circle-ir 3.108.0 → 3.111.0

package/dist/browser/circle-ir.js

@@ -11169,10 +11169,20 @@ var DEFAULT_SINKS = [
   { method: "bash", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "shell", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "sh", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
-  { method: "spawn", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // cognium-dev #187 Sprint 54: arg_positions [0, 1] so the JS shell-mode shape
+  // `spawn('sh', ['-c', tainted])` / `execFile('/bin/sh', ['-c', tainted])`
+  // surfaces taint at the argv-array position (arg[1]).
+  { method: "spawn", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
+  { method: "spawnSync", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
+  { method: "execFile", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
+  { method: "execFileSync", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0, 1] },
   { method: "fork", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "popen", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "system", languages: ["java", "javascript", "typescript", "python", "go", "rust"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // execa (npm) — parses tainted shell-style strings into program+argv;
+  // arg[0] is shell-injectable. cognium-dev #187 Sprint 54.
+  { method: "command", class: "execa", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  { method: "commandSync", class: "execa", languages: ["javascript", "typescript"], type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   // Apache Commons Exec
   // Note: bare class 'Executor' removed (see comment above) — DefaultExecutor matched explicitly.
   { method: "setCommandline", class: "DefaultExecutor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
@@ -12183,7 +12193,9 @@ var DEFAULT_SINKS = [
   { method: "aggregate", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0] },
   // pymongo dynamic attribute-access pattern: `db.users.find({...})` — receiver
   // class isn't statically known. Method-only entries restricted to Python.
-  // cognium-dev#104 Sprint 22.
+  // cognium-dev#104 Sprint 22, #194 Sprint 54 added `find`/`aggregate`.
+  { method: "find", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "aggregate", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "find_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0], languages: ["python"] },
   { method: "update_one", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
   { method: "update_many", type: "nosql_injection", cwe: "CWE-943", severity: "critical", arg_positions: [0, 1], languages: ["python"] },
@@ -12195,21 +12207,32 @@ var DEFAULT_SINKS = [
   { method: "from_string", class: "Template", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "Template", class: "jinja2", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "Template", class: "mako", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
-  // Python Log Injection
-  { method: "info", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "warning", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "error", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "debug", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "critical", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  // Python Log Injection — cognium-dev #193: positions [0, 1, 2, 3, 4]
+  // cover both the format string (arg 0) and Python `logging`'s positional
+  // *args (1..N), which get rendered into the log line via `%` substitution
+  // (e.g. `log.warning("user=%s", user)` taints via arg 1). Five-arg cap
+  // matches the established explicit-enumeration pattern used elsewhere in
+  // this file.
+  { method: "info", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "warning", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "warn", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "error", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "debug", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "critical", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "fatal", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "exception", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "log", class: "logger", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1, 2, 3, 4] },
