adl-toolkit 0.0.0-stage → 0.1.1

package/adl_drift/lang/java/cfg.py

@@ -0,0 +1,1424 @@
+"""Java CFG construction (P4.6, PROBLEMS.md).
+
+`JavaCFGBuilder` is `graph.cfg.CFGBuilderBase`'s Java counterpart to
+`lang/python/cfg.py::PythonCFGBuilder` — walks a `method_declaration`/
+`constructor_declaration`/`compact_constructor_declaration` CST node into
+basic blocks, reusing the shared `CFGBlock`/`CFGDef` bookkeeping and feeding
+the shared `ReachingDefinitions` fixpoint (`graph/cfg.py`) exactly like
+Python does.
+
+Minimum statement kinds (codegraph-java-deep-dive.md §10.2), all handled
+below: `local_variable_declaration`, `expression_statement`, `if_statement`,
+`for_statement`, `enhanced_for_statement`, `while_statement`, `do_statement`,
+`switch_expression`/`switch_statement`, `try_statement`,
+`try_with_resources_statement`, `catch_clause`, `finally_clause`,
+`synchronized_statement`, `return_statement`, `throw_statement`,
+`break_statement`, `continue_statement`, `lambda_expression`.
+
+Design notes:
+  - `return`/`throw` link to the function's synthetic exit block; `break`
+    targets the nearest enclosing loop or `switch`'s merge block (the
+    statement after it); `continue` targets the nearest enclosing loop's
+    condition re-check (a dedicated `update`-entry block for `for`, the
+    loop header for `while`/enhanced-`for`/`do`) — each threaded down as
+    `exit_b`/`break_target`/`continue_target` through every `_process_*`
+    helper, re-pointed at the right block by whichever compound statement
+    establishes it. None of these targets are always their "obvious"
+    block, though: a `try` with a `finally` (`_process_try`) substitutes
+    its own finally block(s) as the target for everything nested inside
+    its body/catch handlers, so an abrupt completion of any of the four
+    kinds still runs `finally` first — chaining correctly through
+    arbitrarily nested `try`/`finally` — before whatever it ultimately
+    reaches links onward to the real target.
+  - Labeled `break <label>;`/`continue <label>;` targeting an *enclosing
+    loop or switch* resolve to that specific statement's own targets, not
+    the nearest one — `labeled_statement` records `label -> (break_target,
+    continue_target)` into a `labels` map (also threaded through every
+    `_process_*` helper, and relayed through an intervening `try`/`finally`
+    exactly like `exit_b`/`break_target`/`continue_target` are) as soon as
+    it dispatches into the loop/switch it wraps. A label on any *other*
+    statement kind (`outer: if (...) { break outer; }` — legal Java, but
+    rare) is not supported: `label` is only threaded into the five
+    loop/switch handlers, so such a label is silently dropped and any
+    `break`/`continue` naming it falls back to the nearest enclosing
+    target, same as today.
+  - `switch`'s case/rule bodies are each treated as independently reachable
+    from the switch entry and merge into one successor block — the same
+    conservative "all handlers reachable, no attempt at precise fallthrough
+    edges" choice `PythonCFGBuilder._process_try` already makes for
+    `except`/`finally` clauses.
+  - A `lambda_expression` is an opaque leaf for def/use purposes (no
+    descent into its body), matching how `PythonCFGBuilder`/`_collect_uses`
+    already treats a nested `function_definition`/`lambda`/`class_definition`
+    as a value, not a control-flow site to analyze inline.
+"""
+
+from __future__ import annotations
+
+from typing import Dict, List, Literal, Optional, Tuple, Union
+
+from tree_sitter import Node
+
+from adl_drift.graph.cfg import CFGBlock, CFGBuilderBase, CFGDef, CFGUse, _node_pos, _text
+from adl_drift.lang.base import CFGConfig
+from adl_drift.lang.java import type_provenance as _tp
+from adl_drift.lang.java.scopes import TYPE_DECLARATIONS
+from adl_drift.lang.java.type_provenance import JavaTypeContext, Provenance, build_type_context
+
+__all__ = [
+    "TAINT_SOURCES",
+    "TAINT_SOURCE_METHODS",
+    "TAINT_SOURCE_PARAM_ANNOTATIONS",
+    "SINK_METHODS",
+    "SINK_METHOD_ARGUMENTS",
+    "SINK_CONSTRUCTORS",
+    "SINK_CONSTRUCTOR_ARGUMENTS",
+    "JavaCFGBuilder",
+    "default_java_cfg_config",
+]
+
+# ─── taint sources (codegraph-java-deep-dive.md §10.3) ────────────────────────
+
+# Exact dotted-callable text, prefix-matched against a def/argument's full RHS
+# text — same mechanism as Python's TAINT_SOURCES (lang/python/cfg.py).
+TAINT_SOURCES: Tuple[str, ...] = (
+    "System.getenv",
+    "System.getProperty",
+)
+
+# Owner FQN for each `TAINT_SOURCES` entry — a project can declare its own
+# top-level class named `System` in the same file/package, which *does*
+# shadow `java.lang.System`'s implicit import for unqualified references
+# within it (F-04, PROBLEMS.md P4.6); an exact dotted-text match alone can't
+# tell the two apart.
+TAINT_SOURCE_OWNERS: Dict[str, str] = {
+    "System.getenv": "java.lang.System",
+    "System.getProperty": "java.lang.System",
+}
+
+# Final call-target identifier (any receiver) -> source label. Receiver-agnostic
+# because an `HttpServletRequest`/JAX-RS `UriInfo` variable can be named
+# anything, unlike Python's conventionally-named `request` object.
+TAINT_SOURCE_METHODS: Dict[str, str] = {
+    "getParameter": "HttpServletRequest.getParameter",
+    "getHeader": "HttpServletRequest.getHeader",
+    "getQueryString": "HttpServletRequest.getQueryString",
+}
+
+# Expected declaring-type FQN(s) for each `TAINT_SOURCE_METHODS` entry (F-04,
+# PROBLEMS.md P4.6) — confirms the call's receiver is plausibly one of these
+# types (via `type_provenance`: declared-variable type + imports) before
+# trusting the simple-name match, so e.g. `Custom.getParameter()` on an
+# unrelated class isn't mistaken for `HttpServletRequest.getParameter`. A
+# method whose receiver can't be confirmed one way or the other (no `import`
+# to check against, or no declared type known for it) still matches — just
+# at a lower confidence (`_owner_provenance` returns `"ambiguous"`) rather
+# than being dropped, to keep recall on unresolved receivers.
+TAINT_SOURCE_METHOD_OWNERS: Dict[str, Tuple[str, ...]] = {
+    "getParameter": ("javax.servlet.http.HttpServletRequest", "jakarta.servlet.http.HttpServletRequest"),
+    "getHeader": ("javax.servlet.http.HttpServletRequest", "jakarta.servlet.http.HttpServletRequest"),
+    "getQueryString": (
+        "javax.servlet.http.HttpServletRequest", "jakarta.servlet.http.HttpServletRequest",
+        "javax.ws.rs.core.UriInfo", "jakarta.ws.rs.core.UriInfo",
+    ),
+}
+
+# Annotation simple name on a formal parameter -> source label. These mark a
+# parameter as tainted at function entry regardless of caller (Spring MVC /
+# JAX-RS request binding), unlike an ordinary parameter which only becomes
+# tainted via cross-function propagation.
+TAINT_SOURCE_PARAM_ANNOTATIONS: Dict[str, str] = {
+    "RequestParam": "@RequestParam",
+    "PathVariable": "@PathVariable",
+    "RequestBody": "@RequestBody",
+    "QueryParam": "@QueryParam",
+    "PathParam": "@PathParam",
+}
+
+# Expected FQN(s) for each `TAINT_SOURCE_PARAM_ANNOTATIONS` entry — same
+# provenance role as `TAINT_SOURCE_METHOD_OWNERS`, but for annotations: a
+# project-local `@interface RequestParam {}` (or an import of a *different*
+# `RequestParam`) must not be treated as Spring's.
