@shundoo-ai/dsh-cosmic 1.0.21 → 1.0.22

package/skills/cosmic-build/scripts/test/test_dcs_code_gate.py

@@ -0,0 +1,901 @@
+import hashlib
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+
+SCRIPTS = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(SCRIPTS))
+
+import dcs_code_gate  # noqa: E402
+from dcs_code_gate import RULES, dcs_rule_issues, dcs_rule_warnings, scan_source, scan_sql  # noqa: E402
+
+
+_GOOD = '''package cus.demo.formplugin;
+
+import java.util.EventObject;
+
+import kd.bos.dataentity.entity.DynamicObject;
+import kd.bos.entity.datamodel.events.ChangeData;
+import kd.bos.entity.datamodel.events.PropertyChangedArgs;
+import kd.bos.exception.KDBizException;
+import kd.bos.form.plugin.AbstractFormPlugin;
+import kd.bos.logging.Log;
+import kd.bos.logging.LogFactory;
+import kd.bos.orm.query.QCP;
+import kd.bos.orm.query.QFilter;
+import kd.bos.servicehelper.BusinessDataServiceHelper;
+
+/**
+ * Fills the unit price when the material changes.
+ */
+public class MaterialPricePlugin extends AbstractFormPlugin {
+    private static final Log LOG = LogFactory.getLog(MaterialPricePlugin.class);
+    private static final String FIELD_MATERIAL = "material";
+    private static final String FIELD_PRICE = "price";
+
+    @Override
+    public void afterCreateNewData(EventObject e) {
+        super.afterCreateNewData(e);
+        getModel().setValue(FIELD_PRICE, 0);
+    }
+
+    @Override
+    public void propertyChanged(PropertyChangedArgs e) {
+        super.propertyChanged(e);
+        if (!FIELD_MATERIAL.equals(e.getProperty().getName())) {
+            return;
+        }
+        ChangeData[] changes = e.getChangeSet();
+        Object value = changes[0].getNewValue();
+        if (!(value instanceof DynamicObject)) {
+            return;
+        }
+        DynamicObject material = (DynamicObject) value;
+        QFilter filter = new QFilter("id", QCP.equals, material.getPkValue());
+        DynamicObject loaded = BusinessDataServiceHelper.loadSingle("bd_material", "id,price", new QFilter[]{filter});
+        if (loaded == null) {
+            LOG.warn("material not found");
+            throw new KDBizException("物料不存在");
+        }
+        getModel().setValue(FIELD_PRICE, loaded.getBigDecimal(FIELD_PRICE));
+        getView().updateView(FIELD_PRICE);
+    }
+}
+'''
+
+_BAD = '''package kd.cus.demo;
+
+import java.util.HashMap;
+import java.util.Map;
+import java.util.List;
+import kd.bos.orm.ORM;
+import kd.bos.db.DB;
+import kd.bos.logging.Log;
+import kd.bos.logging.LogFactory;
+import kd.bos.servicehelper.operation.SaveServiceHelper;
+import kd.bos.servicehelper.QueryServiceHelper;
+
+public class Bad extends AbstractFormPlugin {
+    private static final Log LOG = LogFactory.getLog(Bad.class);
+    private static final Map<String, String> CACHE = new HashMap<>();
+
+    @Override
+    public void propertyChanged(PropertyChangedArgs e) {
+        getView().updateView();
+    }
+
+    public void doWork(List<DynamicObject> rows) {
+        for (DynamicObject row : rows) {
+            LOG.info("row " + row.getPkValue());
+            SaveServiceHelper.save(new DynamicObject[]{row});
+            for (DynamicObject inner : rows) {
+                QueryServiceHelper.query("bd_material", "id", null);
+            }
+        }
+        System.out.println("done");
+        try {
+            ORM.create().queryDataSet("x", "bd_material", "id", null);
+        } catch (Exception ex) {
+            ex.printStackTrace();
+        }
+        String a = row1("billno");
+        a = row1("billno") + row1("billno");
+        if (a.size() == 0) {
+            throw new RuntimeException("x");
+        }
+    }
+
+    private String row1(String key) { return key; }
+}
+'''
+
+
+def _codes(issues):
+    return {code for issue in issues for code in issue["ruleCodes"]}
+
+
+def _plugin(body, imports=""):
+    """A minimal, otherwise clean plugin class around ``body``."""
+    return f"package cus.demo;\n{imports}\npublic class Demo {{\n{body}\n}}\n"
+
+
+def test_every_reported_rule_code_exists_in_the_dcs_rule_table():
+    issues = scan_source(_BAD) + scan_source(_GOOD)
+    assert _codes(issues) <= set(RULES)
+    # Family rules carry one code per keyword in the DCS table; the family code itself never matches.
+    assert "CVE-KD-0056" not in RULES and "CVE-KD-0056-05" in RULES
+    assert "CVE-KD-0026" not in RULES and "CVE-KD-0026-25" in RULES
+    assert "CVE-KD-0721" not in RULES and {"CVE-KD-0721-1", "CVE-KD-0721-2"} <= set(RULES)
+
+
+def test_the_violations_dcs_rejects_are_blocked_together():
+    blocked = dcs_rule_issues(_BAD)
+
+    assert {
+        "CVE-KD-2026-0508",  # kd.bos.orm.ORM
+        "CVE-KD-0413",  # kd.bos.db.DB
+        "CVE-KD-0056-05",  # static HashMap
+        "CVE-KD-0058-1",  # 循环内日志
+        "CVE-KD-0051-10",  # 循环内保存
+        "CVE-KD-1215-1",  # 嵌套循环查询
+        "CVE-KD-0303",  # query with a null filter
+        "CVE-KD-2026-0618",  # unconditional updateView in propertyChanged
+        "java:S106",  # System.out
+        "java:S1155",  # size() == 0
+        "java:S112",  # generic RuntimeException
+        "java:S1128",  # unused import
+        "java:S1192",  # duplicated literal
+    } <= _codes(blocked)
+    assert all(issue["level"] == "block" and issue["fix"] and issue["line"] > 0 for issue in blocked)
+
+
+def test_a_plugin_written_to_the_rules_passes(tmp_path):
+    source = tmp_path / "src" / "main" / "java" / "cus" / "demo" / "formplugin" / "MaterialPricePlugin.java"
+
+    assert scan_source(_GOOD, source) == []
+
+
+def test_the_package_must_match_the_directory_only_when_the_path_is_known(tmp_path):
+    assert "java:S1598" in _codes(scan_source(_GOOD, tmp_path / "Other.java"))
+    assert "java:S1598" not in _codes(scan_source(_GOOD))
+    source = tmp_path / "src" / "cus" / "demo" / "formplugin" / "unused" / ".." / "MaterialPricePlugin.java"
+    assert "java:S1598" not in _codes(scan_source(_GOOD, source))
+
+
+def test_filter_null_is_found_in_whichever_position_the_overload_puts_it():
+    for call in (
+        'QueryServiceHelper.query("bd_material", "id", null)',
+        'QueryServiceHelper.queryDataSet("algo", "bd_material", "id", null, "id")',
