circle-ir 3.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (194) hide show
  1. package/LICENSE +15 -0
  2. package/README.md +200 -0
  3. package/configs/sinks/code_injection.yaml +672 -0
  4. package/configs/sinks/command.yaml +917 -0
  5. package/configs/sinks/deserialization.yaml +105 -0
  6. package/configs/sinks/ldap.yaml +136 -0
  7. package/configs/sinks/nodejs.json +629 -0
  8. package/configs/sinks/path.yaml +715 -0
  9. package/configs/sinks/python.json +501 -0
  10. package/configs/sinks/rust.json +339 -0
  11. package/configs/sinks/sql.yaml +233 -0
  12. package/configs/sinks/ssrf.yaml +160 -0
  13. package/configs/sinks/xpath.yaml +121 -0
  14. package/configs/sinks/xss.yaml +727 -0
  15. package/configs/sources/db_sources.yaml +90 -0
  16. package/configs/sources/env_sources.yaml +94 -0
  17. package/configs/sources/express.json +197 -0
  18. package/configs/sources/file_sources.yaml +164 -0
  19. package/configs/sources/http_sources.yaml +379 -0
  20. package/configs/sources/io_sources.yaml +519 -0
  21. package/configs/sources/network_sources.yaml +99 -0
  22. package/configs/sources/python.json +230 -0
  23. package/configs/sources/rust.json +286 -0
  24. package/configs/sources/spring.yaml +70 -0
  25. package/dist/analysis/advisory-db.d.ts +86 -0
  26. package/dist/analysis/advisory-db.js +104 -0
  27. package/dist/analysis/advisory-db.js.map +1 -0
  28. package/dist/analysis/cargo-parser.d.ts +42 -0
  29. package/dist/analysis/cargo-parser.js +102 -0
  30. package/dist/analysis/cargo-parser.js.map +1 -0
  31. package/dist/analysis/config-loader.d.ts +37 -0
  32. package/dist/analysis/config-loader.js +1561 -0
  33. package/dist/analysis/config-loader.js.map +1 -0
  34. package/dist/analysis/constant-propagation/ast-utils.d.ts +25 -0
  35. package/dist/analysis/constant-propagation/ast-utils.js +34 -0
  36. package/dist/analysis/constant-propagation/ast-utils.js.map +1 -0
  37. package/dist/analysis/constant-propagation/evaluator.d.ts +32 -0
  38. package/dist/analysis/constant-propagation/evaluator.js +296 -0
  39. package/dist/analysis/constant-propagation/evaluator.js.map +1 -0
  40. package/dist/analysis/constant-propagation/index.d.ts +62 -0
  41. package/dist/analysis/constant-propagation/index.js +152 -0
  42. package/dist/analysis/constant-propagation/index.js.map +1 -0
  43. package/dist/analysis/constant-propagation/patterns.d.ts +8 -0
  44. package/dist/analysis/constant-propagation/patterns.js +126 -0
  45. package/dist/analysis/constant-propagation/patterns.js.map +1 -0
  46. package/dist/analysis/constant-propagation/propagator.d.ts +180 -0
  47. package/dist/analysis/constant-propagation/propagator.js +1985 -0
  48. package/dist/analysis/constant-propagation/propagator.js.map +1 -0
  49. package/dist/analysis/constant-propagation/types.d.ts +63 -0
  50. package/dist/analysis/constant-propagation/types.js +5 -0
  51. package/dist/analysis/constant-propagation/types.js.map +1 -0
  52. package/dist/analysis/constant-propagation.d.ts +9 -0
  53. package/dist/analysis/constant-propagation.js +18 -0
  54. package/dist/analysis/constant-propagation.js.map +1 -0
  55. package/dist/analysis/dependency-scanner.d.ts +79 -0
  56. package/dist/analysis/dependency-scanner.js +122 -0
  57. package/dist/analysis/dependency-scanner.js.map +1 -0
  58. package/dist/analysis/dfg-verifier.d.ts +116 -0
  59. package/dist/analysis/dfg-verifier.js +399 -0
  60. package/dist/analysis/dfg-verifier.js.map +1 -0
