circle-ir 3.1.0

package/dist/languages/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Language Plugin System
+ *
+ * Provides multi-language support through a plugin architecture.
+ * Each language (Java, JavaScript, Python, Rust) has its own plugin
+ * that handles AST node types, taint patterns, and framework detection.
+ */
+export type { SupportedLanguage, LanguageNodeTypes, LanguagePlugin, LanguageRegistry, ExtractionContext, FrameworkInfo, TaintSourcePattern, TaintSinkPattern, } from './types.js';
+export { getLanguageRegistry, registerLanguage, getLanguagePlugin, getLanguageForFile, detectLanguage, isLanguageSupported, } from './registry.js';
+export { JavaPlugin, JavaScriptPlugin, PythonPlugin, RustPlugin, registerBuiltinPlugins, } from './plugins/index.js';
+export { BaseLanguagePlugin } from './plugins/base.js';

package/dist/languages/index.js

@@ -0,0 +1,14 @@
+/**
+ * Language Plugin System
+ *
+ * Provides multi-language support through a plugin architecture.
+ * Each language (Java, JavaScript, Python, Rust) has its own plugin
+ * that handles AST node types, taint patterns, and framework detection.
+ */
+// Registry functions
+export { getLanguageRegistry, registerLanguage, getLanguagePlugin, getLanguageForFile, detectLanguage, isLanguageSupported, } from './registry.js';
+// Concrete plugins
+export { JavaPlugin, JavaScriptPlugin, PythonPlugin, RustPlugin, registerBuiltinPlugins, } from './plugins/index.js';
+// Base class for custom plugins
+export { BaseLanguagePlugin } from './plugins/base.js';
+//# sourceMappingURL=index.js.map

package/dist/languages/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/languages/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAcH,qBAAqB;AACrB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB,mBAAmB;AACnB,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAE5B,gCAAgC;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/languages/plugins/base.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Base Language Plugin
+ *
+ * Provides common functionality for all language plugins.
+ */
+import type { Parser, Node as SyntaxNode } from 'web-tree-sitter';
+import type { TypeInfo, CallInfo, ImportInfo } from '../../types/index.js';
+import type { LanguagePlugin, LanguageNodeTypes, ExtractionContext, FrameworkInfo, TaintSourcePattern, TaintSinkPattern, SupportedLanguage } from '../types.js';
+/**
+ * Abstract base class for language plugins.
+ * Provides default implementations for common methods.
+ */
+export declare abstract class BaseLanguagePlugin implements LanguagePlugin {
+    abstract readonly id: SupportedLanguage;
+    abstract readonly name: string;
+    abstract readonly extensions: string[];
+    abstract readonly wasmPath: string;
+    abstract readonly nodeTypes: LanguageNodeTypes;
+    protected parser: Parser | null;
+    initialize(parser: Parser): Promise<void>;
+    canHandle(filePath: string): boolean;
+    abstract extractTypes(context: ExtractionContext): TypeInfo[];
+    abstract extractCalls(context: ExtractionContext): CallInfo[];
+    abstract extractImports(context: ExtractionContext): ImportInfo[];
+    abstract extractPackage(context: ExtractionContext): string | undefined;
+    abstract getBuiltinSources(): TaintSourcePattern[];
+    abstract getBuiltinSinks(): TaintSinkPattern[];
+    detectFramework(context: ExtractionContext): FrameworkInfo | undefined;
+    getReceiverType(node: SyntaxNode, context: ExtractionContext): string | undefined;
+    isStringLiteral(node: SyntaxNode): boolean;
+    getStringValue(node: SyntaxNode): string | undefined;
+    /**
+     * Helper to get text from a node
+     */
+    protected getNodeText(node: SyntaxNode): string;
+    /**
+     * Helper to find all nodes of a given type
+     */
+    protected findNodes(root: SyntaxNode, type: string): SyntaxNode[];
+    /**
+     * Helper to find first child of given type
+     */
+    protected findChildByType(node: SyntaxNode, type: string): SyntaxNode | null;
+}