+        'BusinessDataServiceHelper.loadFromCache(type, (QFilter[]) null)',
+        'BusinessDataServiceHelper.load("bd_material", "id", new QFilter[0])',
+    ):
+        source = _plugin(f"    public Object run(DynamicObjectType type) {{\n        return {call};\n    }}")
+        assert "CVE-KD-0303" in _codes(dcs_rule_issues(source)), call
+    source = _plugin('    public Object run(QFilter[] filters) {\n'
+                     '        return QueryServiceHelper.queryDataSet("algo", "bd_material", "id", filters, null);\n    }')
+    assert "CVE-KD-0303" not in _codes(dcs_rule_issues(source))
+
+
+@pytest.mark.parametrize("call", [
+    'QueryServiceHelper.query(entity, fields, filters)',
+    'QueryServiceHelper.query(entity, fields, filters, null)',
+    'QueryServiceHelper.query(entity, fields, filters, null, top)',
+    'QueryServiceHelper.query("algo", entity, fields, filters, null)',
+    'QueryServiceHelper.query("algo", entity, fields, filters, null, top)',
+    'QueryServiceHelper.queryDataSet("algo", entity, fields, filters, null)',
+    'QueryServiceHelper.queryDataSet("algo", entity, fields, filters, null, top)',
+    'QueryServiceHelper.queryOne(entity, fields, filters)',
+    'QueryServiceHelper.exists(entity, filters)',
+    'QueryServiceHelper.queryPrimaryKeys(entity, filters, null, top)',
+    'QueryServiceHelper.queryPrimaryKeys("algo", entity, filters, null, top)',
+    'QueryServiceHelper.queryPrimaryKeys("algo", entityType, filters, null, top)',
+    'BusinessDataServiceHelper.load(entity, fields, filters)',
+    'BusinessDataServiceHelper.load(entity, fields, filters, null)',
+    'BusinessDataServiceHelper.load(entity, fields, filters, null, top)',
+    'BusinessDataServiceHelper.load(entity, fields, filters, null, top, top)',
+    'BusinessDataServiceHelper.loadFromCache(entity, fields, filters)',
+    'BusinessDataServiceHelper.loadFromCache(entity, fields, filters, null)',
+    'BusinessDataServiceHelper.loadFromCache(type, filters)',
+    'BusinessDataServiceHelper.loadSingle(entity, (QFilter[]) filters)',
+    'BusinessDataServiceHelper.loadSingle(entity, fields, filters)',
+    'BusinessDataServiceHelper.loadSingleFromCache(entity, fields, filters)',
+])
+def test_each_filter_overload_accepts_filters_and_rejects_explicit_empty_filters(call):
+    def source(expression):
+        return _plugin('    public Object run(String entity, String fields, QFilter[] filters, int top, '
+                       'DynamicObjectType type, IDataEntityType entityType) {\n'
+                       f'        return {expression};\n    }}')
+
+    assert "CVE-KD-0303" not in _codes(scan_source(source(call)))
+    for empty in ("(QFilter[]) null", "new QFilter[0]", "new QFilter[]{}"):
+        assert "CVE-KD-0303" in _codes(dcs_rule_issues(source(call.replace("(QFilter[]) filters", "filters").replace("filters", empty))))
+
+
+@pytest.mark.parametrize("call", [
+    'QueryServiceHelper.exists(entity, pk)',
+    'QueryServiceHelper.exists(entity, (Object) null)',
+    'BusinessDataServiceHelper.load(ids, type)',
+    'BusinessDataServiceHelper.loadFromCache(ids, type)',
+    'BusinessDataServiceHelper.loadSingle(pk, type)',
+    'BusinessDataServiceHelper.loadSingle(pk, type, 0, 1)',
+    'BusinessDataServiceHelper.loadSingle(pk, entity)',
+    'BusinessDataServiceHelper.loadSingle(pk, entity, null)',
+    'BusinessDataServiceHelper.loadSingleFromCache(pk, entity, null)',
+    'BusinessDataServiceHelper.loadSingleFromCache(pk, type)',
+])
+def test_primary_key_overloads_are_not_treated_as_unfiltered_queries(call):
+    source = _plugin('    public Object run(Object pk, Object[] ids, String entity, DynamicObjectType type) {\n'
+                     f'        return {call};\n    }}')
+    assert "CVE-KD-0303" not in _codes(scan_source(source))
+
+
+def test_unresolved_overloads_are_advisory_instead_of_blocking_valid_code():
+    source = _plugin('    public Object run() {\n'
+                     '        return QueryServiceHelper.query(entity(), fields(), filter(), null, limit());\n    }')
+    assert "CVE-KD-0303" not in _codes(dcs_rule_issues(source))
+    assert "CVE-KD-0303" in _codes(dcs_rule_warnings(source))
+    source = _plugin('    public boolean run(String entity) {\n'
+                     '        return QueryServiceHelper.exists(entity, null);\n    }')
+    assert "CVE-KD-0303" in _codes(dcs_rule_issues(source))
+
+
+@pytest.mark.parametrize("cipher,blocked", [
+    ("RSA/ECB/OAEPWithSHA-256AndMGF1Padding", False),
+    ("RSA/ECB/PKCS1Padding", True),
+    ("RSA", True),
+    ("AES/GCM/NoPadding", False),
+    ("AES/ECB/PKCS5Padding", True),
+])
+def test_rsa_oaep_is_not_a_symmetric_ecb_cipher(cipher, blocked):
+    source = _plugin(f'    public Object run() {{\n        return Cipher.getInstance("{cipher}");\n    }}')
+    assert ("java:S5542" in _codes(dcs_rule_issues(source))) is blocked
+
+
+@pytest.mark.parametrize("kind,algorithm,bits,blocked", [
+    ("KeyPairGenerator", "EC", 256, False),
+    ("KeyPairGenerator", "EC", 224, False),
+    ("KeyPairGenerator", "EC", 192, True),
+    ("KeyPairGenerator", "RSA", 2048, False),
+    ("KeyPairGenerator", "RSA", 1024, True),
+    ("KeyGenerator", "AES", 128, False),
+    ("KeyGenerator", "AES", 64, True),
+])
+def test_key_lengths_are_checked_on_the_correct_generator(kind, algorithm, bits, blocked):
+    method = "initialize" if kind == "KeyPairGenerator" else "init"
+    source = _plugin(f'    public void run(Other unrelated) {{\n'
+                     f'        {kind} generator = {kind}.getInstance("{algorithm}");\n'
+                     f'        generator.{method}({bits});\n        unrelated.{method}(1);\n    }}')
+    issues = [item for item in scan_source(source) if "java:S4426" in item["ruleCodes"]]
+    assert len(issues) == int(blocked)
+    if blocked:
+        assert algorithm in issues[0]["fix"]
+        assert f"generator.{method}({bits})" in source.splitlines()[issues[0]["line"] - 1]
+
+
+def test_a_reassigned_generator_does_not_inherit_the_previous_algorithm():
+    source = _plugin('    public void run() {\n'
+                     '        KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");\n'
