@oculum/scanner 1.0.14 → 1.0.15

package/dist/taint/llm-risk-scoring.js

@@ -0,0 +1,376 @@
+"use strict";
+/**
+ * LLM Risk Scoring
+ *
+ * Post-processing severity assessment for taint findings involving LLM calls.
+ * Absorbs mitigation logic from the old AST rules (prompt-hygiene-ast.ts,
+ * execution-sinks-ast.ts) into taint-engine-aware risk scoring.
+ *
+ * Called from taint-flow-ast.ts before emitting vulnerabilities.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getEnclosingBodyText = getEnclosingBodyText;
+exports.hasDelimiters = hasDelimiters;
+exports.hasContentFiltering = hasContentFiltering;
+exports.hasJailbreakFiltering = hasJailbreakFiltering;
+exports.hasSandbox = hasSandbox;
+exports.hasValidation = hasValidation;
+exports.hasURLValidation = hasURLValidation;
+exports.hasDOMSanitization = hasDOMSanitization;
+exports.hasPathValidation = hasPathValidation;
+exports.hasSQLParam = hasSQLParam;
+exports.hasShellAllowlist = hasShellAllowlist;
+exports.hasTemplateSafety = hasTemplateSafety;
+exports.hasImportAllowlist = hasImportAllowlist;
+exports.assessPromptInjectionRisk = assessPromptInjectionRisk;
+exports.assessExecutionRisk = assessExecutionRisk;
+// ============================================================================
+// Severity Adjustment Helpers
+// ============================================================================
+const SEVERITY_ORDER = ['info', 'low', 'medium', 'high', 'critical'];
+function severityIndex(s) {
+    return SEVERITY_ORDER.indexOf(s);
+}
+function reduceSeverity(s, steps) {
+    const idx = severityIndex(s);
+    const newIdx = Math.max(0, idx - steps); // floor at 'info'
+    return SEVERITY_ORDER[newIdx];
+}
+// ============================================================================
+// Mitigation Heuristic Helpers
+// ============================================================================
+/** Get enclosing function body text from a taint finding's sink node */
+function getEnclosingBodyText(finding, content) {
+    let current = finding.sink.node.parent;
+    while (current) {
+        if (/function_declaration|arrow_function|function_expression|method_definition|function_definition/.test(current.type)) {
+            const bodyNode = current.childForFieldName('body') ?? current;
+            return content.substring(bodyNode.startIndex, bodyNode.endIndex);
+        }
+        current = current.parent;
+    }
+    // Fallback to full file content
+    return content;
+}
+/** Check if node text contains prompt delimiters */
+function hasDelimiters(text) {
+    return /```|<user>|<\/user>|<human>|---+|\[USER\]|\{\{user\}\}|###\s*User|INPUT:|OUTPUT:/i.test(text);
+}
+/** Check if content filtering is present nearby */
+function hasContentFiltering(bodyText) {
+    return /filterContent|sanitizeContent|cleanContent|contentModeration|moderateContent|stripInstructions|escapePrompt|sanitizePrompt|validateInput/i.test(bodyText);
+}
+/** Check for jailbreak filtering */
+function hasJailbreakFiltering(bodyText) {
+    return /filterJailbreak|detectJailbreak|jailbreakFilter|sanitizePrompt|blockInjection|moderationApi|contentModeration|guardRails|guardrail|promptGuard|inputGuard/i.test(bodyText);
+}
+/** Check for sandbox environment */
+function hasSandbox(bodyText) {
+    return /vm2|isolated-vm|safeeval|safe-eval|sandbox|runInNewContext.*timeout|quickjs|webworker|iframe.*sandbox/i.test(bodyText);
+}
+/** Check for generic output validation */
+function hasValidation(bodyText) {
+    return /validate|sanitize|escape|\.filter\s*\([^)]*(?:allowed|safe|valid)|schema\.|\.parse\s*\(|allowlist|whitelist|blocklist|DOMPurify|xss|encodeURIComponent|textContent\s*=|ReactMarkdown|allowed(?:Columns|Tables|Hosts|Domains)/i.test(bodyText);
+}
+/** Check for URL validation */
+function hasURLValidation(bodyText) {
+    return /allowedHosts\.includes|safeDomains\.includes|allowedDomains\.includes|url\.origin\s*===|\.startsWith\s*\(\s*['"]\/|blockedHosts\.includes|privateIpPatterns|isValidUrl|validateUrl|isAllowedUrl/i.test(bodyText);
+}
+/** Check for DOM sanitization */
+function hasDOMSanitization(bodyText) {
+    return /DOMPurify\.sanitize|sanitizeHtml|escapeHtml|textContent\s*=|innerText\s*=|ReactMarkdown/i.test(bodyText);
+}
+/** Check for path validation */
+function hasPathValidation(bodyText) {
+    return /path\.resolve.*startsWith|resolved\.startsWith|allowedPaths|SAFE_BASE_DIR|baseDir|safeDir|path\.basename/i.test(bodyText);
+}
+/** Check for SQL parameterization */
+function hasSQLParam(bodyText) {
+    return /allowedColumns\.includes|schema\.parse|z\.enum|prisma\.\w+\.find|allowedColumns\.filter/i.test(bodyText);
+}
+/** Check for shell allowlist */
+function hasShellAllowlist(bodyText) {
+    return /allowedArgs\.includes|allowedCommands\.includes|execFile\s*\(\s*['"][^'"]+['"]|sanitized\s*=/i.test(bodyText);
+}
+/** Check for template safety */
+function hasTemplateSafety(bodyText) {
+    return /autoescape\s*[=:]\s*true|DOMPurify\.sanitize|escapeHtml|sanitizeHtml/i.test(bodyText) &&
+        !/autoescape\s*[=:]\s*false/i.test(bodyText);
+}
+/** Check for import allowlist */
+function hasImportAllowlist(bodyText) {
+    return /ALLOWED_PLUGINS|importMap|allowedModules/i.test(bodyText);
+}
+// ============================================================================
+// Context Window Ratio
+// ============================================================================
+/**
+ * Estimate the ratio of user-controlled content in a prompt value.