package/dist/languages/plugins/base.js

@@ -0,0 +1,82 @@
+/**
+ * Base Language Plugin
+ *
+ * Provides common functionality for all language plugins.
+ */
+/**
+ * Abstract base class for language plugins.
+ * Provides default implementations for common methods.
+ */
+export class BaseLanguagePlugin {
+    parser = null;
+    async initialize(parser) {
+        this.parser = parser;
+    }
+    canHandle(filePath) {
+        const lowerPath = filePath.toLowerCase();
+        return this.extensions.some(ext => {
+            const normalizedExt = ext.startsWith('.') ? ext : `.${ext}`;
+            return lowerPath.endsWith(normalizedExt);
+        });
+    }
+    // Default implementations for optional methods
+    detectFramework(context) {
+        return undefined;
+    }
+    getReceiverType(node, context) {
+        return undefined;
+    }
+    isStringLiteral(node) {
+        return node.type === 'string_literal' || node.type === 'string';
+    }
+    getStringValue(node) {
+        if (!this.isStringLiteral(node))
+            return undefined;
+        const text = node.text;
+        // Remove quotes
+        if ((text.startsWith('"') && text.endsWith('"')) ||
+            (text.startsWith("'") && text.endsWith("'"))) {
+            return text.slice(1, -1);
+        }
+        return text;
+    }
+    /**
+     * Helper to get text from a node
+     */
+    getNodeText(node) {
+        return node.text;
+    }
+    /**
+     * Helper to find all nodes of a given type
+     */
+    findNodes(root, type) {
+        const nodes = [];
+        const cursor = root.walk();
+        const visit = () => {
+            if (cursor.nodeType === type) {
+                nodes.push(cursor.currentNode);
+            }
+            if (cursor.gotoFirstChild()) {
+                do {
+                    visit();
+                } while (cursor.gotoNextSibling());
+                cursor.gotoParent();
+            }
+        };
+        visit();
+        return nodes;
+    }
+    /**
+     * Helper to find first child of given type
+     */
+    findChildByType(node, type) {
+        for (let i = 0; i < node.childCount; i++) {
+            const child = node.child(i);
+            if (child?.type === type) {
+                return child;
+            }
+        }
+        return null;
+    }
+}
+//# sourceMappingURL=base.js.map

package/dist/languages/plugins/base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../src/languages/plugins/base.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkBH;;;GAGG;AACH,MAAM,OAAgB,kBAAkB;IAO5B,MAAM,GAAkB,IAAI,CAAC;IAEvC,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,SAAS,CAAC,QAAgB;QACxB,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YAChC,MAAM,aAAa,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;YAC5D,OAAO,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACL,CAAC;IAUD,+CAA+C;IAC/C,eAAe,CAAC,OAA0B;QACxC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,eAAe,CAAC,IAAgB,EAAE,OAA0B;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,eAAe,CAAC,IAAgB;QAC9B,OAAO,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC;IAClE,CAAC;IAED,cAAc,CAAC,IAAgB;QAC7B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,gBAAgB;QAChB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5C,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACO,WAAW,CAAC,IAAgB;QACpC,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;OAEG;IACO,SAAS,CAAC,IAAgB,EAAE,IAAY;QAChD,MAAM,KAAK,GAAiB,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE3B,MAAM,KAAK,GAAG,GAAS,EAAE;YACvB,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC7B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACjC,CAAC;YACD,IAAI,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC5B,GAAG,CAAC;oBACF,KAAK,EAAE,CAAC;gBACV,CAAC,QAAQ,MAAM,CAAC,eAAe,EAAE,EAAE;gBACnC,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,CAAC;QACH,CAAC,CAAC;QAEF,KAAK,EAAE,CAAC;QACR,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACO,eAAe,CAAC,IAAgB,EAAE,IAAY;QACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,KAAK,EAAE,IAAI,KAAK,IAAI,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/languages/plugins/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Language Plugins - Concrete implementations
+ *
+ * Exports all language plugins and provides initialization helpers.
+ */
+export { JavaPlugin } from './java.js';
+export { JavaScriptPlugin } from './javascript.js';
+export { PythonPlugin } from './python.js';
+export { RustPlugin } from './rust.js';
+/**
+ * Register all built-in language plugins with the global registry.
+ * Call this during analyzer initialization.
+ */
+export declare function registerBuiltinPlugins(): void;

