adl-toolkit 0.0.0-stage → 0.1.1

package/adl_drift/detectors/security.py

@@ -0,0 +1,236 @@
+"""Security pattern detector — high-signal single-file checks.
+
+Flags eval/exec/compile, subprocess shell=True, unsafe pickle/yaml,
+os.system/popen, hardcoded secrets, and asserts in non-test code.
+
+P2.18 integration: when def-use facts are available (passed in via
+``def_use_facts`` on the detector instance), dangerous-builtin findings
+are upgraded to CRITICAL (taint-confirmed) or downgraded to LOW (literal-
+only arguments).  Facts are populated by the scan pipeline after the
+CFG+reaching-defs pass.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+from typing import Any, Dict, List, Optional
+
+from tree_sitter import Node, Tree
+
+from adl_drift.detectors.base import BaseDetector
+from adl_drift.utils.types import Pattern, PatternCategory
+
+
+SECRET_RE = re.compile(
+    r"(?i)(api[_-]?key|secret|token|password|passwd|pwd)\s*=\s*['\"]([^'\"]{8,})['\"]"
+)
+
+
+class SecurityDetector(BaseDetector):
+    """Detects high-confidence security anti-patterns in a single file."""
+
+    DANGEROUS_BUILTINS = {"eval", "exec", "compile"}
+    OS_SHELL = {"os.system", "os.popen"}
+    SUBPROCESS = {"subprocess.call", "subprocess.run", "subprocess.Popen",
+                  "subprocess.check_call", "subprocess.check_output"}
+    PICKLE_LOADS = {"pickle.load", "pickle.loads", "cPickle.load", "cPickle.loads"}
+
+    def __init__(self, parser: Any) -> None:
+        super().__init__(parser)
+        # P2.18: populated by scan pipeline after CFG pass.
+        # Maps function_id → {binding_name → List[DefUseFact]}.
+        self.def_use_facts: Dict[str, Dict[str, List[Any]]] = {}
+
+    @property
+    def category(self) -> PatternCategory:
+        return PatternCategory.SECURITY
+
+    def detect(self, tree: Tree, source_bytes: bytes, file_path: Path) -> List[Pattern]:
+        patterns: List[Pattern] = []
+        is_test_file = self._is_test_file(file_path)
+
+        for node in self._walk(tree.root_node):
+            if node.type == "call":
+                patterns.extend(self._check_call(node, source_bytes, file_path))
+            elif node.type == "assert_statement" and not is_test_file:
+                patterns.append(self._make_pattern(
+                    name="assert_in_prod",
+                    description="assert in non-test code (stripped under -O)",
+                    node=node, file_path=file_path, confidence=0.3,
+                    metadata={"severity": "LOW"},
+                ))
+
+        # Hardcoded secrets — regex over source text
+        try:
+            text = source_bytes.decode("utf-8", errors="replace")
+        except Exception:
+            text = ""
+        for m in SECRET_RE.finditer(text):
+            line = text.count("\n", 0, m.start()) + 1
+            patterns.append(Pattern(
+                category=self.category,
+                name="hardcoded_secret",
+                description=f"Possible hardcoded secret: {m.group(1)}",
+                position=self._line_position(line),
+                file_path=file_path,
+                confidence=0.6,
+                metadata={"severity": "MEDIUM", "key_name": m.group(1)},
+            ))
+
+        return patterns
+
+    def _check_call(self, node: Node, source: bytes, file_path: Path) -> List[Pattern]:
+        out: List[Pattern] = []
+        func_node = node.child_by_field_name("function")
+        if func_node is None:
+            return out
+        func_text = self.parser.node_text(func_node, source).strip()
+
+        if func_text in self.DANGEROUS_BUILTINS:
+            severity, confidence, extra = self._refine_dangerous_builtin(
+                func_text, node, source
+            )
+            out.append(self._make_pattern(
+                name=f"dangerous_{func_text}",
+                description=f"{func_text}() executes arbitrary code",
+                node=node, file_path=file_path, confidence=confidence,
+                metadata={"severity": severity, "function": func_text, **extra},
+            ))
+            return out
+
+        if func_text in self.OS_SHELL:
+            out.append(self._make_pattern(
+                name="os_shell",
+                description=f"{func_text}() runs a shell command",
+                node=node, file_path=file_path, confidence=0.9,
+                metadata={"severity": "HIGH", "function": func_text},
+            ))
+            return out
+
+        if func_text in self.SUBPROCESS:
+            if self._has_shell_true(node, source):
+                out.append(self._make_pattern(
+                    name="subprocess_shell_true",
+                    description=f"{func_text}(shell=True) shell-injection risk",
+                    node=node, file_path=file_path, confidence=0.9,
+                    metadata={"severity": "HIGH", "function": func_text},
+                ))
+            return out
+
+        if func_text in self.PICKLE_LOADS:
+            out.append(self._make_pattern(
+                name="unsafe_pickle",
+                description=f"{func_text}() deserializes arbitrary code",
+                node=node, file_path=file_path, confidence=0.85,
+                metadata={"severity": "HIGH", "function": func_text},
+            ))
+            return out
+
+        if func_text in {"yaml.load"} and not self._has_safe_loader(node, source):
+            out.append(self._make_pattern(
+                name="unsafe_yaml_load",
+                description="yaml.load() without SafeLoader",
+                node=node, file_path=file_path, confidence=0.85,
+                metadata={"severity": "HIGH", "function": func_text},
+            ))
+
+        return out
+
+    def _refine_dangerous_builtin(
+        self, func_text: str, call_node: Node, source: bytes
+    ):
+        """P2.18: use def-use facts to refine severity for eval/exec/compile.
