circle-ir 3.148.0 → 3.150.0

package/dist/analysis/passes/cli-main-reflection-suppress-pass.d.ts

@@ -0,0 +1,94 @@
+/**
+ * CliMainReflectionSuppressPass — cognium-dev #162 Option B
+ *
+ * Drops Java reflection `code_injection` sinks in files that look like
+ * a fat-jar CLI tool's own artifact — files that ship a `main(String[])`
+ * entry point AND carry no web-framework entry-point signal anywhere
+ * in the file. The `main(String[])` on the same compilation unit *is*
+ * the trust boundary; the caller is the OS shell that invoked the jar.
+ *
+ * Motivation (from the ticket):
+ *
+ *     // antlr/tool/.../TestRig.java — 5 reflection sinks reported HIGH
+ *     public static void main(String[] args) throws Exception {
+ *         TestRig testRig = new TestRig(args);
+ *         ...
+ *     }
+ *     public void process() throws Exception {
+ *         String lexerName = grammarName + "Lexer";
+ *         ClassLoader cl = Thread.currentThread().getContextClassLoader();
+ *         Class<? extends Lexer> lexerClass =
+ *             cl.loadClass(lexerName).asSubclass(Lexer.class);   // sink
+ *         Constructor<? extends Lexer> lexerCtor =
+ *             lexerClass.getConstructor(CharStream.class);
+ *         Lexer lexer = lexerCtor.newInstance((CharStream)null);  // sink
+ *         ...
+ *     }
+ *
+ * This is documented behaviour of ANTLR's `TestRig` developer CLI —
+ * same shape as `javac`, `java -jar`, `python -m`. The tool's whole
+ * purpose is "give me a grammar name from the command line and I'll
+ * run it." Blocked 5/49 HIGH FPs in the top-100 Java harness.
+ *
+ * ## Signal
+ *
+ * Language MUST be Java. Per-file signal (all must hold):
+ *
+ *   1. Some type in the file declares a `main(String[])` method
+ *      (matches `looksLikeMainMethod` in `entry-point-detection.ts`).
+ *   2. NO type in the file carries a Tier-1 class-level web-framework
+ *      annotation (`@RestController`, `@Controller`, `@Service`,
+ *      `@Component`, `@Path`, `@WebServlet`, `@ServerEndpoint`,
+ *      `@FeignClient`, `@Repository`).
+ *   3. NO method in the file carries a Tier-1 method-level
+ *      web-framework annotation (Spring `@*Mapping`, `@KafkaListener`,
+ *      `@JmsListener`, JAX-RS `@GET/@POST/…`, `@Scheduled`, `@Path`,
+ *      `@DataBoundConstructor`/`@DataBoundSetter`).
+ *   4. NO type in the file extends a Tier-1 supertype (HttpServlet,
+ *      GenericServlet, Filter, HandlerInterceptor, CommandLineRunner,
+ *      SimpleChannelInboundHandler, etc.).
+ *
+ * ## Action
+ *
+ * When the signal fires, drop from the `SinkFilterResult.sinks` list
+ * (the authoritative sink array consumed by `TaintPropagationPass` and
+ * folded into `taint.sinks` by `analyzer.ts`) every sink whose
+ * `type === 'code_injection'` AND `method` is a Java reflection
+ * / ClassLoader surface method. The gate does NOT touch other
+ * `code_injection` shapes: ScriptEngine.eval / GroovyShell.evaluate /
+ * SpEL `parseExpression` remain flagged in CLI tools because they
+ * evaluate scripts (a genuinely dangerous CLI misuse), not just class
+ * names.
+ *
+ * ## Pipeline slot
+ *
+ * Runs after `SinkSemanticsPass` (so its curated-registry drops have
+ * already fired) and before `TaintPropagationPass` (so the flow
+ * generators never see the dropped sinks). Emits no findings.
+ *
+ * ## Pillar I / safety
+ *
+ * - Pure per-file heuristic; no LLM, no filesystem, no config knobs.
