circle-ir 3.1.0

package/dist/resolution/type-hierarchy.js

@@ -0,0 +1,515 @@
+/**
+ * Type Hierarchy Resolution
+ *
+ * Tracks class inheritance and interface implementations across files
+ * to enable polymorphic sink detection.
+ *
+ * Example: When sink is Statement.executeQuery(), we can match calls
+ * on PreparedStatement, CallableStatement, or any other subtype.
+ */
+/**
+ * TypeHierarchyResolver - Builds and queries type inheritance relationships
+ */
+export class TypeHierarchyResolver {
+    // All known types by FQN
+    types = new Map();
+    // Simple name to FQN mapping (for resolution)
+    nameToFqn = new Map();
+    // Subtype relationships: parent FQN -> child FQNs
+    subtypes = new Map();
+    // Implementation relationships: interface FQN -> implementing class FQNs
+    implementations = new Map();
+    /**
+     * Add types from a CircleIR analysis result
+     */
+    addFromIR(ir, filePath) {
+        for (const type of ir.types) {
+            this.addType(type, filePath, ir.meta.package || null);
+        }
+    }
+    /**
+     * Add a single type to the hierarchy
+     */
+    addType(type, filePath, defaultPackage = null) {
+        const pkg = type.package || defaultPackage || '';
+        const fqn = pkg ? `${pkg}.${type.name}` : type.name;
+        const node = {
+            name: type.name,
+            fqn,
+            kind: type.kind,
+            extends: type.extends,
+            implements: type.implements,
+            extendsInterfaces: type.kind === 'interface' ? type.implements : [],
+            file: filePath,
+            line: type.start_line,
+        };
+        this.types.set(fqn, node);
+        // Track simple name -> FQN mapping
+        if (!this.nameToFqn.has(type.name)) {
+            this.nameToFqn.set(type.name, new Set());
+        }
+        this.nameToFqn.get(type.name).add(fqn);
+        // Build inheritance relationships
+        if (type.kind === 'class' || type.kind === 'enum') {
+            // Track class inheritance
+            if (type.extends) {
+                const parentFqn = this.resolveTypeName(type.extends, pkg);
+                if (!this.subtypes.has(parentFqn)) {
+                    this.subtypes.set(parentFqn, new Set());
+                }
+                this.subtypes.get(parentFqn).add(fqn);
+            }
+            // Track interface implementations
+            for (const iface of type.implements) {
+                const ifaceFqn = this.resolveTypeName(iface, pkg);
+                if (!this.implementations.has(ifaceFqn)) {
+                    this.implementations.set(ifaceFqn, new Set());
+                }
+                this.implementations.get(ifaceFqn).add(fqn);
+            }
+        }
+        else if (type.kind === 'interface') {
+            // Track interface inheritance (extends for interfaces)
+            for (const parentIface of type.implements) {
+                const parentFqn = this.resolveTypeName(parentIface, pkg);
+                if (!this.subtypes.has(parentFqn)) {
+                    this.subtypes.set(parentFqn, new Set());
+                }
+                this.subtypes.get(parentFqn).add(fqn);
+            }
+        }
+    }
+    /**
+     * Get all direct subtypes of a class
+     */
+    getDirectSubtypes(className) {
+        const fqn = this.resolveFqn(className);
+        return Array.from(this.subtypes.get(fqn) || []);
+    }
+    /**
+     * Get all subtypes (transitive) of a class
+     */
+    getAllSubtypes(className) {
+        const fqn = this.resolveFqn(className);
+        const result = new Set();
+        const queue = [fqn];
+        while (queue.length > 0) {
+            const current = queue.shift();
+            const children = this.subtypes.get(current);
+            if (children) {
+                for (const child of children) {
+                    if (!result.has(child)) {
+                        result.add(child);
+                        queue.push(child);
+                    }
+                }
+            }
+        }
+        return Array.from(result);
+    }
+    /**
+     * Get all direct implementations of an interface
+     */
+    getDirectImplementations(interfaceName) {
+        const fqn = this.resolveFqn(interfaceName);
+        return Array.from(this.implementations.get(fqn) || []);
+    }
+    /**
+     * Get all implementations (including through subinterfaces) of an interface
+     */
+    getAllImplementations(interfaceName) {
+        const fqn = this.resolveFqn(interfaceName);
+        const result = new Set();
+        const visited = new Set();
+        const queue = [fqn];
+        while (queue.length > 0) {
