circle-ir 3.124.0 → 3.126.0

package/dist/analysis/passes/language-sources-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"language-sources-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/language-sources-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,WAAW,EAAO,MAAM,sBAAsB,CAAC;AAC3H,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqB9E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0C/B,CAAC;AAiCF,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAMD,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB;CAgM7C;AAgkBD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAkG9E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAwC5G;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBjD;AAyKD,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBpG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmCrB;AA+MD,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAsKvF;AA++BD,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,WAAW,EAAE,CAcf;AAoLD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+HnF;AAMD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA2BjF"}
+{"version":3,"file":"language-sources-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/language-sources-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,WAAW,EAAO,MAAM,sBAAsB,CAAC;AAC3H,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqB9E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0C/B,CAAC;AAiCF,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAMD,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB;CAwM7C;AAgkBD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAkG9E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAwC5G;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBjD;AAyKD,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBpG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmCrB;AA+MD,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAsKvF;AA0+CD,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,WAAW,EAAE,CAcf;AAoLD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+HnF;AAMD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA2BjF"}

package/dist/analysis/passes/language-sources-pass.js

@@ -211,6 +211,12 @@ export class LanguageSourcesPass {
         if (language === 'python') {
             additionalSanitizers.push(...findPythonNetlocAllowlistGuardSanitizers(code));
             additionalSanitizers.push(...findPythonRangeCheckGuardSanitizers(code));
+            // Sprint 74 (#216 Pattern B): regex-allowlist wrapper functions,
+            // var-aware set-membership xss guard, and defusedxml import-alias
+            // recognition.
+            additionalSanitizers.push(...findPythonRegexAllowlistWrapperSanitizers(code));
+            additionalSanitizers.push(...findPythonSetMembershipXssGuardSanitizers(code));
+            additionalSanitizers.push(...findPythonDefusedXmlSanitizers(code));
             // Sprint 71 (#190): pattern-based misconfig findings for subscript/context
             // assignment shapes (cors-wildcard-origin, xfo-csp-mismatch, tls-verify-
             // disabled) that the language-agnostic detectors miss in Python.
@@ -238,6 +244,8 @@ export class LanguageSourcesPass {
             additionalSanitizers.push(...findJsCryptoHashSanitizers(code));
             additionalSanitizers.push(...findJsCsvFormulaPrefixSanitizers(code));
             additionalSanitizers.push(...findJsWrapperFunctionSanitizers(code));
+            // Sprint 75 (#216 Pattern D): JS SSRF allow-list guard (var-aware).
+            additionalSanitizers.push(...findJsSsrfAllowlistGuardSanitizers(code));
         }
         // -- Java: Sprint 73 (#216 Pattern A) — Jackson readValue / Gson
         // fromJson recognized as ETE terminator (does not affect
@@ -2105,6 +2113,339 @@ function findPythonRangeCheckGuardSanitizers(code) {
     }
     return sanitizers;
 }
+/**
+ * Detect Python regex-fullmatch allow-list wrapper functions
+ * (cognium-dev #216 Sprint 74 Pattern B).
+ *
+ * Pattern recognized:
+ *
+ *   def checked_uid(uid):
+ *       if not re.fullmatch(r"[a-zA-Z0-9_-]+", uid):
+ *           abort(400)
+ *       return uid
+ *
+ * Two-pass: (1) scan for `def NAME(arg):` declarations whose body
+ * contains `if not re.fullmatch(<TIGHT_REGEX>, arg): <terminator>`
+ * and returns `arg`; (2) for every line containing `NAME(...)` outside
+ * the declaration, emit a sanitizer.
+ *
+ * "Tight" regex means a character-class allow-list that admits only
+ * alphanumerics and a small fixed set of safe separators
+ * ([A-Za-z0-9], \w, plus optional `-`, `_`, `.`). Such an allow-list
+ * strips every injection metacharacter, so the sanitizer lists
+ * ldap/xpath/sql/command/path-traversal/xss + ETE.
+ *
+ * Loose patterns like `.*` or `.+` are rejected (TP-controls cover
+ * the bypass case where the wrapper return value is not what reaches
+ * the sink).
+ */
+function findPythonRegexAllowlistWrapperSanitizers(code) {
+    const sanitizers = [];
+    const lines = code.split('\n');
+    // Match `def NAME(arg):` — single argument, no default.