+ * - False-negative-safe: any web-framework signal in the file
+ *   (annotation OR supertype OR Tier-1 method annotation) disables
+ *   the gate. Recall preserved for `@RestController` classes,
+ *   `HttpServlet` subclasses, Netty handlers, Jenkins plugins, and
+ *   Kafka/JMS listeners that happen to also expose a `main`.
+ * - Reflection-only: `Runtime.exec`, `ProcessBuilder.start`,
+ *   `Statement.execute`, `ObjectInputStream.readObject`, SpEL,
+ *   Groovy, ScriptEngine — all unaffected.
+ * - Java-only: non-Java sources fall through untouched.
+ */
+import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
+export interface CliMainReflectionSuppressResult {
+    /** Whether the fat-jar CLI signal fired for this file. */
+    cliMainSignal: boolean;
+    /** Number of reflection `code_injection` sinks dropped. */
+    droppedCount: number;
+}
+export declare class CliMainReflectionSuppressPass implements AnalysisPass<CliMainReflectionSuppressResult> {
+    readonly name = "cli-main-reflection-suppress";
+    readonly category: "security";
+    run(ctx: PassContext): CliMainReflectionSuppressResult;
+}
+//# sourceMappingURL=cli-main-reflection-suppress-pass.d.ts.map

package/dist/analysis/passes/cli-main-reflection-suppress-pass.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-main-reflection-suppress-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/cli-main-reflection-suppress-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E,MAAM,WAAW,+BAA+B;IAC9C,0DAA0D;IAC1D,aAAa,EAAE,OAAO,CAAC;IACvB,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;CACtB;AAiKD,qBAAa,6BACX,YAAW,YAAY,CAAC,+BAA+B,CAAC;IAExD,QAAQ,CAAC,IAAI,kCAAkC;IAC/C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,+BAA+B;CA+FvD"}

package/dist/analysis/passes/cli-main-reflection-suppress-pass.js

@@ -0,0 +1,337 @@
+/**
+ * CliMainReflectionSuppressPass — cognium-dev #162 Option B
+ *
+ * Drops Java reflection `code_injection` sinks in files that look like
+ * a fat-jar CLI tool's own artifact — files that ship a `main(String[])`
+ * entry point AND carry no web-framework entry-point signal anywhere
+ * in the file. The `main(String[])` on the same compilation unit *is*
+ * the trust boundary; the caller is the OS shell that invoked the jar.
+ *
+ * Motivation (from the ticket):
+ *
+ *     // antlr/tool/.../TestRig.java — 5 reflection sinks reported HIGH
+ *     public static void main(String[] args) throws Exception {
+ *         TestRig testRig = new TestRig(args);
+ *         ...
+ *     }
+ *     public void process() throws Exception {
+ *         String lexerName = grammarName + "Lexer";
+ *         ClassLoader cl = Thread.currentThread().getContextClassLoader();
+ *         Class<? extends Lexer> lexerClass =
+ *             cl.loadClass(lexerName).asSubclass(Lexer.class);   // sink
+ *         Constructor<? extends Lexer> lexerCtor =
+ *             lexerClass.getConstructor(CharStream.class);
+ *         Lexer lexer = lexerCtor.newInstance((CharStream)null);  // sink
+ *         ...
+ *     }
+ *
+ * This is documented behaviour of ANTLR's `TestRig` developer CLI —
+ * same shape as `javac`, `java -jar`, `python -m`. The tool's whole
+ * purpose is "give me a grammar name from the command line and I'll
+ * run it." Blocked 5/49 HIGH FPs in the top-100 Java harness.
+ *
+ * ## Signal
+ *
+ * Language MUST be Java. Per-file signal (all must hold):
+ *
+ *   1. Some type in the file declares a `main(String[])` method
+ *      (matches `looksLikeMainMethod` in `entry-point-detection.ts`).
