@oculum/scanner 1.0.13 → 1.0.15

package/src/__tests__/taint/llm-flow-graph.test.ts

@@ -0,0 +1,850 @@
+/**
+ * LLM Flow Graph Tests — Phase 4
+ *
+ * Tests LLM-specific taint flows: prompt injection (user input → LLM prompt sinks)
+ * and unsafe execution (LLM output → execution sinks). Covers all 7 LLM SDK
+ * sink patterns, import-aware source detection, prompt-specific sanitizers,
+ * and negative cases.
+ *
+ * Uses inlined Parser instances (not shared parseFile) to avoid tree-sitter
+ * native addon corruption across Jest workers.
+ */
+
+import Parser from 'tree-sitter'
+import { createHash } from 'crypto'
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const { typescript: TypeScript } = require('tree-sitter-typescript')
+import type { ParsedAST } from '../../parse/ast'
+import { clearASTCache } from '../../parse/ast'
+import type { TaintFinding } from '../../taint/propagation-types'
+import { analyzeTaintsForFile } from '../../taint/taint-analyzer'
+import { classifySinks } from '../../taint/sink-classifier'
+import { classifySources } from '../../taint/source-classifier'
+import { buildSanitizerRegistry } from '../../taint/sanitizer-registry'
+import { clearTaintFlowCache } from '../../detect/ast-rules/taint-flow-ast'
+
+// Dedicated parser for this test file
+const tsParser = new Parser()
+tsParser.setLanguage(TypeScript)
+
+let counter = 0
+
+beforeEach(() => {
+  clearASTCache()
+  clearTaintFlowCache()
+})
+
+function makeAST(code: string): ParsedAST {
+  const fp = `llm-flow-test-${++counter}.ts`
+  const tree = tsParser.parse(code)
+  const hash = createHash('sha1').update(code + counter).digest('hex')
+  return { tree, language: 'typescript', filePath: fp, hash }
+}
+
+function analyze(code: string): TaintFinding[] {
+  const ast = makeAST(code)
+  return analyzeTaintsForFile(ast, ast.filePath)
+}
+
+function getSinks(code: string) {
+  const ast = makeAST(code)
+  return classifySinks(ast)
+}
+
+function getSources(code: string) {
+  const ast = makeAST(code)
+  return classifySources(ast)
+}
+
+function getSanitizers(code: string) {
+  const ast = makeAST(code)
+  return buildSanitizerRegistry(ast)
+}
+
+function hasKind(finding: TaintFinding, kind: string): boolean {
+  return finding.matchingKinds.has(kind as any)
+}
+
+// ============================================================================
+// A. Sink Detection (14 tests)
+// ============================================================================
+describe('A. LLM Sink Detection', () => {
+  it('1. OpenAI completions.create with user role — no prompt sink (user role is intended for user input)', () => {
+    const sinks = getSinks(`
+      import OpenAI from 'openai'
+      const openai = new OpenAI()
+      async function chat(input: string) {
+        const response = await openai.chat.completions.create({
+          model: 'gpt-4',
+          messages: [{ role: 'user', content: input }],
+        })
+      }
+    `)
+    const promptSinks = sinks.filter(s => s.sinkType === 'prompt_construction' || s.sinkType === 'system_prompt')
+    expect(promptSinks.length).toBe(0)
+  })
+
+  it('2. OpenAI system message → system_prompt sink', () => {
+    const sinks = getSinks(`
+      import OpenAI from 'openai'
+      const openai = new OpenAI()
+      async function chat(input: string) {
+        await openai.chat.completions.create({
+          model: 'gpt-4',
+          messages: [{ role: 'system', content: input }],
+        })
+      }
+    `)
+    const systemSinks = sinks.filter(s => s.sinkType === 'system_prompt')
+    expect(systemSinks.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('3. Anthropic messages.create with dynamic system param', () => {
+    const sinks = getSinks(`
+      import Anthropic from '@anthropic-ai/sdk'
+      const anthropic = new Anthropic()
+      async function chat(systemPrompt: string) {
+        await anthropic.messages.create({
+          model: 'claude-3-5-sonnet',
+          system: systemPrompt,
+          messages: [{ role: 'user', content: 'hello' }],
+        })
+      }
+    `)
+    const systemSinks = sinks.filter(s => s.sinkType === 'system_prompt')
+    expect(systemSinks.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('4. Vercel AI SDK generateText with dynamic prompt', () => {
+    const sinks = getSinks(`
+      import { generateText } from 'ai'
+      async function chat(userInput: string) {
+        await generateText({
+          model: openai('gpt-4'),
+          prompt: userInput,
+        })
+      }
+    `)
+    const promptSinks = sinks.filter(s => s.sinkType === 'prompt_construction')
+    expect(promptSinks.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('5. Vercel AI SDK generateText with dynamic system', () => {
+    const sinks = getSinks(`
+      import { generateText } from 'ai'