+TAINT_SOURCE_PARAM_ANNOTATION_OWNERS: Dict[str, Tuple[str, ...]] = {
+    "RequestParam": ("org.springframework.web.bind.annotation.RequestParam",),
+    "PathVariable": ("org.springframework.web.bind.annotation.PathVariable",),
+    "RequestBody": ("org.springframework.web.bind.annotation.RequestBody",),
+    "QueryParam": ("javax.ws.rs.QueryParam", "jakarta.ws.rs.QueryParam"),
+    "PathParam": ("javax.ws.rs.PathParam", "jakarta.ws.rs.PathParam"),
+}
+
+# ─── taint sinks (codegraph-java-deep-dive.md §10.4 / PROBLEMS.md P4.6) ──────
+
+# Final call-target identifier (any receiver) -> vulnerability category.
+SINK_METHODS: Dict[str, str] = {
+    "executeQuery": "sql_injection",
+    "executeUpdate": "sql_injection",
+    "execute": "sql_injection",
+    "createNativeQuery": "sql_injection",
+    # `Connection.prepareStatement(sql)` is the actual injection point for the
+    # most common JDBC pattern (`PreparedStatement ps = conn.prepareStatement(
+    # taintedSql); ps.executeQuery();`) — that `executeQuery()` call itself
+    # takes no argument once parameterized, so without this entry the tainted
+    # SQL text passed to `prepareStatement` was never checked against any sink
+    # at all (regression fix, PROBLEMS.md P4.6). A tainted SQL *template* is
+    # still flagged; a bind value passed only through `setString`/`setInt`/...
+    # is not a sink argument and stays unflagged (§10.4's own "prepared
+    # statements are not automatically safe" callout, "bound parameter"-safe
+    # half is preserved unchanged since those setters aren't in this table).
+    "prepareStatement": "sql_injection",
+    "readObject": "unsafe_deserialization",
+    "eval": "code_injection",
+    "exec": "command_injection",
+    "command": "command_injection",
+    "invoke": "reflection_injection",
+    "forName": "reflection_injection",
+}
+
+# Expected declaring-type FQN(s) for each `SINK_METHODS` entry — same
+# provenance role as `TAINT_SOURCE_METHOD_OWNERS`, so a business method
+# named `execute`/`invoke`/`exec` on a project-owned class isn't mistaken
+# for the real JDK/framework sink.
+SINK_METHOD_OWNERS: Dict[str, Tuple[str, ...]] = {
+    "executeQuery": ("java.sql.Statement", "java.sql.PreparedStatement", "java.sql.CallableStatement"),
+    "executeUpdate": ("java.sql.Statement", "java.sql.PreparedStatement", "java.sql.CallableStatement"),
+    "execute": ("java.sql.Statement", "java.sql.PreparedStatement", "java.sql.CallableStatement"),
+    "createNativeQuery": ("jakarta.persistence.EntityManager", "javax.persistence.EntityManager"),
+    "prepareStatement": ("java.sql.Connection",),
+    "readObject": ("java.io.ObjectInputStream",),
+    "eval": ("javax.script.ScriptEngine",),
+    "exec": ("java.lang.Runtime",),
+    "command": ("java.lang.ProcessBuilder",),
+    "invoke": ("java.lang.reflect.Method",),
+    "forName": ("java.lang.Class",),
+}
+
+SinkArgumentPolicy = Union[Tuple[int, ...], Literal["all", "receiver"]]
+
+SINK_METHOD_ARGUMENTS: Dict[str, SinkArgumentPolicy] = {
+    "prepareStatement": (0,),
+    "createNativeQuery": (0,),
+    "executeQuery": (0,),
+    "executeUpdate": (0,),
+    "execute": (0,),
+    # `readObject()` takes no argument at all — the JDK API is
+    # `Object ObjectInputStream.readObject()` — so the attacker-controlled
+    # data is the *receiver* (the stream itself), not a positional argument.
+    # A positional-args policy ("all"/index tuple) always yields an empty
+    # list for this call shape, which `_sink_info` (lang/java/taint.py)
+    # then treats as "not a sink" and drops before taint is ever checked
+    # (PROBLEMS.md P4.6 F-01 regression) — "receiver" tells `_sink_args` to
+    # check the receiver expression for taint instead of any argument.
+    "readObject": "receiver",
+    "eval": (0,),
+    "exec": "all",
+    "command": "all",
+    "invoke": "all",
+    "forName": (0,),
+}
+
+SINK_METHOD_EXTERNAL_SUBTYPE_FALLBACKS: frozenset[str] = frozenset({
+    "prepareStatement",
+})
+
+# Constructed type simple name (`new X(...)`) -> category.
+SINK_CONSTRUCTORS: Dict[str, str] = {
+    "ProcessBuilder": "command_injection",
+}
+
+SINK_CONSTRUCTOR_OWNERS: Dict[str, Tuple[str, ...]] = {
+    "ProcessBuilder": ("java.lang.ProcessBuilder",),
+}
+
+SINK_CONSTRUCTOR_ARGUMENTS: Dict[str, SinkArgumentPolicy] = {
+    "ProcessBuilder": "all",
+}
+
+# ─── literal / structural node-type tables ────────────────────────────────────
+
+_LITERAL_TYPES: frozenset = frozenset({
+    "decimal_integer_literal", "hex_integer_literal", "octal_integer_literal",
+    "binary_integer_literal", "decimal_floating_point_literal",
+    "hex_floating_point_literal", "true", "false", "character_literal",
+    "string_literal", "null_literal", "text_block",
+})
+
+_TERMINATOR_TYPES: frozenset = frozenset({
+    "return_statement", "throw_statement", "break_statement", "continue_statement",
+})
+
+_SIMPLE_STMT_TYPES: frozenset = frozenset({
+    "import_declaration", "package_declaration", "empty_statement", "yield_statement",
+})
+
+_METHOD_TYPES = ("method_declaration", "constructor_declaration", "compact_constructor_declaration")
+
+_TYPE_DECL_TYPES = (
+    "class_declaration", "interface_declaration", "enum_declaration",
+    "record_declaration", "annotation_type_declaration",
+)
+
+
+# ─── helper functions (Java-CST-coupled) ──────────────────────────────────────
+
+def _real_children(node: Node) -> List[Node]:
+    """Non-extra, non-punctuation children of a `block`/`switch_block`-like node."""
+    return [c for c in node.children
+            if not c.is_extra and c.type not in ("{", "}", ";", ",")]
+
+
+def _body_stmts(node: Optional[Node]) -> List[Node]:
+    """Statement list for a compound-statement body, whether braced
+    (`block`) or a single braceless statement (`if (x) foo();` is legal
+    Java)."""
+    if node is None:
+        return []
+    if node.type == "block":
+        return _real_children(node)
+    return [node]
+
+
+def _fields(node: Node, field_name: str) -> List[Node]:
+    """Every child of `node` bound to `field_name` (`child_by_field_name`
+    only returns the first — `int a = 1, b = 2;` has two `declarator`
+    fields, `for (int i=0,j=0;;i++,j++)` has two `init`/`update` fields)."""
+    out: List[Node] = []
+    for i, child in enumerate(node.children):
+        if node.field_name_for_child(i) == field_name:
+            out.append(child)
+    return out
+
+
+def _first_named_child(node: Node) -> Optional[Node]:
+    for child in node.children:
+        if child.is_named:
+            return child
+    return None
+
+
+def _is_literal(node: Optional[Node]) -> bool:
+    """True when node represents a compile-time constant (Java literals)."""