+ *   2. NO type in the file carries a Tier-1 class-level web-framework
+ *      annotation (`@RestController`, `@Controller`, `@Service`,
+ *      `@Component`, `@Path`, `@WebServlet`, `@ServerEndpoint`,
+ *      `@FeignClient`, `@Repository`).
+ *   3. NO method in the file carries a Tier-1 method-level
+ *      web-framework annotation (Spring `@*Mapping`, `@KafkaListener`,
+ *      `@JmsListener`, JAX-RS `@GET/@POST/…`, `@Scheduled`, `@Path`,
+ *      `@DataBoundConstructor`/`@DataBoundSetter`).
+ *   4. NO type in the file extends a Tier-1 supertype (HttpServlet,
+ *      GenericServlet, Filter, HandlerInterceptor, CommandLineRunner,
+ *      SimpleChannelInboundHandler, etc.).
+ *
+ * ## Action
+ *
+ * When the signal fires, drop from the `SinkFilterResult.sinks` list
+ * (the authoritative sink array consumed by `TaintPropagationPass` and
+ * folded into `taint.sinks` by `analyzer.ts`) every sink whose
+ * `type === 'code_injection'` AND `method` is a Java reflection
+ * / ClassLoader surface method. The gate does NOT touch other
+ * `code_injection` shapes: ScriptEngine.eval / GroovyShell.evaluate /
+ * SpEL `parseExpression` remain flagged in CLI tools because they
+ * evaluate scripts (a genuinely dangerous CLI misuse), not just class
+ * names.
+ *
+ * ## Pipeline slot
+ *
+ * Runs after `SinkSemanticsPass` (so its curated-registry drops have
+ * already fired) and before `TaintPropagationPass` (so the flow
+ * generators never see the dropped sinks). Emits no findings.
+ *
+ * ## Pillar I / safety
+ *
+ * - Pure per-file heuristic; no LLM, no filesystem, no config knobs.
+ * - False-negative-safe: any web-framework signal in the file
+ *   (annotation OR supertype OR Tier-1 method annotation) disables
+ *   the gate. Recall preserved for `@RestController` classes,
+ *   `HttpServlet` subclasses, Netty handlers, Jenkins plugins, and
+ *   Kafka/JMS listeners that happen to also expose a `main`.
+ * - Reflection-only: `Runtime.exec`, `ProcessBuilder.start`,
+ *   `Statement.execute`, `ObjectInputStream.readObject`, SpEL,
+ *   Groovy, ScriptEngine — all unaffected.
+ * - Java-only: non-Java sources fall through untouched.
+ */
+/**
+ * Java reflection + ClassLoader methods that produce `code_injection`
+ * sinks via `configs/sinks/code_injection.yaml`. Simple-name match on
+ * `sink.method`. Kept intentionally narrow — script-engine /
+ * expression-language sinks (`eval`, `evaluate`, `parseExpression`,
+ * `getBeanInfo`, `getEngineByName`) are NOT in this set, so those
+ * still fire in CLI artifacts.
+ */
+const REFLECTION_SINK_METHODS = new Set([
+    'forName',
+    'newInstance',
+    'invoke',
+    'getMethod',
+    'getDeclaredMethod',
+    'getConstructor',
+    'getDeclaredConstructor',
+    'loadClass',
+    'defineClass',
+]);
+/**
+ * Tier-1 class-level web-framework annotations. Simple-name match
+ * (annotation strings in `TypeInfo.annotations` may include the `@`
+ * prefix and generic args — we strip both). Any single match kills
+ * the gate for this file.
+ */
+const TIER_1_CLASS_ANNOTATIONS = new Set([
+    // Spring MVC
+    'RestController',
+    'Controller',
+    // Spring stereotype beans
+    'Service',
+    'Repository',
+    'Component',
+    // JAX-RS resource class
+    'Path',
+    // Servlet 3.0 annotation-based servlet
+    'WebServlet',
+    // JSR-356 WebSocket endpoint
+    'ServerEndpoint',
+    // Declarative HTTP client
+    'FeignClient',
+]);
+/**
+ * Tier-1 method-level web-framework annotations. Any single match
+ * kills the gate.