  61. package/dist/analysis/findings.d.ts +11 -0
  62. package/dist/analysis/findings.js +228 -0
  63. package/dist/analysis/findings.js.map +1 -0
  64. package/dist/analysis/index.d.ts +16 -0
  65. package/dist/analysis/index.js +18 -0
  66. package/dist/analysis/index.js.map +1 -0
  67. package/dist/analysis/interprocedural.d.ts +99 -0
  68. package/dist/analysis/interprocedural.js +526 -0
  69. package/dist/analysis/interprocedural.js.map +1 -0
  70. package/dist/analysis/path-finder.d.ts +133 -0
  71. package/dist/analysis/path-finder.js +354 -0
  72. package/dist/analysis/path-finder.js.map +1 -0
  73. package/dist/analysis/rules.d.ts +75 -0
  74. package/dist/analysis/rules.js +332 -0
  75. package/dist/analysis/rules.js.map +1 -0
  76. package/dist/analysis/semver.d.ts +27 -0
  77. package/dist/analysis/semver.js +127 -0
  78. package/dist/analysis/semver.js.map +1 -0
  79. package/dist/analysis/taint-matcher.d.ts +15 -0
  80. package/dist/analysis/taint-matcher.js +634 -0
  81. package/dist/analysis/taint-matcher.js.map +1 -0
  82. package/dist/analysis/taint-propagation.d.ts +67 -0
  83. package/dist/analysis/taint-propagation.js +298 -0
  84. package/dist/analysis/taint-propagation.js.map +1 -0
  85. package/dist/analysis/unresolved.d.ts +14 -0
  86. package/dist/analysis/unresolved.js +202 -0
  87. package/dist/analysis/unresolved.js.map +1 -0
  88. package/dist/analyzer.d.ts +43 -0
  89. package/dist/analyzer.js +1010 -0
  90. package/dist/analyzer.js.map +1 -0
  91. package/dist/browser/circle-ir.js +16576 -0
  92. package/dist/browser.d.ts +38 -0
  93. package/dist/browser.js +38 -0
  94. package/dist/browser.js.map +1 -0
  95. package/dist/core/circle-ir-core.cjs +13626 -0
  96. package/dist/core/circle-ir-core.d.ts +59 -0
  97. package/dist/core/circle-ir-core.js +13591 -0
  98. package/dist/core/extractors/calls.d.ts +13 -0
  99. package/dist/core/extractors/calls.js +1429 -0
  100. package/dist/core/extractors/calls.js.map +1 -0
  101. package/dist/core/extractors/cfg.d.ts +9 -0
  102. package/dist/core/extractors/cfg.js +519 -0
  103. package/dist/core/extractors/cfg.js.map +1 -0
  104. package/dist/core/extractors/dfg.d.ts +12 -0
  105. package/dist/core/extractors/dfg.js +1081 -0
  106. package/dist/core/extractors/dfg.js.map +1 -0
  107. package/dist/core/extractors/exports.d.ts +14 -0
  108. package/dist/core/extractors/exports.js +80 -0
  109. package/dist/core/extractors/exports.js.map +1 -0
  110. package/dist/core/extractors/imports.d.ts +9 -0
  111. package/dist/core/extractors/imports.js +739 -0
  112. package/dist/core/extractors/imports.js.map +1 -0
  113. package/dist/core/extractors/index.d.ts +10 -0
  114. package/dist/core/extractors/index.js +11 -0
  115. package/dist/core/extractors/index.js.map +1 -0
  116. package/dist/core/extractors/meta.d.ts +10 -0
  117. package/dist/core/extractors/meta.js +109 -0
  118. package/dist/core/extractors/meta.js.map +1 -0
  119. package/dist/core/extractors/types.d.ts +10 -0
  120. package/dist/core/extractors/types.js +1479 -0
  121. package/dist/core/extractors/types.js.map +1 -0
  122. package/dist/core/index.d.ts +5 -0
  123. package/dist/core/index.js +8 -0
  124. package/dist/core/index.js.map +1 -0
  125. package/dist/core/parser.d.ts +84 -0
  126. package/dist/core/parser.js +250 -0
  127. package/dist/core/parser.js.map +1 -0
  128. package/dist/core-lib.d.ts +59 -0
  129. package/dist/core-lib.js +62 -0
  130. package/dist/core-lib.js.map +1 -0
