circle-ir 3.141.0 → 3.144.3

package/dist/browser/circle-ir.js

@@ -6337,6 +6337,12 @@ function resolveReceiverType(receiver, context) {
     return { simpleName: null, fqn: null };
   }
   if (receiver === "super") return { simpleName: null, fqn: null };
+  const ctorMatch = receiver.match(/^new\s+([A-Za-z_$][\w$.]*)\s*[<(]/);
+  if (ctorMatch) {
+    const ctorClass = ctorMatch[1];
+    const simple = ctorClass.includes(".") ? ctorClass.substring(ctorClass.lastIndexOf(".") + 1) : ctorClass;
+    return resolveFqn(simple, context);
+  }
   const declaredType = context.localVarTypes.get(receiver) ?? context.paramTypes.get(receiver) ?? context.fieldTypes.get(receiver);
   if (declaredType) {
     return resolveFqn(stripGenerics(declaredType), context);
@@ -11451,6 +11457,14 @@ var DEFAULT_SINKS = [
   // reflection remains a downstream concern of body-writing sinks.
   { method: "setHeader", class: "HttpServletResponse", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1] },
   { method: "addHeader", class: "HttpServletResponse", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1] },
+  // Cookie constructor + addCookie — HTTP response splitting via cookie
+  // name/value (CWE-113). Reflects the #189 Sprint 92 V02SetCookie fixture
+  // where `res.addCookie(new Cookie(name, req.getParameter("v")))` allows
+  // CRLF injection into the Set-Cookie header. Both the ctor arg[1] (value)
+  // and the addCookie arg[0] (Cookie handle) are flagged so intermediate-var
+  // and inline-ctor shapes both surface.
+  { method: "Cookie", class: "constructor", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [0, 1] },
+  { method: "addCookie", class: "HttpServletResponse", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [0] },
   // Note: `sendRedirect` is primarily classified as `ssrf` / open-redirect
   // (CWE-601) further down — see entry near line 1195. CRLF via Location
   // header is a secondary concern; keeping the canonical SSRF entry avoids
@@ -12890,11 +12904,62 @@ var DEFAULT_SANITIZERS = [
   { method: "UUID", class: "uuid", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "Decimal", class: "decimal", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] }
 ];
+var DEFAULT_SINK_SEMANTICS = [
+  {
+    signature: "Jedis#executeCommand",
+    real_class: "db_protocol",
+    overrides: ["command_injection", "code_injection"],
+    note: "Redis wire-protocol serialization, not OS exec"
+  },
+  {
+    signature: "Connection#executeCommand",
+    real_class: "db_protocol",
+    overrides: ["command_injection", "code_injection"],
+    note: "Jedis abstract Connection base"
+  },
+  {
+    signature: "JedisCluster#executeCommand",
+    real_class: "db_protocol",
+    overrides: ["command_injection", "code_injection"],
+    note: "Jedis cluster client"
+  },
+  {
+    signature: "Func1#exec",
+    real_class: "functional_dispatch",
+    overrides: ["command_injection", "code_injection"],
+    note: "RxJava functional dispatch, not OS exec"
+  },
+  {
+    signature: "Action0#call",
+    real_class: "functional_dispatch",
+    overrides: ["command_injection"],
+    note: "RxJava Action0 dispatch"
+  },
+  {
+    signature: "Action1#call",
+    real_class: "functional_dispatch",
+    overrides: ["command_injection"],
+    note: "RxJava Action1 dispatch"
+  },
+  {
+    signature: "Unsafe#defineAnonymousClass",
+    real_class: "jdk_internal",
+    overrides: ["code_injection"],
+    note: "sun.misc.Unsafe JDK-internal reflective bridge"
+  },
+  {
+    signature: "MethodHandle#invokeExact",
+    real_class: "jdk_internal",
+    overrides: ["code_injection"],
+    note: "java.lang.invoke.MethodHandle \u2014 JDK-internal"
+  }
+];
 function getDefaultConfig() {
   return {
     sources: DEFAULT_SOURCES,
     sinks: DEFAULT_SINKS,
-    sanitizers: DEFAULT_SANITIZERS
+    sanitizers: DEFAULT_SANITIZERS,
+    sinkSemantics: DEFAULT_SINK_SEMANTICS
   };
 }
 var DEFAULT_HEADER_RULES = [
@@ -13204,7 +13269,20 @@ function findSources(calls, types, patterns, sourceLines, language) {
             line: paramLine,
             confidence: param.type ? 0.7 : 0.5,
             // Lower confidence for untyped params
-            in_method: method.name
+            in_method: method.name,
+            // cognium-dev #220 — expose the parameter name to variable-scan flow
+            // detection so uses of the param (including through concat-derived
+            // aliases via `buildJavaTaintedVars`) can be bridged to sinks.