+ */
+const TIER_1_METHOD_ANNOTATIONS = new Set([
+    // Spring MVC
+    'RequestMapping',
+    'GetMapping',
+    'PostMapping',
+    'PutMapping',
+    'DeleteMapping',
+    'PatchMapping',
+    // Spring messaging / WebSocket
+    'MessageMapping',
+    'SubscribeMapping',
+    // Spring messaging listeners
+    'KafkaListener',
+    'KafkaHandler',
+    'RabbitListener',
+    'RabbitHandler',
+    'JmsListener',
+    'StreamListener',
+    // Spring Cloud AWS
+    'SqsListener',
+    'SqsHandler',
+    // Spring application events
+    'EventListener',
+    // CRON / scheduled
+    'Scheduled',
+    // JAX-RS
+    'Path',
+    'GET',
+    'POST',
+    'PUT',
+    'DELETE',
+    'PATCH',
+    'HEAD',
+    'OPTIONS',
+    // Jenkins Stapler form-binding
+    'DataBoundConstructor',
+    'DataBoundSetter',
+]);
+/**
+ * Tier-1 supertypes whose subclasses declare framework entry points
+ * via lifecycle methods (HttpServlet.doGet, ChannelHandler.channelRead,
+ * CommandLineRunner.run, etc.). Simple-name match on
+ * `TypeInfo.extends` and each `TypeInfo.implements[]` entry (generics
+ * stripped).
+ */
+const TIER_1_SUPERTYPES = new Set([
+    'HttpServlet',
+    'GenericServlet',
+    'Filter',
+    'HandlerInterceptor',
+    'AsyncHandlerInterceptor',
+    'CommandLineRunner',
+    'ApplicationRunner',
+    'SimpleChannelInboundHandler',
+    'ChannelInboundHandler',
+    'ChannelInboundHandlerAdapter',
+    'ChannelDuplexHandler',
+    'NettyRequestProcessor',
+    'Converter',
+    'SingleValueConverter',
+    'ConverterMatcher',
+    'AbstractReflectionConverter',
+    'AbstractSingleValueConverter',
+    'AbstractCollectionConverter',
+]);
+/**
+ * Normalize an annotation string to its simple name. Handles `@Foo`,
+ * `Foo`, `@Foo(...)`, `pkg.Foo`, and `Foo<T>` shapes. Returns the
+ * bare identifier (`Foo`) for the lookup.
+ */
+function normalizeAnnotation(raw) {
+    let s = raw.trim();
+    if (s.startsWith('@'))
+        s = s.slice(1);
+    const parenIdx = s.indexOf('(');
+    if (parenIdx >= 0)
+        s = s.slice(0, parenIdx);
+    const genericIdx = s.indexOf('<');
+    if (genericIdx >= 0)
+        s = s.slice(0, genericIdx);
+    const dotIdx = s.lastIndexOf('.');
+    if (dotIdx >= 0)
+        s = s.slice(dotIdx + 1);
+    return s.trim();
+}
+/** Strip generics + package qualifier from a supertype reference. */
+function normalizeSupertype(raw) {
+    let s = raw.trim();
+    const genericIdx = s.indexOf('<');
+    if (genericIdx >= 0)
+        s = s.slice(0, genericIdx);
+    const dotIdx = s.lastIndexOf('.');
+    if (dotIdx >= 0)
+        s = s.slice(dotIdx + 1);
+    return s.trim();
+}
+/**
+ * Detect the `main(String[] args)` entry-point shape. Static isn't
+ * required by the JVM launcher spec strictly (some launchers accept
+ * instance mains), but every real Java CLI uses `public static void
+ * main(String[])`. We match on the parameter shape only — one string
+ * array — matching `looksLikeMainMethod` in
+ * `src/analysis/entry-point-detection.ts`.