+    const defOpen = /^(\s*)def\s+([A-Za-z_][A-Za-z0-9_]*)\s*\(\s*([A-Za-z_][A-Za-z0-9_]*)\s*\)\s*:\s*$/;
+    // Tight char-class allow-list: starts with `[` followed by safe ranges
+    // and an explicit `+` / `*` / `{n,m}` quantifier; or `\w+`-style.
+    const tightRegex = /r?["'](?:\^)?(?:\\w[+*]|\\d[+*]|\[[A-Za-z0-9_\\\-\.\s]+\][+*]|[A-Za-z0-9_\-\.]+)(?:\$)?["']/;
+    const terminator = /\b(return\s+(?:None|"|'|\(|\[|\{|False|jsonify|make_response|redirect|abort)|raise\s+\w|abort\s*\(|sys\.exit\s*\()/;
+    const wrappers = [];
+    for (let i = 0; i < lines.length; i++) {
+        const m = defOpen.exec(lines[i]);
+        if (!m)
+            continue;
+        const defIndent = m[1].length;
+        const wrapperName = m[2];
+        const argName = m[3];
+        // Walk the indented body of the def. Look for
+        // `if not re.fullmatch(<tight>, <arg>): <terminator>` and `return arg`.
+        let foundGuard = false;
+        let returnsArg = false;
+        let blockEnd = -1;
+        const maxScan = Math.min(lines.length, i + 40);
+        for (let j = i + 1; j < maxScan; j++) {
+            const line = lines[j];
+            if (line.trim() === '')
+                continue;
+            const indent = line.length - line.trimStart().length;
+            if (indent <= defIndent) {
+                blockEnd = j - 1;
+                break;
+            }
+            if (!foundGuard) {
+                const guard = new RegExp(`if\\s+not\\s+re\\.(?:fullmatch|match)\\s*\\(\\s*(${tightRegex.source})\\s*,\\s*${argName}\\s*\\)\\s*:`);
+                if (guard.test(line)) {
+                    // Confirm the next deeper-indented line is a terminator.
+                    for (let k = j + 1; k < maxScan; k++) {
+                        const klin = lines[k];
+                        if (klin.trim() === '')
+                            continue;
+                        const kindent = klin.length - klin.trimStart().length;
+                        if (kindent <= indent)
+                            break;
+                        if (terminator.test(klin))
+                            foundGuard = true;
+                        break;
+                    }
+                }
+            }
+            if (new RegExp(`^\\s*return\\s+${argName}\\s*$`).test(line)) {
+                returnsArg = true;
+            }
+        }
+        if (blockEnd === -1)
+            blockEnd = Math.min(lines.length - 1, i + 39);
+        if (!foundGuard || !returnsArg)
+            continue;
+        wrappers.push({ name: wrapperName, defLine: i, defIndent });
+    }
+    if (wrappers.length === 0)
+        return sanitizers;
+    // The kinds a tight-regex wrapper sanitizes.
+    const wrapperKinds = [
+        'ldap_injection',
+        'xpath_injection',
+        'sql_injection',
+        'command_injection',
+        'path_traversal',
+        'xss',
+        'external_taint_escape',
+    ];
+    // Pass 2: var-aware emission. For each call of the form
+    //   `<VALIDATED> = NAME(...)`
+    // mark every subsequent line in the same function block that
+    // references `<VALIDATED>` as a sanitizer for the wrapper kinds.
+    // This avoids over-suppressing unrelated tainted vars introduced
+    // later in the same function.
+    for (const w of wrappers) {
+        const assignedCallRe = new RegExp(`^(\\s*)([A-Za-z_][A-Za-z0-9_]*)\\s*=\\s*${w.name}\\s*\\(`);
+        const bareCallRe = new RegExp(`\\b${w.name}\\s*\\(`);
+        for (let i = 0; i < lines.length; i++) {
+            if (i === w.defLine)
+                continue;
+            const line = lines[i];
+            if (!bareCallRe.test(line))
+                continue;
+            // Skip calls inside the wrapper's own body.
