@oculum/scanner 1.0.14 → 1.0.15

package/dist/taint/async-flow.js

@@ -0,0 +1,271 @@
+"use strict";
+/**
+ * Async Flow Taint Injection
+ *
+ * Handles taint propagation through async patterns that the standard CFG
+ * doesn't model:
+ *
+ * 1. Promise chains: `.then(data => ...)` / `.catch(err => ...)`
+ *    The callback parameter inherits taint from the resolved/rejected promise.
+ *
+ * 2. Callback-style APIs: `fs.readFile(taintedPath, (err, data) => ...)`
+ *    The callback parameters inherit contextual taint from the call arguments.
+ *
+ * Integration: Called from `applyNodeTransfer` in `propagation.ts` when a
+ * call_expression is encountered. Modifies taint state in-place by seeding
+ * callback parameters.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.injectPromiseChainTaint = injectPromiseChainTaint;
+exports.injectCallbackTaint = injectCallbackTaint;
+const propagation_types_1 = require("./propagation-types");
+// ============================================================================
+// Promise Chain: .then() / .catch()
+// ============================================================================
+const PROMISE_METHODS = /^(then|catch|finally)$/;
+/**
+ * If `callNode` is a `.then()` / `.catch()` call on a tainted object,
+ * seed the callback parameter(s) with the object's taint.
+ *
+ * Example:
+ *   taintedPromise.then(data => sink(data))
+ *   → `data` inherits all taint kinds from `taintedPromise`
+ *
+ *   promise.catch(err => log(err))
+ *   → `err` inherits taint from promise
+ *
+ * Returns true if injection occurred.
+ */
+function injectPromiseChainTaint(callNode, state) {
+    const fnNode = callNode.childForFieldName('function');
+    if (!fnNode || fnNode.type !== 'member_expression')
+        return false;
+    const prop = fnNode.childForFieldName('property');
+    if (!prop || !PROMISE_METHODS.test(prop.text))
+        return false;
+    const obj = fnNode.childForFieldName('object');
+    if (!obj)
+        return false;
+    // Collect taint from the object (the promise/value being chained)
+    const objTaint = collectTaintFromExpression(obj, state);
+    if (objTaint.size === 0)
+        return false;
+    // Find the callback argument(s)
+    const argsNode = callNode.childForFieldName('arguments');
+    if (!argsNode)
+        return false;
+    let injected = false;
+    for (const arg of argsNode.namedChildren) {
+        if (arg.type !== 'arrow_function' && arg.type !== 'function_expression')
+            continue;
+        const params = arg.childForFieldName('parameters');
+        if (!params)
+            continue;
+        for (const param of params.namedChildren) {
+            const paramName = extractParamName(param);
+            if (!paramName)
+                continue;
+            // Seed the callback parameter with the object's taint
+            const existing = (0, propagation_types_1.getTaint)(state, paramName) ?? new Set();
+            for (const k of objTaint)
+                existing.add(k);
+            (0, propagation_types_1.setTaint)(state, paramName, existing);
+            injected = true;
+        }
+    }
+    return injected;
+}
+const CALLBACK_API_PATTERNS = [
+    // fs.readFile(path, [options], callback(err, data))
+    // If path is tainted, the data read may be under attacker control
+    {
+        object: /^(fs|fsp|fsPromises)$/,
+        method: /^(readFile|readdir)$/,
+        taintedArgs: [0],
+        callbackParamIndex: 1, // data (2nd param after err)
+        callbackArgIndex: 'last',
+    },
+    // http.get(url, callback(response)) — response body from tainted URL
+    {
+        object: /^(http|https)$/,
+        method: /^(get|request)$/,
+        taintedArgs: [0],
+        callbackParamIndex: 0, // response (1st param)
+        callbackArgIndex: 'last',
+    },
+    // EventEmitter: emitter.on('event', callback(data))
+    // The data arg inherits taint from the emitter
+    {
+        object: null, // any object
+        method: /^(on|once|addEventListener|addListener)$/,
+        taintedArgs: 'all',
+        callbackParamIndex: 0,
+        callbackArgIndex: 'last',
+    },
+];
+/**
+ * If `callNode` matches a known callback-style API, seed the callback's
+ * parameters with contextual taint from the call arguments.