+            const current = queue.shift();
+            if (visited.has(current))
+                continue;
+            visited.add(current);
+            // Add direct implementations
+            const impls = this.implementations.get(current);
+            if (impls) {
+                for (const impl of impls) {
+                    result.add(impl);
+                    // Also add subtypes of implementing classes
+                    const subtypes = this.getAllSubtypes(impl);
+                    for (const subtype of subtypes) {
+                        result.add(subtype);
+                    }
+                }
+            }
+            // Add subinterfaces to queue
+            const subInterfaces = this.subtypes.get(current);
+            if (subInterfaces) {
+                for (const sub of subInterfaces) {
+                    queue.push(sub);
+                }
+            }
+        }
+        return Array.from(result);
+    }
+    /**
+     * Check if a type is a subtype of another (including transitive)
+     */
+    isSubtypeOf(childName, parentName) {
+        const childFqn = this.resolveFqn(childName);
+        const parentFqn = this.resolveFqn(parentName);
+        if (childFqn === parentFqn)
+            return true;
+        // Check class hierarchy
+        const allSubtypes = this.getAllSubtypes(parentFqn);
+        if (allSubtypes.includes(childFqn))
+            return true;
+        // Check interface implementations
+        const allImpls = this.getAllImplementations(parentFqn);
+        if (allImpls.includes(childFqn))
+            return true;
+        return false;
+    }
+    /**
+     * Check if a type implements an interface (directly or through inheritance)
+     * Also handles interface-extends-interface relationships
+     */
+    implementsInterface(typeName, interfaceName) {
+        const typeFqn = this.resolveFqn(typeName);
+        const ifaceFqn = this.resolveFqn(interfaceName);
+        // Check class implementations
+        const allImpls = this.getAllImplementations(ifaceFqn);
+        if (allImpls.includes(typeFqn))
+            return true;
+        // Check interface-extends-interface (stored in subtypes)
+        const allSubtypes = this.getAllSubtypes(ifaceFqn);
+        if (allSubtypes.includes(typeFqn))
+            return true;
+        return false;
+    }
+    /**
+     * Get type info by name
+     */
+    getType(name) {
+        const fqn = this.resolveFqn(name);
+        return this.types.get(fqn);
+    }
+    /**
+     * Get all types matching a simple name
+     */
+    getTypesByName(simpleName) {
+        const fqns = this.nameToFqn.get(simpleName);
+        if (!fqns)
+            return [];
+        return Array.from(fqns)
+            .map(fqn => this.types.get(fqn))
+            .filter((t) => t !== undefined);
+    }
+    /**
+     * Get the file where a type is defined
+     */
+    getTypeFile(name) {
+        const type = this.getType(name);
+        return type?.file;
+    }
+    /**
+     * Check if a receiver type could match a target class
+     * Handles: exact match, subtype, implementation, simple name match
+     */
+    couldBeType(receiverType, targetClass) {
+        // Direct match
+        if (receiverType === targetClass)
+            return true;
+        // Simple name match
+        const receiverSimple = this.getSimpleName(receiverType);
+        const targetSimple = this.getSimpleName(targetClass);
+        if (receiverSimple === targetSimple)
+            return true;
+        // Subtype or implementation match
+        if (this.isSubtypeOf(receiverType, targetClass))
+            return true;
+        // Check if receiver could be a subtype of target
+        const allSubtypes = this.getAllSubtypes(targetClass);
+        const allImpls = this.getAllImplementations(targetClass);
+        for (const sub of [...allSubtypes, ...allImpls]) {
+            const subSimple = this.getSimpleName(sub);
+            if (subSimple === receiverSimple)
+                return true;
+        }
+        return false;
+    }
+    /**
+     * Export hierarchy data in the CircleIR format
+     */
+    toTypeHierarchyData() {
+        const classes = {};
+        const interfaces = {};
+        for (const [fqn, node] of this.types) {
+            if (node.kind === 'class' || node.kind === 'enum') {
+                classes[fqn] = {
+                    file: node.file,
+                    extends: node.extends ? this.resolveTypeName(node.extends, this.getPackage(fqn)) : null,
+                    implements: node.implements.map(i => this.resolveTypeName(i, this.getPackage(fqn))),