+    if node is None:
+        return False
+    if node.type in _LITERAL_TYPES:
+        return True
+    if node.type == "unary_expression":
+        op = node.child_by_field_name("operator")
+        operand = node.child_by_field_name("operand")
+        if op is not None and op.type == "-" and operand is not None and operand.type in (
+            "decimal_integer_literal", "hex_integer_literal", "octal_integer_literal",
+            "binary_integer_literal", "decimal_floating_point_literal",
+            "hex_floating_point_literal",
+        ):
+            return True
+    if node.type == "parenthesized_expression" and node.child_count >= 3:
+        return _is_literal(node.children[1])
+    return False
+
+
+def _uses_of(node: Optional[Node]) -> List[CFGUse]:
+    out: List[CFGUse] = []
+    _collect_uses(node, out)
+    return out
+
+
+def _collect_uses(node: Optional[Node], uses: List[CFGUse], _visited: Optional[set] = None) -> None:
+    """Walk *node* and append identifier reads to *uses*.
+
+    Skips:
+      - Method/field names (`obj.method(...)`/`obj.field` — only `obj` and
+        the arguments are reads)
+      - Constructed type names (`new X(...)` — only the arguments are reads)
+      - Type positions (`(Foo) x` cast, `x instanceof Foo`, declared types)
+      - Annotations
+      - Lambda bodies (opaque, matching Python's nested-def treatment)
+    """
+    if node is None:
+        return
+    if _visited is None:
+        _visited = set()
+    nid = id(node)
+    if nid in _visited:
+        return
+    _visited.add(nid)
+
+    t = node.type
+
+    if t == "field_access":
+        obj = node.child_by_field_name("object")
+        _collect_uses(obj, uses, _visited)
+        return
+
+    if t == "method_invocation":
+        obj = node.child_by_field_name("object")
+        args = node.child_by_field_name("arguments")
+        _collect_uses(obj, uses, _visited)
+        _collect_uses(args, uses, _visited)
+        return
+
+    if t == "object_creation_expression":
+        args = node.child_by_field_name("arguments")
+        _collect_uses(args, uses, _visited)
+        return
+
+    if t == "cast_expression":
+        _collect_uses(node.child_by_field_name("value"), uses, _visited)
+        return
+
+    if t == "instanceof_expression":
+        _collect_uses(node.child_by_field_name("left"), uses, _visited)
+        return
+
+    if t in ("annotation", "marker_annotation"):
+        return
+
+    if t == "lambda_expression":
+        # Opaque value — don't descend, matching Python's lambda handling.
+        return
+
+    if t == "this":
+        return
+
+    if t == "identifier":
+        txt = _text(node, b"") if node.text is None else (
+            node.text.decode("utf-8", errors="replace")
+        )
+        if txt:
+            uses.append(CFGUse(txt, _node_pos(node)))
+        return
+
+    for child in node.children:
+        _collect_uses(child, uses, _visited)
+
+
+def _annotations_of(node: Node, source: bytes) -> List[Tuple[str, int]]:
+    """`[(raw_name_text, start_byte), ...]` for every annotation on a
+    `formal_parameter`/method/field's `modifiers` child. *raw_name_text*
+    keeps the full dotted path exactly as written (`@RequestParam` ->
+    `"RequestParam"`, `@org.springframework...RequestParam` -> the whole
+    FQN text) — trimming to a simple name here would throw away exactly
+    what `type_provenance.annotation_provenance` needs to tell a
+    fully-qualified annotation from a simple one that needs an `import` to
+    confirm (F-04, PROBLEMS.md P4.6)."""
+    modifiers = next((c for c in node.children if c.type == "modifiers"), None)
+    if modifiers is None:
+        return []
+    out: List[Tuple[str, int]] = []
+    for child in modifiers.children:
+        if child.type not in ("annotation", "marker_annotation"):
+            continue
+        name_node = child.child_by_field_name("name")
+        if name_node is not None:
+            out.append((_text(name_node, source).lstrip("@"), child.start_byte))
+    return out
+
+
+def _annotation_owner_verdict(
+    raw_name: str, at_byte: int, owners: Optional[Tuple[str, ...]], ctx: Optional[JavaTypeContext],
+) -> Provenance:
+    """`"confirmed"`/`"ambiguous"`/`"rejected"` for whether *raw_name* (an
+    annotation as written — possibly fully qualified) denotes one of
+    *owners*. No `owners` entry, or no `ctx` (no file-level import data
+    available), means "nothing to check against" -> `"ambiguous"` — the
+    caller should still treat it as a match, just at reduced confidence."""
+    if not owners or ctx is None:
+        return "ambiguous"
+    verdicts = [
+        _tp.annotation_provenance(raw_name, at_byte, ctx.imports, ctx.local_types, fqn)
+        for fqn in owners
+    ]
+    if any(v == "confirmed" for v in verdicts):
+        return "confirmed"
+    if all(v == "rejected" for v in verdicts):
+        return "rejected"
+    return "ambiguous"
+
+
+def _erased_type_name(type_text: str) -> str:
+    """Strip generic arguments/array brackets for a constructed-type match
+    (`new ProcessBuilder<>(...)`-shaped edge cases, generics on a raw type
+    are not legal Java for `new`, but this keeps the match robust to
+    whitespace/array suffixes)."""
+    text = type_text.strip()
+    idx = text.find("<")
+    if idx != -1:
+        text = text[:idx]
+    return text.strip()
+
+
+def _constructed_receiver_type(obj: Optional[Node], source: bytes) -> str:
+    """Simple type name of an inline `new X(...)` receiver
+    (`new ObjectInputStream(...).readObject()`), F-07 (PROBLEMS.md P4.6).
+    Such a receiver has no declared-variable type and its own text isn't
+    identifier-shaped (it's a whole constructor call, not a name), so
+    neither of `_receiver_type_candidates`' existing candidate paths ever
+    recognized it: `_owner_provenance` saw zero candidates and fell back to
+    `"ambiguous"` even when the constructed type is spelled right there in
+    the source and exactly matches the sink's expected owner — silently
+    downgrading a fully-confirmable sink to reduced confidence."""
+    if obj is None or obj.type != "object_creation_expression":
+        return ""
+    type_node = obj.child_by_field_name("type")
+    if type_node is None:
+        return ""
+    return _erased_type_name(_text(type_node, source))
+
+
+def _enclosing_type_name(node: Node, source: bytes) -> str:
+    """Simple name of the innermost type declaration lexically enclosing
+    *node* — the implicit `this` receiver for an *unqualified* call (no
+    `object` field at all: `getParameter("cmd")`, `executeQuery(q)`), F-08
+    (PROBLEMS.md P4.6). Such a call can only resolve to a method declared on
+    `this` or inherited by it, so the type to confirm against a sink/
+    source's expected owner is the enclosing class itself — not an absent
+    receiver, which previously gave `_receiver_type_candidates` zero
+    candidates and made `_owner_provenance` fall back to `"ambiguous"`
+    (still matched, just at reduced confidence) for *any* unqualified call,
+    including one to a plain, unrelated local method that merely happens to
+    share a sink/source method's simple name."""
+    parent = node.parent
+    while parent is not None:
+        if parent.type in TYPE_DECLARATIONS:
+            return _text(parent.child_by_field_name("name"), source)
+        parent = parent.parent
+    return ""
+
+
+def _receiver_type_candidates(
+    receiver: str, ctx: Optional[JavaTypeContext], at_byte: int,
+    constructed_type: str = "", enclosing_type: str = "",
+) -> Tuple[str, ...]:
+    """Type-name-shaped candidates for a call's receiver expression, for
+    `_owner_provenance`. A bare receiver *identifier* (`request`, `custom`)
+    with a known *declared* variable type uses that type as its candidate.
+
+    Two `Type.staticMethod()`-shaped exceptions, where the receiver text
+    itself already spells a type rather than naming a variable:
+      - `Runtime.getRuntime()` specifically (`security.py`'s own precedent).
+      - Any other bare identifier with *no* declared-variable type that
+        looks like a Java type name — starts uppercase, per the PascalCase-
+        types/camelCase-variables convention (`Custom.forName(...)`) — F-04,
+        PROBLEMS.md P4.6. `type_provenance` naturally rejects a candidate
+        that plainly isn't the expected simple name, so offering it
+        alongside a genuine declared-variable-type candidate is safe: at
+        most one of them can ever match a given owner.