+ *
+ * Example:
+ *   fs.readFile(userPath, (err, data) => db.query(data))
+ *   → `data` inherits path-related taint from `userPath`
+ *
+ * Returns true if injection occurred.
+ */
+function injectCallbackTaint(callNode, state) {
+    const fnNode = callNode.childForFieldName('function');
+    if (!fnNode)
+        return false;
+    // Extract method name and optional object
+    let methodName = null;
+    let objectName = null;
+    if (fnNode.type === 'member_expression') {
+        const prop = fnNode.childForFieldName('property');
+        const obj = fnNode.childForFieldName('object');
+        methodName = prop?.text ?? null;
+        objectName = obj?.text ?? null;
+    }
+    else if (fnNode.type === 'identifier') {
+        methodName = fnNode.text;
+    }
+    if (!methodName)
+        return false;
+    const argsNode = callNode.childForFieldName('arguments');
+    if (!argsNode)
+        return false;
+    const args = argsNode.namedChildren;
+    let injected = false;
+    for (const pattern of CALLBACK_API_PATTERNS) {
+        // Check method name
+        if (!pattern.method.test(methodName))
+            continue;
+        // Check object name (if pattern requires it)
+        if (pattern.object && (!objectName || !pattern.object.test(objectName)))
+            continue;
+        // Collect taint from specified argument positions
+        const argTaint = new Set();
+        if (pattern.taintedArgs === 'all') {
+            for (const arg of args) {
+                const t = collectTaintFromExpression(arg, state);
+                for (const k of t)
+                    argTaint.add(k);
+            }
+        }
+        else {
+            for (const idx of pattern.taintedArgs) {
+                if (idx < args.length) {
+                    const t = collectTaintFromExpression(args[idx], state);
+                    for (const k of t)
+                        argTaint.add(k);
+                }
+            }
+        }
+        if (argTaint.size === 0)
+            continue;
+        // Find the callback argument
+        const callbackIdx = pattern.callbackArgIndex === 'last'
+            ? args.length - 1
+            : pattern.callbackArgIndex;
+        if (callbackIdx < 0 || callbackIdx >= args.length)
+            continue;
+        const callbackArg = args[callbackIdx];
+        if (callbackArg.type !== 'arrow_function' && callbackArg.type !== 'function_expression')
+            continue;
+        const params = callbackArg.childForFieldName('parameters');
+        if (!params)
+            continue;
+        const callbackParams = params.namedChildren;
+        if (pattern.callbackParamIndex >= callbackParams.length)
+            continue;
+        const targetParam = callbackParams[pattern.callbackParamIndex];
+        const paramName = extractParamName(targetParam);
+        if (!paramName)
+            continue;
+        const existing = (0, propagation_types_1.getTaint)(state, paramName) ?? new Set();
+        for (const k of argTaint)
+            existing.add(k);
+        (0, propagation_types_1.setTaint)(state, paramName, existing);
+        injected = true;
+    }
+    return injected;
+}
+// ============================================================================
+// Helpers
+// ============================================================================
+/**
+ * Collect taint kinds from an expression node by checking identifiers
+ * against the current taint state.