+      async function chat(sysPrompt: string) {
+        await generateText({
+          model: openai('gpt-4'),
+          system: sysPrompt,
+          prompt: 'hello',
+        })
+      }
+    `)
+    const systemSinks = sinks.filter(s => s.sinkType === 'system_prompt')
+    expect(systemSinks.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('6. LangChain new SystemMessage with dynamic content', () => {
+    const sinks = getSinks(`
+      import { SystemMessage } from '@langchain/core/messages'
+      function buildPrompt(text: string) {
+        return new SystemMessage(text)
+      }
+    `)
+    const systemSinks = sinks.filter(s => s.sinkType === 'system_prompt')
+    expect(systemSinks.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('7. LangChain new HumanMessage with dynamic content', () => {
+    const sinks = getSinks(`
+      import { HumanMessage } from '@langchain/core/messages'
+      function buildPrompt(text: string) {
+        return new HumanMessage(text)
+      }
+    `)
+    const promptSinks = sinks.filter(s => s.sinkType === 'prompt_construction')
+    expect(promptSinks.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('8. Google AI generateContent with dynamic arg', () => {
+    const sinks = getSinks(`
+      import { GoogleGenerativeAI } from '@google/generative-ai'
+      const genAI = new GoogleGenerativeAI('key')
+      const model = genAI.getGenerativeModel({ model: 'gemini-pro' })
+      async function chat(userInput: string) {
+        await model.generateContent(userInput)
+      }
+    `)
+    const promptSinks = sinks.filter(s => s.sinkType === 'prompt_construction')
+    expect(promptSinks.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('9. Generic model.chat with dynamic arg on LLM client', () => {
+    const sinks = getSinks(`
+      import OpenAI from 'openai'
+      const client = new OpenAI()
+      async function chat(input: string) {
+        await client.chat(input)
+      }
+    `)
+    const promptSinks = sinks.filter(s => s.sinkType === 'prompt_construction')
+    expect(promptSinks.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('10. messages.push with user role — no prompt sink (user role is intended for user input)', () => {
+    const sinks = getSinks(`
+      function buildMessages(userInput: string) {
+        const messages: any[] = []
+        messages.push({ role: 'user', content: userInput })
+      }
+    `)
+    const promptSinks = sinks.filter(s => s.sinkType === 'prompt_construction')
+    expect(promptSinks.length).toBe(0)
+  })
+
+  it('11. messages.push with system role → system_prompt', () => {
+    const sinks = getSinks(`
+      function buildMessages(sysPrompt: string) {
+        const messages: any[] = []
+        messages.push({ role: 'system', content: sysPrompt })
+      }
+    `)
+    const systemSinks = sinks.filter(s => s.sinkType === 'system_prompt')
+    expect(systemSinks.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('12. static content in OpenAI messages → no prompt sink', () => {
+    const sinks = getSinks(`
+      import OpenAI from 'openai'
+      const openai = new OpenAI()
+      async function chat() {
+        await openai.chat.completions.create({
+          model: 'gpt-4',
+          messages: [{ role: 'user', content: 'Hello, how are you?' }],
+        })
+      }
+    `)
+    const promptSinks = sinks.filter(s => s.sinkType === 'prompt_construction' || s.sinkType === 'system_prompt')
+    expect(promptSinks.length).toBe(0)
+  })
+
+  it('13. static content in LangChain message → no sink', () => {
+    const sinks = getSinks(`
+      import { SystemMessage } from '@langchain/core/messages'
+      function buildPrompt() {
+        return new SystemMessage('You are a helpful assistant')
+      }
+    `)
+    const promptSinks = sinks.filter(s => s.sinkType === 'system_prompt')
+    expect(promptSinks.length).toBe(0)
+  })
+
+  it('14. Vercel AI SDK streamText with dynamic prompt', () => {
+    const sinks = getSinks(`
+      import { streamText } from 'ai'
+      async function chat(userInput: string) {
+        await streamText({
+          model: openai('gpt-4'),
+          prompt: userInput,
+        })
+      }
+    `)
+    const promptSinks = sinks.filter(s => s.sinkType === 'prompt_construction')
+    expect(promptSinks.length).toBeGreaterThanOrEqual(1)
+  })
+})
+
+// ============================================================================
+// B. Source Detection (8 tests)
+// ============================================================================
+describe('B. LLM Source Detection', () => {
+  it('1. OpenAI response.choices[0].message.content → llm_output source', () => {
+    const sources = getSources(`
+      async function handler() {
+        const response = await openai.chat.completions.create({ messages: [] })
+        const text = response.choices[0].message.content