+            //
+            // Java-only: the Python/Rust alias-expansion branches in
+            // taint-propagation-pass.ts use the earliest sourcesWithVar entry
+            // as the anchor for synthetic derived sources. Adding
+            // interprocedural_param to sourcesWithVar in those languages
+            // would cause the anchor to become the low-confidence
+            // interprocedural_param at the method decl line instead of the
+            // real HTTP source, breaking downstream sink-type filters
+            // (regressed #78, #92.1, #105 FP-31, #215 recall).
+            ...language === "java" ? { variable: param.name } : {}
           });
         }
       }
@@ -13668,7 +13746,16 @@ function isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines) {
   return false;
 }
 var TEMPLATE_LITERAL_RECEIVER_RE = /^Template\(\s*(?:"[^"\\]*"|'[^'\\]*')\s*\)$/;
-function isSafeJinjaRenderCall(call, pattern, language) {
+var JINJA_AUTOESCAPE_TRUE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*True\b/;
+var JINJA_SELECT_AUTOESCAPE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*select_autoescape\s*\(/;
+var JINJA_AUTOESCAPE_FALSE_RE = /\bEnvironment\s*\([^)]*\bautoescape\s*=\s*False\b/;
+function fileHasSafeJinjaEnvironment(sourceLines) {
+  if (!sourceLines || sourceLines.length === 0) return false;
+  const text = sourceLines.join("\n");
+  if (JINJA_AUTOESCAPE_FALSE_RE.test(text)) return false;
+  return JINJA_AUTOESCAPE_TRUE_RE.test(text) || JINJA_SELECT_AUTOESCAPE_RE.test(text);
+}
+function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   if (language !== "python") return false;
   if (pattern.type !== "xss" && pattern.type !== "code_injection") return false;
   const method = call.method_name;
@@ -13682,7 +13769,8 @@ function isSafeJinjaRenderCall(call, pattern, language) {
   }
   if (method === "render") {
     const receiver = (call.receiver ?? "").trim();
-    return TEMPLATE_LITERAL_RECEIVER_RE.test(receiver);
+    if (TEMPLATE_LITERAL_RECEIVER_RE.test(receiver)) return true;
+    if (fileHasSafeJinjaEnvironment(sourceLines)) return true;
   }
   return false;
 }
@@ -13730,7 +13818,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines)) {
           continue;
         }
-        if (isSafeJinjaRenderCall(call, pattern, language)) {
+        if (isSafeJinjaRenderCall(call, pattern, language, sourceLines)) {
           continue;
         }
         const location = formatCallLocation(call);
@@ -13738,6 +13826,8 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         const confidence = calculateSinkConfidence(call, pattern);
         const existing = sinkMap.get(key);
         if (!existing || confidence > existing.confidence) {
+          const receiverType = call.receiver_type;
+          const simpleClass = receiverType ? receiverType.split(".").pop() || void 0 : void 0;
           sinkMap.set(key, {
             type: pattern.type,
             cwe: pattern.cwe,
@@ -13745,7 +13835,8 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
             line: call.location.line,
             confidence,
             method: call.method_name,
-            argPositions: pattern.arg_positions
+            argPositions: pattern.arg_positions,
+            class: simpleClass
           });
         }
       }
@@ -14700,12 +14791,20 @@ function canSourceReachSink(sourceType, sinkType) {
     // flow detector silently dropped `http_* → trust_boundary` co-located
     // flows like `req.getSession().setAttribute("u", req.getParameter("u"))`
     // (0% recall on OWASP Java trustbound category).