package/dist/languages/plugins/index.js

@@ -0,0 +1,25 @@
+/**
+ * Language Plugins - Concrete implementations
+ *
+ * Exports all language plugins and provides initialization helpers.
+ */
+export { JavaPlugin } from './java.js';
+export { JavaScriptPlugin } from './javascript.js';
+export { PythonPlugin } from './python.js';
+export { RustPlugin } from './rust.js';
+import { registerLanguage } from '../registry.js';
+import { JavaPlugin } from './java.js';
+import { JavaScriptPlugin } from './javascript.js';
+import { PythonPlugin } from './python.js';
+import { RustPlugin } from './rust.js';
+/**
+ * Register all built-in language plugins with the global registry.
+ * Call this during analyzer initialization.
+ */
+export function registerBuiltinPlugins() {
+    registerLanguage(new JavaPlugin());
+    registerLanguage(new JavaScriptPlugin());
+    registerLanguage(new PythonPlugin());
+    registerLanguage(new RustPlugin());
+}
+//# sourceMappingURL=index.js.map

package/dist/languages/plugins/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/languages/plugins/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,gBAAgB,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC;IACnC,gBAAgB,CAAC,IAAI,gBAAgB,EAAE,CAAC,CAAC;IACzC,gBAAgB,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC;IACrC,gBAAgB,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC;AACrC,CAAC"}

package/dist/languages/plugins/java.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Java Language Plugin
+ *
+ * Provides Java-specific AST handling, taint patterns, and framework detection.
+ */
+import type { Node as SyntaxNode } from 'web-tree-sitter';
+import type { TypeInfo, CallInfo, ImportInfo } from '../../types/index.js';
+import type { LanguageNodeTypes, ExtractionContext, FrameworkInfo, TaintSourcePattern, TaintSinkPattern } from '../types.js';
+import { BaseLanguagePlugin } from './base.js';
+/**
+ * Java language plugin implementation.
+ */
+export declare class JavaPlugin extends BaseLanguagePlugin {
+    readonly id: "java";
+    readonly name = "Java";
+    readonly extensions: string[];
+    readonly wasmPath = "tree-sitter-java.wasm";
+    readonly nodeTypes: LanguageNodeTypes;
+    /**
+     * Detect Java frameworks from imports and annotations.
+     */
+    detectFramework(context: ExtractionContext): FrameworkInfo | undefined;
+    /**
+     * Java-specific taint source patterns.
+     * These supplement the YAML configuration.
+     */
+    getBuiltinSources(): TaintSourcePattern[];
+    /**
+     * Java-specific taint sink patterns.
+     * These supplement the YAML configuration.
+     */
+    getBuiltinSinks(): TaintSinkPattern[];
+    /**
+     * Get receiver type from a method invocation node.
+     */
+    getReceiverType(node: SyntaxNode, context: ExtractionContext): string | undefined;
+    /**
+     * Check if node is a Java string literal.
+     */
+    isStringLiteral(node: SyntaxNode): boolean;
+    /**
+     * Get string value from Java string literal.
+     */
+    getStringValue(node: SyntaxNode): string | undefined;
+    extractTypes(context: ExtractionContext): TypeInfo[];
+    extractCalls(context: ExtractionContext): CallInfo[];
+    extractImports(context: ExtractionContext): ImportInfo[];
+    extractPackage(context: ExtractionContext): string | undefined;
+}

