circle-ir-ai 2.33.4 → 2.34.0

package/dist/security-scan/sink-filters.js

@@ -282,16 +282,51 @@ export function isKnownNonSink(code, sinkType) {
     });
 }
 // ---------------------------------------------------------------------------
-// Fix 4 — nosql_injection on browser-side JS/HTML (#94)
+// Fix 4 — nosql_injection on browser-side JS/HTML (#94) + browser-side
+// SQL FP on Chrome-extension / Web-API `.query()` calls (cognium-ai#186)
 // ---------------------------------------------------------------------------
 /**
- * MongoDB / NoSQL drivers run server-side. The LLM occasionally flags
- * client-side `.find(...)`, `.aggregate(...)` calls on `.js`/`.html`
- * (jQuery selectors, DOM array methods) as `nosql_injection`. There is
- * no MongoDB driver in the browser by construction — suppress the
- * entire CWE on browser file types.
+ * Strict browser-only file extensions used by `#94` `isNosqlOnBrowserFile`.
+ *
+ * MUST NOT include `.ts` / `.tsx` / `.mts` / `.cts` — Node.js / Nest / Express
+ * backends written in TypeScript legitimately import `mongodb` / `mongoose`
+ * and call `.find()` / `.aggregate()` server-side. Extending this set to
+ * include `.ts` would silently drop real NoSQL injection findings on any
+ * TypeScript backend. `.js` / `.jsx` / `.mjs` / `.cjs` / `.html` / `.htm` are
+ * kept because the mongodb driver has no browser build for those either, and
+ * the historical evidence (`#94`) came from browser-side jQuery / DOM
+ * collections mis-classified as `.find()` sinks.
  */
 const BROWSER_JS_EXTS = new Set(['.js', '.jsx', '.mjs', '.cjs', '.html', '.htm']);
+/**
+ * Wider "renderer / browser context" extension set used by
+ * `isBrowserQueryApi` (cognium-ai#186). Safe to include TypeScript / Vue /
+ * Svelte here because the code-shape regexes in `isBrowserQueryApi` are
+ * unambiguous browser signals:
+ *
+ *   - `chrome.tabs.query(...)` / `browser.storage.local.query(...)` — WebExt
+ *   - `navigator.permissions.query(...)` — Web Permissions API
+ *   - `document.querySelector*(...)` — DOM
+ *
+ * None of these globals exist in Node.js, so gating on this wider extension
+ * set only suppresses code that had no chance of hitting a real DB driver.
+ * Kept separate from `BROWSER_JS_EXTS` so `isNosqlOnBrowserFile` continues
+ * to treat `.ts` as server-side.
+ */
+const BROWSER_RENDERER_EXTS = new Set([
+    '.js',
+    '.jsx',
+    '.mjs',
+    '.cjs',
+    '.ts',
+    '.tsx',
+    '.mts',
+    '.cts',
+    '.html',
+    '.htm',
+    '.vue',
+    '.svelte',
+]);
 function fileExtension(file) {
     if (!file)
         return '';
@@ -306,6 +341,223 @@ export function isNosqlOnBrowserFile(sinkType, sinkFile) {
     return BROWSER_JS_EXTS.has(fileExtension(sinkFile));
 }
 // ---------------------------------------------------------------------------
+// cognium-ai#186 — browser-side `.query()` mis-classified as SQL injection
+// ---------------------------------------------------------------------------
+/**
+ * Sink types this filter can suppress. `sql_injection` is the observed
+ * failure (BLOCKED tier on a Chrome MV3 extension in #186). `nosql_injection`
+ * is included defensively — the same call shapes (`.query({...})`) are
+ * plausible bait for the same misclassification on the LLM path.
+ */
+const BROWSER_QUERY_SUPPRESSIBLE_SINK_TYPES = new Set([
+    'sql_injection',
+    'nosql_injection',
+]);
+/**
+ * Regex for Chrome-extension `.query()` APIs and Web `navigator`/document
+ * `.query()` / `.querySelector*()` shapes that share the method name with
+ * SQL drivers but never route to a database.
+ *
+ * Anchored on the receiver so a real DB call (`db.query(...)`,
+ * `client.query(...)`, `pool.query(...)`) with an unfamiliar variable name
+ * still fires. The listed receivers are the standardised browser globals
+ * (`chrome`, `browser`, `navigator`, `document`, `window`) — user code
+ * that names a variable `chrome` will hit this filter, which is the
+ * accepted trade-off for suppressing the standard-API FP class.
+ *
+ * Coverage:
+ *   - Chrome / WebExtension APIs:
+ *       chrome.tabs.query, chrome.bookmarks.query, chrome.history.query,
+ *       chrome.sessions.query, chrome.management.query,
+ *       chrome.windows.getAll, chrome.storage.local.query (rare),
+ *       chrome.notifications.getAll (not .query), and the equivalent
+ *       `browser.*` namespace used by Firefox / Safari extensions.
+ *   - Web Permissions API: navigator.permissions.query
+ *   - DOM query APIs: document.querySelector, .querySelectorAll,
+ *     element.querySelector*, window.matchMedia (adjacent shape)
+ *
+ * Non-goals (still real sinks):
+ *   - `db.query(...)`, `client.query(...)`, `knex.raw(...)`,
+ *     `mongoose.<model>.find(...)` — receiver isn't a browser global.
+ *   - `req.query.<key>` — that's a *source*, not a sink; the source-type
+ *     tagger already handles it.
+ */
+const BROWSER_QUERY_RE = /\b(?:chrome|browser)\s*\.\s*(?:tabs|bookmarks|history|sessions|management|windows|storage(?:\.\s*(?:local|sync|managed|session))?|notifications|permissions|contextMenus)\s*\.\s*query\s*\(/;
+const NAVIGATOR_PERMISSIONS_RE = /\bnavigator\s*\.\s*permissions\s*\.\s*query\s*\(/;
+const DOM_QUERY_SELECTOR_RE = /\b(?:document|window|this|self|globalThis|[A-Za-z_$][\w$]*)\s*\.\s*querySelector(?:All)?\s*\(/;
+/**
+ * True if the sink line is a browser / WebExtension `.query()` /
+ * `querySelector*` call. Gated on file extension so that server-side
+ * `chrome.query(...)` on a Node.js repo (unlikely but possible: a variable
+ * named `chrome` in server code) still fires normally.
+ *
+ * Confirmed downstream sighting: `cognium-meet` Chrome extension —
+ * `apps/extension/src/lib/settings-form.ts:177`
+ * (`navigator.permissions.query({ name: 'microphone' })`) and
+ * `apps/extension/src/popup/popup.ts:717`
+ * (`chrome.tabs.query({ active: true, currentWindow: true })`) both
+ * flagged as CRITICAL `sql_injection` → BLOCKED tier on trust score.
+ * Neither call touches a SQL driver.
+ */
+export function isBrowserQueryApi(sinkCode, sinkType, sinkFile) {
+    if (!sinkCode || !sinkType)
+        return false;
+    if (!BROWSER_QUERY_SUPPRESSIBLE_SINK_TYPES.has(sinkType))
+        return false;
+    // File-extension gate: only browser / renderer-side files. Prevents a
+    // server-side variable named `chrome` from being silently suppressed.