+
+    A third exception, `constructed_type` (`_constructed_receiver_type`):
+    an inline `new X(...)` receiver's own constructed type name — F-07,
+    PROBLEMS.md P4.6.
+
+    A fourth, `enclosing_type` (`_enclosing_type_name`): the implicit `this`
+    for a call with no receiver at all — F-08, PROBLEMS.md P4.6. Unlike the
+    PascalCase-guess exception above, this is never a guess: the caller only
+    passes it once it has actually found the enclosing type declaration."""
+    candidates = []
+    declared = ""
+    if ctx is not None:
+        declared = _tp.declared_type_of(receiver, ctx.declared_types, at_byte)
+        if declared:
+            candidates.append(declared)
+    if constructed_type:
+        candidates.append(constructed_type)
+    if enclosing_type:
+        candidates.append(enclosing_type)
+    if receiver.endswith(".getRuntime()"):
+        candidates.append(receiver[: -len(".getRuntime()")])
+    elif not declared and receiver[:1].isupper() and receiver.isidentifier():
+        candidates.append(receiver)
+    return tuple(candidates)
+
+
+def _owner_name_signal(simple: str, owners: Tuple[str, ...]) -> bool:
+    """True when *simple* (an external, hierarchy-unknown candidate type's
+    own simple name) textually suggests one of *owners* — e.g.
+    `OracleConnection` for owner `java.sql.Connection` (owner simple name
+    `Connection`). Gates `_owner_provenance`'s external-subtype fallback:
+    an imported type is only a *plausible* undeclared vendor subtype when
+    its own name carries some signal toward the expected owner, not merely
+    because it happens to have been imported at all (PROBLEMS.md P4.6 —
+    2026-08-28 regression: `import com.example.QueryBuilder; ...
+    builder.prepareStatement(sql)` was flagged `sql_injection` purely
+    because `QueryBuilder` was an explicit import, with zero evidence it
+    has anything to do with `java.sql.Connection`)."""
+    simple_lower = simple.lower()
+    for owner in owners:
+        owner_simple = owner.rsplit(".", 1)[-1].lower()
+        if owner_simple and owner_simple in simple_lower:
+            return True
+    return False
+
+
+def _owner_provenance(
+    candidates: Tuple[str, ...], at_byte: int, owners: Optional[Tuple[str, ...]],
+    ctx: Optional[JavaTypeContext], *, allow_external_subtype_fallback: bool = False,
+) -> Provenance:
+    """`"confirmed"`/`"ambiguous"`/`"rejected"` for whether any of
+    *candidates* (a call's receiver text, its declared variable type, ...)
+    plausibly denotes one of *owners*. No `owners` entry for this call name,
+    or no `ctx`, means "nothing to check against" -> `"ambiguous"`."""
+    if not owners or ctx is None:
+        return "ambiguous"
+    verdicts = [
+        _tp.assignability_provenance(cand, ctx.imports, ctx.local_types, ctx.local_supertypes, fqn, at_byte)
+        for cand in candidates if cand
+        for fqn in owners
+    ]
+    if any(v == "confirmed" for v in verdicts):
+        return "confirmed"
+    if allow_external_subtype_fallback and verdicts and all(v == "rejected" for v in verdicts):
+        for cand in candidates:
+            simple = _tp.simple_type(cand)
+            if simple and not _tp.type_declared_at(ctx.local_types, simple, at_byte):
+                if _owner_name_signal(simple, owners) and any(
+                    imported.endswith(f".{simple}") for imported in ctx.imports
+                ):
+                    return "ambiguous"
+    if verdicts and all(v == "rejected" for v in verdicts):
+        return "rejected"
+    return "ambiguous"
+
+
+def _source_match_for(
+    node: Optional[Node], config: CFGConfig, source: bytes, ctx: Optional[JavaTypeContext] = None,
+) -> Optional[Tuple[str, bool]]:
+    """Find a taint-source invocation anywhere inside *node*, not just at its
+    root — descends through binary concatenation, parenthesized/ternary/cast
+    expressions, nested call receivers/arguments, and array-literal elements
+    so a source doesn't have to be the whole RHS to be recognized (`"sh -c "
+    + System.getenv("CMD")`, `wrap(System.getenv("D"))`, `cond ?
+    System.getenv("A") : "b"`, `new String[] { "sh", System.getenv("D") }`
+    — F-09, PROBLEMS.md P4.6 — ...).
+
+    Returns `(label, confirmed)`: `confirmed` is `True` when the receiver's
+    declared type was positively matched against `TAINT_SOURCE_METHOD_
+    OWNERS` (F-04, PROBLEMS.md P4.6) — e.g. `Custom.getParameter()` on a
+    class unrelated to `HttpServletRequest` is *not* returned at all (its
+    receiver type is confirmed to be something else), whereas a receiver
+    with no resolvable declared type still matches, just as `confirmed=
+    False`, to keep recall on an unresolved receiver. A dotted `TAINT_
+    SOURCES` entry (`System.getenv`) is matched against the call's own
+    `object.name` text exactly, not as a text prefix — `System.getenvFake(
+    ...)` must not match `System.getenv`."""
+    if node is None:
+        return None
+    t = node.type
+
+    if t == "method_invocation":
+        obj = node.child_by_field_name("object")
+        name_node = node.child_by_field_name("name")
+        if obj is not None and name_node is not None:
+            obj_text = _text(obj, source)
+            method_name = _text(name_node, source)
+            dotted = f"{obj_text}.{method_name}"
+            src_key = dotted if dotted in config.taint_sources else None
+            if src_key is None:
+                # Fully-qualified receiver (`java.lang.System.getenv(...)`),
+                # not just the short `System.getenv` form the dotted-text
+                # equality above catches — F-04 gap (PROBLEMS.md P4.6):
+                # `dotted` above never equals the short `TAINT_SOURCES` entry
+                # for an FQN call, so it fell through unmatched even though
+                # `_owner_provenance`/`type_provenance` already confirm an
+                # exact FQN receiver text on their own (`raw_type ==
+                # qualified_name` short-circuit). Only trusted when
+                # `obj_text` equals the *entire* owner FQN, not a suffix of
+                # it, so this can't be fooled by an unrelated `x.y.System`.
+                for cand_key in config.taint_sources:
+                    cand_method = cand_key.rsplit(".", 1)[-1]
+                    owner = TAINT_SOURCE_OWNERS.get(cand_key)
+                    if owner and method_name == cand_method and obj_text == owner:
+                        src_key = cand_key
+                        break
+            if src_key is not None:
+                owner = TAINT_SOURCE_OWNERS.get(src_key)
+                verdict = _owner_provenance(
+                    (obj_text,), node.start_byte, (owner,) if owner else None, ctx,
+                )
+                if verdict != "rejected":
+                    return src_key, verdict == "confirmed"
+        if name_node is not None:
+            method_name = _text(name_node, source)
+            label = config.taint_source_methods.get(method_name)
+            if label:
+                receiver = _text(obj, source) if obj is not None else ""
+                verdict = _owner_provenance(
+                    _receiver_type_candidates(
+                        receiver, ctx, node.start_byte, _constructed_receiver_type(obj, source),
+                        _enclosing_type_name(node, source) if obj is None else "",
+                    ),
+                    node.start_byte, TAINT_SOURCE_METHOD_OWNERS.get(method_name), ctx,
+                )
+                if verdict != "rejected":
+                    return label, verdict == "confirmed"
+        found = _source_match_for(obj, config, source, ctx)
+        if found:
+            return found
+        return _source_match_for(node.child_by_field_name("arguments"), config, source, ctx)
+
+    if t == "binary_expression":
+        return (
+            _source_match_for(node.child_by_field_name("left"), config, source, ctx)
+            or _source_match_for(node.child_by_field_name("right"), config, source, ctx)
+        )
+
+    if t == "ternary_expression":
+        return (
+            _source_match_for(node.child_by_field_name("consequence"), config, source, ctx)
+            or _source_match_for(node.child_by_field_name("alternative"), config, source, ctx)
+        )
+
+    if t == "parenthesized_expression":
+        return _source_match_for(_first_named_child(node), config, source, ctx)
+
+    if t == "cast_expression":
+        return _source_match_for(node.child_by_field_name("value"), config, source, ctx)
+
+    if t == "object_creation_expression":
+        # A source nested inside an inline `new X(...)` receiver/argument
+        # (`new ObjectInputStream(new FileInputStream(System.getenv("P")))`)
+        # was previously invisible (F-06, PROBLEMS.md P4.6): this function
+        # recursed into a call's `object`/`arguments` but had no branch for a
+        # constructor call at all, so it fell through to the catch-all
+        # `return None` below without ever inspecting the constructor's own
+        # arguments. Only matters when the source isn't already bound to a
+        # tainted variable first (the common case, `_ids_in`/the tainted-set
+        # walk, already covers that) — an inline constructed
+        # receiver/argument has no such binding to fall back on.