package/dist/languages/plugins/java.js

@@ -0,0 +1,402 @@
+/**
+ * Java Language Plugin
+ *
+ * Provides Java-specific AST handling, taint patterns, and framework detection.
+ */
+import { BaseLanguagePlugin } from './base.js';
+/**
+ * Java language plugin implementation.
+ */
+export class JavaPlugin extends BaseLanguagePlugin {
+    id = 'java';
+    name = 'Java';
+    extensions = ['.java'];
+    wasmPath = 'tree-sitter-java.wasm';
+    nodeTypes = {
+        // Type declarations
+        classDeclaration: ['class_declaration'],
+        interfaceDeclaration: ['interface_declaration'],
+        enumDeclaration: ['enum_declaration'],
+        functionDeclaration: [],
+        methodDeclaration: ['method_declaration', 'constructor_declaration'],
+        // Expressions
+        methodCall: ['method_invocation'],
+        functionCall: [],
+        assignment: ['assignment_expression'],
+        variableDeclaration: ['local_variable_declaration', 'field_declaration'],
+        // Parameters and arguments
+        parameter: ['formal_parameter', 'spread_parameter'],
+        argument: ['argument_list'],
+        // Annotations/decorators
+        annotation: ['marker_annotation', 'annotation'],
+        decorator: [],
+        // Imports
+        importStatement: ['import_declaration'],
+        // Control flow
+        ifStatement: ['if_statement'],
+        forStatement: ['for_statement', 'enhanced_for_statement'],
+        whileStatement: ['while_statement'],
+        tryStatement: ['try_statement', 'try_with_resources_statement'],
+        returnStatement: ['return_statement'],
+    };
+    /**
+     * Detect Java frameworks from imports and annotations.
+     */
+    detectFramework(context) {
+        const indicators = [];
+        let framework;
+        let confidence = 0;
+        // Check imports for framework patterns
+        for (const imp of context.imports) {
+            const path = imp.from_package || imp.imported_name;
+            // Spring Framework
+            if (path.startsWith('org.springframework')) {
+                framework = 'spring';
+                confidence = Math.max(confidence, 0.9);
+                indicators.push(`import: ${path}`);
+            }
+            // Jakarta EE / Java EE
+            if (path.startsWith('jakarta.') || path.startsWith('javax.')) {
+                if (path.includes('servlet')) {
+                    framework = framework || 'servlet';
+                    confidence = Math.max(confidence, 0.8);
+                    indicators.push(`import: ${path}`);
+                }
+                if (path.includes('ws.rs')) {
+                    framework = 'jax-rs';
+                    confidence = Math.max(confidence, 0.85);
+                    indicators.push(`import: ${path}`);
+                }
+            }
+            // Struts
+            if (path.startsWith('org.apache.struts')) {
+                framework = 'struts';
+                confidence = Math.max(confidence, 0.85);
+                indicators.push(`import: ${path}`);
+            }
+            // Quarkus
+            if (path.startsWith('io.quarkus')) {
+                framework = 'quarkus';
+                confidence = Math.max(confidence, 0.85);
+                indicators.push(`import: ${path}`);
+            }
+        }
+        if (framework) {
+            return { name: framework, confidence, indicators };
+        }
+        return undefined;
+    }
+    /**
+     * Java-specific taint source patterns.
+     * These supplement the YAML configuration.
+     */
+    getBuiltinSources() {
+        return [
+            // Spring MVC annotations
+            {
+                annotation: 'RequestParam',
+                type: 'http_param',
+                severity: 'high',
+                confidence: 0.95,
+                returnTainted: true,
+            },
+            {
+                annotation: 'RequestBody',
+                type: 'http_body',
+                severity: 'high',
+                confidence: 0.95,
+                returnTainted: true,
+            },
+            {
+                annotation: 'PathVariable',
+                type: 'http_path',
+                severity: 'high',
+                confidence: 0.95,
+                returnTainted: true,
+            },
+            {
+                annotation: 'RequestHeader',
+                type: 'http_header',
+                severity: 'high',
+                confidence: 0.9,
+                returnTainted: true,