+ *
+ * - Single identifier → 1.0 (100% user-controlled)
+ * - Template literal → dynamicParts / totalLength
+ * - Static string → 0.0
+ */
+function estimateContextRatio(finding, content) {
+    // Walk from sink node to find the prompt value node
+    const sinkNode = finding.sink.node;
+    // For system_prompt sinks, the dynamic content is typically the `content`/`system`/`prompt` property value
+    // We use the sink expression text as a proxy
+    const sinkText = content.substring(sinkNode.startIndex, sinkNode.endIndex);
+    // If the sink expression directly contains just an identifier that matches our tainted var
+    if (sinkText.includes('`')) {
+        // Template literal — estimate static vs dynamic ratio
+        const templateParts = sinkText.match(/\$\{[^}]+\}/g);
+        if (templateParts) {
+            // Subtract 3 per interpolation (${ and }) to count only inner expression length
+            const dynamicLen = templateParts.reduce((sum, p) => sum + Math.max(0, p.length - 3), 0);
+            const totalLen = sinkText.length;
+            if (totalLen > 0) {
+                return Math.min(1.0, dynamicLen / totalLen);
+            }
+        }
+    }
+    // Simple identifier passed directly → 100% controlled
+    return 1.0;
+}
+// ============================================================================
+// Prompt Injection Risk Assessment
+// ============================================================================
+/**
+ * Assess risk for taint findings where user input flows to a prompt sink.
+ */
+function assessPromptInjectionRisk(finding, content) {
+    const riskFactors = [];
+    const mitigations = [];
+    // 1. Base severity by sink position
+    const isSystemPrompt = finding.sink.sinkType === 'system_prompt';
+    let severity = isSystemPrompt ? 'critical' : 'high';
+    if (isSystemPrompt) {
+        riskFactors.push('User input flows to system prompt');
+    }
+    else {
+        riskFactors.push('User input flows to prompt construction');
+    }
+    // 2. Source type context
+    const sourceType = finding.source.sourceType;
+    let injectionType = 'direct prompt injection';
+    if (sourceType === 'rag_retrieval') {
+        injectionType = 'indirect injection via RAG retrieval';
+        riskFactors.push('External content from RAG pipeline');
+    }
+    else if (sourceType === 'tool_output') {
+        injectionType = 'indirect injection via tool output';
+        riskFactors.push('Content from tool execution result');
+    }
+    else if (sourceType === 'conversation_history') {
+        injectionType = 'injection via conversation history';
+        riskFactors.push('Content from conversation history');
+        // Chat history is typically previous messages being re-assembled — lower risk
+        severity = reduceSeverity(severity, 1);
+        mitigations.push('Conversation history source (serialization pattern)');
+    }
+    else if (sourceType === 'database_result') {
+        injectionType = 'indirect injection via database content';
+        riskFactors.push('Content from database query result');
+        // Check if sink expression matches message deserialization patterns
+        const sinkExpr = finding.sink.expression;
+        if (/AIMessage|HumanMessage|ChatMessage|messages\.append|messages\.push|ChatMessageHistory/.test(sinkExpr)) {
+            severity = reduceSeverity(severity, 1);
+            mitigations.push('Message deserialization pattern detected');
+        }
+    }
+    else if (sourceType === 'external_api') {
+        injectionType = 'indirect injection via external API';
+        riskFactors.push('Content from external API response');
+    }
+    else {
+        riskFactors.push(`Direct user input (${sourceType.replace(/_/g, ' ')})`);
+    }
+    // 3. Context window ratio
+    const contextRatio = estimateContextRatio(finding, content);
+    if (contextRatio !== null) {
+        if (contextRatio >= 0.9 && isSystemPrompt) {
+            riskFactors.push('System prompt almost entirely user-controlled');
+        }
+        else if (contextRatio < 0.2) {
+            severity = reduceSeverity(severity, 1);
+            mitigations.push('Small interpolation in larger template');
+        }
+    }
+    // 4. Mitigation heuristics from enclosing function
+    const bodyText = getEnclosingBodyText(finding, content);
+    if (hasDelimiters(bodyText)) {
+        severity = reduceSeverity(severity, 1);
+        mitigations.push('Prompt delimiters detected');
+    }
+    if (hasContentFiltering(bodyText)) {
+        severity = reduceSeverity(severity, 1);
+        mitigations.push('Content filtering detected');
+    }
+    if (hasJailbreakFiltering(bodyText)) {
+        severity = reduceSeverity(severity, 1);
+        mitigations.push('Jailbreak filtering detected');
+    }
+    // Floor: prompt injection with partial mitigations should never drop below 'low'
+    if (severityIndex(severity) < severityIndex('low')) {
+        severity = 'low';
+    }
+    // Build note
+    const sourceDesc = finding.source.sourceType.replace(/_/g, ' ');
+    const sinkDesc = finding.sink.sinkType.replace(/_/g, ' ');
+    const pathLen = finding.path.length;
+    let note = `${injectionType}: ${sourceDesc} at line ${finding.source.line} flows to ${sinkDesc} through ${pathLen} step${pathLen === 1 ? '' : 's'}`;
+    if (mitigations.length > 0) {
+        note += ` (${mitigations.join('; ')})`;
+    }
+    return {
+        adjustedSeverity: severity,
+        adjustedCategory: 'ai_prompt_injection',
+        riskFactors,
+        mitigations,
+        contextRatio,
+        note,
+    };
+}
+// ============================================================================
+// Execution Risk Assessment
+// ============================================================================
+/**
+ * Assess risk for taint findings where LLM output flows to execution sinks.
