circle-ir 3.141.0 → 3.144.3

package/dist/analysis/passes/sink-semantics-pass.js

@@ -0,0 +1,100 @@
+/**
+ * SinkSemanticsPass — cognium-dev #139 Tier A
+ *
+ * Consults a curated `<ClassName>#<methodName>` → `real_class` +
+ * `overrides` registry (`configs/sink-semantics.json`) and drops
+ * sinks whose emitted `SinkType` label disagrees with the registry's
+ * declared real-behavior classification.
+ *
+ * Motivation: the taint-matcher's `configs/sinks/*.yaml` patterns
+ * often use method-only matches (no class filter) which produce FPs
+ * when unrelated classes happen to share a method name. Canonical
+ * example:
+ *
+ *     public byte[] get(byte[] key) {
+ *       return connection.executeCommand(commandObjects.get(key));
+ *     }
+ *
+ * The `executeCommand` pattern in `configs/sinks/command.yaml` has no
+ * `class` filter, so `Jedis.executeCommand(...)` — Redis wire-protocol
+ * serialization — is flagged as `command_injection`. The registry
+ * fixes this by listing `Jedis#executeCommand → drop
+ * command_injection` (with `real_class: db_protocol` as a documenting
+ * label).
+ *
+ * The gate is deliberately narrow (~8 seed entries as of 3.144.0);
+ * each entry is class-scoped so `Runtime.exec`, `ProcessBuilder.start`,
+ * `Statement.execute`, `Class.forName`, and `Method.invoke` remain
+ * unaffected. Unresolved receivers (`sink.class === undefined`) fall
+ * through — the gate is false-negative-safe.
+ *
+ * Pipeline slot: runs after `SinkFilterPass` (so unrelated FP
+ * suppressions have already fired) and before `TaintPropagationPass`
+ * (so the flow generators never see the dropped sinks).
+ *
+ * Tier B (speculative verifier on disagreements) is explicitly OUT
+ * of scope for circle-ir. Any speculative-verification layer belongs
+ * in cognium-ai / circle-ir-ai; results from that layer can be
+ * promoted to Tier A registry entries by hand.
+ */
+/**
+ * Build a signature → overrides lookup map from a flat entry list.
+ * Signature format: `<ClassName>#<methodName>` (simple names only;
+ * case-sensitive).
+ */
+function buildRegistry(entries) {
+    const registry = new Map();
+    for (const entry of entries) {
+        const existing = registry.get(entry.signature);
+        if (existing) {
+            // Last-write-wins for duplicate signatures; also union the
+            // overrides so multiple files can extend the same signature.
+            for (const t of entry.overrides)
+                existing.add(t);
+        }
+        else {
+            registry.set(entry.signature, new Set(entry.overrides));
+        }
+    }
+    return registry;
+}
+export class SinkSemanticsPass {
+    name = 'sink-semantics';
+    category = 'security';
+    run(ctx) {
+        const { graph, config } = ctx;
+        const entries = config.sinkSemantics ?? [];
+        if (entries.length === 0) {
+            // No registry loaded — nothing to do. Preserves legacy callers
+            // that construct a TaintConfig without `sinkSemantics`.
+            return { droppedCount: 0, registrySize: 0 };
+        }
+        const registry = buildRegistry(entries);
+        const sinks = graph.ir.taint.sinks;
+        let droppedCount = 0;
+        const kept = sinks.filter((sink) => {
+            // Unresolved receiver → registry cannot apply. Preserve the
+            // sink so the normal flow generator still processes it.
+            if (!sink.class || !sink.method)
+                return true;
+            const signature = `${sink.class}#${sink.method}`;
+            const overrides = registry.get(signature);
+            if (!overrides)
+                return true;
+            if (overrides.has(sink.type)) {
+                droppedCount++;
+                return false;
+            }
+            return true;
+        });
+        // Mutate in place so downstream passes (TaintPropagationPass)
+        // see the reduced sink set. Preserves array identity for any
+        // consumer that captured a reference before this pass ran.
+        if (droppedCount > 0) {
+            sinks.length = 0;
+            sinks.push(...kept);
+        }
+        return { droppedCount, registrySize: registry.size };
+    }
+}
+//# sourceMappingURL=sink-semantics-pass.js.map