+ */
+function collectTaintFromExpression(node, state) {
+    const result = new Set();
+    if (node.type === 'identifier') {
+        const kinds = (0, propagation_types_1.getTaint)(state, node.text);
+        if (kinds)
+            for (const k of kinds)
+                result.add(k);
+        return result;
+    }
+    // For member expressions, check the root identifier
+    if (node.type === 'member_expression') {
+        let current = node;
+        while (current.type === 'member_expression' || current.type === 'subscript_expression') {
+            const obj = current.childForFieldName('object');
+            if (!obj)
+                break;
+            current = obj;
+        }
+        if (current.type === 'identifier') {
+            const kinds = (0, propagation_types_1.getTaint)(state, current.text);
+            if (kinds)
+                for (const k of kinds)
+                    result.add(k);
+        }
+        return result;
+    }
+    // For call expressions, check if the result carries taint (conservative: check args)
+    if (node.type === 'call_expression') {
+        const argsNode = node.childForFieldName('arguments');
+        if (argsNode) {
+            for (const arg of argsNode.namedChildren) {
+                if (arg.type === 'arrow_function' || arg.type === 'function_expression')
+                    continue;
+                const t = collectTaintFromExpression(arg, state);
+                for (const k of t)
+                    result.add(k);
+            }
+        }
+        // Also check method chain object
+        const fnNode = node.childForFieldName('function');
+        if (fnNode?.type === 'member_expression') {
+            const obj = fnNode.childForFieldName('object');
+            if (obj) {
+                const t = collectTaintFromExpression(obj, state);
+                for (const k of t)
+                    result.add(k);
+            }
+        }
+    }
+    return result;
+}
+/**
+ * Extract the parameter name from various parameter node types.
+ */
+function extractParamName(param) {
+    if (param.type === 'identifier')
+        return param.text;
+    // TypeScript typed parameters: (data: Buffer) => ...
+    if (param.type === 'required_parameter' || param.type === 'optional_parameter') {
+        const pattern = param.childForFieldName('pattern');
+        if (pattern?.type === 'identifier')
+            return pattern.text;
+    }
+    // Assignment pattern with default: (data = '') => ...
+    if (param.type === 'assignment_pattern') {
+        const left = param.childForFieldName('left');
+        if (left?.type === 'identifier')
+            return left.text;
+    }
+    return null;
+}
+//# sourceMappingURL=async-flow.js.map

package/dist/taint/async-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"async-flow.js","sourceRoot":"","sources":["../../src/taint/async-flow.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;AA0BH,0DA0CC;AA0DD,kDA+EC;AAxMD,2DAAwD;AAExD,+EAA+E;AAC/E,oCAAoC;AACpC,+EAA+E;AAE/E,MAAM,eAAe,GAAG,wBAAwB,CAAA;AAEhD;;;;;;;;;;;;GAYG;AACH,SAAgB,uBAAuB,CACrC,QAA2B,EAC3B,KAAiB;IAEjB,MAAM,MAAM,GAAG,QAAQ,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;IACrD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAmB;QAAE,OAAO,KAAK,CAAA;IAEhE,MAAM,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;IACjD,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAE3D,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IAC9C,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IAEtB,kEAAkE;IAClE,MAAM,QAAQ,GAAG,0BAA0B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACvD,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAErC,gCAAgC;IAChC,MAAM,QAAQ,GAAG,QAAQ,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;IACxD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAA;IAE3B,IAAI,QAAQ,GAAG,KAAK,CAAA;IAEpB,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QACzC,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB;YAAE,SAAQ;QAEjF,MAAM,MAAM,GAAG,GAAG,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAA;QAClD,IAAI,CAAC,MAAM;YAAE,SAAQ;QAErB