+                    subclasses: this.getDirectSubtypes(fqn),
+                };
+            }
+            else if (node.kind === 'interface') {
+                interfaces[fqn] = {
+                    file: node.file,
+                    extends: node.extendsInterfaces.map(i => this.resolveTypeName(i, this.getPackage(fqn))),
+                    implementations: this.getDirectImplementations(fqn),
+                };
+            }
+        }
+        return { classes, interfaces };
+    }
+    /**
+     * Get statistics about the hierarchy
+     */
+    getStats() {
+        let classes = 0, interfaces = 0, enums = 0;
+        for (const node of this.types.values()) {
+            if (node.kind === 'class')
+                classes++;
+            else if (node.kind === 'interface')
+                interfaces++;
+            else if (node.kind === 'enum')
+                enums++;
+        }
+        return { totalTypes: this.types.size, classes, interfaces, enums };
+    }
+    /**
+     * Get all types in the hierarchy
+     */
+    getAllTypes() {
+        return Array.from(this.types.values());
+    }
+    /**
+     * Clear all data
+     */
+    clear() {
+        this.types.clear();
+        this.nameToFqn.clear();
+        this.subtypes.clear();
+        this.implementations.clear();
+    }
+    // --- Private helpers ---
+    /**
+     * Resolve a type name to its FQN
+     */
+    resolveTypeName(name, currentPackage) {
+        // Already fully qualified
+        if (name.includes('.'))
+            return name;
+        // Check if we know this type
+        const fqns = this.nameToFqn.get(name);
+        if (fqns && fqns.size === 1) {
+            return Array.from(fqns)[0];
+        }
+        // Assume same package
+        return currentPackage ? `${currentPackage}.${name}` : name;
+    }
+    /**
+     * Resolve a name (simple or FQN) to its FQN
+     */
+    resolveFqn(name) {
+        // Already in types map
+        if (this.types.has(name))
+            return name;
+        // Try to find by simple name
+        const fqns = this.nameToFqn.get(name);
+        if (fqns && fqns.size > 0) {
+            return Array.from(fqns)[0];
+        }
+        return name;
+    }
+    /**
+     * Get simple name from FQN
+     */
+    getSimpleName(name) {
+        const lastDot = name.lastIndexOf('.');
+        return lastDot === -1 ? name : name.substring(lastDot + 1);
+    }
+    /**
+     * Get package from FQN
+     */
+    getPackage(fqn) {
+        const lastDot = fqn.lastIndexOf('.');
+        return lastDot === -1 ? '' : fqn.substring(0, lastDot);
+    }
+}
+/**
+ * Pre-populated common Java type hierarchy
+ * These are standard JDK types that code often extends/implements
+ */
+export function createWithJdkTypes() {
+    const resolver = new TypeHierarchyResolver();
+    // Add common JDBC hierarchy
+    const jdbcTypes = [
+        {
+            name: 'Statement',
+            kind: 'interface',
+            package: 'java.sql',
+            extends: null,
+            implements: [],
+            annotations: [],
+            methods: [],
+            fields: [],
+            start_line: 0,
+            end_line: 0,
+        },
+        {
+            name: 'PreparedStatement',
+            kind: 'interface',
+            package: 'java.sql',
+            extends: null,
+            implements: ['Statement'],
+            annotations: [],
+            methods: [],
+            fields: [],
+            start_line: 0,
+            end_line: 0,
+        },
+        {
+            name: 'CallableStatement',
+            kind: 'interface',
+            package: 'java.sql',
+            extends: null,
+            implements: ['PreparedStatement'],
+            annotations: [],
+            methods: [],
+            fields: [],
+            start_line: 0,
+            end_line: 0,
+        },
+    ];
+    // Add common IO hierarchy
+    const ioTypes = [
+        {
+            name: 'InputStream',
+            kind: 'class',
+            package: 'java.io',
+            extends: null,
+            implements: [],
+            annotations: [],
+            methods: [],
+            fields: [],
+            start_line: 0,
+            end_line: 0,
+        },
+        {
+            name: 'FileInputStream',
+            kind: 'class',
+            package: 'java.io',
+            extends: 'InputStream',
+            implements: [],
+            annotations: [],
+            methods: [],
+            fields: [],
+            start_line: 0,
+            end_line: 0,
+        },
+        {
+            name: 'OutputStream',
+            kind: 'class',