+        return text
+      }
+    `)
+    const llmSources = sources.filter(s => s.sourceType === 'llm_output')
+    expect(llmSources.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('2. Vercel AI SDK result.text → llm_output source', () => {
+    const sources = getSources(`
+      import { generateText } from 'ai'
+      async function handler() {
+        const result = await generateText({ model: openai('gpt-4'), prompt: 'hello' })
+        const output = result.text
+      }
+    `)
+    const llmSources = sources.filter(s => s.sourceType === 'llm_output')
+    expect(llmSources.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('3. Anthropic response.content[0].text → llm_output source', () => {
+    const sources = getSources(`
+      async function handler() {
+        const response = await anthropic.messages.create({ messages: [] })
+        const text = response.content[0].text
+      }
+    `)
+    const llmSources = sources.filter(s => s.sourceType === 'llm_output')
+    expect(llmSources.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('4. Google AI response.candidates[0].content → llm_output source', () => {
+    const sources = getSources(`
+      async function handler() {
+        const response = await model.generateContent('hello')
+        const text = response.candidates[0].content
+      }
+    `)
+    const llmSources = sources.filter(s => s.sourceType === 'llm_output')
+    expect(llmSources.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('5. import-aware: OpenAI create() return → llm_output source', () => {
+    const sources = getSources(`
+      import OpenAI from 'openai'
+      const openai = new OpenAI()
+      async function handler() {
+        const result = await openai.chat.completions.create({
+          model: 'gpt-4',
+          messages: [{ role: 'user', content: 'hello' }],
+        })
+      }
+    `)
+    const llmSources = sources.filter(s => s.sourceType === 'llm_output')
+    expect(llmSources.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('6. import-aware: Vercel AI SDK generateText return → llm_output', () => {
+    const sources = getSources(`
+      import { generateText } from 'ai'
+      async function handler() {
+        const result = await generateText({ model: openai('gpt-4'), prompt: 'hello' })
+      }
+    `)
+    const llmSources = sources.filter(s => s.sourceType === 'llm_output')
+    expect(llmSources.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('7. llm_output source has prompt taint kind', () => {
+    const sources = getSources(`
+      async function handler() {
+        const response = await openai.chat.completions.create({ messages: [] })
+        const text = response.choices[0].message.content
+      }
+    `)
+    const llmSources = sources.filter(s => s.sourceType === 'llm_output')
+    expect(llmSources.length).toBeGreaterThanOrEqual(1)
+    // llm_output should carry command, sql, xss, path, prompt kinds
+    const kinds = llmSources[0].taintKinds
+    expect(kinds.has('command')).toBe(true)
+    expect(kinds.has('xss')).toBe(true)
+    expect(kinds.has('prompt')).toBe(true)
+  })
+
+  it('8. non-LLM function call return is not tagged as llm_output', () => {
+    const sources = getSources(`
+      async function handler() {
+        const result = await fetch('https://api.example.com/data')
+        const data = await result.json()
+      }
+    `)
+    const llmSources = sources.filter(s => s.sourceType === 'llm_output')
+    expect(llmSources.length).toBe(0)
+  })
+})
+
+// ============================================================================
+// C. Prompt Injection E2E (10 tests)
+// ============================================================================
+describe('C. Prompt Injection E2E', () => {
+  it('1. req.body → OpenAI system prompt', () => {
+    const findings = analyze(`
+      import OpenAI from 'openai'
+      const openai = new OpenAI()
+      async function handler(req: Request) {
+        const input = req.body
+        await openai.chat.completions.create({
+          model: 'gpt-4',
+          messages: [{ role: 'system', content: input }],
+        })
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'prompt'))).toBe(true)
+  })
+
+  it('2. req.body → Anthropic system param', () => {
+    const findings = analyze(`
+      import Anthropic from '@anthropic-ai/sdk'
+      const anthropic = new Anthropic()
+      async function handler(req: Request) {
+        const input = req.body
+        await anthropic.messages.create({
+          model: 'claude-3-5-sonnet',
+          system: input,
+          messages: [],
+        })
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'prompt'))).toBe(true)
+  })
+
+  it('3. req.body → Vercel AI SDK prompt', () => {
+    const findings = analyze(`