+            },
+            {
+                annotation: 'CookieValue',
+                type: 'http_cookie',
+                severity: 'high',
+                confidence: 0.9,
+                returnTainted: true,
+            },
+            {
+                annotation: 'MatrixVariable',
+                type: 'http_param',
+                severity: 'high',
+                confidence: 0.85,
+                returnTainted: true,
+            },
+            // JAX-RS annotations
+            {
+                annotation: 'QueryParam',
+                type: 'http_param',
+                severity: 'high',
+                confidence: 0.95,
+                returnTainted: true,
+            },
+            {
+                annotation: 'PathParam',
+                type: 'http_path',
+                severity: 'high',
+                confidence: 0.95,
+                returnTainted: true,
+            },
+            {
+                annotation: 'FormParam',
+                type: 'http_body',
+                severity: 'high',
+                confidence: 0.95,
+                returnTainted: true,
+            },
+            {
+                annotation: 'HeaderParam',
+                type: 'http_header',
+                severity: 'high',
+                confidence: 0.9,
+                returnTainted: true,
+            },
+            // Servlet API
+            {
+                method: 'getParameter',
+                class: 'HttpServletRequest',
+                type: 'http_param',
+                severity: 'high',
+                confidence: 0.95,
+                returnTainted: true,
+            },
+            {
+                method: 'getParameterValues',
+                class: 'HttpServletRequest',
+                type: 'http_param',
+                severity: 'high',
+                confidence: 0.95,
+                returnTainted: true,
+            },
+            {
+                method: 'getHeader',
+                class: 'HttpServletRequest',
+                type: 'http_header',
+                severity: 'high',
+                confidence: 0.9,
+                returnTainted: true,
+            },
+            {
+                method: 'getCookies',
+                class: 'HttpServletRequest',
+                type: 'http_cookie',
+                severity: 'high',
+                confidence: 0.9,
+                returnTainted: true,
+            },
+            {
+                method: 'getInputStream',
+                class: 'HttpServletRequest',
+                type: 'http_body',
+                severity: 'high',
+                confidence: 0.85,
+                returnTainted: true,
+            },
+            {
+                method: 'getReader',
+                class: 'HttpServletRequest',
+                type: 'http_body',
+                severity: 'high',
+                confidence: 0.85,
+                returnTainted: true,
+            },
+        ];
+    }
+    /**
+     * Java-specific taint sink patterns.
+     * These supplement the YAML configuration.
+     */
+    getBuiltinSinks() {
+        return [
+            // SQL Injection
+            {
+                method: 'executeQuery',
+                class: 'Statement',
+                type: 'sql_injection',
+                cwe: 'CWE-89',
+                severity: 'critical',
+                argPositions: [0],
+            },
+            {
+                method: 'executeUpdate',
+                class: 'Statement',
+                type: 'sql_injection',
+                cwe: 'CWE-89',
+                severity: 'critical',
+                argPositions: [0],
+            },
+            {
+                method: 'execute',
+                class: 'Statement',
+                type: 'sql_injection',
+                cwe: 'CWE-89',
+                severity: 'critical',
+                argPositions: [0],
+            },
+            // Command Injection
+            {
+                method: 'exec',
+                class: 'Runtime',
+                type: 'command_injection',
+                cwe: 'CWE-78',
+                severity: 'critical',
+                argPositions: [0],
+            },
+            {
+                method: 'start',
+                class: 'ProcessBuilder',
+                type: 'command_injection',
+                cwe: 'CWE-78',
+                severity: 'critical',
+                argPositions: [], // Constructor args are dangerous
+            },
