$"];
         };
     };
 };

package/linter/rules/problematic-inputs.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROBLEMATIC_INPUTS = void 0;
+const linter_format_1 = require("../linter-format");
+const flowr_search_builder_1 = require("../../search/flowr-search-builder");
+const range_1 = require("../../util/range");
+const linter_tags_1 = require("../linter-tags");
+const simple_input_classifier_1 = require("../../queries/catalog/input-sources-query/simple-input-classifier");
+const parse_1 = require("../../slicing/criterion/parse");
+const defaultConsider = ['^eval$', '^system$', '^system2$', '^shell$'];
+function normalizeConsider(cfg) {
+    if (cfg?.consider === undefined) {
+        return Array.from(defaultConsider, s => new RegExp(s));
+    }
+    if (Array.isArray(cfg.consider)) {
+        const arr = cfg.consider.length === 0 ? Array.from(defaultConsider) : cfg.consider;
+        // deduplicate while preserving order
+        return Array.from(new Set(arr), s => new RegExp(s));
+    }
+    return [new RegExp(cfg.consider)];
+}
+/**
+ * Format a list of input sources either as a single-line string (inline) or a block.
+ * - inline: returns a semicolon-separated single-line summary
+ * - block: returns an array of lines (to be joined with newlines by the caller)
+ */
+function formatInputSources(inputs, inline = true) {
+    if (!inputs || inputs.length === 0) {
+        return inline ? '' : [];
+    }
+    const formatOne = (s, inlineMode) => {
+        const typeStr = '[' + s.types.join(',') + ']';
+        const cdsStr = s.cds ? ', cds: [' + s.cds.join(',') + ']' : '';
+        return inlineMode
+            ? `${s.id} (type: ${typeStr}, trace: ${s.trace}${cdsStr})`
+            : `- ${s.id}: type=${typeStr}, trace=${s.trace}${cdsStr}`;
+    };
+    if (inline) {
+        return inputs.map(s => formatOne(s, true)).join('; ');
+    }
+    return inputs.map(s => formatOne(s, false));
+}
+// small helpers to keep checks readable
+function hasUnknownSource(sources) {
+    return sources.some(s => s.types.includes(simple_input_classifier_1.InputType.Unknown));
+}
+function isProblematicForAllowed(sources, allowed) {
+    return sources.some(s => s.types.some(t => !allowed.includes(t)));
+}
+exports.PROBLEMATIC_INPUTS = {
+    createSearch: config => {
+        const cfg = config;
+        const considerArr = normalizeConsider(cfg);
+        const queries = considerArr.map((name, i) => ({
+            type: 'call-context',
+            callName: name,
+            callNameExact: false,
+            subkind: `fn-${i}`
+        }));
+        return flowr_search_builder_1.Q.fromQuery(...queries);
+    },
+    processSearchResult: async (elements, _config, data) => {
+        const results = [];
+        const defaultAccept = [simple_input_classifier_1.InputType.Constant, simple_input_classifier_1.InputType.DerivedConstant];
+        for (const element of elements.getElements()) {
+            const nid = element.node.info.id;
+            const criterion = parse_1.SlicingCriterion.fromId(nid);
+            const q = { type: 'input-sources', criterion };
+            const all = await data.analyzer.query([q]);
+            const inputSourcesResult = all['input-sources'];
+            const sources = inputSourcesResult?.results?.[criterion] ?? [];
+            if (isProblematicForAllowed(sources, defaultAccept)) {
+                const certainty = hasUnknownSource(sources) ? linter_format_1.LintingResultCertainty.Uncertain : linter_format_1.LintingResultCertainty.Certain;
+                results.push({
+                    involvedId: nid,
+                    certainty,
+                    loc: range_1.SourceLocation.fromNode(element.node) ?? range_1.SourceLocation.invalid(),
+                    name: element.node.lexeme ?? '',
+                    sources
+                });
+            }
+        }
+        return {
+            results,
+            '.meta': {}
+        };
+    },
+    /* helper to format input sources for pretty printing */
+    prettyPrint: {
+        [linter_format_1.LintingPrettyPrintContext.Query]: result => {
+            const inputs = result.sources ?? [];
+            const srcStr = formatInputSources(inputs, true);
+            return 'Use of configured dynamic call at ' + range_1.SourceLocation.format(result.loc) + (srcStr ? '; inputs: ' + srcStr : '');
+        },
+        [linter_format_1.LintingPrettyPrintContext.Full]: result => {
+            const inputs = result.sources ?? [];
+            const srcLines = formatInputSources(inputs, false);
+            return 'Use of configured dynamic call at ' + range_1.SourceLocation.format(result.loc) + ' is potentially problematic' + (srcLines.length ? '\nInputs:\n' + srcLines.join('\n') : '');
+        }
+    },
+    info: {
+        name: 'Problematic inputs',
+        description: 'Detects uses of configured dynamic calls (e.g. eval, system) whose inputs are not statically constant. Prints the computed input-sources for the call and flags usages that depend on non-constant/trusted inputs.',
+        tags: [linter_tags_1.LintingRuleTag.Security, linter_tags_1.LintingRuleTag.Smell, linter_tags_1.LintingRuleTag.Readability, linter_tags_1.LintingRuleTag.Performance],
+        certainty: linter_format_1.LintingRuleCertainty.BestEffort,
+        defaultConfig: {
+            consider: defaultConsider
+        }
+    }
+};
+//# sourceMappingURL=problematic-inputs.js.map