+                     '        generator.initialize(2048);\n'
+                     '        generator = KeyPairGenerator.getInstance("EC");\n'
+                     '        generator.initialize(192);\n    }')
+    issues = [item for item in scan_source(source) if "java:S4426" in item["ruleCodes"]]
+    assert len(issues) == 1 and "EC" in issues[0]["fix"]
+
+
+def test_same_generator_names_in_other_methods_do_not_inherit_the_algorithm():
+    source = _plugin('    public void first() {\n'
+                     '        KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");\n'
+                     '        generator.initialize(2048);\n    }\n'
+                     '    public void second() {\n'
+                     '        KeyPairGenerator generator = KeyPairGenerator.getInstance("EC");\n'
+                     '        generator.initialize(256);\n    }')
+    assert "java:S4426" not in _codes(scan_source(source))
+
+
+@pytest.mark.parametrize("setting,blocked", [
+    ('factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);', False),
+    ('factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", false);', True),
+    ('factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);', True),
+    ('factory.setExpandEntityReferences(false);', True),
+    ('String note = "disallow-doctype-decl";', True),
+    ('factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);\n'
+     '        factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", false);', True),
+])
+def test_xxe_hardening_requires_effective_settings_on_this_factory(setting, blocked):
+    source = _plugin('    public Object run() {\n'
+                     '        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();\n'
+                     f'        {setting}\n        return factory.newDocumentBuilder();\n    }}')
+    assert ("java:S2755" in _codes(dcs_rule_issues(source))) is blocked
+
+
+def test_the_same_factory_name_in_another_method_is_not_implicitly_hardened():
+    source = _plugin('    public Object first() {\n'
+                     '        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();\n'
+                     '        factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);\n'
+                     '        return factory.newDocumentBuilder();\n    }\n'
+                     '    public Object second() {\n'
+                     '        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();\n'
+                     '        return factory.newDocumentBuilder();\n    }')
+    issues = [item for item in scan_source(source) if "java:S2755" in item["ruleCodes"]]
+    assert len(issues) == 1 and issues[0]["line"] > source.splitlines().index('    public Object second() {') + 1
+
+
+def test_one_hardened_factory_does_not_clear_another_or_an_earlier_parse():
+    source = _plugin('    public Object run() {\n'
+                     '        DocumentBuilderFactory safe = DocumentBuilderFactory.newInstance();\n'
+                     '        safe.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);\n'
+                     '        DocumentBuilderFactory unsafe = DocumentBuilderFactory.newInstance();\n'
+                     '        return unsafe.newDocumentBuilder();\n    }')
+    findings = [item for item in scan_source(source) if "java:S2755" in item["ruleCodes"]]
+    assert len(findings) == 1
+    assert "DocumentBuilderFactory unsafe" in source.splitlines()[findings[0]["line"] - 1]
+    late = _plugin('    public void run() {\n'
+                   '        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();\n'
+                   '        factory.newDocumentBuilder();\n'
+                   '        factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);\n    }')
+    assert "java:S2755" in _codes(dcs_rule_issues(late))
+
+
+@pytest.mark.parametrize("kind,settings", [
+    ("XMLInputFactory", 'factory.setProperty(XMLInputFactory.SUPPORT_DTD, false);\n'
+     '        factory.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);'),
+    ("TransformerFactory", 'factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");\n'
+     '        factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");'),
+    ("SchemaFactory", 'factory.setProperty(XMLConstants.ACCESS_EXTERNAL_DTD, "");\n'
+     '        factory.setProperty(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");'),
+])
+def test_factory_specific_xxe_controls_are_not_interchangeable(kind, settings):
+    source = _plugin(f'    public Object run() {{\n        {kind} factory = {kind}.newInstance();\n'
+                     f'        {settings}\n        return factory;\n    }}')
+    assert "java:S2755" not in _codes(scan_source(source))
+    assert "java:S2755" in _codes(dcs_rule_issues(source.replace(settings.splitlines()[0], "")))
+
+
+def test_runtime_or_conditional_xxe_settings_are_not_claimed_as_proven_safe():
+    for setting in (
+        'factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", enabled);',
+        'if (enabled) { factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true); }',
+        'if (enabled) factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);',
+    ):
+        source = _plugin('    public Object run(boolean enabled) {\n'
+                         '        DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();\n'
+                         f'        {setting}\n        return factory.newDocumentBuilder();\n    }}')
+        assert "java:S2755" not in _codes(dcs_rule_issues(source))
+        assert "java:S2755" in _codes(dcs_rule_warnings(source))
+
+
+@pytest.mark.parametrize("expression,blocked", [
+    ('new BigInteger("42")', True),
+    ('new BigInteger("9223372036854775808")', False),
+    ('new BigInteger(bytes)', False),
+    ('new BigInteger(1, bytes)', False),
+    ('new BigInteger(text)', False),
+    ('new BigInteger(text, 16)', False),
+    ('new java.math.BigInteger(bytes)', False),
+])
+def test_big_integer_constructors_are_only_replaced_when_value_of_is_equivalent(expression, blocked):
+    source = _plugin('    public Object run(byte[] bytes, String text) {\n'
+                     f'        return {expression};\n    }}')