+ */
+function isMainMethod(name, paramTypes) {
+    if (name !== 'main')
+        return false;
+    if (paramTypes.length !== 1)
+        return false;
+    const t = paramTypes[0];
+    if (!t)
+        return false;
+    const bare = t.replace(/\s+/g, '');
+    return bare === 'String[]' || bare === 'java.lang.String[]';
+}
+export class CliMainReflectionSuppressPass {
+    name = 'cli-main-reflection-suppress';
+    category = 'security';
+    run(ctx) {
+        const { graph, language } = ctx;
+        // Java-only gate. Non-Java IR falls through untouched.
+        if (language !== 'java') {
+            return { cliMainSignal: false, droppedCount: 0 };
+        }
+        const types = graph.ir.types;
+        if (!types || types.length === 0) {
+            return { cliMainSignal: false, droppedCount: 0 };
+        }
+        // Signal condition (1): main(String[]) present anywhere in file.
+        let hasMain = false;
+        // Disqualifiers (2), (3), (4): any Tier-1 web-framework signal.
+        let hasFrameworkSignal = false;
+        for (const type of types) {
+            // (2) class-level annotations
+            for (const ann of type.annotations) {
+                if (TIER_1_CLASS_ANNOTATIONS.has(normalizeAnnotation(ann))) {
+                    hasFrameworkSignal = true;
+                    break;
+                }
+            }
+            if (hasFrameworkSignal)
+                break;
+            // (4) supertype match — `extends` slot + every `implements` slot.
+            if (type.extends && TIER_1_SUPERTYPES.has(normalizeSupertype(type.extends))) {
+                hasFrameworkSignal = true;
+                break;
+            }
+            for (const impl of type.implements) {
+                if (TIER_1_SUPERTYPES.has(normalizeSupertype(impl))) {
+                    hasFrameworkSignal = true;
+                    break;
+                }
+            }
+            if (hasFrameworkSignal)
+                break;
+            for (const method of type.methods) {
+                // (3) method-level annotations
+                for (const ann of method.annotations) {
+                    if (TIER_1_METHOD_ANNOTATIONS.has(normalizeAnnotation(ann))) {
+                        hasFrameworkSignal = true;
+                        break;
+                    }
+                }
+                if (hasFrameworkSignal)
+                    break;
+                // (1) main(String[]) shape
+                if (!hasMain) {
+                    const paramTypes = method.parameters.map((p) => p.type);
+                    if (isMainMethod(method.name, paramTypes)) {
+                        hasMain = true;
+                    }
+                }
+            }
+            if (hasFrameworkSignal)
+                break;
+        }
+        const cliMainSignal = hasMain && !hasFrameworkSignal;
+        if (!cliMainSignal) {
+            return { cliMainSignal: false, droppedCount: 0 };
+        }
+        // Drop reflection code_injection sinks in place. The authoritative
+        // sink list in the real pipeline is `SinkFilterResult.sinks` — that
+        // is what `analyzer.ts` assembles the final `taint.sinks` from and
+        // what `TaintPropagationPass` / `InterproceduralPass` consume.
+        // `graph.ir.taint.sinks` starts empty and is never populated by the
+        // pipeline, so mutating it alone would be a no-op. Prefer the
+        // sink-filter result; fall back to `graph.ir.taint.sinks` for
+        // stand-alone unit-test harnesses that don't run `SinkFilterPass`.