+            // Path Traversal
+            {
+                method: 'FileInputStream',
+                type: 'path_traversal',
+                cwe: 'CWE-22',
+                severity: 'high',
+                argPositions: [0],
+            },
+            {
+                method: 'FileOutputStream',
+                type: 'path_traversal',
+                cwe: 'CWE-22',
+                severity: 'high',
+                argPositions: [0],
+            },
+            // XSS
+            {
+                method: 'write',
+                class: 'PrintWriter',
+                type: 'xss',
+                cwe: 'CWE-79',
+                severity: 'high',
+                argPositions: [0],
+            },
+            {
+                method: 'println',
+                class: 'PrintWriter',
+                type: 'xss',
+                cwe: 'CWE-79',
+                severity: 'high',
+                argPositions: [0],
+            },
+            // LDAP Injection
+            {
+                method: 'search',
+                class: 'DirContext',
+                type: 'ldap_injection',
+                cwe: 'CWE-90',
+                severity: 'high',
+                argPositions: [0, 1],
+            },
+            // XPath Injection
+            {
+                method: 'evaluate',
+                class: 'XPath',
+                type: 'xpath_injection',
+                cwe: 'CWE-643',
+                severity: 'high',
+                argPositions: [0],
+            },
+            // Deserialization
+            {
+                method: 'readObject',
+                class: 'ObjectInputStream',
+                type: 'deserialization',
+                cwe: 'CWE-502',
+                severity: 'critical',
+                argPositions: [],
+            },
+        ];
+    }
+    /**
+     * Get receiver type from a method invocation node.
+     */
+    getReceiverType(node, context) {
+        if (node.type !== 'method_invocation')
+            return undefined;
+        const receiver = node.childForFieldName('object');
+        if (!receiver)
+            return undefined;
+        // If receiver is an identifier, look up its type
+        if (receiver.type === 'identifier') {
+            const name = receiver.text;
+            // Try to find variable declaration to get type
+            // This is a simplified lookup - full implementation would use scope analysis
+            return undefined; // TODO: Implement type resolution
+        }
+        // If receiver is a field access, return the field type
+        if (receiver.type === 'field_access') {
+            return receiver.text;
+        }
+        return undefined;
+    }
+    /**
+     * Check if node is a Java string literal.
+     */
+    isStringLiteral(node) {
+        return node.type === 'string_literal';
+    }
+    /**
+     * Get string value from Java string literal.
+     */
+    getStringValue(node) {
+        if (node.type !== 'string_literal')
+            return undefined;
+        const text = node.text;
+        // Remove surrounding quotes
+        if (text.startsWith('"') && text.endsWith('"')) {
+            return text.slice(1, -1);
+        }
+        return text;
+    }
+    // Extraction methods - delegate to existing extractors for now
+    // These will be migrated into the plugin in future iterations
+    extractTypes(context) {
+        // Delegated to existing extractor
+        return [];
+    }
+    extractCalls(context) {
+        // Delegated to existing extractor
+        return [];
+    }
+    extractImports(context) {
+        // Delegated to existing extractor
+        return [];
+    }
+    extractPackage(context) {
+        // Find package declaration in tree
+        const packages = this.findNodes(context.tree.rootNode, 'package_declaration');
+        if (packages.length === 0)
+            return undefined;
+        const pkgDecl = packages[0];
+        const nameNode = pkgDecl.childForFieldName('name');
+        if (nameNode) {
+            return this.getNodeText(nameNode);
+        }
+        // Fallback: find scoped_identifier or identifier
+        for (let i = 0; i < pkgDecl.childCount; i++) {
+            const child = pkgDecl.child(i);
+            if (child && (child.type === 'scoped_identifier' || child.type === 'identifier')) {
+                return this.getNodeText(child);
+            }
+        }
+        return undefined;
+    }
+}
+//# sourceMappingURL=java.js.map