+    // Uses BROWSER_RENDERER_EXTS (wider than BROWSER_JS_EXTS) because the
+    // chrome.*/navigator.*/document.* code shapes below are unambiguously
+    // browser — safe to widen to `.ts` / `.tsx` / `.vue` / `.svelte`.
+    if (!BROWSER_RENDERER_EXTS.has(fileExtension(sinkFile)))
+        return false;
+    const trimmed = sinkCode.trim();
+    if (!trimmed)
+        return false;
+    if (BROWSER_QUERY_RE.test(trimmed))
+        return true;
+    if (NAVIGATOR_PERMISSIONS_RE.test(trimmed))
+        return true;
+    if (DOM_QUERY_SELECTOR_RE.test(trimmed))
+        return true;
+    return false;
+}
+// ---------------------------------------------------------------------------
+// cognium-ai#167 — library-internal FP gates 5, 6, 7 for XPath / XXE / crypto
+// ---------------------------------------------------------------------------
+//
+// The 10-repo top-100 sweep on 2026-07-01 surfaced three sink families that
+// share the same failure mode as cognium-dev#179's gates 1-4: the sink fires
+// on the *library itself*, not on caller-controlled input reaching the
+// library's public API. Each gate matches on the fully-qualified package
+// path in the sink file — semver-stable and doesn't depend on repo name.
+//
+//   Gate 5 (XPath):  JsonPath ValueNodes.java (10 CRIT CWE-643) — the
+//                    library's own predicate-node type
+//   Gate 6 (XXE):    jsoup XML processing (5 CRIT CWE-611) — jsoup IS the
+//                    parser being flagged
+//   Gate 7 (crypto): JJWT JcaTemplate.java + EcdhKeyAlgorithm.java (8 CRIT
+//                    CWE-902 + CWE-310) — jjwt's JCA wrapper + ECDH-ES impl
+/** Fully-qualified package paths for XPath / JsonPath-shaped libraries.
+ *  Anchored on `/pkg/` (leading + trailing separator) so a class name like
+ *  `MyJaxenParser.java` doesn't spuriously match. Case-insensitive because
+ *  a few of these historically use mixed-case Maven `groupId`s. */
+const XPATH_LIBRARY_PATH_RE = /(?:com\/jayway\/jsonpath|org\/jaxen|net\/sf\/saxon|org\/dom4j\/xpath)\//i;
+/** Fully-qualified package paths for HTML / XML parser libraries whose own
+ *  internal XML processing gets flagged CWE-611. The evidence-driven set:
+ *  jsoup (5 CRIT in the 10-repo sweep) + adjacent HTML parser shapes. */
+const XXE_PARSER_LIBRARY_PATH_RE = /(?:org\/jsoup|org\/htmlcleaner)\//i;
+/** Sink types that gate 7 can suppress. `crypto_api` = high-level misuse
+ *  (algorithm choice, mode, IV); `crypto` = lower-level primitive selection.
+ *  Both fire on JJWT internals — the whole *point* of the library is to
+ *  call `Cipher.getInstance(...)` / `KeyAgreement.getInstance(...)`. */
+const CRYPTO_SUPPRESSIBLE_SINK_TYPES = new Set(['crypto_api', 'crypto']);
+/** Fully-qualified package paths for crypto libraries whose own JCA-wrapping
+ *  code gets flagged as unsafe crypto usage. */
+const CRYPTO_LIBRARY_PATH_RE = /(?:io\/jsonwebtoken|com\/nimbusds\/jose|org\/bouncycastle|com\/google\/crypto\/tink)\//i;
+/** JCA Service Provider Interface types. A class that extends/implements
+ *  any of these IS a JCA SPI implementation — Cipher.getInstance / Mac.
+ *  getInstance / etc. inside such a class are the intended implementation,
+ *  not user-controlled crypto misuse. Backstop for crypto library code
+ *  that isn't in the fully-qualified path set above. */
+const JCA_SPI_TYPES = new Set([
+    'CipherSpi',
+    'MacSpi',
+    'MessageDigestSpi',
+    'KeyAgreementSpi',
+    'SignatureSpi',
+    'KeyFactorySpi',
+    'SecretKeyFactorySpi',
+    'KeyGeneratorSpi',
+    'KeyPairGeneratorSpi',
+    'AlgorithmParametersSpi',
+    'SecureRandomSpi',
+]);
+/**
+ * True when the sink is an `xpath_injection` inside a well-known XPath
+ * library package (JsonPath / Jaxen / Saxon / dom4j XPath). These libraries'
+ * own predicate-node / expression-node classes fire the xpath_injection
+ * rule because they syntactically wrap an XPath-shaped call — but they ARE
+ * the XPath engine, not user code reaching an unsafe evaluator.
+ *
+ * Confirmed evidence (cognium-ai#167): `json-path/JsonPath` — 10 CRIT
+ * findings in `ValueNodes.java:680,694`.
+ */
+export function isXPathLibraryInternal(sinkType, sinkFile) {
+    if (sinkType !== 'xpath_injection')
+        return false;
+    if (!sinkFile)
+        return false;
+    return XPATH_LIBRARY_PATH_RE.test(sinkFile);
+}
+/**
+ * True when the sink is an `xxe` inside a well-known HTML/XML parser
+ * library (jsoup, htmlcleaner). These libraries' own XML processing paths
+ * fire the XXE rule because they syntactically call low-level XML APIs —
+ * but they ARE the parser, and their DTD/entity handling is a library
+ * configuration surface exposed to callers.
+ *
+ * Confirmed evidence (cognium-ai#167): `jhy/jsoup` — 5 CRIT CWE-611 in
+ * jsoup's own XML processing paths.
+ *
+ * Note: complements cognium-dev#166 (DocumentBuilderFactory FEATURE_
+ * SECURE_PROCESSING recognition). #166 covers DBF; this gate covers
+ * parser libraries that don't use DBF.
+ */
+export function isXxeOnParserLibrary(sinkType, sinkFile) {
+    if (sinkType !== 'xxe')
+        return false;
+    if (!sinkFile)
+        return false;
+    return XXE_PARSER_LIBRARY_PATH_RE.test(sinkFile);
+}
+/**
+ * True when the sink is a `crypto_api` / `crypto` inside a well-known
+ * crypto library (JJWT, Nimbus JOSE, BouncyCastle, Tink) OR inside a
+ * class that extends/implements a JCA SPI type (`CipherSpi`, `MacSpi`,
+ * etc.). Crypto misuse rules fire on `Cipher.getInstance(...)` /
+ * `KeyAgreement.getInstance(...)` / algorithm-string sinks — but a JWT
+ * or JOSE library's whole purpose IS to wrap those calls, so the sink
+ * is the intended implementation, not caller-controlled misuse.
+ *
+ * Confirmed evidence (cognium-ai#167): `jwtk/jjwt` — 5× CWE-902 in
+ * `JcaTemplate.java:67`, 3× CWE-310 in `EcdhKeyAlgorithm.java:188`.