+
+        Returns (severity, confidence, extra_metadata).
+
+        Rules:
+          - Argument is a literal node directly → LOW (no data-flow needed)
+          - Argument is an identifier AND all reaching defs are literals
+            → LOW ("always_literal" in metadata)
+          - Argument is an identifier AND any reaching def is tainted
+            → CRITICAL ("taint_source" in metadata, highest priority)
+          - Otherwise → HIGH (default, no facts or mixed/unknown defs)
+        """
+        from adl_drift.graph.cfg import _is_literal as cfg_is_literal
+
+        args = call_node.child_by_field_name("arguments")
+        first_arg = None
+        if args:
+            for child in args.children:
+                if child.type not in ("(", ")", ",", "comment"):
+                    first_arg = child
+                    break
+
+        # Direct literal argument — no data-flow needed
+        if first_arg is not None and cfg_is_literal(first_arg):
+            return "LOW", 0.5, {"data_flow": "literal_arg"}
+
+        # Identifier argument — look up def-use facts
+        if first_arg is not None and first_arg.type == "identifier" and self.def_use_facts:
+            arg_name = (
+                first_arg.text.decode("utf-8", errors="replace")
+                if first_arg.text else ""
+            )
+            if arg_name:
+                enclosing_fid = self._find_enclosing_function_id(call_node)
+                facts_by_func = self.def_use_facts.get(enclosing_fid, {})
+                arg_facts = facts_by_func.get(arg_name, [])
+                if arg_facts:
+                    tainted = [f for f in arg_facts if f.taint_source]
+                    all_literal = all(f.is_literal for f in arg_facts)
+                    if tainted:
+                        return "CRITICAL", 0.95, {
+                            "data_flow": "taint_confirmed",
+                            "taint_source": tainted[0].taint_source,
+                        }
+                    if all_literal:
+                        return "LOW", 0.5, {"data_flow": "always_literal"}
+
+        return "HIGH", 0.9, {}
+
+    def _find_enclosing_function_id(self, node: Node) -> str:
+        """Walk up the CST to find the enclosing function's name (best effort)."""
+        cur = node.parent
+        parts: List[str] = []
+        while cur is not None:
+            if cur.type in ("function_definition", "async_function_definition"):
+                name_node = cur.child_by_field_name("name")
+                if name_node and name_node.text:
+                    parts.append(name_node.text.decode("utf-8", errors="replace"))
+            cur = cur.parent
+        parts.reverse()
+        return ".".join(parts) if parts else "<module>"
+
+    def _has_shell_true(self, call_node: Node, source: bytes) -> bool:
+        args = call_node.child_by_field_name("arguments")
+        if args is None:
+            return False
+        for child in args.children:
+            if child.type == "keyword_argument":
+                name_node = child.child_by_field_name("name")
+                val_node = child.child_by_field_name("value")
+                if name_node is not None and val_node is not None:
+                    if self.parser.node_text(name_node, source) == "shell" and \
+                       self.parser.node_text(val_node, source) == "True":
+                        return True
+        return False
+
+    def _has_safe_loader(self, call_node: Node, source: bytes) -> bool:
+        text = self.parser.node_text(call_node, source)
+        return "SafeLoader" in text or "safe_load" in text
+
+    @staticmethod
+    def _is_test_file(file_path: Path) -> bool:
+        n = file_path.name
+        return n.startswith("test_") or n.endswith("_test.py") or "tests" in file_path.parts
+
+    @staticmethod
+    def _line_position(line: int):
+        from adl_drift.utils.types import SourcePosition
+        return SourcePosition(line=line, column=0, end_line=line, end_column=0)
+
+    def _walk(self, node: Node):
+        yield node
+        for child in node.children:
+            yield from self._walk(child)

package/adl_drift/detectors/taint.py

@@ -0,0 +1,406 @@
+"""Taint analysis — source→sink tracking (P2.19, generalized to a
+per-language seam in P4.6 — see PROBLEMS.md P4.6).