+ */
+function assessExecutionRisk(finding, content) {
+    const riskFactors = [];
+    const mitigations = [];
+    const sinkType = finding.sink.sinkType;
+    // 1. Base severity by sink type
+    let severity;
+    switch (sinkType) {
+        case 'eval':
+        case 'exec':
+        case 'command_exec':
+        case 'sql_query':
+        case 'nosql_query':
+        case 'http_request':
+        case 'file_write':
+        case 'path_access':
+        case 'dynamic_import':
+            severity = 'critical';
+            break;
+        case 'inner_html':
+        case 'template_render':
+        case 'redirect':
+            severity = 'high';
+            break;
+        case 'regex_constructor':
+            severity = 'medium';
+            break;
+        case 'response_body':
+            severity = 'medium';
+            break;
+        default:
+            severity = 'high';
+    }
+    riskFactors.push(`LLM output flows to ${sinkType.replace(/_/g, ' ')} sink`);
+    // 2. Source type context
+    const sourceType = finding.source.sourceType;
+    if (sourceType === 'llm_output') {
+        riskFactors.push('Direct LLM API response output');
+    }
+    else if (sourceType === 'tool_output') {
+        riskFactors.push('Tool execution result (may contain LLM-influenced data)');
+    }
+    else if (sourceType === 'rag_retrieval') {
+        riskFactors.push('RAG retrieval result');
+    }
+    // 3. Mitigation heuristics from enclosing function
+    const bodyText = getEnclosingBodyText(finding, content);
+    // Sandbox — strong mitigation
+    if (hasSandbox(bodyText)) {
+        severity = reduceSeverity(severity, 2);
+        mitigations.push('Sandbox detected');
+    }
+    // Generic validation
+    if (hasValidation(bodyText)) {
+        severity = reduceSeverity(severity, 1);
+        mitigations.push('Validation detected');
+    }
+    // Sink-specific mitigations
+    switch (sinkType) {
+        case 'http_request':
+        case 'redirect':
+            if (hasURLValidation(bodyText)) {
+                severity = 'info';
+                mitigations.push('URL validation detected');
+            }
+            break;
+        case 'inner_html':
+            if (hasDOMSanitization(bodyText)) {
+                severity = 'info';
+                mitigations.push('DOM sanitization detected');
+            }
+            break;
+        case 'path_access':
+        case 'file_write':
+            if (hasPathValidation(bodyText)) {
+                severity = 'info';
+                mitigations.push('Path validation detected');
+            }
+            break;
+        case 'sql_query':
+        case 'nosql_query':
+            if (hasSQLParam(bodyText)) {
+                severity = 'info';
+                mitigations.push('SQL parameterization detected');
+            }
+            break;
+        case 'command_exec':
+            if (hasShellAllowlist(bodyText)) {
+                severity = reduceSeverity(severity, 1);
+                mitigations.push('Shell allowlist detected');
+            }
+            break;
+        case 'template_render':
+            if (hasTemplateSafety(bodyText)) {
+                severity = 'info';
+                mitigations.push('Template safety detected');
+            }
+            break;
+        case 'dynamic_import':
+            if (hasImportAllowlist(bodyText)) {
+                severity = reduceSeverity(severity, 1);
+                mitigations.push('Import allowlist detected');
+            }
+            break;
+        case 'response_body': {
+            // AI SDK streaming responses are intentional LLM output delivery, not XSS vectors
+            const streamingPatterns = /toUIMessageStreamResponse|toDataStreamResponse|toTextStreamResponse|StreamingTextResponse|toAIStream|pipeDataStreamToResponse|streamText|streamObject/i;
+            if (streamingPatterns.test(bodyText)) {
+                severity = 'info';
+                mitigations.push('AI SDK streaming response pattern');
+            }
+            // .json() response methods return structured JSON, not HTML
+            if (/\.json\s*\(/.test(bodyText)) {
+                severity = 'info';
+                mitigations.push('JSON response method');
+            }
+            break;
+        }
+    }
+    // Build note
+    const sourceDesc = finding.source.sourceType.replace(/_/g, ' ');
+    const sinkDesc = finding.sink.sinkType.replace(/_/g, ' ');
+    const pathLen = finding.path.length;
+    let note = `LLM output (${sourceDesc}) flows to ${sinkDesc} through ${pathLen} step${pathLen === 1 ? '' : 's'}`;
+    if (mitigations.length > 0) {