+        const sinks = ctx.hasResult('sink-filter')
+            ? ctx.getResult('sink-filter').sinks
+            : graph.ir.taint.sinks;
+        let droppedCount = 0;
+        const kept = sinks.filter((sink) => {
+            if (sink.type !== 'code_injection')
+                return true;
+            if (!sink.method)
+                return true;
+            if (!REFLECTION_SINK_METHODS.has(sink.method))
+                return true;
+            droppedCount++;
+            return false;
+        });
+        if (droppedCount > 0) {
+            sinks.length = 0;
+            sinks.push(...kept);
+        }
+        return { cliMainSignal: true, droppedCount };
+    }
+}
+//# sourceMappingURL=cli-main-reflection-suppress-pass.js.map

package/dist/analysis/passes/cli-main-reflection-suppress-pass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-main-reflection-suppress-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/cli-main-reflection-suppress-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AAYH;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAC3D,SAAS;IACT,aAAa;IACb,QAAQ;IACR,WAAW;IACX,mBAAmB;IACnB,gBAAgB;IAChB,wBAAwB;IACxB,WAAW;IACX,aAAa;CACd,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC;IAC5D,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,0BAA0B;IAC1B,SAAS;IACT,YAAY;IACZ,WAAW;IACX,wBAAwB;IACxB,MAAM;IACN,uCAAuC;IACvC,YAAY;IACZ,6BAA6B;IAC7B,gBAAgB;IAChB,0BAA0B;IAC1B,aAAa;CACd,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC;IAC7D,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,eAAe;IACf,cAAc;IACd,+BAA+B;IAC/B,gBAAgB;IAChB,kBAAkB;IAClB,6BAA6B;IAC7B,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,eAAe;IACf,aAAa;IACb,gBAAgB;IAChB,mBAAmB;IACnB,aAAa;IACb,YAAY;IACZ,4BAA4B;IAC5B,eAAe;IACf,mBAAmB;IACnB,WAAW;IACX,SAAS;IACT,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,OAAO;IACP,MAAM;IACN,SAAS;IACT,+BAA+B;IAC/B,sBAAsB;IACtB,iBAAiB;CAClB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,aAAa;IACb,gBAAgB;IAChB,QAAQ;IACR,oBAAoB;IACpB,yBAAyB;IACzB,mBAAmB;IACnB,mBAAmB;IACnB,6BAA6B;IAC7B,uBAAuB;IACvB,8BAA8B;IAC9B,sBAAsB;IACtB,uBAAuB;IACvB,WAAW;IACX,sBAAsB;IACtB,kBAAkB;IAClB,6BAA6B;IAC7B,8BAA8B;IAC9B,6BAA6B;CAC9B,CAAC,CAAC;AAEH;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACnB,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,UAAU,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC;AAED,qEAAqE;AACrE,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACnB,MAAM,UAAU,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,UAAU,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,IAAY,EAAE,UAAsC;IACxE,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,oBAAoB,CAAC;AAC9D,CAAC;AAED,MAAM,OAAO,6BAA6B;IAG/B,IAAI,GAAG,8BAA8B,CAAC;IACtC,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAEhC,uDAAuD;QACvD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QACnD,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;QAC7B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QACnD,CAAC;QAED,iEAAiE;QACjE,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,gEAAgE;QAChE,IAAI,kBAAkB,GAAG,KAAK,CAAC;QAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,8BAA8B;YAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnC,IAAI,wBAAwB,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC3D,kBAAkB,GAAG,IAAI,CAAC;oBAC1B,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,kBAAkB;gBAAE,MAAM;YAE9B,kEAAkE;YAClE,IAAI,IAAI,CAAC,OAAO,IAAI,iBAAiB,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC5E,kBAAkB,GAAG,IAAI,CAAC;gBAC1B,MAAM;YACR,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACnC,IAAI,iBAAiB,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBACpD,kBAAkB,GAAG,IAAI,CAAC;oBAC1B,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,kBAAkB;gBAAE,MAAM;YAE9B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClC,+BAA+B;gBAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACrC,IAAI,yBAAyB,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;wBAC5D,kBAAkB,GAAG,IAAI,CAAC;wBAC1B,MAAM;oBACR,CAAC;gBACH,CAAC;gBACD,IAAI,kBAAkB;oBAAE,MAAM;gBAE9B,2BAA2B;gBAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBACxD,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;wBAC1C,OAAO,GAAG,IAAI,CAAC;oBACjB,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IAAI,kBAAkB;gBAAE,MAAM;QAChC,CAAC;QAED,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QACnD,CAAC;QAED,mEAAmE;QACnE,oEAAoE;QACpE,mEAAmE;QACnE,+DAA+D;QAC/D,oEAAoE;QACpE,8DAA8D;QAC9D,8DAA8D;QAC9D,mEAAmE;QACnE,MAAM,KAAK,GAA+C,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC;YACpF,CAAC,CAAC,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC,KAAK;YACtD,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAEzB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;gBAAE,OAAO,IAAI,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAC9B,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3D,YAAY,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QAEH,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC/C,CAAC;CACF"}

package/dist/analysis/passes/resource-leak-pass.d.ts

@@ -68,5 +68,31 @@ export declare class ResourceLeakPass implements AnalysisPass<ResourceLeakResult
      * `void openFoo()` continue to fire.
