@shundoo-ai/dsh-cosmic 1.0.21 → 1.0.22

package/skills/cosmic-build/scripts/dcs_code_gate.py

@@ -0,0 +1,1976 @@
+"""Check Java plugin source against the DCS deployment gate before it leaves the workstation.
+
+A customer packages the plugin and deploys it through DCS, whose code scan (Sonar, SpotBugs,
+Fortify and Kingdee's own CVE-KD rules) rejects the package for problems the compiler never sees:
+a static ``HashMap`` field, a log call inside a loop, a ``kd.bos.orm.ORM`` import, the same field
+key literal written three times. Each rejection costs the customer a full rebuild and redeploy, so
+the rules that a source scan can decide are checked here, while the code is still being written.
+
+The rule codes are the DCS codes (``CVE-KD-0056-05``, ``java:S1192``, ``DM_NUMBER_CTOR`` ...) so a
+finding here and a line in a DCS report name the same rule. Two levels:
+
+* ``block`` — the source text alone settles the violation. ``compile_plugin_source.py`` refuses
+  the source, and the standalone scan exits 2.
+* ``advise`` — a scan cannot prove it (types, data flow, estimated complexity). DCS may still
+  reject it, so each one is to be fixed or explicitly justified, but it does not block here.
+
+This is a deliberately narrow reader, like ``java_source``: it works on comment- and literal-free
+text and never claims a rule it cannot see. Rules that need the whole build — jar and class name
+conflicts, metadata scans, null-flow analysis — stay with DCS; ``--source`` on a module directory
+additionally covers the packaging rules it can see on disk (jar files, SQL scripts).
+"""
+
+from __future__ import annotations
+
+import argparse
+import bisect
+import json
+import re
+import sys
+from pathlib import Path
+
+from java_source import _split_params, commentless, method_bodies, stripped
+
+SCHEMA_VERSION = "app-build-dcs-code-gate/v1"
+
+# DCS rule code -> (DCS risk, DCS rule name), copied from the DCS gate catalogue
+# (金蝶AI套件公有云门禁) so a finding can be matched to the line DCS would report.
+RULES: dict[str, tuple[str, str]] = {
+    "CVE-KD-0001": ("严重", "禁止使用指定类AccountUtils"),
+    "CVE-KD-0002": ("严重", "禁止使用指定类MCDBUtil"),
+    "CVE-KD-0003": ("严重", "禁止使用指定类MCApiUtil"),
+    "CVE-KD-0004": ("严重", "禁止使用指定类LoginMCServiceDbImpl"),
+    "CVE-KD-0005": ("严重", "禁止使用指定类DBConfig"),
+    "CVE-KD-0006": ("严重", "禁止使用指定类KDDriverUtil"),
+    "CVE-KD-0007": ("严重", "禁止使用指定类DataSourceFactory"),
+    "CVE-KD-0008": ("低危", "禁止调用System.getenv"),
+    "CVE-KD-0009": ("低危", "禁止调用System.getProperty"),
+    "CVE-KD-0010": ("低危", "禁止调用System.getProperties"),
+    "CVE-KD-0011-1": ("低危", "禁止二开通过反射操作，破坏苍穹架构约束Class.forName"),
+    "CVE-KD-0011-2": ("低危", "禁止二开通过反射操作，破坏苍穹架构约束java.lang.reflect"),
+    "CVE-KD-0011-3": ("低危", "禁止二开通过反射操作，破坏苍穹架构约束URLClassLoader"),
+    "CVE-KD-0012-1": ("低危", "禁止二开通过字节码ClassReader操作，破坏苍穹架构约束"),
+    "CVE-KD-0012-2": ("低危", "禁止二开通过字节码ClassWriter操作，破坏苍穹架构约束"),
+    "CVE-KD-0012-3": ("低危", "禁止二开通过字节码ClassVisitor操作，破坏苍穹架构约束"),
+    "CVE-KD-0012-4": ("低危", "禁止二开通过字节码操作，破坏苍穹架构约束javassist.CtClass"),
+    "CVE-KD-0012-5": ("低危", "禁止二开通过字节码操作，破坏苍穹架构约束ClassPool"),
+    "CVE-KD-0012-6": ("低危", "禁止二开通过字节码操作，破坏苍穹架构约束javassist.CtMethod"),
+    "CVE-KD-0012-7": ("低危", "禁止二开通过字节码操作，破坏苍穹架构约束Instrumentation"),
+    "CVE-KD-0012-8": ("低危", "禁止二开通过字节码操作，破坏苍穹架构约束ClassFileTransformer"),
+    "CVE-KD-0013-1": ("低危", "禁止关键字drop table"),
+    "CVE-KD-0013-2": ("低危", "禁止关键字truncate table"),
+    "CVE-KD-0013-3": ("低危", "禁止关键字rename table"),
+    "CVE-KD-0014-1": ("严重", "禁止使用指定类方法RequestContext.setAccountId"),
+    "CVE-KD-0014-2": ("严重", "禁止使用指定类方法RequestContext.setTenantId"),
+    "CVE-KD-0015-1": ("低危", "禁止使用SessionInfo所有set方法"),
+    "CVE-KD-0017": ("低危", "禁止调用System.setProperty"),
+    "CVE-KD-0018": ("严重", "禁止使用指定类RequestContextInfo"),
+    "CVE-KD-0019-1": ("低危", "Redis访问治理：禁止直接通过JedisClient访问Redis"),
+    "CVE-KD-0020": ("低危", "Redis访问治理：禁止直接通过Jedis客户端第三方包访问Redis"),
+    "CVE-KD-0021": ("低危", "Zookeeper访问治理：禁止直接通过ZKFactory访问Zookeeper"),
+    "CVE-KD-0022": ("低危", "Zookeeper访问治理：禁止直接通过Zookeeper客户端第三方包访问Zookeeper"),
+    "CVE-KD-0023": ("低危", "MQ访问治理：禁止直接通过RabbitMq客户端第三方包访问RabbiMq"),
+    "CVE-KD-0024": ("低危", "MQ访问治理：禁止直接通过RockettMq客户端第三方包访问RockettMq"),
+    "CVE-KD-0025": ("低危", "MQ访问治理：禁止直接通过kafka客户端第三方包访问kafka"),
+    "CVE-KD-0029": ("低危", "禁止二开使用Socket"),
+    "CVE-KD-0051-03": ("低危", "禁止在循环中访问kd.bos.cache.redis.RedisSessionlessCache"),
+    "CVE-KD-0051-04": ("低危", "禁止在循环中访问kd.bos.cache.redis.RedisSessionableCache"),
+    "CVE-KD-0051-07": ("低危", "禁止在循环中访问kd.bos.data.BusinessDataReader"),
+    "CVE-KD-0051-08": ("低危", "禁止在循环中访问kd.bos.data.BusinessDataWriter"),
+    "CVE-KD-0051-09": ("低危", "禁止在循环中访问kd.bos.servicehelper.operation.OperationServiceHelper"),
+    "CVE-KD-0051-10": ("低危", "禁止在循环中访问kd.bos.servicehelper.operation.SaveServiceHelper"),
+    "CVE-KD-0051-11": ("低危", "禁止在循环中访问kd.bos.servicehelper.operation.DeleteServiceHelper"),
+    "CVE-KD-TS-0051-46": ("高危", "禁止在循环中访问kd.bos.servicehelper.BusinessDataServiceHelper的loadHead方法"),
+    "CVE-KD-0052": ("高危", "禁止循环中访问view.updateView()"),
+    "CVE-KD-0053-01": ("严重", "关键字禁止select *"),
+    "CVE-KD-0054-1": ("低危", "禁止循环调用PageCache"),
+    "CVE-KD-0054-2": ("低危", "禁止循环调用RootPageCache"),
+    "CVE-KD-0055-1": ("低危", "二开禁止使用原生线程"),
+    "CVE-KD-0055-2": ("低危", "禁止使用指定类java.util.concurrent.FutureTask"),
+    "CVE-KD-0055-3": ("低危", "禁止使用指定类java.util.concurrent.ExecutorService"),
+    "CVE-KD-0055-4": ("低危", "禁止使用指定类java.util.concurrent.Executors"),
+    "CVE-KD-0055-5": ("低危", "禁止使用指定类java.util.concurrent.ThreadPoolExecutor"),
+    "CVE-KD-0055-6": ("低危", "禁止使用指定类java.util.concurrent.ForkJoinPool"),
+    "CVE-KD-0055-7": ("低危", "禁止使用指定类java.util.concurrent.ScheduledExecutorService"),
+    "CVE-KD-0055-8": ("低危", "禁止使用指定类java.util.concurrent.CompletableFuture"),
+    "CVE-KD-0055-9": ("低危", "禁止使用指定类java.util.concurrent.Future"),
+    "CVE-KD-0058-1": ("严重", "日志治理：禁止循环中写日志"),
+    "CVE-KD-0059-1": ("严重", "避免不合理地调用MetadataDao"),
+    "CVE-KD-0201": ("低危", "禁止循环调用微服务接口"),
+    "CVE-KD-0209-1": ("低危", "禁止使用System.out.print打印日志"),
+    "CVE-KD-0209-2": ("低危", "禁止使用e.printStackTrace()打印日志"),
+    "CVE-KD-0302-01": ("严重", "二开删除数据必须加有效过滤条件"),
+    "CVE-KD-0303": ("严重", "二开查询数据必须加有效过滤条件"),
+    "CVE-KD-0400": ("低危", "禁止调用kd.bos.lang.Lang.setHolder"),
+    "CVE-KD-0401": ("严重", "禁止通过注释跳过sonar检查（// NOSONAR）"),
+    "CVE-KD-0402": ("低危", "禁止通注解跳过sonar检查（@SuppressWarnings(\"squid:S243\")）"),
+    "CVE-KD-0403": ("中危", "包名,类名,方法名,变量名中文检测"),
+    "CVE-KD-0413": ("低危", "禁止使用kd.bos.db.DB"),
+    "CVE-KD-TS-0413": ("高危", "禁止使用kd.bos.db.DB"),
+    "CVE-KD-0414-2": ("严重", "禁止引用非标准SDK内容-新项目"),
+    "CVE-KD-0501": ("高危", "二开代码使用jdk17构建错误"),
+    "CVE-KD-0717-2": ("严重", "禁止二开直接删除数据——DeleteServiceHelper.delete()"),
+    "CVE-KD-0717-3": ("严重", "禁止二开直接删除数据——BusinessDataWriter.delete()"),
+    "CVE-KD-0717-4": ("严重", "禁止二开直接删除数据——ORM.delete()"),
+    "CVE-KD-0720-2": ("严重", "禁止使用CREATE OR REPLACE VIEW创建视图"),
+    "CVE-KD-0721-1": ("严重", "禁止使用CREATE PROCEDURE创建存储过程"),
+    "CVE-KD-0721-2": ("严重", "禁止使用CREATE OR REPLACE PROCEDURE创建存储过程"),
+    "CVE-KD-0722-1": ("严重", "禁止使用CREATE FUNCTION创建函数"),
+    "CVE-KD-0722-2": ("严重", "禁止使用CREATE OR REPLACE FUNCTION创建函数"),
+    "CVE-KD-0723-1": ("严重", "禁止使用CREATE TRIGGER创建触发器"),
+    "CVE-KD-0723-2": ("严重", "禁止使用CREATE OR REPLACE TRIGGER创建触发器"),
+    "CVE-KD-1215-1": ("高危", "禁止在两层及以上循环内读写数据库"),
+    "CVE-KD-1215-2": ("严重", "禁止在三层及以上循环内读写数据库"),
+    "CVE-KD-2026-0508": ("低危", "禁止使用kd.bos.orm.ORM"),
+    "CVE-KD-2026-0618": ("严重", "禁止在 propertyChanged() 中无条件调用 updateView()"),
+    "CVE-KD-20260901-1": ("严重", "禁止使用kd.bos.zk"),
+    "CVE-KD-20260901-2": ("严重", "禁止使用org.apache.zookeeper"),
+    "CVE-KD-20260901-3": ("严重", "禁止使用org.apache.curator"),
+    "CVE-KD-20260901-4": ("严重", "禁止使用kd.bos.mq.MessageConsumer"),
+    "CVE-KD-SCAN-jar": ("严重", "引入第三方jar包"),
+    "CVE-KD-SCAN-libFile": ("严重", "引入第三方文件"),
+    "CVE-KD-SQL-0001": ("严重", "禁止创建视图"),
+    "CVE-KD-SQL-0002": ("严重", "禁止创建存储过程"),
+    "CVE-KD-SQL-0003": ("严重", "禁止创建函数"),
+    "CVE-KD-SQL-0004": ("严重", "禁止创建触发器"),
+    "CVE-KD-SQL-0005": ("低危", "禁止插入数据"),
+    "CVE-KD-SQL-0006": ("严重", "禁止更新数据"),
+    "CVE-KD-SQL-0007": ("严重", "禁止删除数据"),
+    "CVE-KD-SQL-0008": ("严重", "禁止删除字段"),
+    "CVE-KD-SQL-0009": ("严重", "禁止删除表"),
+    "CVE-KD-SQL-0010": ("严重", "禁止重命名表和字段"),
+    "CVE-KD-SQL-0014": ("严重", "新建表名长度不可超过24个字符"),
+    "CVE-KD-SQL-0015": ("低危", "文件非UTF-8格式"),
+    "class_fully_qualified_name_conflict_stp": ("严重", "类完全限定名与标准产品冲突"),
+    "java:S100": ("低危", "Method names should comply with a naming convention"),
+    "java:S101": ("低危", "Class names should comply with a naming convention"),
+    "java:S106": ("中危", "Standard outputs should not be used directly to log anything"),
+    "java:S108": ("中危", "Nested blocks of code should not be left empty"),
+    "java:S112": ("中危", "Generic exceptions should never be thrown"),
+    "java:S115": ("高危", "Constant names should comply with a naming convention"),
+    "java:S116": ("低危", "Field names should comply with a naming convention"),
+    "java:S117": ("低危", "Local variable and method parameter names should comply with a naming convention"),
+    "java:S1066": ("中危", "Collapsible \"if\" statements should be merged"),
+    "java:S1068": ("中危", "Unused \"private\" fields should be removed"),
+    "java:S1118": ("中危", "Utility classes should not have public constructors"),
+    "java:S1124": ("低危", "Modifiers should be declared in the correct order"),
+    "java:S1125": ("低危", "Boolean literals should not be redundant"),
+    "java:S1126": ("低危", "Return of boolean expressions should not be wrapped into an \"if-then-else\" statement"),
+    "java:S1128": ("低危", "Unnecessary imports should be removed"),
+    "java:S1144": ("中危", "Unused \"private\" methods should be removed"),
+    "java:S1149": ("中危", "Synchronized classes Vector, Hashtable, Stack and StringBuffer should not be used"),
+    "java:S1153": ("低危", "String.valueOf() should not be appended to a String"),
+    "java:S1155": ("低危", "Collection.isEmpty() should be used to test for emptiness"),
+    "java:S1157": ("低危", "Case insensitive string comparisons should be made without intermediate upper or lower casing"),
+    "java:S1168": ("中危", "Empty arrays and collections should be returned instead of null"),
+    "java:S1171": ("中危", "Only static class initializers should be used"),
+    "java:S1172": ("中危", "Unused method parameters should be removed"),
+    "java:S1181": ("中危", "Throwable and Error should not be caught"),
+    "java:S1186": ("高危", "Methods should not be empty"),
+    "java:S1192": ("高危", "String literals should not be duplicated"),
+    "java:S1197": ("低危", "Array designators \"[]\" should be on the type, not the variable"),
+    "java:S1199": ("低危", "Nested code blocks should not be used"),
+    "java:S1206": ("低危", "\"equals(Object obj)\" and \"hashCode()\" should be overridden in pairs"),
+    "java:S1215": ("高危", "Execution of the Garbage Collector should be triggered only by the JVM"),
+    "java:S1220": ("低危", "The default unnamed package should not be used"),
+    "java:S125": ("中危", "Sections of code should not be commented out"),
+    "java:S128": ("严重", "Switch cases should end with an unconditional \"break\" statement"),
+    "java:S131": ("高危", "\"switch\" statements should have \"default\" clauses"),
+    "java:S1313": ("低危", "Using hardcoded IP addresses is security-sensitive"),
+    "java:S1444": ("低危", "\"public static\" fields should be constant"),
+    "java:S1452": ("高危", "Generic wildcard types should not be used in return types"),
+    "java:S1481": ("低危", "Unused local variables should be removed"),
+    "java:S1488": ("低危", "Local variables should not be declared and then immediately returned or thrown"),
+    "java:S1598": ("高危", "Package declaration should match source file directory"),
+    "java:S1604": ("中危", "Anonymous inner classes containing only one method should become lambdas"),
+    "java:S1643": ("低危", "Strings should not be concatenated using '+' in a loop"),
+    "java:S1845": ("严重", "Methods and field names should not be the same or differ only by capitalization"),
+    "java:S2068": ("严重", "Hard-coded credentials are security-sensitive"),
+    "java:S2077": ("中危", "Formatting SQL queries is security-sensitive"),
+    "java:S2111": ("中危", "\"BigDecimal(double)\" should not be used"),
+    "java:S2129": ("中危", "Constructors should not be used to instantiate \"String\", \"BigInteger\", \"BigDecimal\" and primitive-wrapper classes"),
+    "java:S2133": ("中危", "Objects should not be created only to \"getClass\""),
+    "java:S2139": ("中危", "Exceptions should be either logged or rethrown but not both"),
+    "java:S2142": ("中危", "\"InterruptedException\" should not be ignored"),
+    "java:S2168": ("严重", "Double-checked locking should not be used"),
+    "java:S2178": ("严重", "Short-circuit logic should be used in boolean contexts"),
+    "java:S2189": ("严重", "Loops should not be infinite"),
+    "java:S2245": ("高危", "Using pseudorandom number generators (PRNGs) is security-sensitive"),
+    "java:S2276": ("严重", "\"wait(...)\" should be used instead of \"Thread.sleep(...)\" when a lock is held"),
+    "java:S2386": ("低危", "Mutable fields should not be \"public static\""),
+    "java:S2696": ("高危", "Instance methods should not write to \"static\" fields"),
+    "java:S2755": ("严重", "XML parsers should not be vulnerable to XXE attacks"),
+    "java:S2864": ("中危", "\"entrySet()\" should be iterated when both the key and value are needed"),
+    "java:S3011": ("中危", "Reflection should not be used to increase accessibility of classes, methods, or fields"),
+    "java:S3358": ("中危", "Ternary operators should not be nested"),
+    "java:S3776": ("高危", "Cognitive Complexity of methods should not be too high"),
+    "java:S4423": ("高危", "Weak SSL/TLS protocols should not be used"),
+    "java:S4426": ("高危", "Cryptographic keys should be robust"),
+    "java:S4635": ("高危", "String offset-based methods should be preferred for finding substrings from offsets"),
+    "java:S4790": ("高危", "Using weak hashing algorithms is security-sensitive"),
+    "java:S4973": ("中危", "Strings and Boxed types should be compared using \"equals()\""),
+    "java:S5332": ("高危", "Using clear-text protocols is security-sensitive"),
+    "java:S5361": ("高危", "\"String#replace\" should be preferred to \"String#replaceAll\""),
+    "java:S5542": ("低危", "Encryption algorithms should be used with secure mode and padding scheme"),
+    "java:S5547": ("高危", "Cipher algorithms should be robust"),
+    "DM_BOOLEAN_CTOR": ("中危", "Performance - Method invokes inefficient Boolean constructor; use Boolean.valueOf(...) instead"),
+    "DM_CONVERT_CASE": ("低危", "I18n - Consider using Locale parameterized version of invoked method"),
+    "DM_EXIT": ("中危", "Bad practice - Method invokes System.exit(...)"),
+    "DM_FP_NUMBER_CTOR": ("中危", "Performance - Method invokes inefficient floating-point Number constructor; use static valueOf instead"),
+    "DM_GC": ("中危", "Performance - Explicit garbage collection; extremely dubious except in benchmarking code"),
+    "DM_NUMBER_CTOR": ("中危", "Performance - Method invokes inefficient Number constructor; use static valueOf instead"),
+    "DM_STRING_CTOR": ("中危", "Performance - Method invokes inefficient new String(String) constructor"),
+    "DM_STRING_VOID_CTOR": ("中危", "Performance - Method invokes inefficient new String() constructor"),
+    "EC_NULL_ARG": ("中危", "Correctness - Call to equals(null)"),
+    "ES_COMPARING_STRINGS_WITH_EQ": ("中危", "Bad practice - Comparison of String objects using == or !="),
+    "IIL_PATTERN_COMPILE_IN_LOOP": ("中危", "Performance - Method calls Pattern.compile in a loop"),
+    "ITA_INEFFICIENT_TO_ARRAY": ("中危", "Performance - Method uses toArray() with zero-length array argument"),
+    "WMI_WRONG_MAP_ITERATOR": ("中危", "Performance - Inefficient use of keySet iterator instead of entrySet iterator"),
+    "FORTIFY:Hardcoded Password": ("中危", "Password Management: Hardcoded Password / Empty Password"),
+    "FORTIFY:Hardcoded Encryption Key": ("严重", "Key Management: Hardcoded Encryption Key"),
+    "FORTIFY:Insecure Initialization Vector": ("严重", "Weak Encryption: Insecure Initialization Vector"),
+    "FORTIFY:Inadequate RSA Padding": ("中危", "Weak Encryption: Inadequate RSA Padding"),
+    "FORTIFY:Unsafe Deserialization": ("严重", "Dynamic Code Evaluation: Unsafe Deserialization"),
+    "FORTIFY:Return Inside Finally": ("高危", "Poor Error Handling: Return Inside Finally"),
+    "FORTIFY:Privacy Violation": ("中危", "Privacy Violation"),
+    "FORTIFY:SQL Injection": ("严重", "SQL Injection"),
+    "UUF_UNUSED_FIELD": ("中危", "Performance - Unused field"),
+}
+_STATIC_COLLECTIONS = {
+    "Collection": "01", "Map": "02", "Set": "03", "List": "04", "HashMap": "05", "LinkedHashMap": "06",
+    "Hashtable": "07", "TreeMap": "08", "WeakHashMap": "09", "IdentityHashMap": "10", "Properties": "11",
+    "HashSet": "12", "LinkedHashSet": "13", "TreeSet": "14", "ArrayList": "15", "LinkedList": "16",
+    "Vector": "17", "Stack": "18", "ConcurrentHashMap": "19", "ConcurrentSkipListMap": "20",
+    "CopyOnWriteArrayList": "21", "CopyOnWriteArraySet": "22", "ConcurrentSkipListSet": "23",
+}
+RULES.update({f"CVE-KD-0056-{number}": ("低危", f"禁止使用{name}静态集合变量") for name, number in _STATIC_COLLECTIONS.items()})
+# Internal file-service and temporary-file keywords, each with its own DCS code.