+        return _source_match_for(node.child_by_field_name("arguments"), config, source, ctx)
+
+    if t == "array_creation_expression":
+        # A source nested inside an inline array literal argument (`new
+        # ProcessBuilder(new String[] { "sh", "-c", System.getenv("CMD") })`)
+        # was previously invisible (F-09, PROBLEMS.md P4.6) for the same
+        # reason as F-06 above: no branch here for an array-creation node, so
+        # it fell through to `return None` without ever inspecting the
+        # array's elements.
+        return _source_match_for(node.child_by_field_name("value"), config, source, ctx)
+
+    if t in ("argument_list", "array_initializer"):
+        for child in node.children:
+            if child.is_named:
+                found = _source_match_for(child, config, source, ctx)
+                if found:
+                    return found
+        return None
+
+    if t == "switch_expression":
+        # A source nested inside a `switch` expression's arms (`switch (x) {
+        # case 1 -> System.getenv("Q"); default -> "static"; }`, Java 14+)
+        # was previously invisible (PROBLEMS.md P4.6) for the same reason as
+        # F-06/F-09 above: no branch here for `switch_expression`, so it fell
+        # through to `return None` without ever inspecting any arm's value.
+        body = node.child_by_field_name("body")
+        if body is None:
+            return None
+        for group in body.children:
+            if group.type not in ("switch_rule", "switch_block_statement_group"):
+                continue
+            for stmt in group.children:
+                if not stmt.is_named or stmt.type == "switch_label":
+                    continue
+                found = _switch_arm_match(stmt, config, source, ctx)
+                if found:
+                    return found
+        return None
+
+    return None
+
+
+def _switch_arm_match(
+    stmt: Node, config: CFGConfig, source: bytes, ctx: Optional[JavaTypeContext] = None,
+) -> Optional[Tuple[str, bool]]:
+    """The value a single `switch_rule`/`switch_block_statement_group`
+    statement contributes, if any — `expression_statement` (arrow form,
+    `case 1 -> System.getenv("Q");`) and `yield_statement` (block-arrow form
+    or classic `case 1: yield ...;` form) each wrap exactly the value
+    expression; a `block` arm is searched for its own `yield_statement`(s),
+    recursing through `if`/`try`/`synchronized` control structures that can
+    still contain one (`case 1 -> { if (cond) { yield System.getenv("Q"); }
+    yield "safe"; }` — a real false negative found in review: the taint
+    source here was previously invisible because this function stopped at
+    `if_statement`/`try_statement`/`synchronized_statement` instead of
+    looking inside them for a `yield`, and — contrary to what an earlier
+    version of this docstring claimed — `lang/java/taint.py`'s identifier
+    propagation does NOT independently discover a *new* source call nested
+    this way; it only propagates taint between identifiers already known to
+    be tainted). A `throw_statement` arm never completes the switch with a
+    value, so it's deliberately not recursed into — matching
+    `_source_match_for`'s own conservative-for-recall,
+    not-conservative-for-nonsense philosophy would mean flagging code paths
+    that can't actually produce the tainted value. A nested
+    `switch_expression`/`switch_statement` is also not descended into here:
+    a `yield` inside it resolves to that inner switch, not this one, so it's
+    left alone (its own value, if used, is picked up wherever it's actually
+    consumed by `_source_match_for`)."""
+    t = stmt.type
+    if t in ("expression_statement", "yield_statement"):
+        return _source_match_for(_first_named_child(stmt), config, source, ctx)
+    if t == "block":
+        for child in stmt.children:
+            if child.is_named:
+                found = _switch_arm_match(child, config, source, ctx)
+                if found:
+                    return found
+        return None
+    if t == "if_statement":
+        for field_name in ("consequence", "alternative"):
+            branch = stmt.child_by_field_name(field_name)
+            if branch is not None:
+                found = _switch_arm_match(branch, config, source, ctx)
+                if found:
+                    return found
+        return None
+    if t in ("try_statement", "try_with_resources_statement"):
+        body = stmt.child_by_field_name("body")
+        if body is not None:
+            found = _switch_arm_match(body, config, source, ctx)
+            if found:
+                return found
+        for child in stmt.children:
+            if child.type != "catch_clause":
+                continue
+            catch_body = child.child_by_field_name("body")
+            if catch_body is not None:
+                found = _switch_arm_match(catch_body, config, source, ctx)
+                if found:
+                    return found
+        return None
+    if t == "synchronized_statement":
+        body = stmt.child_by_field_name("body")
+        return _switch_arm_match(body, config, source, ctx) if body is not None else None
+    return None
+
+
+def _source_label_for(
+    node: Optional[Node], config: CFGConfig, source: bytes, ctx: Optional[JavaTypeContext] = None,
+) -> Optional[str]:
+    """Label-only convenience wrapper around `_source_match_for` for callers
+    that don't need the confirmed/ambiguous distinction."""
+    match = _source_match_for(node, config, source, ctx)
+    return match[0] if match else None
+
+
+def _collect_param_specs(
+    params_node: Optional[Node], source: bytes,
+) -> List[Tuple[str, List[Tuple[str, int]]]]:
+    """`[(param_name, [(raw_annotation_name, start_byte), ...]), ...]` for a
+    `formal_parameters` CST node (handles plain `formal_parameter` and
+    varargs `spread_parameter`)."""
+    if params_node is None:
+        return []
+    out: List[Tuple[str, List[Tuple[str, int]]]] = []
+    for child in params_node.children:
+        if child.type not in ("formal_parameter", "spread_parameter"):
+            continue
+        name_node = child.child_by_field_name("name")
+        if name_node is None:
+            continue
+        out.append((_text(name_node, source), _annotations_of(child, source)))
+    return out
+
+
+def _method_parameters(node: Node) -> Optional[Node]:
+    params = node.child_by_field_name("parameters")
+    if params is not None or node.type != "compact_constructor_declaration":
+        return params
+    record = node.parent.parent if node.parent is not None else None
+    if record is not None and record.type == "record_declaration":
+        return record.child_by_field_name("parameters")
+    return None
+
+
+# ─── CFG builder ──────────────────────────────────────────────────────────────
+
+class JavaCFGBuilder(CFGBuilderBase):
+    """Converts a method/constructor CST node into a basic-block CFG."""
+
+    def build(
+        self, func_node: Node, source: bytes
+    ) -> Tuple[int, int, Dict[int, CFGBlock], List[CFGDef]]:
+        self._reset()
+
+        # Per-compilation-unit import/declared-type provenance data (F-04,
+        # PROBLEMS.md P4.6) — computed once per `build()` call (once per
+        # method; this builder isn't on a hot per-file loop, see module
+        # docstring) and consulted by `_taint_of`/the annotation loop below
+        # to confirm a source/sink match's receiver or annotation actually
+        # denotes the real JDK/framework type, not a same-named local one.