+            if (i > w.defLine) {
+                const lineIndent = line.length - line.trimStart().length;
+                if (lineIndent > w.defIndent) {
+                    let stillInside = true;
+                    for (let k = w.defLine + 1; k < i; k++) {
+                        const kline = lines[k];
+                        if (kline.trim() === '')
+                            continue;
+                        const kindent = kline.length - kline.trimStart().length;
+                        if (kindent <= w.defIndent) {
+                            stillInside = false;
+                            break;
+                        }
+                    }
+                    if (stillInside)
+                        continue;
+                }
+            }
+            // Emit a sanitizer at the call line itself (covers ETE on a
+            // single-line `NAME(req.args.get(...))` shape).
+            sanitizers.push({
+                type: 'python_regex_allowlist_wrapper',
+                method: w.name,
+                line: i + 1,
+                sanitizes: [...wrapperKinds],
+            });
+            // If the call result is assigned to a variable, track it and
+            // emit sanitizers on every later line in the same function
+            // block that mentions that variable name. End the scan when
+            // we leave the call's enclosing block.
+            const am = assignedCallRe.exec(line);
+            if (!am)
+                continue;
+            const callIndent = am[1].length;
+            const validated = am[2];
+            const validatedRe = new RegExp(`\\b${validated}\\b`);
+            for (let j = i + 1; j < lines.length; j++) {
+                const jline = lines[j];
+                if (jline.trim() === '')
+                    continue;
+                const jindent = jline.length - jline.trimStart().length;
+                if (jindent < callIndent)
+                    break;
+                if (validatedRe.test(jline)) {
+                    sanitizers.push({
+                        type: 'python_regex_allowlist_wrapper',
+                        method: w.name,
+                        line: j + 1,
+                        sanitizes: [...wrapperKinds],
+                    });
+                }
+            }
+        }
+    }
+    return sanitizers;
+}
+/**
+ * Detect Python set-membership allow-list guards that should sanitize
+ * `xss` flows (cognium-dev #216 Sprint 74 Pattern B, SSTI fixture).
+ *
+ * Pattern recognized:
+ *
+ *   t = request.args.get("t", "")
+ *   if t not in ALLOWED:
+ *       abort(403)
+ *   env.from_string("{{ " + t + " }}").render()
+ *
+ * The existing `findPythonNetlocAllowlistGuardSanitizers` already
+ * handles the source pattern but cannot list `xss` as a blanket
+ * sanitizer (over-suppression risk: a different unguarded variable
+ * later in the same handler would be incorrectly cleared). This
+ * detector is variable-aware: it only emits an `xss` sanitizer on
+ * lines that actually reference the guarded variable.
+ */
+function findPythonSetMembershipXssGuardSanitizers(code) {
+    const sanitizers = [];
+    const lines = code.split('\n');
+    // `if <ident> not in <ALLOWLIST>:`
+    const guardOpen = /^(\s*)if\s+([A-Za-z_][A-Za-z0-9_]*)\s+not\s+in\s+([A-Za-z_][A-Za-z0-9_]*)\s*:\s*$/;
+    const allowlistName = /^(?:[A-Z][A-Z0-9_]+|.*?(allowed|accepted|whitelist|permitted|valid|approved).*)$/i;
+    const terminator = /\b(return|raise|abort\s*\(|sys\.exit\s*\()/;
+    for (let i = 0; i < lines.length; i++) {
+        const m = guardOpen.exec(lines[i]);
+        if (!m)
+            continue;
+        const guardIndent = m[1].length;
+        const guardedVar = m[2];
+        const allowName = m[3];
+        if (!allowlistName.test(allowName))
+            continue;
+        let bodyHasTerminator = false;
+        let blockEnd = -1;
+        const maxScan = Math.min(lines.length, i + 26);
+        for (let j = i + 1; j < maxScan; j++) {
+            const line = lines[j];
+            if (line.trim() === '')
+                continue;
+            const indent = line.length - line.trimStart().length;
+            if (indent <= guardIndent) {
+                blockEnd = j - 1;
+                break;
+            }
+            if (terminator.test(line))
+                bodyHasTerminator = true;
+        }
+        if (blockEnd === -1)
+            blockEnd = Math.min(lines.length - 1, i + 25);
+        if (!bodyHasTerminator)
+            continue;
+        // Var-aware emission: only lines that reference the guarded var.