+_FILE_SERVICE_TOKENS = {
+    "attachmentServer.url": "1", "imageServer.url": "2", "attachment.fileserver": "3", "image.fileserver": "4",
+    "file/upload.do": "5", "file/remove.do": "6", "file/exists.do": "7", "file/getForbiddenExtensions.do": "8",
+    "file/getAllowExtensions.do": "9", "file/getFileSize.do": "10", "file/transferTempToPersist.do": "11",
+    "login/getTicket.do": "12", "tempfile/supportTempfile.do": "13", "tempfile/isSupported.do": "14",
+    "tempfile/isSupportTempTransToPersist.do": "15", "fileServerManage/getVersion.do": "16",
+    "fileServerManage/getDiskUrlInfos.do": "17", "fileServerManage/getMatchFileMsgInfos.do": "18",
+    "fileServerManage/getChildrenFileMsgInfos.do": "19", "fileServerManage/getMaxDirectoryScanDepth.do": "20",
+    "fileServerManage/getFileMsgInfo.do": "21", "fileServerManage/getFileMsgInfoTree.do": "22",
+    "fileServerManage/buildRmScript.do": "23", "fileServerManage/buildCopyScript.do": "24", "ereceipt.url": "25",
+}
+RULES.update({f"CVE-KD-0026-{number}": ("低危", f"文件访问治理：禁止使用特殊关键字{token}") for token, number in _FILE_SERVICE_TOKENS.items()})
+_TEMPFILE_TOKENS = {"redis.serversForCache": "03", "tempfile.redis": "02", "tempfile.fileserver": "04", "tempfile.disk": "05"}
+RULES.update({f"CVE-KD-0028-{number}": ("严重", f"附件临时路径检查方式不正确{token}") for token, number in _TEMPFILE_TOKENS.items()})
+_RISK_ORDER = {"严重": 0, "高危": 1, "中危": 2, "低危": 3}
+# 客户两表按真实编号取并集；运行时不依赖客户本机的 Excel 或 Office 库。
+CATALOG = json.loads(Path(__file__).with_name("dcs-rule-catalog.json").read_text(encoding="utf-8"))
+for _code, _entry in CATALOG["rules"].items():
+    RULES[_code] = (_entry["risk"], _entry["name"] or RULES.get(_code, ("", _code))[1])
+
+# 旧 Fortify 名称是兼容别名。具体 UUID 可能对应不同语言/调用链，作为关联编号，
+# 不冒充已定位到某个 Fortify 检测器；实际匹配仍由 DCS 完整分析决定。
+_FORTIFY_NAMES = {
+    "FORTIFY:Hardcoded Password": "Password Management: Hardcoded Password",
+    "FORTIFY:Hardcoded Encryption Key": "Key Management: Hardcoded Encryption Key",
+    "FORTIFY:Insecure Initialization Vector": "Weak Encryption: Insecure Initialization Vector",
+    "FORTIFY:Inadequate RSA Padding": "Weak Encryption: Inadequate RSA Padding",
+    "FORTIFY:Unsafe Deserialization": "Dynamic Code Evaluation: Unsafe Deserialization",
+    "FORTIFY:Return Inside Finally": "Poor Error Handling: Return Inside Finally",
+    "FORTIFY:Privacy Violation": "Privacy Violation",
+    "FORTIFY:SQL Injection": "SQL Injection",
+    "java:S2755": "XML External Entity Injection",
+    "java:S4426": "Weak Encryption: Insufficient Key Size",
+    "java:S4830": "Insecure SSL: Overly Broad Certificate Trust",
+    "java:S5527": "Insecure SSL: Server Identity Verification Disabled",
+}
+_FORTIFY_CODES = {
+    alias: tuple(code for code, entry in CATALOG["rules"].items() if entry["engine"] == "fortify" and entry["name"] == name)
+    for alias, name in _FORTIFY_NAMES.items()
+}
+
+BLOCK = "block"
+ADVISE = "advise"
+
+
+class _Source:
+    """One Java file in three aligned views, plus the structure every rule needs.
+
+    ``raw`` is the file, ``code`` has comments and literals blanked, ``lit`` keeps literals. All
+    three share offsets, so a match in any of them reports the same line.
+    """
+
+    def __init__(self, text: str, path: Path | None = None) -> None:
+        self.raw = text
+        self.path = path
+        self.code = stripped(text)
+        self.lit = commentless(text)
+        self._starts = [0] + [index + 1 for index, char in enumerate(text) if char == "\n"]
+        self.pair: dict[int, int] = {}
+        self.opener: dict[int, int] = {}
+        self.owners: dict[int, str] = {}
+        self._braces: list[tuple[int, int]] = []
+        stack: list[int] = []
+        depth = 0
+        for index, char in enumerate(self.code):
+            if char in "({[":
+                stack.append(index)
+            elif char in ")}]" and stack:
+                start = stack.pop()
+                self.pair[start] = index
+                self.opener[index] = start
+            if char in "{}":
+                depth += 1 if char == "{" else -1
+                self._braces.append((index, depth))
+        self.loops = self._loop_spans()
+        self.methods = self._methods()
+        self.literals = [(match.start(), match.group(1)) for match in _STRING_RE.finditer(self.lit)
+                         if match.group(0).startswith('"')]
+
+    def line(self, offset: int) -> int:
+        return bisect.bisect_right(self._starts, offset)
+
+    def brace_depth(self, offset: int) -> int:
+        """How many braces are open just before ``offset``."""
+        position = bisect.bisect_left(self._braces, (offset, -(10 ** 9)))
+        return self._braces[position - 1][1] if position else 0
+
+    def statement_end(self, index: int) -> int:
+        code = self.code
+        while index < len(code):
+            char = code[index]
+            if char in "({[" and index in self.pair:
+                index = self.pair[index] + 1
+                continue
+            if char in ";}":
+                return index
+            index += 1
+        return len(code)
+
+    def body_after(self, index: int) -> tuple[int, int] | None:
+        """The span of the statement or block that starts at the first code after ``index``."""
+        code = self.code
+        while index < len(code) and code[index].isspace():
+            index += 1
+        if index >= len(code) or code[index] == ";":
+            return None
+        if code[index] == "{":
+            close = self.pair.get(index)
+            return (index, close) if close is not None else None
+        return index, self.statement_end(index)
+
+    def _loop_spans(self) -> list[tuple[int, int]]:
+        spans = []
+        for match in re.finditer(r"\b(?:for|while)\s*\(", self.code):
+            close = self.pair.get(match.end() - 1)
+            body = self.body_after(close + 1) if close is not None else None
+            if body:
+                spans.append(body)
+        for match in re.finditer(r"\bdo\s*\{", self.code):
+            close = self.pair.get(match.end() - 1)
+            if close is not None:
+                spans.append((match.end() - 1, close))
+        for match in re.finditer(r"\.\s*forEach\s*\(", self.code):
+            close = self.pair.get(match.end() - 1)
+            if close is not None:
+                spans.append((match.end() - 1, close))
+        return spans
+
+    def loop_depth(self, offset: int) -> int:
+        return sum(1 for start, end in self.loops if start < offset < end)
+
+    def _methods(self) -> list[dict]:
+        methods = []
+        for body in method_bodies(self.raw):
+            opening = body["start"] - 1
+            head_start = max(self.code.rfind(char, 0, opening) for char in ";{}") + 1
+            header = self.code[head_start:opening]
+            # The declared name is the word before the last top-level parameter list; method_bodies
+            # takes the first `name(`, which is a type annotation in `Result<@Ann("x") T> save(...)`.
+            tail = re.sub(r"\bthrows\s+[\w$.,\s<>]+$", "", header.rstrip()).rstrip()
+            if not tail.endswith(")") or head_start + len(tail) - 1 not in self.opener:
+                continue
+            params_close = head_start + len(tail) - 1
+            params_open = self.opener[params_close]
+            index = params_open - 1
+            while index >= head_start and self.code[index].isspace():
+                index -= 1
+            name = _word_ending_at(self.code, index)
+            if not name:
+                continue
+            name_offset = index + 1 - len(name)
+            prefix = self.code[head_start:name_offset]
+            methods.append({
+                "name": name,
+                "start": body["start"],
+                "end": body["end"],
+                "headStart": head_start,
+                "nameOffset": name_offset,
+                "prefix": prefix,
+                "params": self.code[params_open + 1 : params_close],
+                "static": bool(re.search(r"\bstatic\b", prefix)),
+                "private": bool(re.search(r"\bprivate\b", prefix)),
+                "override": "@Override" in prefix,
+                "synchronized": bool(re.search(r"\bsynchronized\b", prefix)),
+            })
+        return methods
+
+    def method_at(self, offset: int) -> dict | None:
+        return next((item for item in self.methods if item["start"] <= offset <= item["end"]), None)
+
+
+_STRING_RE = re.compile(r"'(?:\\.|[^'\\\n])*'|\"((?:\\.|[^\"\\\n])*)\"")
+
+
+def _issue(src: _Source, offset: int, rules, message: str, fix: str, level: str = BLOCK) -> dict:
+    codes = [rules] if isinstance(rules, str) else list(rules)
+    related = sorted({code for alias in codes for code in _FORTIFY_CODES.get(alias, ())})
+    risk = min((RULES[code][0] for code in codes + related), key=_RISK_ORDER.__getitem__)
+    return {
+        "line": src.line(offset),
+        "ruleCodes": codes,
+        "relatedRuleCodes": related,
+        "dcsRisk": risk,
+        "dcsRule": RULES[codes[0]][1],
+        "level": level,
+        "message": message,
+        "fix": fix,
+    }
+
+
+def _typed_names(src: _Source, types: str) -> set[str]:
+    """Variables and fields declared with one of the given simple type names."""
+    pattern = rf"\b(?:{types})\s*(?:<[^;=(){{}}]*>)?\s+([A-Za-z_$][\w$]*)\s*[=;,)]"
+    return {match.group(1) for match in re.finditer(pattern, src.code)}
+
+
+def _receiver_calls(src: _Source, types: str, extra: tuple[str, ...] = ()):
+    """按调用位置核对变量绑定；同名参数、局部变量和字段不跨作用域继承类型。"""
+    names = _typed_names(src, types) | set(extra)
+    alternatives = [types] + (["|".join(re.escape(name) for name in sorted(names))] if names else [])
+    pattern = rf"(?<![\w$.])(?:this\s*\.\s*)?(?:{'|'.join(alternatives)})\s*\.\s*([A-Za-z_$][\w$]*)\s*\("
+    bindings = []
+    for declared in re.finditer(r"\b([\w$.]+(?:\s*<[^;=(){}]*>)?(?:\s*\[\s*\])*)\s+([A-Za-z_$][\w$]*)\s*(?=[=;,):])", src.code):
+        if declared.group(1) in _NOT_TYPES:
+            continue
+        braces = [(opening, end) for opening, end in src.pair.items() if src.code[opening] == "{" and opening < declared.start() < end]
+        if not braces:
+            continue
+        opening, end = max(braces)
+        head = src.code[max(src.code.rfind(char, 0, opening) for char in ";{}") + 1:opening]
+        field = bool(re.search(r"\b(?:class|interface|enum|record)\s+\w+|\bnew\s+[\w$.]+(?:<[^;(){}]*>)?\s*\([^;{}]*\)\s*$", head))
+        parens = [(start, close) for start, close in src.pair.items() if src.code[start] == "(" and opening < start < declared.start() < close]
+        if parens:
+            start, close = max(parens)
+            tail = re.match(r"\s*(?:throws\s+[\w$.,\s]+)?(?:->\s*)?", src.code[close + 1:])
+            scope = src.body_after(close + 1 + tail.end())
+            if scope is None:
+                continue
+            opening, end = scope
+            field = False
+        bindings.append((opening, end, declared.start(), field, re.sub(r"\s+", "", declared.group(1)), declared.group(2)))
+    for call in re.finditer(pattern, src.code):
+        receiver = re.sub(r"\s+", "", src.code[call.start():call.start(1)]).rstrip(".")
+        explicit = receiver.startswith("this.")
+        name = receiver.removeprefix("this.")
+        visible = [binding for binding in bindings if binding[5] == name and binding[0] < call.start() < binding[1]
+                   and (binding[3] or binding[2] < call.start()) and (not explicit or binding[3])]
+        if visible:
+            binding = max(visible, key=lambda item: (item[0], item[2]))
+            if not re.fullmatch(types, binding[4]):
+                continue
+            # 嵌套函数的参数或类型未能解析时，不能沿用外层绑定作阻断证明。
+            method = src.method_at(call.start())
+            boundary = max(binding[0] + 1, method["start"] if method else 0)
+            if not explicit and _nested_function(src, call.start(), boundary):
+                continue
+            if not explicit and any(call.start() < src.statement_end(lam.end()) for lam in re.finditer(rf"\b{re.escape(name)}\s*->", src.code[:call.start()])):
+                continue
+            yield call
+            continue
+        if not explicit and (re.fullmatch(types, name) or name in extra):
+            yield call
+
+
+# --- Forbidden platform internals, middleware clients, threads, reflection -------------------
+
+# (rule codes, targets, replacement). A target ending in "." is a package; a dotted name is a
+# class matched by import, by fully qualified use, or by simple name under a wildcard import; a
+# bare name is a class whose package DCS does not state, matched by simple name.