package/dist/analysis/passes/sink-semantics-pass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sink-semantics-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/sink-semantics-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAaH;;;;GAIG;AACH,SAAS,aAAa,CACpB,OAAsC;IAEtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,QAAQ,EAAE,CAAC;YACb,2DAA2D;YAC3D,6DAA6D;YAC7D,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS;gBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,OAAO,iBAAiB;IAGnB,IAAI,GAAG,gBAAgB,CAAC;IACxB,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;QAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,+DAA+D;YAC/D,wDAAwD;YACxD,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QAC9C,CAAC;QAED,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAEnC,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,4DAA4D;YAC5D,wDAAwD;YACxD,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAC7C,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACjD,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1C,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC5B,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,YAAY,EAAE,CAAC;gBACf,OAAO,KAAK,CAAC;YACf,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,8DAA8D;QAC9D,6DAA6D;QAC7D,2DAA2D;QAC3D,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IACvD,CAAC;CACF"}

package/dist/analysis/passes/source-semantics-pass.d.ts

@@ -0,0 +1,66 @@
+/**
+ * SourceSemanticsPass — cognium-dev #138
+ *
+ * Tags every entry in `graph.ir.taint.sources` with three optional
+ * booleans (`constant`, `spi`, `demoPath`) that downstream passes use
+ * to drop or downgrade false-positive taint flows:
+ *
+ *   Filter 1 — Constant folding
+ *     `String API_KEY = "abc";` / `static final String KEY = "abc";` /
+ *     `String v = SomeEnum.VALUE;` → `constant = true`.
+ *     A compile-time constant string cannot carry attacker-controlled
+ *     data, so it is dropped for every taint sink type. The
+ *     hardcoded-credential rule continues to fire (that is precisely
+ *     the point of that rule).
+ *
+ *   Filter 2 — SPI (Service Provider Interface)
+ *     `ServiceLoader.load(Plugin.class)` /
+ *     `ServiceLoader.loadInstalled(...)` / `ServiceLoader.stream(...)` /
+ *     `Class.forName(name)` co-located with a
+ *     `.getResources("META-INF/services/…")` lookup within ±30 lines
+ *     of the same method → `spi = true`. SPI-loaded values are
+ *     provider-controlled configuration, not attacker input.
+ *
+ *   Filter 3 — Demo path
+ *     Path components matching `demo`, `example(s)`, `samples`,
+ *     `integration-tests`, or `integration_tests` (case-insensitive)
+ *     → `demoPath = true` on every source in the file. This tag is
+ *     never used to drop flows — `scan-secrets-pass` consumes it to
+ *     downgrade hardcoded-credential findings on demo paths from
+ *     `high` → `info` and `warning/error` → `note`.
+ *
+ * This pass is a pure source-tagger: it never emits SAST findings and
+ * never removes sources from `graph.ir.taint.sources`. All
+ * consumption is downstream (findings.ts, taint-propagation-pass,
+ * scan-secrets-pass).
+ *
+ * Consumption policy is documented on the `TaintSource` type
+ * (`src/types/index.ts`) and in `findings.ts:sourceSemanticsAllowed`.
+ *
+ * Pipeline slot: runs after `LanguageSourcesPass` (so the full source
+ * list is available) and before `TaintPropagationPass` (so the tags
+ * are visible to flow generation).
+ */
+import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
+/**
+ * Path-component regex used by both this pass (source tagging) and
+ * `scan-secrets-pass` (severity downgrade). Matches when any path
+ * segment equals one of the demo/example/samples/integration-tests
+ * tokens, case-insensitive. A bare filename like `DemoParser.java`
+ * does NOT match (no leading or trailing path separator).
+ */
+export declare const DEMO_PATH_RE: RegExp;
+export interface SourceSemanticsResult {
+    /** Number of sources tagged with `constant = true`. */
+    constantCount: number;
+    /** Number of sources tagged with `spi = true`. */
+    spiCount: number;
+    /** Number of sources tagged with `demoPath = true`. */
+    demoPathCount: number;
+}
+export declare class SourceSemanticsPass implements AnalysisPass<SourceSemanticsResult> {
+    readonly name = "source-semantics";
+    readonly category: "security";
+    run(ctx: PassContext): SourceSemanticsResult;
+}
+//# sourceMappingURL=source-semantics-pass.d.ts.map

