circle-ir 3.140.0 → 3.144.0

package/dist/core/circle-ir-core.cjs

@@ -6383,6 +6383,12 @@ function resolveReceiverType(receiver, context) {
     return { simpleName: null, fqn: null };
   }
   if (receiver === "super") return { simpleName: null, fqn: null };
+  const ctorMatch = receiver.match(/^new\s+([A-Za-z_$][\w$.]*)\s*[<(]/);
+  if (ctorMatch) {
+    const ctorClass = ctorMatch[1];
+    const simple = ctorClass.includes(".") ? ctorClass.substring(ctorClass.lastIndexOf(".") + 1) : ctorClass;
+    return resolveFqn(simple, context);
+  }
   const declaredType = context.localVarTypes.get(receiver) ?? context.paramTypes.get(receiver) ?? context.fieldTypes.get(receiver);
   if (declaredType) {
     return resolveFqn(stripGenerics(declaredType), context);
@@ -6393,19 +6399,43 @@ function resolveReceiverType(receiver, context) {
       return resolveFqn(simple, context);
     }
   }
-  const chained = receiver.match(/^([A-Za-z_$][\w$]*)\.([A-Za-z_$][\w$]*)\s*\([^()]*\)$/);
-  if (chained) {
-    const varName = chained[1];
-    const methodName = chained[2];
-    const varType = context.localVarTypes.get(varName) ?? context.paramTypes.get(varName) ?? context.fieldTypes.get(varName);
-    if (varType) {
-      const returnType = JAVA_CHAINED_FACTORY_RETURN_TYPES[stripGenerics(varType)]?.[methodName];
+  const chain = splitChainedReceiver(receiver);
+  if (chain) {
+    const prefixType = resolveReceiverType(chain.prefix, context);
+    if (prefixType.simpleName) {
+      const returnType = JAVA_CHAINED_FACTORY_RETURN_TYPES[prefixType.simpleName]?.[chain.methodName];
       if (returnType) return resolveFqn(returnType, context);
     }
   }
   return { simpleName: null, fqn: null };
 }
+function splitChainedReceiver(receiver) {
+  if (!receiver.endsWith(")")) return null;
+  let depth = 0;
+  let openIdx = -1;
+  for (let i2 = receiver.length - 1; i2 >= 0; i2--) {
+    const c = receiver[i2];
+    if (c === ")") depth++;
+    else if (c === "(") {
+      depth--;
+      if (depth === 0) {
+        openIdx = i2;
+        break;
+      }
+    }
+  }
+  if (openIdx <= 0) return null;
+  const beforeParen = receiver.substring(0, openIdx);
+  const dotIdx = beforeParen.lastIndexOf(".");
+  if (dotIdx <= 0) return null;
+  const methodName = beforeParen.substring(dotIdx + 1).trim();
+  if (!/^[A-Za-z_$][\w$]*$/.test(methodName)) return null;
+  const prefix = beforeParen.substring(0, dotIdx).trim();
+  if (!prefix) return null;
+  return { prefix, methodName };
+}
 var JAVA_CHAINED_FACTORY_RETURN_TYPES = {
+  // Servlet API (Sprint 91 / #117)
   HttpServletRequest: {
     getSession: "HttpSession",
     getServletContext: "ServletContext",
@@ -6416,6 +6446,32 @@ var JAVA_CHAINED_FACTORY_RETURN_TYPES = {
   },
   ServletContext: {
     getRequestDispatcher: "RequestDispatcher"
+  },
+  // JAXP DOM / SAX / XPath / Transformer / StAX factories (Sprint 92 / #189)
+  DocumentBuilderFactory: {
+    newInstance: "DocumentBuilderFactory",
+    newDocumentBuilder: "DocumentBuilder"
+  },
+  SAXParserFactory: {
+    newInstance: "SAXParserFactory",
+    newSAXParser: "SAXParser"
+  },
+  SAXParser: {
+    getXMLReader: "XMLReader"
+  },
+  XPathFactory: {
+    newInstance: "XPathFactory",
+    newXPath: "XPath"
+  },
+  TransformerFactory: {
+    newInstance: "TransformerFactory",