+        note += ` (${mitigations.join('; ')})`;
+    }
+    return {
+        adjustedSeverity: severity,
+        adjustedCategory: 'ai_unsafe_execution',
+        riskFactors,
+        mitigations,
+        contextRatio: null,
+        note,
+    };
+}
+//# sourceMappingURL=llm-risk-scoring.js.map

package/dist/taint/llm-risk-scoring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-risk-scoring.js","sourceRoot":"","sources":["../../src/taint/llm-risk-scoring.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAuCH,oDAWC;AAGD,sCAEC;AAGD,kDAEC;AAGD,sDAEC;AAGD,gCAEC;AAGD,sCAEC;AAGD,4CAEC;AAGD,gDAEC;AAGD,8CAEC;AAGD,kCAEC;AAGD,8CAEC;AAGD,8CAGC;AAGD,gDAEC;AA6CD,8DA+FC;AASD,kDA+IC;AAjYD,+EAA+E;AAC/E,8BAA8B;AAC9B,+EAA+E;AAE/E,MAAM,cAAc,GAA4B,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;AAE7F,SAAS,aAAa,CAAC,CAAwB;IAC7C,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AAClC,CAAC;AAED,SAAS,cAAc,CAAC,CAAwB,EAAE,KAAa;IAC7D,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,KAAK,CAAC,CAAA,CAAC,kBAAkB;IAC1D,OAAO,cAAc,CAAC,MAAM,CAAC,CAAA;AAC/B,CAAC;AAED,+EAA+E;AAC/E,+BAA+B;AAC/B,+EAA+E;AAE/E,wEAAwE;AACxE,SAAgB,oBAAoB,CAAC,OAAqB,EAAE,OAAe;IACzE,IAAI,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAA;IACtC,OAAO,OAAO,EAAE,CAAC;QACf,IAAI,+FAA+F,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACvH,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,OAAO,CAAA;YAC7D,OAAO,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAClE,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAA;IAC1B,CAAC;IACD,gCAAgC;IAChC,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,oDAAoD;AACpD,SAAgB,aAAa,CAAC,IAAY;IACxC,OAAO,mFAAmF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACvG,CAAC;AAED,mDAAmD;AACnD,SAAgB,mBAAmB,CAAC,QAAgB;IAClD,OAAO,2IAA2I,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACnK,CAAC;AAED,oCAAoC;AACpC,SAAgB,qBAAqB,CAAC,QAAgB;IACpD,OAAO,4JAA4J,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACpL,CAAC;AAED,oCAAoC;AACpC,SAAgB,UAAU,CAAC,QAAgB;IACzC,OAAO,wGAAwG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAChI,CAAC;AAED,0CAA0C;AAC1C,SAAgB,aAAa,CAAC,QAAgB;IAC5C,OAAO,+NAA+N,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACvP,CAAC;AAED,+BAA+B;AAC/B,SAAgB,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,kMAAkM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAC1N,CAAC;AAED,iCAAiC;AACjC,SAAgB,kBAAkB,CAAC,QAAgB;IACjD,OAAO,0FAA0F,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAClH,CAAC;AAED,gCAAgC;AAChC,SAAgB,iBAAiB,CAAC,QAAgB;IAChD,OAAO,2GAA2G,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACnI,CAAC;AAED,qCAAqC;AACrC,SAAgB,WAAW,CAAC,QAAgB;IAC1C,OAAO,0FAA0F,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAClH,CAAC;AAED,gCAAgC;AAChC,SAAgB,iBAAiB,CAAC,QAAgB;IAChD,OAAO,+FAA+F,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACvH,CAAC;AAED,gCAAgC;AAChC,SAAgB,iBAAiB,CAAC,QAAgB;IAChD,OAAO,uEAAuE,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC3F,CAAC,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAChD,CAAC;AAED,iCAAiC;AACjC,SAAgB,kBAAkB,CAAC,QAAgB;IACjD,OAAO,2CAA2C,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACnE,CAAC;AAED,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,OAAqB,EAAE,OAAe;IAClE,oDAAoD;IACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAA;IAClC,2GAA2G;IAC3G,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAE1E,2FAA2F;IAC3F,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,sDAAsD;QACtD,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QACpD,IAAI,aAAa,EAAE,CAAC;YAClB,gFAAgF;YAChF,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;YACvF,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAA;YAChC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,GAAG,QAAQ,CAAC,CAAA;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,+EAA+E;AAC/E,mCAAmC;AACnC,+EAA+E;AAE/E;;GAEG;AACH,SAAgB,yBAAyB,CAAC,OAAqB,EAAE,OAAe;IAC9E,MAAM,WAAW,GAAa,EAAE,CAAA;IAChC,MAAM,WAAW,GAAa,EAAE,CAAA;IAEhC,oCAAoC;IACpC,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,eAAe,CAAA;IAChE,IAAI,QAAQ,GAA0B,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAA;IAE1E,IAAI,cAAc,EAAE,CAAC;QACnB,WAAW,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAA;IACvD,CAAC;SAAM,CAAC;QACN,WAAW,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAA;IAC7D,CAAC;IAED,yBAAyB;IACzB,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAA;IAC5C,IAAI,aAAa,GAAG,yBAAyB,CAAA;IAC7C,IAAI,UAAU,KAAK,eAAe,EAAE,CAAC;QACnC,aAAa,GAAG,sCAAsC,CAAA;QACtD,WAAW,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAA;IACxD,CAAC;SAAM,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;QACxC,aAAa,GAAG,oCAAoC,CAAA;QACpD,WAAW,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAA;IACxD,CAAC;SAAM,IAAI,UAAU,KAAK,sBAAsB,EAAE,CAAC;QACjD,aAAa,GAAG,oCAAoC,CAAA;QACpD,WAAW,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAA;QACrD,8EAA8E;QAC9E,QAAQ,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QACtC,WAAW,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAA;IACzE,CAAC;SAAM,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;QAC5C,aAAa,GAAG,yCAAyC,CAAA;QACzD,WAAW,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAA;QACtD,oEAAoE;QACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAA;QACxC,IAAI,uFAAuF,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3G,QAAQ,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;YACtC,WAAW,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAA;QAC9D,CAAC;IACH,CAAC;SAAM,IAAI,UAAU,KAAK,cAAc,EAAE,CAAC;QACzC,aAAa,GAAG,qCAAqC,CAAA;QACrD,WAAW,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAA;IACxD,CAAC;SAAM,CAAC;QACN,WAAW,CAAC,IAAI,CAAC,sBAAsB,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAA;IAC1E,CAAC;IAED,0BAA0B;IAC1B,MAAM,YAAY,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC3D,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,IAAI,YAAY,IAAI,GAAG,IAAI,cAAc,EAAE,CAAC;YAC1C,WAAW,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAA;QACnE,CAAC;aAAM,IAAI,YAAY,GAAG,GAAG,EAAE,CAAC;YAC9B,QAAQ,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;YACtC,WAAW,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAEvD,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,QAAQ,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QACtC,WAAW,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,QAAQ,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QACtC,WAAW,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,QAAQ,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QACtC,WAAW,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAA;IAClD,CAAC;IAED,iFAAiF;IACjF,IAAI,aAAa,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,QAAQ,GAAG,KAAK,CAAA;IAClB,CAAC;IAED,aAAa;IACb,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAA;IACnC,IAAI,IAAI,GAAG,GAAG,aAAa,KAAK,UAAU,YAAY,OAAO,CAAC,MAAM,CAAC,IAAI,aAAa,QAAQ,YAAY,OAAO,QAAQ,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAA;IAEnJ,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,IAAI,IAAI,KAAK,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;IACxC,CAAC;IAED,OAAO;QACL,gBAAgB,EAAE,QAAQ;QAC1B,gBAAgB,EAAE,qBAAqB;QACvC,WAAW;QACX,WAAW;QACX,YAAY;QACZ,IAAI;KACL,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAE/E;;GAEG;AACH,SAAgB,mBAAmB,CAAC,OAAqB,EAAE,OAAe;IACxE,MAAM,WAAW,GAAa,EAAE,CAAA;IAChC,MAAM,WAAW,GAAa,EAAE,CAAA;IAEhC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAA;IAEtC,gCAAgC;IAChC,IAAI,QAA+B,CAAA;IACnC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM,CAAC;QACZ,KAAK,cAAc,CAAC;QACpB,KAAK,WAAW,CAAC;QACjB,KAAK,aAAa,CAAC;QACnB,KAAK,cAAc,CAAC;QACpB,KAAK,YAAY,CAAC;QAClB,KAAK,aAAa,CAAC;QACnB,KAAK,gBAAgB;YACnB,QAAQ,GAAG,UAAU,CAAA;YACrB,MAAK;QACP,KAAK,YAAY,CAAC;QAClB,KAAK,iBAAiB,CAAC;QACvB,KAAK,UAAU;YACb,QAAQ,GAAG,MAAM,CAAA;YACjB,MAAK;QACP,KAAK,mBAAmB;YACtB,QAAQ,GAAG,QAAQ,CAAA;YACnB,MAAK;QACP,KAAK,eAAe;YAClB,QAAQ,GAAG,QAAQ,CAAA;YACnB,MAAK;QACP;YACE,QAAQ,GAAG,MAAM,CAAA;IACrB,CAAC;IAED,WAAW,CAAC,IAAI,CAAC,uBAAuB,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAE3E,yBAAyB;IACzB,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAA;IAC5C,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;QAChC,WAAW,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAA;IACpD,CAAC;SAAM,IAAI,UAAU,KAAK,aAAa,EAAE,CAAC;QACxC,WAAW,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAA;IAC7E,CAAC;SAAM,IAAI,UAAU,KAAK,eAAe,EAAE,CAAC;QAC1C,WAAW,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;IAC1C,CAAC;IAED,mDAAmD;IACnD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAEvD,8BAA8B;IAC9B,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,QAAQ,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QACtC,WAAW,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;IACtC,CAAC;IAED,qBAAqB;IACrB,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,QAAQ,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QACtC,WAAW,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;IACzC,CAAC;IAED,4BAA4B;IAC5B,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,cAAc,CAAC;QACpB,KAAK,UAAU;YACb,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/B,QAAQ,GAAG,MAAM,CAAA;gBACjB,WAAW,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAA;YAC7C,CAAC;YACD,MAAK;QACP,KAAK,YAAY;YACf,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,QAAQ,GAAG,MAAM,CAAA;gBACjB,WAAW,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;YAC/C,CAAC;YACD,MAAK;QACP,KAAK,aAAa,CAAC;QACnB,KAAK,YAAY;YACf,