circle-ir 3.118.0 → 3.121.0

package/dist/analysis/html/index.d.ts

@@ -8,5 +8,6 @@
  */
 export { extractHtmlContent, type HtmlScriptBlock, type HtmlEventHandler, type HtmlExtractionResult, } from './html-extractor.js';
 export { runHtmlAttributeSecurityChecks } from './html-attribute-security-pass.js';
+export { runVueTemplateXssChecks } from './vue-template-xss-pass.js';
 export { mergeHtmlResults, type ScriptBlockResult, } from './html-merge.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/analysis/html/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/analysis/html/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AAEnF,OAAO,EACL,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/analysis/html/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AAEnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAErE,OAAO,EACL,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,iBAAiB,CAAC"}

package/dist/analysis/html/index.js

@@ -8,5 +8,6 @@
  */
 export { extractHtmlContent, } from './html-extractor.js';
 export { runHtmlAttributeSecurityChecks } from './html-attribute-security-pass.js';
+export { runVueTemplateXssChecks } from './vue-template-xss-pass.js';
 export { mergeHtmlResults, } from './html-merge.js';
 //# sourceMappingURL=index.js.map

package/dist/analysis/html/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/analysis/html/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,kBAAkB,GAInB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AAEnF,OAAO,EACL,gBAAgB,GAEjB,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/analysis/html/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,kBAAkB,GAInB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AAEnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAErE,OAAO,EACL,gBAAgB,GAEjB,MAAM,iBAAiB,CAAC"}

package/dist/analysis/html/vue-template-xss-pass.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Vue Template XSS Pass
+ *
+ * Sprint 64 (cognium-dev #184, sprint 2 of 2). Synthetic-emission pass
+ * that walks the `<template>` subtree of a Vue Single-File Component
+ * looking for attribute bindings that write raw HTML
+ * (`v-html`, `v-bind:innerHTML`, `:innerHTML`, `v-bind:outerHTML`,
+ * `:outerHTML`). For each match it parses the RHS expression for JS
+ * identifiers and resolves them against the set of tainted variable
+ * names extracted from the file's `<script>` blocks. A match emits a
+ * `vue-template-xss` finding (CWE-79).
+ *
+ * The pass is invoked from `analyzeMarkupFile()` only when
+ * `language === 'vue'`; plain `.html` files skip it because raw-HTML
+ * sinks there land in `javascript_dom_xss.yaml` via the JS pipeline.
+ *
+ * Pattern mirrors `html-attribute-security-pass.ts`: walk the tree
+ * iteratively, emit `SastFinding` objects directly, no taint matcher,
+ * no sink-config YAML.
+ */
+import type { Node as SyntaxNode } from 'web-tree-sitter';
+import type { SastFinding } from '../../types/index.js';
+import type { ScriptBlockResult } from './html-merge.js';
+/**
+ * Walk the parse tree for a Vue SFC and emit `vue-template-xss`
+ * findings for dangerous template-attribute bindings that reference
+ * tainted identifiers from the file's script blocks.
+ *
+ * @param rootNode - tree-sitter-html root node of the .vue file
+ * @param filePath - path to the .vue file (for finding `file` field)
+ * @param scriptResults - per-script-block IRs produced earlier in
+ *   `analyzeMarkupFile()`. Each block's `ir.taint` + `ir.dfg` is the
+ *   source of truth for which identifiers are tainted.
+ */
+export declare function runVueTemplateXssChecks(rootNode: SyntaxNode, filePath: string, scriptResults: ScriptBlockResult[]): SastFinding[];
+//# sourceMappingURL=vue-template-xss-pass.d.ts.map

package/dist/analysis/html/vue-template-xss-pass.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vue-template-xss-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/html/vue-template-xss-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAiCzD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,iBAAiB,EAAE,GACjC,WAAW,EAAE,CAqBf"}