+    newTransformer: "Transformer"
+  },
+  XMLInputFactory: {
+    newInstance: "XMLInputFactory",
+    newFactory: "XMLInputFactory",
+    createXMLStreamReader: "XMLStreamReader",
+    createXMLEventReader: "XMLEventReader"
   }
 };
 function resolveFqn(simpleName, context) {
@@ -10059,12 +10115,25 @@ function loadSinkConfigs(configs) {
   }
   return { sinks, sanitizers };
 }
-function createTaintConfig(sourceContents, sinkContents) {
+function loadSinkSemanticsConfigs(configs) {
+  const entries = [];
+  for (const config of configs) {
+    if (config.sinks) {
+      entries.push(...config.sinks);
+    }
+  }
+  return entries;
+}
+function createTaintConfig(sourceContents, sinkContents, sinkSemanticsContents = []) {
   const sourceConfigs = sourceContents.map((c) => parseConfig(c));
   const sinkConfigs = sinkContents.map((c) => parseConfig(c));
+  const sinkSemanticsConfigs = sinkSemanticsContents.map(
+    (c) => parseConfig(c)
+  );
   const sources = loadSourceConfigs(sourceConfigs);
   const { sinks, sanitizers } = loadSinkConfigs(sinkConfigs);
-  return { sources, sinks, sanitizers };
+  const sinkSemantics = loadSinkSemanticsConfigs(sinkSemanticsConfigs);
+  return { sources, sinks, sanitizers, sinkSemantics };
 }
 var DEFAULT_SOURCES = [
   // HTTP Sources (Servlet API)
@@ -10783,6 +10852,14 @@ var DEFAULT_SINKS = [
   // reflection remains a downstream concern of body-writing sinks.
   { method: "setHeader", class: "HttpServletResponse", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1] },
   { method: "addHeader", class: "HttpServletResponse", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1] },
+  // Cookie constructor + addCookie — HTTP response splitting via cookie
+  // name/value (CWE-113). Reflects the #189 Sprint 92 V02SetCookie fixture
+  // where `res.addCookie(new Cookie(name, req.getParameter("v")))` allows
+  // CRLF injection into the Set-Cookie header. Both the ctor arg[1] (value)
+  // and the addCookie arg[0] (Cookie handle) are flagged so intermediate-var
+  // and inline-ctor shapes both surface.
+  { method: "Cookie", class: "constructor", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [0, 1] },
+  { method: "addCookie", class: "HttpServletResponse", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [0] },
   // Note: `sendRedirect` is primarily classified as `ssrf` / open-redirect
   // (CWE-601) further down — see entry near line 1195. CRLF via Location
   // header is a secondary concern; keeping the canonical SSRF entry avoids
@@ -12222,11 +12299,62 @@ var DEFAULT_SANITIZERS = [
   { method: "UUID", class: "uuid", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "Decimal", class: "decimal", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] }
 ];
+var DEFAULT_SINK_SEMANTICS = [
+  {
+    signature: "Jedis#executeCommand",
+    real_class: "db_protocol",
+    overrides: ["command_injection", "code_injection"],
+    note: "Redis wire-protocol serialization, not OS exec"
+  },
+  {
+    signature: "Connection#executeCommand",
+    real_class: "db_protocol",
+    overrides: ["command_injection", "code_injection"],
+    note: "Jedis abstract Connection base"
+  },
+  {
+    signature: "JedisCluster#executeCommand",
+    real_class: "db_protocol",
+    overrides: ["command_injection", "code_injection"],
+    note: "Jedis cluster client"