+    assert ("java:S2129" in _codes(dcs_rule_issues(source))) is blocked
+
+
+def test_every_try_resource_is_implicitly_used_but_ordinary_unused_locals_are_not():
+    source = _plugin('    public void run() {\n'
+                     '        try (Scope first = open(); Scope second = open(); Scope third = open()) {\n'
+                     '            Scope unused = open();\n            work();\n        }\n    }')
+    issues = [item for item in scan_source(source) if "java:S1481" in item["ruleCodes"]]
+    assert len(issues) == 1 and "unused" in issues[0]["message"]
+
+
+@pytest.mark.parametrize("body", [
+    'public Object run(Runnable work) { return new Thread(work); }',
+    'public Object run(Runnable work) { return new java.lang.Thread(work); }',
+    'public class Worker extends Thread { public void run() { work(); } }',
+    'public class Worker extends java.lang.Thread { public void run() { work(); } }',
+])
+def test_native_threads_cannot_bypass_the_gate_with_fully_qualified_names(body):
+    assert "CVE-KD-0055-1" in _codes(dcs_rule_issues(_plugin(body)))
+
+
+def test_update_view_in_property_changed_is_allowed_once_guarded_on_the_field():
+    unguarded = _plugin("    public void propertyChanged(PropertyChangedArgs e) {\n        getView().updateView();\n    }")
+    guarded = _plugin(
+        "    public void propertyChanged(PropertyChangedArgs e) {\n"
+        "        if (!\"qty\".equals(e.getProperty().getName())) {\n            return;\n        }\n"
+        "        getView().updateView(\"qty\");\n    }")
+
+    assert "CVE-KD-2026-0618" in _codes(scan_source(unguarded))
+    assert "CVE-KD-2026-0618" not in _codes(scan_source(guarded))
+
+
+def test_a_rethrown_throwable_is_advisory_and_a_swallowed_one_is_blocked():
+    rethrown = _plugin(
+        "    public void run(Runnable work) {\n        try {\n            work.run();\n"
+        "        } catch (Throwable e) {\n            LOG.error(\"failed\", e);\n            throw e;\n        }\n    }")
+    swallowed = rethrown.replace("throw e;", "LOG.warn(\"ignored\");")
+
+    assert "java:S1181" not in _codes(dcs_rule_issues(rethrown))
+    assert "java:S1181" in _codes(dcs_rule_warnings(rethrown))
+    assert "java:S1181" in _codes(dcs_rule_issues(swallowed))
+
+
+def test_hardcoded_credentials_are_blocked_but_sql_text_naming_a_column_is_not():
+    hardcoded = _plugin('    private static final String PASSWORD = "Kd@123456";')
+    sql_text = _plugin('    public String sql(String password) {\n'
+                       '        return "where fpassword=\'" + password + "\'";\n    }')
+
+    assert "java:S2068" in _codes(dcs_rule_issues(hardcoded))
+    assert "java:S2068" not in _codes(scan_source(sql_text))
+
+
+def test_shapes_that_only_look_like_a_violation_are_not_reported():
+    # A type annotation inside the return type is not the method name.
+    annotated = _plugin('    public Result<@Body("x") Boolean> saveMap(String key) {\n        return Result.of(key);\n    }')
+    assert "java:S100" not in _codes(scan_source(annotated))
+    # An operator inside a string literal is text, not a comparison.
+    literal = _plugin('    public String text(String a, String b) {\n        return a + " != " + b;\n    }')
+    assert "java:S4973" not in _codes(scan_source(literal))
+    # toArray with a sized array is the accepted form; a zero-length one is not.
+    sized = _plugin("    public String[] run(java.util.List<String> keys) {\n"
+                    "        return keys.toArray(new String[keys.size()]);\n    }")
+    assert "ITA_INEFFICIENT_TO_ARRAY" not in _codes(scan_source(sized))
+    assert "ITA_INEFFICIENT_TO_ARRAY" in _codes(scan_source(sized.replace("keys.size()", "0")))
+
+
+def test_comments_and_literals_never_trigger_a_forbidden_type():
+    source = _plugin('    // do not use kd.bos.orm.ORM here\n'
+                     '    public String note() {\n        return "kd.bos.db.DB is forbidden";\n    }')
+
+    assert not {"CVE-KD-2026-0508", "CVE-KD-0413"} & _codes(scan_source(source))
+
+
+def test_warnings_carry_the_compile_gate_shape():
+    source = _plugin("    public int run() {\n        // int total = compute(1, 2);\n        return 1;\n    }")
+    warnings = dcs_rule_warnings(source)
+
+    assert [item["ruleCodes"] for item in warnings] == [["java:S125"]]
+    assert warnings[0]["severity"] == "warning"
+    assert warnings[0]["errorCode"] == "PLUGIN_SOURCE_DCS_RULE_ADVISORY"
+    assert dcs_rule_issues(source) == []
+
+
+def test_sql_scripts_are_limited_to_the_schema_changes_dcs_allows():
+    issues = scan_sql(
+        b"-- delete from t_old\n"
+        b"create table t_demo_a_very_long_table_name_x (fid bigint);\n"
+        b"insert into t_demo values (1);\n"
+        b"create or replace view v_demo as select 1;\n")
+
+    assert _codes(issues) == {"CVE-KD-SQL-0014", "CVE-KD-SQL-0005", "CVE-KD-SQL-0001", "CVE-KD-SQL-0017"}
+    assert [issue["line"] for issue in issues if issue["ruleCodes"] == ["CVE-KD-SQL-0005"]] == [3]
+    assert _codes(scan_sql("create table t_x (fid bigint);".encode("gbk") + "-- 中文".encode("gbk"))) == {
+        "CVE-KD-SQL-0015"}
+
+
+@pytest.mark.parametrize("literal", [
+    "'insert into t_demo'", "'delete from t_demo'", "'drop table t_demo'",
+    "'it''s -- text'", "'/* text */'", "'first\nupdate t_demo set fid=1'",
+    "$$delete from t_demo$$", "$tag$insert into t_demo$tag$",
+])
+def test_sql_literal_keywords_and_comment_delimiters_do_not_hide_real_statements(literal):
+    sql = f"create table t_demo (note varchar(100) default {literal});\nupdate t_demo set note='ok';"
+    issues = scan_sql(sql.encode("utf-8"))
+    assert _codes(issues) == {"CVE-KD-SQL-0006"}
+    assert issues[0]["line"] == sql.count("\n") + 1
+
+
+@pytest.mark.parametrize("quoted", ['"t_demo"', '`t_demo`', '[t_demo]', '"schema"."t_demo"'])
+def test_sql_quoted_identifiers_preserve_real_updates_and_schema_rules(quoted):
+    assert _codes(scan_sql(f"update {quoted} set fid=1;".encode())) == {"CVE-KD-SQL-0006"}
+    assert _codes(scan_sql(f"alter table {quoted} drop column fid;".encode())) == {"CVE-KD-SQL-0008"}
+    assert scan_sql(f"create table {quoted} (fid bigint);".encode()) == []