  131. package/dist/index.d.ts +15 -0
  132. package/dist/index.js +20 -0
  133. package/dist/index.js.map +1 -0
  134. package/dist/languages/index.d.ts +11 -0
  135. package/dist/languages/index.js +14 -0
  136. package/dist/languages/index.js.map +1 -0
  137. package/dist/languages/plugins/base.d.ts +44 -0
  138. package/dist/languages/plugins/base.js +82 -0
  139. package/dist/languages/plugins/base.js.map +1 -0
  140. package/dist/languages/plugins/index.d.ts +14 -0
  141. package/dist/languages/plugins/index.js +25 -0
  142. package/dist/languages/plugins/index.js.map +1 -0
  143. package/dist/languages/plugins/java.d.ts +49 -0
  144. package/dist/languages/plugins/java.js +402 -0
  145. package/dist/languages/plugins/java.js.map +1 -0
  146. package/dist/languages/plugins/javascript.d.ts +48 -0
  147. package/dist/languages/plugins/javascript.js +445 -0
  148. package/dist/languages/plugins/javascript.js.map +1 -0
  149. package/dist/languages/plugins/python.d.ts +47 -0
  150. package/dist/languages/plugins/python.js +480 -0
  151. package/dist/languages/plugins/python.js.map +1 -0
  152. package/dist/languages/plugins/rust.d.ts +47 -0
  153. package/dist/languages/plugins/rust.js +405 -0
  154. package/dist/languages/plugins/rust.js.map +1 -0
  155. package/dist/languages/registry.d.ts +30 -0
  156. package/dist/languages/registry.js +80 -0
  157. package/dist/languages/registry.js.map +1 -0
  158. package/dist/languages/types.d.ts +184 -0
  159. package/dist/languages/types.js +8 -0
  160. package/dist/languages/types.js.map +1 -0
  161. package/dist/resolution/cross-file.d.ts +146 -0
  162. package/dist/resolution/cross-file.js +439 -0
  163. package/dist/resolution/cross-file.js.map +1 -0
  164. package/dist/resolution/index.d.ts +12 -0
  165. package/dist/resolution/index.js +10 -0
  166. package/dist/resolution/index.js.map +1 -0
  167. package/dist/resolution/symbol-table.d.ts +136 -0
  168. package/dist/resolution/symbol-table.js +336 -0
  169. package/dist/resolution/symbol-table.js.map +1 -0
  170. package/dist/resolution/type-hierarchy.d.ts +124 -0
  171. package/dist/resolution/type-hierarchy.js +515 -0
  172. package/dist/resolution/type-hierarchy.js.map +1 -0
  173. package/dist/types/config.d.ts +45 -0
  174. package/dist/types/config.js +5 -0
  175. package/dist/types/config.js.map +1 -0
  176. package/dist/types/index.d.ts +392 -0
  177. package/dist/types/index.js +7 -0
  178. package/dist/types/index.js.map +1 -0
  179. package/dist/utils/logger.d.ts +85 -0
  180. package/dist/utils/logger.js +198 -0
  181. package/dist/utils/logger.js.map +1 -0
  182. package/dist/wasm/tree-sitter-java.wasm +0 -0
  183. package/dist/wasm/tree-sitter-javascript.wasm +0 -0
  184. package/dist/wasm/tree-sitter-python.wasm +0 -0
  185. package/dist/wasm/tree-sitter-rust.wasm +0 -0
  186. package/dist/wasm/web-tree-sitter.wasm +0 -0
  187. package/docs/SPEC.md +1021 -0
  188. package/examples/browser-example.html +610 -0
  189. package/examples/node-example.ts +215 -0
  190. package/package.json +107 -0
  191. package/wasm/tree-sitter-java.wasm +0 -0
  192. package/wasm/tree-sitter-javascript.wasm +0 -0
  193. package/wasm/tree-sitter-python.wasm +0 -0
  194. package/wasm/tree-sitter-rust.wasm +0 -0
@@ -0,0 +1,336 @@
1
+ /**
2
+ * Symbol Table for Cross-File Resolution
3
+ *
4
+ * Tracks what each file exports (classes, methods, fields) and imports,
5
+ * enabling resolution of cross-file references.