package/dist/analysis/html/vue-template-xss-pass.js

@@ -0,0 +1,163 @@
+/**
+ * Vue Template XSS Pass
+ *
+ * Sprint 64 (cognium-dev #184, sprint 2 of 2). Synthetic-emission pass
+ * that walks the `<template>` subtree of a Vue Single-File Component
+ * looking for attribute bindings that write raw HTML
+ * (`v-html`, `v-bind:innerHTML`, `:innerHTML`, `v-bind:outerHTML`,
+ * `:outerHTML`). For each match it parses the RHS expression for JS
+ * identifiers and resolves them against the set of tainted variable
+ * names extracted from the file's `<script>` blocks. A match emits a
+ * `vue-template-xss` finding (CWE-79).
+ *
+ * The pass is invoked from `analyzeMarkupFile()` only when
+ * `language === 'vue'`; plain `.html` files skip it because raw-HTML
+ * sinks there land in `javascript_dom_xss.yaml` via the JS pipeline.
+ *
+ * Pattern mirrors `html-attribute-security-pass.ts`: walk the tree
+ * iteratively, emit `SastFinding` objects directly, no taint matcher,
+ * no sink-config YAML.
+ */
+import { findChildByType, stripQuotes } from './html-extractor.js';
+/**
+ * Vue template attribute bindings that write raw HTML.
+ * v-text is intentionally excluded — it writes via textContent which
+ * the browser escapes, so it's safe.
+ */
+const DANGEROUS_BINDINGS = new Set([
+    'v-html',
+    'v-bind:innerhtml',
+    ':innerhtml',
+    'v-bind:outerhtml',
+    ':outerhtml',
+]);
+/**
+ * JS identifier matcher used to extract referenced names from the RHS
+ * expression of a binding. Chained access like `state.user.name`
+ * yields each identifier in turn (`state`, `user`, `name`); the first
+ * one that resolves to a tainted variable wins.
+ */
+const ID_RE = /\b([A-Za-z_$][A-Za-z0-9_$]*)\b/g;
+/**
+ * JS keywords / safe globals that must never count as taint candidates.
+ */
+const RESERVED = new Set([
+    'true', 'false', 'null', 'undefined', 'this', 'new', 'typeof',
+    'void', 'delete', 'instanceof', 'in', 'of',
+    'Math', 'Number', 'String', 'Boolean', 'Array', 'Object', 'JSON',
+]);
+/**
+ * Walk the parse tree for a Vue SFC and emit `vue-template-xss`
+ * findings for dangerous template-attribute bindings that reference
+ * tainted identifiers from the file's script blocks.
+ *
+ * @param rootNode - tree-sitter-html root node of the .vue file
+ * @param filePath - path to the .vue file (for finding `file` field)
+ * @param scriptResults - per-script-block IRs produced earlier in
+ *   `analyzeMarkupFile()`. Each block's `ir.taint` + `ir.dfg` is the
+ *   source of truth for which identifiers are tainted.
+ */
+export function runVueTemplateXssChecks(rootNode, filePath, scriptResults) {
+    const taintedNames = collectTaintedNames(scriptResults);
+    if (taintedNames.size === 0)
+        return [];
+    const findings = [];
+    // Iterative DFS — guard against stack overflow on deep templates,
+    // matches the pattern used in html-attribute-security-pass.ts.
+    const stack = [rootNode];
+    while (stack.length > 0) {
+        const node = stack.pop();
+        if (node.type === 'start_tag' || node.type === 'self_closing_tag') {
+            checkElementBindings(node, filePath, taintedNames, findings);
+        }
+        for (let i = node.childCount - 1; i >= 0; i--) {
+            const c = node.child(i);
+            if (c)
+                stack.push(c);
+        }
+    }
+    return findings;
+}
+function checkElementBindings(tag, filePath, tainted, out) {
+    for (let i = 0; i < tag.childCount; i++) {
+        const attr = tag.child(i);
+        if (!attr || attr.type !== 'attribute')
+            continue;
+        const nameNode = findChildByType(attr, 'attribute_name');
+        if (!nameNode)
+            continue;
+        const lcName = nameNode.text.toLowerCase();
+        if (!DANGEROUS_BINDINGS.has(lcName))
+            continue;
+        const valueNode = findChildByType(attr, 'quoted_attribute_value') ??
+            findChildByType(attr, 'attribute_value');
+        if (!valueNode)
+            continue;
+        const rhs = stripQuotes(valueNode.text);
+        if (!rhs.trim())
+            continue;
+        const matched = matchTaint(rhs, tainted);
+        if (!matched)
+            continue;
+        const line = nameNode.startPosition.row + 1;
+        out.push({
+            id: `vue-template-xss-${filePath}-${line}-${lcName}`,
+            pass: 'vue-template-xss',
+            category: 'security',
+            rule_id: 'vue-template-xss',
+            cwe: 'CWE-79',
+            severity: 'high',
+            level: 'error',
+            message: `Vue template attribute "${nameNode.text}" binds tainted identifier "${matched}" — writes raw HTML (XSS risk).`,
+            file: filePath,
+            line,
+            snippet: `${nameNode.text}="${rhs}"`,
+        });
+    }
+}
+function matchTaint(rhs, tainted) {
+    ID_RE.lastIndex = 0;
+    let m;
+    while ((m = ID_RE.exec(rhs)) !== null) {
+        const id = m[1];
+        if (RESERVED.has(id))
+            continue;
+        if (tainted.has(id))
+            return id;
+    }
+    return undefined;
+}
+/**
+ * Build the set of identifier names that should be treated as tainted
+ * when they appear on the RHS of a template binding. A name qualifies
+ * if either:
+ *   1. A `DFGDef` at the same line as a `TaintSource` carries it (the
+ *      variable directly captures a source expression), or
+ *   2. It appears in the `path` of any `TaintFlowInfo` (so
+ *      re-assignments like `const y = x;` where `x` is tainted carry
+ *      the taint through to `y`), or
+ *   3. The `TaintSource.variable` field is populated directly.
+ */
+function collectTaintedNames(blocks) {
+    const names = new Set();
+    for (const { ir } of blocks) {
+        const sourceLines = new Set();
+        for (const source of ir.taint.sources) {
+            sourceLines.add(source.line);
+            if (source.variable)
+                names.add(source.variable);
+        }
+        for (const def of ir.dfg.defs) {
+            if (sourceLines.has(def.line) && def.variable)
+                names.add(def.variable);
+        }
+        for (const flow of ir.taint.flows ?? []) {
+            for (const step of flow.path ?? []) {
+                if (step.variable)
+                    names.add(step.variable);
+            }
+        }
+    }
+    return names;
+}
+//# sourceMappingURL=vue-template-xss-pass.js.map