package/linter/rules/seeded-randomness.d.ts

@@ -54,7 +54,7 @@ export declare const SEEDED_RANDOMNESS: {
                 readonly type: "assignment";
                 readonly name: ".Random.seed";
             }];
-            readonly randomnessConsumers: readonly ["jitter", "sample", "sample.int", "arima.sim", "kmeans", "princomp", "rcauchy", "rchisq", "rexp", "rgamma", "rgeom", "rlnorm", "rlogis", "rmultinom", "rnbinom", "rnorm", "rpois", "runif", "pointLabel", "some", "rbernoulli", "rdunif", "generateSeedVectors"];
+            readonly randomnessConsumers: readonly ["jitter", "sample", "sample.int", "arima.sim", "kmeans", "princomp", "rcauchy", "rchisq", "rexp", "rgamma", "rgeom", "rlnorm", "rlogis", "rmultinom", "rnbinom", "rnorm", "rpois", "runif", "pointLabel", "some", "rbernoulli", "rdunif", "generateSeedVectors", "rbeta", "rf", "rhyper", "rweibull", "rt", "rvonmises", "rwilcox", "rxor", "rhyper", "rmvnorm", "rsignrank", "randomForest", "permuted", "permute", "shuffle", "shuffleSet", "data_shuffle", "sample_frac", "sample_n", "slice_sample"];
         };
         readonly tags: readonly [LintingRuleTag.Robustness, LintingRuleTag.Reproducibility];
         readonly certainty: LintingRuleCertainty.BestEffort;

package/linter/rules/seeded-randomness.js

@@ -126,7 +126,14 @@ exports.SEEDED_RANDOMNESS = {
     info: {
         defaultConfig: {
             randomnessProducers: [{ type: 'function', name: 'set.seed' }, { type: 'assignment', name: '.Random.seed' }],
-            randomnessConsumers: ['jitter', 'sample', 'sample.int', 'arima.sim', 'kmeans', 'princomp', 'rcauchy', 'rchisq', 'rexp', 'rgamma', 'rgeom', 'rlnorm', 'rlogis', 'rmultinom', 'rnbinom', 'rnorm', 'rpois', 'runif', 'pointLabel', 'some', 'rbernoulli', 'rdunif', 'generateSeedVectors'],
+            randomnessConsumers: [
+                'jitter', 'sample', 'sample.int', 'arima.sim', 'kmeans', 'princomp', 'rcauchy', 'rchisq', 'rexp',
+                'rgamma', 'rgeom', 'rlnorm', 'rlogis', 'rmultinom', 'rnbinom', 'rnorm', 'rpois', 'runif', 'pointLabel',
+                'some', 'rbernoulli', 'rdunif', 'generateSeedVectors',
+                'rbeta', 'rf', 'rhyper', 'rweibull', 'rt', 'rvonmises', 'rwilcox', 'rxor', 'rhyper', 'rmvnorm',
+                'rsignrank', 'randomForest',
+                'permuted', 'permute', 'shuffle', 'shuffleSet', 'data_shuffle', 'sample_frac', 'sample_n', 'slice_sample',
+            ],
         },
         tags: [linter_tags_1.LintingRuleTag.Robustness, linter_tags_1.LintingRuleTag.Reproducibility],
         // only finds proper randomness producers and consumers due to its config, but will not find all producers/consumers since not all existing deprecated functions will be in the config

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eagleoutice/flowr",
-  "version": "2.10.3",
+  "version": "2.10.4",
   "description": "Static Dataflow Analyzer and Program Slicer for the R Programming Language",
   "types": "dist/src/index.d.ts",
   "repository": {
@@ -167,7 +167,7 @@
   "devDependencies": {
     "@commitlint/cli": "^20.5.0",
     "@commitlint/config-angular": "^20.5.0",
-    "@eagleoutice/eslint-config-flowr": "^1.0.36",
+    "@eagleoutice/eslint-config-flowr": "^1.0.40",
     "@eslint/eslintrc": "^3.3.3",
     "@eslint/js": "^9.39.2",
     "@j-ulrich/release-it-regex-bumper": "^5.3.0",

package/queries/catalog/call-context-query/call-context-query-executor.js

@@ -77,14 +77,14 @@ function promoteQueryCallNames(queries) {
                     ...q.fileFilter,
                     filter: promoteCallName(q.fileFilter.filter)
                 },
-                linkTo: Array.isArray(q.linkTo) ? q.linkTo.map(l => ({
+                linkTo: q.linkTo ? Array.isArray(q.linkTo) ? q.linkTo.map(l => ({
                     ...l,
                     callName: promoteCallName(l.callName)
                 })) : {
                     ...q.linkTo,
                     /* we have to add another promotion layer whenever we add something without this call name */
                     callName: promoteCallName(q.linkTo.callName)
-                }
+                } : undefined
             };
         }
         else {

package/queries/catalog/call-context-query/call-context-query-format.d.ts

@@ -88,7 +88,7 @@ export type LinkTo<CallName extends CallNameTypes = CallNameTypes, AttachLinkInf
     attachLinkInfo?: AttachLinkInfo;
 };
 export interface SubCallContextQueryFormat<CallName extends CallNameTypes = CallNameTypes, AttachLinkInfo = NoInfo> extends DefaultCallContextQueryFormat<CallName> {
-    readonly linkTo: LinkTo<CallName, AttachLinkInfo> | LinkTo<CallName, AttachLinkInfo>[];
+    readonly linkTo?: LinkTo<CallName, AttachLinkInfo> | LinkTo<CallName, AttachLinkInfo>[];
 }
 export interface CallContextQuerySubKindResult {
     /** The id of the call vertex identified within the supplied dataflow graph */