+        const varRe = new RegExp(`\\b${guardedVar}\\b`);
+        for (let l = blockEnd + 2; l <= lines.length; l++) {
+            const lineText = lines[l - 1];
+            if (!varRe.test(lineText))
+                continue;
+            sanitizers.push({
+                type: 'python_set_membership_xss_guard',
+                method: 'if',
+                line: l,
+                sanitizes: ['xss', 'external_taint_escape'],
+            });
+        }
+    }
+    return sanitizers;
+}
+/**
+ * Detect Python `defusedxml` import-alias usage as xxe sanitizer
+ * (cognium-dev #216 Sprint 74 Pattern B).
+ *
+ * defusedxml is the canonical Python defense against XML External
+ * Entity (CWE-611) attacks — its parsers reject DTD and entity
+ * expansion by design. Recognize three import shapes:
+ *
+ *   import defusedxml.ElementTree as ET
+ *   from defusedxml.ElementTree import fromstring
+ *   import defusedxml as DX
+ *
+ * For every line that calls `<alias>.<method>(...)` (module-alias
+ * shape) or bare `<name>(...)` (from-import shape) emit a sanitizer
+ * with `sanitizes: ['xxe', 'external_taint_escape']`.
+ */
+function findPythonDefusedXmlSanitizers(code) {
+    const sanitizers = [];
+    const lines = code.split('\n');
+    // Aliases bound to a defusedxml.* module (or defusedxml itself).
+    const moduleAliases = new Set();
+    // Names imported FROM defusedxml.*.
+    const fromNames = new Set();
+    const importAs = /^\s*import\s+defusedxml(?:\.[A-Za-z_][A-Za-z0-9_.]*)?\s+as\s+([A-Za-z_][A-Za-z0-9_]*)\s*$/;
+    const importBare = /^\s*import\s+defusedxml(?:\.([A-Za-z_][A-Za-z0-9_.]*))?\s*$/;
+    const fromImport = /^\s*from\s+defusedxml(?:\.[A-Za-z_][A-Za-z0-9_.]*)?\s+import\s+(.+)$/;
+    for (const raw of lines) {
+        const line = raw.replace(/#.*$/, '');
+        let m;
+        if ((m = importAs.exec(line))) {
+            moduleAliases.add(m[1]);
+            continue;
+        }
+        if ((m = importBare.exec(line))) {
+            // `import defusedxml.ElementTree` → callers use full
+            // `defusedxml.ElementTree.fromstring`. Bind the leaf segment
+            // when present, else `defusedxml`.
+            if (m[1]) {
+                moduleAliases.add(m[1].split('.').pop());
+            }
+            moduleAliases.add('defusedxml');
+            continue;
+        }
+        if ((m = fromImport.exec(line))) {
+            const items = m[1].split(',');
+            for (const item of items) {
+                const trimmed = item.trim().replace(/[()\\]/g, '');
+                if (!trimmed)
+                    continue;
+                const asMatch = /^([A-Za-z_][A-Za-z0-9_]*)\s+as\s+([A-Za-z_][A-Za-z0-9_]*)$/.exec(trimmed);
+                if (asMatch) {
+                    fromNames.add(asMatch[2]);
+                }
+                else if (/^[A-Za-z_][A-Za-z0-9_]*$/.test(trimmed)) {
+                    fromNames.add(trimmed);
+                }
+            }
+        }
+    }
+    if (moduleAliases.size === 0 && fromNames.size === 0)
+        return sanitizers;
+    // Emit per-line sanitizers at each call site.
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // Skip import lines themselves.
+        if (/^\s*(?:import|from)\s+/.test(line))
+            continue;
+        let matched = false;
+        for (const alias of moduleAliases) {
+            const re = new RegExp(`\\b${alias}\\s*\\.\\s*[A-Za-z_][A-Za-z0-9_]*\\s*\\(`);
+            if (re.test(line)) {
+                matched = true;
+                break;
+            }
+        }
+        if (!matched) {
+            for (const name of fromNames) {
+                const re = new RegExp(`\\b${name}\\s*\\(`);
+                if (re.test(line)) {
+                    matched = true;
+                    break;
+                }
+            }
+        }
+        if (!matched)
+            continue;
+        sanitizers.push({
+            type: 'python_defusedxml_import',
+            method: 'defusedxml',
+            line: i + 1,
+            sanitizes: ['xxe', 'external_taint_escape'],
+        });
+    }
+    return sanitizers;
+}
 /**
  * Detect Rust HashSet/HashMap host allow-list guards (cognium-dev #115 FP-23).