package/dist/analysis/html/vue-template-xss-pass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vue-template-xss-pass.js","sourceRoot":"","sources":["../../../src/analysis/html/vue-template-xss-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEnE;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAS;IACzC,QAAQ;IACR,kBAAkB;IAClB,YAAY;IACZ,kBAAkB;IAClB,YAAY;CACb,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,KAAK,GAAG,iCAAiC,CAAC;AAEhD;;GAEG;AACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS;IAC/B,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ;IAC7D,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI;IAC1C,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM;CACjE,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAoB,EACpB,QAAgB,EAChB,aAAkC;IAElC,MAAM,YAAY,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAC;IACxD,IAAI,YAAY,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEvC,MAAM,QAAQ,GAAkB,EAAE,CAAC;IAEnC,kEAAkE;IAClE,+DAA+D;IAC/D,MAAM,KAAK,GAAiB,CAAC,QAAQ,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAClE,oBAAoB,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAC3B,GAAe,EACf,QAAgB,EAChB,OAAoB,EACpB,GAAkB;IAElB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QAEjD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QAE9C,MAAM,SAAS,GACb,eAAe,CAAC,IAAI,EAAE,wBAAwB,CAAC;YAC/C,eAAe,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS;YAAE,SAAS;QAEzB,MAAM,GAAG,GAAG,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;YAAE,SAAS;QAE1B,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,oBAAoB,QAAQ,IAAI,IAAI,IAAI,MAAM,EAAE;YACpD,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,kBAAkB;YAC3B,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,OAAO;YACd,OAAO,EAAE,2BAA2B,QAAQ,CAAC,IAAI,+BAA+B,OAAO,iCAAiC;YACxH,IAAI,EAAE,QAAQ;YACd,IAAI;YACJ,OAAO,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,GAAG,GAAG;SACrC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,OAAoB;IACnD,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;IACpB,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,mBAAmB,CAAC,MAA2B;IACtD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,KAAK,MAAM,MAAM,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACtC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,MAAM,CAAC,QAAQ;gBAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClD,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACxC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;gBACnC,IAAI,IAAI,CAAC,QAAQ;oBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/analysis/passes/language-sources-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"language-sources-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/language-sources-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,WAAW,EAAO,MAAM,sBAAsB,CAAC;AAC3H,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqB9E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0C/B,CAAC;AA4BF,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAMD,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB;CAuH7C;AAgkBD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAkG9E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAwC5G;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBjD;AAoFD,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBpG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmCrB;AA8KD,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA0GvF"}
+{"version":3,"file":"language-sources-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/language-sources-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,WAAW,EAAO,MAAM,sBAAsB,CAAC;AAC3H,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqB9E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0C/B,CAAC;AA4BF,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAMD,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB;CAuH7C;AAgkBD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAkG9E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAwC5G;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBjD;AAoFD,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBpG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmCrB;AA+MD,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAmHvF"}