-    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary"],
+    // deserialization added Sprint 93 (#189): SnakeYAML/Jackson/etc. sinks
+    // like `new Yaml().load(req.getParameter("y"))` are real RCE gadget chains
+    // (CWE-502). The reach map previously restricted deserialization to
+    // http_body so http_param/http_query request-derived values feeding
+    // Yaml.load, ObjectInputStream ctor, XMLDecoder ctor, etc. silently
+    // dropped their inline-colocation flow. Typed-overload FPs are gated by
+    // the sink pattern's `safe_if_class_literal_at` flag (Jackson readValue,
+    // Yaml.loadAs, Gson.fromJson) so the wider reach does not regress.
+    http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization"],
     http_body: ["sql_injection", "command_injection", "deserialization", "xxe", "xss", "code_injection", "mybatis_mapper_call", "crlf", "mass_assignment", "open_redirect", "trust_boundary"],
     http_header: ["sql_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary"],
     http_cookie: ["sql_injection", "xss", "mybatis_mapper_call", "code_injection", "crlf", "open_redirect", "trust_boundary"],
     http_path: ["path_traversal", "sql_injection", "ssrf", "mybatis_mapper_call", "open_redirect", "trust_boundary"],
-    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary"],
+    http_query: ["sql_injection", "command_injection", "xss", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization"],
     // ssrf added Sprint 57 #200: bash CGI/webhook handlers and scripts that
     // take a URL on stdin or as a positional CLI arg (`curl "$1"`,
     // `wget "$(read line)"`) and curl/wget it server-side are textbook SSRF
@@ -14727,6 +14826,15 @@ function canSourceReachSink(sourceType, sinkType) {
   const validSinks = sourceToSinkMapping[sourceType];
   return validSinks ? validSinks.includes(sinkType) : false;
 }
+function sourceSemanticsAllowed(source, sinkType) {
+  if (source.constant === true) {
+    return false;
+  }
+  if (source.spi === true) {
+    return sinkType === "code_injection";
+  }
+  return true;
+}
 
 // src/analysis/findings-instrumentation.ts
 var instrumentEnabled = false;
@@ -24649,6 +24757,65 @@ function buildRustTaintedVars(sourceCode, seedVars) {
   }
   return derived;
 }
+function buildJavaTaintedVars(sourceCode, seedVars) {
+  const derived = /* @__PURE__ */ new Map();
+  const knownTainted = new Set(seedVars);
+  const lines = sourceCode.split("\n");
+  const declRe = /^\s*(?:public|private|protected|static|final|volatile|transient|\s)*\s*(?:[A-Za-z_][\w.]*(?:\s*<[^>]*>)?(?:\s*\[\s*\])*)\s+([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+  const assignRe = /^\s*([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+  const JAVA_KEYWORDS = /* @__PURE__ */ new Set([
+    "if",
+    "else",
+    "while",
+    "for",
+    "do",
+    "switch",
+    "case",
+    "return",
+    "throw",
+    "try",
+    "catch",
+    "finally",
+    "new",
+    "this",
+    "super",
+    "break",
+    "continue",
+    "default",
+    "class",
+    "interface",
+    "enum"
+  ]);
+  let changed = true;
+  let guard = 0;
+  while (changed && guard < lines.length + 2) {
+    changed = false;
+    guard++;
+    for (let i2 = 0; i2 < lines.length; i2++) {
+      const line = lines[i2];
+      const trimmed = line.trimStart();
+      if (trimmed.startsWith("//") || trimmed.startsWith("*")) continue;
+      const declMatch = declRe.exec(line);