  *
@@ -2425,6 +2766,168 @@ function findJsWrapperFunctionSanitizers(code) {
     }
     return sanitizers;
 }
+/**
+ * JS/TS: SSRF allow-list guard sanitizer (cognium-dev #216 Sprint 75
+ * Pattern D).
+ *
+ * Pattern recognized:
+ *
+ *   const ALLOWED = new Set(['api.example.com', 'cdn.example.com']);
+ *   const url = new URL(req.query.target);
+ *   if (!ALLOWED.has(url.hostname)) {
+ *       return res.status(400).send('blocked');
+ *   }
+ *   fetch(url);            // safe — host is one of N fixed strings
+ *
+ * Or the bare-host shape:
+ *
+ *   const ALLOWED_HOSTS = ['api.example.com'];
+ *   const host = req.query.host;
+ *   if (!ALLOWED_HOSTS.includes(host)) {
+ *       return res.status(400).end();
+ *   }
+ *   fetch(`https://${host}/data`);
+ *
+ * Set-membership against a fixed allow-list proves the value is byte-
+ * identical to one of N developer-chosen literals. The detector is
+ * **variable-aware**: it captures the guarded variable name AND any
+ * upstream aliases (`new URL(<v>).hostname` / `.host`) and only emits
+ * sanitizers on subsequent lines in the same block that reference one
+ * of those names. This prevents over-suppressing an unrelated unguarded
+ * variable later in the same handler (Sprint 74 TP-2 lesson).
+ *
+ * Existing `sink-filter-pass.ts:775-812` Stage 8 guard handles
+ * `open_redirect` / `crlf` at the sink line; this detector expands the
+ * mechanism to `ssrf` via the language-sources sanitizer path.
+ *
+ * Conservative shape:
+ *   - guard call must be `<ALLOW>.has(<v>)` or `<ALLOW>.includes(<v>)`
+ *     or `<ALLOW>.indexOf(<v>) < 0` (negation `!` or `< 0` required)
+ *   - <ALLOW> identifier matches UPPER_SNAKE or allowed|whitelist|...
+ *   - body must contain a terminator (return / throw / res.status...end)
+ *   - String#includes substring check (`host.includes('example.com')`)
+ *     does NOT qualify — TP-2 control proves this.
+ */
+function findJsSsrfAllowlistGuardSanitizers(code) {
+    const sanitizers = [];
+    const lines = code.split('\n');
+    // Build alias map: `const <v> = new URL(<src>).hostname` (or .host).
+    // Maps alias name → source identifier (e.g. `url` → req.query.target chain).
+    // For the SSRF detector we only need the alias name itself so a Set is
+    // sufficient — once an alias is allow-list-checked, the original `new URL`
+    // expression input is also considered guarded by transitivity through it.
+    const urlAliasToHostAlias = new Map();
+    const urlAliasDecl = /\b(?:const|let|var)\s+([A-Za-z_]\w*)\s*=\s*new\s+URL\s*\(\s*([A-Za-z_][\w.[\]'"`]*)\s*\)/;
+    const hostAliasDecl = /\b(?:const|let|var)\s+([A-Za-z_]\w*)\s*=\s*([A-Za-z_]\w*)\.(?:hostname|host)\b/;
+    // alias → upstream url-alias
+    const hostFromUrl = new Map();
+    for (const line of lines) {
+        const ua = urlAliasDecl.exec(line);
+        if (ua)
+            urlAliasToHostAlias.set(ua[1], ua[2]);
+        const ha = hostAliasDecl.exec(line);
+        if (ha)
+            hostFromUrl.set(ha[1], ha[2]);
+    }
+    // `ALLOW.has(<v>)`, `ALLOW.includes(<v>)`, `ALLOW.indexOf(<v>)`
+    // (with leading `!` for has/includes, or `< 0` for indexOf).