package/dist/analysis/passes/language-sources-pass.js

@@ -1240,9 +1240,49 @@ function findBashTaintSources(sourceCode, dfg) {
 // Bash/Shell pattern-based findings
 // ---------------------------------------------------------------------------
 const BASH_CREDENTIAL_PATTERN = /^(.*?)(password|passwd|secret|api_?key|token|auth_token|private_key|access_key)\s*=\s*["']?([^"'\s$][^"'\s]*)["']?\s*$/i;
+// Sprint 65 (#216): suppress predictable-temp-file when the same /tmp/X path
+// is verified by a checksum tool later in the script. This breaks the TOCTOU
+// substitution risk that justifies the warning.
+const BASH_CHECKSUM_VERIFY_PATTERN = /\b(?:sha(?:1|224|256|384|512)sum|md5sum|cksum|b2sum)\s+(?:-c\b|--check\b)/;
+function collectChecksumVerifiedTmpPaths(lines) {
+    const verified = new Set();
+    for (const line of lines) {
+        if (!BASH_CHECKSUM_VERIFY_PATTERN.test(line))
+            continue;
+        const matches = line.match(/\/tmp\/[^\s"'$|`]+/g);
+        if (!matches)
+            continue;
+        for (const p of matches)
+            verified.add(p);
+    }
+    return verified;
+}
+// Sprint 65 (#216): suppress predictable-temp-file when the /tmp file is the
+// WRITE TARGET of an archive command (tar/zip/gzip/7z/bzip2/xz). The file is
+// being produced, not consumed, so there is no TOCTOU read race.
+const BASH_ARCHIVE_EXT_PATTERN = /\.(?:tgz|tar\.gz|tar\.bz2|tar\.xz|tar|tbz2|txz|zip|gz|bz2|xz|7z)$/i;
+function isArchiveOutputContext(line, tmpRel) {
+    if (!BASH_ARCHIVE_EXT_PATTERN.test(tmpRel))
+        return false;
+    // tar with a create flag (c) anywhere in the flag cluster: tar czf, tar -cf, tar cvjf, etc.
+    if (/\btar\b/.test(line) && /(?:^|\s)-?[A-Za-z]*c[A-Za-z]*\b/.test(line))
+        return true;
+    if (/\bzip\b/.test(line) && !/\bunzip\b/.test(line))
+        return true;
+    if (/\bgzip\b/.test(line) && /(?:-c\b|--stdout\b|>)/.test(line))
+        return true;
+    if (/\bbzip2\b/.test(line) && /(?:-c\b|--stdout\b|>)/.test(line))
+        return true;
+    if (/\bxz\b/.test(line) && /(?:-c\b|--stdout\b|>)/.test(line))
+        return true;
+    if (/\b7z\s+a\b/.test(line))
+        return true;
+    return false;
+}
 export function findBashPatternFindings(sourceCode, file) {
     const findings = [];
     const lines = sourceCode.split('\n');
+    const checksumVerifiedTmpPaths = collectChecksumVerifiedTmpPaths(lines);
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
         const trimmed = line.trim();
@@ -1290,19 +1330,27 @@ export function findBashPatternFindings(sourceCode, file) {
         // 3. Predictable /tmp file (no variable in path)
         const tmpMatch = trimmed.match(/\/tmp\/([^\s"'$]+)/);
         if (tmpMatch && !/mktemp/.test(trimmed)) {
-            findings.push({
-                id: `predictable-temp-file-${file}-${lineNumber}`,
-                pass: 'language-sources',
-                category: 'security',
-                rule_id: 'predictable-temp-file',
-                cwe: 'CWE-377',
-                severity: 'medium',
-                level: 'warning',
-                message: `Predictable temp file: /tmp/${tmpMatch[1]}. Use mktemp instead`,
-                file,
-                line: lineNumber,
-                snippet: trimmed.substring(0, 80),
-            });
+            const tmpRel = tmpMatch[1];
+            const tmpPath = `/tmp/${tmpRel}`;
+            // Sprint 65 (#216): suppress when path is checksum-verified or is an
+            // archive WRITE target. Both shapes are benign-by-construction.
+            const isChecksumVerified = checksumVerifiedTmpPaths.has(tmpPath);
+            const isArchiveOutput = isArchiveOutputContext(trimmed, tmpRel);
+            if (!isChecksumVerified && !isArchiveOutput) {
+                findings.push({
+                    id: `predictable-temp-file-${file}-${lineNumber}`,
+                    pass: 'language-sources',
+                    category: 'security',
+                    rule_id: 'predictable-temp-file',
+                    cwe: 'CWE-377',
+                    severity: 'medium',
+                    level: 'warning',
+                    message: `Predictable temp file: /tmp/${tmpRel}. Use mktemp instead`,
+                    file,
+                    line: lineNumber,
+                    snippet: trimmed.substring(0, 80),
+                });
+            }
         }
         // 4. Insecure file permissions: chmod 777 or chmod 666
         if (/\bchmod\b/.test(trimmed) && /\b(777|666)\b/.test(trimmed)) {