+  },
+  {
+    signature: "Func1#exec",
+    real_class: "functional_dispatch",
+    overrides: ["command_injection", "code_injection"],
+    note: "RxJava functional dispatch, not OS exec"
+  },
+  {
+    signature: "Action0#call",
+    real_class: "functional_dispatch",
+    overrides: ["command_injection"],
+    note: "RxJava Action0 dispatch"
+  },
+  {
+    signature: "Action1#call",
+    real_class: "functional_dispatch",
+    overrides: ["command_injection"],
+    note: "RxJava Action1 dispatch"
+  },
+  {
+    signature: "Unsafe#defineAnonymousClass",
+    real_class: "jdk_internal",
+    overrides: ["code_injection"],
+    note: "sun.misc.Unsafe JDK-internal reflective bridge"
+  },
+  {
+    signature: "MethodHandle#invokeExact",
+    real_class: "jdk_internal",
+    overrides: ["code_injection"],
+    note: "java.lang.invoke.MethodHandle \u2014 JDK-internal"
+  }
+];
 function getDefaultConfig() {
   return {
     sources: DEFAULT_SOURCES,
     sinks: DEFAULT_SINKS,
-    sanitizers: DEFAULT_SANITIZERS
+    sanitizers: DEFAULT_SANITIZERS,
+    sinkSemantics: DEFAULT_SINK_SEMANTICS
   };
 }
 
@@ -12983,6 +13111,8 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         const confidence = calculateSinkConfidence(call, pattern);
         const existing = sinkMap.get(key);
         if (!existing || confidence > existing.confidence) {
+          const receiverType = call.receiver_type;
+          const simpleClass = receiverType ? receiverType.split(".").pop() || void 0 : void 0;
           sinkMap.set(key, {
             type: pattern.type,
             cwe: pattern.cwe,
@@ -12990,7 +13120,8 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
             line: call.location.line,
             confidence,
             method: call.method_name,
-            argPositions: pattern.arg_positions
+            argPositions: pattern.arg_positions,
+            class: simpleClass
           });
         }
       }

package/dist/core/circle-ir-core.js

@@ -6317,6 +6317,12 @@ function resolveReceiverType(receiver, context) {
     return { simpleName: null, fqn: null };
   }
   if (receiver === "super") return { simpleName: null, fqn: null };
+  const ctorMatch = receiver.match(/^new\s+([A-Za-z_$][\w$.]*)\s*[<(]/);
+  if (ctorMatch) {
+    const ctorClass = ctorMatch[1];
+    const simple = ctorClass.includes(".") ? ctorClass.substring(ctorClass.lastIndexOf(".") + 1) : ctorClass;
+    return resolveFqn(simple, context);
+  }
   const declaredType = context.localVarTypes.get(receiver) ?? context.paramTypes.get(receiver) ?? context.fieldTypes.get(receiver);
   if (declaredType) {
     return resolveFqn(stripGenerics(declaredType), context);
@@ -6327,19 +6333,43 @@ function resolveReceiverType(receiver, context) {
       return resolveFqn(simple, context);
     }
   }
-  const chained = receiver.match(/^([A-Za-z_$][\w$]*)\.([A-Za-z_$][\w$]*)\s*\([^()]*\)$/);
-  if (chained) {
-    const varName = chained[1];
-    const methodName = chained[2];
-    const varType = context.localVarTypes.get(varName) ?? context.paramTypes.get(varName) ?? context.fieldTypes.get(varName);
-    if (varType) {
-      const returnType = JAVA_CHAINED_FACTORY_RETURN_TYPES[stripGenerics(varType)]?.[methodName];
+  const chain = splitChainedReceiver(receiver);
+  if (chain) {