+_FORBIDDEN_TYPES = (
+    ("CVE-KD-0001", ("AccountUtils",), "read tenant/account data through the documented RequestContext getters"),
+    ("CVE-KD-0002", ("MCDBUtil",), "use the platform service helpers; MC database access is not open to customization"),
+    ("CVE-KD-0003", ("MCApiUtil",), "use the platform service helpers; MC APIs are not open to customization"),
+    ("CVE-KD-0004", ("LoginMCServiceDbImpl",), "use the documented login/session APIs"),
+    ("CVE-KD-0005", ("DBConfig",), "use QueryServiceHelper / BusinessDataServiceHelper; datasource configuration is internal"),
+    ("CVE-KD-0006", ("KDDriverUtil",), "use QueryServiceHelper / BusinessDataServiceHelper; JDBC drivers are internal"),
+    ("CVE-KD-0007", ("DataSourceFactory",), "use QueryServiceHelper / BusinessDataServiceHelper; datasources are internal"),
+    ("CVE-KD-0018", ("RequestContextInfo",), "read the current context through RequestContext.get() getters only"),
+    ("CVE-KD-0019-1", ("JedisClient",), "use the platform cache (CacheFactory distributed cache) instead of Redis clients"),
+    ("CVE-KD-0020", ("redis.clients.",), "use the platform cache (CacheFactory distributed cache) instead of Jedis"),
+    ("CVE-KD-0021", ("ZKFactory",), "do not access Zookeeper from customization; use platform locks/configuration services"),
+    ("CVE-KD-0022", ("org.apache.zookeeper.",), "do not access Zookeeper from customization"),
+    ("CVE-KD-20260901-2", ("org.apache.zookeeper.",), "do not access Zookeeper from customization"),
+    ("CVE-KD-20260901-3", ("org.apache.curator.",), "do not access Zookeeper from customization"),
+    ("CVE-KD-20260901-1", ("kd.bos.zk.",), "do not use kd.bos.zk; use platform locks/configuration services"),
+    ("CVE-KD-20260901-4", ("kd.bos.mq.MessageConsumer",), "do not consume MQ directly; use a platform-registered scheduled task or event subscription"),
+    ("CVE-KD-0023", ("com.rabbitmq.",), "do not use MQ clients directly from customization"),
+    ("CVE-KD-0024", ("org.apache.rocketmq.",), "do not use MQ clients directly from customization"),
+    ("CVE-KD-0025", ("org.apache.kafka.",), "do not use MQ clients directly from customization"),
+    ("CVE-KD-0029", ("java.net.Socket", "java.net.ServerSocket", "java.net.DatagramSocket",
+                     "java.nio.channels.SocketChannel", "java.nio.channels.ServerSocketChannel"),
+     "call external systems through the platform integration/HTTP facilities, never raw sockets"),
+    ("CVE-KD-0413", ("kd.bos.db.DB",), "use QueryServiceHelper (query/queryDataSet) or BusinessDataServiceHelper; KSQL through DB is not allowed"),
+    ("CVE-KD-2026-0508", ("kd.bos.orm.ORM",), "QueryServiceHelper.queryDataSet(algoKey, entity, fields, filters, orderBy) takes the same arguments as ORM.queryDataSet; use QueryServiceHelper.query/exists or BusinessDataServiceHelper for the rest"),
+    ("CVE-KD-0011-2", ("java.lang.reflect.",), "call the API directly; reflection breaks platform constraints"),
+    ("CVE-KD-0011-3", ("java.net.URLClassLoader",), "do not load classes dynamically from customization"),
+    ("CVE-KD-0012-1", ("ClassReader",), "do not manipulate bytecode from customization"),
+    ("CVE-KD-0012-2", ("ClassWriter",), "do not manipulate bytecode from customization"),
+    ("CVE-KD-0012-3", ("ClassVisitor",), "do not manipulate bytecode from customization"),
+    ("CVE-KD-0012-4", ("javassist.",), "do not manipulate bytecode from customization"),
+    ("CVE-KD-0012-5", ("ClassPool",), "do not manipulate bytecode from customization"),
+    ("CVE-KD-0012-6", ("CtMethod",), "do not manipulate bytecode from customization"),
+    ("CVE-KD-0012-7", ("java.lang.instrument.Instrumentation",), "do not instrument classes from customization"),
+    ("CVE-KD-0012-8", ("java.lang.instrument.ClassFileTransformer",), "do not instrument classes from customization"),
+    ("CVE-KD-0055-2", ("java.util.concurrent.FutureTask",), "run asynchronous work with kd.bos.threads.ThreadPools.executeOnce(name, runnable)"),
+    ("CVE-KD-0055-3", ("java.util.concurrent.ExecutorService",), "use kd.bos.threads.ThreadPools.executeOnce(name, runnable) or a kd.bos.threads.ThreadPool; do not hold an ExecutorService"),
+    ("CVE-KD-0055-4", ("java.util.concurrent.Executors",), "use kd.bos.threads.ThreadPools instead of Executors"),
+    ("CVE-KD-0055-5", ("java.util.concurrent.ThreadPoolExecutor",), "use kd.bos.threads.ThreadPools instead of ThreadPoolExecutor"),
+    ("CVE-KD-0055-6", ("java.util.concurrent.ForkJoinPool",), "use kd.bos.threads.ThreadPools instead of ForkJoinPool"),
+    ("CVE-KD-0055-7", ("java.util.concurrent.ScheduledExecutorService",), "use a platform scheduled task instead of a ScheduledExecutorService"),
+    ("CVE-KD-0055-8", ("java.util.concurrent.CompletableFuture",), "use kd.bos.threads.ThreadPools.executeOnce(name, runnable) instead of CompletableFuture"),
+    ("CVE-KD-0055-9", ("java.util.concurrent.Future",), "use kd.bos.threads.ThreadPools.executeOnce(name, runnable); do not wait on a Future"),
+    ("CVE-KD-0501", ("sun.", "com.sun.", "javax.xml.bind.", "javax.xml.ws.", "javax.jws.", "javax.activation.",
+                     "javax.annotation.PostConstruct", "javax.annotation.PreDestroy"),
+     "JDK internal or removed APIs fail the JDK 17 build; use java.util.Base64, java.time and other public JDK APIs"),
+)
+
+_IMPORT_RE = re.compile(r"^[ \t]*import\s+(static\s+)?([\w.$]+?)(\.\*)?\s*;", re.MULTILINE)
+
+
+def _imports(src: _Source) -> list[tuple[int, str, bool, bool]]:
+    return [(match.start(2), match.group(2), bool(match.group(1)), bool(match.group(3)))
+            for match in _IMPORT_RE.finditer(src.code)]
+
+
+def _forbidden_type_issues(src: _Source) -> list[dict]:
+    issues = []
+    imports = _imports(src)
+    body = _IMPORT_RE.sub(lambda match: " " * len(match.group(0)), src.code)
+    for code, targets, fix in _FORBIDDEN_TYPES:
+        hit = None
+        for target in targets:
+            if target.endswith("."):
+                hit = next((offset for offset, name, _static, _wild in imports if (name + ".").startswith(target)), None)
+                if hit is None:
+                    match = re.search(rf"(?<![\w.]){re.escape(target)}\w", body)
+                    hit = match.start() if match else None
+            elif "." in target:
+                package, simple = target.rsplit(".", 1)
+                hit = next((offset for offset, name, static, wild in imports
+                            if name == target or (static and name.startswith(target + "."))
+                            or (wild and name == package and re.search(rf"\b{simple}\b", body))), None)
+                if hit is None:
+                    match = re.search(rf"(?<![\w.]){re.escape(target)}\b", body)
+                    hit = match.start() if match else None
+            else:
+                match = re.search(rf"(?<![\w$]){re.escape(target)}(?![\w$])", src.code)
+                hit = match.start() if match else None
+            if hit is not None:
+                break
+        if hit is not None:
+            issues.append(_issue(src, hit, code, f"forbidden by DCS: {RULES[code][1]}", fix))
+    return issues
+
+
+# Calls forbidden anywhere: (pattern over code, rule codes, message, fix).
+_FORBIDDEN_CALLS = (
+    (r"\bSystem\s*\.\s*getenv\s*\(", "CVE-KD-0008", "System.getenv", "read configuration through the platform parameter/configuration services"),
+    (r"\bSystem\s*\.\s*getProperty\s*\(", "CVE-KD-0009", "System.getProperty", "read configuration through the platform parameter/configuration services"),
+    (r"\bSystem\s*\.\s*getProperties\s*\(", "CVE-KD-0010", "System.getProperties", "read configuration through the platform parameter/configuration services"),
+    (r"\bSystem\s*\.\s*setProperty\s*\(", "CVE-KD-0017", "System.setProperty", "never change JVM-wide state from a plugin"),
+    (r"\bClass\s*\.\s*forName\s*\(", "CVE-KD-0011-1", "Class.forName", "reference the class directly"),
+    (r"\.\s*getDeclared(?:Method|Field|Constructor)s?\s*\(", "CVE-KD-0011-2", "reflective member lookup", "call the API directly"),
+    (r"\.\s*setAccessible\s*\(", ("java:S3011", "CVE-KD-0011-2"), "setAccessible bypasses access control", "use the public API"),
+    (r"\bLang\s*\.\s*setHolder\s*\(", "CVE-KD-0400", "Lang.setHolder", "never change the request language holder"),
+    (r"\bRequestContext\b[\s\S]{0,80}?\.\s*setAccountId\s*\(", "CVE-KD-0014-1", "RequestContext.setAccountId", "never switch the account of the current request"),
+    (r"\bRequestContext\b[\s\S]{0,80}?\.\s*setTenantId\s*\(", "CVE-KD-0014-2", "RequestContext.setTenantId", "never switch the tenant of the current request"),
+    (r"\bSessionInfo\s*\.\s*get\s*\(\s*\)\s*\.\s*set\w*\s*\(", "CVE-KD-0015-1", "SessionInfo setter", "never modify the session"),
+    (r"\bSystem\s*\.\s*(?:out|err)\s*\.\s*print", ("CVE-KD-0209-1", "java:S106"), "System.out/err printing",
+     "log through kd.bos.logging.Log: private static final Log LOG = LogFactory.getLog(X.class)"),
+    (r"\.\s*printStackTrace\s*\(", "CVE-KD-0209-2", "printStackTrace()", "log with LOG.error(\"business message\", e) or rethrow with the cause"),
+    (r"\bSystem\s*\.\s*gc\s*\(|\bRuntime\s*\.\s*getRuntime\s*\(\s*\)\s*\.\s*gc\s*\(", ("java:S1215", "DM_GC"), "explicit garbage collection", "remove the call"),
+    (r"\bSystem\s*\.\s*exit\s*\(|\bRuntime\s*\.\s*getRuntime\s*\(\s*\)\s*\.\s*(?:exit|halt)\s*\(", "DM_EXIT", "System.exit", "throw a KDBizException instead of stopping the JVM"),
+    (r"\bnew\s+(?:java\.lang\.)?Thread\s*\(|\bextends\s+(?:java\.lang\.)?Thread\b", "CVE-KD-0055-1", "native thread", "run asynchronous work with kd.bos.threads.ThreadPools.executeOnce(name, runnable)"),
+    (r"\bnew\s+(?:java\.util\.)?Timer\s*\(", "CVE-KD-0055-1", "java.util.Timer starts a native thread", "use a platform scheduled task"),
+    (r"\bMetadataDao\s*\.", "CVE-KD-0059-1", "MetadataDao", "read runtime metadata through EntityMetadataCache.getDataEntityType(entityNumber)"),
+    (r"\bDeleteServiceHelper\s*\.\s*delete\s*\(", "CVE-KD-0717-2", "DeleteServiceHelper.delete deletes rows directly",
+     "delete through the operation: OperationServiceHelper.executeOperate(\"delete\", entityNumber, ids, OperateOption.create()) so validations and plugins run"),
+    (r"\bBusinessDataWriter\s*\.\s*delete\s*\(", "CVE-KD-0717-3", "BusinessDataWriter.delete deletes rows directly",
+     "delete through OperationServiceHelper.executeOperate(\"delete\", ...)"),
+    (r"\bORM\b[^;]*?\.\s*delete\s*\(", "CVE-KD-0717-4", "ORM.delete deletes rows directly",
+     "delete through OperationServiceHelper.executeOperate(\"delete\", ...)"),
+    (r"\bnew\s+(?:java\.io\.)?ObjectInputStream\s*\(|\bnew\s+(?:java\.beans\.)?XMLDecoder\s*\(|setAutoTypeSupport\s*\(\s*true",
+     "FORTIFY:Unsafe Deserialization", "unsafe deserialization", "exchange data as JSON into explicit types"),
+)
+
+
+def _forbidden_call_issues(src: _Source) -> list[dict]:
+    issues = []
+    for pattern, codes, what, fix in _FORBIDDEN_CALLS:
+        for match in re.finditer(pattern, src.code):
+            issues.append(_issue(src, match.start(), codes, f"{what} is forbidden by DCS", fix))
+    for name in _typed_names(src, "SessionInfo"):
+        for match in re.finditer(rf"(?<![\w$.]){re.escape(name)}\s*\.\s*set\w*\s*\(", src.code):
+            issues.append(_issue(src, match.start(), "CVE-KD-0015-1", "SessionInfo setter is forbidden by DCS", "never modify the session"))
+    return issues
+
+
+# --- 客户新增的指定调用和高风险源码检查 -------------------------------------------------------
+
+
+def _catalogue_issues(src: _Source) -> list[dict]:
+    issues = []
+    for code, entry in CATALOG["rules"].items():
+        check = entry.get("check", {})
+        if entry["engine"] != "sonar" or check.get("kind") not in ("循环里面指定方法", "指定类中指定方法"):
+            continue
+        # 表中多方法配置仅首项带全限定类名，后续项为同类方法名。
+        target, *extra = check["target"].split(",")
+        if "." not in target:
+            continue
+        owner, method = target.rsplit(".", 1)
+        simple = owner.rsplit(".", 1)[-1]
+        for call in _receiver_calls(src, re.escape(owner) + "|" + re.escape(simple)):
+            if call.group(1) not in (method, *extra):
+                continue
+            if check["kind"] == "循环里面指定方法" and not src.loop_depth(call.start()):
+                continue
+            issues.append(_issue(src, call.start(), code, f"{owner}.{call.group(1)}: {entry['name']}",
+                                 _LOOP_FIX if check["kind"] == "循环里面指定方法" else "use the published metadata/cache API; never mutate MetadataDao internals"))
+    for offset, literal in src.literals:
+        if "/*dialect*/" in literal.lower():
+            issues.append(_issue(src, offset, "CVE-KD-0060-1", "dialect SQL in Java source", "use QueryServiceHelper/QFilter instead of dialect SQL"))
+    return issues
+
+
+def _additional_security_issues(src: _Source) -> list[dict]:
+    issues = []
+    patterns = (
+        (r"\bRuntime\s*\.\s*getRuntime\s*\(\s*\)\s*\.\s*exec\s*\(|\bnew\s+(?:java\.lang\.)?ProcessBuilder\s*\(",
+         "Command Injection", "external process execution", "use platform services; never build shell commands from request values"),
+        (r"\bScriptEngineManager\b|\.\s*eval\s*\(", "Dynamic Code Evaluation: Script Injection", "dynamic script evaluation", "replace evaluation with explicit Java logic and validated parameters"),
+    )
+    for pattern, name, message, fix in patterns:
+        codes = [code for code, entry in CATALOG["rules"].items() if entry["engine"] == "fortify" and entry["name"] == name]
+        for match in re.finditer(pattern, src.code):
+            # 不知道具体 Fortify 调用链，不把危险入口直接当作已证实注入。
+            issues.append(_issue(src, match.start(), codes, message + "; verify input provenance", fix, ADVISE))
+    predictable_seed = re.compile(r"[-+]?\d+[lL]?|new\s+byte\s*\[\s*\d+\s*\]|new\s+byte\s*\[\s*\]\s*\{\s*[-+\d,\s]*\}")
+    for created in re.finditer(r"\bnew\s+(?:java\.security\.)?SecureRandom\s*\(", src.code):
+        arguments = _arguments(src, created.end() - 1)
+        if arguments and (predictable_seed.fullmatch(arguments[0]) or "currentTimeMillis" in arguments[0]):
+            issues.append(_issue(src, created.start(), "java:S4347", "predictable SecureRandom seed", "use new SecureRandom() without a manually predictable seed"))
+        for call in _instance_calls(src, created):
+            arguments = _arguments(src, call.end() - 1)
+            if call.group(1) == "setSeed" and arguments and (predictable_seed.fullmatch(arguments[0]) or "currentTimeMillis" in arguments[0]):
+                issues.append(_issue(src, call.start(), "java:S4347", "predictable SecureRandom seed", "allow SecureRandom to seed itself"))
+    for name, pattern, fix in (
+        ("Server-Side Request Forgery", r"\bnew\s+(?:java\.net\.)?URL\s*\(", "allowlist protocol and destination host; reject private-network addresses and revalidate redirects"),
+        ("Open Redirect", r"\.\s*sendRedirect\s*\(", "use a trusted relative path or an explicit destination allowlist"),
+        ("Header Manipulation", r"\.\s*(?:setHeader|addHeader)\s*\(", "reject CR/LF and validate header names/values"),
+        ("Path Manipulation", r"\bnew\s+(?:java\.io\.)?File\s*\(|\bPaths\s*\.\s*get\s*\(", "resolve under a trusted root and check normalized containment before filesystem access"),
+    ):
+        codes = [code for code, entry in CATALOG["rules"].items() if entry["engine"] == "fortify" and entry["name"] == name]
+        for match in re.finditer(pattern, src.code):
+            arguments = _arguments(src, match.end() - 1)
+            if not arguments or all(re.fullmatch(r'"(?:\\.|[^"\\])*"', argument) for argument in arguments):
+                continue
+            issues.append(_issue(src, match.start(), codes, name + ": dynamic input needs data-flow review", fix, ADVISE))
+    for match in re.finditer(r"\.\s*(?:enableDefaultTyping|activateDefaultTyping)\s*\(", src.code):
+        issues.append(_issue(src, match.start(), ("java:S4544", "FORTIFY:Unsafe Deserialization"), "Jackson polymorphic deserialization needs validation",
+                             "deserialize into explicit DTO types; do not enable unrestricted default typing", ADVISE))
+    for call in _receiver_calls(src, r"HttpsURLConnection|javax\.net\.ssl\.HttpsURLConnection"):
+        if call.group(1) not in ("setHostnameVerifier", "setDefaultHostnameVerifier"):
+            continue
+        arguments = _arguments(src, call.end() - 1)
+        if arguments and re.fullmatch(r"\([^()]*\)\s*->\s*(?:true|\{\s*return\s+true\s*;\s*\})", arguments[0]):
+            issues.append(_issue(src, call.start(), "java:S5527", "hostname verifier accepts every host", "use the default hostname verifier; never bypass TLS identity checks"))
+    # 定位具体 TLS 方法声明，兼顾通用方法读取器未枚举的局部类和匿名类。
+    for method in re.finditer(r"\b(void|boolean)\s+(checkServerTrusted|checkClientTrusted|verify)\s*\(", src.code):
+        params_close = src.pair.get(method.end() - 1)
+        if params_close is None:
+            continue
+        tail = re.match(r"\s*(?:throws\s+[\w$.,\s]+)?\{", src.code[params_close + 1:])
+        if tail is None:
+            continue
+        body_start = params_close + 1 + tail.end()