+      import { generateText } from 'ai'
+      async function handler(req: Request) {
+        const input = req.body
+        await generateText({
+          model: openai('gpt-4'),
+          prompt: input,
+        })
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'prompt'))).toBe(true)
+  })
+
+  it('4. req.body → LangChain SystemMessage', () => {
+    const findings = analyze(`
+      import { SystemMessage } from '@langchain/core/messages'
+      function handler(req: Request) {
+        const input = req.body
+        const msg = new SystemMessage(input)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'prompt'))).toBe(true)
+  })
+
+  it('5. req.body → Google AI generateContent', () => {
+    const findings = analyze(`
+      import { GoogleGenerativeAI } from '@google/generative-ai'
+      const genAI = new GoogleGenerativeAI('key')
+      const model = genAI.getGenerativeModel({ model: 'gemini-pro' })
+      async function handler(req: Request) {
+        const input = req.body
+        await model.generateContent(input)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'prompt'))).toBe(true)
+  })
+
+  it('6. req.body → messages.push user message — no finding (user role is safe)', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const input = req.body
+        const messages: any[] = []
+        messages.push({ role: 'user', content: input })
+      }
+    `)
+    // User-role messages are the intended place for user input — no prompt injection
+    expect(findings.length).toBe(0)
+  })
+
+  it('7. template literal with user input → prompt sink', () => {
+    const findings = analyze(`
+      import { generateText } from 'ai'
+      async function handler(req: Request) {
+        const userMsg = req.body
+        await generateText({
+          model: openai('gpt-4'),
+          prompt: \`You are a helpful assistant. User says: \${userMsg}\`,
+        })
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'prompt'))).toBe(true)
+  })
+
+  it('8. multi-step propagation: req.body → variable → prompt', () => {
+    const findings = analyze(`
+      import { generateText } from 'ai'
+      async function handler(req: Request) {
+        const raw = req.body
+        const processed = raw.trim()
+        const message = processed
+        await generateText({
+          model: openai('gpt-4'),
+          prompt: message,
+        })
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'prompt'))).toBe(true)
+  })
+
+  it('9. hardcoded prompt → no finding', () => {
+    const findings = analyze(`
+      import { generateText } from 'ai'
+      async function handler() {
+        await generateText({
+          model: openai('gpt-4'),
+          prompt: 'Tell me a joke',
+        })
+      }
+    `)
+    const promptFindings = findings.filter(f => hasKind(f, 'prompt'))
+    expect(promptFindings.length).toBe(0)
+  })
+
+  it('10. req.query → Vercel AI SDK system param', () => {
+    const findings = analyze(`
+      import { streamText } from 'ai'
+      async function handler(req: Request) {
+        const personality = req.query
+        await streamText({
+          model: openai('gpt-4'),
+          system: personality,
+          prompt: 'hello',
+        })
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'prompt'))).toBe(true)
+  })
+})
+
+// ============================================================================
+// D. Unsafe Execution E2E (10 tests)
+// ============================================================================
+describe('D. Unsafe Execution E2E', () => {
+  it('1. LLM output → eval', () => {
+    const findings = analyze(`
+      async function handler() {
+        const response = await openai.chat.completions.create({ messages: [] })
+        const code = response.choices[0].message.content
+        eval(code)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'command'))).toBe(true)
+  })
+
+  it('2. LLM output → child_process exec', () => {
+    const findings = analyze(`
+      import { exec } from 'child_process'
+      async function handler() {
+        const response = await openai.chat.completions.create({ messages: [] })
+        const cmd = response.choices[0].message.content
+        exec(cmd)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'command'))).toBe(true)
+  })
+
+  it('3. LLM output → innerHTML', () => {
+    const findings = analyze(`
+      async function handler() {
+        const response = await openai.chat.completions.create({ messages: [] })
+        const html = response.choices[0].message.content
+        document.getElementById('output').innerHTML = html
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'xss'))).toBe(true)
+  })
+
+  it('4. LLM output → SQL query', () => {
+    const findings = analyze(`
+      async function handler() {
+        const response = await openai.chat.completions.create({ messages: [] })