+        root = func_node
+        while root.parent is not None:
+            root = root.parent
+        self._type_ctx = build_type_context(root, source)
+
+        entry = self._new_block()
+        exit_b = self._new_block()
+
+        params_node = _method_parameters(func_node)
+        for name, annotations in _collect_param_specs(params_node, source):
+            taint = None
+            for raw_name, at_byte in annotations:
+                simple = raw_name.rsplit(".", 1)[-1]
+                label = self.config.taint_source_param_annotations.get(simple)
+                if not label:
+                    continue
+                verdict = _annotation_owner_verdict(
+                    raw_name, at_byte,
+                    TAINT_SOURCE_PARAM_ANNOTATION_OWNERS.get(simple), self._type_ctx,
+                )
+                if verdict == "rejected":
+                    continue
+                taint = label
+                break
+            d = self._new_def(name, _node_pos(params_node), False, taint)
+            entry.events.append(d)
+
+        body = func_node.child_by_field_name("body")
+        if body is not None:
+            tail = self._process_stmts(_body_stmts(body), entry, exit_b, source)
+            if tail is not None:
+                self._link(tail, exit_b)
+        else:
+            self._link(entry, exit_b)
+
+        return entry.id, exit_b.id, self._blocks, self._all_defs
+
+    # ── taint helper ──────────────────────────────────────────────────────
+
+    def _taint_of(self, node: Optional[Node], source: bytes) -> Optional[str]:
+        return _source_label_for(node, self.config, source, self._type_ctx)
+
+    # ── statement dispatch ────────────────────────────────────────────────
+
+    def _process_stmts(
+        self, stmts: List[Node], cur: CFGBlock, exit_b: CFGBlock, source: bytes,
+        break_target: Optional[CFGBlock] = None, continue_target: Optional[CFGBlock] = None,
+        labels: Optional[Dict[str, Tuple[CFGBlock, CFGBlock]]] = None,
+    ) -> Optional[CFGBlock]:
+        for stmt in stmts:
+            if cur is None:
+                return None
+            cur = self._process_stmt(stmt, cur, exit_b, source, break_target, continue_target, labels)
+        return cur
+
+    def _process_stmt(
+        self, stmt: Node, cur: CFGBlock, exit_b: CFGBlock, source: bytes,
+        break_target: Optional[CFGBlock] = None, continue_target: Optional[CFGBlock] = None,
+        labels: Optional[Dict[str, Tuple[CFGBlock, CFGBlock]]] = None, label: Optional[str] = None,
+    ) -> Optional[CFGBlock]:
+        t = stmt.type
+
+        if t == "expression_statement":
+            real = [c for c in stmt.children if not c.is_extra and c.type != ";"]
+            if len(real) == 1:
+                return self._process_stmt(real[0], cur, exit_b, source, break_target, continue_target, labels)
+            cur.events.extend(_uses_of(stmt))
+            return cur
+
+        if t == "local_variable_declaration":
+            for decl in _fields(stmt, "declarator"):
+                name_node = decl.child_by_field_name("name")
+                value = decl.child_by_field_name("value")
+                if name_node is None:
+                    continue
+                is_lit = _is_literal(value)
+                taint = self._taint_of(value, source)
+                if value is not None:
+                    cur.events.extend(_uses_of(value))
+                cur.events.append(
+                    self._new_def(_text(name_node, source), _node_pos(name_node), is_lit, taint)
+                )
+            return cur
+
+        if t == "assignment_expression":
+            lhs = stmt.child_by_field_name("left")
+            op = stmt.child_by_field_name("operator")
+            rhs = stmt.child_by_field_name("right")
+            op_text = _text(op, source) if op is not None else "="
+            if rhs is not None:
+                cur.events.extend(_uses_of(rhs))
+            if lhs is not None and lhs.type == "identifier":
+                name = _text(lhs, source)
+                if op_text != "=":
+                    cur.events.append(CFGUse(name, _node_pos(lhs)))
+                is_lit = _is_literal(rhs) if op_text == "=" else False
+                taint = self._taint_of(rhs, source) if op_text == "=" else None
+                cur.events.append(self._new_def(name, _node_pos(lhs), is_lit, taint))
+            return cur
+
+        if t == "update_expression":
+            ident = next((c for c in stmt.children if c.type == "identifier"), None)
+            if ident is not None:
+                name = _text(ident, source)
+                cur.events.append(CFGUse(name, _node_pos(ident)))
+                cur.events.append(self._new_def(name, _node_pos(ident), False, None))
+            return cur
+
+        if t in ("return_statement", "throw_statement"):
+            expr = _first_named_child(stmt)
+            if expr is not None:
+                cur.events.extend(_uses_of(expr))
+            self._link(cur, exit_b)
+            return None
+
+        if t == "break_statement":
+            # A labeled `break <label>;` targets that specific loop/switch's
+            # own merge block (via `labels`, see module docstring), not
+            # necessarily the nearest one. Unlabeled falls back to
+            # `break_target`, and that falls back to `exit_b` only for
+            # malformed/unparseable code where no enclosing loop/switch was
+            # tracked (a bare `break` outside one is not valid Java).
+            label_node = next((c for c in stmt.children if c.type == "identifier"), None)
+            target = break_target
+            if label_node is not None and labels:
+                named = labels.get(_text(label_node, source))
+                if named is not None:
+                    target = named[0]
+            self._link(cur, target if target is not None else exit_b)
+            return None
+
+        if t == "continue_statement":
+            label_node = next((c for c in stmt.children if c.type == "identifier"), None)
+            target = continue_target
+            if label_node is not None and labels:
+                named = labels.get(_text(label_node, source))
+                if named is not None:
+                    target = named[1]
+            self._link(cur, target if target is not None else exit_b)
+            return None
+
+        if t == "assert_statement":
+            for child in stmt.children:
+                if child.is_named:
+                    cur.events.extend(_uses_of(child))
+            return cur
+
+        if t in _SIMPLE_STMT_TYPES:
+            cur.events.extend(_uses_of(stmt))
+            return cur
+
+        if t == "if_statement":
+            return self._process_if(stmt, cur, exit_b, source, break_target, continue_target, labels)
+
+        if t == "for_statement":
+            return self._process_for(stmt, cur, exit_b, source, break_target, continue_target, labels, label)
+
+        if t == "enhanced_for_statement":
+            return self._process_enhanced_for(
+                stmt, cur, exit_b, source, break_target, continue_target, labels, label
+            )
+
+        if t == "while_statement":
+            return self._process_while(stmt, cur, exit_b, source, break_target, continue_target, labels, label)
+
+        if t == "do_statement":
+            return self._process_do_while(stmt, cur, exit_b, source, break_target, continue_target, labels, label)
+
+        if t in ("switch_expression", "switch_statement"):
+            return self._process_switch(stmt, cur, exit_b, source, break_target, continue_target, labels, label)
+
+        if t in ("try_statement", "try_with_resources_statement"):
+            return self._process_try(stmt, cur, exit_b, source, break_target, continue_target, labels)
+
+        if t == "synchronized_statement":
+            return self._process_synchronized(stmt, cur, exit_b, source, break_target, continue_target, labels)
+
+        if t == "labeled_statement":
+            # Only threaded into the five loop/switch handlers above (via
+            # their own `label` parameter) — a label on any other statement
+            # kind is dropped; see module docstring.
+            label_node = next((c for c in stmt.children if c.type == "identifier"), None)
+            inner = next((c for c in reversed(stmt.children) if c.is_named), None)
+            if inner is not None:
+                label_text = _text(label_node, source) if label_node is not None else None
+                return self._process_stmt(
+                    inner, cur, exit_b, source, break_target, continue_target, labels, label_text
+                )
+            return cur
+
+        if t == "block":
+            return self._process_stmts(_real_children(stmt), cur, exit_b, source, break_target, continue_target, labels)
+
+        if t in _TYPE_DECL_TYPES:
+            # Local/nested type declaration — opaque, no defs/uses of its own.