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChC,QAAQ,GAAG,MAAM,CAAA;gBACjB,WAAW,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;YAC9C,CAAC;YACD,MAAK;QACP,KAAK,WAAW,CAAC;QACjB,KAAK,aAAa;YAChB,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1B,QAAQ,GAAG,MAAM,CAAA;gBACjB,WAAW,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAA;YACnD,CAAC;YACD,MAAK;QACP,KAAK,cAAc;YACjB,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChC,QAAQ,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;gBACtC,WAAW,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;YAC9C,CAAC;YACD,MAAK;QACP,KAAK,iBAAiB;YACpB,IAAI,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChC,QAAQ,GAAG,MAAM,CAAA;gBACjB,WAAW,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;YAC9C,CAAC;YACD,MAAK;QACP,KAAK,gBAAgB;YACnB,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,QAAQ,GAAG,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;gBACtC,WAAW,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;YAC/C,CAAC;YACD,MAAK;QACP,KAAK,eAAe,CAAC,CAAC,CAAC;YACrB,kFAAkF;YAClF,MAAM,iBAAiB,GAAG,wJAAwJ,CAAA;YAClL,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrC,QAAQ,GAAG,MAAM,CAAA;gBACjB,WAAW,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAA;YACvD,CAAC;YACD,4DAA4D;YAC5D,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,QAAQ,GAAG,MAAM,CAAA;gBACjB,WAAW,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;YAC1C,CAAC;YACD,MAAK;QACP,CAAC;IACH,CAAC;IAED,aAAa;IACb,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAA;IACnC,IAAI,IAAI,GAAG,eAAe,UAAU,cAAc,QAAQ,YAAY,OAAO,QAAQ,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAA;IAE/G,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,IAAI,IAAI,KAAK,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;IACxC,CAAC;IAED,OAAO;QACL,gBAAgB,EAAE,QAAQ;QAC1B,gBAAgB,EAAE,qBAAqB;QACvC,WAAW;QACX,WAAW;QACX,YAAY,EAAE,IAAI;QAClB,IAAI;KACL,CAAA;AACH,CAAC"}

package/dist/taint/propagation-types.d.ts

@@ -0,0 +1,104 @@
+/**
+ * Taint Propagation Types
+ *
+ * Data model for the taint propagation engine (Phase 2, Part 3).
+ * Extended in Phase 3 with cross-file call entry/return step types.
+ * Used by propagation.ts and taint-analyzer.ts.
+ */
+import type { TaintKind, TaintSource, TaintSink } from './types';
+import type { CrossFileIndex } from './cross-file-index';
+import type { ParsedAST } from '../parse/ast';
+import type { ProjectAnalysisCache } from './file-analysis-cache';
+/** Field key: field name, or '*' for whole-object (unresolved field) taint. */
+export type FieldKey = string;
+export declare const WHOLE_OBJECT: FieldKey;
+/**
+ * Per-node taint state: variable name → field map → active taint kinds.
+ * The '*' key represents whole-object (unresolved field) taint.
+ */
+export type TaintState = Map<string, Map<FieldKey, Set<TaintKind>>>;
+/**
+ * Get effective taint for a variable (union of '*' and all fields).
+ *
+ * Phase 8 optimization: when only the WHOLE_OBJECT ('*') field exists (common case ~80%),
+ * returns the existing Set directly to avoid allocation. Callers that mutate the result
+ * MUST clone first (see augmented assignment and seed re-injection in propagation.ts).
+ */
+export declare function getTaint(state: TaintState, varName: string): Set<TaintKind> | undefined;
+/** Get taint for a specific field (field-specific ∪ '*' fallback). */
+export declare function getFieldTaint(state: TaintState, varName: string, field: FieldKey): Set<TaintKind> | undefined;
+/** Set whole-object taint (sets '*' key, clears field-specific entries). */
+export declare function setTaint(state: TaintState, varName: string, kinds: Set<TaintKind>): void;
+/** Set taint for a specific field only. */
+export declare function setFieldTaint(state: TaintState, varName: string, field: FieldKey, kinds: Set<TaintKind>): void;
+/** Delete all taint for a variable. */
+export declare function deleteTaint(state: TaintState, varName: string): void;
+/** Check if a variable has any taint. */
+export declare function hasTaint(state: TaintState, varName: string): boolean;
+/** One step in a taint propagation path. */
+export interface TaintStep {
+    nodeId: number;
+    line: number;
+    variable: string;
+    taintKinds: ReadonlySet<TaintKind>;
+    description: string;
+    stepType: 'source' | 'propagation' | 'sanitizer' | 'sink' | 'call_entry' | 'call_return';
+    /** When step is in a different file (cross-file analysis). */
+    filePath?: string;
+    /** When entering/exiting a function (cross-file analysis). */
+    functionName?: string;
+}
+/**
+ * Context for resolving function calls across file boundaries.
+ * Passed through the propagation engine to enable inter-procedural analysis.