+        const query = response.choices[0].message.content
+        db.query(query)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'sql'))).toBe(true)
+  })
+
+  it('5. LLM output → file write', () => {
+    const findings = analyze(`
+      async function handler() {
+        const response = await openai.chat.completions.create({ messages: [] })
+        const data = response.choices[0].message.content
+        fs.writeFile('/tmp/output.txt', data)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    // file_write is vulnerable to 'path' kind
+    expect(findings.some(f => hasKind(f, 'path'))).toBe(true)
+  })
+
+  it('6. import-aware: OpenAI return → eval', () => {
+    const findings = analyze(`
+      import OpenAI from 'openai'
+      const openai = new OpenAI()
+      async function handler() {
+        const result = await openai.chat.completions.create({
+          model: 'gpt-4',
+          messages: [{ role: 'user', content: 'write code' }],
+        })
+        eval(result)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'command'))).toBe(true)
+  })
+
+  it('7. import-aware: Vercel AI SDK return → eval', () => {
+    const findings = analyze(`
+      import { generateText } from 'ai'
+      async function handler() {
+        const result = await generateText({ model: openai('gpt-4'), prompt: 'code' })
+        eval(result)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'command'))).toBe(true)
+  })
+
+  it('8. destructured LLM output → eval', () => {
+    const findings = analyze(`
+      import { generateText } from 'ai'
+      async function handler() {
+        const { text } = await generateText({ model: openai('gpt-4'), prompt: 'code' })
+        eval(text)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'command'))).toBe(true)
+  })
+
+  it('9. LLM output displayed only (console.log) → no execution finding', () => {
+    const findings = analyze(`
+      async function handler() {
+        const response = await openai.chat.completions.create({ messages: [] })
+        const text = response.choices[0].message.content
+        console.log(text)
+      }
+    `)
+    // console.log is not a dangerous sink
+    const execFindings = findings.filter(f => hasKind(f, 'command') || hasKind(f, 'sql'))
+    expect(execFindings.length).toBe(0)
+  })
+
+  it('10. LLM output → fetch does NOT produce ssrf (ssrf not in llm_output kinds)', () => {
+    const findings = analyze(`
+      async function handler() {
+        const response = await openai.chat.completions.create({ messages: [] })
+        const url = response.choices[0].message.content
+        fetch(url)
+      }
+    `)
+    // llm_output source carries: command, sql, xss, path, prompt — but NOT ssrf
+    // fetch sink requires ssrf kind → no overlap → no finding
+    const ssrfFindings = findings.filter(f => hasKind(f, 'ssrf'))
+    expect(ssrfFindings.length).toBe(0)
+  })
+})
+
+// ============================================================================
+// E. Sanitizer Coverage (7 tests)
+// ============================================================================
+describe('E. Sanitizer Coverage', () => {
+  it('1. sanitizePrompt() clears prompt taint', () => {
+    const findings = analyze(`
+      import { generateText } from 'ai'
+      async function handler(req: Request) {
+        const input = req.body
+        const safe = sanitizePrompt(input)
+        await generateText({
+          model: openai('gpt-4'),
+          prompt: safe,
+        })
+      }
+    `)
+    const promptFindings = findings.filter(f => hasKind(f, 'prompt'))
+    expect(promptFindings.length).toBe(0)
+  })
+
+  it('2. promptGuard() clears prompt taint', () => {
+    const findings = analyze(`
+      import { generateText } from 'ai'
+      async function handler(req: Request) {
+        const input = req.body
+        const safe = promptGuard(input)
+        await generateText({
+          model: openai('gpt-4'),
+          prompt: safe,
+        })
+      }
+    `)
+    const promptFindings = findings.filter(f => hasKind(f, 'prompt'))
+    expect(promptFindings.length).toBe(0)
+  })
+
+  it('3. filterJailbreak() clears prompt taint', () => {
+    const findings = analyze(`
+      import { generateText } from 'ai'
+      async function handler(req: Request) {
+        const input = req.body
+        const safe = filterJailbreak(input)
+        await generateText({
+          model: openai('gpt-4'),
+          prompt: safe,
+        })
+      }
+    `)
+    const promptFindings = findings.filter(f => hasKind(f, 'prompt'))
+    expect(promptFindings.length).toBe(0)
+  })
+
+  it('4. detectInjection() clears prompt taint', () => {
+    const findings = analyze(`
+      import { generateText } from 'ai'
+      async function handler(req: Request) {