+    const prefixType = resolveReceiverType(chain.prefix, context);
+    if (prefixType.simpleName) {
+      const returnType = JAVA_CHAINED_FACTORY_RETURN_TYPES[prefixType.simpleName]?.[chain.methodName];
       if (returnType) return resolveFqn(returnType, context);
     }
   }
   return { simpleName: null, fqn: null };
 }
+function splitChainedReceiver(receiver) {
+  if (!receiver.endsWith(")")) return null;
+  let depth = 0;
+  let openIdx = -1;
+  for (let i2 = receiver.length - 1; i2 >= 0; i2--) {
+    const c = receiver[i2];
+    if (c === ")") depth++;
+    else if (c === "(") {
+      depth--;
+      if (depth === 0) {
+        openIdx = i2;
+        break;
+      }
+    }
+  }
+  if (openIdx <= 0) return null;
+  const beforeParen = receiver.substring(0, openIdx);
+  const dotIdx = beforeParen.lastIndexOf(".");
+  if (dotIdx <= 0) return null;
+  const methodName = beforeParen.substring(dotIdx + 1).trim();
+  if (!/^[A-Za-z_$][\w$]*$/.test(methodName)) return null;
+  const prefix = beforeParen.substring(0, dotIdx).trim();
+  if (!prefix) return null;
+  return { prefix, methodName };
+}
 var JAVA_CHAINED_FACTORY_RETURN_TYPES = {
+  // Servlet API (Sprint 91 / #117)
   HttpServletRequest: {
     getSession: "HttpSession",
     getServletContext: "ServletContext",
@@ -6350,6 +6380,32 @@ var JAVA_CHAINED_FACTORY_RETURN_TYPES = {
   },
   ServletContext: {
     getRequestDispatcher: "RequestDispatcher"
+  },
+  // JAXP DOM / SAX / XPath / Transformer / StAX factories (Sprint 92 / #189)
+  DocumentBuilderFactory: {
+    newInstance: "DocumentBuilderFactory",
+    newDocumentBuilder: "DocumentBuilder"
+  },
+  SAXParserFactory: {
+    newInstance: "SAXParserFactory",
+    newSAXParser: "SAXParser"
+  },
+  SAXParser: {
+    getXMLReader: "XMLReader"
+  },
+  XPathFactory: {
+    newInstance: "XPathFactory",
+    newXPath: "XPath"
+  },
+  TransformerFactory: {
+    newInstance: "TransformerFactory",
+    newTransformer: "Transformer"
+  },
+  XMLInputFactory: {
+    newInstance: "XMLInputFactory",
+    newFactory: "XMLInputFactory",
+    createXMLStreamReader: "XMLStreamReader",
+    createXMLEventReader: "XMLEventReader"
   }
 };
 function resolveFqn(simpleName, context) {
@@ -9993,12 +10049,25 @@ function loadSinkConfigs(configs) {
   }
   return { sinks, sanitizers };
 }
-function createTaintConfig(sourceContents, sinkContents) {
+function loadSinkSemanticsConfigs(configs) {
+  const entries = [];
+  for (const config of configs) {
+    if (config.sinks) {
+      entries.push(...config.sinks);
+    }
+  }
+  return entries;
+}
+function createTaintConfig(sourceContents, sinkContents, sinkSemanticsContents = []) {
   const sourceConfigs = sourceContents.map((c) => parseConfig(c));
   const sinkConfigs = sinkContents.map((c) => parseConfig(c));
+  const sinkSemanticsConfigs = sinkSemanticsContents.map(
+    (c) => parseConfig(c)
+  );
   const sources = loadSourceConfigs(sourceConfigs);
   const { sinks, sanitizers } = loadSinkConfigs(sinkConfigs);
-  return { sources, sinks, sanitizers };
+  const sinkSemantics = loadSinkSemanticsConfigs(sinkSemanticsConfigs);
+  return { sources, sinks, sanitizers, sinkSemantics };
 }
 var DEFAULT_SOURCES = [
   // HTTP Sources (Servlet API)
@@ -10717,6 +10786,14 @@ var DEFAULT_SINKS = [
   // reflection remains a downstream concern of body-writing sinks.