+        body_close = src.pair.get(body_start - 1)
+        if body_close is None:
+            continue
+        body = src.code[body_start:body_close].strip()
+        ancestors = [opening for opening, close in src.pair.items() if src.code[opening] == "{" and opening < method.start() < close]
+        owner_start = max(ancestors, default=0)
+        owner_head = src.code[max(src.code.rfind(char, 0, owner_start) for char in ";{}") + 1:owner_start]
+        if method.group(1) == "void" and method.group(2) in ("checkServerTrusted", "checkClientTrusted") and re.search(r"\b(?:X509TrustManager|X509ExtendedTrustManager)\b", owner_head) and not body:
+            issues.append(_issue(src, method.start(2), "java:S4830", "trust manager accepts certificates without validation", "use the platform/default trust manager and trusted certificate chain"))
+        if method.group(1) == "boolean" and method.group(2) == "verify" and re.search(r"\bHostnameVerifier\b", owner_head) and re.fullmatch(r"return\s+true\s*;", body):
+            issues.append(_issue(src, method.start(2), "java:S5527", "hostname verifier always returns true", "use the default hostname verifier"))
+    return issues
+
+
+def _nested_function(src: _Source, offset: int, boundary: int) -> bool:
+    """判断跳转是否属于指定边界内的另一函数或类声明。"""
+    if any(method["headStart"] >= boundary and method["start"] <= offset <= method["end"] for method in src.methods):
+        return True
+    nested = [opening for opening, end in src.pair.items() if src.code[opening] == "{" and boundary <= opening < offset < end]
+    if any(_block_owner(src, opening) == "->" for opening in nested):
+        return True
+    # 通用方法读取器只枚举外层方法，因此还需排除局部类和匿名类的整个声明体。
+    return any(re.search(r"\b(?:class|interface|enum|record)\s+\w+|\bnew\s+[\w$.]+(?:<[^;(){}]*>)?\s*\([^;{}]*\)\s*$",
+                         src.code[max(src.code.rfind(char, 0, opening) for char in ";{}") + 1:opening]) for opening in nested)
+
+
+def _finally_jumps(src: _Source):
+    """仅识别会离开 finally 的跳转，不把嵌套函数或内部循环的跳转当作退出。"""
+    for match in re.finditer(r"\bfinally\s*\{", src.code):
+        close = src.pair.get(match.end() - 1)
+        if close is None:
+            continue
+        for jump in re.finditer(r"\b(return|break|continue|throw)\b", src.code[match.end():close]):
+            offset = match.end() + jump.start()
+            nested = [(opening, end) for opening, end in src.pair.items()
+                      if src.code[opening] == "{" and match.end() <= opening < offset < end]
+            if _nested_function(src, offset, match.end()):
+                continue
+            if jump.group(1) in ("break", "continue"):
+                # 带标签跳转需要解析目标；源码预检不猜测其目标是否位于 finally 外。
+                if re.match(r"\s+[A-Za-z_$]", src.code[offset + len(jump.group(1)):]):
+                    continue
+                if any(match.end() <= start < offset < end for start, end in src.loops):
+                    continue
+                if jump.group(1) == "break" and any(_block_owner(src, opening) == "switch" for opening, _end in nested):
+                    continue
+            caught = jump.group(1) == "throw" and any(
+                _block_owner(src, opening) == "try" and re.match(r"\s*catch\b", src.code[end + 1:])
+                for opening, end in nested
+            )
+            yield offset, jump.group(1), ADVISE if caught else BLOCK
+
+
+def _additional_code_issues(src: _Source) -> list[dict]:
+    issues = []
+    for method in src.methods:
+        body = src.code[method["start"]:method["end"]]
+        if method["name"] == "finalize" and not method["params"].strip():
+            issues.append(_issue(src, method["nameOffset"], "java:S1113", "finalize() override", "remove finalization; manage resources explicitly with try-with-resources"))
+        if re.search(r"\bBoolean\s*$", method["prefix"]):
+            for match in re.finditer(r"\breturn\s+null\s*;", body):
+                offset = method["start"] + match.start()
+                if _nested_function(src, offset, method["start"]):
+                    continue
+                issues.append(_issue(src, offset, "java:S2447", "Boolean method returns null", "return Boolean.TRUE/FALSE or use a primitive boolean"))
+                break
+        resources = [(method["start"] + match.end() - 1, src.pair.get(method["start"] + match.end() - 1, -1)) for match in re.finditer(r"\btry\s*\(", body)]
+        for created in re.finditer(r"\b(?:([\w$]+)\s*=\s*)new\s+(?:[\w$]+\.)*(FileInputStream|FileOutputStream|FileReader|FileWriter|BufferedReader|BufferedWriter|DataInputStream|DataOutputStream|ZipFile)\s*\(", body):
+            offset = method["start"] + created.start()
+            if any(opening < offset < close for opening, close in resources):
+                continue
+            after = body[created.end():]
+            if re.search(rf"\b{re.escape(created.group(1))}\s*\.\s*close\s*\(", after):
+                continue
+            issues.append(_issue(src, offset, ("java:S2095", "java:S2093"), "resource closure/ownership is not verified",
+                                 "use try-with-resources; if ownership is transferred, verify the caller closes it", ADVISE))
+    for offset, jump, level in _finally_jumps(src):
+        rule = "java:S1163" if jump == "throw" else "java:S1143"
+        issues.append(_issue(src, offset, rule, f"{jump} inside finally may discard the original outcome", "move control-flow changes outside finally", level))
+    for call in _receiver_calls(src, "Thread|java\\.lang\\.Thread"):
+        if call.group(1) in ("wait", "notify", "notifyAll"):
+            issues.append(_issue(src, call.start(), "java:S2236", "monitor operation on a Thread instance", "use a dedicated lock object or platform synchronization API"))
+    jdbc_values = "Array|AsciiStream|BigDecimal|BinaryStream|Blob|Boolean|Byte|Bytes|CharacterStream|Clob|Date|Double|Float|Int|Long|NCharacterStream|NClob|NString|Null|Object|Ref|RowId|Short|SQLXML|String|Time|Timestamp|UnicodeStream|URL"
+    for types, methods in ((r"PreparedStatement|CallableStatement|java\.sql\.PreparedStatement|java\.sql\.CallableStatement", rf"set(?:{jdbc_values})|registerOutParameter"),
+                           (r"ResultSet|java\.sql\.ResultSet", rf"(?:get|update)(?:{jdbc_values})")):
+        for call in _receiver_calls(src, types):
+            if not re.fullmatch(methods, call.group(1)):
+                continue
+            arguments = _arguments(src, call.end() - 1)
+            if arguments and re.fullmatch(r"[-+]?\d+[lL]?", arguments[0]) and int(arguments[0].rstrip("lL")) <= 0:
+                issues.append(_issue(src, call.start(), "java:S2695", "JDBC index is not positive (indices start at 1)", "use a valid 1-based parameter/column index"))
+    for match in re.finditer(r"\b(?:System|Runtime)\s*\.\s*runFinalizersOnExit\s*\(", src.code):
+        issues.append(_issue(src, match.start(), "java:S2151", "runFinalizersOnExit is unsafe", "remove the call"))
+    for match in re.finditer(r"\b(?:new\s+(?:java\.lang\.)?ThreadGroup\s*\(|(?:java\.lang\.)?ThreadGroup\s+\w+)", src.code):
+        issues.append(_issue(src, match.start(), "java:S3014", "ThreadGroup use", "use kd.bos.threads.ThreadPools"))
+    for match in re.finditer(r"\.\s*indexOf\s*\([^;()]*\)\s*>\s*0\b", src.code):
+        issues.append(_issue(src, match.start(), "java:S2692", "indexOf > 0 excludes a match at the start", "use >= 0 when checking containment, or justify excluding index 0", ADVISE))
+    return issues
+
+
+# --- Static collections ---------------------------------------------------------------------
+
+_STATIC_FIELD_RE = re.compile(
+    r"\bstatic\s+(?:(?:final|transient|volatile|public|protected|private)\s+)*"
+    r"(?:[\w$]+\.)*(?P<type>[A-Za-z_$][\w$]*)\s*(?:<[^;=(){}]*>)?\s*(?:\[\s*\])*\s+"
+    r"(?P<name>[A-Za-z_$][\w$]*)\s*(?P<end>[=;,])"
+)
+
+
+def _static_collection_issues(src: _Source) -> list[dict]:
+    issues = []
+    for match in _STATIC_FIELD_RE.finditer(src.code):
+        declared = match.group("type")
+        if declared not in _STATIC_COLLECTIONS or re.search(r"\[\s*\]", match.group(0)):
+            continue
+        codes = [f"CVE-KD-0056-{_STATIC_COLLECTIONS[declared]}"]
+        if match.group("end") == "=":
+            created = re.match(r"\s*new\s+(?:[\w$]+\.)*([A-Za-z_$][\w$]*)", src.code[match.end():])
+            if created and created.group(1) in _STATIC_COLLECTIONS and created.group(1) != declared:
+                codes.append(f"CVE-KD-0056-{_STATIC_COLLECTIONS[created.group(1)]}")
+        issues.append(_issue(
+            src, match.start(), codes,
+            f"static collection field '{match.group('name')}' ({declared}); DCS rejects static collections even when final",
+            "keep the collection in a local variable or an instance field; for fixed lookup values use a "
+            "static final array, a switch or an enum",
+        ))
+    return issues
+
+
+# --- Calls inside loops ---------------------------------------------------------------------
+
+_DB_HELPERS = "BusinessDataServiceHelper|QueryServiceHelper|SaveServiceHelper|DeleteServiceHelper|OperationServiceHelper|BusinessDataReader|BusinessDataWriter|DB|ORM|DBServiceHelper"
+_LOOP_SERVICES = {
+    "RedisSessionlessCache": "CVE-KD-0051-03", "DistributeSessionlessCache": "CVE-KD-0051-03",
+    "RedisSessionableCache": "CVE-KD-0051-04", "DistributeSessionableCache": "CVE-KD-0051-04",
+    "BusinessDataReader": "CVE-KD-0051-07", "BusinessDataWriter": "CVE-KD-0051-08",
+    "OperationServiceHelper": "CVE-KD-0051-09", "SaveServiceHelper": "CVE-KD-0051-10",
+    "DeleteServiceHelper": "CVE-KD-0051-11",
+}
+_LOOP_FIX = "load or query everything once before the loop (one call with an IN filter / id array), work on the result in memory, and save once after the loop"
+
+
+def _loop_issues(src: _Source) -> list[dict]:
+    issues: list[dict] = []
+    seen: set[int] = set()
+
+    def add(offset: int, codes, message: str, fix: str, level: str = BLOCK) -> None:
+        if offset not in seen:
+            seen.add(offset)
+            issues.append(_issue(src, offset, codes, message, fix, level))
+
+    # Database and service access, with the nesting depth that decides 1215-1 / 1215-2.
+    orm_names = _typed_names(src, "ORM")
+    db_receivers = _DB_HELPERS + ("|" + "|".join(re.escape(name) for name in sorted(orm_names)) if orm_names else "")
+    for match in re.finditer(rf"(?<![\w$.])({db_receivers})\s*\.\s*([A-Za-z_$][\w$]*)\s*\(", src.code):
+        depth = src.loop_depth(match.start())
+        if not depth:
+            continue
+        receiver, method = match.group(1), match.group(2)
+        codes = []
+        if receiver in _LOOP_SERVICES:
+            codes.append(_LOOP_SERVICES[receiver])
+        if receiver == "BusinessDataServiceHelper" and method == "loadHead":
+            codes.append("CVE-KD-TS-0051-46")
+        if depth >= 3:
+            codes.append("CVE-KD-1215-2")
+        elif depth == 2:
+            codes.append("CVE-KD-1215-1")
+        call = f"{receiver}.{method}"
+        if codes:
+            add(match.start(), codes, f"{call} inside {depth} nested loop(s)", _LOOP_FIX)
+        else:
+            add(match.start(), "CVE-KD-1215-1", f"{call} inside a loop reads/writes the database once per row; "
+                "platform standards forbid it and DCS rejects it once loops nest", _LOOP_FIX, ADVISE)
+    for types, code in (("RedisSessionlessCache|DistributeSessionlessCache", "CVE-KD-0051-03"),
+                        ("RedisSessionableCache|DistributeSessionableCache", "CVE-KD-0051-04")):
+        for name in _typed_names(src, types):
+            for match in re.finditer(rf"(?<![\w$.]){re.escape(name)}\s*\.\s*\w+\s*\(", src.code):
+                if src.loop_depth(match.start()):
+                    add(match.start(), code, "distributed cache access inside a loop", "read/write the cache in one batch call outside the loop")
+    for match in re.finditer(r"\bupdateView\s*\(", src.code):
+        if src.loop_depth(match.start()):
+            add(match.start(), "CVE-KD-0052", "updateView() inside a loop", "set values in the loop and call getView().updateView(key) once after it")
+    page_cache = _typed_names(src, "IPageCache|PageCache|RootPageCache")
+    cache_calls = r"\bget(?:Root)?PageCache\s*\(\s*\)\s*\.\s*\w+\s*\("
+    if page_cache:
+        cache_calls += "|" + "|".join(rf"(?<![\w$.]){re.escape(name)}\s*\.\s*\w+\s*\(" for name in sorted(page_cache))
+    for match in re.finditer(cache_calls, src.code):
+        if src.loop_depth(match.start()):
+            code = "CVE-KD-0054-2" if "Root" in match.group(0) else "CVE-KD-0054-1"
+            add(match.start(), code, "page cache access inside a loop", "collect the values in a local map and put/read the page cache once outside the loop")
+    log_names = _typed_names(src, "Log|Logger") | {"log", "logger", "LOG", "LOGGER"}
+    log_pattern = rf"(?<![\w$.])(?:{'|'.join(re.escape(name) for name in sorted(log_names))}|LogFactory\s*\.\s*getLog\s*\([^)]*\))\s*\.\s*(?:trace|debug|info|warn|error|fatal)\s*\("
+    for match in re.finditer(log_pattern, src.code):
+        if src.loop_depth(match.start()):
+            add(match.start(), ("CVE-KD-0058-1",), "log call inside a loop",
+                "collect what matters in the loop and write one summary log after it")
+    for match in re.finditer(r"\bDispatchServiceHelper\s*\.\s*invoke\w*\s*\(|\bServiceFactory\s*\.\s*getService\s*\([^)]*\)\s*\.\s*\w+\s*\(", src.code):
+        if src.loop_depth(match.start()):
+            add(match.start(), "CVE-KD-0201", "microservice call inside a loop", "pass the whole batch to one service call outside the loop")
+    for match in re.finditer(r"\bPattern\s*\.\s*compile\s*\(", src.code):
+        if src.loop_depth(match.start()):
+            add(match.start(), "IIL_PATTERN_COMPILE_IN_LOOP", "Pattern.compile inside a loop", "compile once into a private static final Pattern")
+    for method in src.methods:
+        body = src.code[method["start"]:method["end"]]
+        strings = set(re.findall(r"\bString\s+([A-Za-z_$][\w$]*)\s*[=;]", body))
+        for name in strings:
+            for match in re.finditer(rf"(?<![\w$.]){re.escape(name)}\s*(?:\+=|=\s*{re.escape(name)}\s*\+)", body):
+                offset = method["start"] + match.start()
+                if src.loop_depth(offset):
+                    add(offset, "java:S1643", f"string '{name}' concatenated with + inside a loop", "append to a StringBuilder and convert once after the loop")
+    return issues
+
+
+# --- Data access: filters, deletes, SQL keywords ---------------------------------------------
+
+# SDK 重载签名；None 表示按主键读取，不得当作无条件查询。
+_FILTER_OVERLOADS = {
+    ("QueryServiceHelper", "query"): (
+        (("String", "String", "QFilter[]"), 2),
+        (("String", "String", "QFilter[]", "String"), 2),
+        (("String", "String", "QFilter[]", "String", "int"), 2),
+        (("String", "String", "String", "QFilter[]", "String"), 3),
+        (("String", "String", "String", "QFilter[]", "String", "int"), 3),
+    ),
+    ("QueryServiceHelper", "queryOne"): ((("String", "String", "QFilter[]"), 2),),
+    ("QueryServiceHelper", "queryDataSet"): (
+        (("String", "String", "String", "QFilter[]", "String"), 3),
+        (("String", "String", "String", "QFilter[]", "String", "int"), 3),
+    ),
+    ("QueryServiceHelper", "exists"): ((("String", "Object"), None), (("String", "QFilter[]"), 1)),
+    ("QueryServiceHelper", "queryPrimaryKeys"): (
+        (("String", "QFilter[]", "String", "int"), 1),
+        (("String", "String", "QFilter[]", "String", "int"), 2),
+        (("String", "IDataEntityType", "QFilter[]", "String", "int"), 2),
+    ),
+    ("BusinessDataServiceHelper", "load"): (
+        (("String", "String", "QFilter[]"), 2),
+        (("String", "String", "QFilter[]", "String"), 2),
+        (("String", "String", "QFilter[]", "String", "int"), 2),
+        (("String", "String", "QFilter[]", "String", "int", "int"), 2),
+        (("Object[]", "DynamicObjectType"), None),
+    ),
+    ("BusinessDataServiceHelper", "loadFromCache"): (
+        (("Object[]", "DynamicObjectType"), None),
+        (("String", "String", "QFilter[]"), 2),
+        (("String", "String", "QFilter[]", "String"), 2),
+        (("DynamicObjectType", "QFilter[]"), 1),
+    ),
+    ("BusinessDataServiceHelper", "loadSingle"): (
+        (("Object", "DynamicObjectType"), None),
+        (("Object", "DynamicObjectType", "int", "int"), None),
+        (("Object", "String"), None),
+        (("Object", "String", "String"), None),
+        (("String", "QFilter[]"), 1),
+        (("String", "String", "QFilter[]"), 2),
+    ),
+    ("BusinessDataServiceHelper", "loadSingleFromCache"): (
+        (("Object", "String", "String"), None),
+        (("String", "String", "QFilter[]"), 2),
+        (("Object", "DynamicObjectType"), None),
+    ),
+}
+_EMPTY_FILTER_RE = re.compile(r"^(?:\(\s*(?:kd\.bos\.orm\.query\.)?QFilter\s*\[\s*\]\s*\)\s*)?null$|^new\s+(?:kd\.bos\.orm\.query\.)?QFilter\s*\[\s*0?\s*\]\s*(?:\{\s*\})?$")
+
+
+def _arguments(src: _Source, open_paren: int) -> list[str]:
+    """The call's arguments, split on the code view (commas in literals do not count) and read from
+    the literal-preserving view so a string argument still holds a position."""