+ *
+ * Two-layer detection:
+ *   1. Fully-qualified package path match (fast; covers the 4 known
+ *      library packages in `CRYPTO_LIBRARY_PATH_RE`).
+ *   2. JCA SPI subclass check via `types.implements[]` (backstop; catches
+ *      third-party JCA providers not in the path set).
+ */
+export function isCryptoLibraryInternal(sinkType, sinkFile, types, sinkLine) {
+    if (!sinkType || !CRYPTO_SUPPRESSIBLE_SINK_TYPES.has(sinkType))
+        return false;
+    // Layer 1: file-path heuristic.
+    if (sinkFile && CRYPTO_LIBRARY_PATH_RE.test(sinkFile))
+        return true;
+    // Layer 2: JCA SPI subclass check. Only fires when types + sinkLine are
+    // available (post-#111 callers). Missing bounds → skip → preserve recall.
+    if (!types || types.length === 0)
+        return false;
+    if (sinkLine == null || !Number.isFinite(sinkLine))
+        return false;
+    for (const t of types) {
+        if (t.kind !== 'class')
+            continue;
+        if (sinkLine < t.start_line || sinkLine > t.end_line)
+            continue;
+        for (const impl of t.implements) {
+            // `implements` carries simple names from circle-ir; tolerate the
+            // generic-parameter form (e.g. `CipherSpi<Foo>` — hypothetical but
+            // matches the #111 pattern).
+            const simple = impl.replace(/<.*$/, '').trim();
+            if (JCA_SPI_TYPES.has(simple))
+                return true;
+        }
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
 // Class-aware MyBatis Interceptor suppression (#111)
 // ---------------------------------------------------------------------------
 /**
@@ -367,6 +619,104 @@ export function isInsideMybatisInterceptor(types, sinkLine, sinkType) {
     return false;
 }
 // ---------------------------------------------------------------------------
+// cognium-ai#172 — XSS FP: response.setContentType("application/json") set
+// earlier in the same method as the writer sink
+// ---------------------------------------------------------------------------
+/**
+ * XSS sink types that can be suppressed by an in-scope
+ * `setContentType("application/json*")` — see `hasJsonContentTypeInScope`.
+ *
+ * Kept explicit rather than a broad `startsWith('xss')` so a future
+ * `xss_stored` (persisted-payload) sink type won't be inadvertently
+ * suppressed by a header set immediately before the write (persisted
+ * flows can still be exploitable when re-served without the same header).
+ */
+const JSON_CT_SUPPRESSIBLE_SINK_TYPES = new Set([
+    'xss',
+    'reflected_xss',
+    'dom_xss',
+]);
+/**
+ * Regex for the servlet `HttpServletResponse.setContentType("application/json…")`
+ * pattern. Match is line-oriented and case-insensitive on the method name +
+ * MIME type so `.setContentType("Application/JSON")` still hits.
+ *
+ * Anchoring:
+ *  - `setContentType` — method name, dotted or bare (matches
+ *    `response.setContentType(...)` and `resp.setContentType(...)`)
+ *  - opening quote → `application/json` — the MIME literal must actually
+ *    start the string so `"text/html; application/json-hint"` (contrived
+ *    but possible) doesn't false-positive
+ *  - `application/json-patch+json` / `application/jsonrequest` etc. are
+ *    NOT accepted — the `\b` anchor after `json` requires a delimiter
+ *    (`"`, `;`, whitespace, `+`) that isn't `-` or letters, so `jsonp` /
+ *    `json-patch` still trigger a browser HTML sniff → keep as XSS.
+ */
+const SET_CONTENT_TYPE_JSON_RE = /setContentType\s*\(\s*["'`]application\/json\b(?![a-z\-])/i;
+/**
+ * True if a `setContentType("application/json…")` call appears earlier in
+ * the same enclosing method as the sink. Suppresses XSS FPs on servlet
+ * `response.getWriter().println(...)` (and equivalent writer sinks) when
+ * the response Content-Type is already committed to JSON — modern browsers
+ * refuse to interpret an `application/json` body as HTML, so a reflected
+ * value in the JSON body can't fire an XSS payload.
+ *
+ * Confirmed example (cognium-ai#172): calcite-avatica `AvaticaJsonHandler`
+ * sets `application/json;charset=utf-8` at line 98 and writes at line 153,
+ * flagged as high-severity XSS pre-#172.
+ *
+ * Bounds are conservative:
+ *  - Only fires when the sink line is inside a known method (`types` +
+ *    `methods` + line range all present). Missing bounds → return false
+ *    → treat as unsuppressed (preserve recall).
+ *  - Only scans lines strictly BEFORE the sink line, inclusive of the
+ *    method's opening line — a `setContentType` call AFTER the sink can't
+ *    protect against the reflected value already having been written.
+ *  - No cross-method / cross-file inference. If the caller sets JSON on
+ *    the response and delegates to a helper that writes, the helper
+ *    method still emits XSS (recall over precision for indirect flows).
+ *  - Only matches `application/json` MIME literals — NOT `application/
+ *    json-patch+json`, `application/jsonrequest`, or JSONP (`text/
+ *    javascript` + a `?callback=` query). See the regex anchor.
+ */
+export function hasJsonContentTypeInScope(sourceCode, types, sinkLine) {
+    if (!sourceCode || !types || types.length === 0)
+        return false;
+    if (sinkLine == null || !Number.isFinite(sinkLine) || sinkLine < 1)
+        return false;
+    // Locate the enclosing method. Uses the same inclusive-1-indexed bounds
+    // as source-classifier.ts::findEnclosing so the two stay consistent.
+    let methodStartLine;
+    for (const t of types) {
+        if (sinkLine < t.start_line || sinkLine > t.end_line)
+            continue;
+        for (const m of t.methods ?? []) {
+            if (sinkLine >= m.start_line && sinkLine <= m.end_line) {
+                methodStartLine = m.start_line;
+                break;
+            }
+        }
+        if (methodStartLine !== undefined)
+            break;
+    }
+    if (methodStartLine === undefined)
+        return false;
+    // Scan `[methodStart, sinkLine)` for the setContentType call. `split('\n')`
+    // yields a 0-indexed array; lines are 1-indexed in the schema, so line N
+    // is at index N-1.
+    const lines = sourceCode.split('\n');
+    const startIdx = Math.max(0, methodStartLine - 1);
+    const endIdx = Math.min(lines.length, sinkLine - 1); // exclusive of sink line
+    for (let i = startIdx; i < endIdx; i++) {
+        const line = lines[i];
+        if (!line)
+            continue;
+        if (SET_CONTENT_TYPE_JSON_RE.test(line))
+            return true;
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
 // Combined predicate
 // ---------------------------------------------------------------------------
 /**
@@ -377,25 +727,56 @@ export function isInsideMybatisInterceptor(types, sinkLine, sinkType) {
  * it short-circuits the whole table on the bulk-FP case from #94.
  *
  * Backwards-compat: callers passing just `(code, type)` still get
- * the previous behavior — the new `sinkFile` arg is optional and only
- * activates the #93 nosql-on-browser check.