6
+ */
7
+ /**
8
+ * SymbolTable - Tracks exports and imports across project files
9
+ */
10
+ export class SymbolTable {
11
+ // All exported symbols by FQN
12
+ exports = new Map();
13
+ // Simple name -> FQNs (for ambiguous resolution)
14
+ nameToFqns = new Map();
15
+ // File -> its imports
16
+ fileImports = new Map();
17
+ // Package -> exported types in that package
18
+ packageTypes = new Map();
19
+ // FQN -> file path
20
+ fqnToFile = new Map();
21
+ /**
22
+ * Add exports and imports from a CircleIR analysis result
23
+ */
24
+ addFromIR(ir, filePath) {
25
+ const pkg = ir.meta.package || '';
26
+ // Process types and their members
27
+ for (const type of ir.types) {
28
+ this.addTypeExports(type, filePath, pkg);
29
+ }
30
+ // Process imports
31
+ this.addFileImports(ir.imports, filePath);
32
+ // Process explicit exports if available
33
+ for (const exp of ir.exports) {
34
+ this.addExplicitExport(exp, filePath, pkg);
35
+ }
36
+ }
37
+ /**
38
+ * Add type and its members as exports
39
+ */
40
+ addTypeExports(type, filePath, pkg) {
41
+ const fqn = pkg ? `${pkg}.${type.name}` : type.name;
42
+ const visibility = this.getVisibility(type.annotations);
43
+ // Add type itself
44
+ const typeExport = {
45
+ name: type.name,
46
+ fqn,
47
+ kind: type.kind,
48
+ file: filePath,
49
+ line: type.start_line,
50
+ visibility,
51
+ };
52
+ this.registerExport(typeExport);
53
+ // Track in package
54
+ if (!this.packageTypes.has(pkg)) {
55
+ this.packageTypes.set(pkg, new Set());
56
+ }
57
+ this.packageTypes.get(pkg).add(fqn);
58
+ // Add methods
59
+ for (const method of type.methods) {
60
+ this.addMethodExport(method, fqn, filePath);
61
+ }
62
+ // Add fields
63
+ for (const field of type.fields) {
64
+ this.addFieldExport(field, fqn, filePath);
65
+ }
66
+ }
67
+ /**
68
+ * Add a method as an export
69
+ */
70
+ addMethodExport(method, parentFqn, filePath) {
71
+ const methodFqn = `${parentFqn}.${method.name}`;
72
+ const signature = method.parameters.map(p => p.type || 'Object').join(',');
73
+ const visibility = this.getVisibilityFromModifiers(method.modifiers);
74
+ const methodExport = {
75
+ name: method.name,
76
+ fqn: methodFqn,
77
+ kind: 'method',
78
+ file: filePath,
79
+ line: method.start_line,
80
+ visibility,
81
+ parentType: parentFqn,
82
+ signature,
83
+ };
84
+ this.registerExport(methodExport);
85
+ }
86
+ /**
87
+ * Add a field as an export
88
+ */
89
+ addFieldExport(field, parentFqn, filePath) {
90
+ const fieldFqn = `${parentFqn}.${field.name}`;
91
+ const visibility = this.getVisibilityFromModifiers(field.modifiers);
92
+ const fieldExport = {
93
+ name: field.name,
94
+ fqn: fieldFqn,
95
+ kind: 'field',
96
+ file: filePath,
97
+ line: 0, // Fields don't have line numbers in current TypeInfo
98
+ visibility,
99
+ parentType: parentFqn,
100
+ };
101
+ this.registerExport(fieldExport);
102
+ }
103
+ /**
104
+ * Register an export in all indexes
105
+ */
106
+ registerExport(symbol) {
107
+ this.exports.set(symbol.fqn, symbol);
108
+ this.fqnToFile.set(symbol.fqn, symbol.file);
109
+ if (!this.nameToFqns.has(symbol.name)) {
110
+ this.nameToFqns.set(symbol.name, new Set());
111
+ }
112
+ this.nameToFqns.get(symbol.name).add(symbol.fqn);
113
+ }
114
+ /**
115
+ * Add imports for a file
116
+ */
117
+ addFileImports(imports, filePath) {
118
+ const fileImport = {
119
+ imports,
120
+ resolved: new Map(),
121
+ wildcardPackages: [],
122
+ };
123
+ for (const imp of imports) {
124
+ if (imp.is_wildcard && imp.from_package) {
125
+ // Wildcard import: import java.util.*
126
+ fileImport.wildcardPackages.push(imp.from_package);
127
+ }
128
+ else if (imp.from_package && imp.imported_name !== '*') {
129
+ // Specific import: import java.util.ArrayList
130
+ const fqn = `${imp.from_package}.${imp.imported_name}`;