+            package: 'java.io',
+            extends: null,
+            implements: [],
+            annotations: [],
+            methods: [],
+            fields: [],
+            start_line: 0,
+            end_line: 0,
+        },
+        {
+            name: 'FileOutputStream',
+            kind: 'class',
+            package: 'java.io',
+            extends: 'OutputStream',
+            implements: [],
+            annotations: [],
+            methods: [],
+            fields: [],
+            start_line: 0,
+            end_line: 0,
+        },
+        {
+            name: 'Writer',
+            kind: 'class',
+            package: 'java.io',
+            extends: null,
+            implements: [],
+            annotations: [],
+            methods: [],
+            fields: [],
+            start_line: 0,
+            end_line: 0,
+        },
+        {
+            name: 'PrintWriter',
+            kind: 'class',
+            package: 'java.io',
+            extends: 'Writer',
+            implements: [],
+            annotations: [],
+            methods: [],
+            fields: [],
+            start_line: 0,
+            end_line: 0,
+        },
+    ];
+    // Add servlet hierarchy
+    const servletTypes = [
+        {
+            name: 'ServletRequest',
+            kind: 'interface',
+            package: 'javax.servlet',
+            extends: null,
+            implements: [],
+            annotations: [],
+            methods: [],
+            fields: [],
+            start_line: 0,
+            end_line: 0,
+        },
+        {
+            name: 'HttpServletRequest',
+            kind: 'interface',
+            package: 'javax.servlet.http',
+            extends: null,
+            implements: ['javax.servlet.ServletRequest'], // FQN for cross-package reference
+            annotations: [],
+            methods: [],
+            fields: [],
+            start_line: 0,
+            end_line: 0,
+        },
+        {
+            name: 'ServletResponse',
+            kind: 'interface',
+            package: 'javax.servlet',
+            extends: null,
+            implements: [],
+            annotations: [],
+            methods: [],
+            fields: [],
+            start_line: 0,
+            end_line: 0,
+        },
+        {
+            name: 'HttpServletResponse',
+            kind: 'interface',
+            package: 'javax.servlet.http',
+            extends: null,
+            implements: ['javax.servlet.ServletResponse'], // FQN for cross-package reference
+            annotations: [],
+            methods: [],
+            fields: [],
+            start_line: 0,
+            end_line: 0,
+        },
+    ];
+    // Add all JDK types
+    for (const type of [...jdbcTypes, ...ioTypes, ...servletTypes]) {
+        resolver.addType(type, 'jdk', type.package);
+    }
+    return resolver;
+}
+//# sourceMappingURL=type-hierarchy.js.map

package/dist/resolution/type-hierarchy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"type-hierarchy.js","sourceRoot":"","sources":["../../src/resolution/type-hierarchy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAwBH;;GAEG;AACH,MAAM,OAAO,qBAAqB;IAChC,yBAAyB;IACjB,KAAK,GAA0B,IAAI,GAAG,EAAE,CAAC;IAEjD,8CAA8C;IACtC,SAAS,GAA6B,IAAI,GAAG,EAAE,CAAC;IAExD,kDAAkD;IAC1C,QAAQ,GAA6B,IAAI,GAAG,EAAE,CAAC;IAEvD,yEAAyE;IACjE,eAAe,GAA6B,IAAI,GAAG,EAAE,CAAC;IAE9D;;OAEG;IACH,SAAS,CAAC,EAAY,EAAE,QAAgB;QACtC,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,IAAc,EAAE,QAAgB,EAAE,iBAAgC,IAAI;QAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,IAAI,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAEpD,MAAM,IAAI,GAAa;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG;YACH,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,iBAAiB,EAAE,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;YACnE,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,IAAI,CAAC,UAAU;SACtB,CAAC;QAEF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAE1B,mCAAmC;QACnC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAExC,kCAAkC;QAClC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAClD,0BAA0B;YAC1B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBAC1D,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;gBAC1C,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzC,CAAC;YAED,kCAAkC;YAClC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAClD,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACxC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;gBAChD,CAAC;gBACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACrC,uDAAuD;YACvD,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;gBACzD