+    close = src.pair.get(open_paren)
+    if close is None:
+        return []
+    parts, start, index = [], open_paren + 1, open_paren + 1
+    while index < close:
+        char = src.code[index]
+        if char in "({[" and index in src.pair:
+            index = src.pair[index] + 1
+            continue
+        if char == ",":
+            parts.append(src.lit[start:index])
+            start = index + 1
+        index += 1
+    parts.append(src.lit[start:close])
+    arguments = [" ".join(part.split()) for part in parts]
+    return arguments if any(arguments) else []
+
+
+def _expression_type(src: _Source, expression: str, offset: int) -> str | None:
+    """仅推断字面量、显式类型和当前方法中的声明；未知表达式不冒充已解析重载。"""
+    if expression == "null":
+        return "null"
+    if re.fullmatch(r'"(?:\\.|[^"\\])*"', expression):
+        return "String"
+    if re.fullmatch(r"[-+]?\d+|(?:Integer\.)?(?:MAX_VALUE|MIN_VALUE)", expression):
+        return "int"
+    if re.fullmatch(r"[-+]?\d+[lL]", expression):
+        return "long"
+    typed = re.match(r"\(\s*([\w$.]+)\s*(\[\s*\])?\s*\)", expression) or re.match(r"new\s+([\w$.]+)\s*(\[)?", expression)
+    if typed:
+        return typed.group(1).rsplit(".", 1)[-1] + ("[]" if typed.group(2) else "")
+    if re.fullmatch(r"(?:this\.)?[A-Za-z_$][\w$]*", expression):
+        name = expression.removeprefix("this.")
+        method = src.method_at(offset)
+        scope = src.code[method["headStart"]:offset] if method else src.code[:offset]
+        declarations = list(re.finditer(rf"\b([\w$.]+)\s*(\[\s*\])?\s+{re.escape(name)}\s*(?=[=;,)]|$)", scope))
+        if declarations and declarations[-1].group(1) not in _NOT_TYPES and not expression.startswith("this."):
+            declared = declarations[-1]
+            return declared.group(1).rsplit(".", 1)[-1] + ("[]" if declared.group(2) else "")
+        field = next((item for item in _fields(src) if item["name"] == name), None)
+        if field:
+            return field["type"].rsplit(".", 1)[-1]
+    return None
+
+
+def _data_access_issues(src: _Source) -> list[dict]:
+    issues = []
+    for match in re.finditer(r"(?<![\w$.])(QueryServiceHelper|BusinessDataServiceHelper)\s*\.\s*(\w+)\s*\(", src.code):
+        overloads = _FILTER_OVERLOADS.get((match.group(1), match.group(2)), ())
+        arguments = _arguments(src, match.end() - 1)
+        types = [_expression_type(src, argument, match.start()) for argument in arguments]
+        candidates = [(signature, index) for signature, index in overloads if len(signature) == len(types) and all(
+            actual is None or actual == expected or expected == "Object"
+            or (actual == "null" and expected != "int")
+            for actual, expected in zip(types, signature))]
+        # exists(entity, null) 按 Java 的最具体重载选择 QFilter[]，显式 Object 转型则是主键。
+        if match.group(1, 2) == ("QueryServiceHelper", "exists") and len(types) == 2 and types[1] in ("null", "QFilter[]"):
+            candidates = [item for item in candidates if item[1] is not None]
+        empty = [index for _signature, index in candidates if index is not None and _EMPTY_FILTER_RE.fullmatch(arguments[index])]
+        if empty:
+            proven = len(empty) == len(candidates)
+            issues.append(_issue(
+                src, match.start(), "CVE-KD-0303",
+                f"{match.group(1)}.{match.group(2)} " + ("without a filter reads the whole table" if proven else "may select an overload with an empty filter; verify the argument types"),
+                "pass a real QFilter (id IN, bill number, organization, date range ...); never null or an empty QFilter array",
+                BLOCK if proven else ADVISE,
+            ))
+    sql_rules = (
+        (r"\bcreate\s+view\b", "CVE-KD-0720-1", "create view in code", "model an entity/report instead of a database view"),
+        (r"\bselect\s+\*", "CVE-KD-0053-01", "select * in SQL", "list the needed columns explicitly"),
+        (r"\bdrop\s+table\b", "CVE-KD-0013-1", "drop table in code", "schema changes are not allowed from plugin code"),
+        (r"\btruncate\s+table\b", "CVE-KD-0013-2", "truncate table in code", "schema/data wipes are not allowed from plugin code"),
+        (r"\brename\s+table\b|\balter\s+table\s+\S+\s+rename\b", "CVE-KD-0013-3", "rename table in code", "schema changes are not allowed from plugin code"),
+        (r"\bcreate\s+(?:or\s+replace\s+)?view\b", "CVE-KD-0720-2", "create view in code", "model the data as an entity/report instead of a database view"),
+        (r"\bcreate\s+or\s+replace\s+procedure\b", "CVE-KD-0721-2", "create procedure in code", "implement the logic in Java"),
+        (r"\bcreate\s+procedure\b", "CVE-KD-0721-1", "create procedure in code", "implement the logic in Java"),
+        (r"\bcreate\s+or\s+replace\s+function\b", "CVE-KD-0722-2", "create function in code", "implement the logic in Java"),
+        (r"\bcreate\s+function\b", "CVE-KD-0722-1", "create function in code", "implement the logic in Java"),
+        (r"\bcreate\s+or\s+replace\s+trigger\b", "CVE-KD-0723-2", "create trigger in code", "use an operation plugin instead of a trigger"),
+        (r"\bcreate\s+trigger\b", "CVE-KD-0723-1", "create trigger in code", "use an operation plugin instead of a trigger"),
+    )
+    for offset, text in src.literals:
+        for pattern, code, what, fix in sql_rules:
+            if re.search(pattern, text, re.IGNORECASE):
+                issues.append(_issue(src, offset, code, f"{what} is forbidden by DCS", fix))
+        if re.search(r"\bdelete\s+from\b", text, re.IGNORECASE):
+            statement = src.lit[offset:src.statement_end(offset)]
+            if not re.search(r"\bwhere\b", statement, re.IGNORECASE):
+                issues.append(_issue(src, offset, "CVE-KD-0302-01", "delete without a WHERE condition",
+                                     "delete through OperationServiceHelper.executeOperate(\"delete\", ...) with explicit ids"))
+        for token, number in _FILE_SERVICE_TOKENS.items():
+            if token.lower() in text.lower():
+                issues.append(_issue(src, offset, f"CVE-KD-0026-{number}", f"file-service internal keyword '{token}'",
+                                     "use the attachment/file service helpers (AttachmentServiceHelper, FileServiceFactory) instead of internal URLs"))
+        for token, number in _TEMPFILE_TOKENS.items():
+            if token.lower() in text.lower():
+                issues.append(_issue(src, offset, f"CVE-KD-0028-{number}", f"temporary-file internal keyword '{token}'",
+                                     "use the documented attachment APIs; do not inspect the temporary file storage configuration"))
+                break
+    for match in re.finditer(r"\"[^\"\n]*\b(?:select|update|delete|insert)\b[^\"\n]*\"\s*\+\s*[A-Za-z_$(]", src.lit, re.IGNORECASE):
+        if re.search(r"\b(?:select\s+.+\bfrom|update\s+\w+\s+set|delete\s+from|insert\s+into)\b", match.group(0), re.IGNORECASE):
+            issues.append(_issue(src, match.start(), ("FORTIFY:SQL Injection", "java:S2077"), "SQL built by string concatenation",
+                                 "query through QFilter with QueryServiceHelper; never concatenate values into SQL", ADVISE))
+    return issues
+
+
+# --- Suppression, identifiers, packaging ------------------------------------------------------
+
+def _suppression_and_naming_issues(src: _Source) -> list[dict]:
+    issues = []
+    for match in re.finditer(r"NOSONAR", src.raw, re.IGNORECASE):
+        if src.code[match.start()] == " ":
+            issues.append(_issue(src, match.start(), "CVE-KD-0401", "NOSONAR comment suppresses the DCS scan", "remove the comment and fix the reported problem"))
+    for match in re.finditer(r"@SuppressWarnings\s*\(([^)]*)\)", src.lit):
+        if re.search(r"squid:|java:S|\"S\d+", match.group(1)):
+            issues.append(_issue(src, match.start(), "CVE-KD-0402", "@SuppressWarnings with a Sonar rule suppresses the DCS scan", "remove the suppression and fix the reported problem"))
+    for match in re.finditer(r"[\u3400-\u9fff\uf900-\ufaff]+", src.code):
+        issues.append(_issue(src, match.start(), "CVE-KD-0403", "Chinese characters in a package/class/method/variable name", "use English identifiers; keep Chinese only in comments and ResManager texts"))
+    package = re.search(r"^\s*package\s+([\w.]+)\s*;", src.code, re.MULTILINE)
+    if not package:
+        issues.append(_issue(src, 0, "java:S1220", "source has no package declaration", "declare the prepared package"))
+    else:
+        if package.group(1).split(".")[0] == "kd":
+            issues.append(_issue(src, package.start(1), "class_fully_qualified_name_conflict_stp",
+                                 "the kd.* namespace belongs to the standard product; a customization class there can collide with it",
+                                 "use the developer's ISV/app package prefix prepared for this app", ADVISE))
+        if src.path is not None:
+            parts = tuple(package.group(1).split("."))
+            if src.path.resolve().parent.parts[-len(parts):] != parts:
+                issues.append(_issue(src, package.start(1), "java:S1598", f"package {package.group(1)} does not match the source directory",
+                                     "move the file or correct the package declaration"))
+    for offset, name, _static, _wild in _imports(src):
+        if name.startswith("kd.") and re.search(r"\.(?:impl|internal)\.", name + "."):
+            issues.append(_issue(src, offset, "CVE-KD-0414-2", f"{name} is not part of the published SDK",
+                                 "use the public API documented for the target SDK", ADVISE))
+    return issues
+
+
+# --- Security --------------------------------------------------------------------------------
+
+def _instance_calls(src: _Source, created):
+    """跟踪同一代码块内的工厂变量，遇到重赋值结束，避免别的实例替它通过检查。"""
+    start = max(src.code.rfind(char, 0, created.start()) for char in ";{}") + 1
+    assigned = re.search(r"(?<![\w$.])([A-Za-z_$][\w$]*)\s*=\s*$", src.code[start:created.start()])
+    if not assigned:
+        return []
+    name = re.escape(assigned.group(1))
+    end = min((close for opening, close in src.pair.items() if src.code[opening] == "{" and opening < created.start() < close), default=len(src.code))
+    after = src.statement_end(created.end()) + 1
+    reassigned = re.search(rf"(?<![\w$.]){name}\s*=(?!=)", src.code[after:end])
+    if reassigned:
+        end = after + reassigned.start()
+    if after >= end:
+        return []
+    return list(re.compile(rf"(?<![\w$.]){name}\s*\.\s*(\w+)\s*\(").finditer(src.code, after, end))
+
+
+def _xxe_issues(src: _Source) -> list[dict]:
+    issues = []
+    factories = r"\b(DocumentBuilderFactory|SAXParserFactory|XMLInputFactory|TransformerFactory|SchemaFactory)\s*\.\s*newInstance\s*\(|\bnew\s+(SAXReader|SAXBuilder)\s*\("
+    usage = {"newDocumentBuilder", "newSAXParser", "createXMLStreamReader", "createXMLEventReader", "newTransformer", "newTemplates", "newSchema", "read", "build"}
+    for created in re.finditer(factories, src.code):
+        kind = created.group(1) or created.group(2)
+        settings, uncertain = {}, False
+        for call in _instance_calls(src, created):
+            if call.group(1) in usage:
+                break
+            if call.group(1) not in ("setFeature", "setProperty", "setAttribute"):
+                continue
+            arguments = _arguments(src, call.end() - 1)
+            if len(arguments) != 2:
+                continue
+            key = arguments[0].strip('"').rsplit("/", 1)[-1].rsplit(".", 1)[-1]
+            if key not in {"disallow-doctype-decl", "external-general-entities", "external-parameter-entities", "load-external-dtd", "SUPPORT_DTD", "IS_SUPPORTING_EXTERNAL_ENTITIES", "ACCESS_EXTERNAL_DTD", "ACCESS_EXTERNAL_STYLESHEET", "ACCESS_EXTERNAL_SCHEMA"}:
+                continue
+            # 分支中的设置不构成所有路径都安全的证明；运行时值保留为建议项。
+            head = max(src.code.rfind(char, created.end(), call.start()) for char in ";{}") + 1
+            conditional = re.search(r"\b(?:if|else|for|while)\b", src.code[head:call.start()])
+            if conditional or src.brace_depth(call.start()) != src.brace_depth(created.start()) or arguments[1] not in ("true", "false", '""'):
+                uncertain = True
+                settings[key] = None
+                continue
+            settings[key] = arguments[1]
+        if kind == "XMLInputFactory":
+            safe = settings.get("SUPPORT_DTD") == "false" and settings.get("IS_SUPPORTING_EXTERNAL_ENTITIES") == "false"
+        elif kind in ("TransformerFactory", "SchemaFactory"):
+            other = "ACCESS_EXTERNAL_STYLESHEET" if kind == "TransformerFactory" else "ACCESS_EXTERNAL_SCHEMA"
+            safe = settings.get("ACCESS_EXTERNAL_DTD") == '""' and settings.get(other) == '""'
+        else:
+            safe = settings.get("disallow-doctype-decl") == "true" or all(settings.get(key) == "false" for key in (
+                "external-general-entities", "external-parameter-entities", "load-external-dtd"))
+        if not safe:
+            issues.append(_issue(src, created.start(), "java:S2755", "XML parser XXE protection is not verified" if uncertain else "XML parser without XXE protection",
+                                 "harden this factory before use: DOM/SAX disallow-doctype-decl=true; StAX disable DTD and external entities; transformer/schema deny external DTD and stylesheet/schema access",
+                                 ADVISE if uncertain else BLOCK))
+    return issues
+
+
+_SECRET_NAME = r"(?:password|passwd|pwd|passphrase)"
+_TOKEN_NAME = r"(?:secret|token|apikey|api_key|accesskey|access_key|privatekey|private_key|secretkey)"
+
+
+def _security_issues(src: _Source) -> list[dict]:
+    issues = []
+    # Sonar's credential words are password/passwd/pwd/passphrase; any non-empty literal assigned
+    # to such a name is reported, so a message or field-key constant needs a different name.
+    for match in re.finditer(rf"\b([\w$]*{_SECRET_NAME}[\w$]*)\s*=\s*\"([^\"\n]*)\"", src.lit, re.IGNORECASE):
+        name, value = match.group(1), match.group(2)
+        if not value:
+            issues.append(_issue(src, match.start(), ("FORTIFY:Hardcoded Password", "java:S2068"), f"empty credential assigned to '{name}'",
+                                 "read credentials from encrypted MC/system parameters at runtime"))
+            continue
+        issues.append(_issue(src, match.start(), ("java:S2068", "FORTIFY:Hardcoded Password"), f"string literal assigned to credential-like name '{name}'",
+                             "read real credentials from encrypted MC/system parameters at runtime; if this is a field key or a "
+                             f"message, rename the constant without the credential word (e.g. FIELD_{value.upper()} / MSG_...)"