131
+ fileImport.resolved.set(imp.imported_name, fqn);
132
+ }
133
+ }
134
+ this.fileImports.set(filePath, fileImport);
135
+ }
136
+ /**
137
+ * Add explicit export declaration
138
+ */
139
+ addExplicitExport(exp, filePath, pkg) {
140
+ const fqn = pkg ? `${pkg}.${exp.symbol}` : exp.symbol;
141
+ // Only add if not already registered (types take precedence)
142
+ if (!this.exports.has(fqn)) {
143
+ const symbol = {
144
+ name: exp.symbol,
145
+ fqn,
146
+ kind: exp.kind,
147
+ file: filePath,
148
+ line: 0,
149
+ visibility: exp.visibility,
150
+ };
151
+ this.registerExport(symbol);
152
+ }
153
+ }
154
+ /**
155
+ * Resolve a simple name to its FQN from a given file's context
156
+ */
157
+ resolveSymbol(name, fromFile) {
158
+ // Check if already FQN
159
+ if (this.exports.has(name)) {
160
+ return this.exports.get(name);
161
+ }
162
+ // Check file's specific imports
163
+ const fileImport = this.fileImports.get(fromFile);
164
+ if (fileImport) {
165
+ const resolved = fileImport.resolved.get(name);
166
+ if (resolved && this.exports.has(resolved)) {
167
+ return this.exports.get(resolved);
168
+ }
169
+ // Check wildcard imports
170
+ for (const pkg of fileImport.wildcardPackages) {
171
+ const fqn = `${pkg}.${name}`;
172
+ if (this.exports.has(fqn)) {
173
+ return this.exports.get(fqn);
174
+ }
175
+ }
176
+ }
177
+ // Check by simple name (may be ambiguous)
178
+ const fqns = this.nameToFqns.get(name);
179
+ if (fqns && fqns.size === 1) {
180
+ return this.exports.get(Array.from(fqns)[0]);
181
+ }
182
+ return undefined;
183
+ }
184
+ /**
185
+ * Resolve a type name to FQN, considering imports
186
+ */
187
+ resolveTypeName(name, fromFile) {
188
+ const symbol = this.resolveSymbol(name, fromFile);
189
+ if (symbol && (symbol.kind === 'class' || symbol.kind === 'interface' || symbol.kind === 'enum')) {
190
+ return symbol.fqn;
191
+ }
192
+ return undefined;
193
+ }
194
+ /**
195
+ * Get all methods of a type by FQN
196
+ */
197
+ getMethodsOfType(typeFqn) {
198
+ const results = [];
199
+ for (const symbol of this.exports.values()) {
200
+ if (symbol.kind === 'method' && symbol.parentType === typeFqn) {
201
+ results.push(symbol);
202
+ }
203
+ }
204
+ return results;
205
+ }
206
+ /**
207
+ * Find a method by name in a type
208
+ */
209
+ findMethod(typeFqn, methodName) {
210
+ const methodFqn = `${typeFqn}.${methodName}`;
211
+ return this.exports.get(methodFqn);
212
+ }
213
+ /**
214
+ * Get the file where a symbol is defined
215
+ */
216
+ getFile(fqn) {
217
+ return this.fqnToFile.get(fqn);
218
+ }
219
+ /**
220
+ * Get all exported symbols from a file
221
+ */
222
+ getFileExports(filePath) {
223
+ const results = [];
224
+ for (const symbol of this.exports.values()) {
225
+ if (symbol.file === filePath) {
226
+ results.push(symbol);
227
+ }
228
+ }
229
+ return results;
230
+ }
231
+ /**
232
+ * Get all types in a package
233
+ */
234
+ getPackageTypes(packageName) {
235
+ return Array.from(this.packageTypes.get(packageName) || []);
236
+ }
237
+ /**
238
+ * Get all known packages
239
+ */
240
+ getPackages() {
241
+ return Array.from(this.packageTypes.keys());
242
+ }
243
+ /**
244
+ * Check if a symbol exists
245
+ */
246
+ hasSymbol(fqn) {
247
+ return this.exports.has(fqn);
248
+ }
249
+ /**
250
+ * Get symbol by FQN
251
+ */
252
+ getSymbol(fqn) {
253
+ return this.exports.get(fqn);
254
+ }
255
+ /**
256
+ * Get all possible FQNs for a simple name
257
+ */
258
+ getPossibleFqns(simpleName) {
259
+ return Array.from(this.nameToFqns.get(simpleName) || []);
260
+ }
261
+ /**
262
+ * Get imports for a file
263
+ */
264
+ getFileImports(filePath) {
265
+ return this.fileImports.get(filePath)?.imports || [];
266
+ }
267
+ /**
268
+ * Get statistics
269
+ */
270
+ getStats() {
271
+ let types = 0, methods = 0, fields = 0;