+    assert _codes(scan_sql(('create table "schema"."' + "t" * 25 + '" (fid bigint);').encode())) == {"CVE-KD-SQL-0014"}
+
+
+def test_quoted_sql_keywords_and_comments_are_not_executable_code():
+    assert scan_sql(b'create table t_demo ("insert into" varchar(100));\n'
+                    b'-- update t_demo set fid=1\n/* delete from t_demo */') == []
+
+
+def _cli(*args):
+    run = subprocess.run([sys.executable, str(SCRIPTS / "dcs_code_gate.py"), *args],
+                         capture_output=True, text=True)
+    return run.returncode, json.loads(run.stdout)
+
+
+def test_the_cli_scans_a_module_and_fails_on_blocking_findings(tmp_path):
+    package = tmp_path / "src" / "main" / "java" / "cus" / "demo" / "formplugin"
+    package.mkdir(parents=True)
+    (package / "MaterialPricePlugin.java").write_text(_GOOD, encoding="utf-8")
+    (tmp_path / "build").mkdir()
+    (tmp_path / "build" / "Bad.java").write_text(_BAD, encoding="utf-8")
+
+    code, report = _cli("--source", str(tmp_path))
+    assert code == 0
+    assert report["status"] is True and report["scannedFiles"] == 1
+    assert report["ruleSource"] == "金蝶AI套件公有云门禁20261026.xlsx ∪ 扫描规则_1026144356.xlsx（高危/严重）"
+    assert report["ruleSources"] == dcs_code_gate.CATALOG["sources"]
+    assert report["catalogueMerge"] == {"overlapCount": 313, "addedCount": 115}
+    assert report["coverage"] == {"cataloguedRuleCount": 1582, "scope": "source-text", "complete": False}
+    assert report["missing"] == report["scanErrors"] == report["emptySources"] == []
+
+    (tmp_path / "lib").mkdir()
+    (tmp_path / "lib" / "third.jar").write_bytes(b"PK")
+    (package / "Bad.java").write_text(_BAD, encoding="utf-8")
+    code, report = _cli("--source", str(tmp_path))
+    assert code == 2
+    assert report["status"] is False
+    assert {"CVE-KD-SCAN-jar", "CVE-KD-2026-0508"} <= _codes(report["findings"])
+    assert all(Path(item["file"]).name in {"Bad.java", "third.jar"} for item in report["findings"])
+
+
+def test_the_cli_fails_on_advisories_only_in_strict_mode_and_on_a_missing_path(tmp_path):
+    source = tmp_path / "cus" / "demo" / "Demo.java"
+    source.parent.mkdir(parents=True)
+    source.write_text(_plugin("    public int run() {\n        // int total = compute(1, 2);\n        return 1;\n    }"),
+                      encoding="utf-8")
+
+    code, report = _cli("--source", str(source))
+    assert code == 0 and report["advisoryCount"] == 1
+    code, report = _cli("--source", str(source), "--strict")
+    assert code == 2 and report["status"] is False
+    code, report = _cli("--source", str(tmp_path / "absent"))
+    assert code == 2 and report["missing"]
+
+
+@pytest.mark.parametrize("suffix", [".jar", ".class", ".so", ".dll", ".dylib", ".JAR"])
+def test_the_cli_rejects_a_binary_passed_directly(tmp_path, suffix):
+    source = tmp_path / f"dependency{suffix}"
+    source.write_bytes(b"binary")
+
+    code, report = _cli("--source", str(source))
+
+    assert code == 2 and report["status"] is False
+    assert report["emptySources"] == []
+    assert report["findingCount"] == 1
+    assert _codes(report["findings"]) == {
+        "CVE-KD-SCAN-jar" if suffix.lower() == ".jar" else "CVE-KD-SCAN-libFile"}
+    assert report["findings"][0]["file"] == str(source.resolve())
+
+
+@pytest.mark.parametrize("kind", ["empty", "unsupported", "build-only"])
+def test_the_cli_never_reports_unscanned_input_as_a_clean_module(tmp_path, kind):
+    source = tmp_path
+    if kind == "unsupported":
+        source = tmp_path / "notes.txt"
+        source.write_text("notes", encoding="utf-8")
+    if kind == "build-only":
+        (tmp_path / "build").mkdir()
+        (tmp_path / "build" / "Bad.java").write_text(_BAD, encoding="utf-8")
+
+    code, report = _cli("--source", str(source))
+
+    assert code == 2 and report["status"] is False
+    assert report["scannedFiles"] == report["findingCount"] == 0
+    assert report["emptySources"] == [str(source.resolve())]
+
+
+def test_the_cli_reports_read_errors_and_keeps_scanning_other_inputs(tmp_path, monkeypatch, capsys):
+    unreadable = tmp_path / "broken.sql"
+    readable = tmp_path / "valid.sql"
+    unreadable.write_bytes(b"create table t_broken (fid bigint);")
+    readable.write_bytes(b"create table t_demo (fid bigint);")
+    read_bytes = Path.read_bytes
+
+    def read(path):
+        if path == unreadable:
+            raise PermissionError("test read denied")
+        return read_bytes(path)
+
+    monkeypatch.setattr(Path, "read_bytes", read)
+    monkeypatch.setattr(sys, "argv", ["dcs_code_gate.py", "--source", str(unreadable), "--source", str(readable)])
+
+    assert dcs_code_gate.main() == 2
+    report = json.loads(capsys.readouterr().out)
+    assert report["status"] is False
+    assert report["scanErrors"] == [{"file": str(unreadable), "message": "test read denied"}]
+    assert report["scannedFiles"] == 1 and report["findingCount"] == 0
+
+
+@pytest.mark.parametrize("relative", [
+    "examples/java-rules/CosmicReportFilters.java",
+    "examples/java-rules/CosmicReportAggregation.java",
+])
+def test_report_helpers_remain_free_of_dcs_source_violations(relative):
+    path = SCRIPTS.parent / relative
+    issues = dcs_rule_issues(path.read_text(encoding="utf-8"))
+    # 独立 SDK 测试的默认包 helper 不是可直接交付的插件；只在这两个夹具中允许默认包。
+    assert not [issue for issue in issues if issue["ruleCodes"] != ["java:S1220"]]
+
+
+def test_catalogue_is_the_exact_union_and_preserves_original_lower_risks():
+    catalog = dcs_code_gate.CATALOG
+    original = {code for code, entry in catalog["rules"].items() if 0 in entry["sources"]}
+    selected = {code for code, entry in catalog["rules"].items() if 1 in entry["sources"]}
+    assert len(original) == 1467 and len(selected) == 428
+    assert len(original & selected) == 313 and len(selected - original) == 115
+    assert original | selected == catalog["rules"].keys()
+    for index, codes in enumerate((original, selected)):
+        assert hashlib.sha256("\n".join(sorted(codes)).encode()).hexdigest() == catalog["sources"][index]["codeSetSha256"]
+    assert all(entry["sourceRisks"][entry["sources"].index(1)] in {"高危", "严重"} for entry in catalog["rules"].values() if 1 in entry["sources"])