+      const assignMatch = !declMatch ? assignRe.exec(line) : null;
+      const m = declMatch ?? assignMatch;
+      if (!m) continue;
+      const lhs = m[1];
+      const rhs = m[2];
+      if (JAVA_KEYWORDS.has(lhs)) continue;
+      if (knownTainted.has(lhs)) continue;
+      const escaped = (v) => v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const ref = [...knownTainted].some(
+        (v) => new RegExp(`(?<![\\p{L}\\p{N}_])${escaped(v)}(?![\\p{L}\\p{N}_])`, "u").test(rhs)
+      );
+      if (ref) {
+        derived.set(lhs, i2 + 1);
+        knownTainted.add(lhs);
+        changed = true;
+      }
+    }
+  }
+  return derived;
+}
 var BASH_UNTRUSTED_ENV_PATTERNS = [
   /^USER_INPUT$/i,
   /^QUERY_STRING$/i,
@@ -25006,7 +25173,7 @@ function findBashRealpathPrefixGuardSanitizers(code) {
   const caseOpen = /^\s*case\s+"?\$\{?\w+\}?"?\s+in\b/;
   const esacClose = /^\s*esac\b/;
   const armOpener = /^\s*([^)\s][^)]*?)\)/;
-  const prefixArm = /^(?:"\$\{?\w+\}?"|"[^"]*"|\/[\w\-./]+|\$\{?\w+\}?|[\w\-./]+)(?:\/|\*)/;
+  const prefixArm = /^(?:"\$\{?\w+\}?"|"[^"]*"|\/[\w\-./]+|\$\{?\w+\}?|https?:\/\/[\w\-.]+|[\w\-./]+)(?:\/|\*)/;
   const catchAllArm = /^(?:\*|\\\*)$/;
   let i2 = 0;
   while (i2 < lines.length) {
@@ -25831,9 +25998,11 @@ function findJavaArgvFormExecSanitizers(code) {
   const lines = code.split("\n");
   const argvExecRe = /\.\s*exec\s*\(\s*new\s+String\s*\[\s*\]\s*\{/;
   const argvPbRe = /\bnew\s+ProcessBuilder\s*\(\s*new\s+String\s*\[\s*\]\s*\{/;
+  const shellInStringRe = /new\s+String\s*\[\s*\]\s*\{\s*"(?:\/(?:usr\/)?bin\/(?:sh|bash|zsh|ksh|dash)|(?:sh|bash|zsh|ksh|dash)|cmd(?:\.exe)?|powershell(?:\.exe)?|pwsh)"\s*,\s*"(?:-c|\/c|-Command|-command)"/i;
   for (let i2 = 0; i2 < lines.length; i2++) {
     const text = lines[i2];
     if (!argvExecRe.test(text) && !argvPbRe.test(text)) continue;
+    if (shellInStringRe.test(text)) continue;
     sanitizers.push({
       type: "java_argv_form_exec",
       method: "exec",
@@ -27770,6 +27939,22 @@ function findPythonMongoengineWhereNosqlInjectionFindings(code, file) {
   }
   return findings;
 }
+function hasHostAllowlistBeforeSink(taintedVars, lines, sinkLineIdx) {
+  for (let i2 = 0; i2 < sinkLineIdx; i2++) {
+    const t = lines[i2];
+    for (const v of taintedVars) {
+      const containsRe = new RegExp(
+        `\\.\\s*contains\\s*\\(\\s*${v}\\s*\\.\\s*getHost\\s*\\(\\s*\\)\\s*\\)`
+      );
+      if (containsRe.test(t)) return true;
+      const equalsRe = new RegExp(
+        `\\b${v}\\s*\\.\\s*getHost\\s*\\(\\s*\\)\\s*\\.\\s*equals(?:IgnoreCase)?\\s*\\(\\s*"[^"]+"\\s*\\)`
+      );
+      if (equalsRe.test(t)) return true;
+    }
+  }
+  return false;
+}
 function findJavaUrlOpenStreamSsrfFindings(code, file) {
   const findings = [];
   if (typeof code !== "string" || code.length === 0) return findings;
@@ -27825,6 +28010,7 @@ function findJavaUrlOpenStreamSsrfFindings(code, file) {
       }
     }
     if (!tainted) continue;
+    if (hasHostAllowlistBeforeSink(taintedVars, lines, i2)) continue;
     const key = `${i2 + 1}:${op}`;
     if (seen.has(key)) continue;
     seen.add(key);
@@ -28967,6 +29153,80 @@ function findJsTemplateInjectionSstiFindings(code, file) {
   return findings;
 }
 
+// src/analysis/passes/source-semantics-pass.ts
+var DEMO_PATH_RE = /(?:^|\/)(?:demo|example|examples|samples|integration-tests|integration_tests)(?:\/|$)/i;