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;oBAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;gBAC1C,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,SAAiB;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACvC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,SAAiB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;QAEpB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;YAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,IAAI,QAAQ,EAAE,CAAC;gBACb,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;oBAC7B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;wBACvB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;wBAClB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACpB,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,wBAAwB,CAAC,aAAqB;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAC3C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,aAAqB;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;QAEpB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;YAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YACnC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAErB,6BAA6B;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAChD,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACjB,4CAA4C;oBAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;oBAC3C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;wBAC/B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBACtB,CAAC;gBACH,CAAC;YACH,CAAC;YAED,6BAA6B;YAC7B,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,aAAa,EAAE,CAAC;gBAClB,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;oBAChC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,SAAiB,EAAE,UAAkB;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAE9C,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAExC,wBAAwB;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAEhD,kCAAkC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAE7C,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,mBAAmB,CAAC,QAAgB,EAAE,aAAqB;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAEhD,8BAA8B;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAE5C,yDAAyD;QACzD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAE/C,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,IAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAClC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,UAAkB;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;aACpB,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;aAC/B,MAAM,CAAC,CAAC,CAAC,EAAiB,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IACnD,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,IAAY;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,IAAI,EAAE,IAAI,CAAC;IACpB,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,YAAoB,EAAE,WAAmB;QACnD,eAAe;QACf,IAAI,YAAY,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAE9C,oBAAoB;QACpB,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QACxD,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,cAAc,KAAK,YAAY;YAAE,OAAO,IAAI,CAAC;QAEjD,kCAAkC;QAClC,IAAI,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;QAE7D,iDAAiD;QACjD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAEzD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,WAAW,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;YAChD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,SAAS,KAAK,cAAc;gBAAE,OAAO,IAAI,CAAC;QAChD,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,mBAAmB;QACjB,MAAM,OAAO,GAAuC,EAAE,CAAC;QACvD,MAAM,UAAU,GAA2C,EAAE,CAAC;QAE9D,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,GAAG;oBACb,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;oBACvF,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;oBACnF,UAAU,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC;iBACxC,CAAC;YACJ,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBACrC,UAAU,CAAC,GAAG,CAAC,GAAG;oBAChB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;oBACvF,eAAe,EAAE,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC;iBACpD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,OAAO,GAAG,CAAC,EAAE,UAAU,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;QAC3C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO;gBAAE,OAAO,EAAE,CAAC;iBAChC,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;gBAAE,UAAU,EAAE,CAAC;iBAC5C,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;gBAAE,KAAK,EAAE,CAAC;QACzC,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACrE,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;IAED,0BAA0B;IAE1B;;OAEG;IACK,eAAe,CAAC,IAAY,EAAE,cAAsB;QAC1D,0BAA0B;QAC1B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpC,6BAA6B;