+    assert any(entry["risk"] == "低危" for entry in catalog["rules"].values())
+    assert any(entry["risk"] == "中危" for entry in catalog["rules"].values())
+    assert len(catalog["rules"]) == 1582
+    assert set(RULES) - catalog["rules"].keys() == {alias for alias in dcs_code_gate._FORTIFY_NAMES if alias.startswith("FORTIFY:")}
+    assert all(dcs_code_gate._FORTIFY_CODES.values())
+
+
+def test_shared_rule_codes_keep_the_stronger_risk_without_duplicate_registration():
+    for code, entry in dcs_code_gate.CATALOG["rules"].items():
+        assert RULES[code][0] == min(entry["sourceRisks"], key=dcs_code_gate._RISK_ORDER.__getitem__)
+    assert RULES["CVE-KD-2026-0508"][0] == "严重"
+    assert RULES["CVE-KD-0056-02"][0] == "高危"
+    assert RULES["CVE-KD-SQL-0015"][0] == "严重"
+    assert scan_sql(b"\xff")[0]["dcsRisk"] == "严重"
+
+
+_LOOP_CATALOG = [(code, entry["check"]["target"]) for code, entry in dcs_code_gate.CATALOG["rules"].items()
+                 if code.startswith("CVE-KD-0051-") and entry.get("check", {}).get("kind") == "循环里面指定方法"]
+
+
+@pytest.mark.parametrize("code,target", _LOOP_CATALOG)
+@pytest.mark.parametrize("receiver", ["simple", "qualified", "instance"])
+def test_every_added_loop_method_is_checked_with_its_real_rule_code(code, target, receiver):
+    owner, method = target.rsplit(".", 1)
+    simple = owner.rsplit(".", 1)[-1]
+    name = owner if receiver == "qualified" else "helper" if receiver == "instance" else simple
+    params = f"{simple} helper, " if receiver == "instance" else ""
+    source = _plugin(f"    public void run({params}List<Object> rows) {{\n"
+                     f"        for (Object row : rows) {{ {name}.{method}(row); }}\n    }}", f"import {owner};\nimport java.util.List;")
+    assert code in _codes(dcs_rule_issues(source))
+    outside = source.replace(f"for (Object row : rows) {{ {name}.{method}(row); }}", f"{name}.{method}(rows);")
+    assert code not in _codes(scan_source(outside))
+
+
+@pytest.mark.parametrize("code,call", [
+    ("CVE-KD-0059-2", "MetadataDao.getFormDeployFile(key)"),
+    ("CVE-KD-0059-3", "kd.bos.metadata.dao.MetadataDao.refreshMainEntityLName(key)"),
+])
+def test_additional_metadata_methods_are_rejected(code, call):
+    source = _plugin(f"public Object run(String key) {{ return {call}; }}")
+    assert code in _codes(dcs_rule_issues(source))
+
+
+@pytest.mark.parametrize("body,code", [
+    ('public Object run() { SecureRandom random = new SecureRandom(); random.setSeed(123L); return random; }', "java:S4347"),
+    ('public Boolean run() { return null; }', "java:S2447"),
+    ('protected void finalize() { work(); }', "java:S1113"),
+    ('public void run() { try { work(); } finally { throw new IllegalStateException(); } }', "java:S1163"),
+    ('public int run() { try { work(); } finally { return 1; } }', "java:S1143"),
+    ('public void run(Thread worker) { worker.notifyAll(); }', "java:S2236"),
+    ('public void run(java.sql.PreparedStatement stmt) { stmt.setString(0, "x"); }', "java:S2695"),
+    ('public Object run() { return new java.lang.ThreadGroup("worker"); }', "java:S3014"),
+    ('public void run() { System.runFinalizersOnExit(true); }', "java:S2151"),
+    ('public void run(HttpsURLConnection connection) { connection.setHostnameVerifier((host, session) -> true); }', "java:S5527"),
+    ('public String run() { return "/*dialect*/ select id from t_demo"; }', "CVE-KD-0060-1"),
+    ('public String run() { return "CREATE VIEW v_demo AS SELECT 1"; }', "CVE-KD-0720-1"),
+])
+def test_new_high_risk_source_patterns_block(body, code):
+    assert code in _codes(dcs_rule_issues(_plugin(body)))
+
+
+def test_certificate_and_hostname_verification_cannot_be_replaced_by_noops():
+    for interface, body, code in (
+        ("X509TrustManager", 'public void checkServerTrusted(X509Certificate[] chain, String authType) { /* deliberately empty */ }', "java:S4830"),
+        ("HostnameVerifier", 'public boolean verify(String host, SSLSession session) { return true; }', "java:S5527"),
+    ):
+        source = f"package cus.demo; public class Demo implements {interface} {{ {body} }}"
+        findings = [issue for issue in dcs_rule_issues(source) if code in issue["ruleCodes"]]
+        assert len(findings) == 1
+        assert findings[0]["relatedRuleCodes"]
+        safe = source.replace("/* deliberately empty */", "validate(chain, authType);").replace("return true;", "return defaultVerifier.verify(host, session);")
+        assert code not in _codes(scan_source(safe))
+
+
+def test_safe_seed_jdbc_and_monitor_operations_are_not_flagged():
+    source = _plugin('public Object run(byte[] seed, Object lock, ResultSet result) {\n'
+                     '    SecureRandom random = new SecureRandom(seed); random.setSeed(seed);\n'
+                     '    lock.notifyAll(); result.getString(1); return random;\n}')
+    assert not {"java:S4347", "java:S2236", "java:S2695"} & _codes(scan_source(source))
+
+
+@pytest.mark.parametrize("expression,name", [
+    ('Runtime.getRuntime().exec(command)', "Command Injection"),
+    ('new ProcessBuilder(command)', "Command Injection"),
+    ('engine.eval(command)', "Dynamic Code Evaluation: Script Injection"),
+    ('new java.net.URL(address)', "Server-Side Request Forgery"),
+    ('response.sendRedirect(address)', "Open Redirect"),
+    ('response.setHeader("Location", address)', "Header Manipulation"),
+    ('new java.io.File(address)', "Path Manipulation"),
+])
+def test_potential_injections_require_review_not_a_false_proven_block(expression, name):
+    source = _plugin(f"public Object run(String command, String address) {{ return {expression}; }}")
+    codes = {code for code, entry in dcs_code_gate.CATALOG["rules"].items() if entry["engine"] == "fortify" and entry["name"] == name}
+    assert codes & _codes(dcs_rule_warnings(source))
+    assert not codes & _codes(dcs_rule_issues(source))
+
+
+def test_resources_are_advisory_when_ownership_is_unknown_but_try_resources_are_valid():
+    source = _plugin('public int run(String file) { FileInputStream stream = new FileInputStream(file); return stream.read(); }')
+    assert {"java:S2093", "java:S2095"} <= _codes(dcs_rule_warnings(source))