+var CONST_STRING_ASSIGN_RE = /^\s*(?:final\s+|static\s+final\s+)?[A-Za-z_][\w.<>\[\]]*\s+[A-Za-z_]\w*\s*=\s*"[^"]*"\s*;?\s*$/;
+var STATIC_FINAL_RE = /^\s*(?:public\s+|private\s+|protected\s+)?static\s+final\s+/;
+var ENUM_CONST_REF_RE = /=\s*[A-Z][A-Za-z0-9_]*\.[A-Z][A-Z0-9_]*\s*;?\s*$/;
+function isConstantSource(code) {
+  if (!code) return false;
+  if (CONST_STRING_ASSIGN_RE.test(code)) return true;
+  if (STATIC_FINAL_RE.test(code)) {
+    const rhs = code.split("=").slice(1).join("=").trim();
+    if (rhs.length === 0) return false;
+    if (/^"[^"]*"\s*;?\s*$/.test(rhs)) return true;
+    if (/^-?\d+(?:\.\d+)?[fFdDlL]?\s*;?\s*$/.test(rhs)) return true;
+    if (/^(?:true|false)\s*;?\s*$/.test(rhs)) return true;
+    if (/^[A-Za-z_][\w.]*\s*;?\s*$/.test(rhs)) return true;
+    return false;
+  }
+  if (ENUM_CONST_REF_RE.test(code)) return true;
+  return false;
+}
+var SERVICE_LOADER_RE = /\bServiceLoader\.(?:load|loadInstalled|stream)\s*\(/;
+var CLASS_FOR_NAME_RE = /\bClass\.forName\s*\(/;
+var META_INF_SERVICES_RE = /getResources?\s*\(\s*"META-INF\/services\//;
+var SPI_WINDOW = 30;
+function isSpiSource(source, lines) {
+  const code = source.code;
+  if (!code) return false;
+  if (SERVICE_LOADER_RE.test(code)) return true;
+  if (CLASS_FOR_NAME_RE.test(code)) {
+    const start2 = Math.max(0, source.line - 1 - SPI_WINDOW);
+    const end = Math.min(lines.length, source.line - 1 + SPI_WINDOW + 1);
+    for (let i2 = start2; i2 < end; i2++) {
+      if (META_INF_SERVICES_RE.test(lines[i2])) return true;
+    }
+  }
+  return false;
+}
+function isDemoPathFile(file) {
+  if (!file) return false;
+  return DEMO_PATH_RE.test(file);
+}
+var SourceSemanticsPass = class {
+  name = "source-semantics";
+  category = "security";
+  run(ctx) {
+    const { graph, code } = ctx;
+    const sources = graph.ir.taint.sources;
+    if (sources.length === 0) {
+      return { constantCount: 0, spiCount: 0, demoPathCount: 0 };
+    }
+    const file = graph.ir.meta.file;
+    const demoPath = isDemoPathFile(file);
+    const lines = code.split("\n");
+    let constantCount = 0;
+    let spiCount = 0;
+    let demoPathCount = 0;
+    for (const source of sources) {
+      if (isConstantSource(source.code)) {
+        source.constant = true;
+        constantCount++;
+      }
+      if (isSpiSource(source, lines)) {
+        source.spi = true;
+        spiCount++;
+      }
+      if (demoPath) {
+        source.demoPath = true;
+        demoPathCount++;
+      }
+    }
+    return { constantCount, spiCount, demoPathCount };
+  }
+};
+
 // src/analysis/passes/sink-filter-pass.ts
 var JS_XSS_SANITIZERS = [
   /\bDOMPurify\.sanitize\s*\(/,
@@ -29514,7 +29774,7 @@ var SinkFilterPass = class {
       const sourceLines = ctx.code.split("\n");
       filtered = filtered.filter((sink) => {
         if (sink.type !== "command_injection") return true;
-        if (sink.method !== "ProcessBuilder") return true;
+        if (sink.method !== "ProcessBuilder" && sink.method !== "start") return true;
         const sinkLineText = sourceLines[sink.line - 1] ?? "";
         if (!/\bnew\s+ProcessBuilder\s*\(/.test(sinkLineText)) return true;
         if (PROCESS_BUILDER_ARGV_FORM_RE.test(sinkLineText)) return false;
@@ -30258,6 +30518,50 @@ function filterSanitizedSinks(sinks, sanitizers, calls) {
   });
 }
 
+// src/analysis/passes/sink-semantics-pass.ts
+function buildRegistry(entries) {