   // Python `logging` module top-level functions (e.g. logging.info(...))
   // — cognium-dev#104 Sprint 22: OOP fixtures use `import logging; logging.info(self.msg)`.
-  { method: "info", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "warning", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "error", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "debug", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "critical", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
-  { method: "log", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1] },
-  { method: "exception", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0] },
+  { method: "info", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "warning", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "warn", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "error", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "debug", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "critical", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "fatal", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
+  { method: "log", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [1, 2, 3, 4] },
+  { method: "exception", class: "logging", type: "log_injection", cwe: "CWE-117", severity: "low", arg_positions: [0, 1, 2, 3, 4] },
   // =========================================================================
   // Java CWE-Bench Enhancement Patterns (Collection/Builder)
   // =========================================================================
@@ -12839,10 +12862,50 @@ var PYTHON_TAINTED_PATTERNS = [
 function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy, language, code) {
   const sourceLines = code !== void 0 ? code.split("\n") : void 0;
   const sources = findSources(calls, types, config.sources, sourceLines, language);
-  const sinks = findSinks(calls, config.sinks, typeHierarchy, language, sourceLines);
+  const sinkPatterns = expandPromisifyAliases(config.sinks, sourceLines, language);
+  const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines);
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
   return { sources, sinks, sanitizers };
 }
+function expandPromisifyAliases(patterns, sourceLines, language) {
+  if (!sourceLines || sourceLines.length === 0) return patterns;
+  if (language !== "javascript" && language !== "typescript") return patterns;
+  const PROMISIFY_RE = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:util\s*\.\s*)?promisify\s*\(\s*([A-Za-z_$][\w$]*)\s*\)/;
+  const innerToPattern = /* @__PURE__ */ new Map();
+  for (const p of patterns) {
+    if (p.languages && !p.languages.includes(language)) continue;
+    if (p.class !== void 0) continue;
+    if (!innerToPattern.has(p.method)) innerToPattern.set(p.method, p);
+  }
+  for (const p of patterns) {
+    if (p.languages && !p.languages.includes(language)) continue;
+    if (innerToPattern.has(p.method)) continue;
+    innerToPattern.set(p.method, p);
+  }
+  const aliasPatterns = [];
+  const seenAliases = /* @__PURE__ */ new Set();
+  for (const line of sourceLines) {
+    const m = PROMISIFY_RE.exec(line);
+    if (!m) continue;
+    const aliasName = m[1];
+    const innerName = m[2];
+    if (!aliasName || !innerName) continue;
+    if (seenAliases.has(aliasName)) continue;
+    const template = innerToPattern.get(innerName);
+    if (!template) continue;
+    seenAliases.add(aliasName);
+    aliasPatterns.push({
+      method: aliasName,
+      type: template.type,
+      cwe: template.cwe,
+      severity: template.severity,
+      arg_positions: template.arg_positions,
+      languages: [language],
+      note: `util.promisify alias of ${innerName} \u2014 cognium-dev #187`
+    });
+  }
+  return aliasPatterns.length === 0 ? patterns : patterns.concat(aliasPatterns);
+}
 function attachSourceLineCode(sources, sinks, code) {
   const lines = code.split("\n");
   for (const s of sources) {
@@ -13208,6 +13271,41 @@ function isSafeGoExecCommandCall(call, pattern, language) {
   if (SHELL_PROGRAMS.has(program)) return false;
   return true;
 }