+
+Two layers:
+
+  - **Intra-function** (`TaintStrategy.analyze_one`, per language — Python's
+    is `lang/python/taint.py::PythonTaintStrategy`, Java's is `lang/java/
+    taint.py::JavaTaintStrategy`): flow-insensitive taint propagation over
+    one function body, driven by the source/sink tables on a `CFGConfig`
+    (`lang/base.py`). A binding is tainted if it is assigned (directly or
+    transitively) from a known taint source or from another tainted
+    binding. When a tainted binding reaches a sink call-site argument → a
+    `TaintPath` is emitted. This is the CST-coupled "mechanics" half —
+    mirrors how P4.4 split `CallResolver` out of the shared resolution
+    driver.
+
+  - **Cross-function** (`TaintAnalyzer.analyze`): a worklist fixpoint over
+    the call graph, fully language-agnostic — it never inspects a CST node,
+    only `TaintStrategy.analyze_one`'s `(tainted, TaintPath, _OutCall)`
+    results. When a function passes a tainted argument to a callee, the
+    callee's matching parameter becomes a taint entry; the callee is
+    re-analyzed with that seed. Callees are resolved by simple name against
+    the function index (so it follows calls across modules), over-approximating
+    on ambiguity — taint recall is best-effort by design.
+
+Identity (P1.10 boundary rule): taint state is keyed by binding *name* scoped to
+the enclosing function id, never by a global dotted name — the data-flow layer
+stays immune to the node-id collision classes tracked in P1.10.
+
+Limitation: cross-function taint only follows calls between functions whose CSTs
+are present in the current scan (all of them on a full scan; the changed set on
+an incremental scan). This mirrors the per-file best-effort design of the
+def-use pass.
+"""
+
+from __future__ import annotations
+
+from collections import defaultdict, deque
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Set, Tuple
+
+from tree_sitter import Node
+
+from adl_drift.graph.edges import EdgeType
+from adl_drift.lang.base import CFGConfig
+from adl_drift.utils.types import SourcePosition
+
+MAX_FIXPOINT_ITERATIONS = 12
+
+
+# ─── public data type ───────────────────────────────────────────────────────
+
+@dataclass
+class TaintPath:
+    """A confirmed source→sink data-flow path inside one function.
+
+    ``binding_name`` is the tainted variable handed to the sink (``None`` when a
+    source expression is passed inline, e.g. ``eval(request.GET["x"])``).
+    ``cross_function`` is True when the taint entered through a parameter rather
+    than a source assigned in this function body.
+    """
+
+    function_id: str
+    file_path: str
+    sink: str
+    sink_category: str
+    source_label: str
+    binding_name: Optional[str]
+    sink_site: SourcePosition
+    chain: List[str] = field(default_factory=list)
+    confidence: float = 0.9
+    cross_function: bool = False
+
+    def to_dict(self) -> Dict[str, Any]:
+        return {
+            "function_id": self.function_id,
+            "file_path": self.file_path,
+            "sink": self.sink,
+            "sink_category": self.sink_category,
+            "source_label": self.source_label,
+            "binding_name": self.binding_name,
+            "sink_site": self.sink_site.to_dict(),
+            "chain": list(self.chain),
+            "confidence": self.confidence,
+            "cross_function": self.cross_function,
+        }
+
+    @classmethod
+    def from_dict(cls, d: Dict[str, Any]) -> "TaintPath":
+        return cls(
+            function_id=d["function_id"],
+            file_path=d["file_path"],
+            sink=d["sink"],
+            sink_category=d["sink_category"],
+            source_label=d["source_label"],
+            binding_name=d.get("binding_name"),
+            sink_site=SourcePosition.from_dict(d["sink_site"]),
+            chain=list(d.get("chain", [])),
+            confidence=d.get("confidence", 0.9),
+            cross_function=d.get("cross_function", False),
+        )
+
+
+@dataclass
+class _OutCall:
+    """An outgoing call site from an analyzed function whose arguments carry
+    taint — positional index / keyword name of every tainted argument.