+ * the previous behavior — the newer `sinkFile`/`types`/`sinkLine`/
+ * `sourceCode` args are all optional and gate the individual checks
+ * that need them. Callers that omit them get the pre-#172 behavior on
+ * that filter (returns false → not suppressed).
  */
-export function isSuppressedSinkShape(sinkCode, sinkType, sinkFile, types, sinkLine) {
+export function isSuppressedSinkShape(sinkCode, sinkType, sinkFile, types, sinkLine, 
+// cognium-ai#172: full file contents for the JSON-content-type XSS scan.
+// Optional so legacy callers (older tests, runReport invoked without a
+// pattern-match result) get pre-#172 behavior.
+sourceCode) {
     if (isPhantomLineSink(sinkCode))
         return true;
     if (isNosqlOnBrowserFile(sinkType, sinkFile))
         return true;
+    // cognium-ai#186: browser-side `.query()` mis-classified as SQL
+    // (chrome.tabs.query, navigator.permissions.query, DOM querySelector*)
+    // — cheap file-ext + regex, ordered before the more expensive
+    // isKnownNonSink pattern table.
+    if (isBrowserQueryApi(sinkCode, sinkType, sinkFile))
+        return true;
+    // cognium-ai#167 gates 5, 6, 7 — library-internal FPs for XPath /
+    // XXE / crypto. Each is a fully-qualified-package match on the sink
+    // file (semver-stable, doesn't depend on repo name). Cheap regex, no
+    // TypeScript source read required; ordered before isKnownNonSink so
+    // the more expensive pattern table isn't reached for these buckets.
+    if (isXPathLibraryInternal(sinkType, sinkFile))
+        return true;
+    if (isXxeOnParserLibrary(sinkType, sinkFile))
+        return true;
+    if (isCryptoLibraryInternal(sinkType, sinkFile, types, sinkLine))
+        return true;
     if (isRequireOrImportSink(sinkCode))
         return true;
     if (isKnownNonSink(sinkCode, sinkType))
         return true;
-    // #111: class-aware MyBatis Interceptor suppression. Last because it
-    // needs `types` + `sinkLine`, both of which may be unavailable on
-    // legacy code paths (older test callers, runReport invoked without a
-    // pattern-match result). When omitted the predicate returns false
-    // and behavior is unchanged.
+    // #111: class-aware MyBatis Interceptor suppression. Last of the
+    // pre-#172 checks because it needs `types` + `sinkLine`, both of which
+    // may be unavailable on legacy code paths (older test callers, runReport
+    // invoked without a pattern-match result). When omitted the predicate
+    // returns false and behavior is unchanged.
     if (isInsideMybatisInterceptor(types, sinkLine, sinkType))
         return true;
+    // cognium-ai#172: XSS on servlet writer sink with `application/json`
+    // Content-Type committed earlier in the same method. Guarded by
+    // sink-type check so non-XSS findings never pay the source scan cost.
+    if (sinkType &&
+        JSON_CT_SUPPRESSIBLE_SINK_TYPES.has(sinkType) &&
+        hasJsonContentTypeInScope(sourceCode, types, sinkLine)) {
+        return true;
+    }
     return false;
 }
 //# sourceMappingURL=sink-filters.js.map

package/dist/security-scan/sink-filters.js.map

@@ -1 +1 @@
-{"version":3,"file":"sink-filters.js","sourceRoot":"","sources":["../../src/security-scan/sink-filters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,8EAA8E;AAC9E,4CAA4C;AAC5C,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,eAAe,GAAG,2BAA2B,CAAC;AACpD,6EAA6E;AAC7E,uEAAuE;AACvE,kEAAkE;AAClE,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,MAAM,UAAU,iBAAiB,CAAC,IAA+B;IAC/D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,yDAAyD;IACzD,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,+CAA+C;IAC/C,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,sDAAsD;IACtD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,wDAAwD;AACxD,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,oBAAoB,GACxB,mEAAmE,CAAC;AAEtE,MAAM,UAAU,qBAAqB,CAAC,IAA+B;IACnE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC;AAkED;;;;GAIG;AACH,MAAM,oBAAoB,GAAG;IAC3B,eAAe;IACf,mBAAmB;IACnB,gBAAgB;IAChB,iBAAiB;IACjB,KAAK;IACL,gBAAgB;IAChB,iBAAiB;IACjB,MAAM;IACN,gBAAgB;IAChB,iBAAiB;IACjB,eAAe;IACf,oBAAoB;CACZ,CAAC;AAEX,MAAM,iBAAiB,GAAqB;IAC1C,uBAAuB;IACvB,EAAE,OAAO,EAAE,8BAA8B,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE;IACnF,EAAE,OAAO,EAAE,wCAAwC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE;IAE7F,mEAAmE;IACnE,EAAE,OAAO,EAAE,iCAAiC,EAAE,QAAQ,EAAE,mBAAmB,EAAE,GAAG,EAAE,KAAK,EAAE;IACzF,EAAE,OAAO,EAAE,2CAA2C,EAAE,QAAQ,EAAE,mBAAmB,EAAE,GAAG,EAAE,KAAK,EAAE;IACnG,EAAE,OAAO,EAAE,4CAA4C,EAAE,QAAQ,EAAE,mBAAmB,EAAE,GAAG,EAAE,KAAK,EAAE;IACpG,8DAA8D;IAC9D,sEAAsE;IACtE,4DAA4D;IAC5D,mEAAmE;IACnE,EAAE,OAAO,EAAE,+DAA+D,EAAE,QAAQ,EAAE,mBAAmB,EAAE,GAAG,EAAE,KAAK,EAAE;IAEvH,4DAA4D;IAC5D,+DAA+D;IAC/D,sEAAsE;IACtE,4DAA4D;IAC5D,gEAAgE;IAChE,2CAA2C;IAC3C,oEAAoE;IACpE,yDAAyD;IACzD,qDAAqD;IACrD;QACE,OAAO,EAAE,+FAA+F;QACxG,QAAQ,EAAE,eAAe;QACzB,GAAG,EAAE,KAAK;KACX;IAED,sDAAsD;IACtD,mEAAmE;IACnE,sEAAsE;IACtE,EAAE,OAAO,EAAE,qDAAqD,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,EAAE;IAC3G,2EAA2E;IAC3E,uDAAuD;IACvD,EAAE,OAAO,EAAE,kDAAkD,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