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QAED,sBAAsB;QACtB,OAAO,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,IAAY;QAC7B,uBAAuB;QACvB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAEtC,6BAA6B;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,IAAY;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAAW;QAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,QAAQ,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAE7C,4BAA4B;IAC5B,MAAM,SAAS,GAAe;QAC5B;YACE,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,UAAU;YACnB,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,EAAE;YACd,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE,CAAC;SACZ;QACD;YACE,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,UAAU;YACnB,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,CAAC,WAAW,CAAC;YACzB,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE,CAAC;SACZ;QACD;YACE,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,UAAU;YACnB,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,CAAC,mBAAmB,CAAC;YACjC,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE,CAAC;SACZ;KACF,CAAC;IAEF,0BAA0B;IAC1B,MAAM,OAAO,GAAe;QAC1B;YACE,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,EAAE;YACd,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE,CAAC;SACZ;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,aAAa;YACtB,UAAU,EAAE,EAAE;YACd,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE,CAAC;SACZ;QACD;YACE,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,EAAE;YACd,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE,CAAC;SACZ;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,cAAc;YACvB,UAAU,EAAE,EAAE;YACd,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE,CAAC;SACZ;QACD;YACE,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,EAAE;YACd,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE,CAAC;SACZ;QACD;YACE,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,SAAS;YAClB,OAAO,EAAE,QAAQ;YACjB,UAAU,EAAE,EAAE;YACd,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE,CAAC;SACZ;KACF,CAAC;IAEF,wBAAwB;IACxB,MAAM,YAAY,GAAe;QAC/B;YACE,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,eAAe;YACxB,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,EAAE;YACd,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE,CAAC;SACZ;QACD;YACE,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,oBAAoB;YAC7B,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,CAAC,8BAA8B,CAAC,EAAG,kCAAkC;YACjF,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE,CAAC;SACZ;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,eAAe;YACxB,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,EAAE;YACd,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE,CAAC;SACZ;QACD;YACE,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,oBAAoB;YAC7B,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,CAAC,+BAA+B,CAAC,EAAG,kCAAkC;YAClF,WAAW,EAAE,EAAE;YACf,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,QAAQ,EAAE,CAAC;SACZ;KACF,CAAC;IAEF,oBAAoB;IACpB,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,SAAS,EAAE,GAAG,OAAO,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC;QAC/D,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/types/config.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Types for YAML configuration files (configs/sources/, configs/sinks/)
+ */
+import type { Severity, SinkType, SourceType } from './index.js';
+export interface SourceConfig {
+    sources: SourcePattern[];
+}
+export interface SourcePattern {
+    method?: string;
+    class?: string;
+    property?: string;
+    object?: string;
+    annotation?: string;
+    type: SourceType;
+    severity: Severity;
+    return_tainted?: boolean;
+    param_tainted?: boolean;
+    property_tainted?: boolean;
+    note?: string;
+}
+export interface SinkConfig {
+    sinks: SinkPattern[];
+    sanitizers?: SanitizerPattern[];
+}
+export interface SinkPattern {
+    method: string;
+    class?: string;
+    type: SinkType;
+    cwe: string;
+    severity: Severity;
+    arg_positions: number[];
+    note?: string;
+}
+export interface SanitizerPattern {
+    method?: string;
+    class?: string;
+    annotation?: string;
+    removes: SinkType[];
+    note?: string;
+}
+export interface TaintConfig {
+    sources: SourcePattern[];
+    sinks: SinkPattern[];
+    sanitizers: SanitizerPattern[];
+}

package/dist/types/config.js

@@ -0,0 +1,5 @@
+/**
+ * Types for YAML configuration files (configs/sources/, configs/sinks/)
+ */
+export {};
+//# sourceMappingURL=config.js.map

package/dist/types/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/types/config.ts"],"names":[],"mappings":"AAAA;;GAEG"}