+function isSafeJSChildProcessCall(call, pattern, language) {
+  if (language !== "javascript" && language !== "typescript") return false;
+  if (pattern.type !== "command_injection") return false;
+  const m = call.method_name;
+  if (m !== "spawn" && m !== "spawnSync" && m !== "execFile" && m !== "execFileSync") return false;
+  const programArg = call.arguments.find((a) => a.position === 0);
+  if (!programArg) return false;
+  let program;
+  if (programArg.literal !== null && programArg.literal !== void 0) {
+    program = String(programArg.literal).split("/").pop() ?? String(programArg.literal);
+  } else {
+    const expr = (programArg.expression ?? "").trim();
+    if (!(expr.startsWith('"') || expr.startsWith("`") || expr.startsWith("'"))) {
+      return false;
+    }
+    const stripped = expr.slice(1, -1);
+    program = stripped.split("/").pop() ?? stripped;
+  }
+  const SHELL_PROGRAMS = /* @__PURE__ */ new Set([
+    "sh",
+    "bash",
+    "zsh",
+    "dash",
+    "ash",
+    "ksh",
+    "cmd",
+    "cmd.exe",
+    "powershell",
+    "pwsh",
+    "powershell.exe",
+    "pwsh.exe"
+  ]);
+  if (SHELL_PROGRAMS.has(program)) return false;
+  return true;
+}
 function isSafeRustCommandCall(call, pattern, language) {
   if (language !== "rust") return false;
   if (pattern.type !== "command_injection") return false;
@@ -13422,6 +13520,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (isSafeRustCommandCall(call, pattern, language)) {
           continue;
         }
+        if (isSafeJSChildProcessCall(call, pattern, language)) {
+          continue;
+        }
         if (pattern.safe_if_class_literal_at !== void 0 && argIsClassLiteral(call, pattern.safe_if_class_literal_at)) {
           continue;
         }
@@ -13859,6 +13960,9 @@ function receiverMightBeClass(receiver, className) {
         return true;
       }
     }
+    if (className === "Logger" && /\.getLogger\(.*\)$/.test(receiver)) {
+      return true;
+    }
   }
   if (receiver.includes("::") && receiver.endsWith(")")) {
     const scopedMatch = receiver.match(/^(\w+)::(\w+)\(.*\)$/);
@@ -24415,6 +24519,25 @@ var JS_XSS_SANITIZERS = [
   /\bbypassSecurityTrust/
   // Angular
 ];
+var JS_LOG_INJECTION_SANITIZERS = [
+  /\bstripCrlf\s*\(/,
+  /\bstripCRLF\s*\(/,
+  /\bremoveNewlines\s*\(/,
+  /\bsanitizeLogValue\s*\(/,
+  // Inline CRLF-stripping regex literal: .replace(/[\r\n]/g, '')
+  /\.replace\(\s*\/\[\s*\\r\s*\\n\s*\]\/[gimsu]*\s*,\s*['"`]['"`]\s*\)/,
+  // Inline CRLF sequence: .replace(/\r\n/g, '')
+  /\.replace\(\s*\/\\r\\n\/[gimsu]*\s*,\s*['"`]['"`]\s*\)/
+];
+var PY_BUILTIN_LDAP_SANITIZERS = ["escape_filter_chars", "filter_format"];
+var PY_LDAP_METACHARS = ["(", ")", "=", "*", "\\"];
+var PY_DEF_RE = /^\s*def\s+([A-Za-z_]\w*)\s*\(\s*([A-Za-z_]\w*)\s*\)\s*:\s*$/;
+var PY_LDAP_STRIP_RETURN_RE = /^\s*return\s+re\.sub\(\s*r?["']\[([^"'\]]+)\]["']\s*,\s*r?["']["']\s*,\s*([A-Za-z_]\w*)\s*\)\s*$/;
+var PY_XML_PARSER_HARDENED_RE = /\bXMLParser\s*\([^)]*\bresolve_entities\s*=\s*False\b[^)]*\)/;
+var PY_SQL_EXEC_METHODS = /* @__PURE__ */ new Set(["execute", "executemany"]);
+var PY_INLINE_FULLMATCH_RE = /\bre\s*\.\s*fullmatch\s*\(\s*r?"((?:[^"\\]|\\.)*)"/g;
+var PY_INLINE_MATCH_ANCHORED_RE = /\bre\s*\.\s*match\s*\(\s*r?"\^((?:[^"\\]|\\.)*)\$"/g;
+var PY_BIND_PLACEHOLDER_RE = /\?|%s|:[A-Za-z_]\w*/;
 var DATA_PARSER_TYPES = /* @__PURE__ */ new Set([
   "Parser",
   // commonmark, airline, picocli, jcommander
@@ -25125,9 +25248,329 @@ var SinkFilterPass = class {
         return true;
       });
     }
+    if (["javascript", "typescript"].includes(language)) {
+      const sourceLines = ctx.code.split("\n");
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "log_injection") return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        if (JS_LOG_INJECTION_SANITIZERS.some((p) => p.test(sinkLineText))) return false;
+        const varNames = extractSourceIdentifiers(sinkLineText);
+        for (const v of varNames) {
+          if (isAssignedFromSanitizerPattern(sourceLines, sink.line, v, JS_LOG_INJECTION_SANITIZERS)) {
+            return false;
+          }
+        }
+        return true;
+      });
+    }
+    if (language === "python") {