,EAAE;IACxG,qCAAqC;IACrC,EAAE,OAAO,EAAE,oDAAoD,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,EAAE;IAC1G,0DAA0D;IAC1D,EAAE,OAAO,EAAE,6CAA6C,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,EAAE;IACnG,4CAA4C;IAC5C,EAAE,OAAO,EAAE,uDAAuD,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,EAAE;IAE7G,8DAA8D;IAC9D,oEAAoE;IACpE,EAAE,OAAO,EAAE,uCAAuC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE;IAC5F,8DAA8D;IAC9D,sEAAsE;IACtE,kDAAkD;IAClD,EAAE,OAAO,EAAE,uDAAuD,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE;IAC5G,8EAA8E;IAC9E,EAAE,OAAO,EAAE,qDAAqD,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE;IAC1G,6DAA6D;IAC7D,sEAAsE;IACtE,2CAA2C;IAC3C,EAAE,OAAO,EAAE,gCAAgC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE;IAErF,4DAA4D;IAC5D,+CAA+C;IAC/C,kDAAkD;IAClD,6DAA6D;IAC7D,iEAAiE;IACjE,qEAAqE;IACrE,iEAAiE;IACjE,oEAAoE;IACpE,gEAAgE;IAChE,kEAAkE;IAClE,uCAAuC;IACvC,EAAE;IACF,qBAAqB;IACrB,+CAA+C;IAC/C,mEAAmE;IACnE,8DAA8D;IAC9D,qEAAqE;IACrE,+DAA+D;IAC/D,gEAAgE;IAChE,yDAAyD;IACzD,EAAE;IACF,kEAAkE;IAClE,iEAAiE;IACjE,mCAAmC;IAEnC,4DAA4D;IAC5D;QACE,OAAO,EACL,iJAAiJ;QACnJ,QAAQ,EAAE,oBAAoB;QAC9B,GAAG,EAAE,MAAM;KACZ;IACD,gCAAgC;IAChC;QACE,OAAO,EACL,iKAAiK;QACnK,QAAQ,EAAE,oBAAoB;QAC9B,GAAG,EAAE,MAAM;KACZ;IACD,0EAA0E;IAC1E;QACE,OAAO,EACL,kIAAkI;QACpI,QAAQ,EAAE,oBAAoB;QAC9B,GAAG,EAAE,MAAM;KACZ;IACD,gCAAgC;IAChC;QACE,OAAO,EACL,wIAAwI;QAC1I,QAAQ,EAAE,oBAAoB;QAC9B,GAAG,EAAE,MAAM;KACZ;IAED,yEAAyE;IACzE,oEAAoE;IACpE,kEAAkE;IAClE,iEAAiE;IACjE,qEAAqE;IACrE,mEAAmE;IACnE,iCAAiC;IACjC,EAAE;IACF,8DAA8D;IAC9D,sEAAsE;IACtE,gEAAgE;IAChE,wEAAwE;IACxE,mEAAmE;IACnE,qEAAqE;IACrE,6DAA6D;IAC7D,4DAA4D;IAC5D,4DAA4D;IAC5D,kEAAkE;IAClE,wBAAwB;IACxB,EAAE;IACF,gEAAgE;IAChE,kEAAkE;IAClE,2DAA2D;IAC3D,oEAAoE;IACpE,sEAAsE;IACtE,gEAAgE;IAChE,mDAAmD;IACnD,EAAE;IACF,oEAAoE;IACpE,qCAAqC;IAErC,qDAAqD;IACrD;QACE,OAAO,EACL,sHAAsH;QACxH,QAAQ,EAAE,CAAC,eAAe,EAAE,gBAAgB,CAAC;QAC7C,GAAG,EAAE,WAAW;KACjB;IACD,qEAAqE;IACrE;QACE,OAAO,EAAE,4DAA4D;QACrE,QAAQ,EAAE,eAAe;QACzB,GAAG,EAAE,WAAW;KACjB;IACD,6DAA6D;IAC7D,iEAAiE;IACjE,+DAA+D;IAC/D,iEAAiE;IACjE,oEAAoE;IACpE;QACE,OAAO,EACL,+KAA+K;QACjL,QAAQ,EAAE,eAAe;QACzB,GAAG,EAAE,WAAW;KACjB;CACF,CAAC;AAEF,MAAM,UAAU,cAAc,CAC5B,IAA+B,EAC/B,QAAmC;IAEnC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC3C,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/B,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC5B,OAAO,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,wDAAwD;AACxD,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAElF,SAAS,aAAa,CAAC,IAA+B;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAAmC,EACnC,QAAmC;IAEnC,IAAI,QAAQ,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,8EAA8E;AAC9E,qDAAqD;AACrD,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC;IAC7C,mBAAmB;IACnB,aAAa;IACb,UAAU;IACV,mBAAmB;IACnB,kBAAkB;IAClB,wEAAwE;IACxE,qEAAqE;IACrE,qCAAqC;CACtC,CAAC,CAAC;AAEH,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC;IAC9C,eAAe;IACf,gBAAgB;IAChB,mBAAmB;CACpB,CAAC,CAAC;AAcH,MAAM,UAAU,0BAA0B,CACxC,KAAkD,EAClD,QAAmC,EACnC,QAAmC;IAEnC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,QAAQ,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,IAAI,CAAC,QAAQ,IAAI,CAAC,+BAA+B,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;YAAE,SAAS;QACjC,IAAI,QAAQ,GAAG,CAAC,CAAC,UAAU,IAAI,QAAQ,GAAG,CAAC,CAAC,QAAQ;YAAE,SAAS;QAC/D,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YAChC,iEAAiE;YACjE,6DAA6D;YAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAmC,EACnC,QAAmC,EACnC,QAAoC,EACpC,KAAuC,EACvC,QAAwB;IAExB,IAAI,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,qBAAqB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,qEAAqE;IACrE,kEAAkE;IAClE,qEAAqE;IACrE,kEAAkE;IAClE,6BAA6B;IAC7B,IAAI,0BAA0B,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"sink-filters.js","sourceRoot":"","sources":["../../src/security-scan/sink-filters.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,8EAA8E;AAC9E,4CAA4C;AAC5C,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,eAAe,GAAG,2BAA2B,CAAC;AACpD,6EAA6E;AAC7E,uEAAuE;AACvE,kEAAkE;AAClE,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,MAAM,UAAU,iBAAiB,CAAC,IAA+B;IAC/D,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,yDAAyD;IACzD,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,+CAA+C;IAC/C,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,sDAAsD;IACtD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,wDAAwD;AACxD,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,oBAAoB,GACxB,mEAAmE,CAAC;AAEtE,MAAM,UAAU,qBAAqB,CAAC,IAA+B;IACnE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC;AAkED;;;;GAIG;AACH,MAAM,oBAAoB,GAAG;IAC3B,eAAe;IACf,mBAAmB;IACnB,gBAAgB;IAChB,iBAAiB;IACjB,KAAK;IACL,gBAAgB;IAChB,iBAAiB;IACjB,MAAM;IACN,gBAAgB;IAChB,iBAAiB;IACjB,eAAe;IACf,oBAAoB;CACZ,CAAC;AAEX,MAAM,iBAAiB,GAAqB;IAC1C,uBAAuB;IACvB,EAAE,OAAO,EAAE,8BAA8B,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE;IACnF,EAAE,OAAO,EAAE,wCAAwC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE;IAE7F,mEAAmE;IACnE,EAAE,OAAO,EAAE,iCAAiC,EAAE,QAAQ,EAAE,mBAAmB,EAAE,GAAG,EAAE,KAAK,EAAE;IACzF,EAAE,OAAO,EAAE,2CAA2C,EAAE,QAAQ,EAAE,mBAAmB,EAAE,GAAG,EAAE,KAAK,EAAE;IACnG,EAAE