+  const registry = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    const existing = registry.get(entry.signature);
+    if (existing) {
+      for (const t of entry.overrides) existing.add(t);
+    } else {
+      registry.set(entry.signature, new Set(entry.overrides));
+    }
+  }
+  return registry;
+}
+var SinkSemanticsPass = class {
+  name = "sink-semantics";
+  category = "security";
+  run(ctx) {
+    const { graph, config } = ctx;
+    const entries = config.sinkSemantics ?? [];
+    if (entries.length === 0) {
+      return { droppedCount: 0, registrySize: 0 };
+    }
+    const registry = buildRegistry(entries);
+    const sinks = graph.ir.taint.sinks;
+    let droppedCount = 0;
+    const kept = sinks.filter((sink) => {
+      if (!sink.class || !sink.method) return true;
+      const signature = `${sink.class}#${sink.method}`;
+      const overrides = registry.get(signature);
+      if (!overrides) return true;
+      if (overrides.has(sink.type)) {
+        droppedCount++;
+        return false;
+      }
+      return true;
+    });
+    if (droppedCount > 0) {
+      sinks.length = 0;
+      sinks.push(...kept);
+    }
+    return { droppedCount, registrySize: registry.size };
+  }
+};
+
 // src/analysis/passes/taint-propagation-pass.ts
 var TaintPropagationPass = class {
   name = "taint-propagation";
@@ -30887,6 +31191,25 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
       }
     }
   }
+  if (language === "java" && typeof code === "string" && sourcesWithVar.length > 0) {
+    const seedVars = new Set(sourcesWithVar.map((s) => s.variable));
+    const derived = buildJavaTaintedVars(code, seedVars);
+    if (derived.size > 0) {
+      let anchor = sourcesWithVar[0];
+      for (const s of sourcesWithVar) {
+        if (s.line < anchor.line) anchor = s;
+      }
+      const existingVars = new Set(sourcesWithVar.map((s) => s.variable));
+      for (const [varName] of derived) {
+        if (!varName || existingVars.has(varName)) continue;
+        sourcesWithVar.push({
+          ...anchor,
+          variable: varName
+        });
+        existingVars.add(varName);
+      }
+    }
+  }
   const reCache = /* @__PURE__ */ new Map();
   for (const s of sourcesWithVar) {
     if (reCache.has(s.variable)) continue;
@@ -30916,6 +31239,7 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
           }
           const re = reCache.get(source.variable);
           if (!re || !re.test(expr)) continue;
+          if (!sourceSemanticsAllowed(source, sink.type)) continue;
           if (flows.some(
             (f) => f.source_line === source.line && f.sink_line === sink.line && f.sink_type === sink.type
           )) continue;
@@ -30944,7 +31268,6 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
   }
   const sourcesByLine = /* @__PURE__ */ new Map();
   for (const s of sources) {
-    if (s.variable && s.variable.length > 0) continue;
     const arr = sourcesByLine.get(s.line) ?? [];
     arr.push(s);
     sourcesByLine.set(s.line, arr);
@@ -30955,6 +31278,19 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
     if (!colocSources || colocSources.length === 0) continue;
     for (const source of colocSources) {
       if (!canSourceReachSink(source.type, sink.type)) continue;
+      if (!sourceSemanticsAllowed(source, sink.type)) continue;
+      const sourceVar = source.variable;
+      if (sourceVar && sourceVar.length > 0) {
+        const sinkCode = sink.code;
+        if (!sinkCode) {