+      const sourceLines = ctx.code.split("\n");
+      const wrappers = findPythonLdapStripWrappers(sourceLines);
+      const allLdapSanitizers = [...PY_BUILTIN_LDAP_SANITIZERS, ...wrappers];
+      if (allLdapSanitizers.length > 0) {
+        const ldapPatterns = allLdapSanitizers.map(
+          (name2) => new RegExp(`\\b${escapeRegex(name2)}\\s*\\(`)
+        );
+        filtered = filtered.filter((sink) => {
+          if (sink.type !== "ldap_injection") return true;
+          const sinkLineText = sourceLines[sink.line - 1] ?? "";
+          if (ldapPatterns.some((p) => p.test(sinkLineText))) return false;
+          const varNames = extractSourceIdentifiers(sinkLineText);
+          for (const v of varNames) {
+            if (isAssignedFromSanitizerPattern(sourceLines, sink.line, v, ldapPatterns)) {
+              return false;
+            }
+          }
+          return true;
+        });
+      }
+    }
+    if (language === "python") {
+      const sourceLines = ctx.code.split("\n");
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "xxe") return true;
+        const lookback = 30;
+        const lo = Math.max(0, sink.line - 1 - lookback);
+        for (let i2 = sink.line - 2; i2 >= lo; i2--) {
+          const ln = sourceLines[i2] ?? "";
+          if (PY_XML_PARSER_HARDENED_RE.test(ln)) return false;
+          if (/^\s*def\s+\w+\s*\(/.test(ln)) break;
+        }
+        return true;
+      });
+    }
+    if (language === "python") {
+      const sourceLines = ctx.code.split("\n");
+      filtered = filtered.filter((sink) => {
+        if (sink.type !== "sql_injection") return true;
+        const method = sink.method ?? "";
+        if (!PY_SQL_EXEC_METHODS.has(method)) return true;
+        const sinkLineText = sourceLines[sink.line - 1] ?? "";
+        const fstrMatch = sinkLineText.match(/\bf"((?:[^"\\]|\\.)*)"|\bf'((?:[^'\\]|\\.)*)'/);
+        if (!fstrMatch) return true;
+        const fstrBody = fstrMatch[1] ?? fstrMatch[2] ?? "";
+        const { literals, interps } = splitPyFstringTokens(fstrBody);
+        if (interps.length === 0) return true;
+        if (!literals.some((lit) => PY_BIND_PLACEHOLDER_RE.test(lit))) return true;
+        let sawHelperWithGuard = false;
+        for (const interp of interps) {
+          const t = interp.trim();
+          if (t === "") return true;
+          if (/^-?\d+$/.test(t) || /^"(?:[^"\\]|\\.)*"$/.test(t) || /^'(?:[^'\\]|\\.)*'$/.test(t)) {
+            continue;
+          }
+          let helperName = null;
+          const directCall = t.match(/^([A-Za-z_]\w*)\s*\(/);
+          if (directCall) {
+            helperName = directCall[1] ?? null;
+          } else if (/^[A-Za-z_]\w*$/.test(t)) {
+            helperName = findPythonAssignedHelperCall(t, sink.line, sourceLines);
+            if (helperName === null) return true;
+          } else {
+            return true;
+          }
+          const body2 = findPythonFunctionBody(helperName, sourceLines);
+          if (body2 && pythonBodyHasInlineRegexAllowlistRaise(body2)) {
+            sawHelperWithGuard = true;
+          }
+        }
+        if (!sawHelperWithGuard) return true;
+        return false;
+      });
+    }
     return { sources, sinks: filtered, sanitizers };
   }
 };
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var RESERVED_KEYWORDS = /* @__PURE__ */ new Set([
+  // JS/TS
+  "if",
+  "else",
+  "return",
+  "const",
+  "let",
+  "var",
+  "function",
+  "class",
+  "new",
+  "this",
+  "for",
+  "while",
+  "do",
+  "break",
+  "continue",
+  "switch",
+  "case",
+  "default",
+  "try",
+  "catch",
+  "finally",
+  "throw",
+  "typeof",
+  "instanceof",
+  "in",
+  "of",
+  "await",
+  "async",
+  "import",
+  "export",
+  "from",
+  "as",
+  "void",
+  "null",
+  "undefined",
+  "true",
+  "false",
+  "super",
+  "extends",
+  "static",
+  // Python
+  "def",
+  "lambda",
+  "yield",
+  "pass",
+  "with",
+  "global",
+  "nonlocal",
+  "and",
+  "or",
+  "not",
+  "is",
+  "None",
+  "True",
+  "False",
+  "raise",
+  "except",
+  "elif",
+  "self",
+  "cls",
+  "print",
+  // Common stdlib roots that show up everywhere and would balloon scans.