      */
     private isFactoryMethod;
+    /**
+     * #226 — true if `variable` is passed as a constructor argument to a
+     * known Closeable wrapper call within the enclosing method's line
+     * range. Ownership of the inner stream transfers to the wrapper.
+     *
+     * The check is deliberately per-method: cross-method wrapping does
+     * not apply because the inner reference has already escaped the
+     * scope by then.
+     */
+    private isWrappedByCloseableCtor;
+    /**
+     * #227 — true if `variable` refers to a field of the enclosing class
+     * that is closed inside a worker-literal method (Runnable#run,
+     * Callable#call, Consumer#accept, ...) declared in the same enclosing
+     * method. Ownership transfers to the executor thread.
+     *
+     * The heuristic is intentionally conservative: it requires both
+     *  (a) the resource variable to match a declared field name on the
+     *      enclosing class (so a stray local named `selector` cannot
+     *      accidentally opt in to the suppression), AND
+     *  (b) a `<field>.close()` (or CLOSE_METHODS) call to appear on a
+     *      line inside a method whose name is one of WORKER_METHODS and
+     *      whose start_line is strictly within the enclosing method's
+     *      body (nested literal indicator).
+     */
+    private isClosedInNestedWorker;
 }
 //# sourceMappingURL=resource-leak-pass.d.ts.map

package/dist/analysis/passes/resource-leak-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource-leak-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/resource-leak-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA+C9E,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,KAAK,EAAE,KAAK,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,UAAU,GAAG,WAAW,CAAC;KAChC,CAAC,CAAC;CACJ;AAED,qBAAa,gBAAiB,YAAW,YAAY,CAAC,kBAAkB,CAAC;IACvE,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,QAAQ,EAAG,aAAa,CAAU;IAE3C,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,kBAAkB;IA0HzC,kFAAkF;IAClF,OAAO,CAAC,eAAe;IAOvB;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAQ3B;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAa1B;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAgBvB;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;IAa9B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;CAIxB"}
+{"version":3,"file":"resource-leak-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/resource-leak-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAgF9E,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,KAAK,EAAE,KAAK,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,UAAU,GAAG,WAAW,CAAC;KAChC,CAAC,CAAC;CACJ;AAED,qBAAa,gBAAiB,YAAW,YAAY,CAAC,kBAAkB,CAAC;IACvE,QAAQ,CAAC,IAAI,mBAAmB;IAChC,QAAQ,CAAC,QAAQ,EAAG,aAAa,CAAU;IAE3C,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,kBAAkB;IAkJzC,kFAAkF;IAClF,OAAO,CAAC,eAAe;IAOvB;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAQ3B;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAa1B;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAgBvB;;;;;;OAMG;IACH,OAAO,CAAC,sBAAsB;IAa9B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAKvB;;;;;;;;OAQG;IACH,OAAO,CAAC,wBAAwB;IAmBhC;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,sBAAsB;CAqD/B"}

package/dist/analysis/passes/resource-leak-pass.js

@@ -56,6 +56,37 @@ const CLOSE_METHODS = new Set([
     'close', 'dispose', 'shutdown', 'disconnect', 'release', 'destroy', 'free',
     'shutdownNow', 'terminate',
 ]);
+/**
+ * #226 — Closeable wrapper constructors that document ownership transfer
+ * of their underlying stream/reader. When the underlying resource is passed
+ * as a constructor argument to one of these wrappers, closing the wrapper
+ * cascades to the inner stream (per JDK javadoc), so no leak exists.