272
+ const files = new Set();
273
+ for (const symbol of this.exports.values()) {
274
+ files.add(symbol.file);
275
+ if (symbol.kind === 'class' || symbol.kind === 'interface' || symbol.kind === 'enum') {
276
+ types++;
277
+ }
278
+ else if (symbol.kind === 'method') {
279
+ methods++;
280
+ }
281
+ else if (symbol.kind === 'field') {
282
+ fields++;
283
+ }
284
+ }
285
+ return {
286
+ totalSymbols: this.exports.size,
287
+ types,
288
+ methods,
289
+ fields,
290
+ files: files.size,
291
+ packages: this.packageTypes.size,
292
+ };
293
+ }
294
+ /**
295
+ * Clear all data
296
+ */
297
+ clear() {
298
+ this.exports.clear();
299
+ this.nameToFqns.clear();
300
+ this.fileImports.clear();
301
+ this.packageTypes.clear();
302
+ this.fqnToFile.clear();
303
+ }
304
+ // --- Private helpers ---
305
+ /**
306
+ * Extract visibility from annotations (for types)
307
+ */
308
+ getVisibility(_annotations) {
309
+ // Types in Java are public by default if in their own file
310
+ // For simplicity, assume public unless we find evidence otherwise
311
+ return 'public';
312
+ }
313
+ /**
314
+ * Extract visibility from modifiers
315
+ */
316
+ getVisibilityFromModifiers(modifiers) {
317
+ if (modifiers.includes('public'))
318
+ return 'public';
319
+ if (modifiers.includes('protected'))
320
+ return 'protected';
321
+ if (modifiers.includes('private'))
322
+ return 'private';
323
+ return 'package';
324
+ }
325
+ }
326
+ /**
327
+ * Build a symbol table from multiple IR results
328
+ */
329
+ export function buildSymbolTable(files) {
330
+ const table = new SymbolTable();
331
+ for (const { ir, path } of files) {
332
+ table.addFromIR(ir, path);
333
+ }
334
+ return table;
335
+ }
336
+ //# sourceMappingURL=symbol-table.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"symbol-table.js","sourceRoot":"","sources":["../../src/resolution/symbol-table.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAoCH;;GAEG;AACH,MAAM,OAAO,WAAW;IACtB,8BAA8B;IACtB,OAAO,GAAgC,IAAI,GAAG,EAAE,CAAC;IAEzD,iDAAiD;IACzC,UAAU,GAA6B,IAAI,GAAG,EAAE,CAAC;IAEzD,sBAAsB;IACd,WAAW,GAA6B,IAAI,GAAG,EAAE,CAAC;IAE1D,4CAA4C;IACpC,YAAY,GAA6B,IAAI,GAAG,EAAE,CAAC;IAE3D,mBAAmB;IACX,SAAS,GAAwB,IAAI,GAAG,EAAE,CAAC;IAEnD;;OAEG;IACH,SAAS,CAAC,EAAY,EAAE,QAAgB;QACtC,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QAElC,kCAAkC;QAClC,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC3C,CAAC;QAED,kBAAkB;QAClB,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAE1C,wCAAwC;QACxC,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,IAAc,EAAE,QAAgB,EAAE,GAAW;QAClE,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACpD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAExD,kBAAkB;QAClB,MAAM,UAAU,GAAmB;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG;YACH,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,UAAU;SACX,CAAC;QAEF,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;QAEhC,mBAAmB;QACnB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAErC,cAAc;QACd,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC9C,CAAC;QAED,aAAa;QACb,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;OAEG;IACK,eAAe,CAAC,MAAkB,EAAE,SAAiB,EAAE,QAAgB;QAC7E,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3E,MAAM,UAAU,GAAG,IAAI,CAAC,0BAA0B,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAErE,MAAM,YAAY,GAAmB;YACnC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,MAAM,CAAC,UAAU;YACvB,UAAU;YACV,UAAU,EAAE,SAAS;YACrB,SAAS;SACV,CAAC;QAEF,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,KAAgB,EAAE,SAAiB,EAAE,QAAgB;QAC1E,MAAM,QAAQ,GAAG,GAAG,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAEpE,MAAM,WAAW,GAAmB;YAClC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,EAAE,QAAQ;YACb,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,EAAE,qDAAqD;YAC9D,UAAU;YACV