+  "console",
+  "req",
+  "res",
+  "request",
+  "response"
+]);
+function extractSourceIdentifiers(text) {
+  const out2 = [];
+  const re = /\b([A-Za-z_]\w+)\b/g;
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    const name2 = m[1];
+    if (!RESERVED_KEYWORDS.has(name2)) out2.push(name2);
+  }
+  return out2;
+}
+function isAssignedFromSanitizerPattern(sourceLines, sinkLine, varName, sanitizerPatterns, lookback = 30) {
+  const escapedVar = escapeRegex(varName);
+  const assignRe = new RegExp(
+    `(?:\\b(?:const|let|var|final|String)\\s+)?\\b${escapedVar}\\s*=\\s*(.+)`
+  );
+  const fnBoundaryRe = /^\s*(?:def\s+\w+\s*\(|function\s+\w+\s*\(|\w+\s*[:=]\s*(?:async\s+)?\(?[^)]*\)?\s*=>)/;
+  const lo = Math.max(0, sinkLine - 1 - lookback);
+  for (let i2 = sinkLine - 2; i2 >= lo; i2--) {
+    const ln = sourceLines[i2] ?? "";
+    const m = ln.match(assignRe);
+    if (m) {
+      const rhs = (m[1] ?? "").trim();
+      return sanitizerPatterns.some((p) => p.test(rhs));
+    }
+    if (fnBoundaryRe.test(ln)) break;
+  }
+  return false;
+}
+function findPythonLdapStripWrappers(sourceLines) {
+  const out2 = [];
+  for (let i2 = 0; i2 < sourceLines.length; i2++) {
+    const defMatch = sourceLines[i2].match(PY_DEF_RE);
+    if (!defMatch) continue;
+    const fnName = defMatch[1];
+    const param = defMatch[2];
+    for (let j = i2 + 1; j < Math.min(i2 + 4, sourceLines.length); j++) {
+      const body2 = sourceLines[j];
+      if (/^\s*$/.test(body2) || /^\s*#/.test(body2)) continue;
+      const ret = body2.match(PY_LDAP_STRIP_RETURN_RE);
+      if (!ret) break;
+      const charClass = ret[1];
+      const argName = ret[2];
+      if (argName !== param) break;
+      const metaCount = PY_LDAP_METACHARS.filter((c) => charClass.includes(c)).length;
+      if (metaCount >= 3) out2.push(fnName);
+      break;
+    }
+  }
+  return out2;
+}
+function splitPyFstringTokens(body2) {
+  const literals = [];
+  const interps = [];
+  let i2 = 0;
+  let cur = "";
+  while (i2 < body2.length) {
+    const ch = body2[i2] ?? "";
+    if (ch === "{" && body2[i2 + 1] === "{") {
+      cur += "{";
+      i2 += 2;
+      continue;
+    }
+    if (ch === "}" && body2[i2 + 1] === "}") {
+      cur += "}";
+      i2 += 2;
+      continue;
+    }
+    if (ch === "{") {
+      literals.push(cur);
+      cur = "";
+      i2++;
+      let depth = 1;
+      let expr = "";
+      while (i2 < body2.length && depth > 0) {
+        const ch2 = body2[i2] ?? "";
+        if (ch2 === "{") {
+          depth++;
+          expr += ch2;
+          i2++;
+          continue;
+        }
+        if (ch2 === "}") {
+          depth--;
+          if (depth === 0) {
+            i2++;
+            break;
+          }
+          expr += ch2;
+          i2++;
+          continue;
+        }
+        expr += ch2;
+        i2++;
+      }
+      const colonIdx = expr.indexOf(":");
+      const interp = colonIdx >= 0 ? expr.substring(0, colonIdx) : expr;
+      interps.push(interp);
+      continue;
+    }
+    cur += ch;
+    i2++;
+  }
+  literals.push(cur);
+  return { literals, interps };
+}
+function findPythonAssignedHelperCall(varName, sinkLine, sourceLines) {
+  if (!/^[A-Za-z_]\w*$/.test(varName)) return null;
+  const lo = Math.max(0, sinkLine - 31);
+  const assignRe = new RegExp(
+    `^\\s*${varName}\\s*=\\s*([A-Za-z_]\\w*)\\s*\\(`
+  );
+  for (let i2 = sinkLine - 2; i2 >= lo; i2--) {
+    const ln = sourceLines[i2] ?? "";
+    const m = ln.match(assignRe);
+    if (m) return m[1] ?? null;
+  }
+  return null;
+}
+function findPythonFunctionBody(funcName, sourceLines) {
+  if (!/^[A-Za-z_]\w*$/.test(funcName)) return null;
+  const sigRe = new RegExp(`^(\\s*)def\\s+${funcName}\\s*\\(`);
+  for (let i2 = 0; i2 < sourceLines.length; i2++) {
+    const ln = sourceLines[i2] ?? "";
+    const m = ln.match(sigRe);
+    if (!m) continue;
+    const baseIndent = (m[1] ?? "").length;
+    const body2 = [];