package/queries/catalog/call-context-query/call-context-query-format.js

@@ -29,8 +29,7 @@ exports.CallContextQueryDefinition = {
     executor: call_context_query_executor_1.executeCallContextQueries,
     asciiSummarizer: async (formatter, analyzer, queryResults, result) => {
         const out = queryResults;
-        result.push(`Query: ${(0, ansi_1.bold)('call-context', formatter)} (${(0, time_1.printAsMs)(out['.meta'].timing, 0)})`);
-        result.push((0, query_print_1.asciiCallContext)(formatter, out, (await analyzer.normalize()).idMap));
+        result.push(`Query: ${(0, ansi_1.bold)('call-context', formatter)} (${(0, time_1.printAsMs)(out['.meta'].timing, 0)})`, (0, query_print_1.asciiCallContext)(formatter, out, (await analyzer.normalize()).idMap));
         return true;
     },
     schema: joi_1.default.object({

package/queries/catalog/dependencies-query/function-info/read-functions.js

@@ -108,5 +108,11 @@ exports.ReadFunctions = [
     { package: 'rpolars', name: 'pl_scan_ipc', argIdx: 0, argName: 'source', resolveValue: true, ignoreIf: 'arg-missing' },
     { package: 'rpolars', name: 'pl_scan_ndjson', argIdx: 0, argName: 'source', resolveValue: true, ignoreIf: 'arg-missing' },
     { package: 'rpolars', name: 'pl_scan_parquet', argIdx: 0, argName: 'source', resolveValue: true, ignoreIf: 'arg-missing' },
+    { package: 'rio', name: 'import', argIdx: 0, argName: 'file', resolveValue: true },
+    { package: 'rio', name: 'import_list', argIdx: 0, argName: 'file', resolveValue: true },
+    { package: 'openxlsx', name: 'read.xlsx', argIdx: 0, argName: 'file', resolveValue: true },
+    { package: 'openxlsx', name: 'loadWorkbook', argIdx: 0, argName: 'file', resolveValue: true },
+    { package: 'readODS', name: 'read_ods', argIdx: 0, argName: 'path', resolveValue: true },
+    { package: 'vroom', name: 'vroom', argIdx: 0, argName: 'file', resolveValue: true },
 ];
 //# sourceMappingURL=read-functions.js.map

package/queries/catalog/dependencies-query/function-info/write-functions.js

@@ -115,6 +115,13 @@ exports.WriteFunctions = [
     { package: 'rpolars', name: 'write_csv', argIdx: 0, argName: 'file', resolveValue: true, ignoreIf: 'arg-missing' },
     { package: 'rpolars', name: 'write_ndjson', argIdx: 0, argName: 'file', resolveValue: true, ignoreIf: 'arg-missing' },
     { package: 'rpolars', name: 'write_parquet', argIdx: 0, argName: 'file', resolveValue: true, ignoreIf: 'arg-missing' },
+    { package: 'data.table', name: 'fwrite', argIdx: 1, argName: 'file', resolveValue: true },
+    { package: 'writexl', name: 'write_xlsx', argIdx: 1, argName: 'path', resolveValue: true },
+    { package: 'openxlsx', name: 'write.xlsx', argIdx: 1, argName: 'file', resolveValue: true },
+    { package: 'vroom', name: 'vroom_write', argIdx: 1, argName: 'file', resolveValue: true },
+    { package: 'vroom', name: 'vroom_write_lines', argIdx: 1, argName: 'file', resolveValue: true },
+    { package: 'rio', name: 'export', argIdx: 1, argName: 'file', resolveValue: true },
+    { package: 'rio', name: 'export_list', argIdx: 1, argName: 'file', resolveValue: true },
     { package: 'magick', name: 'image_write', argIdx: 1, argName: 'path', resolveValue: true, ignoreIf: 'arg-missing' },
 ];
 //# sourceMappingURL=write-functions.js.map