package/dist/analysis/passes/source-semantics-pass.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-semantics-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/source-semantics-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,QACiE,CAAC;AA2F3F,MAAM,WAAW,qBAAqB;IACpC,uDAAuD;IACvD,aAAa,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,mBACX,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAE9C,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB;CAgC7C"}

package/dist/analysis/passes/source-semantics-pass.js

@@ -0,0 +1,165 @@
+/**
+ * SourceSemanticsPass — cognium-dev #138
+ *
+ * Tags every entry in `graph.ir.taint.sources` with three optional
+ * booleans (`constant`, `spi`, `demoPath`) that downstream passes use
+ * to drop or downgrade false-positive taint flows:
+ *
+ *   Filter 1 — Constant folding
+ *     `String API_KEY = "abc";` / `static final String KEY = "abc";` /
+ *     `String v = SomeEnum.VALUE;` → `constant = true`.
+ *     A compile-time constant string cannot carry attacker-controlled
+ *     data, so it is dropped for every taint sink type. The
+ *     hardcoded-credential rule continues to fire (that is precisely
+ *     the point of that rule).
+ *
+ *   Filter 2 — SPI (Service Provider Interface)
+ *     `ServiceLoader.load(Plugin.class)` /
+ *     `ServiceLoader.loadInstalled(...)` / `ServiceLoader.stream(...)` /
+ *     `Class.forName(name)` co-located with a
+ *     `.getResources("META-INF/services/…")` lookup within ±30 lines
+ *     of the same method → `spi = true`. SPI-loaded values are
+ *     provider-controlled configuration, not attacker input.
+ *
+ *   Filter 3 — Demo path
+ *     Path components matching `demo`, `example(s)`, `samples`,
+ *     `integration-tests`, or `integration_tests` (case-insensitive)
+ *     → `demoPath = true` on every source in the file. This tag is
+ *     never used to drop flows — `scan-secrets-pass` consumes it to
+ *     downgrade hardcoded-credential findings on demo paths from
+ *     `high` → `info` and `warning/error` → `note`.
+ *
+ * This pass is a pure source-tagger: it never emits SAST findings and
+ * never removes sources from `graph.ir.taint.sources`. All
+ * consumption is downstream (findings.ts, taint-propagation-pass,
+ * scan-secrets-pass).
+ *
+ * Consumption policy is documented on the `TaintSource` type
+ * (`src/types/index.ts`) and in `findings.ts:sourceSemanticsAllowed`.
+ *
+ * Pipeline slot: runs after `LanguageSourcesPass` (so the full source
+ * list is available) and before `TaintPropagationPass` (so the tags
+ * are visible to flow generation).
+ */
+/**
+ * Path-component regex used by both this pass (source tagging) and
+ * `scan-secrets-pass` (severity downgrade). Matches when any path
+ * segment equals one of the demo/example/samples/integration-tests
+ * tokens, case-insensitive. A bare filename like `DemoParser.java`
+ * does NOT match (no leading or trailing path separator).
+ */
+export const DEMO_PATH_RE = /(?:^|\/)(?:demo|example|examples|samples|integration-tests|integration_tests)(?:\/|$)/i;
+// ---------------------------------------------------------------------------
+// Filter 1 — Constant
+// ---------------------------------------------------------------------------
+// `[final ] TYPE ident = "string literal";` — canonical simple form.
+// Allows generics / arrays in the type position (`List<String>`, `String[]`).
+const CONST_STRING_ASSIGN_RE = /^\s*(?:final\s+|static\s+final\s+)?[A-Za-z_][\w.<>\[\]]*\s+[A-Za-z_]\w*\s*=\s*"[^"]*"\s*;?\s*$/;
+// `[public|private|protected ] static final TYPE ident = <literal-or-simple-expr>`
+// The RHS check gates on either a string literal, a numeric/boolean literal,
+// or a bare identifier reference (constant reference chain). We intentionally
+// accept the presence of `static final` as a strong signal — Java's language
+// rules already ensure the value is compile-time constant or effectively so.