,OAAO,EAAE,4CAA4C,EAAE,QAAQ,EAAE,mBAAmB,EAAE,GAAG,EAAE,KAAK,EAAE;IACpG,8DAA8D;IAC9D,sEAAsE;IACtE,4DAA4D;IAC5D,mEAAmE;IACnE,EAAE,OAAO,EAAE,+DAA+D,EAAE,QAAQ,EAAE,mBAAmB,EAAE,GAAG,EAAE,KAAK,EAAE;IAEvH,4DAA4D;IAC5D,+DAA+D;IAC/D,sEAAsE;IACtE,4DAA4D;IAC5D,gEAAgE;IAChE,2CAA2C;IAC3C,oEAAoE;IACpE,yDAAyD;IACzD,qDAAqD;IACrD;QACE,OAAO,EAAE,+FAA+F;QACxG,QAAQ,EAAE,eAAe;QACzB,GAAG,EAAE,KAAK;KACX;IAED,sDAAsD;IACtD,mEAAmE;IACnE,sEAAsE;IACtE,EAAE,OAAO,EAAE,qDAAqD,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,EAAE;IAC3G,2EAA2E;IAC3E,uDAAuD;IACvD,EAAE,OAAO,EAAE,kDAAkD,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,EAAE;IACxG,qCAAqC;IACrC,EAAE,OAAO,EAAE,oDAAoD,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,EAAE;IAC1G,0DAA0D;IAC1D,EAAE,OAAO,EAAE,6CAA6C,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,EAAE;IACnG,4CAA4C;IAC5C,EAAE,OAAO,EAAE,uDAAuD,EAAE,QAAQ,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,EAAE;IAE7G,8DAA8D;IAC9D,oEAAoE;IACpE,EAAE,OAAO,EAAE,uCAAuC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE;IAC5F,8DAA8D;IAC9D,sEAAsE;IACtE,kDAAkD;IAClD,EAAE,OAAO,EAAE,uDAAuD,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE;IAC5G,8EAA8E;IAC9E,EAAE,OAAO,EAAE,qDAAqD,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE;IAC1G,6DAA6D;IAC7D,sEAAsE;IACtE,2CAA2C;IAC3C,EAAE,OAAO,EAAE,gCAAgC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,KAAK,EAAE;IAErF,4DAA4D;IAC5D,+CAA+C;IAC/C,kDAAkD;IAClD,6DAA6D;IAC7D,iEAAiE;IACjE,qEAAqE;IACrE,iEAAiE;IACjE,oEAAoE;IACpE,gEAAgE;IAChE,kEAAkE;IAClE,uCAAuC;IACvC,EAAE;IACF,qBAAqB;IACrB,+CAA+C;IAC/C,mEAAmE;IACnE,8DAA8D;IAC9D,qEAAqE;IACrE,+DAA+D;IAC/D,gEAAgE;IAChE,yDAAyD;IACzD,EAAE;IACF,kEAAkE;IAClE,iEAAiE;IACjE,mCAAmC;IAEnC,4DAA4D;IAC5D;QACE,OAAO,EACL,iJAAiJ;QACnJ,QAAQ,EAAE,oBAAoB;QAC9B,GAAG,EAAE,MAAM;KACZ;IACD,gCAAgC;IAChC;QACE,OAAO,EACL,iKAAiK;QACnK,QAAQ,EAAE,oBAAoB;QAC9B,GAAG,EAAE,MAAM;KACZ;IACD,0EAA0E;IAC1E;QACE,OAAO,EACL,kIAAkI;QACpI,QAAQ,EAAE,oBAAoB;QAC9B,GAAG,EAAE,MAAM;KACZ;IACD,gCAAgC;IAChC;QACE,OAAO,EACL,wIAAwI;QAC1I,QAAQ,EAAE,oBAAoB;QAC9B,GAAG,EAAE,MAAM;KACZ;IAED,yEAAyE;IACzE,oEAAoE;IACpE,kEAAkE;IAClE,iEAAiE;IACjE,qEAAqE;IACrE,mEAAmE;IACnE,iCAAiC;IACjC,EAAE;IACF,8DAA8D;IAC9D,sEAAsE;IACtE,gEAAgE;IAChE,wEAAwE;IACxE,mEAAmE;IACnE,qEAAqE;IACrE,6DAA6D;IAC7D,4DAA4D;IAC5D,4DAA4D;IAC5D,kEAAkE;IAClE,wBAAwB;IACxB,EAAE;IACF,gEAAgE;IAChE,kEAAkE;IAClE,2DAA2D;IAC3D,oEAAoE;IACpE,sEAAsE;IACtE,gEAAgE;IAChE,mDAAmD;IACnD,EAAE;IACF,oEAAoE;IACpE,qCAAqC;IAErC,qDAAqD;IACrD;QACE,OAAO,EACL,sHAAsH;QACxH,QAAQ,EAAE,CAAC,eAAe,EAAE,gBAAgB,CAAC;QAC7C,GAAG,EAAE,WAAW;KACjB;IACD,qEAAqE;IACrE;QACE,OAAO,EAAE,4DAA4D;QACrE,QAAQ,EAAE,eAAe;QACzB,GAAG,EAAE,WAAW;KACjB;IACD,6DAA6D;IAC7D,iEAAiE;IACjE,+DAA+D;IAC/D,iEAAiE;IACjE,oEAAoE;IACpE;QACE,OAAO,EACL,+KAA+K;QACjL,QAAQ,EAAE,eAAe;QACzB,GAAG,EAAE,WAAW;KACjB;CACF,CAAC;AAEF,MAAM,UAAU,cAAc,CAC5B,IAA+B,EAC/B,QAAmC;IAEnC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC3C,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/B,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC5B,OAAO,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,uEAAuE;AACvE,yEAAyE;AACzE,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAElF;;;;;;;;;;;;;;GAcG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,SAAS;CACV,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,IAA+B;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAAmC,EACnC,QAAmC;IAEnC,IAAI,QAAQ,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,8EAA8E;AAC9E,2EAA2E;AAC3E,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,qCAAqC,GAAG,IAAI,GAAG,CAAC;IACpD,eAAe;IACf,iBAAiB;CAClB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,gBAAgB,GACpB,6LAA6L,CAAC;AAEhM,MAAM,wBAAwB,GAC5B,kDAAkD,CAAC;AAErD,MAAM,qBAAqB,GACzB,+FAA+F,CAAC;AAElG;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAmC,EACnC,QAAmC,EACnC,QAAmC;IAEnC,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,CAAC,qCAAqC,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,sEAAsE;IACtE,sEAAsE;IACtE,sEAAsE;IACtE,sEAAsE;IACtE,kEAAkE;IAClE,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,EAAE;AACF,sEAAsE;AACtE,uDAAuD;AACvD,0EAA0E;AAC1E,0CAA0C;AAC1C,2EAA2E;AAC3E,4EAA4E;AAE5E;;;mEAGmE;AACnE,MAAM,qBAAqB,GACzB,0EAA0E,CAAC;AAE7E;;yEAEyE;AACzE,MAAM,0BAA0B,GAAG,oCAAoC,CAAC;AAExE;;;wEAGwE;AACxE,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEzE;gDACgD;AAChD,MAAM,sBAAsB,GAC1B,yFAAyF,CAAC;AAE5F;;;;wDAIwD;AACxD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,WAAW;IACX,QAAQ;IACR,kBAAkB;IAClB,iBAAiB;IACjB,cAAc;IACd,eAAe;IACf,qBAAqB;IACrB,iBAAiB;IACjB,qBAAqB;IACrB,wBAAwB;IACxB,iBAAiB;CAClB,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAmC,EACnC,QAAmC;IAEnC,IAAI,QAAQ,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAmC,EACnC,QAAmC;IAEnC,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAmC,EACnC,QAAmC,EACnC,KAAkD,EAClD,QAAmC;IAEnC,IAAI,CAAC,QAAQ,IAAI,CAAC,8BAA8B,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,gCAAgC;IAChC,IAAI,QAAQ,IAAI,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,wEAAwE;IACxE,0EAA0E;IAC1E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,QAAQ,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;YAAE,SAAS;QACjC,IAAI,QAAQ,GAAG,