+                             if re.fullmatch(r"[a-z][a-z0-9_]*", value) else
+                             "read real credentials from encrypted MC/system parameters at runtime; if this is a message, rename "
+                             "the constant without the credential word"))
+    for match in re.finditer(rf"\b([\w$]*{_TOKEN_NAME}[\w$]*)\s*=\s*\"([^\"\n]+)\"", src.lit, re.IGNORECASE):
+        issues.append(_issue(src, match.start(), "FORTIFY:Hardcoded Encryption Key", f"'{match.group(1)}' looks like a hard-coded secret",
+                             "read secrets from encrypted parameters at runtime; rename the constant if it is not a secret", ADVISE))
+    for offset, text in src.literals:
+        if re.search(r"(?i)\b(?:password|passwd|pwd)\s*=\s*(?![\s'\"?{%:$])[^&\s\"']+", text):
+            issues.append(_issue(src, offset, "java:S2068", "credential embedded in a string", "read credentials from encrypted parameters at runtime"))
+        if re.match(r"(?i)(?:http|ftp|telnet)://(?!localhost|127\.0\.0\.1)", text):
+            issues.append(_issue(src, offset, "java:S5332", "clear-text protocol URL in code", "use https and read external addresses from configuration", ADVISE))
+        if re.fullmatch(r"(?:\d{1,3}\.){3}\d{1,3}(?::\d+)?", text) and not text.startswith(("127.", "0.")):
+            issues.append(_issue(src, offset, "java:S1313", "hard-coded IP address", "read external addresses from configuration", ADVISE))
+    for match in re.finditer(r"\bnew\s+(?:java\.util\.)?Random\s*\(|\bMath\s*\.\s*random\s*\(|\bThreadLocalRandom\s*\.\s*current\s*\(|\bRandomStringUtils\s*\.\s*random", src.code):
+        issues.append(_issue(src, match.start(), ("java:S2245",), "pseudorandom generator", "use java.security.SecureRandom"))
+    for match in re.finditer(r"\bMessageDigest\s*\.\s*getInstance\s*\(\s*\"(MD2|MD4|MD5|SHA|SHA-?1)\"", src.lit, re.IGNORECASE):
+        issues.append(_issue(src, match.start(), "java:S4790", f"weak hash {match.group(1)}", "use SHA-256 or stronger"))
+    for match in re.finditer(r"\b(?:DigestUtils\s*\.\s*(?:md2|md5|sha1?|shaHex|sha1Hex|md5Hex|md2Hex)|Hashing\s*\.\s*(?:md5|sha1))\s*\(", src.code):
+        issues.append(_issue(src, match.start(), "java:S4790", "weak hash", "use SHA-256 or stronger (DigestUtils.sha256Hex)"))
+    for match in re.finditer(r"\bCipher\s*\.\s*getInstance\s*\(\s*\"([^\"]*)\"", src.lit):
+        value = match.group(1).upper()
+        if re.match(r"(?:DES|DESEDE|3DES|TRIPLEDES|RC2|RC4|ARCFOUR|BLOWFISH)\b", value):
+            issues.append(_issue(src, match.start(), "java:S5547", f"weak cipher {match.group(1)}", "use AES/GCM/NoPadding"))
+        elif value.startswith("RSA") and ("OAEP" not in value):
+            issues.append(_issue(src, match.start(), ("FORTIFY:Inadequate RSA Padding", "java:S5542"), f"RSA without OAEP padding ({match.group(1)})", "use RSA/ECB/OAEPWithSHA-256AndMGF1Padding"))
+        elif not value.startswith("RSA") and (value == "AES" or "/ECB" in value or "/CBC/PKCS5PADDING" in value):
+            issues.append(_issue(src, match.start(), "java:S5542", f"insecure cipher mode {match.group(1)}", "use AES/GCM/NoPadding with a random IV"))
+    for match in re.finditer(r"\bSSLContext\s*\.\s*getInstance\s*\(\s*\"([^\"]*)\"", src.lit):
+        if match.group(1) not in ("TLSv1.2", "TLSv1.3", "DTLSv1.2", "DTLSv1.3"):
+            issues.append(_issue(src, match.start(), "java:S4423", f"weak protocol {match.group(1)}", "use TLSv1.2 or TLSv1.3"))
+    for created in re.finditer(r'\b(KeyPairGenerator|KeyGenerator)\s*\.\s*getInstance\s*\(\s*"([^"\n]+)"', src.lit):
+        algorithm = created.group(2).upper()
+        minimum = {"RSA": 2048, "DSA": 2048, "DH": 2048, "DIFFIEHELLMAN": 2048, "EC": 224, "AES": 128}.get(algorithm)
+        for call in _instance_calls(src, created):
+            expected = "initialize" if created.group(1) == "KeyPairGenerator" else "init"
+            arguments = _arguments(src, call.end() - 1)
+            if call.group(1) != expected or not arguments or not re.fullmatch(r"\d+", arguments[0]):
+                continue
+            if minimum is not None and int(arguments[0]) < minimum:
+                issues.append(_issue(src, call.start(), "java:S4426", f"{algorithm} {arguments[0]}-bit key", f"use at least {minimum}-bit {algorithm} keys"))
+    constants = set(re.findall(r"\b([A-Za-z_$][\w$]*)\s*=\s*\"", src.lit))
+    for match in re.finditer(r"\bnew\s+(SecretKeySpec|IvParameterSpec)\s*\(", src.code):
+        arguments = _arguments(src, match.end() - 1)
+        literal_arg = src.lit[match.end():src.pair.get(match.end() - 1, match.end())]
+        first = arguments[0] if arguments else ""
+        root = re.match(r"([A-Za-z_$][\w$]*)", first)
+        if '"' in literal_arg.split(",")[0] or (root and root.group(1) in constants) or re.match(r"new\s+byte\s*\[\s*\]\s*\{", first):
+            code = "FORTIFY:Hardcoded Encryption Key" if match.group(1) == "SecretKeySpec" else "FORTIFY:Insecure Initialization Vector"
+            issues.append(_issue(src, match.start(), code, f"{match.group(1)} built from a constant", "load keys from encrypted configuration; generate a fresh random IV per message with SecureRandom"))
+    issues.extend(_xxe_issues(src))
+    for offset, jump, level in _finally_jumps(src):
+        if jump == "return":
+            issues.append(_issue(src, offset, "FORTIFY:Return Inside Finally", "return inside finally discards exceptions", "move the return out of the finally block", level))
+    log_call = r"\b(?:log|logger|LOG|LOGGER)\s*\.\s*(?:trace|debug|info|warn|error)\s*\(([^;]*)\)\s*;"
+    for match in re.finditer(log_call, src.code):
+        if re.search(rf"(?i)\b\w*(?:{_SECRET_NAME}|{_TOKEN_NAME})\w*\b", match.group(1)):
+            issues.append(_issue(src, match.start(), "FORTIFY:Privacy Violation", "a credential-like value is written to the log", "never log passwords, tokens or keys", ADVISE))
+    return issues
+
+
+# --- Sonar / SpotBugs code rules ---------------------------------------------------------------
+
+_SIMPLE_RULES = (
+    (r"\bnew\s+(?:java\.lang\.)?(Integer|Long|Short|Byte|Character)\s*\(", ("java:S2129", "DM_NUMBER_CTOR"), "wrapper constructor", "use {0}.valueOf(...)"),
+    (r"\bnew\s+(?:java\.lang\.)?(Double|Float)\s*\(", ("java:S2129", "DM_FP_NUMBER_CTOR"), "wrapper constructor", "use {0}.valueOf(...)"),
+    (r"\bnew\s+(?:java\.lang\.)?(Boolean)\s*\(", ("java:S2129", "DM_BOOLEAN_CTOR"), "Boolean constructor", "use Boolean.valueOf(...) or Boolean.TRUE/FALSE"),
+    (r"\bnew\s+(?:java\.lang\.)?(String)\s*\(\s*\)", ("java:S2129", "DM_STRING_VOID_CTOR"), "new String()", "use \"\""),
+    (r"\bnew\s+(?:java\.math\.)?BigDecimal\s*\(\s*-?\d+[lL]?\s*\)", "java:S2129", "BigDecimal constructed from an integer literal", "use BigDecimal.valueOf(n) or BigDecimal.ZERO/ONE/TEN"),
+    (r"\.\s*equals\s*\(\s*null\s*\)", "EC_NULL_ARG", "equals(null) is always false", "compare with == null"),
+    (r"\.\s*size\s*\(\s*\)\s*(?:==|!=|>|<=)\s*0\b(?!\.)|\.\s*size\s*\(\s*\)\s*(?:>=|<)\s*1\b(?!\.)|\b0\s*(?:==|!=|<|>=)\s*[\w$.()]+\.\s*size\s*\(\s*\)", "java:S1155", "size() compared with 0", "use isEmpty()"),
+    (r"\.\s*to(?:Lower|Upper)Case\s*\(\s*\)\s*\.\s*equals\s*\(", "java:S1157", "case conversion before equals", "use equalsIgnoreCase(...)"),
+    (r"\.\s*to(?:Lower|Upper)Case\s*\(\s*\)", "DM_CONVERT_CASE", "toLowerCase()/toUpperCase() without a Locale", "pass Locale.ROOT (or Locale.ENGLISH)"),
+    (r"\+\s*String\s*\.\s*valueOf\s*\(", "java:S1153", "String.valueOf appended to a String", "append the value directly"),
+    (r"\bnew\s+[\w$.]+\s*(?:<[^;(){}]*>)?\s*\([^;{}]*\)\s*\.\s*getClass\s*\(\s*\)", "java:S2133", "object created only to call getClass", "use X.class"),
+    (r"\.\s*toArray\s*\(\s*new\s+[\w$.]+\s*\[\s*0\s*\]\s*\)", "ITA_INEFFICIENT_TO_ARRAY", "toArray with a zero-length array", "pass an array of the collection size: list.toArray(new X[list.size()])"),
+    (r"\.\s*substring\s*\([^;()]*(?:\([^;()]*\))?[^;()]*\)\s*\.\s*(?:indexOf|lastIndexOf|startsWith)\s*\(", "java:S4635", "substring before indexOf/startsWith", "use indexOf(str, fromIndex) / startsWith(prefix, offset)"),
+    (r"\bthrow\s+new\s+(?:java\.lang\.)?(?:RuntimeException|Exception|Throwable|Error)\s*\(", "java:S112", "generic exception thrown", "throw kd.bos.exception.KDBizException (user-facing) or a dedicated exception type"),
+    (r"(?:==|!=)\s*true\b|(?:==|!=)\s*false\b|\btrue\s*(?:==|!=)|\bfalse\s*(?:==|!=)|\?\s*(?:true|false)\s*:\s*(?:true|false)\b", "java:S1125", "redundant boolean literal", "use the boolean expression directly"),
+    (r"\bnew\s+[\w$.]+\s*(?:<[^;(){}]*>)?\s*\([^;{}]*\)\s*\{\s*\{", "java:S1171", "double-brace initialization", "create the collection, then add the values in ordinary statements"),
+    (r"\bnew\s+(?:Runnable|Callable|Comparator|Supplier|Consumer|BiConsumer|Function|BiFunction|Predicate|BiPredicate|UnaryOperator|BinaryOperator)\s*(?:<[^;{}]*>)?\s*\(\s*\)\s*\{", "java:S1604", "anonymous class for a functional interface", "use a lambda or method reference"),
+    (r"\b(?:Vector|Hashtable|Stack|StringBuffer)\b", "java:S1149", "synchronized legacy collection/StringBuffer", "use ArrayList / HashMap / ArrayDeque / StringBuilder"),
+)
+
+
+def _simple_rule_issues(src: _Source) -> list[dict]:
+    issues = []
+    imports_removed = _IMPORT_RE.sub(lambda match: " " * len(match.group(0)), src.code)
+    for pattern, codes, what, fix in _SIMPLE_RULES:
+        for match in re.finditer(pattern, imports_removed):
+            subject = match.group(1) if match.groups() else ""
+            issues.append(_issue(src, match.start(), codes, what, fix.format(subject)))
+    for match in re.finditer(r"\bcatch\s*\(\s*(?:final\s+)?(?:java\.lang\.)?(?:Throwable|Error)\s+(\w+)\s*\)\s*\{", src.code):
+        close = src.pair.get(match.end() - 1)
+        rethrown = close is not None and re.search(rf"\bthrow\s+{match.group(1)}\s*;", src.code[match.end():close])
+        issues.append(_issue(src, match.start(), "java:S1181", "catching Throwable/Error",
+                             "catch Exception (or the specific exceptions the code can handle); a transaction rollback belongs in catch (Exception e)",
+                             ADVISE if rethrown else BLOCK))
+    for match in re.finditer(r"\bnew\s+(?:java\.lang\.)?String\s*\(\s*\"", src.lit):
+        issues.append(_issue(src, match.start(), ("java:S2129", "DM_STRING_CTOR"), "new String(\"...\")", "use the literal directly"))
+    for match in re.finditer(r'\bnew\s+(?:java\.math\.)?BigInteger\s*\(\s*"(-?\d+)"\s*\)', src.lit):
+        value = int(match.group(1))
+        if -(2 ** 63) <= value < 2 ** 63:
+            issues.append(_issue(src, match.start(), "java:S2129", "BigInteger constructed from a small decimal literal", f"use BigInteger.valueOf({value}L)"))
+    for match in re.finditer(r"\bnew\s+(?:java\.math\.)?BigDecimal\s*\(\s*-?\d+\.\d*(?:[eE][-+]?\d+)?[dDfF]?\s*\)", src.code):
+        issues.append(_issue(src, match.start(), "java:S2111", "BigDecimal(double) is imprecise", "use new BigDecimal(\"1.10\") or BigDecimal.valueOf(d)"))
+    for offset, text in src.literals:
+        close = offset + len(text) + 1
+        if re.search(r"(?:==|!=)\s*$", src.code[max(0, offset - 8):offset]) or re.match(r"\s*(?:==|!=)", src.code[close + 1:close + 9]):
+            issues.append(_issue(src, offset, ("java:S4973", "ES_COMPARING_STRINGS_WITH_EQ"), "string compared with ==/!=", "use \"literal\".equals(value) or Objects.equals"))
+    for match in re.finditer(r"\.\s*replaceAll\s*\(\s*\"((?:\\.|[^\"\\])*)\"", src.lit):
+        if not re.search(r"[.$|()\[\]{}^?*+\\]", match.group(1)):
+            issues.append(_issue(src, match.start(), "java:S5361", "replaceAll with a plain literal", "use replace(...)"))
+    for match in re.finditer(r"\bfor\s*\(\s*(?:final\s+)?[\w$.<>, ?]+\s+(\w+)\s*:\s*([\w$.]+)\s*\.\s*keySet\s*\(\s*\)\s*\)", src.code):
+        body = src.body_after(src.pair.get(src.code.index("(", match.start()), match.end()) + 1)
+        if body and re.search(rf"\b{re.escape(match.group(2))}\s*\.\s*get\s*\(\s*{re.escape(match.group(1))}\s*\)", src.code[body[0]:body[1]]):
+            issues.append(_issue(src, match.start(), ("java:S2864", "WMI_WRONG_MAP_ITERATOR"), "keySet() iteration that also reads the value", "iterate entrySet()"))
+    for match in re.finditer(r"\bcatch\s*\(\s*(?:final\s+)?(?:[\w.]+\s*\|\s*)*(?:java\.lang\.)?InterruptedException\b[^)]*?(\w+)\s*\)\s*\{", src.code):
+        close = src.pair.get(match.end() - 1)
+        block = src.code[match.end():close] if close else ""
+        if not re.search(r"\binterrupt\s*\(\s*\)|\bthrow\b", block):
+            issues.append(_issue(src, match.start(), "java:S2142", "InterruptedException swallowed", "call Thread.currentThread().interrupt() before handling it"))
+    for match in re.finditer(r"\b(?:while\s*\(\s*true\s*\)|for\s*\(\s*;\s*;\s*\))", src.code):
+        body = src.body_after(match.end())
+        if body and not re.search(r"\b(?:break|return|throw)\b|System\s*\.\s*exit", src.code[body[0]:body[1]]):
+            issues.append(_issue(src, match.start(), "java:S2189", "loop without an exit", "add a termination condition"))
+    for match in re.finditer(r"\bif\s*\(\s*(\w+)\s*==\s*null\s*\)\s*\{\s*synchronized\s*\([^)]*\)\s*\{\s*if\s*\(\s*\1\s*==\s*null", src.code):
+        issues.append(_issue(src, match.start(), "java:S2168", "double-checked locking", "initialize eagerly or use a holder class"))
+    locked = [src.body_after(src.pair[match.end() - 1] + 1) for match in re.finditer(r"\bsynchronized\s*\(", src.code)
+              if match.end() - 1 in src.pair]
+    for match in re.finditer(r"\bThread\s*\.\s*sleep\s*\(", src.code):
+        method = src.method_at(match.start())
+        in_block = any(span and span[0] < match.start() < span[1] for span in locked)
+        if (method and method["synchronized"]) or in_block:
+            issues.append(_issue(src, match.start(), "java:S2276", "Thread.sleep while holding a lock", "release the lock first or use wait(timeout)"))
+    for match in re.finditer(r"(?:\{\s*return\s+(true|false)\s*;\s*\}\s*(?:else\s*\{\s*)?|\)\s*return\s+(true|false)\s*;\s*(?:else\s+)?)return\s+(true|false)\s*;", src.code):
+        first = match.group(1) or match.group(2)
+        if first != match.group(3):
+            issues.append(_issue(src, match.start(), "java:S1126", "if/else returning boolean literals", "return the condition directly"))
+    for match in re.finditer(r"(?:^|[;{}])\s*(?:final\s+)?([\w$.]+)(?:\s*<[^;=(){}]*>)?(?:\s*\[\s*\])*\s+([A-Za-z_$][\w$]*)\s*=\s*[^;]+;\s*(?:return|throw)\s+\2\s*;", src.code):
+        if match.group(1) not in _NOT_TYPES:
+            issues.append(_issue(src, match.start(2), "java:S1488", f"'{match.group(2)}' is declared only to be returned", "return the expression directly"))
+    for match in re.finditer(r"\b(?:byte|short|int|long|float|double|char|boolean|[A-Z][\w$]*(?:<[^;=(){}]*>)?)\s+([a-z_$][\w$]*)\s*\[\s*\]\s*[=;,)]", src.code):
+        issues.append(_issue(src, match.start(1), "java:S1197", f"array designator on variable '{match.group(1)}'", "write Type[] name"))
+    for match in re.finditer(r"\b(?:(?:public|protected|private|abstract|static|final|transient|volatile|synchronized|native|strictfp|default)\s+){2,}", src.code):
+        words = match.group(0).split()
+        order = ["public", "protected", "private", "abstract", "static", "final", "transient", "volatile", "synchronized", "native", "strictfp", "default"]
+        ranks = [order.index(word) for word in words]
+        if ranks != sorted(ranks):
+            issues.append(_issue(src, match.start(), "java:S1124", f"modifier order '{' '.join(words)}'", f"write '{' '.join(sorted(words, key=order.index))}'"))
+    return issues
+
+
+def _block_owner(src: _Source, opening: int) -> str:
+    """The keyword, name or punctuation that a ``{`` belongs to: ``if``, a method name, ``->``, ``=`` ..."""