+const STATIC_FINAL_RE = /^\s*(?:public\s+|private\s+|protected\s+)?static\s+final\s+/;
+// `ident = SomeEnum.VALUE;` — enum constant reference. Requires an
+// UPPER_CASE constant identifier after the dot to avoid matching
+// regular field access like `user.name`. The type identifier (LHS of
+// the dot) is allowed to be either PascalCase (`SomeEnum`) or
+// SCREAMING_SNAKE (`SOME_ENUM`) — both are common in Java / Kotlin
+// enum types.
+const ENUM_CONST_REF_RE = /=\s*[A-Z][A-Za-z0-9_]*\.[A-Z][A-Z0-9_]*\s*;?\s*$/;
+function isConstantSource(code) {
+    if (!code)
+        return false;
+    if (CONST_STRING_ASSIGN_RE.test(code))
+        return true;
+    if (STATIC_FINAL_RE.test(code)) {
+        // For static final, require the RHS to look like a literal or a
+        // simple constant reference (no method calls / no `new`).
+        const rhs = code.split('=').slice(1).join('=').trim();
+        if (rhs.length === 0)
+            return false;
+        if (/^"[^"]*"\s*;?\s*$/.test(rhs))
+            return true; // string literal
+        if (/^-?\d+(?:\.\d+)?[fFdDlL]?\s*;?\s*$/.test(rhs))
+            return true; // numeric
+        if (/^(?:true|false)\s*;?\s*$/.test(rhs))
+            return true; // boolean
+        if (/^[A-Za-z_][\w.]*\s*;?\s*$/.test(rhs))
+            return true; // ident ref
+        return false;
+    }
+    if (ENUM_CONST_REF_RE.test(code))
+        return true;
+    return false;
+}
+// ---------------------------------------------------------------------------
+// Filter 2 — SPI
+// ---------------------------------------------------------------------------
+const SERVICE_LOADER_RE = /\bServiceLoader\.(?:load|loadInstalled|stream)\s*\(/;
+const CLASS_FOR_NAME_RE = /\bClass\.forName\s*\(/;
+const META_INF_SERVICES_RE = /getResources?\s*\(\s*"META-INF\/services\//;
+/**
+ * SPI window size (lines). Matches the ±30-line window that
+ * `sink-filter-pass.ts` Stage 9f uses for the same co-location check.
+ */
+const SPI_WINDOW = 30;
+function isSpiSource(source, lines) {
+    const code = source.code;
+    if (!code)
+        return false;
+    if (SERVICE_LOADER_RE.test(code))
+        return true;
+    if (CLASS_FOR_NAME_RE.test(code)) {
+        // Check for META-INF/services lookup within ±SPI_WINDOW lines of
+        // the source line. `source.line` is 1-indexed.
+        const start = Math.max(0, source.line - 1 - SPI_WINDOW);
+        const end = Math.min(lines.length, source.line - 1 + SPI_WINDOW + 1);
+        for (let i = start; i < end; i++) {
+            if (META_INF_SERVICES_RE.test(lines[i]))
+                return true;
+        }
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
+// Filter 3 — DemoPath
+// ---------------------------------------------------------------------------
+function isDemoPathFile(file) {
+    if (!file)
+        return false;
+    return DEMO_PATH_RE.test(file);
+}
+export class SourceSemanticsPass {
+    name = 'source-semantics';
+    category = 'security';
+    run(ctx) {
+        const { graph, code } = ctx;
+        const sources = graph.ir.taint.sources;
+        if (sources.length === 0) {
+            return { constantCount: 0, spiCount: 0, demoPathCount: 0 };
+        }
+        const file = graph.ir.meta.file;
+        const demoPath = isDemoPathFile(file);
+        const lines = code.split('\n');
+        let constantCount = 0;
+        let spiCount = 0;
+        let demoPathCount = 0;
+        for (const source of sources) {
+            if (isConstantSource(source.code)) {
+                source.constant = true;
+                constantCount++;
+            }
+            if (isSpiSource(source, lines)) {
+                source.spi = true;
+                spiCount++;
+            }
+            if (demoPath) {
+                source.demoPath = true;
+                demoPathCount++;
+            }
+        }
+        return { constantCount, spiCount, demoPathCount };
+    }
+}
+//# sourceMappingURL=source-semantics-pass.js.map