CAAC,CAAC,UAAU,IAAI,QAAQ,GAAG,CAAC,CAAC,QAAQ;YAAE,SAAS;QAC/D,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YAChC,iEAAiE;YACjE,mEAAmE;YACnE,6BAA6B;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,qDAAqD;AACrD,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC;IAC7C,mBAAmB;IACnB,aAAa;IACb,UAAU;IACV,mBAAmB;IACnB,kBAAkB;IAClB,wEAAwE;IACxE,qEAAqE;IACrE,qCAAqC;CACtC,CAAC,CAAC;AAEH,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC;IAC9C,eAAe;IACf,gBAAgB;IAChB,mBAAmB;CACpB,CAAC,CAAC;AA4BH,MAAM,UAAU,0BAA0B,CACxC,KAAkD,EAClD,QAAmC,EACnC,QAAmC;IAEnC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,QAAQ,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,IAAI,CAAC,QAAQ,IAAI,CAAC,+BAA+B,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;YAAE,SAAS;QACjC,IAAI,QAAQ,GAAG,CAAC,CAAC,UAAU,IAAI,QAAQ,GAAG,CAAC,CAAC,QAAQ;YAAE,SAAS;QAC/D,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YAChC,iEAAiE;YACjE,6DAA6D;YAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,8BAA8B,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,2EAA2E;AAC3E,gDAAgD;AAChD,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,+BAA+B,GAAG,IAAI,GAAG,CAAC;IAC9C,KAAK;IACL,eAAe;IACf,SAAS;CACV,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,MAAM,wBAAwB,GAC5B,4DAA4D,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAqC,EACrC,KAAkD,EAClD,QAAmC;IAEnC,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,QAAQ,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAEjF,wEAAwE;IACxE,qEAAqE;IACrE,IAAI,eAAmC,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,QAAQ,GAAG,CAAC,CAAC,UAAU,IAAI,QAAQ,GAAG,CAAC,CAAC,QAAQ;YAAE,SAAS;QAC/D,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YAChC,IAAI,QAAQ,IAAI,CAAC,CAAC,UAAU,IAAI,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;gBACvD,eAAe,GAAG,CAAC,CAAC,UAAU,CAAC;gBAC/B,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,eAAe,KAAK,SAAS;YAAE,MAAM;IAC3C,CAAC;IACD,IAAI,eAAe,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAEhD,4EAA4E;IAC5E,yEAAyE;IACzE,mBAAmB;IACnB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,yBAAyB;IAC9E,KAAK,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAmC,EACnC,QAAmC,EACnC,QAAoC,EACpC,KAAuC,EACvC,QAAwB;AACxB,yEAAyE;AACzE,uEAAuE;AACvE,+CAA+C;AAC/C,UAA0B;IAE1B,IAAI,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,gEAAgE;IAChE,uEAAuE;IACvE,8DAA8D;IAC9D,gCAAgC;IAChC,IAAI,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,kEAAkE;IAClE,oEAAoE;IACpE,qEAAqE;IACrE,oEAAoE;IACpE,oEAAoE;IACpE,IAAI,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,uBAAuB,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,IAAI,qBAAqB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,iEAAiE;IACjE,uEAAuE;IACvE,yEAAyE;IACzE,sEAAsE;IACtE,2CAA2C;IAC3C,IAAI,0BAA0B,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,qEAAqE;IACrE,gEAAgE;IAChE,sEAAsE;IACtE,IACE,QAAQ;QACR,+BAA+B,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC7C,yBAAyB,CAAC,UAAU,EAAE,KAAK,EAAE,QAAQ,CAAC,EACtD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/trust/passes/input-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"input-validation.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/input-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,KAAK,eAAe,EAGrB,MAAM,aAAa,CAAC;AAMrB,yEAAyE;AACzE,QAAA,MAAM,aAAa,EAAE,GAAG,CAAC,MAAM,CAW7B,CAAC;AAEH,8DAA8D;AAC9D,QAAA,MAAM,cAAc,EAAE,GAAG,CAAC,MAAM,CAE9B,CAAC;AACH,QAAA,MAAM,UAAU,EAAE,GAAG,CAAC,MAAM,CAE1B,CAAC;AAMH,MAAM,WAAW,sBAAsB;IACrC,oCAAoC;IACpC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;CAC9B;AAgBD,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,eAAe,CAAC,CAuF1B;AAGD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC"}
+{"version":3,"file":"input-validation.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/input-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,KAAK,eAAe,EAGrB,MAAM,aAAa,CAAC;AAOrB,yEAAyE;AACzE,QAAA,MAAM,aAAa,EAAE,GAAG,CAAC,MAAM,CAW7B,CAAC;AAEH,8DAA8D;AAC9D,QAAA,MAAM,cAAc,EAAE,GAAG,CAAC,MAAM,CAE9B,CAAC;AACH,QAAA,MAAM,UAAU,EAAE,GAAG,CAAC,MAAM,CAE1B,CAAC;AAMH,MAAM,WAAW,sBAAsB;IACrC,oCAAoC;IACpC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;CAC9B;AAgBD,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,eAAe,CAAC,CA4G1B;AAGD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC"}

package/dist/trust/passes/input-validation.js

@@ -9,6 +9,7 @@
  *
  * Falls back gracefully (score 100 + info) when no CircleIR data is available.
  */
+import { isBrowserQueryApi } from '../../security-scan/sink-filters.js';
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -67,9 +68,29 @@ export async function inputValidationPass(projectPath, options = {}) {
     let sanitizedFlows = 0;
     for (const ir of options.circleIRResults) {
         const file = ir.meta?.file ?? 'unknown';
+        // cognium-ai#186: build a line -> sink.code lookup so we can gate flows
+        // through `isBrowserQueryApi`. Same file resolves to the same sink line
+        // regardless of which source flowed into it, so a Map keyed on sink_line
+        // is enough. Missing sinks (line absent from the map) fall through to
+        // pre-#186 behavior.