+        const input = req.body
+        const safe = detectInjection(input)
+        await generateText({
+          model: openai('gpt-4'),
+          prompt: safe,
+        })
+      }
+    `)
+    const promptFindings = findings.filter(f => hasKind(f, 'prompt'))
+    expect(promptFindings.length).toBe(0)
+  })
+
+  it('5. OpenAI moderation API clears prompt taint', () => {
+    const sanitizers = getSanitizers(`
+      import OpenAI from 'openai'
+      const openai = new OpenAI()
+      async function moderate(text: string) {
+        const result = await openai.moderations.create({ input: text })
+        return result
+      }
+    `)
+    const modSanitizers = sanitizers.filter(s => s.name.includes('moderations'))
+    expect(modSanitizers.length).toBeGreaterThanOrEqual(1)
+    expect([...modSanitizers[0].clearsKinds]).toContain('prompt')
+  })
+
+  it('6. DOMPurify does NOT clear prompt taint', () => {
+    const findings = analyze(`
+      import DOMPurify from 'dompurify'
+      import { generateText } from 'ai'
+      async function handler(req: Request) {
+        const input = req.body
+        const safe = DOMPurify.sanitize(input)
+        await generateText({
+          model: openai('gpt-4'),
+          prompt: safe,
+        })
+      }
+    `)
+    // DOMPurify clears xss but NOT prompt
+    const promptFindings = findings.filter(f => hasKind(f, 'prompt'))
+    expect(promptFindings.length).toBeGreaterThanOrEqual(1)
+  })
+
+  it('7. parseInt clears all taint including prompt', () => {
+    const findings = analyze(`
+      import { generateText } from 'ai'
+      async function handler(req: Request) {
+        const input = req.body
+        const safe = parseInt(input)
+        await generateText({
+          model: openai('gpt-4'),
+          prompt: safe,
+        })
+      }
+    `)
+    expect(findings.length).toBe(0)
+  })
+})
+
+// ============================================================================
+// F. Negative Cases (6 tests)
+// ============================================================================
+describe('F. Negative Cases', () => {
+  it('1. static prompt strings → no prompt injection finding', () => {
+    const findings = analyze(`
+      import OpenAI from 'openai'
+      const openai = new OpenAI()
+      async function handler() {
+        await openai.chat.completions.create({
+          model: 'gpt-4',
+          messages: [
+            { role: 'system', content: 'You are a helpful assistant' },
+            { role: 'user', content: 'What is 2+2?' },
+          ],
+        })
+      }
+    `)
+    const promptFindings = findings.filter(f => hasKind(f, 'prompt'))
+    expect(promptFindings.length).toBe(0)
+  })
+
+  it('2. non-LLM code with user input → standard taint, not LLM flow', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const input = req.body
+        eval(input)
+      }
+    `)
+    // Should produce command finding, but no prompt finding
+    expect(findings.some(f => hasKind(f, 'command'))).toBe(true)
+    // Prompt finding only if prompt sink present (not here)
+    const promptFindings = findings.filter(f => hasKind(f, 'prompt'))
+    expect(promptFindings.length).toBe(0)
+  })
+
+  it('3. hardcoded LLM call with no user input → no finding', () => {
+    const findings = analyze(`
+      import { generateText } from 'ai'
+      async function handler() {
+        const result = await generateText({
+          model: openai('gpt-4'),
+          prompt: 'Tell me a joke about cats',
+        })
+        console.log(result)
+      }
+    `)
+    expect(findings.length).toBe(0)
+  })
+
+  it('4. LLM output stored but never used in sink → no finding', () => {
+    const findings = analyze(`
+      async function handler() {
+        const response = await openai.chat.completions.create({ messages: [] })
+        const text = response.choices[0].message.content
+        const saved = text
+      }
+    `)
+    // No dangerous sinks reachable
+    expect(findings.length).toBe(0)
+  })
+
+  it('5. standard user input to standard sink is not misclassified as LLM', () => {
+    const findings = analyze(`
+      function handler(req: Request) {
+        const x = req.body
+        db.query(x)
+      }
+    `)
+    expect(findings.length).toBeGreaterThanOrEqual(1)
+    expect(findings.some(f => hasKind(f, 'sql'))).toBe(true)
+    // Should NOT have prompt kind
+    expect(findings.some(f => hasKind(f, 'prompt'))).toBe(false)
+  })
+
+  it('6. LLM output to console.log and return only → no finding', () => {
+    const findings = analyze(`
+      import { generateText } from 'ai'
+      async function handler() {
+        const result = await generateText({ model: openai('gpt-4'), prompt: 'hello' })
+        console.log(result)
+        return result
+      }
+    `)
+    expect(findings.length).toBe(0)
+  })
+})