package/dist/analysis/passes/source-semantics-pass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-semantics-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/source-semantics-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAKH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GACvB,wFAAwF,CAAC;AAE3F,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,qEAAqE;AACrE,8EAA8E;AAC9E,MAAM,sBAAsB,GAC1B,gGAAgG,CAAC;AAEnG,mFAAmF;AACnF,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,MAAM,eAAe,GACnB,6DAA6D,CAAC;AAEhE,mEAAmE;AACnE,iEAAiE;AACjE,qEAAqE;AACrE,8DAA8D;AAC9D,mEAAmE;AACnE,cAAc;AACd,MAAM,iBAAiB,GAAG,kDAAkD,CAAC;AAE7E,SAAS,gBAAgB,CAAC,IAAwB;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,gEAAgE;QAChE,0DAA0D;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACnC,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,iBAAiB;QACjE,IAAI,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,UAAU;QAC3E,IAAI,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,UAAU;QACjE,IAAI,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,YAAY;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,iBAAiB,GACrB,qDAAqD,CAAC;AAExD,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAElD,MAAM,oBAAoB,GAAG,4CAA4C,CAAC;AAE1E;;;GAGG;AACH,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,SAAS,WAAW,CAAC,MAAmB,EAAE,KAAe;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,iEAAiE;QACjE,+CAA+C;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC,CAAC;QACrE,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YACjC,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;QACxD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,SAAS,cAAc,CAAC,IAAwB;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAeD,MAAM,OAAO,mBAAmB;IAGrB,IAAI,GAAG,kBAAkB,CAAC;IAC1B,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;QACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;QAC7D,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE/B,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,aAAa,GAAG,CAAC,CAAC;QAEtB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACvB,aAAa,EAAE,CAAC;YAClB,CAAC;YACD,IAAI,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;gBAClB,QAAQ,EAAE,CAAC;YACb,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACvB,aAAa,EAAE,CAAC;YAClB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;IACpD,CAAC;CACF"}