+    cached = src.owners.get(opening)
+    if cached is not None:
+        return cached
+    code = src.code
+    index = opening - 1
+    while index >= 0 and code[index].isspace():
+        index -= 1
+    if index >= 0 and code[index] == ")" and index in src.opener:
+        index = src.opener[index] - 1
+        while index >= 0 and code[index].isspace():
+            index -= 1
+        owner = _word_ending_at(code, index)
+    elif index >= 1 and code[index - 1:index + 1] == "->":
+        owner = "->"
+    elif index >= 0 and code[index] in "=[],(;{}":
+        owner = code[index]
+    else:
+        owner = _word_ending_at(code, index)
+    src.owners[opening] = owner
+    return owner
+
+
+def _word_ending_at(code: str, index: int) -> str:
+    end = index + 1
+    while index >= 0 and (code[index].isalnum() or code[index] in "_$"):
+        index -= 1
+    return code[index + 1:end]
+
+
+_CONTROL_OWNERS = {"if", "for", "while", "switch", "catch", "synchronized", "else", "try", "finally", "do"}
+
+
+def _structure_issues(src: _Source) -> list[dict]:
+    issues = []
+    code = src.code
+    for opening, close in src.pair.items():
+        if code[opening] != "{":
+            continue
+        owner = _block_owner(src, opening)
+        if code[opening + 1:close].strip():
+            if owner in (";", "{", "}") and src.method_at(opening):
+                issues.append(_issue(src, opening, "java:S1199", "nested code block", "extract the block into a method or remove the braces"))
+            continue
+        if owner in _CONTROL_OWNERS and not src.raw[opening + 1:close].strip():
+            issues.append(_issue(src, opening, "java:S108", f"empty {owner} block",
+                                 "handle the case; for a catch, log with LOG.error(message, e) or rethrow — an intentionally empty block needs a comment explaining why"))
+    for method in src.methods:
+        if not src.raw[method["start"]:method["end"]].strip() and not _is_constructor(src, method):
+            issues.append(_issue(src, method["nameOffset"], "java:S1186", f"empty method {method['name']}()",
+                                 "remove the override if nothing needs to happen, or add a comment explaining why it is intentionally empty"))
+    issues += _switch_issues(src)
+    issues += _collapsible_if_issues(src)
+    for method in src.methods:
+        score = _cognitive_complexity(src, method)
+        if score > 15:
+            issues.append(_issue(src, method["nameOffset"], "java:S3776", f"{method['name']}() has an estimated cognitive complexity of {score} (limit 15)",
+                                 "extract cohesive steps into private methods and replace nested conditions with early returns", ADVISE))
+    for match in re.finditer(r"\?", code):
+        previous = code[:match.start()].rstrip()[-1:]
+        if previous in ("<", ",", "(") or code[match.start() + 1:match.start() + 2] in (".", ">"):
+            continue
+        statement_start = max(code.rfind(char, 0, match.start()) for char in ";{}") + 1
+        prior = code[statement_start:match.start()]
+        if re.search(r"(?<![<,(])\?(?!\s*[>.,])", prior) and ":" in prior:
+            issues.append(_issue(src, match.start(), "java:S3358", "nested ternary operator", "use if/else or a helper method", ADVISE))
+    for match in re.finditer(r"\b(?:if|while)\s*\(", code):
+        close = src.pair.get(match.end() - 1)
+        condition = code[match.end():close] if close else ""
+        if re.search(r"(?<![&|])[&|](?![&|=])", condition) and re.search(r"==|!=|<|>|!\w|\bequals\b|\bisEmpty\b|\btrue\b|\bfalse\b", condition):
+            issues.append(_issue(src, match.start(), "java:S2178", "non-short-circuit & or | in a condition", "use && / ||", ADVISE))
+    for match in re.finditer(r"\bcatch\s*\([^)]*?(\w+)\s*\)\s*\{", code):
+        close = src.pair.get(match.end() - 1)
+        block = code[match.end():close] if close else ""
+        variable = re.escape(match.group(1))
+        if (re.search(rf"\.\s*(?:error|warn|info)\s*\([^;]*\b{variable}\b", block)
+                and re.search(rf"\bthrow\s+(?:{variable}\b|new\s+\w+\s*\([^;]*\b{variable}\b)", block)):
+            issues.append(_issue(src, match.start(), "java:S2139", "exception both logged and rethrown",
+                                 "either log and handle it, or rethrow it with the cause — not both", ADVISE))
+    return issues
+
+
+def _is_constructor(src: _Source, method: dict) -> bool:
+    """A declaration with no return type left once annotations, modifiers and type parameters go."""
+    rest = re.sub(r"@[\w.$]+(?:\s*\([^()]*\))?|<[^<>]*>|\b(?:public|protected|private|static|final|synchronized|abstract|native|strictfp)\b",
+                  " ", method["prefix"])
+    return not rest.strip()
+
+
+def _parameter_names(params: str) -> list[str]:
+    names = []
+    for part in _split_params(params):
+        name = re.search(r"([A-Za-z_$][\w$]*)\s*(?:\[\s*\])*$", part)
+        if name:
+            names.append(name.group(1))
+    return names
+
+
+def _switch_issues(src: _Source) -> list[dict]:
+    issues = []
+    code = src.code
+    for match in re.finditer(r"\bswitch\s*\(", code):
+        close = src.pair.get(match.end() - 1)
+        body = src.body_after(close + 1) if close is not None else None
+        if not body or code[body[0]] != "{":
+            continue
+        before = code[:match.start()].rstrip()[-2:]
+        expression = before.endswith(("=", "(", ",", "->")) or re.search(r"\b(?:return|yield)\s*$", code[:match.start()])
+        labels = []
+        index = body[0] + 1
+        while index < body[1]:
+            char = code[index]
+            if char in "({[" and index in src.pair:
+                index = src.pair[index] + 1
+                continue
+            label = re.match(r"\b(?:case\b[^;{}]*?|default\s*)(:|->)", code[index:body[1]])
+            if label and (index == 0 or not re.match(r"[\w$]", code[index - 1])):
+                labels.append((index, index + label.end(), label.group(1)))
+                index += label.end()
+                continue
+            index += 1
+        if not expression and not any(re.match(r"default\b", code[start:end]) for start, end, _arrow in labels):
+            issues.append(_issue(src, match.start(), "java:S131", "switch without a default clause", "add a default branch (handle or reject the unexpected value)"))
+        if any(arrow == "->" for _start, _end, arrow in labels):
+            continue
+        for position, (_start, end, _arrow) in enumerate(labels[:-1]):
+            segment = code[end:labels[position + 1][0]].strip()
+            if not segment:
+                continue
+            last = _last_statement(segment)
+            if not re.match(r"(?:break|return|throw|continue|yield)\b", last):
+                level = ADVISE if segment.endswith("}") else BLOCK
+                issues.append(_issue(src, labels[position + 1][0], "java:S128", "switch case falls through to the next label",
+                                     "end each case with break/return/throw", level))
+    return issues
+
+
+def _last_statement(segment: str) -> str:
+    text = segment.strip()
+    while text.startswith("{") and text.endswith("}"):
+        text = text[1:-1].strip()
+    if text.endswith("}"):
+        return text
+    statements = [part.strip() for part in re.split(r"[;{}]", text[:-1] if text.endswith(";") else text)]
+    return statements[-1] if statements else ""
+
+
+def _collapsible_if_issues(src: _Source) -> list[dict]:
+    issues = []
+    code = src.code
+    for match in re.finditer(r"\bif\s*\(", code):
+        if re.search(r"\belse\s*$", code[:match.start()]):
+            continue
+        close = src.pair.get(match.end() - 1)
+        body = src.body_after(close + 1) if close is not None else None
+        if not body or code[body[0]] != "{" or re.match(r"\s*else\b", code[body[1] + 1:]):
+            continue
+        inner = code[body[0] + 1:body[1]]
+        inner_match = re.match(r"\s*if\s*\(", inner)
+        if not inner_match:
+            continue
+        inner_open = body[0] + 1 + inner_match.end() - 1
+        inner_close = src.pair.get(inner_open)
+        inner_body = src.body_after(inner_close + 1) if inner_close is not None else None
+        if not inner_body:
+            continue
+        rest = code[inner_body[1] + 1:body[1]]
+        if not rest.strip() or (code[inner_body[0]] != "{" and not code[inner_body[1] + 1:body[1]].strip()):
+            if not re.match(r"\s*else\b", code[inner_body[1] + 1:]):
+                issues.append(_issue(src, match.start(), "java:S1066", "nested if can be merged with its parent", "combine the conditions with &&"))
+    return issues
+
+
+def _cognitive_complexity(src: _Source, method: dict) -> int:
+    code = src.code
+    start, end = method["start"], method["end"]
+    nesting_blocks = [(opening, close) for opening, close in src.pair.items()
+                      if start <= opening < end and code[opening] == "{"
+                      and _block_owner(src, opening) in {"if", "else", "for", "while", "do", "switch", "catch", "->"}]
+
+    def nesting(offset: int) -> int:
+        return sum(1 for opening, close in nesting_blocks if opening < offset < close)
+
+    score = 0
+    body = code[start:end]
+    for match in re.finditer(r"\belse\s+if\b|\belse\b|\bif\b|\bfor\b|\bwhile\b|\bdo\b|\bswitch\b|\bcatch\b|\b(?:break|continue)\s+[A-Za-z_$]", body):
+        offset = start + match.start()
+        token = match.group(0).split()[0]
+        if token == "else":
+            score += 1
+            continue
+        if token in ("break", "continue"):
+            score += 1
+            continue
+        if token == "while" and re.search(r"\}\s*$", code[:offset]):
+            opening = src.opener.get(code[:offset].rstrip().__len__() - 1)
+            if opening is not None and _block_owner(src, opening) == "do":
+                continue
+        score += 1 + nesting(offset)
+    for match in re.finditer(r"\?", body):
+        offset = start + match.start()
+        previous = code[:offset].rstrip()[-1:]
+        if previous in ("<", ",", "(") or code[offset + 1:offset + 2] in (".", ">"):
+            continue
+        score += 1 + nesting(offset)
+    previous_operator, previous_end = None, -1
+    for match in re.finditer(r"&&|\|\||[;{}()]", body):
+        token = match.group(0)
+        if token in ("&&", "||"):
+            if token != previous_operator:
+                score += 1
+            previous_operator = token
+            continue
+        if token in ";{}":
+            previous_operator = None
+    return score
+
+
+# --- Declarations: naming, unused members, statics, utility classes --------------------------
+
+_FIELD_RE = re.compile(
+    r"(?:^|(?<=[;{}]))\s*(?:@[\w.$]+(?:\s*\([^()]*\))?\s*)*"
+    r"(?P<mods>(?:(?:public|protected|private|static|final|transient|volatile)\s+)*)"
+    r"(?P<type>[\w$.]+(?:\s*<[^;=(){}]*>)?(?:\s*\[\s*\])*)\s+(?P<name>[A-Za-z_$][\w$]*)\s*(?P<end>[=;,])"
+)
+_CONSTANT_TYPES = {"byte", "short", "int", "long", "float", "double", "boolean", "char", "String",
+                   "Byte", "Short", "Integer", "Long", "Float", "Double", "Boolean", "Character"}
+_NOT_TYPES = {"return", "throw", "new", "else", "case", "yield", "assert", "package", "import", "goto", "break", "continue"}
+
+
+def _class_depth(src: _Source, offset: int) -> int:
+    return src.brace_depth(offset)
+
+
+def _fields(src: _Source) -> list[dict]:
+    fields = []
+    for match in _FIELD_RE.finditer(src.code):
+        if match.group("type") in _NOT_TYPES or _class_depth(src, match.start("type")) != 1:
+            continue
+        mods = match.group("mods").split()
+        fields.append({"name": match.group("name"), "type": re.sub(r"\s+", "", match.group("type")), "mods": set(mods),
+                       "offset": match.start("name"), "end": match.group("end")})
+    return fields
+
+
+def _declaration_issues(src: _Source) -> list[dict]:
+    issues = []
+    code = src.code
+    fields = _fields(src)
+    imports_removed = _IMPORT_RE.sub(lambda match: " " * len(match.group(0)), code)
+    for field in fields:
+        name, mods = field["name"], field["mods"]
+        if {"static", "final"} <= mods:
+            if field["type"] in _CONSTANT_TYPES and name != "serialVersionUID" and not re.fullmatch(r"[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)*", name):
+                issues.append(_issue(src, field["offset"], "java:S115", f"constant '{name}' is not UPPER_SNAKE_CASE", "rename it, e.g. " + re.sub(r"(?<=[a-z0-9])(?=[A-Z])", "_", name).upper()))
+        elif not re.fullmatch(r"[a-z][a-zA-Z0-9]*", name):
+            issues.append(_issue(src, field["offset"], "java:S116", f"field '{name}' is not lowerCamelCase", "rename it in lowerCamelCase"))
+        if "private" in mods and name != "serialVersionUID" and len(re.findall(rf"(?<![\w$]){re.escape(name)}(?![\w$])", imports_removed)) == 1:
+            issues.append(_issue(src, field["offset"], ("java:S1068", "UUF_UNUSED_FIELD"), f"private field '{name}' is never used", "remove it"))
+        if "static" in mods and "final" not in mods:
+            if "public" in mods:
+                issues.append(_issue(src, field["offset"], ("java:S1444", "java:S2386"), f"public static field '{name}' is mutable", "make it private static final, or an instance field"))
+            for method in src.methods:
+                if method["static"]:
+                    continue
+                body = code[method["start"]:method["end"]]
+                write = re.search(rf"(?<![\w$.])(?:this\.)?{re.escape(name)}\s*(?:[+\-*/%&|^]?=(?!=)|\+\+|--)|(?:\+\+|--){re.escape(name)}\b", body)
+                if write:
+                    issues.append(_issue(src, method["start"] + write.start(), "java:S2696",
+                                         f"instance method {method['name']}() writes static field '{name}'; the plugin instance is shared across users",
+                                         "keep the state in a local variable or getPageCache()"))
+                    break
+    for match in re.finditer(r"\b(?:class|interface|enum|record)\s+([A-Za-z_$][\w$]*)(?![\w$.])", code):
+        if not re.fullmatch(r"[A-Z][a-zA-Z0-9]*", match.group(1)):
+            issues.append(_issue(src, match.start(1), "java:S101", f"class '{match.group(1)}' is not UpperCamelCase", "rename the class (and the file)"))
+    methods_by_lower: dict[str, set[str]] = {}
+    for method in src.methods:
+        constructor = _is_constructor(src, method)
+        if not constructor and not re.fullmatch(r"[a-z][a-zA-Z0-9]*", method["name"]):
+            issues.append(_issue(src, method["nameOffset"], "java:S100", f"method '{method['name']}' is not lowerCamelCase", "rename it in lowerCamelCase"))
+        if not constructor:
+            methods_by_lower.setdefault(method["name"].lower(), set()).add(method["name"])
+        for name in _parameter_names(method["params"]):
+            if not re.fullmatch(r"[a-z][a-zA-Z0-9]*", name):
+                issues.append(_issue(src, method["nameOffset"], "java:S117", f"parameter '{name}' is not lowerCamelCase", "rename it in lowerCamelCase"))
+        body = code[method["start"]:method["end"]]
+        resources = [(method["start"] + match.end() - 1, src.pair.get(method["start"] + match.end() - 1, -1))
+                     for match in re.finditer(r"\btry\s*\(", body)]
+        for local in re.finditer(r"(?:^|(?<=[;{}(]))\s*(?:final\s+)?([A-Za-z_$][\w$.]*(?:\s*<[^;=(){}]*>)?(?:\s*\[\s*\])*)\s+([A-Za-z_$][\w$]*)\s*(=(?!=)|;)", body):
+            if local.group(1) in _NOT_TYPES:
+                continue
+            name = local.group(2)
+            offset = method["start"] + local.start(2)
+            if not re.fullmatch(r"[a-z][a-zA-Z0-9]*", name):
+                issues.append(_issue(src, offset, "java:S117", f"local variable '{name}' is not lowerCamelCase", "rename it in lowerCamelCase"))
+            if (len(re.findall(rf"(?<![\w$]){re.escape(name)}(?![\w$])", body)) == 1
+                    and not any(opening < offset < close for opening, close in resources)):
+                issues.append(_issue(src, offset, "java:S1481", f"local variable '{name}' is never used", "remove it"))
+        if (method["private"] or method["static"]) and not method["override"] and not constructor and method["name"] != "main":
+            for name in _parameter_names(method["params"]):
+                if not re.search(rf"(?<![\w$]){re.escape(name)}(?![\w$])", body):
+                    issues.append(_issue(src, method["nameOffset"], "java:S1172", f"parameter '{name}' of {method['name']}() is never used", "remove the parameter"))
+        if method["private"] and not constructor and method["name"] not in ("readObject", "writeObject", "readResolve", "writeReplace", "readObjectNoData"):
+            uses = len(re.findall(rf"(?<![\w$]){re.escape(method['name'])}\s*\(|::\s*{re.escape(method['name'])}\b", imports_removed))
+            declarations = sum(1 for item in src.methods if item["name"] == method["name"])
+            if uses <= declarations:
+                issues.append(_issue(src, method["nameOffset"], "java:S1144", f"private method {method['name']}() is never called", "remove it"))
+        returns = re.sub(r"@[\w.]+(?:\s*\([^)]*\))?|\b(?:public|protected|private|static|final|synchronized|abstract|native|strictfp|default)\b", "", method["prefix"]).strip()
+        if not method["override"] and re.search(r"<\s*\?|\?\s*(?:extends|super)\b", returns):
+            issues.append(_issue(src, method["nameOffset"], "java:S1452", f"{method['name']}() returns a wildcard type", "return a concrete generic type"))
+        if re.search(r"\b(?:List|Map|Set|Collection|ArrayList|HashMap|HashSet|LinkedList|LinkedHashMap)\b|\[\s*\]\s*$", returns):
+            for match in re.finditer(r"\breturn\s+null\s*;", body):
+                offset = method["start"] + match.start()
+                if _nested_function(src, offset, method["start"]):
+                    continue
+                issues.append(_issue(src, offset, "java:S1168", f"{method['name']}() returns null for a collection/array", "return an empty collection or array"))
+                break
+    field_names = {field["name"] for field in fields}
+    lowered: dict[str, set[str]] = {}
+    for name in field_names:
+        lowered.setdefault(name.lower(), set()).add(name)
+    for key, names in methods_by_lower.items():
+        lowered.setdefault(key, set()).update(names)
+    for key, names in lowered.items():
+        clash = len(names) > 1 or (names & field_names and key in methods_by_lower and methods_by_lower[key] & field_names)
+        if clash:
+            field = next((item for item in fields if item["name"].lower() == key), None)
+            offset = field["offset"] if field else next(item["nameOffset"] for item in src.methods if item["name"].lower() == key)
+            issues.append(_issue(src, offset, "java:S1845", f"members {sorted(names)} differ only by capitalization or reuse a field name", "rename one of them"))
+    declares_equals = re.search(r"\bboolean\s+equals\s*\(\s*(?:final\s+)?Object\b", code)
+    declares_hash = re.search(r"\bint\s+hashCode\s*\(\s*\)", code)
+    if bool(declares_equals) != bool(declares_hash):
+        issues.append(_issue(src, (declares_equals or declares_hash).start(), "java:S1206", "equals and hashCode are not overridden together", "override both"))
+    top = re.search(r"\bclass\s+([A-Za-z_$][\w$]*)([^{]*)\{", code)
+    if top and not re.search(r"\b(?:extends|implements)\b", top.group(2)) and not re.search(r"\babstract\s+class\b", code[:top.end()]):
+        outer = [method for method in src.methods if not _is_constructor(src, method)]
+        has_constructor = any(_is_constructor(src, method) for method in src.methods)
+        instance_fields = [field for field in fields if "static" not in field["mods"]]
+        if outer and all(method["static"] for method in outer) and not has_constructor and not instance_fields:
+            issues.append(_issue(src, top.start(), "java:S1118", f"utility class {top.group(1)} has an implicit public constructor",
+                                 f"add 'private {top.group(1)}() {{ }}' with a comment, e.g. // static helpers only"))
+    for offset, name, static, wild in _imports(src):
+        if wild:
+            continue
+        simple = name.rsplit(".", 1)[-1]
+        package = name.rsplit(".", 1)[0]
+        own_package = re.search(r"^\s*package\s+([\w.]+)\s*;", code, re.MULTILINE)
+        redundant = (not static and (package == "java.lang" or (own_package and package == own_package.group(1))))
+        used = re.search(rf"(?<![\w$]){re.escape(simple)}(?![\w$])", imports_removed) or re.search(
+            rf"(?:@link|@see|@throws|@exception)\s+[\w.#]*\b{re.escape(simple)}\b", src.raw)
+        if redundant or not used:
+            issues.append(_issue(src, offset, "java:S1128", f"unnecessary import {name}", "remove the import"))
+    imported = [name for _offset, name, _static, wild in _imports(src) if not wild]
+    for name in {item for item in imported if imported.count(item) > 1}:
+        offset = [item for item in _imports(src) if item[1] == name][1][0]
+        issues.append(_issue(src, offset, "java:S1128", f"duplicate import {name}", "remove the duplicate"))
+    return issues
+
+
+# --- Plugin lifecycle: propertyChanged / updateView ------------------------------------------
+
+def _lifecycle_issues(src: _Source) -> list[dict]:
+    """updateView() in propertyChanged() must sit behind a check of which property changed.