+    const allowlistName = /^(?:[A-Z][A-Z0-9_]+|.*?(allowed|accepted|whitelist|permitted|valid|approved).*)$/i;
+    const guardHas = /if\s*\(\s*!\s*([A-Za-z_]\w*)\s*\.\s*(?:has|includes)\s*\(\s*([A-Za-z_]\w*)(?:\s*\.\s*(?:hostname|host))?\s*\)\s*\)/;
+    const guardIndexOf = /if\s*\(\s*([A-Za-z_]\w*)\s*\.\s*indexOf\s*\(\s*([A-Za-z_]\w*)(?:\s*\.\s*(?:hostname|host))?\s*\)\s*<\s*0\s*\)/;
+    const terminator = /\b(return|throw|res\s*\.\s*status\s*\([^)]*\)\s*\.\s*(?:send|end|json)\s*\()/;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        let m = guardHas.exec(line);
+        let allow = null;
+        let guardedVar = null;
+        if (m) {
+            allow = m[1];
+            guardedVar = m[2];
+        }
+        else {
+            m = guardIndexOf.exec(line);
+            if (m) {
+                allow = m[1];
+                guardedVar = m[2];
+            }
+        }
+        if (!allow || !guardedVar)
+            continue;
+        if (!allowlistName.test(allow))
+            continue;
+        // Find the guard block opening brace and matching close.
+        // The brace may be on the same line (`if (...) {`) or the next.
+        // We scan forward for a body terminator within ~25 lines.
+        let bodyHasTerminator = false;
+        let blockEnd = -1;
+        const maxScan = Math.min(lines.length, i + 26);
+        // Naive brace tracking: count `{` and `}` starting at the guard line.
+        let braceDepth = 0;
+        let started = false;
+        for (let j = i; j < maxScan; j++) {
+            const ln = lines[j];
+            for (const ch of ln) {
+                if (ch === '{') {
+                    braceDepth++;
+                    started = true;
+                }
+                else if (ch === '}') {
+                    braceDepth--;
+                    if (started && braceDepth === 0) {
+                        blockEnd = j;
+                        break;
+                    }
+                }
+            }
+            if (started && j > i && terminator.test(ln))
+                bodyHasTerminator = true;
+            if (blockEnd !== -1)
+                break;
+        }
+        if (!started)
+            continue;
+        if (blockEnd === -1)
+            continue;
+        if (!bodyHasTerminator)
+            continue;
+        // Build set of names whose subsequent references are sanitized.
+        // Start with guardedVar. When the inline guard reads `.hostname` /
+        // `.host` of a known `new URL(<src>)` alias, guardedVar IS the url
+        // alias itself (captured by `([A-Za-z_]\w*)` before `(?:\.hostname)?`),
+        // so `fetch(url)` later naturally matches.
+        const safeNames = new Set([guardedVar]);
+        // If guardedVar is itself a host-alias declared as `const h = u.hostname`,
+        // the upstream url alias is also safe.
+        if (hostFromUrl.has(guardedVar)) {
+            safeNames.add(hostFromUrl.get(guardedVar));
+        }
+        // If guardedVar IS a url alias, any host-alias derived from it is safe.
+        for (const [hostName, urlName] of hostFromUrl) {
+            if (urlName === guardedVar)
+                safeNames.add(hostName);
+        }
+        // Silence unused-var lint for the upstream-url map: it is intentionally
+        // built but not directly consulted in the current emission path
+        // (guardedVar covers the url alias because the guard regex matches the
+        // url identifier itself when `.hostname` is the inline accessor).
+        void urlAliasToHostAlias;
+        const refRes = [...safeNames].map((n) => new RegExp(`\\b${n}\\b`));
+        // Var-aware emission: lines after the guard block referencing one of
+        // the safe names get a sanitizer.
+        for (let l = blockEnd + 2; l <= lines.length; l++) {
+            const lineText = lines[l - 1];
+            if (!refRes.some((re) => re.test(lineText)))
+                continue;
+            sanitizers.push({
+                type: 'js_ssrf_allowlist_guard',
+                method: 'if',
+                line: l,
+                sanitizes: ['ssrf', 'external_taint_escape'],
+            });
+        }
+    }
+    return sanitizers;
+}
 // ---------------------------------------------------------------------------
 // Sprint 70 (#151) — external-secret-exfiltration composed-flow detection.
 //