+ */
+export interface CallResolutionContext {
+    crossFileIndex: CrossFileIndex;
+    allASTs: Map<string, ParsedAST>;
+    /** Prevent infinite recursion: set of "${filePath}:${functionName}" being analyzed. */
+    callStack: Set<string>;
+    /** Max call depth to follow (default: 5). */
+    maxDepth: number;
+    /** Cache: "${filePath}:${functionName}:${taintKindsSorted}" → return taint + steps. */
+    resultCache: Map<string, CalleeResult | null>;
+    /** Pre-built per-file analysis cache (CFGs, sources, sinks, sanitizers). Phase 8. */
+    analysisCache?: ProjectAnalysisCache;
+    /** Pre-built function taint summaries for summary-based composition. Phase 8. */
+    summaryCache?: SummaryCache;
+}
+/** Sentinel value indicating a summary is currently being built (recursion guard). */
+export declare const BUILDING_SENTINEL: unique symbol;
+export type SummaryCache = Map<string, FunctionTaintSummary | typeof BUILDING_SENTINEL | null>;
+/** Summary of a function's taint behavior: which param taint kinds survive to return/sinks. */
+export interface FunctionTaintSummary {
+    functionName: string;
+    filePath: string;
+    params: string[];
+    /** Per param index: which taint kinds survive through sanitizers to return. */
+    paramReturnKinds: Map<number, Set<TaintKind>>;
+    /** Per param index: which sinks are reachable with which taint kinds. */
+    paramSinkEntries: Map<number, ParamSinkEntry[]>;
+}
+export interface ParamSinkEntry {
+    sinkLine: number;
+    sinkExpression: string;
+    sinkType: string;
+    reachableKinds: Set<TaintKind>;
+}
+export interface CalleeResult {
+    returnTaint: Set<TaintKind>;
+    steps: TaintStep[];
+    /** Findings discovered inside the callee (sink reached within callee). */
+    calleeFindings: TaintFinding[];
+}
+/** A confirmed taint finding: source → sink with full path. */
+export interface TaintFinding {
+    source: TaintSource;
+    sink: TaintSink;
+    path: TaintStep[];
+    /** Intersection of source taint kinds and sink vulnerable-to kinds. */
+    matchingKinds: Set<TaintKind>;
+    functionName: string;
+    filePath: string;
+}
+//# sourceMappingURL=propagation-types.d.ts.map

package/dist/taint/propagation-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"propagation-types.d.ts","sourceRoot":"","sources":["../../src/taint/propagation-types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAMjE,+EAA+E;AAC/E,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAA;AAC7B,eAAO,MAAM,YAAY,EAAE,QAAc,CAAA;AAEzC;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;AAMnE;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,SAAS,CAcvF;AAED,sEAAsE;AACtE,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,SAAS,CAa7G;AAED,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,CAIxF;AAED,2CAA2C;AAC3C,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,CAO9G;AAED,uCAAuC;AACvC,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAEpE;AAED,yCAAyC;AACzC,wBAAgB,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAOpE;AAMD,4CAA4C;AAC5C,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,WAAW,CAAC,SAAS,CAAC,CAAA;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,QAAQ,GAAG,aAAa,GAAG,WAAW,GAAG,MAAM,GAC9C,YAAY,GAAG,aAAa,CAAA;IACvC,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAMD;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,cAAc,CAAA;IAC9B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAC/B,uFAAuF;IACvF,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACtB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAA;IAChB,uFAAuF;IACvF,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC,CAAA;IAC7C,qFAAqF;IACrF,aAAa,CAAC,EAAE,oBAAoB,CAAA;IACpC,iFAAiF;IACjF,YAAY,CAAC,EAAE,YAAY,CAAA;CAC5B;AAED,sFAAsF;AACtF,eAAO,MAAM,iBAAiB,eAAqB,CAAA;AAEnD,MAAM,MAAM,YAAY,GAAG,GAAG,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,iBAAiB,GAAG,IAAI,CAAC,CAAA;AAE9F,+FAA+F;AAC/F,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,+EAA+E;IAC/E,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAA;IAC7C,yEAAyE;IACzE,gBAAgB,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,CAAA;CAChD;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;CAC/B;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;IAC3B,KAAK,EAAE,SAAS,EAAE,CAAA;IAClB,0EAA0E;IAC1E,cAAc,EAAE,YAAY,EAAE,CAAA;CAC/B;AAMD,+DAA+D;AAC/D,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,CAAA;IACnB,IAAI,EAAE,SAAS,CAAA;IACf,IAAI,EAAE,SAAS,EAAE,CAAA;IACjB,uEAAuE;IACvE,aAAa,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;IAC7B,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;CACjB"}

package/dist/taint/propagation-types.js

@@ -0,0 +1,98 @@
+"use strict";
+/**
+ * Taint Propagation Types
+ *
+ * Data model for the taint propagation engine (Phase 2, Part 3).
+ * Extended in Phase 3 with cross-file call entry/return step types.
+ * Used by propagation.ts and taint-analyzer.ts.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BUILDING_SENTINEL = exports.WHOLE_OBJECT = void 0;
+exports.getTaint = getTaint;
+exports.getFieldTaint = getFieldTaint;
+exports.setTaint = setTaint;
+exports.setFieldTaint = setFieldTaint;
+exports.deleteTaint = deleteTaint;
+exports.hasTaint = hasTaint;
+exports.WHOLE_OBJECT = '*';
+// ============================================================================
+// TaintState Accessors
+// ============================================================================
+/**
+ * Get effective taint for a variable (union of '*' and all fields).
+ *
+ * Phase 8 optimization: when only the WHOLE_OBJECT ('*') field exists (common case ~80%),
+ * returns the existing Set directly to avoid allocation. Callers that mutate the result
+ * MUST clone first (see augmented assignment and seed re-injection in propagation.ts).