package/dist/analysis/passes/taint-propagation-pass.js

@@ -12,8 +12,8 @@
  */
 import { propagateTaint } from '../taint-propagation.js';
 import { isFalsePositive, isCorrelatedPredicateFP } from '../constant-propagation.js';
-import { buildPythonTaintedVars, buildRustTaintedVars } from './language-sources-pass.js';
-import { canSourceReachSink } from '../findings.js';
+import { buildJavaTaintedVars, buildPythonTaintedVars, buildRustTaintedVars } from './language-sources-pass.js';
+import { canSourceReachSink, sourceSemanticsAllowed } from '../findings.js';
 export class TaintPropagationPass {
     name = 'taint-propagation';
     category = 'security';
@@ -1076,6 +1076,36 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
             }
         }
     }
+    // Java alias expansion (cognium-dev #220): mirror the Rust branch so
+    // that the array-form `Runtime.exec(String[])` shape
+    //   String cmd = "echo " + arg;
+    //   Runtime.getRuntime().exec(new String[]{"/bin/sh", "-c", cmd});
+    // produces a flow back to `arg`. Without this, the variable-scan below
+    // never sees `cmd` (only `arg` is in the source's variable field) and
+    // the array literal defeats the sink-arg colocation heuristic. Seeds
+    // with real source variables (HTTP source `arg` or the now-populated
+    // interprocedural_param parameter name) and iterates to a fixpoint.
+    if (language === 'java' && typeof code === 'string' && sourcesWithVar.length > 0) {
+        const seedVars = new Set(sourcesWithVar.map(s => s.variable));
+        const derived = buildJavaTaintedVars(code, seedVars);
+        if (derived.size > 0) {
+            let anchor = sourcesWithVar[0];
+            for (const s of sourcesWithVar) {
+                if (s.line < anchor.line)
+                    anchor = s;
+            }
+            const existingVars = new Set(sourcesWithVar.map(s => s.variable));
+            for (const [varName] of derived) {
+                if (!varName || existingVars.has(varName))
+                    continue;
+                sourcesWithVar.push({
+                    ...anchor,
+                    variable: varName,
+                });
+                existingVars.add(varName);
+            }
+        }
+    }
     // Pre-compile word-boundary regexes per unique source variable.
     // Escape regex-special characters defensively (variable names should be
     // plain identifiers but Python attribute paths like `obj.attr` could leak in).
@@ -1128,6 +1158,14 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
                     const re = reCache.get(source.variable);
                     if (!re || !re.test(expr))
                         continue;
+                    // cognium-dev #138: source-semantics gate. Drop flows whose
+                    // source was tagged constant / SPI-loaded by
+                    // SourceSemanticsPass — a compile-time constant cannot carry
+                    // attacker-controlled data, and SPI-loaded values are
+                    // provider-controlled configuration (see the predicate's
+                    // JSDoc in findings.ts for the exact per-sink policy).
+                    if (!sourceSemanticsAllowed(source, sink.type))
+                        continue;
                     // Dedupe by (source_line, sink_line, sink.type) — a single source
                     // can reach multiple distinct sinks at the same line (e.g. an
                     // execute() call modeled as both `xss` and `sql_injection`).
@@ -1194,16 +1232,21 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
     // for the simple cases where the source pattern matches the iterable
     // and the loop variable is used on the same line.
     //
-    // Restricted to sources with no `variable` field: an inline-pattern
-    // source has no enclosing assignment, so it can't be confused with an
-    // assignment-style source whose use happens to land on the same line
-    // (the latter must still respect "source precedes sink" — see the
-    // taint-propagation-pass "does NOT emit when source line is at or
-    // after sink line" regression guard).
+    // Sources without a `variable` field are the classic inline-pattern case
+    // (e.g. `exec(req.getParameter("u"))`). Sources WITH a `variable` field
+    // are also admitted when the LHS-bound identifier does NOT appear in the
+    // sink call's source-line `code`. This covers Sprint 93 (#189)
+    // `Object o = y.load(req.getParameter("y"))` where Java LHS-binding tags
+    // the source with the outer assignment target `o`, yet `o` cannot appear
+    // in the sink's own arguments because it is being *defined by* the sink
+    // expression. The variable-scan path already emits when the sink args
+    // reference the source var, so gating on absence of the var in the sink
+    // code preserves the "assignment-after-use is impossible" regression
+    // guard (`uid = source(); doSink("x = " + uid)` on the same line would
+    // still have `uid` present in the sink code and thus fall to
+    // variable-scan, not colocation).
     const sourcesByLine = new Map();
     for (const s of sources) {
-        if (s.variable && s.variable.length > 0)
-            continue;
         const arr = sourcesByLine.get(s.line) ?? [];
         arr.push(s);
         sourcesByLine.set(s.line, arr);
@@ -1217,6 +1260,44 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
         for (const source of colocSources) {
             if (!canSourceReachSink(source.type, sink.type))
                 continue;
+            // cognium-dev #138: source-semantics gate for inline sources.
+            // Drop flows tagged constant / SPI (see sourceSemanticsAllowed
+            // JSDoc for the per-sink policy).
+            if (!sourceSemanticsAllowed(source, sink.type))
+                continue;
+            // Variable-scan handoff — if the source carries an LHS-bound
+            // variable AND that identifier is textually present in the RHS of
+            // the sink's own source-line code, the variable-scan path is
+            // authoritative for this pair. Skipping the colocation emission
+            // here preserves the "assignment-then-same-line-use is impossible"
+            // regression guard (`uid = source(); doSink(uid)` collapsed onto
+            // one line). When the LHS var is absent from the RHS (i.e. the
+            // sink expression IS the RHS being assigned to that var), the
+            // source is nested inside the sink expression (Sprint 93 (#189)
+            // nested `Object o = y.load(req.getParameter("y"))` pattern) and
+            // the colocation emission is the only path that will surface the
+            // flow. We strip an optional leading `TYPE ident =` prefix from
+            // the sink code so the LHS binding of THIS line does not
+            // spuriously match the source var.
+            const sourceVar = source.variable;
+            if (sourceVar && sourceVar.length > 0) {
+                const sinkCode = sink.code;
+                if (!sinkCode) {
+                    // Conservative fallback: without sink source-line text we
+                    // cannot verify the nested-source shape, so preserve the
+                    // pre-Sprint-93 behaviour of dropping variable-bound sources
+                    // from colocation. The variable-scan supplement remains
+                    // authoritative for these cases.
+                    continue;
+                }
+                // Strip a possible declaration/assignment LHS: `TYPE var =` or
+                // `var =`. Matches single `=` only (not ==, !=, <=, >=).
+                const assignMatch = sinkCode.match(/^\s*(?:[A-Za-z_][\w.<>[\]\s,?]*\s+)?[A-Za-z_]\w*\s*=(?!=)\s*/);
+                const rhs = assignMatch ? sinkCode.slice(assignMatch[0].length) : sinkCode;
+                if (new RegExp(`\\b${sourceVar}\\b`).test(rhs)) {
+                    continue;
+                }
+            }
             // Skip the degenerate `file_input` → `path_traversal` colocation
             // where the source and sink describe the SAME call (one being the
             // chained accessor of the other). Example: Python