+    assert "java:S2095" not in _codes(dcs_rule_issues(source))
+    safe = _plugin('public int run(String file) { try (FileInputStream first = new FileInputStream(file); FileInputStream second = new FileInputStream(file)) { return first.read() + second.read(); } }')
+    assert not {"java:S2093", "java:S2095", "java:S1481"} & _codes(scan_source(safe))
+
+
+def test_fortify_compatibility_aliases_link_to_real_spreadsheet_ids():
+    source = _plugin('private static final String PASSWORD = "secret";')
+    issue = next(issue for issue in scan_source(source) if "java:S2068" in issue["ruleCodes"])
+    assert issue["relatedRuleCodes"]
+    assert all(dcs_code_gate.CATALOG["rules"][code]["name"] == "Password Management: Hardcoded Password" for code in issue["relatedRuleCodes"])
+    assert "5FC849F9-EBBB-49C9-8F48-45368F98C83E-1" in issue["relatedRuleCodes"]
+
+
+@pytest.mark.parametrize("sql,code", [
+    ('INSERT INTO "t_demo" VALUES (1);', "CVE-KD-SQL-0017"),
+    ("DELETE t_demo WHERE fid=1;", "CVE-KD-SQL-0007"),
+    ("EXEC p_AlterColumn 't_demo', 'fid', 'NULL';", "CVE-KD-SQL-0008"),
+    ("EXEC p_modifyobjectname 't_demo', 't_new';", "CVE-KD-SQL-0010"),
+])
+def test_new_sql_rules_detect_statements_and_ignore_strings_comments(sql, code):
+    assert code in _codes(scan_sql(sql.encode()))
+    assert code not in _codes(scan_sql(("-- " + sql).encode()))
+    assert code not in _codes(scan_sql(("SELECT '" + sql.replace("'", "''") + "';").encode()))
+
+
+def test_sql_dialect_comments_preserve_offsets_and_are_contextual_advice():
+    sql = "/*dialect*/\nUPDATE t_demo SET fid=1;"
+    issues = scan_sql(sql.encode())
+    assert next(issue for issue in issues if issue["ruleCodes"] == ["CVE-KD-SQL-0006"])["line"] == 2
+    assert next(issue for issue in issues if issue["ruleCodes"] == ["CVE-KD-SQL-0016"])["level"] == "advise"
+    for text in ("SELECT '/*dialect*/';", 'CREATE TABLE "/*dialect*/" (fid int);', "/* documentation /*dialect*/ */"):
+        assert "CVE-KD-SQL-0016" not in _codes(scan_sql(text.encode()))
+    assert "CVE-KD-SQL-0017" not in _codes(scan_sql(b"INSERT INTO t_demo(fid) VALUES (1);"))
+
+
+def test_big_table_warnings_are_not_proven_violations_and_strict_cli_can_enforce_them(tmp_path):
+    sql = tmp_path / "changes.sql"
+    sql.write_text("CREATE INDEX idx ON t_demo(fid);\nALTER TABLE t_demo ADD COLUMN note varchar(100);\nALTER TABLE t_demo ALTER COLUMN note TYPE varchar(200);", encoding="utf-8")
+    code, report = _cli("--source", str(sql))
+    assert code == 0 and not report["findings"]
+    assert _codes(report["advisories"]) == {"CVE-KD-SQL-0011", "CVE-KD-SQL-0012", "CVE-KD-SQL-0013"}
+    assert _cli("--source", str(sql), "--strict")[0] == 2
+
+
+def test_duplicate_top_level_class_names_are_blocked_within_a_scanned_module(tmp_path):
+    for directory in ("src", "test"):
+        java = tmp_path / directory / "cus" / "demo" / "Demo.java"
+        java.parent.mkdir(parents=True)
+        java.write_text(_plugin('public String run() { return "ok"; }'), encoding="utf-8")
+    code, report = _cli("--source", str(tmp_path))
+    assert code == 2
+    conflicts = [issue for issue in report["findings"] if issue["ruleCodes"] == ["class_fully_qualified_name_conflict_internal"]]
+    assert len(conflicts) == 2
+
+
+@pytest.mark.parametrize("body", [
+    'public void run() { try { work(); } finally { Runnable job = () -> { return; }; use(job); } }',
+    'public void run() { try { work(); } finally { class Local { int value() { return 1; } } use(new Local()); } }',
+    'public void run() { try { work(); } finally { Runnable job = new Runnable() { public void run() { return; } }; use(job); } }',
+    'public void run() { try { work(); } finally { for (int i = 0; i < 2; i++) { if (i == 1) break; continue; } } }',
+    'public void run(int n) { try { work(); } finally { switch (n) { case 1: work(); break; default: work(); } } }',
+])
+def test_finally_does_not_confuse_nested_function_or_local_loop_jumps_with_escaping(body):
+    assert not {"java:S1143", "java:S1163", "FORTIFY:Return Inside Finally"} & _codes(scan_source(_plugin(body)))
+
+
+def test_a_caught_throw_in_finally_needs_review_instead_of_a_proven_block():
+    source = _plugin('public void run() { try { work(); } finally { try { throw new IllegalStateException(); } catch (IllegalStateException e) { recover(e); } } }')
+    assert "java:S1163" not in _codes(dcs_rule_issues(source))
+    assert "java:S1163" in _codes(dcs_rule_warnings(source))
+
+
+@pytest.mark.parametrize("body", [
+    'public void run(PreparedStatement stmt) { stmt.setFetchSize(0); stmt.setMaxRows(0); stmt.setQueryTimeout(0); }',
+    'public void run(ResultSet result) { result.setFetchSize(0); result.getString("id"); result.getString(1); }',
+])
+def test_jdbc_limits_and_named_columns_are_not_mistaken_for_invalid_indices(body):
+    assert "java:S2695" not in _codes(scan_source(_plugin(body)))
+
+
+@pytest.mark.parametrize("body", [
+    'public void run(ResultSet result) { result.getObject(0); }',
+    'public void run(CallableStatement stmt) { stmt.registerOutParameter(0, 12); }',
+])
+def test_jdbc_index_zero_is_invalid_for_columns_and_output_parameters(body):
+    assert "java:S2695" in _codes(dcs_rule_issues(_plugin(body)))
+
+
+def test_non_constant_seed_array_elements_are_not_proven_predictable():
+    source = _plugin('public Object run() { return new SecureRandom(new byte[]{entropy()}); }')
+    assert "java:S4347" not in _codes(scan_source(source))
+    for seed in ("new byte[16]", "new byte[]{1, 2, 3}"):
+        assert "java:S4347" in _codes(dcs_rule_issues(_plugin(f'public Object run() {{ return new SecureRandom({seed}); }}')))
+
+
+@pytest.mark.parametrize("body", [
+    'public void run(HttpsURLConnection connection) { connection.setHostnameVerifier((host, session) -> { return true; }); }',
+    'public void run() { javax.net.ssl.HttpsURLConnection.setDefaultHostnameVerifier((host, session) -> true); }',
+])
+def test_both_https_hostname_verifier_setters_reject_always_true_lambdas(body):
+    assert "java:S5527" in _codes(dcs_rule_issues(_plugin(body)))
+
+
+@pytest.mark.parametrize("body,blocked", [