   { method: "setHeader", class: "HttpServletResponse", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1] },
   { method: "addHeader", class: "HttpServletResponse", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1] },
+  // Cookie constructor + addCookie — HTTP response splitting via cookie
+  // name/value (CWE-113). Reflects the #189 Sprint 92 V02SetCookie fixture
+  // where `res.addCookie(new Cookie(name, req.getParameter("v")))` allows
+  // CRLF injection into the Set-Cookie header. Both the ctor arg[1] (value)
+  // and the addCookie arg[0] (Cookie handle) are flagged so intermediate-var
+  // and inline-ctor shapes both surface.
+  { method: "Cookie", class: "constructor", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [0, 1] },
+  { method: "addCookie", class: "HttpServletResponse", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [0] },
   // Note: `sendRedirect` is primarily classified as `ssrf` / open-redirect
   // (CWE-601) further down — see entry near line 1195. CRLF via Location
   // header is a secondary concern; keeping the canonical SSRF entry avoids
@@ -12156,11 +12233,62 @@ var DEFAULT_SANITIZERS = [
   { method: "UUID", class: "uuid", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "Decimal", class: "decimal", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] }
 ];
+var DEFAULT_SINK_SEMANTICS = [
+  {
+    signature: "Jedis#executeCommand",
+    real_class: "db_protocol",
+    overrides: ["command_injection", "code_injection"],
+    note: "Redis wire-protocol serialization, not OS exec"
+  },
+  {
+    signature: "Connection#executeCommand",
+    real_class: "db_protocol",
+    overrides: ["command_injection", "code_injection"],
+    note: "Jedis abstract Connection base"
+  },
+  {
+    signature: "JedisCluster#executeCommand",
+    real_class: "db_protocol",
+    overrides: ["command_injection", "code_injection"],
+    note: "Jedis cluster client"
+  },
+  {
+    signature: "Func1#exec",
+    real_class: "functional_dispatch",
+    overrides: ["command_injection", "code_injection"],
+    note: "RxJava functional dispatch, not OS exec"
+  },
+  {
+    signature: "Action0#call",
+    real_class: "functional_dispatch",
+    overrides: ["command_injection"],
+    note: "RxJava Action0 dispatch"
+  },
+  {
+    signature: "Action1#call",
+    real_class: "functional_dispatch",
+    overrides: ["command_injection"],
+    note: "RxJava Action1 dispatch"
+  },
+  {
+    signature: "Unsafe#defineAnonymousClass",
+    real_class: "jdk_internal",
+    overrides: ["code_injection"],
+    note: "sun.misc.Unsafe JDK-internal reflective bridge"
+  },
+  {
+    signature: "MethodHandle#invokeExact",
+    real_class: "jdk_internal",
+    overrides: ["code_injection"],
+    note: "java.lang.invoke.MethodHandle \u2014 JDK-internal"
+  }
+];
 function getDefaultConfig() {
   return {
     sources: DEFAULT_SOURCES,
     sinks: DEFAULT_SINKS,
-    sanitizers: DEFAULT_SANITIZERS
+    sanitizers: DEFAULT_SANITIZERS,
+    sinkSemantics: DEFAULT_SINK_SEMANTICS
   };
 }
 
@@ -12917,6 +13045,8 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         const confidence = calculateSinkConfidence(call, pattern);
         const existing = sinkMap.get(key);
         if (!existing || confidence > existing.confidence) {
+          const receiverType = call.receiver_type;
+          const simpleClass = receiverType ? receiverType.split(".").pop() || void 0 : void 0;
           sinkMap.set(key, {
             type: pattern.type,
             cwe: pattern.cwe,
@@ -12924,7 +13054,8 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
             line: call.location.line,
             confidence,
             method: call.method_name,
-            argPositions: pattern.arg_positions
+            argPositions: pattern.arg_positions,
+            class: simpleClass
           });
         }
       }

package/dist/core/extractors/calls.js

@@ -828,6 +828,20 @@ function resolveReceiverType(receiver, context) {
     // `super` — defer; cannot determine parent class without hierarchy
     if (receiver === 'super')
         return { simpleName: null, fqn: null };
+    // Constructor receiver: `new X(...)` or `new pkg.X(...)` — resolves to the
+    // constructed class. Enables sink matching on inline receivers built via
+    // `new Yaml().load(taint)` (#189 Sprint 92 SnakeYAML) or
+    // `new ObjectMapper().readValue(taint)` (#189 Sprint 92 Jackson). Nested
+    // constructor arguments are ignored — only the outer class name matters
+    // for method-receiver resolution.