+
+    Guarded means inside an if/else/switch block, after an unbraced ``if (...)``, or after an early
+    ``return`` that filters the property first.
+    """
+    issues = []
+    for method in src.methods:
+        if method["name"] != "propertyChanged":
+            continue
+        for match in re.finditer(r"\bupdateView\s*\(", src.code[method["start"]:method["end"]]):
+            offset = method["start"] + match.start()
+            guarded = any(_block_owner(src, opening) in ("if", "switch", "else") and opening < offset < close
+                          for opening, close in src.pair.items() if method["start"] <= opening < method["end"] and src.code[opening] == "{")
+            statement = src.code[max(src.code.rfind(char, method["start"], offset) for char in ";{}") + 1:offset]
+            unbraced = re.match(r"\s*(?:if\s*\(|else\b)", statement)
+            early_return = re.search(r"\breturn\b", src.code[method["start"]:offset])
+            if not guarded and not unbraced and not early_return:
+                issues.append(_issue(src, offset, "CVE-KD-2026-0618", "propertyChanged() calls updateView() unconditionally",
+                                     "guard it on e.getProperty().getName() and refresh only the changed control: getView().updateView(\"fieldKey\")"))
+    return issues
+
+
+# --- Comments ---------------------------------------------------------------------------------
+
+_CODE_COMMENT_RE = re.compile(
+    r"^(?:(?:[\w$.<>\[\]]+\s+)?[\w$.\[\]()<>]+\s*(?:[+\-*/]?=)\s*[^=].*;|[\w$.]+\s*\(.*\)\s*;|(?:if|for|while|switch)\s*\(.*\)\s*\{?|return\b.*;|\}\s*(?:else\b.*)?|import\s+[\w.]+;)\s*$"
+)
+
+
+def _comment_issues(src: _Source) -> list[dict]:
+    issues = []
+    lines = src.raw.split("\n")
+    lit_lines = src.lit.split("\n")
+    offset = 0
+    in_javadoc = False
+    for raw_line, lit_line in zip(lines, lit_lines):
+        # `lit` blanks comments only, so the characters it blanked are the comment on this line.
+        comment = "".join(char for char, kept in zip(raw_line, lit_line) if kept == " ")
+        if "/**" in comment:
+            in_javadoc = True
+        text = re.sub(r"^\s*(?://+|/\*+|\*+)\s*", "", comment.strip()).rstrip("*/ ").strip()
+        if not in_javadoc and text and _CODE_COMMENT_RE.match(text):
+            issues.append(_issue(src, offset, "java:S125", "commented-out code", "delete the commented code; version control keeps history", ADVISE))
+        if "*/" in comment:
+            in_javadoc = False
+        offset += len(raw_line) + 1
+    return issues
+
+
+# --- Duplicated literals ----------------------------------------------------------------------
+
+def _duplicate_literal_issues(src: _Source) -> list[dict]:
+    occurrences: dict[str, list[int]] = {}
+    for offset, text in src.literals:
+        if len(text) < 5:
+            continue
+        line_start = src.lit.rfind("\n", 0, offset) + 1
+        if re.search(r"@[\w.]+\s*\([^)]*$", src.lit[line_start:offset]):
+            continue
+        occurrences.setdefault(text, []).append(offset)
+    issues = []
+    for text, offsets in occurrences.items():
+        if len(offsets) >= 3:
+            lines = sorted({src.line(offset) for offset in offsets})
+            issues.append(_issue(src, offsets[0], "java:S1192", f"literal \"{text}\" appears {len(offsets)} times (lines {lines})",
+                                 "declare it once as a private static final String constant (e.g. for a field key) and use the constant"))
+    return issues
+
+
+_CHECKS = (
+    _forbidden_type_issues, _forbidden_call_issues, _static_collection_issues, _loop_issues,
+    _data_access_issues, _suppression_and_naming_issues, _security_issues, _simple_rule_issues,
+    _structure_issues, _declaration_issues, _lifecycle_issues, _comment_issues, _duplicate_literal_issues,
+    _catalogue_issues, _additional_security_issues, _additional_code_issues,
+)
+
+
+def scan_source(source_text: str, path: Path | None = None) -> list[dict]:
+    """Every DCS issue in one Java source, ordered by line; ``level`` tells block from advise."""
+    src = _Source(source_text, path)
+    issues = [issue for check in _CHECKS for issue in check(src)]
+    unique = {(issue["line"], tuple(issue["ruleCodes"]), issue["message"]): issue for issue in issues}
+    return sorted(unique.values(), key=lambda issue: (issue["line"], issue["ruleCodes"][0]))
+
+
+def dcs_rule_issues(source_text: str, path: Path | None = None) -> list[dict]:
+    """Blocking DCS findings, in the shape of the other compile_plugin_source checks."""
+    return [issue for issue in scan_source(source_text, path) if issue["level"] == BLOCK]
+
+
+def dcs_rule_warnings(source_text: str, path: Path | None = None) -> list[dict]:
+    """Advisory DCS findings for ``sourceWarnings``: not provable from source, still to be fixed."""
+    return [{**issue, "severity": "warning", "errorCode": "PLUGIN_SOURCE_DCS_RULE_ADVISORY"}
+            for issue in scan_source(source_text, path) if issue["level"] == ADVISE]
+
+
+# --- SQL scripts and packaged files (module scan) --------------------------------------------
+
+_SQL_RULES = (
+    (r"\bcreate\s+(?:or\s+replace\s+)?view\b", "CVE-KD-SQL-0001"),
+    (r"\bcreate\s+(?:or\s+replace\s+)?procedure\b", "CVE-KD-SQL-0002"),
+    (r"\bcreate\s+(?:or\s+replace\s+)?function\b", "CVE-KD-SQL-0003"),
+    (r"\bcreate\s+(?:or\s+replace\s+)?trigger\b", "CVE-KD-SQL-0004"),
+    (r"\binsert\s+into\b", "CVE-KD-SQL-0005"),
+    (r"\bupdate\s+[\w.]+\s+set\b", "CVE-KD-SQL-0006"),
+    (r"\bdelete\s+(?:from\s+)?[\w.]+\b", "CVE-KD-SQL-0007"),
+    (r"\balter\s+table\s+[\w.]+\s+drop\b", "CVE-KD-SQL-0008"),
+    (r"\bdrop\s+table\b", "CVE-KD-SQL-0009"),
+    (r"\brename\s+(?:table|column)\b|\balter\s+table\s+[\w.]+\s+rename\b|\b(?:sp_rename|p_modifyobjectname)\b", "CVE-KD-SQL-0010"),
+)
+
+
+_SQL_TOKEN_RE = re.compile(r"'(?:''|[^'])*'|\"(?:\"\"|[^\"])*\"|`(?:``|[^`])*`|\[(?:\]\]|[^\]])*\]|--[^\r\n]*|/\*[\s\S]*?\*/|(?P<tag>\$(?:[A-Za-z_]\w*)?\$)[\s\S]*?(?P=tag)")
+
+
+def _sql_code(text: str) -> tuple[str, dict[int, str]]:
+    """按 SQL 词法顺序跳过字符串和注释；引号标识符保留位置但不能触发关键字规则。"""
+    identifiers = {}
+
+    def blank(match):
+        token = match.group(0)
+        if token[0] in '\"`[':
+            closing = "]" if token[0] == "[" else token[0]
+            identifiers[match.start()] = token[1:-1].replace(closing * 2, closing)
+            return re.sub(r"[^\r\n]", "x", token)
+        return re.sub(r"[^\r\n]", " ", token)
+
+    return _SQL_TOKEN_RE.sub(blank, text), identifiers
+
+
+def scan_sql(data: bytes) -> list[dict]:
+    try:
+        text = data.decode("utf-8-sig")
+    except UnicodeDecodeError:
+        return [{"line": 1, "ruleCodes": ["CVE-KD-SQL-0015"], "dcsRisk": RULES["CVE-KD-SQL-0015"][0], "dcsRule": RULES["CVE-KD-SQL-0015"][1],
+                 "level": BLOCK, "message": "SQL script is not UTF-8", "fix": "save the script as UTF-8"}]
+    code, identifiers = _sql_code(text)
+    issues = []
+    for pattern, rule in _SQL_RULES:
+        for match in re.finditer(pattern, code, re.IGNORECASE):
+            # 外键 ON DELETE 引用动作不是删除数据语句；注释已置空，换行不影响判断。
+            if rule == "CVE-KD-SQL-0007" and re.search(r"\bon\s*$", code[:match.start()], re.IGNORECASE):
+                continue
+            issues.append({"line": code.count("\n", 0, match.start()) + 1, "ruleCodes": [rule], "dcsRisk": RULES[rule][0],
+                           "dcsRule": RULES[rule][1], "level": BLOCK, "message": f"{RULES[rule][1]}: {text[match.start():match.end()]}",
+                           "fix": "keep scripts to schema creation the platform allows; move data changes into operations"})
+    for match in re.finditer(r"\bcreate\s+table\s+(?:if\s+not\s+exists\s+)?([\w.]+)", code, re.IGNORECASE):
+        table_offset = match.start(1) + match.group(1).rfind(".") + 1
+        table = identifiers.get(table_offset, match.group(1).rsplit(".", 1)[-1])
+        if len(table) > 24:
+            issues.append({"line": code.count("\n", 0, match.start()) + 1, "ruleCodes": ["CVE-KD-SQL-0014"], "dcsRisk": "严重",
+                           "dcsRule": RULES["CVE-KD-SQL-0014"][1], "level": BLOCK,
+                           "message": f"table name {table} has {len(table)} characters", "fix": "shorten the table name to 24 characters or fewer"})
+    for pattern, rule, level, fix in (
+        (r"\binsert\s+into\s+[\w.]+\s+(?:values|select|default)\b", "CVE-KD-SQL-0017", BLOCK, "list INSERT target columns explicitly"),
+        (r"\b(?:create\s+(?:unique\s+)?index|alter\s+index)\b", "CVE-KD-SQL-0011", ADVISE, "verify target-table size and index impact with the deployment owner"),
+        (r"\balter\s+table\s+[\w.]+\s+add\s+(?!constraint\b|primary\b|unique\b|foreign\b|check\b)(?:column\s+)?\w+", "CVE-KD-SQL-0012", ADVISE, "verify target-table size and ADD COLUMN impact before deployment"),
+        (r"\balter\s+table\s+[\w.]+\s+(?:alter|modify)\s+(?:column\s+)?\w+", "CVE-KD-SQL-0013", ADVISE, "verify target-table size and column migration impact before deployment"),
+    ):
+        for match in re.finditer(pattern, code, re.IGNORECASE):
+            issues.append({"line": code.count("\n", 0, match.start()) + 1, "ruleCodes": [rule], "dcsRisk": RULES[rule][0],
+                           "dcsRule": RULES[rule][1], "level": level, "message": RULES[rule][1], "fix": fix})
+    for directive in _SQL_TOKEN_RE.finditer(text):
+        if directive.group(0).lower() == "/*dialect*/":
+            rule = "CVE-KD-SQL-0016"
+            issues.append({"line": text.count("\n", 0, directive.start()) + 1, "ruleCodes": [rule], "dcsRisk": RULES[rule][0],
+                           "dcsRule": RULES[rule][1], "level": ADVISE, "message": RULES[rule][1],
+                           "fix": "ISV products must remove dialect SQL; verify the deployment/product context"})
+    # KSQL 的删除字段过程含字面量参数，须在执行语句处解析，不能把字符串/注释当调用。
+    for match in re.finditer(r"\bexec(?:ute)?\s+(?:[\w]+\.)?p_AlterColumn\b", code, re.IGNORECASE):
+        end = code.find(";", match.end())
+        statement = text[match.end():end if end >= 0 else len(text)]
+        if re.match(r"\s*'[^']+'\s*,\s*'[^']+'\s*,\s*'NULL'\s*(?:,|$)", statement, re.IGNORECASE):
+            rule = "CVE-KD-SQL-0008"
+            issues.append({"line": code.count("\n", 0, match.start()) + 1, "ruleCodes": [rule], "dcsRisk": RULES[rule][0],
+                           "dcsRule": RULES[rule][1], "level": BLOCK, "message": "p_AlterColumn deletes a column", "fix": "do not drop fields in deployment SQL"})
+    return issues
+
+
+_SKIPPED_DIRS = {"build", "out", "target", ".gradle", ".idea", ".git", "node_modules", ".temp", "bin"}
+
+
+def scan_path(root: Path) -> dict:
+    files = [root] if root.is_file() else sorted(
+        path for path in root.rglob("*")
+        if path.is_file() and not (_SKIPPED_DIRS & set(path.relative_to(root).parts[:-1]))
+    )
+    findings, advisories, scanned = [], [], 0
+    class_names: dict[str, list[tuple[Path, int]]] = {}
+    for path in files:
+        suffix = path.suffix.lower()
+        if suffix == ".java":
+            scanned += 1
+            try:
+                text = path.read_bytes().decode("utf-8-sig")
+            except UnicodeDecodeError:
+                findings.append({"file": str(path), "line": 1, "ruleCodes": ["CVE-KD-0501"], "dcsRisk": "高危",
+                                 "dcsRule": RULES["CVE-KD-0501"][1], "level": BLOCK,
+                                 "message": "source is not UTF-8; the JDK 17 build reads sources as UTF-8", "fix": "save the file as UTF-8"})
+                continue
+            for issue in scan_source(text, path):
+                (findings if issue["level"] == BLOCK else advisories).append({"file": str(path), **issue})
+            source = _Source(text)
+            package = re.search(r"\bpackage\s+([\w.]+)\s*;", source.code)
+            for declared in re.finditer(r"\b(?:class|interface|enum|record)\s+([\w$]+)", source.code):
+                if source.brace_depth(declared.start()) == 0:
+                    name = (package.group(1) + "." if package else "") + declared.group(1)
+                    class_names.setdefault(name, []).append((path, source.line(declared.start())))
+        elif suffix == ".sql":
+            scanned += 1
+            for issue in scan_sql(path.read_bytes()):
+                (findings if issue["level"] == BLOCK else advisories).append({"file": str(path), **issue})
+        elif suffix in (".jar", ".class", ".so", ".dll", ".dylib"):
+            rule = "CVE-KD-SCAN-jar" if suffix == ".jar" else "CVE-KD-SCAN-libFile"
+            findings.append({"file": str(path), "line": 0, "ruleCodes": [rule], "dcsRisk": RULES[rule][0], "dcsRule": RULES[rule][1],
+                             "level": BLOCK, "message": f"packaged binary {path.name}",
+                             "fix": "remove it; depend only on the platform SDK libraries, which DCS provides at deployment"})
+    for name, declarations in class_names.items():
+        if len(declarations) < 2:
+            continue
+        rule = "class_fully_qualified_name_conflict_internal"
+        for path, line in declarations:
+            findings.append({"file": str(path), "line": line, "ruleCodes": [rule], "dcsRisk": RULES[rule][0],
+                             "dcsRule": RULES[rule][1], "level": BLOCK, "message": f"duplicate class {name} in the inspected source module",
+                             "fix": "remove duplicate source classes or use distinct fully qualified names"})
+    return {"findings": findings, "advisories": advisories, "scanned": scanned}
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Check Java plugin source against the DCS deployment gate.")
+    parser.add_argument("--source", action="append", required=True, help="a .java/.sql file or a module directory; repeatable")
+    parser.add_argument("--strict", action="store_true", help="also fail on advisory findings")
+    args = parser.parse_args()
+    findings, advisories, scanned, missing = [], [], 0, []
+    scan_errors, empty_sources = [], []
+    for item in args.source:
+        path = Path(item).expanduser().resolve()
+        if not path.exists():
+            missing.append(str(path))
+            continue
+        try:
+            result = scan_path(path)
+        except OSError as exc:
+            scan_errors.append({"file": str(path), "message": str(exc)})
+            continue
+        if not result["scanned"] and not result["findings"]:
+            empty_sources.append(str(path))
+        findings += result["findings"]
+        advisories += result["advisories"]
+        scanned += result["scanned"]
+    status = not (missing or scan_errors or empty_sources or findings or (args.strict and advisories))
+    print(json.dumps({
+        "schemaVersion": SCHEMA_VERSION,
+        "status": status,
+        "scannedFiles": scanned,
+        "missing": missing,
+        "scanErrors": scan_errors,
+        "emptySources": empty_sources,
+        "ruleSource": "金蝶AI套件公有云门禁20261026.xlsx ∪ 扫描规则_1026144356.xlsx（高危/严重）",
+        "ruleSources": CATALOG["sources"],
+        "coverage": {"cataloguedRuleCount": len(CATALOG["rules"]), "scope": "source-text", "complete": False},
+        "catalogueMerge": {"overlapCount": CATALOG["overlapCount"], "addedCount": CATALOG["addedCount"]},
+        "findingCount": len(findings),
+        "advisoryCount": len(advisories),
+        "findings": findings,
+        "advisories": advisories,
+        "notCovered": "final JAR/external class-name conflicts, metadata/KSC/TypeScript scans, null-flow, injection/ownership and other whole-build analyses stay with DCS; catalogue registration is not detector coverage",
+    }, ensure_ascii=False, indent=2))
+    return 0 if status else 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())