+    Shared shape every `TaintStrategy.analyze_one` implementation returns,
+    consumed by the language-agnostic cross-function worklist below.
+
+    `site_line` (1-indexed, matching `GraphEdge.line`'s convention) is the
+    call node's own source line — call-site identity, so `_resolve_callees`
+    can tell *this specific call* apart from a different call to a
+    same-named method elsewhere in the same function (F-03, PROBLEMS.md
+    P4.6: `good.process(tainted); bad.process("static");` in one function
+    must not both get resolved from a single `_OutCall`). `None` for a
+    language whose strategy doesn't supply it — `_resolve_callees` then
+    falls back to matching by name alone, same as before this field existed.
+
+    `site_column` (0-indexed, matching `GraphEdge.column`'s / tree-sitter
+    `start_point[1]`'s convention) is the call node's own source column —
+    needed on top of `site_line` because two distinct calls to the same
+    simple name can land on the *same* line (`good.process(q);
+    bad.process("static");` written on one line, or simply two call
+    expressions used as arguments to each other). Matching by line alone
+    cannot tell those apart and would over-approximate back to the
+    F-03 bug it was meant to fix. `None` for a language/site whose strategy
+    doesn't supply it — `_resolve_callees` then falls back to line-only,
+    then name-only, matching."""
+
+    callee: str
+    pos: Set[int]
+    kw: Set[str]
+    site_line: Optional[int] = None
+    site_column: Optional[int] = None
+
+
+# ─── per-language intra-function mechanics (P4.6) ────────────────────────────
+
+class TaintStrategy:
+    """Per-language intra-function taint mechanics (P4.6, PROBLEMS.md).
+
+    Owns everything CST-coupled about taint tracking for one language: how a
+    binding gets its parameter list, and how one function body propagates
+    taint from sources to sinks. `TaintAnalyzer` (below) drives this
+    strategy inside a fully language-agnostic cross-function worklist —
+    mirrors how `graph/builder.py::CallGraphBuilder` drives a `CallResolver`
+    (P4.4).
+
+    `lang/python/taint.py::PythonTaintStrategy` and `lang/java/taint.py::
+    JavaTaintStrategy` are the two implementations. Never constructed
+    directly — obtained via `CallGraphBuilder._get_taint_strategy()`, which
+    builds one lazily via `CFGConfig.taint_strategy_factory`.
+    """
+
+    def __init__(self, config: CFGConfig) -> None:
+        self.config = config
+
+    def param_names(self, func_node: Node, source: bytes) -> List[str]:
+        """Ordered parameter identifiers for `func_node` (includes an
+        explicit receiver name where the language has one, e.g. Python's
+        `self`/`cls` — Java has none, `this` is never a formal parameter)."""
+        raise NotImplementedError
+
+    def analyze_one(
+        self,
+        func_node: Node,
+        source: bytes,
+        function_id: str,
+        file_path: str,
+        seed_params: Set[str],
+    ) -> Tuple[Set[str], List[TaintPath], List[_OutCall]]:
+        """Flow-insensitive taint over one function body.
+
+        Returns ``(tainted_bindings, sink_paths, out_calls)``."""
+        raise NotImplementedError
+
+
+# ─── graph-level driver (intra + cross function; language-agnostic) ─────────
+
+@dataclass
+class _FuncMeta:
+    node_id: str
+    name: str
+    func_node: Node
+    source: bytes
+    file_path: str
+    params: List[str]
+    is_method: bool
+
+
+class TaintAnalyzer:
+    """Runs intra- and cross-function taint over a built graph + parse trees."""