+    const ctorMatch = receiver.match(/^new\s+([A-Za-z_$][\w$.]*)\s*[<(]/);
+    if (ctorMatch) {
+        const ctorClass = ctorMatch[1];
+        const simple = ctorClass.includes('.')
+            ? ctorClass.substring(ctorClass.lastIndexOf('.') + 1)
+            : ctorClass;
+        return resolveFqn(simple, context);
+    }
     // Local variable, parameter, or field declared in this file
     const declaredType = context.localVarTypes.get(receiver) ??
         context.paramTypes.get(receiver) ??
@@ -845,22 +859,23 @@ function resolveReceiverType(receiver, context) {
             return resolveFqn(simple, context);
         }
     }
-    // Chained receiver: `<var>.<method>(...)` — resolve the return type via the
-    // servlet factory map so sink patterns keyed on the returned class (e.g.
-    // `HttpSession.setAttribute` for trust_boundary) match receivers built from
-    // `req.getSession()` / `req.getSession(false)`. cognium-dev #117 Sprint 91:
-    // 0% recall on OWASP Java trust-boundary category because chained factory
-    // calls produced receiver_type=null, dropping trust_boundary sink matches
-    // while xss's classless setAttribute pattern still fired at the same line.
-    const chained = receiver.match(/^([A-Za-z_$][\w$]*)\.([A-Za-z_$][\w$]*)\s*\([^()]*\)$/);
-    if (chained) {
-        const varName = chained[1];
-        const methodName = chained[2];
-        const varType = context.localVarTypes.get(varName) ??
-            context.paramTypes.get(varName) ??
-            context.fieldTypes.get(varName);
-        if (varType) {
-            const returnType = JAVA_CHAINED_FACTORY_RETURN_TYPES[stripGenerics(varType)]?.[methodName];
+    // Chained receiver: `<prefix>.<method>(...)` — resolve the return type via
+    // the servlet/JAXP factory map so sink patterns keyed on the returned class
+    // (e.g. `HttpSession.setAttribute` for trust_boundary, `DocumentBuilder.parse`
+    // for xxe) match receivers built from chained factory calls like
+    // `req.getSession().setAttribute(...)` (#117 Sprint 91) or
+    // `DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(...)`
+    // (#189 Sprint 92 JAXP factory chains).
+    //
+    // The prefix can itself be a chained call: recursion terminates on a bare
+    // identifier (local var / param / field) or a static class reference. Each
+    // step's return type is looked up in JAVA_CHAINED_FACTORY_RETURN_TYPES so
+    // multi-level factory chains like `X.newInstance().newY()` resolve to Y.
+    const chain = splitChainedReceiver(receiver);
+    if (chain) {
+        const prefixType = resolveReceiverType(chain.prefix, context);
+        if (prefixType.simpleName) {
+            const returnType = JAVA_CHAINED_FACTORY_RETURN_TYPES[prefixType.simpleName]?.[chain.methodName];
             if (returnType)
                 return resolveFqn(returnType, context);
         }
@@ -868,7 +883,45 @@ function resolveReceiverType(receiver, context) {
     return { simpleName: null, fqn: null };
 }
 /**
- * Chained factory-method return types for Java servlet/JSP APIs.