+          continue;
+        }
+        const assignMatch = sinkCode.match(/^\s*(?:[A-Za-z_][\w.<>[\]\s,?]*\s+)?[A-Za-z_]\w*\s*=(?!=)\s*/);
+        const rhs = assignMatch ? sinkCode.slice(assignMatch[0].length) : sinkCode;
+        if (new RegExp(`\\b${sourceVar}\\b`).test(rhs)) {
+          continue;
+        }
+      }
       if (source.type === "file_input" && sink.type === "path_traversal" && sink.method && source.location.includes(`${sink.method}(`)) {
         continue;
       }
@@ -35059,6 +35395,13 @@ function isProtocolMandatedCryptoFile(file, code) {
 }
 
 // src/analysis/passes/scan-secrets-pass.ts
+function applyDemoDowngrade(demoPath, severity, level) {
+  if (!demoPath) return { severity, level };
+  if (severity === "high") {
+    return { severity: "low", level: "note" };
+  }
+  return { severity, level };
+}
 var TEST_PATH_RE3 = /(?:^|[\\/])(?:test|tests|spec|specs|__tests?__|__mocks?__|fixtures?|testdata)(?:[\\/]|$)/i;
 var TEST_FILENAME_RE = /(?:\.(?:test|spec)\.[cm]?[jt]sx?|_test\.go|_test\.py|Test\.java|Tests\.java)$/i;
 function isTestFile(file) {
@@ -35374,6 +35717,7 @@ var ScanSecretsPass = class {
     if (isTestFile(file) || isGeneratedFile(file)) {
       return { providerFindings: 0, entropyFindings: 0 };
     }
+    const demoPath = DEMO_PATH_RE.test(file);
     const lines = ctx.code.split("\n");
     const prior = ctx.getFindings?.() ?? [];
     const seen = /* @__PURE__ */ new Set();
@@ -35400,14 +35744,15 @@ var ScanSecretsPass = class {
         const key = `${lineNum}:hardcoded-credential`;
         if (seen.has(key)) continue;
         seen.add(key);
+        const dg = applyDemoDowngrade(demoPath, pattern.severity, pattern.level);
         ctx.addFinding({
           id: `hardcoded-credential-${file}-${lineNum}`,
           pass: this.name,
           category: this.category,
           rule_id: "hardcoded-credential",
           cwe: "CWE-798",
-          severity: pattern.severity,
-          level: pattern.level,
+          severity: dg.severity,
+          level: dg.level,
           message: `Hardcoded credential: ${pattern.name} detected`,
           file,
           line: lineNum,
@@ -35427,14 +35772,15 @@ var ScanSecretsPass = class {
       const key = `${lineNum}:hardcoded-credential`;
       if (seen.has(key)) continue;
       seen.add(key);
+      const dg = applyDemoDowngrade(demoPath, "high", "error");
       ctx.addFinding({
         id: `hardcoded-credential-${file}-${lineNum}`,
         pass: this.name,
         category: this.category,
         rule_id: "hardcoded-credential",
         cwe: "CWE-798",
-        severity: "high",
-        level: "error",
+        severity: dg.severity,
+        level: dg.level,
         message: `Hardcoded credential: \`${hit.name}\` assigned a literal value`,
         file,
         line: lineNum,
@@ -39748,7 +40094,9 @@ async function analyze(code, filePath, language, options = {}) {
     pipeline.add(new TaintMatcherPass());
     pipeline.add(new ConstantPropagationPass(tree));
     pipeline.add(new LanguageSourcesPass());
+    if (!disabledPasses.has("source-semantics")) pipeline.add(new SourceSemanticsPass());
     pipeline.add(new SinkFilterPass());
+    if (!disabledPasses.has("sink-semantics")) pipeline.add(new SinkSemanticsPass());
     pipeline.add(new TaintPropagationPass());
     pipeline.add(new InterproceduralPass({
       enableEntryPointGate: options.enableEntryPointGate ?? true