package/queries/catalog/input-sources-query/input-sources-query-executor.js

@@ -28,6 +28,7 @@ async function executeInputSourcesQuery({ analyzer }, queries) {
         const fdef = r_function_definition_1.RFunctionDefinition.rootFunctionDefinition(provenanceNode, nast.idMap);
         const provenance = df_helper_1.Dataflow.provenanceGraph(criterionId, df.graph, fdef ? model_1.RNode.collectAllIds(fdef) : undefined);
         results[key] = (0, simple_input_classifier_1.classifyInput)(criterionId, provenance, {
+            fullDfg: df.graph,
             networkFns: query.config?.networkFns ?? network_functions_1.NETWORK_FUNCTIONS.info.defaultConfig.fns,
             randomFns: query.config?.randomFns ?? seeded_randomness_1.SEEDED_RANDOMNESS.info.defaultConfig.randomnessConsumers,
             pureFns: query.config?.pureFns ?? ['paste', 'paste0', 'parse', '+', '-', '*',
@@ -43,17 +44,38 @@ async function executeInputSourcesQuery({ analyzer }, queries) {
                 'min', 'max', 'range', 'sum', 'prod', 'mean', 'median', 'var', 'sd',
                 'head', 'tail', 'seq', 'rep',
                 'apply', 'lapply', 'sapply', 'vapply', 'tapply',
-                'matrix', 'array', 'substitute', 'quote', 'bquote', 'enquote', 'enexpr', 'enexprs', 'enquo', 'enquos',
-                'expression', 'call', 'as.call', 'as.expression',
+                'matrix', 'array',
                 'rownames', 'colnames',
                 'list.files', 'tolower', 'toupper', 'printf',
                 '<-', '->', '=', '<<-', '->>', 'assign', 'get',
                 '[', '[[', '$', 'length<-', 'dim<-', 'names<-', 'colnames<-', 'rownames<-',
-                'as.character', 'as.numeric', 'as.logical', 'as.list', 'as.data.frame', 'as.matrix', 'as.array',
+                'as.character', 'as.numeric', 'as.logical', 'as.raw', 'as.list', 'as.data.frame', 'as.matrix', 'as.array',
                 'identity', 'invisible', 'return', 'force', 'missing',
-                'print', 'cat', 'message', 'warning', 'stop'
+                'print', 'cat', 'message', 'warning', 'stop',
+                'format', 'sprintf', 'formatC',
+                'is.na', 'is.null', 'is.numeric', 'is.character',
+                'which', 'match', 'order', 'sort', 'unique', 'duplicated', 'na.omit',
+                'grep', 'grepl', 'sub', 'gsub', 'regexpr', 'gregexpr', 'regexec', 'regmatches',
+                'as.integer', 'as.double', 'as.complex',
+                'trimws', 'seq_len', 'seq_along', 'rep.int',
+                'pmin', 'pmax', 'cumsum', 'cumprod', 'cummax', 'cummin', 'diff', 'signif',
+                'table', 'prop.table', 'xtabs',
+                'rbind', 'cbind', 't', 'crossprod', 'tcrossprod',
+                'colSums', 'rowSums', 'colMeans', 'rowMeans',
+                'solve', 'det', 'eigen',
+                'is.factor', 'is.logical', 'is.vector', 'is.matrix', 'is.data.frame',
+            ],
+            readFileFns: query.config?.readFileFns ?? read_functions_1.ReadFunctions.map(f => f.name),
+            systemFns: query.config?.systemFns ?? ['system', 'system2', 'pipe', 'shell', 'shell.exec'],
+            ffiFns: query.config?.ffiFns ?? ['.C', '.Call', '.Fortran', '.External', 'dyn.load', 'sourceCpp', 'getNativeSymbolInfo'],
+            langFns: query.config?.langFns ?? [
+                'substitute', 'quote', 'bquote', 'enquote',
+                'enexpr', 'enexprs', 'enquo', 'enquos',
+                'expression', 'call', 'as.call', 'as.expression',
+                'as.name', 'as.symbol', 'alist', 'as.language', 'evalq',
+                'expr', 'quo', 'enexpr', 'ensym', 'ensyms'
             ],
-            readFileFns: query.config?.readFileFns ?? read_functions_1.ReadFunctions.map(f => f.name)
+            optionsFns: query.config?.optionsFns ?? ['options', 'getOption', 'Sys.getenv']
         });
     }
     return {

package/queries/catalog/input-sources-query/input-sources-query-format.js

@@ -29,10 +29,10 @@ exports.InputSourcesDefinition = {
         const nast = (await analyzer.normalize()).idMap;
         for (const [key, sources] of Object.entries(out.results)) {
             result.push(`   ╰ Input Sources for ${key}`);
-            for (const { id, trace, type } of sources) {
+            for (const { id, trace, types } of sources) {
                 const kNode = nast.get(id);
                 const kLoc = kNode ? range_1.SourceLocation.format(range_1.SourceLocation.fromNode(kNode)) : 'unknown location';
-                result.push(`           ╰ ${kLoc} (id: ${id}), type: ${JSON.stringify(type)}, trace: ${trace}`);
+                result.push(`           ╰ ${kLoc} (id: ${id}), type: ${JSON.stringify(types)}, trace: ${trace}`);
             }
         }
         return true;
@@ -42,11 +42,14 @@ exports.InputSourcesDefinition = {
         type: joi_1.default.string().valid('input-sources').required().description('The type of the query.'),
         criterion: joi_1.default.string().required().description('The slicing criterion to use.'),
         config: joi_1.default.object({
-            networkFunctions: joi_1.default.array().items(joi_1.default.string()).optional().description('Functions that fetch data from the network.'),
-            randomnessConsumers: joi_1.default.array().items(joi_1.default.string()).optional().description('Functions that consume randomness.'),
-            randomnessProducers: joi_1.default.array().items(joi_1.default.object({ type: joi_1.default.string().valid('function', 'assignment'), name: joi_1.default.string().required() })).optional().description('Functions or assignments that produce randomness seeds.'),
-            configurableFunctions: joi_1.default.array().items(joi_1.default.string()).optional().description('Functions that read configuration (options/env).'),
-            pureFunctions: joi_1.default.array().items(joi_1.default.string()).optional().description('Deterministic functions that keep constant inputs constant.'),
+            pureFns: joi_1.default.array().items(joi_1.default.string()).optional().description('Deterministic/pure functions: functions that preserve constantness of their inputs (e.g., arithmetic, parse).'),
+            networkFns: joi_1.default.array().items(joi_1.default.string()).optional().description('Functions that fetch data from the network (e.g., download.file, url connections).'),
+            randomFns: joi_1.default.array().items(joi_1.default.string()).optional().description('Functions that produce randomness (e.g., runif, rnorm).'),
+            readFileFns: joi_1.default.array().items(joi_1.default.string()).optional().description('Functions that read from the filesystem and produce data (e.g., read.csv, readRDS).'),
+            systemFns: joi_1.default.array().items(joi_1.default.string()).optional().description('Functions that execute system commands (e.g., system, system2, shell, pipe).'),
+            ffiFns: joi_1.default.array().items(joi_1.default.string()).optional().description('Functions that call native code via the R FFI (.C, .Call, .Fortran, .External, dyn.load).'),
+            langFns: joi_1.default.array().items(joi_1.default.string()).optional().description('Functions that produce language objects (e.g., substitute, quote, bquote, expression).'),
+            optionsFns: joi_1.default.array().items(joi_1.default.string()).optional().description('Functions that access or set global options (e.g., options, getOption).'),
         }).optional()
     }).description('Input Sources query definition'),
     flattenInvolvedNodes: (queryResults) => {