+        const sinksByLine = new Map();
+        for (const sink of ir.taint?.sinks ?? []) {
+            if (typeof sink.line === 'number' && typeof sink.code === 'string') {
+                sinksByLine.set(sink.line, sink.code);
+            }
+        }
         for (const flow of ir.taint?.flows ?? []) {
             if (!INPUT_SOURCES.has(flow.source_type))
                 continue;
+            // cognium-ai#186: browser `.query()` / `querySelector*` on renderer
+            // file types (`.ts` / `.js` / `.html` / `.vue` / …) — Chrome extension
+            // APIs and Web APIs share the `.query()` method name with SQL drivers.
+            // Drop the flow entirely (not counted in totalFlows) so the coverage
+            // score isn't dragged down by a non-vulnerability. Guarded on the
+            // presence of sink.code — without it the filter is a no-op.
+            const sinkCode = sinksByLine.get(flow.sink_line);
+            if (isBrowserQueryApi(sinkCode, flow.sink_type, file))
+                continue;
             totalFlows++;
             if (flow.sanitized) {
                 sanitizedFlows++;

package/dist/trust/passes/input-validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"input-validation.js","sourceRoot":"","sources":["../../../src/trust/passes/input-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,yEAAyE;AACzE,MAAM,aAAa,GAAgB,IAAI,GAAG,CAAC;IACzC,YAAY;IACZ,cAAc;IACd,aAAa;IACb,aAAa;IACb,WAAW;IACX,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,WAAW;IACX,YAAY;CACb,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,cAAc,GAAgB,IAAI,GAAG,CAAC;IAC1C,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB;CAC1E,CAAC,CAAC;AACH,MAAM,UAAU,GAAgB,IAAI,GAAG,CAAC;IACtC,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB;CAC5E,CAAC,CAAC;AAWH,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,UAAU,CAAC;IACpD,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB,EACnB,UAAkC,EAAE;IAEpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,MAAM,WAAW,GACf,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,CAAC;oBACT,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,aAAa;oBACrB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,0EAA0E;oBACnF,IAAI,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;iBACrC,CAAC;YACF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,eAAgB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,SAAS,CAAC;QAExC,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;gBAAE,SAAS;YAEnD,UAAU,EAAE,CAAC;YAEb,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,cAAc,EAAE,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC9C,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,eAAe,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC,SAAS,EAAE;oBAC9D,QAAQ;oBACR,OAAO,EAAE,eAAe,IAAI,CAAC,WAAW,YAAY,IAAI,CAAC,SAAS,OAAO,IAAI,UAAU,IAAI,CAAC,WAAW,WAAW,IAAI,CAAC,SAAS,GAAG;oBACnI,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE;oBAC1C,IAAI,EAAE;wBACJ,UAAU,EAAE,IAAI,CAAC,WAAW;wBAC5B,QAAQ,EAAE,IAAI,CAAC,SAAS;wBACxB,UAAU,EAAE,IAAI,CAAC,WAAW;wBAC5B,QAAQ,EAAE,IAAI,CAAC,SAAS;qBACzB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,CAAC;oBACT,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,gBAAgB;oBACxB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,kDAAkD;oBAC3D,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;iBACxB,CAAC;YACF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,wCAAwC;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,cAAc,GAAG,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC;IAE9D,uBAAuB;IACvB,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,qBAAqB;QAC7B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,8BAA8B,cAAc,IAAI,UAAU,qBAAqB,KAAK,IAAI;QACjG,IAAI,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,GAAG,UAAU,EAAE;KACjF,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,KAAK;QACL,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,sBAAsB;AACtB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC"}
+{"version":3,"file":"input-validation.js","sourceRoot":"","sources":["../../../src/trust/passes/input-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAExE,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,yEAAyE;AACzE,MAAM,aAAa,GAAgB,IAAI,GAAG,CAAC;IACzC,YAAY;IACZ,cAAc;IACd,aAAa;IACb,aAAa;IACb,WAAW;IACX,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,WAAW;IACX,YAAY;CACb,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,cAAc,GAAgB,IAAI,GAAG,CAAC;IAC1C,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB;CAC1E,CAAC,CAAC;AACH,MAAM,UAAU,GAAgB,IAAI,GAAG,CAAC;IACtC,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB;CAC5E,CAAC,CAAC;AAWH,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,UAAU,CAAC;IACpD,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB,EACnB,UAAkC,EAAE;IAEpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,MAAM,WAAW,GACf,OAAO,CAAC,eAAe,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,CAAC;oBACT,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,aAAa;oBACrB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,0EAA0E;oBACnF,IAAI,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;iBACrC,CAAC;YACF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,eAAgB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,SAAS,CAAC;QAExC,wEAAwE;QACxE,wEAAwE;QACxE,yEAAyE;QACzE,sEAAsE;QACtE,qBAAqB;QACrB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;gBAAE,SAAS;YAEnD,oEAAoE;YACpE,uEAAuE;YACvE,uEAAuE;YACvE,qEAAqE;YACrE,kEAAkE;YAClE,4DAA4D;YAC5D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC;gBAAE,SAAS;YAEhE,UAAU,EAAE,CAAC;YAEb,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACnB,cAAc,EAAE,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC9C,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,eAAe,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC,SAAS,EAAE;oBAC9D,QAAQ;oBACR,OAAO,EAAE,eAAe,IAAI,CAAC,WAAW,YAAY,IAAI,CAAC,SAAS,OAAO,IAAI,UAAU,IAAI,CAAC,WAAW,WAAW,IAAI,CAAC,SAAS,GAAG;oBACnI,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE;oBAC1C,IAAI,EAAE;wBACJ,UAAU,EAAE,IAAI,CAAC,WAAW;wBAC5B,QAAQ,EAAE,IAAI,CAAC,SAAS;wBACxB,UAAU,EAAE,IAAI,CAAC,WAAW;wBAC5B,QAAQ,EAAE,IAAI,CAAC,SAAS;qBACzB;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,CAAC;oBACT,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,gBAAgB;oBACxB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,kDAAkD;oBAC3D,IAAI,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;iBACxB,CAAC;YACF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,wCAAwC;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,cAAc,GAAG,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC;IAE9D,uBAAuB;IACvB,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,qBAAqB;QAC7B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,8BAA8B,cAAc,IAAI,UAAU,qBAAqB,KAAK,IAAI;QACjG,IAAI,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,cAAc,GAAG,UAAU,EAAE;KACjF,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,KAAK;QACL,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,sBAAsB;AACtB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir-ai",
-  "version": "2.33.4",
+  "version": "2.34.0",
   "description": "LLM-enhanced SAST analysis built on circle-ir",
   "main": "dist/index.js",
   "module": "dist/index.js",
@@ -97,7 +97,7 @@
     "@ax-llm/ax": "^20.0.0",
     "@cognium/project-profile-detect": "^1.1.0",
     "@mastra/core": "^1.18.0",
-    "circle-ir": "3.148.0",
+    "circle-ir": "3.150.0",
     "minimatch": "^10.2.5",
     "p-queue": "^9.1.0"
   },