+            return cur
+
+        # ── fallback: conservative — collect all identifiers as uses ──────
+        cur.events.extend(_uses_of(stmt))
+        return cur
+
+    # ── compound statement helpers ────────────────────────────────────────
+
+    def _process_if(
+        self, node: Node, cur: CFGBlock, exit_b: CFGBlock, source: bytes,
+        break_target: Optional[CFGBlock] = None, continue_target: Optional[CFGBlock] = None,
+        labels: Optional[Dict[str, Tuple[CFGBlock, CFGBlock]]] = None,
+    ) -> Optional[CFGBlock]:
+        cond = node.child_by_field_name("condition")
+        if cond is not None:
+            cur.events.extend(_uses_of(cond))
+
+        merge = self._new_block()
+
+        then_body = node.child_by_field_name("consequence")
+        if then_body is not None:
+            then_b = self._new_block()
+            self._link(cur, then_b)
+            tail = self._process_stmts(
+                _body_stmts(then_body), then_b, exit_b, source, break_target, continue_target, labels
+            )
+            if tail is not None:
+                self._link(tail, merge)
+        else:
+            self._link(cur, merge)
+
+        alt = node.child_by_field_name("alternative")
+        if alt is None:
+            self._link(cur, merge)
+        elif alt.type == "if_statement":
+            alt_b = self._new_block()
+            self._link(cur, alt_b)
+            tail = self._process_stmt(alt, alt_b, exit_b, source, break_target, continue_target, labels)
+            if tail is not None:
+                self._link(tail, merge)
+        else:
+            alt_b = self._new_block()
+            self._link(cur, alt_b)
+            tail = self._process_stmts(
+                _body_stmts(alt), alt_b, exit_b, source, break_target, continue_target, labels
+            )
+            if tail is not None:
+                self._link(tail, merge)
+
+        return merge
+
+    def _process_for(
+        self, node: Node, cur: CFGBlock, exit_b: CFGBlock, source: bytes,
+        break_target: Optional[CFGBlock] = None, continue_target: Optional[CFGBlock] = None,
+        labels: Optional[Dict[str, Tuple[CFGBlock, CFGBlock]]] = None, label: Optional[str] = None,
+    ) -> Optional[CFGBlock]:
+        # init runs once, unconditionally, before the header — not part of
+        # the loop body, so it keeps whatever break/continue target this
+        # `for` statement itself is nested in (irrelevant in valid Java: an
+        # `init` clause can't contain a bare `break`/`continue`).
+        for init in _fields(node, "init"):
+            cur = self._process_stmt(init, cur, exit_b, source, break_target, continue_target, labels)
+            if cur is None:
+                return None
+
+        header = self._new_block()
+        body_b = self._new_block()
+        # `continue`'s target is a dedicated block preceding the `update`
+        # clause (not the body's own tail block) — Java's `for`-loop
+        # `continue` runs `update` before the condition is re-checked, and
+        # a `continue` may fire before the body's tail is known (e.g. from
+        # inside a nested `if`).
+        update_b = self._new_block()
+        after = self._new_block()
+        self._link(cur, header)
+
+        cond = node.child_by_field_name("condition")
+        if cond is not None:
+            header.events.extend(_uses_of(cond))
+
+        self._link(header, body_b)
+        self._link(header, after)
+
+        # If this `for` is itself directly labeled (`outer: for (...) {}`),
+        # `break outer;`/`continue outer;` anywhere inside its body —
+        # including past a nested loop — must resolve to *this* loop's own
+        # targets, not whatever loop most closely encloses them.
+        body_labels = {**(labels or {}), label: (after, update_b)} if label else (labels or {})
+
+        body = node.child_by_field_name("body")
+        tail = self._process_stmts(_body_stmts(body), body_b, exit_b, source, after, update_b, body_labels)
+        if tail is not None:
+            self._link(tail, update_b)
+
+        upd_tail = update_b
+        for upd in _fields(node, "update"):
+            upd_tail = self._process_stmt(upd, upd_tail, exit_b, source, break_target, continue_target, labels)
+            if upd_tail is None:
+                break
+        if upd_tail is not None:
+            self._link(upd_tail, header)  # back-edge
+
+        return after
+
+    def _process_enhanced_for(
+        self, node: Node, cur: CFGBlock, exit_b: CFGBlock, source: bytes,
+        break_target: Optional[CFGBlock] = None, continue_target: Optional[CFGBlock] = None,
+        labels: Optional[Dict[str, Tuple[CFGBlock, CFGBlock]]] = None, label: Optional[str] = None,
+    ) -> Optional[CFGBlock]:
+        header = self._new_block()
+        body_b = self._new_block()
+        after = self._new_block()
+        self._link(cur, header)
+
+        value = node.child_by_field_name("value")
+        if value is not None:
+            header.events.extend(_uses_of(value))
+
+        name_node = node.child_by_field_name("name")
+        if name_node is not None:
+            taint = self._taint_of(value, source)
+            header.events.append(
+                self._new_def(_text(name_node, source), _node_pos(name_node), False, taint)
+            )
+
+        self._link(header, body_b)
+        self._link(header, after)
+
+        # `continue` re-fetches the next element — there's no `update`
+        # clause, so it targets the header directly.
+        body_labels = {**(labels or {}), label: (after, header)} if label else (labels or {})
+
+        body = node.child_by_field_name("body")
+        tail = self._process_stmts(_body_stmts(body), body_b, exit_b, source, after, header, body_labels)
+        if tail is not None:
+            self._link(tail, header)  # back-edge
+
+        return after
+
+    def _process_while(
+        self, node: Node, cur: CFGBlock, exit_b: CFGBlock, source: bytes,
+        break_target: Optional[CFGBlock] = None, continue_target: Optional[CFGBlock] = None,
+        labels: Optional[Dict[str, Tuple[CFGBlock, CFGBlock]]] = None, label: Optional[str] = None,
+    ) -> Optional[CFGBlock]:
+        header = self._new_block()
+        body_b = self._new_block()
+        after = self._new_block()
+        self._link(cur, header)
+
+        cond = node.child_by_field_name("condition")
+        if cond is not None:
+            header.events.extend(_uses_of(cond))
+
+        self._link(header, body_b)
+        self._link(header, after)
+
+        # `continue` jumps straight to the condition re-check.
+        body_labels = {**(labels or {}), label: (after, header)} if label else (labels or {})
+
+        body = node.child_by_field_name("body")
+        tail = self._process_stmts(_body_stmts(body), body_b, exit_b, source, after, header, body_labels)
+        if tail is not None:
+            self._link(tail, header)  # back-edge
+
+        return after
+
+    def _process_do_while(
+        self, node: Node, cur: CFGBlock, exit_b: CFGBlock, source: bytes,
+        break_target: Optional[CFGBlock] = None, continue_target: Optional[CFGBlock] = None,
+        labels: Optional[Dict[str, Tuple[CFGBlock, CFGBlock]]] = None, label: Optional[str] = None,
+    ) -> Optional[CFGBlock]:
+        body_b = self._new_block()
+        header = self._new_block()
+        after = self._new_block()
+        self._link(cur, body_b)  # body always runs at least once
+
+        # `continue` in a `do`-loop still goes to the condition check
+        # (`header`), which here comes *after* the body syntactically.
+        body_labels = {**(labels or {}), label: (after, header)} if label else (labels or {})
+
+        body = node.child_by_field_name("body")
+        tail = self._process_stmts(_body_stmts(body), body_b, exit_b, source, after, header, body_labels)
+        if tail is not None:
+            self._link(tail, header)
+
+        cond = node.child_by_field_name("condition")
+        if cond is not None:
+            header.events.extend(_uses_of(cond))
+
+        self._link(header, body_b)  # back-edge
+        self._link(header, after)
+
+        return after
+
+    def _process_switch(
+        self, node: Node, cur: CFGBlock, exit_b: CFGBlock, source: bytes,
+        break_target: Optional[CFGBlock] = None, continue_target: Optional[CFGBlock] = None,
+        labels: Optional[Dict[str, Tuple[CFGBlock, CFGBlock]]] = None, label: Optional[str] = None,
+    ) -> Optional[CFGBlock]:
+        cond = node.child_by_field_name("condition")
+        if cond is not None:
+            cur.events.extend(_uses_of(cond))
+
+        merge = self._new_block()
+        switch_body = node.child_by_field_name("body")
+        groups: List[Node] = []
+        if switch_body is not None:
+            groups = [c for c in switch_body.children
+                      if c.type in ("switch_block_statement_group", "switch_rule")]
+
+        # Conservative fallback: no case (including `default`, if present) is
+        # guaranteed to execute from a static analysis's point of view, so a
+        # pre-switch def must still be considered reaching the merge block —
+        # same "extra reachable pair is safe, a missed one is not" philosophy
+        # `PythonCFGBuilder._process_if`'s no-else fallthrough edge follows.