+ * Split a chained receiver expression into `<prefix>.<methodName>(...)`.
+ * Walks the string from the right to find the matching open-paren of the
+ * outer call, then finds the last `.` before it to isolate the method name
+ * and prefix expression. Returns `null` when the receiver is not a method
+ * invocation shape (bare identifier, dotted class name, `this.field`, etc.).
+ */
+function splitChainedReceiver(receiver) {
+    if (!receiver.endsWith(')'))
+        return null;
+    let depth = 0;
+    let openIdx = -1;
+    for (let i = receiver.length - 1; i >= 0; i--) {
+        const c = receiver[i];
+        if (c === ')')
+            depth++;
+        else if (c === '(') {
+            depth--;
+            if (depth === 0) {
+                openIdx = i;
+                break;
+            }
+        }
+    }
+    if (openIdx <= 0)
+        return null;
+    const beforeParen = receiver.substring(0, openIdx);
+    const dotIdx = beforeParen.lastIndexOf('.');
+    if (dotIdx <= 0)
+        return null;
+    const methodName = beforeParen.substring(dotIdx + 1).trim();
+    if (!/^[A-Za-z_$][\w$]*$/.test(methodName))
+        return null;
+    const prefix = beforeParen.substring(0, dotIdx).trim();
+    if (!prefix)
+        return null;
+    return { prefix, methodName };
+}
+/**
+ * Chained factory-method return types for Java servlet / JAXP / JSP APIs.
  *
  * Keyed as `receiverType -> methodName -> returnType`. Used by
  * `resolveReceiverType` to pin the type of a receiver written as
@@ -876,11 +929,18 @@ function resolveReceiverType(receiver, context) {
  * recognise `getSession()` as producing `HttpSession` and thus fire the
  * class-scoped `HttpSession.setAttribute` trust_boundary sink pattern.
  *
- * Deliberately narrow: only the servlet-container APIs where the return
+ * The `resolveReceiverType` walker is recursive (via `splitChainedReceiver`),
+ * so multi-level chains like
+ * `DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(...)`
+ * resolve to `DocumentBuilder` and fire the class-scoped
+ * `DocumentBuilder.parse` xxe sink pattern (#189 Sprint 92).
+ *
+ * Deliberately narrow: only well-known JDK factory APIs where the return
  * type is defined by the interface contract are listed. Application-level
  * factories (`someService.getFoo()`) are still unresolved.
  */
 const JAVA_CHAINED_FACTORY_RETURN_TYPES = {
+    // Servlet API (Sprint 91 / #117)
     HttpServletRequest: {
         getSession: 'HttpSession',
         getServletContext: 'ServletContext',
@@ -892,6 +952,32 @@ const JAVA_CHAINED_FACTORY_RETURN_TYPES = {
     ServletContext: {
         getRequestDispatcher: 'RequestDispatcher',
     },
+    // JAXP DOM / SAX / XPath / Transformer / StAX factories (Sprint 92 / #189)
+    DocumentBuilderFactory: {
+        newInstance: 'DocumentBuilderFactory',
+        newDocumentBuilder: 'DocumentBuilder',
+    },
+    SAXParserFactory: {
+        newInstance: 'SAXParserFactory',
+        newSAXParser: 'SAXParser',
+    },
+    SAXParser: {
+        getXMLReader: 'XMLReader',
+    },
+    XPathFactory: {
+        newInstance: 'XPathFactory',
+        newXPath: 'XPath',
+    },
+    TransformerFactory: {
+        newInstance: 'TransformerFactory',
+        newTransformer: 'Transformer',
+    },
+    XMLInputFactory: {
+        newInstance: 'XMLInputFactory',
+        newFactory: 'XMLInputFactory',
+        createXMLStreamReader: 'XMLStreamReader',
+        createXMLEventReader: 'XMLEventReader',
+    },
 };
 /**
  * Look up the FQN of a simple type name in the file's imports map.