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;YACzC,IAAI,CAAC,SAAS;gBAAE,SAAQ;YAExB,sDAAsD;YACtD,MAAM,QAAQ,GAAG,IAAA,4BAAQ,EAAC,KAAK,EAAE,SAAS,CAAC,IAAI,IAAI,GAAG,EAAE,CAAA;YACxD,KAAK,MAAM,CAAC,IAAI,QAAQ;gBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YACzC,IAAA,4BAAQ,EAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;YACpC,QAAQ,GAAG,IAAI,CAAA;QACjB,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAmBD,MAAM,qBAAqB,GAAyB;IAClD,oDAAoD;IACpD,kEAAkE;IAClE;QACE,MAAM,EAAE,uBAAuB;QAC/B,MAAM,EAAE,sBAAsB;QAC9B,WAAW,EAAE,CAAC,CAAC,CAAC;QAChB,kBAAkB,EAAE,CAAC,EAAE,6BAA6B;QACpD,gBAAgB,EAAE,MAAM;KACzB;IACD,qEAAqE;IACrE;QACE,MAAM,EAAE,gBAAgB;QACxB,MAAM,EAAE,iBAAiB;QACzB,WAAW,EAAE,CAAC,CAAC,CAAC;QAChB,kBAAkB,EAAE,CAAC,EAAE,uBAAuB;QAC9C,gBAAgB,EAAE,MAAM;KACzB;IACD,oDAAoD;IACpD,+CAA+C;IAC/C;QACE,MAAM,EAAE,IAAI,EAAE,aAAa;QAC3B,MAAM,EAAE,0CAA0C;QAClD,WAAW,EAAE,KAAK;QAClB,kBAAkB,EAAE,CAAC;QACrB,gBAAgB,EAAE,MAAM;KACzB;CACF,CAAA;AAED;;;;;;;;;GASG;AACH,SAAgB,mBAAmB,CACjC,QAA2B,EAC3B,KAAiB;IAEjB,MAAM,MAAM,GAAG,QAAQ,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAEzB,0CAA0C;IAC1C,IAAI,UAAU,GAAkB,IAAI,CAAA;IACpC,IAAI,UAAU,GAAkB,IAAI,CAAA;IAEpC,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;QACjD,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAA;QAC9C,UAAU,GAAG,IAAI,EAAE,IAAI,IAAI,IAAI,CAAA;QAC/B,UAAU,GAAG,GAAG,EAAE,IAAI,IAAI,IAAI,CAAA;IAChC,CAAC;SAAM,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACxC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAA;IAC1B,CAAC;IAED,IAAI,CAAC,UAAU;QAAE,OAAO,KAAK,CAAA;IAE7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;IACxD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAA;IAEnC,IAAI,QAAQ,GAAG,KAAK,CAAA;IAEpB,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,oBAAoB;QACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,SAAQ;QAE9C,6CAA6C;QAC7C,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAAE,SAAQ;QAEjF,kDAAkD;QAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAa,CAAA;QACrC,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;YAClC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,0BAA0B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAChD,KAAK,MAAM,CAAC,IAAI,CAAC;oBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YACpC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;gBACtC,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;oBACtB,MAAM,CAAC,GAAG,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;oBACtD,KAAK,MAAM,CAAC,IAAI,CAAC;wBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;gBACpC,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;YAAE,SAAQ;QAEjC,6BAA6B;QAC7B,MAAM,WAAW,GAAG,OAAO,CAAC,gBAAgB,KAAK,MAAM;YACrD,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YACjB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAA;QAC5B,IAAI,WAAW,GAAG,CAAC,IAAI,WAAW,IAAI,IAAI,CAAC,MAAM;YAAE,SAAQ;QAE3D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,CAAA;QACrC,IAAI,WAAW,CAAC,IAAI,KAAK,gBAAgB,IAAI,WAAW,CAAC,IAAI,KAAK,qBAAqB;YAAE,SAAQ;QAEjG,MAAM,MAAM,GAAG,WAAW,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAA;QAC1D,IAAI,CAAC,MAAM;YAAE,SAAQ;QAErB,MAAM,cAAc,GAAG,MAAM,CAAC,aAAa,CAAA;QAC3C,IAAI,OAAO,CAAC,kBAAkB,IAAI,cAAc,CAAC,MAAM;YAAE,SAAQ;QAEjE,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAA;QAC9D,MAAM,SAAS,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAA;QAC/C,IAAI,CAAC,SAAS;YAAE,SAAQ;QAExB,MAAM,QAAQ,GAAG,IAAA,4BAAQ,EAAC,KAAK,EAAE,SAAS,CAAC,IAAI,IAAI,GAAG,EAAE,CAAA;QACxD,KAAK,MAAM,CAAC,IAAI,QAAQ;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACzC,IAAA,4BAAQ,EAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;QACpC,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E;;;GAGG;AACH,SAAS,0BAA0B,CACjC,IAAuB,EACvB,KAAiB;IAEjB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAa,CAAA;IAEnC,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAA,4BAAQ,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QACxC,IAAI,KAAK;YAAE,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAC/C,OAAO,MAAM,CAAA;IACf,CAAC;IAED,oDAAoD;IACpD,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACtC,IAAI,OAAO,GAAsB,IAAI,CAAA;QACrC,OAAO,OAAO,CAAC,IAAI,KAAK,mBAAmB,IAAI,OAAO,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YACvF,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAA;YAC/C,IAAI,CAAC,GAAG;gBAAE,MAAK;YACf,OAAO,GAAG,GAAG,CAAA;QACf,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,IAAA,4BAAQ,EAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;YAC3C,IAAI,KAAK;gBAAE,KAAK,MAAM,CAAC,IAAI,KAAK;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACjD,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,qFAAqF;IACrF,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACpD,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;gBACzC,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB;oBAAE,SAAQ;gBACjF,MAAM,CAAC,GAAG,0BAA0B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAChD,KAAK,MAAM,CAAC,IAAI,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YAClC,CAAC;QACH,CAAC;QACD,iCAAiC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAA;QACjD,IAAI,MAAM,EAAE,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAA;YAC9C,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,GAAG,0BAA0B,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBAChD,KAAK,MAAM,CAAC,IAAI,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,KAAwB;IAChD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC,IAAI,CAAA;IAElD,qDAAqD;IACrD,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAC/E,MAAM,OAAO,GAAG,KAAK,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAA;QAClD,IAAI,OAAO,EAAE,IAAI,KAAK,YAAY;YAAE,OAAO,OAAO,CAAC,IAAI,CAAA;IACzD,CAAC;IAED,sDAAsD;IACtD,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAA;QAC5C,IAAI,IAAI,EAAE,IAAI,KAAK,YAAY;YAAE,OAAO,IAAI,CAAC,IAAI,CAAA;IACnD,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/taint/cfg-builder.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Control Flow Graph Builder
+ *
+ * Builds an intra-procedural CFG for each function in a parsed AST.
+ * Uses the "pending-exits" pattern: each processStatement() call receives
+ * a list of nodes needing an outgoing edge and returns a new list of exits.
+ *
+ * Statement-level granularity. Expression-level flow (sub-expressions, short-circuit)
+ * is handled by the taint propagator within each CFGNode.
+ */
+import type Parser from 'tree-sitter';
+import { type ParsedAST } from '../parse/ast';
+import type { CFG } from './cfg-types';
+/**
+ * Build a CFG for a single function AST node.
+ * The function node should be one of: function_declaration, arrow_function,
+ * function_expression, method_definition, generator_function_declaration.
+ */
+export declare function buildCFG(fnNode: Parser.SyntaxNode, fnName: string): CFG;
+/**
+ * Build CFGs for all functions in a file. Returns a map keyed by function name,
+ * using the same naming conventions as call-graph.ts:
+ * - function_declaration → name
+ * - method_definition → ClassName.methodName
+ * - arrow/function_expression in variable_declarator → variable name
+ * - module-level code → '<module>'
+ */
+export declare function buildFileCFGs(ast: ParsedAST): Map<string, CFG>;
+/** Get all successor node ids from a given node. */
+export declare function getSuccessors(cfg: CFG, nodeId: number): number[];
+/** Get all predecessor node ids for a given node. */
+export declare function getPredecessors(cfg: CFG, nodeId: number): number[];
+/** Check if there's a path from `fromId` to `toId` in the CFG using BFS. */
+export declare function isReachable(cfg: CFG, fromId: number, toId: number): boolean;
+//# sourceMappingURL=cfg-builder.d.ts.map

package/dist/taint/cfg-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cfg-builder.d.ts","sourceRoot":"","sources":["../../src/taint/cfg-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,EAAW,KAAK,SAAS,EAAE,MAAM,cAAc,CAAA;AAEtD,OAAO,KAAK,EACV,GAAG,EASJ,MAAM,aAAa,CAAA;AAMpB;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,CAGvE;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CA2C9D;AAMD,oDAAoD;AACpD,wBAAgB,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAIhE;AAED,qDAAqD;AACrD,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAIlE;AAED,4EAA4E;AAC5E,wBAAgB,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAmB3E"}