package/queries/catalog/input-sources-query/simple-input-classifier.d.ts

@@ -8,13 +8,13 @@ import { Identifier } from '../../../dataflow/environments/identifier';
  * joining differing lattice elements.
  *
  *```
- *            [ Unknown ]
- *     /     /     |     \       \
- *[Param] [File] [Net] [Rand] [Scope]
- *     \     \    |      /      /
- *        [ DerivedConstant ]
- *               |
- *          [ Constant ]
+ *              [ Unknown ]
+ *                   |
+ * [Param] [File] [Net], ...
+ *                   |
+ *            [ DerivedConstant ]
+ *                   |
+ *              [ Constant ]
  *```
  *
  */
@@ -23,6 +23,14 @@ export declare enum InputType {
     File = "file",
     Network = "net",
     Random = "rand",
+    /** Calls to system/system2 and similar */
+    System = "system",
+    /** Calls to .C / Fortran interfaces */
+    Ffi = "ffi",
+    /** Language objects (quote/substitute/etc.) */
+    Lang = "lang",
+    /** Global options / option accessors (options, getOption) */
+    Options = "options",
     Constant = "const",
     /** Read from environment/call scope */
     Scope = "scope",
@@ -46,7 +54,7 @@ export declare enum InputTraceType {
  */
 export interface InputSource extends MergeableRecord {
     id: NodeId;
-    type: InputType[];
+    types: InputType[];
     trace: InputTraceType;
     /** if the trace is affected by control dependencies, they are classified too, this is a duplicate free array */
     cds?: InputType[];
@@ -81,6 +89,26 @@ export interface InputClassifierConfig extends MergeableRecord {
      * Functions that read from the file system
      */
     readFileFns: readonly InputClassifierFunctionIdentifier[];
+    /**
+     * Functions that call system utilities (system/system2)
+     */
+    systemFns?: readonly InputClassifierFunctionIdentifier[];
+    /**
+     * Functions that call native code via .C/.Fortran interfaces
+     */
+    ffiFns?: readonly InputClassifierFunctionIdentifier[];
+    /**
+     * Functions that produce language objects such as quote/substitute
+     */
+    langFns?: readonly InputClassifierFunctionIdentifier[];
+    /**
+     * Functions that access or set global options
+     */
+    optionsFns?: readonly InputClassifierFunctionIdentifier[];
+    /**
+     * For the scope escape analysis, pass on the full, non-reduced DFG here
+     */
+    fullDfg?: DataflowGraph;
 }
 /**
  * Takes the given id which is expected to either be:

package/queries/catalog/input-sources-query/simple-input-classifier.js

@@ -6,6 +6,7 @@ const graph_1 = require("../../../dataflow/graph/graph");
 const objects_1 = require("../../../util/objects");
 const vertex_1 = require("../../../dataflow/graph/vertex");
 const df_helper_1 = require("../../../dataflow/graph/df-helper");
+const edge_1 = require("../../../dataflow/graph/edge");
 const identifier_1 = require("../../../dataflow/environments/identifier");
 const assert_1 = require("../../../util/assert");
 const arrays_1 = require("../../../util/collections/arrays");
@@ -18,16 +19,20 @@ class InputClassifier {
         this.dfg = dfg;
         this.config = config;
     }
+    isDefinedByOnCall(id) {
+        const out = (this.config.fullDfg ?? this.dfg).outgoingEdges(id) ?? new Map();
+        return out.values().some(e => edge_1.DfEdge.includesType(e, edge_1.EdgeType.DefinedByOnCall));
+    }
     classifyEntry(vertex) {
         const cached = this.cache.get(vertex.id);
         if (cached) {
             return cached;
         }
         // insert temporary unknown to break cycles
-        this.cache.set(vertex.id, { id: vertex.id, type: [InputType.Unknown], trace: InputTraceType.Unknown });
+        this.cache.set(vertex.id, { id: vertex.id, types: [InputType.Unknown], trace: InputTraceType.Unknown });
         switch (vertex.tag) {
             case vertex_1.VertexType.Value:
-                return this.classifyCdsAndReturn(vertex, { id: vertex.id, type: [InputType.Constant], trace: InputTraceType.Unknown });
+                return this.classifyCdsAndReturn(vertex, { id: vertex.id, types: [InputType.Constant], trace: InputTraceType.Unknown });
             case vertex_1.VertexType.FunctionCall:
                 return this.classifyFunctionCall(vertex);
             case vertex_1.VertexType.VariableDefinition:
@@ -35,7 +40,7 @@ class InputClassifier {
             case vertex_1.VertexType.Use:
                 return this.classifyVariable(vertex);
             default:
-                return this.classifyCdsAndReturn(vertex, { id: vertex.id, type: [InputType.Unknown], trace: InputTraceType.Unknown });
+                return this.classifyCdsAndReturn(vertex, { id: vertex.id, types: [InputType.Unknown], trace: InputTraceType.Unknown });
         }
     }
     classifyFunctionCall(call) {
@@ -59,17 +64,29 @@ class InputClassifier {
         }
         if (!matchesList(call, this.config.pureFns)) {
             if (matchesList(call, this.config.readFileFns)) {
-                return this.classifyCdsAndReturn(call, { id: call.id, type: [InputType.File], trace: InputTraceType.Unknown });
+                return this.classifyCdsAndReturn(call, { id: call.id, types: [InputType.File], trace: InputTraceType.Unknown });
             }
             else if (matchesList(call, this.config.networkFns)) {
-                return this.classifyCdsAndReturn(call, { id: call.id, type: [InputType.Network], trace: InputTraceType.Unknown });
+                return this.classifyCdsAndReturn(call, { id: call.id, types: [InputType.Network], trace: InputTraceType.Unknown });
             }
             else if (matchesList(call, this.config.randomFns)) {
-                return this.classifyCdsAndReturn(call, { id: call.id, type: [InputType.Random], trace: InputTraceType.Unknown });
+                return this.classifyCdsAndReturn(call, { id: call.id, types: [InputType.Random], trace: InputTraceType.Unknown });
+            }
+            else if (matchesList(call, this.config.systemFns)) {
+                return this.classifyCdsAndReturn(call, { id: call.id, types: [InputType.System], trace: InputTraceType.Unknown });
+            }
+            else if (matchesList(call, this.config.ffiFns)) {
+                return this.classifyCdsAndReturn(call, { id: call.id, types: [InputType.Ffi], trace: InputTraceType.Unknown });
+            }
+            else if (matchesList(call, this.config.langFns)) {
+                return this.classifyCdsAndReturn(call, { id: call.id, types: [InputType.Lang], trace: InputTraceType.Unknown });
+            }
+            else if (matchesList(call, this.config.optionsFns)) {
+                return this.classifyCdsAndReturn(call, { id: call.id, types: [InputType.Options], trace: InputTraceType.Unknown });
             }
             else {
                 // if it is not pure, we cannot classify based on the inputs, in that case we do not know!
-                return this.classifyCdsAndReturn(call, { id: call.id, type: [InputType.Unknown], trace: InputTraceType.Unknown });
+                return this.classifyCdsAndReturn(call, { id: call.id, types: [InputType.Unknown], trace: InputTraceType.Unknown });
             }
         }
         // Otherwise, classify by arguments; pure functions get Known/Pure handling
@@ -91,7 +108,7 @@ class InputClassifier {
             }
             const classified = this.classifyEntry(argVtx);
             // collect all observed types from this argument
-            argTypes.push(...classified.type);
+            argTypes.push(...classified.types);
             if (classified.cds) {
                 cdTypes.push(...classified.cds);
             }
@@ -100,15 +117,15 @@ class InputClassifier {
         // all arguments only contain constant-like types -> derived constant
         const allConstLike = argTypes.length > 0 && argTypes.every(t => t === InputType.Constant || t === InputType.DerivedConstant);
         if (allConstLike) {
-            return this.classifyCdsAndReturn(call, (0, objects_1.compactRecord)({ id: call.id, type: [InputType.DerivedConstant], trace: InputTraceType.Pure, cds }));
+            return this.classifyCdsAndReturn(call, (0, objects_1.compactRecord)({ id: call.id, types: [InputType.DerivedConstant], trace: InputTraceType.Pure, cds }));
         }
         argTypes.push(InputType.DerivedConstant);
-        return this.classifyCdsAndReturn(call, (0, objects_1.compactRecord)({ id: call.id, type: (0, arrays_1.uniqueArray)(argTypes), trace: InputTraceType.Known, cds }));
+        return this.classifyCdsAndReturn(call, (0, objects_1.compactRecord)({ id: call.id, types: (0, arrays_1.uniqueArray)(argTypes), trace: InputTraceType.Known, cds }));