+ */
+function getTaint(state, varName) {
+    const fieldMap = state.get(varName);
+    if (!fieldMap)
+        return undefined;
+    // Fast path: single '*' field = return directly (no allocation)
+    if (fieldMap.size === 1) {
+        const onlyEntry = fieldMap.get(exports.WHOLE_OBJECT);
+        if (onlyEntry && onlyEntry.size > 0)
+            return onlyEntry;
+    }
+    // Slow path: union of all field sets
+    const result = new Set();
+    for (const kinds of fieldMap.values()) {
+        for (const k of kinds)
+            result.add(k);
+    }
+    return result.size > 0 ? result : undefined;
+}
+/** Get taint for a specific field (field-specific ∪ '*' fallback). */
+function getFieldTaint(state, varName, field) {
+    const fieldMap = state.get(varName);
+    if (!fieldMap)
+        return undefined;
+    const result = new Set();
+    // Field-specific taint
+    const fieldKinds = fieldMap.get(field);
+    if (fieldKinds)
+        for (const k of fieldKinds)
+            result.add(k);
+    // Whole-object fallback
+    if (field !== exports.WHOLE_OBJECT) {
+        const wholeKinds = fieldMap.get(exports.WHOLE_OBJECT);
+        if (wholeKinds)
+            for (const k of wholeKinds)
+                result.add(k);
+    }
+    return result.size > 0 ? result : undefined;
+}
+/** Set whole-object taint (sets '*' key, clears field-specific entries). */
+function setTaint(state, varName, kinds) {
+    const fieldMap = new Map();
+    fieldMap.set(exports.WHOLE_OBJECT, kinds);
+    state.set(varName, fieldMap);
+}
+/** Set taint for a specific field only. */
+function setFieldTaint(state, varName, field, kinds) {
+    let fieldMap = state.get(varName);
+    if (!fieldMap) {
+        fieldMap = new Map();
+        state.set(varName, fieldMap);
+    }
+    fieldMap.set(field, kinds);
+}
+/** Delete all taint for a variable. */
+function deleteTaint(state, varName) {
+    state.delete(varName);
+}
+/** Check if a variable has any taint. */
+function hasTaint(state, varName) {
+    const fieldMap = state.get(varName);
+    if (!fieldMap)
+        return false;
+    for (const kinds of fieldMap.values()) {
+        if (kinds.size > 0)
+            return true;
+    }
+    return false;
+}
+/** Sentinel value indicating a summary is currently being built (recursion guard). */
+exports.BUILDING_SENTINEL = Symbol('building');
+//# sourceMappingURL=propagation-types.js.map

package/dist/taint/propagation-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"propagation-types.js","sourceRoot":"","sources":["../../src/taint/propagation-types.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAgCH,4BAcC;AAGD,sCAaC;AAGD,4BAIC;AAGD,sCAOC;AAGD,kCAEC;AAGD,4BAOC;AAjFY,QAAA,YAAY,GAAa,GAAG,CAAA;AAQzC,+EAA+E;AAC/E,uBAAuB;AACvB,+EAA+E;AAE/E;;;;;;GAMG;AACH,SAAgB,QAAQ,CAAC,KAAiB,EAAE,OAAe;IACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACnC,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC/B,gEAAgE;IAChE,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,oBAAY,CAAC,CAAA;QAC5C,IAAI,SAAS,IAAI,SAAS,CAAC,IAAI,GAAG,CAAC;YAAE,OAAO,SAAS,CAAA;IACvD,CAAC;IACD,qCAAqC;IACrC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAa,CAAA;IACnC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IACtC,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7C,CAAC;AAED,sEAAsE;AACtE,SAAgB,aAAa,CAAC,KAAiB,EAAE,OAAe,EAAE,KAAe;IAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACnC,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC/B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAa,CAAA;IACnC,uBAAuB;IACvB,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACtC,IAAI,UAAU;QAAE,KAAK,MAAM,CAAC,IAAI,UAAU;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IACzD,wBAAwB;IACxB,IAAI,KAAK,KAAK,oBAAY,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,oBAAY,CAAC,CAAA;QAC7C,IAAI,UAAU;YAAE,KAAK,MAAM,CAAC,IAAI,UAAU;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7C,CAAC;AAED,4EAA4E;AAC5E,SAAgB,QAAQ,CAAC,KAAiB,EAAE,OAAe,EAAE,KAAqB;IAChF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAA;IACpD,QAAQ,CAAC,GAAG,CAAC,oBAAY,EAAE,KAAK,CAAC,CAAA;IACjC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;AAC9B,CAAC;AAED,2CAA2C;AAC3C,SAAgB,aAAa,CAAC,KAAiB,EAAE,OAAe,EAAE,KAAe,EAAE,KAAqB;IACtG,IAAI,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAA;QAC9C,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IAC9B,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AAC5B,CAAC;AAED,uCAAuC;AACvC,SAAgB,WAAW,CAAC,KAAiB,EAAE,OAAe;IAC5D,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;AACvB,CAAC;AAED,yCAAyC;AACzC,SAAgB,QAAQ,CAAC,KAAiB,EAAE,OAAe;IACzD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACnC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3B,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;IACjC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AA4CD,sFAAsF;AACzE,QAAA,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAAC,CAAA"}