package/dist/languages/plugins/java.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"java.js","sourceRoot":"","sources":["../../../src/languages/plugins/java.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C;;GAEG;AACH,MAAM,OAAO,UAAW,SAAQ,kBAAkB;IACvC,EAAE,GAAG,MAAe,CAAC;IACrB,IAAI,GAAG,MAAM,CAAC;IACd,UAAU,GAAG,CAAC,OAAO,CAAC,CAAC;IACvB,QAAQ,GAAG,uBAAuB,CAAC;IAEnC,SAAS,GAAsB;QACtC,oBAAoB;QACpB,gBAAgB,EAAE,CAAC,mBAAmB,CAAC;QACvC,oBAAoB,EAAE,CAAC,uBAAuB,CAAC;QAC/C,eAAe,EAAE,CAAC,kBAAkB,CAAC;QACrC,mBAAmB,EAAE,EAAE;QACvB,iBAAiB,EAAE,CAAC,oBAAoB,EAAE,yBAAyB,CAAC;QAEpE,cAAc;QACd,UAAU,EAAE,CAAC,mBAAmB,CAAC;QACjC,YAAY,EAAE,EAAE;QAChB,UAAU,EAAE,CAAC,uBAAuB,CAAC;QACrC,mBAAmB,EAAE,CAAC,4BAA4B,EAAE,mBAAmB,CAAC;QAExE,2BAA2B;QAC3B,SAAS,EAAE,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;QACnD,QAAQ,EAAE,CAAC,eAAe,CAAC;QAE3B,yBAAyB;QACzB,UAAU,EAAE,CAAC,mBAAmB,EAAE,YAAY,CAAC;QAC/C,SAAS,EAAE,EAAE;QAEb,UAAU;QACV,eAAe,EAAE,CAAC,oBAAoB,CAAC;QAEvC,eAAe;QACf,WAAW,EAAE,CAAC,cAAc,CAAC;QAC7B,YAAY,EAAE,CAAC,eAAe,EAAE,wBAAwB,CAAC;QACzD,cAAc,EAAE,CAAC,iBAAiB,CAAC;QACnC,YAAY,EAAE,CAAC,eAAe,EAAE,8BAA8B,CAAC;QAC/D,eAAe,EAAE,CAAC,kBAAkB,CAAC;KACtC,CAAC;IAEF;;OAEG;IACH,eAAe,CAAC,OAA0B;QACxC,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,SAA6B,CAAC;QAClC,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,uCAAuC;QACvC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,aAAa,CAAC;YAEnD,mBAAmB;YACnB,IAAI,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBAC3C,SAAS,GAAG,QAAQ,CAAC;gBACrB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;YAED,uBAAuB;YACvB,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7D,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC7B,SAAS,GAAG,SAAS,IAAI,SAAS,CAAC;oBACnC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;oBACvC,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;gBACrC,CAAC;gBACD,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3B,SAAS,GAAG,QAAQ,CAAC;oBACrB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;oBACxC,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;YAED,SAAS;YACT,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACzC,SAAS,GAAG,QAAQ,CAAC;gBACrB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;YAED,UAAU;YACV,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAClC,SAAS,GAAG,SAAS,CAAC;gBACtB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QACrD,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,iBAAiB;QACf,OAAO;YACL,yBAAyB;YACzB;gBACE,UAAU,EAAE,cAAc;gBAC1B,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,UAAU,EAAE,aAAa;gBACzB,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,UAAU,EAAE,cAAc;gBAC1B,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,UAAU,EAAE,eAAe;gBAC3B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,UAAU,EAAE,aAAa;gBACzB,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,UAAU,EAAE,gBAAgB;gBAC5B,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YAED,qBAAqB;YACrB;gBACE,UAAU,EAAE,YAAY;gBACxB,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,UAAU,EAAE,WAAW;gBACvB,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,UAAU,EAAE,WAAW;gBACvB,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,UAAU,EAAE,aAAa;gBACzB,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YAED,cAAc;YACd;gBACE,MAAM,EAAE,cAAc;gBACtB,KAAK,EAAE,oBAAoB;gBAC3B,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,oBAAoB;gBAC5B,KAAK,EAAE,oBAAoB;gBAC3B,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,WAAW;gBACnB,KAAK,EAAE,oBAAoB;gBAC3B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,YAAY;gBACpB,KAAK,EAAE,oBAAoB;gBAC3B,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,gBAAgB;gBACxB,KAAK,EAAE,oBAAoB;gBAC3B,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,WAAW;gBACnB,KAAK,EAAE,oBAAoB;gBAC3B,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,eAAe;QACb,OAAO;YACL,gBAAgB;YAChB;gBACE,MAAM,EAAE,cAAc;gBACtB,KAAK,EAAE,WAAW;gBAClB,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,eAAe;gBACvB,KAAK,EAAE,WAAW;gBAClB,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,WAAW;gBAClB,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,oBAAoB;YACpB;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,mBAAmB;gBACzB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,gBAAgB;gBACvB,IAAI,EAAE,mBAAmB;gBACzB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,EAAE,EAAG,iCAAiC;aACrD;YAED,iBAAiB;YACjB;gBACE,MAAM,EAAE,iBAAiB;gBACzB,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,kBAAkB;gBAC1B,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,MAAM;YACN;gBACE,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,aAAa;gBACpB,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,aAAa;gBACpB,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,iBAAiB;YACjB;gBACE,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,YAAY;gBACnB,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;aACrB;YAED,kBAAkB;YAClB;gBACE,MAAM,EAAE,UAAU;gBAClB,KAAK,EAAE,OAAO;gBACd,IAAI,EAAE,iBAAiB;gBACvB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,kBAAkB;YAClB;gBACE,MAAM,EAAE,YAAY;gBACpB,KAAK,EAAE,mBAAmB;gBAC1B,IAAI,EAAE,iBAAiB;gBACvB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,EAAE;aACjB;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,IAAgB,EAAE,OAA0B;QAC1D,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB;YAAE,OAAO,SAAS,CAAC;QAExD,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAEhC,iDAAiD;QACjD,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;YAC3B,+CAA+C;YAC/C,6EAA6E;YAC7E,OAAO,SAAS,CAAC,CAAE,kCAAkC;QACvD,CAAC;QAED,uDAAuD;QACvD,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACrC,OAAO,QAAQ,CAAC,IAAI,CAAC;QACvB,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,IAAgB;QAC9B,OAAO,IAAI,CAAC,IAAI,KAAK,gBAAgB,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,IAAgB;QAC7B,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;YAAE,OAAO,SAAS,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACvB,4BAA4B;QAC5B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+DAA+D;IAC/D,8DAA8D;IAE9D,YAAY,CAAC,OAA0B;QACrC,kCAAkC;QAClC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,YAAY,CAAC,OAA0B;QACrC,kCAAkC;QAClC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,cAAc,CAAC,OAA0B;QACvC,kCAAkC;QAClC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,cAAc,CAAC,OAA0B;QACvC,mCAAmC;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QAC9E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAE5C,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;QAED,iDAAiD;QACjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;gBACjF,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}