     }
     classifyVariable(vtx) {
         const origins = df_helper_1.Dataflow.origin(this.dfg, vtx.id);
         if (origins === undefined) {
-            return this.classifyCdsAndReturn(vtx, { id: vtx.id, type: [InputType.Unknown], trace: InputTraceType.Unknown });
+            return this.classifyCdsAndReturn(vtx, { id: vtx.id, types: this.isDefinedByOnCall(vtx.id) ? [InputType.Scope] : [InputType.Unknown], trace: InputTraceType.Unknown });
         }
         const types = [];
         const cds = [];
@@ -121,13 +138,19 @@ class InputClassifier {
             if (o.type === 0 /* OriginType.ReadVariableOrigin */ || o.type === 1 /* OriginType.WriteVariableOrigin */) {
                 const v = this.dfg.getVertex(o.id);
                 if (v) {
+                    // if the referenced definition is linked via defined-by-on-call to another
+                    // id (e.g., a parameter linked to a caller argument), mark it as a Scope origin
+                    if (this.isDefinedByOnCall(v.id)) {
+                        types.push(InputType.Scope);
+                        allPure = false;
+                    }
                     // if this is a variable definition that is a parameter, classify as Parameter
                     if (v.tag === vertex_1.VertexType.VariableDefinition && this.dfg.idMap?.get(v.id)?.info.role === "param-n" /* RoleInParent.ParameterName */) {
                         types.push(InputType.Parameter);
                         continue;
                     }
                     const c = this.classifyEntry(v);
-                    types.push(...c.type);
+                    types.push(...c.types);
                     if (c.cds) {
                         cds.push(...c.cds);
                     }
@@ -144,7 +167,7 @@ class InputClassifier {
                 const v = this.dfg.getVertex(o.id);
                 if (v) {
                     const c = this.classifyEntry(v);
-                    types.push(...c.type);
+                    types.push(...c.types);
                     if (c.cds) {
                         cds.push(...c.cds);
                     }
@@ -162,17 +185,17 @@ class InputClassifier {
         }
         const t = types.length === 0 ? [InputType.Unknown] : (0, arrays_1.uniqueArray)(types);
         const trace = allPure ? InputTraceType.Pure : InputTraceType.Alias;
-        return this.classifyCdsAndReturn(vtx, { id: vtx.id, type: t, trace, cds: cds.length === 0 ? undefined : (0, arrays_1.uniqueArray)(cds) });
+        return this.classifyCdsAndReturn(vtx, { id: vtx.id, types: t, trace, cds: cds.length === 0 ? undefined : (0, arrays_1.uniqueArray)(cds) });
     }
     classifyVariableDefinition(vtx) {
         // parameter definitions are classified as Parameter
         if (this.dfg.idMap?.get(vtx.id)?.info.role === "param-n" /* RoleInParent.ParameterName */) {
-            return this.classifyCdsAndReturn(vtx, { id: vtx.id, type: [InputType.Parameter], trace: InputTraceType.Unknown });
+            return this.classifyCdsAndReturn(vtx, { id: vtx.id, types: [InputType.Parameter], trace: InputTraceType.Unknown });
         }
         const sources = vtx.source;
         if (sources === undefined || sources.length === 0) {
             // fallback to unknown if we cannot find the value
-            return this.classifyCdsAndReturn(vtx, { id: vtx.id, type: [InputType.Unknown], trace: InputTraceType.Unknown });
+            return this.classifyCdsAndReturn(vtx, { id: vtx.id, types: [InputType.Unknown], trace: InputTraceType.Unknown });
         }
         const types = [];
         const cds = [];
@@ -181,7 +204,7 @@ class InputClassifier {
             const tv = this.dfg.getVertex(tid);
             if (tv) {
                 const c = this.classifyEntry(tv);
-                types.push(...c.type);
+                types.push(...c.types);
                 if (c.cds) {
                     cds.push(...c.cds);
                 }
@@ -195,7 +218,7 @@ class InputClassifier {
         }
         const t = types.length === 0 ? [InputType.Unknown] : (0, arrays_1.uniqueArray)(types);
         const trace = allPure ? InputTraceType.Pure : InputTraceType.Alias;
-        return this.classifyCdsAndReturn(vtx, { id: vtx.id, type: t, trace, cds: cds.length === 0 ? undefined : (0, arrays_1.uniqueArray)(cds) });
+        return this.classifyCdsAndReturn(vtx, { id: vtx.id, types: t, trace, cds: cds.length === 0 ? undefined : (0, arrays_1.uniqueArray)(cds) });
     }
     classifyCdsAndReturn(vtx, src) {
         if (vtx.cds) {
@@ -205,7 +228,7 @@ class InputClassifier {
                     return undefined;
                 }
                 const e = this.classifyEntry(cv);
-                return e.cds ? [...e.type, ...e.cds] : [...e.type];
+                return e.cds ? [...e.types, ...e.cds] : [...e.types];
             }).filter(assert_1.isNotUndefined).concat(src.cds ?? []));
             if (cds.length > 0) {
                 src.cds = cds;
@@ -224,13 +247,13 @@ class InputClassifier {
  * joining differing lattice elements.
  *
  *```
- *            [ Unknown ]
- *     /     /     |     \       \
- *[Param] [File] [Net] [Rand] [Scope]
- *     \     \    |      /      /
- *        [ DerivedConstant ]
- *               |
- *          [ Constant ]
+ *              [ Unknown ]
+ *                   |
+ * [Param] [File] [Net], ...
+ *                   |
+ *            [ DerivedConstant ]
+ *                   |
+ *              [ Constant ]
  *```
  *
  */
@@ -240,6 +263,14 @@ var InputType;
     InputType["File"] = "file";
     InputType["Network"] = "net";
     InputType["Random"] = "rand";
+    /** Calls to system/system2 and similar */
+    InputType["System"] = "system";
+    /** Calls to .C / Fortran interfaces */
+    InputType["Ffi"] = "ffi";
+    /** Language objects (quote/substitute/etc.) */
+    InputType["Lang"] = "lang";
+    /** Global options / option accessors (options, getOption) */
+    InputType["Options"] = "options";
     InputType["Constant"] = "const";
     /** Read from environment/call scope */
     InputType["Scope"] = "scope";