+
+    def analyze(self, builder: Any, parses: Dict[Path, Any]) -> List[TaintPath]:
+        strategy = builder._get_taint_strategy()
+        metas = self._build_func_index(builder, parses, strategy)
+        if not metas:
+            return []
+
+        by_name: Dict[str, List[str]] = defaultdict(list)
+        for nid, m in metas.items():
+            by_name[m.name].append(nid)
+
+        seeds: Dict[str, Set[str]] = {nid: set() for nid in metas}
+        worklist: deque = deque(metas.keys())
+        in_wl: Set[str] = set(metas)
+        iterations = 0
+        max_iter = len(metas) * MAX_FIXPOINT_ITERATIONS + len(metas)
+
+        # Cache the last out_calls per node to propagate without re-emitting paths.
+        while worklist and iterations < max_iter:
+            iterations += 1
+            nid = worklist.popleft()
+            in_wl.discard(nid)
+            m = metas[nid]
+            _, _, out_calls = strategy.analyze_one(
+                m.func_node, m.source, nid, m.file_path, seeds[nid]
+            )
+            for oc in out_calls:
+                for cand_id in self._resolve_callees(builder, nid, oc, by_name, metas):
+                    cand = metas[cand_id]
+                    added = self._map_taint_to_params(cand, oc, seeds[cand_id])
+                    if added:
+                        seeds[cand_id] |= added
+                        if cand_id not in in_wl:
+                            worklist.append(cand_id)
+                            in_wl.add(cand_id)
+
+        # Final pass: emit sink paths with the converged seeds.
+        paths: List[TaintPath] = []
+        for nid, m in metas.items():
+            _, sink_paths, _ = strategy.analyze_one(
+                m.func_node, m.source, nid, m.file_path, seeds[nid]
+            )
+            paths.extend(sink_paths)
+        return paths
+
+    @staticmethod
+    def _resolve_callees(
+        builder: Any,
+        caller_id: str,
+        oc: "_OutCall",
+        by_name: Dict[str, List[str]],
+        metas: Dict[str, "_FuncMeta"],
+    ) -> List[str]:
+        """Candidate target function ids for the call site *oc* made inside
+        *caller_id*.
+
+        Prefers the call graph's own resolved `CALLS` edges out of this
+        specific caller (P4.4 overload/receiver-type resolution, P4.12
+        interface/DI fan-out) over blind simple-name fan-out — otherwise two
+        unrelated classes with a same-named method (`Good.process`/`Bad.
+        process`) would both get seeded just because *some* function in the
+        codebase resolves a call to one of them.
+
+        When `caller_id` has more than one resolved `CALLS` edge for this
+        callee name (e.g. two *different* call sites in the same function,
+        `good.process(tainted); bad.process("static");` — both legitimately
+        resolved, to different targets), matching on name alone would still
+        conflate them. `oc.site_line` (the call node's own source line)
+        narrows this down to the specific call site's own edge(s) — still
+        possibly more than one, for genuine same-site fan-out (P4.12
+        interface/DI dispatch), which is correct to keep.
+
+        Two distinct same-named calls can also share one line (`good.
+        process(q); bad.process("static");` on one physical line — a real
+        edge case reported against the line-only version of this fix,
+        PROBLEMS.md P4.6 F-03 remaining gap). So within the line match,
+        `oc.site_column` narrows further to the exact call-site node when
+        more than one candidate remains on that line; ties still fall
+        through to "by line" (all edges on that line) when the column
+        doesn't single one out. Falls back progressively — by line only,
+        then by name only — covers `site_line`/`site_column` being `None`
+        (a `TaintStrategy` or resolver edge that doesn't supply them) and
+        any resolver/extraction position mismatch — recall over precision,
+        same as the no-CALLS-edge-at-all fallback below.
+
+        Falls back to `by_name` only when the resolver produced no `CALLS`
+        edge at all from this caller for this callee name (e.g. an
+        unresolved dynamic dispatch) — recall over precision in that case,
+        matching this worklist's existing best-effort design for genuinely
+        unresolved calls.