+    ('public Boolean run() { class Local { Object value() { return null; } } use(new Local()); return Boolean.TRUE; }', False),
+    ('public Boolean run() { Supplier<Object> value = () -> { return null; }; use(value); return Boolean.TRUE; }', False),
+    ('public Boolean run() { Supplier<Object> value = new Supplier<Object>() { public Object get() { return null; } }; use(value); return Boolean.TRUE; }', False),
+    ('public Boolean run() { Supplier<Object> value = () -> { return null; }; use(value); return null; }', True),
+    ('public Boolean run() { class Local { Object value() { return null; } } use(new Local()); return null; }', True),
+])
+def test_boolean_null_returns_belong_to_the_declaring_function(body, blocked):
+    assert ("java:S2447" in _codes(dcs_rule_issues(_plugin(body)))) is blocked
+
+
+@pytest.mark.parametrize("shape", ["anonymous", "local"])
+@pytest.mark.parametrize("interface,body,code", [
+    ("javax.net.ssl.X509TrustManager", 'public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException { /* deliberately empty */ } public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException { validate(chain, authType); } public X509Certificate[] getAcceptedIssuers() { return issuers(); }', "java:S4830"),
+    ("javax.net.ssl.HostnameVerifier", 'public boolean verify(String host, SSLSession session) { return true; }', "java:S5527"),
+])
+def test_tls_verification_in_method_local_implementations_is_checked(shape, interface, body, code):
+    declaration = f"return new {interface}() {{ {body} }};" if shape == "anonymous" else f"class Local implements {interface} {{ {body} }} return new Local();"
+    source = _plugin(f"public Object run() {{ {declaration} }}")
+    findings = [issue for issue in dcs_rule_issues(source) if code in issue["ruleCodes"]]
+    assert len(findings) == 1
+    assert findings[0]["relatedRuleCodes"]
+    safe = source.replace("/* deliberately empty */", "validate(chain, authType);").replace("return true;", "return defaultVerifier.verify(host, session);")
+    assert code not in _codes(scan_source(safe))
+
+
+@pytest.mark.parametrize("body,blocked", [
+    ('public java.util.List<Object> run() { class Local { Object value() { return null; } } return java.util.Collections.singletonList(new Local()); }', False),
+    ('public Object[] run() { Supplier<Object> value = () -> { return null; }; return new Object[]{value}; }', False),
+    ('public java.util.List<Object> run() { Runnable task = () -> {}; task.run(); return null; }', True),
+    ('public Object[] run() { class Local { Object value() { return null; } } use(new Local()); return null; }', True),
+])
+def test_collection_null_returns_belong_to_the_declaring_function(body, blocked):
+    assert ("java:S1168" in _codes(dcs_rule_issues(_plugin(body)))) is blocked
+
+
+@pytest.mark.parametrize("body,blocked", [
+    ('public String jdbc(java.sql.ResultSet result) { return result.getString(1); } public String json(com.alibaba.fastjson.JSONArray result) { return result.getString(0); }', False),
+    ('public String jdbc(java.sql.ResultSet result) { return result.getString(0); } public String json(com.alibaba.fastjson.JSONArray result) { return result.getString(1); }', True),
+    ('public String jdbc() { ResultSet result = query(); return result.getString(1); } public String json() { JSONArray result = parse(); return result.getString(0); }', False),
+    ('public String run(boolean ready) { if (ready) { ResultSet result = query(); use(result.getString(1)); } JSONArray result = parse(); return result.getString(0); }', False),
+    ('private ResultSet result; public String run(JSONArray result) { return result.getString(0); }', False),
+    ('private ResultSet result; public String run(JSONArray result) { return this.result.getString(0); }', True),
+    ('public String run() { return result.getString(0); } private ResultSet result;', True),
+    ('private ResultSet result; public Object run(Stream<JSONArray> values) { return values.map(result -> result.getString(0)); }', False),
+    ('public Object run(Stream<ResultSet> values) { return values.map((ResultSet result) -> { return result.getString(0); }); }', True),
+    ('public void run() { ResultSet[] results = query(); use(results); } public String parse(JSONArray results) { return results.getString(0); }', False),
+])
+def test_jdbc_receiver_types_respect_lexical_bindings(body, blocked):
+    assert ("java:S2695" in _codes(dcs_rule_issues(_plugin(body)))) is blocked
+
+
+def test_thread_and_catalogue_receivers_do_not_leak_across_methods():
+    source = _plugin('public void threaded(Thread worker) { use(worker); } public void plain(Object worker) { worker.notifyAll(); } '
+                     'public void query(QueryServiceHelper helper) { use(helper); } public void render(Renderer helper, Object[] rows) { for (Object row : rows) { helper.query(row); } }')
+    assert not {"java:S2236", "CVE-KD-0051-62"} & _codes(dcs_rule_issues(source))
+
+
+@pytest.mark.parametrize("action", ["CASCADE", "SET NULL", "SET DEFAULT", "RESTRICT", "NO ACTION"])
+def test_foreign_key_delete_actions_are_not_delete_statements(action):
+    sql = f"CREATE TABLE t_child (fid bigint, parent_id bigint, FOREIGN KEY (parent_id) REFERENCES t_parent(fid) ON /* note */ DELETE\n{action});"
+    assert "CVE-KD-SQL-0007" not in _codes(scan_sql(sql.encode()))
+    real = sql + '\nDELETE t_child WHERE fid=1;\nDELETE FROM "t_child" WHERE fid=2;'
+    findings = [issue for issue in scan_sql(real.encode()) if "CVE-KD-SQL-0007" in issue["ruleCodes"]]
+    assert [issue["line"] for issue in findings] == [3, 4]
+
+
+def test_new_catalogue_and_documentation_are_available_in_the_executed_locale():
+    assert Path(dcs_code_gate.__file__).resolve().parent == SCRIPTS
+    catalog = json.loads((SCRIPTS / "dcs-rule-catalog.json").read_text(encoding="utf-8"))
+    assert catalog == dcs_code_gate.CATALOG
+    guide = (SCRIPTS.parent / "references" / "dcs-code-rules.md").read_text(encoding="utf-8")
+    for value in ("金蝶AI套件公有云门禁20261026.xlsx", "扫描规则_1026144356.xlsx", "1467", "428", "313", "115", "1582", "relatedRuleCodes", "CVE-KD-0051-14…67", "CVE-KD-SQL-0017", "java:S4347"):
+        assert value in guide