package/util/version.js

@@ -6,7 +6,7 @@ exports.printVersionInformation = printVersionInformation;
 const semver_1 = require("semver");
 const assert_1 = require("./assert");
 // this is automatically replaced with the current version by release-it
-const version = '2.10.3';
+const version = '2.10.4';
 /**
  * Retrieves the current flowR version as a new {@link SemVer} object.
  */

package/linter/rules/problematic-eval.js

@@ -1,83 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PROBLEMATIC_EVAL = void 0;
-const linter_format_1 = require("../linter-format");
-const flowr_search_builder_1 = require("../../search/flowr-search-builder");
-const range_1 = require("../../util/range");
-const linter_tags_1 = require("../linter-tags");
-const simple_input_classifier_1 = require("../../queries/catalog/input-sources-query/simple-input-classifier");
-const query_1 = require("../../queries/query");
-const parse_1 = require("../../slicing/criterion/parse");
-/**
- * Format a list of input sources either as a single-line string (inline) or a block.
- * - inline: returns a semicolon-separated single-line summary
- * - block: returns an array of lines (to be joined with newlines by the caller)
- */
-function formatInputSources(inputs, inline = true) {
-    if (!inputs || inputs.length === 0) {
-        return inline ? '' : [];
-    }
-    if (inline) {
-        return inputs.map(s => `${s.id} (type: ${Array.isArray(s.type) ? '[' + s.type.join(',') + ']' : s.type}, trace: ${s.trace}${s.cds ? ', cds: [' + s.cds.join(',') + ']' : ''})`).join('; ');
-    }
-    return inputs.map(s => `- ${s.id}: type=${Array.isArray(s.type) ? '[' + s.type.join(',') + ']' : s.type}, trace=${s.trace}${s.cds ? ', cds=[' + s.cds.join(',') + ']' : ''}`);
-}
-exports.PROBLEMATIC_EVAL = {
-    /* create a search that finds calls that look like eval-like functions */
-    createSearch: config => flowr_search_builder_1.Q.fromQuery({
-        type: 'call-context',
-        callName: config.considerAsEval,
-        callNameExact: false
-    }),
-    processSearchResult: async (elements, _config, data) => {
-        const results = [];
-        for (const element of elements.getElements()) {
-            const nid = element.node.info.id;
-            // run an input-sources query for this eval-like call
-            const criterion = parse_1.SlicingCriterion.fromId(nid);
-            const q = { type: 'input-sources', criterion };
-            const all = await (0, query_1.executeQueries)({ analyzer: data.analyzer }, [q]);
-            const inputSourcesResult = all['input-sources'];
-            const sources = inputSourcesResult?.results?.[criterion] ?? [];
-            // if any input is not a constant or derived constant, flag it
-            const problematic = sources.some(s => Array.isArray(s.type)
-                ? s.type.some(t => t !== simple_input_classifier_1.InputType.Constant && t !== simple_input_classifier_1.InputType.DerivedConstant)
-                : (s.type !== simple_input_classifier_1.InputType.Constant && s.type !== simple_input_classifier_1.InputType.DerivedConstant));
-            if (problematic) {
-                results.push({
-                    involvedId: nid,
-                    certainty: sources.some(s => Array.isArray(s.type) ? s.type.includes(simple_input_classifier_1.InputType.Unknown) : s.type === simple_input_classifier_1.InputType.Unknown) ? linter_format_1.LintingResultCertainty.Uncertain : linter_format_1.LintingResultCertainty.Certain,
-                    loc: range_1.SourceLocation.fromNode(element.node) ?? range_1.SourceLocation.invalid(),
-                    sources
-                });
-            }
-        }
-        return {
-            results,
-            '.meta': {}
-        };
-    },
-    /* helper to format input sources for pretty printing */
-    prettyPrint: {
-        [linter_format_1.LintingPrettyPrintContext.Query]: result => {
-            const inputs = result.sources ?? [];
-            const srcStr = formatInputSources(inputs, true);
-            return `Use of eval-like function at ${range_1.SourceLocation.format(result.loc)}${srcStr ? `; inputs: ${srcStr}` : ''}`;
-        },
-        [linter_format_1.LintingPrettyPrintContext.Full]: result => {
-            const inputs = result.sources ?? [];
-            const srcLines = formatInputSources(inputs, false);
-            return `Use of eval-like function at ${range_1.SourceLocation.format(result.loc)} is potentially problematic${srcLines.length ? '\nInputs:\n' + srcLines.join('\n') : ''}`;
-        }
-    },
-    info: {
-        name: 'Problematic eval',
-        description: 'Detects uses of eval-like functions whose inputs are not statically constant. Prints the computed input-sources for the eval and flags usages that depend on non-constant/trusted inputs.',
-        tags: [linter_tags_1.LintingRuleTag.Security, linter_tags_1.LintingRuleTag.Smell, linter_tags_1.LintingRuleTag.Readability, linter_tags_1.LintingRuleTag.Performance],
-        certainty: linter_format_1.LintingRuleCertainty.BestEffort,
-        defaultConfig: {
-            considerAsEval: '^eval$'
-        }
-    }
-};
-//# sourceMappingURL=problematic-eval.js.map