,UAAU,EAAE,SAAS;SACtB,CAAC;QAEF,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,MAAsB;QAC3C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAE5C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;IAED;;OAEG;IACK,cAAc,CAAC,OAAqB,EAAE,QAAgB;QAC5D,MAAM,UAAU,GAAgB;YAC9B,OAAO;YACP,QAAQ,EAAE,IAAI,GAAG,EAAE;YACnB,gBAAgB,EAAE,EAAE;SACrB,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;gBACxC,sCAAsC;gBACtC,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACrD,CAAC;iBAAM,IAAI,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,aAAa,KAAK,GAAG,EAAE,CAAC;gBACzD,8CAA8C;gBAC9C,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;gBACvD,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,GAAe,EAAE,QAAgB,EAAE,GAAW;QACtE,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QAEtD,6DAA6D;QAC7D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAmB;gBAC7B,IAAI,EAAE,GAAG,CAAC,MAAM;gBAChB,GAAG;gBACH,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC;gBACP,UAAU,EAAE,GAAG,CAAC,UAAU;aAC3B,CAAC;YACF,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,IAAY,EAAE,QAAgB;QAC1C,uBAAuB;QACvB,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QAED,gCAAgC;QAChC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACpC,CAAC;YAED,yBAAyB;YACzB,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,gBAAgB,EAAE,CAAC;gBAC9C,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;gBAC7B,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;QACH,CAAC;QAED,0CAA0C;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,IAAY,EAAE,QAAgB;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAClD,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC;YACjG,OAAO,MAAM,CAAC,GAAG,CAAC;QACpB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,OAAe;QAC9B,MAAM,OAAO,GAAqB,EAAE,CAAC;QACrC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;gBAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAAe,EAAE,UAAkB;QAC5C,MAAM,SAAS,GAAG,GAAG,OAAO,IAAI,UAAU,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,GAAW;QACjB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,QAAgB;QAC7B,MAAM,OAAO,GAAqB,EAAE,CAAC;QACrC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,WAAmB;QACjC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,UAAkB;QAChC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,QAAgB;QAC7B,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC;IACvD,CAAC;IAED;;OAEG;IACH,QAAQ;QAQN,IAAI,KAAK,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAEhC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACvB,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrF,KAAK,EAAE,CAAC;YACV,CAAC;iBAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpC,OAAO,EAAE,CAAC;YACZ,CAAC;iBAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACnC,MAAM,EAAE,CAAC;YACX,CAAC;QACH,CAAC;QAED,OAAO;YACL,YAAY,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC/B,KAAK;YACL,OAAO;YACP,MAAM;YACN,KAAK,EAAE,KAAK,CAAC,IAAI;YACjB,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI;SACjC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IAED,0BAA0B;IAE1B;;OAEG;IACK,aAAa,CAAC,YAAsB;QAC1C,2DAA2D;QAC3D,kEAAkE;QAClE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,0BAA0B,CAAC,SAAmB;QACpD,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;QAClD,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,WAAW,CAAC;QACxD,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QACpD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA4C;IAC3E,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC;IAChC,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QACjC,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
@@ -0,0 +1,124 @@
1
+ /**
2
+ * Type Hierarchy Resolution
3
+ *
4
+ * Tracks class inheritance and interface implementations across files
5
+ * to enable polymorphic sink detection.