+    for (let j = i2 + 1; j < sourceLines.length; j++) {
+      const ln2 = sourceLines[j] ?? "";
+      if (ln2.trim() === "") {
+        body2.push(ln2);
+        continue;
+      }
+      const indentMatch = ln2.match(/^(\s*)/);
+      const indent = (indentMatch?.[1] ?? "").length;
+      if (indent <= baseIndent) break;
+      body2.push(ln2);
+    }
+    return body2;
+  }
+  return null;
+}
+function pythonBodyHasInlineRegexAllowlistRaise(bodyLines) {
+  const stripped = bodyLines.map((ln) => ln.replace(/#.*$/, ""));
+  const text = stripped.join("\n");
+  if (!/\braise\s+/.test(text)) return false;
+  PY_INLINE_FULLMATCH_RE.lastIndex = 0;
+  let m;
+  while ((m = PY_INLINE_FULLMATCH_RE.exec(text)) !== null) {
+    if (isImplicitlyAnchoredAllowlistRegex(m[1] ?? "")) return true;
+  }
+  PY_INLINE_MATCH_ANCHORED_RE.lastIndex = 0;
+  while ((m = PY_INLINE_MATCH_ANCHORED_RE.exec(text)) !== null) {
+    if (isImplicitlyAnchoredAllowlistRegex(m[1] ?? "")) return true;
+  }
+  return false;
+}
 function evalArithmetic(input) {
   let pos = 0;
   const len = input.length;
@@ -25497,7 +25940,10 @@ var TaintPropagationPass = class {
           if (f.sink_type !== "nosql_injection") return true;
           const sink = sinkByLine.get(f.sink_line);
           if (!sink || !sink.code || !sink.method) return true;
-          return !isMongoValueBoundFilter(sink.code, sink.method);
+          const sourceVar = f.path && f.path.length > 0 ? f.path[0].variable : null;
+          const isHttpSource = typeof f.source_type === "string" && f.source_type.startsWith("http_");
+          const sourceVarForFilter = isHttpSource ? sourceVar : null;
+          return !isMongoValueBoundFilter(sink.code, sink.method, sourceVarForFilter);
         });
       }
     }
@@ -25532,7 +25978,7 @@ var TaintPropagationPass = class {
     return { flows: finalFlows };
   }
 };
-function isMongoValueBoundFilter(sinkCode, sinkMethod) {
+function isMongoValueBoundFilter(sinkCode, sinkMethod, sourceVar) {
   if (!sinkCode || !sinkMethod) return false;
   const callIdx = sinkCode.indexOf(`${sinkMethod}(`);
   if (callIdx < 0) return false;
@@ -25584,6 +26030,11 @@ function isMongoValueBoundFilter(sinkCode, sinkMethod) {
   if (/\.\.\./.test(stripped)) return false;
   if (/(^|[,{\s])\$[A-Za-z_]\w*\s*:/.test(stripped)) return false;
   if (/(['"])\$[A-Za-z_]\w*\1\s*:/.test(body2)) return false;
+  if (sourceVar && /^[A-Za-z_]\w*$/.test(sourceVar)) {
+    const escaped = sourceVar.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const tokenRe = new RegExp(`(?<![\\p{L}\\p{N}_])${escaped}(?![\\p{L}\\p{N}_])`, "u");
+    if (tokenRe.test(stripped)) return false;
+  }
   return true;
 }
 function isInJavaSanitizedMethod(code, types, sinkLine, sinkType) {
@@ -27171,7 +27622,7 @@ var NullDerefPass = class {
 };
 
 // src/analysis/passes/resource-leak-pass.ts
-function escapeRegex(s) {
+function escapeRegex2(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 var FACTORY_METHOD_NAME_RE = /^(?:open|create|new|get|make|build)[A-Z]/;
@@ -27334,7 +27785,7 @@ var ResourceLeakPass = class {
    * ownership to the caller (caller is responsible for close).
    */
   isReturnedToCaller(lines, variable, fromLine, toLine) {
-    const varRe = new RegExp(`\\breturn\\b[^;]*\\b${escapeRegex(variable)}\\b`);
+    const varRe = new RegExp(`\\breturn\\b[^;]*\\b${escapeRegex2(variable)}\\b`);
     for (let l = fromLine; l <= toLine && l <= lines.length; l++) {
       if (varRe.test(lines[l - 1] ?? "")) return true;
     }
@@ -27347,7 +27798,7 @@ var ResourceLeakPass = class {
    */
   fieldStoredName(lines, variable, openLine, toLine) {
     const thisAssignRe = new RegExp(
-      `\\bthis\\s*\\.\\s*(\\w+)\\s*=\\s*${escapeRegex(variable)}\\b`
+      `\\bthis\\s*\\.\\s*(\\w+)\\s*=\\s*${escapeRegex2(variable)}\\b`
     );
     for (let l = openLine; l <= toLine && l <= lines.length; l++) {
       const m = thisAssignRe.exec(lines[l - 1] ?? "");