+        self._link(cur, merge)
+
+        # `break` inside a case targets this switch's own merge block (the
+        # statement after the switch) — a plain, unlabeled `continue`,
+        # though, isn't caught by the switch at all; it still refers to
+        # whatever loop lexically encloses the switch, so `continue_target`
+        # passes through unchanged. If this switch is itself labeled
+        # (`outer: switch (...) {}`), `break outer;`/`continue outer;` from
+        # deeper inside must resolve to *this* switch's targets specifically.
+        body_labels = {**(labels or {}), label: (merge, continue_target)} if label else (labels or {})
+
+        for group in groups:
+            group_b = self._new_block()
+            self._link(cur, group_b)  # conservative: every case reachable
+            stmts = [c for c in group.children
+                     if c.is_named and c.type != "switch_label"]
+            tail = self._process_stmts(stmts, group_b, exit_b, source, merge, continue_target, body_labels)
+            if tail is not None:
+                self._link(tail, merge)
+
+        return merge
+
+    def _process_try(
+        self, node: Node, cur: CFGBlock, exit_b: CFGBlock, source: bytes,
+        break_target: Optional[CFGBlock] = None, continue_target: Optional[CFGBlock] = None,
+        labels: Optional[Dict[str, Tuple[CFGBlock, CFGBlock]]] = None,
+    ) -> Optional[CFGBlock]:
+        merge = self._new_block()
+
+        finally_clause = next((c for c in node.children if c.type == "finally_clause"), None)
+        fin_body = None
+        if finally_clause is not None:
+            fin_body = next((c for c in finally_clause.children if c.type == "block"), None)
+
+        # An active `finally` intercepts every abrupt completion (`return`,
+        # `throw`, `break`, `continue`) from the try body and catch handlers
+        # before it actually reaches whichever target that completion was
+        # headed for (function exit, an enclosing loop/switch's break point,
+        # an enclosing loop's continue point). Each distinct target that's
+        # actually active here gets its own copy of the finally body — the
+        # continuations differ (chasing `exit_b` vs. `break_target` vs.
+        # `continue_target`), and this also chains correctly through
+        # arbitrarily nested `try`/`finally`, since a target this method
+        # itself received may already be *another* enclosing try's own
+        # relay block. A `return`/`break`/`continue` written directly inside
+        # the finally body itself is unaffected — it still resolves against
+        # this try's own `exit_b`/`break_target`/`continue_target`, per
+        # normal lexical scoping, not the relayed one.
+        def _relay(target: Optional[CFGBlock]) -> Optional[CFGBlock]:
+            if target is None or fin_body is None:
+                return target
+            relay_b = self._new_block()
+            tail = self._process_stmts(
+                _real_children(fin_body), relay_b, exit_b, source, break_target, continue_target, labels
+            )
+            if tail is not None:
+                self._link(tail, target)
+            return relay_b
+
+        abrupt_exit = _relay(exit_b)
+        abrupt_break = _relay(break_target)
+        abrupt_continue = _relay(continue_target)
+        # A labeled break/continue escaping this try must run `finally`
+        # too, same as the unlabeled/exit cases above — relay every active
+        # label's own (break, continue) target pair the same way.
+        abrupt_labels = (
+            {name: (_relay(brk), _relay(cont)) for name, (brk, cont) in labels.items()}
+            if labels else labels
+        )
+
+        pre = cur
+        resources = node.child_by_field_name("resources")
+        if resources is not None:
+            res_b = self._new_block()
+            self._link(cur, res_b)
+            for res in resources.children:
+                if res.type != "resource":
+                    continue
+                name_node = res.child_by_field_name("name")
+                value = res.child_by_field_name("value")
+                if value is not None:
+                    res_b.events.extend(_uses_of(value))
+                if name_node is not None:
+                    taint = self._taint_of(value, source)
+                    res_b.events.append(
+                        self._new_def(_text(name_node, source), _node_pos(name_node), False, taint)
+                    )
+            pre = res_b
+
+        body = node.child_by_field_name("body")
+        if body is not None:
+            try_b = self._new_block()
+            self._link(pre, try_b)
+            tail = self._process_stmts(
+                _real_children(body), try_b, abrupt_exit, source, abrupt_break, abrupt_continue, abrupt_labels
+            )
+            if tail is not None:
+                self._link(tail, merge)
+        else:
+            self._link(pre, merge)
+
+        for child in node.children:
+            if child.type != "catch_clause":
+                continue
+            exc_b = self._new_block()
+            self._link(pre, exc_b)  # conservative: reachable from try entry
+            param = next(
+                (c for c in child.children if c.type == "catch_formal_parameter"), None
+            )
+            if param is not None:
+                name_node = param.child_by_field_name("name")
+                if name_node is not None:
+                    exc_b.events.append(
+                        self._new_def(_text(name_node, source), _node_pos(name_node), False, None)
+                    )
+            exc_body = child.child_by_field_name("body")
+            if exc_body is not None:
+                tail = self._process_stmts(
+                    _real_children(exc_body), exc_b, abrupt_exit, source, abrupt_break, abrupt_continue,
+                    abrupt_labels,
+                )
+                if tail is not None:
+                    self._link(tail, merge)
+            else:
+                self._link(exc_b, merge)
+
+        if fin_body is not None:
+            fin_b = self._new_block()
+            self._link(merge, fin_b)
+            tail = self._process_stmts(
+                _real_children(fin_body), fin_b, exit_b, source, break_target, continue_target, labels
+            )
+            if tail is not None:
+                merge = tail
+
+        return merge
+
+    def _process_synchronized(
+        self, node: Node, cur: CFGBlock, exit_b: CFGBlock, source: bytes,
+        break_target: Optional[CFGBlock] = None, continue_target: Optional[CFGBlock] = None,
+        labels: Optional[Dict[str, Tuple[CFGBlock, CFGBlock]]] = None,
+    ) -> Optional[CFGBlock]:
+        lock = next((c for c in node.children if c.type == "parenthesized_expression"), None)
+        if lock is not None:
+            cur.events.extend(_uses_of(lock))
+        body = node.child_by_field_name("body")
+        return self._process_stmts(_body_stmts(body), cur, exit_b, source, break_target, continue_target, labels)
+
+
+def default_java_cfg_config() -> CFGConfig:
+    """The real Java `CFGConfig` — returned by `JavaBackend.cfg_config()`."""
+    from adl_drift.lang.java.taint import default_java_taint_strategy
+
+    return CFGConfig(
+        taint_sources=TAINT_SOURCES,
+        taint_source_methods=dict(TAINT_SOURCE_METHODS),
+        taint_source_param_annotations=dict(TAINT_SOURCE_PARAM_ANNOTATIONS),
+        sink_methods=dict(SINK_METHODS),
+        sink_constructors=dict(SINK_CONSTRUCTORS),
+        cfg_builder_factory=lambda config: JavaCFGBuilder(config),
+        taint_strategy_factory=lambda config: default_java_taint_strategy(config),
+    )
+
+
+def analyze_function(func_node: Node, source: bytes, function_id: str):
+    """Convenience wrapper mirroring `graph.cfg.analyze_function`, pinned to
+    Java's `CFGConfig` — used directly by Java CFG unit tests."""
+    from adl_drift.graph.cfg import analyze_function as _analyze_function
+    return _analyze_function(func_node, source, function_id, default_java_cfg_config())