6
+ *
7
+ * Example: When sink is Statement.executeQuery(), we can match calls
8
+ * on PreparedStatement, CallableStatement, or any other subtype.
9
+ */
10
+ import type { TypeInfo, TypeHierarchy as TypeHierarchyData, CircleIR } from '../types/index.js';
11
+ /**
12
+ * Node representation for hierarchy tracking
13
+ */
14
+ export interface TypeNode {
15
+ name: string;
16
+ fqn: string;
17
+ kind: 'class' | 'interface' | 'enum';
18
+ extends: string | null;
19
+ implements: string[];
20
+ extendsInterfaces: string[];
21
+ file: string;
22
+ line: number;
23
+ }
24
+ /**
25
+ * TypeHierarchyResolver - Builds and queries type inheritance relationships
26
+ */
27
+ export declare class TypeHierarchyResolver {
28
+ private types;
29
+ private nameToFqn;
30
+ private subtypes;
31
+ private implementations;
32
+ /**
33
+ * Add types from a CircleIR analysis result
34
+ */
35
+ addFromIR(ir: CircleIR, filePath: string): void;
36
+ /**
37
+ * Add a single type to the hierarchy
38
+ */
39
+ addType(type: TypeInfo, filePath: string, defaultPackage?: string | null): void;
40
+ /**
41
+ * Get all direct subtypes of a class
42
+ */
43
+ getDirectSubtypes(className: string): string[];
44
+ /**
45
+ * Get all subtypes (transitive) of a class
46
+ */
47
+ getAllSubtypes(className: string): string[];
48
+ /**
49
+ * Get all direct implementations of an interface
50
+ */
51
+ getDirectImplementations(interfaceName: string): string[];
52
+ /**
53
+ * Get all implementations (including through subinterfaces) of an interface
54
+ */
55
+ getAllImplementations(interfaceName: string): string[];
56
+ /**
57
+ * Check if a type is a subtype of another (including transitive)
58
+ */
59
+ isSubtypeOf(childName: string, parentName: string): boolean;
60
+ /**
61
+ * Check if a type implements an interface (directly or through inheritance)
62
+ * Also handles interface-extends-interface relationships
63
+ */
64
+ implementsInterface(typeName: string, interfaceName: string): boolean;
65
+ /**
66
+ * Get type info by name
67
+ */
68
+ getType(name: string): TypeNode | undefined;
69
+ /**
70
+ * Get all types matching a simple name
71
+ */
72
+ getTypesByName(simpleName: string): TypeNode[];
73
+ /**
74
+ * Get the file where a type is defined
75
+ */
76
+ getTypeFile(name: string): string | undefined;
77
+ /**
78
+ * Check if a receiver type could match a target class
79
+ * Handles: exact match, subtype, implementation, simple name match
80
+ */
81
+ couldBeType(receiverType: string, targetClass: string): boolean;
82
+ /**
83
+ * Export hierarchy data in the CircleIR format
84
+ */
85
+ toTypeHierarchyData(): TypeHierarchyData;
86
+ /**
87
+ * Get statistics about the hierarchy
88
+ */
89
+ getStats(): {
90
+ totalTypes: number;
91
+ classes: number;
92
+ interfaces: number;
93
+ enums: number;
94
+ };
95
+ /**
96
+ * Get all types in the hierarchy
97
+ */
98
+ getAllTypes(): TypeNode[];
99
+ /**
100
+ * Clear all data
101
+ */
102
+ clear(): void;
103
+ /**
104
+ * Resolve a type name to its FQN
105
+ */
106
+ private resolveTypeName;
107
+ /**
108
+ * Resolve a name (simple or FQN) to its FQN
109
+ */
110
+ private resolveFqn;
111
+ /**
112
+ * Get simple name from FQN
113
+ */
114
+ private getSimpleName;
115
+ /**
116
+ * Get package from FQN
117
+ */
118
+ private getPackage;
119
+ }
120
+ /**
121
+ * Pre-populated common Java type hierarchy
122
+ * These are standard JDK types that code often extends/implements
123
+ */
124
+ export declare function createWithJdkTypes(): TypeHierarchyResolver;