+        """
+        nodes = getattr(builder, "_nodes", None)
+        occurrences = getattr(builder, "_edge_occurrences", None)
+        if occurrences and nodes is not None:
+            by_name_occurrences = [
+                edge for edge in occurrences
+                if edge.source == caller_id
+                and edge.edge_type == EdgeType.CALLS
+                and edge.target in metas
+                and nodes.get(edge.target) is not None
+                and nodes[edge.target].name == oc.callee
+            ]
+            if by_name_occurrences:
+                if oc.site_line is not None:
+                    by_line = [
+                        edge for edge in by_name_occurrences
+                        if edge.line == oc.site_line
+                    ]
+                    if by_line:
+                        if oc.site_column is not None:
+                            by_column = [
+                                edge.target for edge in by_line
+                                if edge.column == oc.site_column
+                            ]
+                            if by_column:
+                                return list(dict.fromkeys(by_column))
+                        return list(dict.fromkeys(edge.target for edge in by_line))
+                return list(dict.fromkeys(edge.target for edge in by_name_occurrences))
+
+        graph = getattr(builder, "graph", None)
+        if graph is not None and nodes is not None and graph.has_node(caller_id):
+            by_name_edges = [
+                (target, data)
+                for _, target, data in graph.out_edges(caller_id, data=True)
+                if data.get("type") == EdgeType.CALLS.name
+                and target in metas
+                and nodes.get(target) is not None
+                and nodes[target].name == oc.callee
+            ]
+            if by_name_edges:
+                if oc.site_line is not None:
+                    # `GraphEdge.to_dict()` (what `_add_edge` feeds into the
+                    # NetworkX edge data dict) nests the call-site line/column
+                    # under `"position"`, not as top-level keys.
+                    by_site = [
+                        t for t, d in by_name_edges
+                        if (d.get("position") or {}).get("line") == oc.site_line
+                    ]
+                    if by_site:
+                        if oc.site_column is not None:
+                            by_site_edges = [
+                                (t, d) for t, d in by_name_edges
+                                if (d.get("position") or {}).get("line") == oc.site_line
+                            ]
+                            by_column = [
+                                t for t, d in by_site_edges
+                                if (d.get("position") or {}).get("column") == oc.site_column
+                            ]
+                            if by_column:
+                                return by_column
+                        return by_site
+                return [t for t, _ in by_name_edges]
+        return by_name.get(oc.callee, [])
+
+    @staticmethod
+    def _map_taint_to_params(
+        cand: _FuncMeta, oc: _OutCall, existing: Set[str]
+    ) -> Set[str]:
+        """Map tainted call arguments to the callee's parameter names."""
+        added: Set[str] = set()
+        offset = 1 if cand.is_method else 0  # skip self/cls for method calls
+        for pos in oc.pos:
+            tgt = pos + offset
+            if 0 <= tgt < len(cand.params):
+                p = cand.params[tgt]
+                if p not in existing:
+                    added.add(p)
+        for kw in oc.kw:
+            if kw in cand.params and kw not in existing:
+                added.add(kw)
+        return added
+
+    def _build_func_index(
+        self, builder: Any, parses: Dict[Path, Any], strategy: TaintStrategy,
+    ) -> Dict[str, _FuncMeta]:
+        # `builder._path_to_module()` is path-derived and does not match the
+        # package-declaration-derived module a Java file's real graph nodes
+        # carry (`GraphNode.module`, set from `AnalysisResult.module_name` —
+        # see `lang/java/extractor.py`), so function ids computed from it
+        # would not line up with the actual graph node ids `builder._iter_
+        # func_cst` derives (via `CallGraphBuilder._symbol_to_id`). Reading
+        # the module straight off any already-built node for that file keeps
+        # this correct for every language; Python is unaffected since its
+        # nodes' `.module` already equals the path-derived value.
+        module_by_file: Dict[str, str] = {}
+        for node in builder._nodes.values():
+            module_by_file.setdefault(node.file_path, node.module)
+
+        receiver_self_names = builder._get_resolver().config.receiver_self_names
+
+        metas: Dict[str, _FuncMeta] = {}
+        for file_path, parse_result in parses.items():
+            try:
+                source = parse_result.source_bytes
+                fp_str = str(file_path)
+                module = module_by_file.get(fp_str) or builder._path_to_module(file_path)
+            except Exception:
+                continue
+            for func_cst, nid in builder._iter_func_cst(
+                parse_result.tree.root_node, source, module
+            ):
+                params = strategy.param_names(func_cst, source)
+                is_method = bool(params) and params[0] in receiver_self_names
+                name_node = func_cst.child_by_field_name("name")
+                fname = source[name_node.start_byte:name_node.end_byte].decode(
+                    "utf-8", errors="replace"
+                ) if name_node else ""
+                metas[nid] = _FuncMeta(
+                    node_id=nid, name=fname, func_node=func_cst, source=source,
+                    file_path=fp_str, params=params, is_method=is_method,
+                )
+        return metas