+ * Reference: java.io + java.util.zip standard wrappers.
+ */
+const WRAPPER_CTORS = new Set([
+    // java.io wrappers
+    'BufferedInputStream', 'BufferedOutputStream', 'BufferedReader', 'BufferedWriter',
+    'InputStreamReader', 'OutputStreamWriter', 'DataInputStream', 'DataOutputStream',
+    'PrintStream', 'PrintWriter', 'LineNumberReader', 'PushbackInputStream',
+    'PushbackReader', 'SequenceInputStream',
+    // java.util.zip wrappers
+    'GZIPInputStream', 'GZIPOutputStream', 'ZipInputStream', 'ZipOutputStream',
+    'InflaterInputStream', 'DeflaterOutputStream', 'CheckedInputStream',
+    'CheckedOutputStream',
+]);
+/**
+ * #227 — Anonymous-class / functional-interface literal method names that
+ * commonly hold long-lived resources handed off from an outer scope. When a
+ * resource-field is closed inside one of these literals, ownership has been
+ * transferred to the worker and the outer method should not be flagged.
+ */
+const WORKER_METHODS = new Set([
+    'run', // Runnable, Thread
+    'call', // Callable
+    'accept', // Consumer
+    'get', // Supplier
+    'apply', // Function
+]);
 export class ResourceLeakPass {
     name = 'resource-leak';
     category = 'reliability';
@@ -103,6 +134,24 @@ export class ResourceLeakPass {
             if (this.isFactoryMethod(methodInfo.method)) {
                 continue;
             }
+            // #226 — suppression 4: resource is immediately passed as a
+            // constructor argument to a known Closeable wrapper (e.g.
+            // `new GZIPInputStream(fis)`, `new BufferedReader(new
+            // InputStreamReader(is))`). Per JDK javadoc, closing the
+            // wrapper cascades to the underlying stream, so ownership
+            // transfers to the wrapper and the inner reference is released
+            // through the outer chain.
+            if (this.isWrappedByCloseableCtor(graph.ir.calls, resourceVar, openLine, methodEnd)) {
+                continue;
+            }
+            // #227 — suppression 5: resource is stored to a class field
+            // AND that field is referenced with a close() call inside a
+            // worker literal (Runnable#run / Callable#call / etc.) declared
+            // in the same method. Idiomatic Java concurrency: outer method
+            // opens the resource, executor thread closes it in cleanup.
+            if (this.isClosedInNestedWorker(graph, codeLines, resourceVar, methodInfo, openLine, methodEnd)) {
+                continue;
+            }
             // Look for a close() call on this resource within the method
             const closeCall = graph.ir.calls.find(c => CLOSE_METHODS.has(c.method_name) &&
                 c.receiver === resourceVar &&
@@ -240,5 +289,94 @@ export class ResourceLeakPass {
             return false;
         return FACTORY_METHOD_NAME_RE.test(method.name);
     }
+    /**
+     * #226 — true if `variable` is passed as a constructor argument to a
+     * known Closeable wrapper call within the enclosing method's line
+     * range. Ownership of the inner stream transfers to the wrapper.
+     *
+     * The check is deliberately per-method: cross-method wrapping does
+     * not apply because the inner reference has already escaped the
+     * scope by then.
+     */
+    isWrappedByCloseableCtor(calls, variable, fromLine, toLine) {
+        // WRAPPER_CTORS names are PascalCase JDK class names — safe to
+        // match regardless of `is_constructor` (Java tree-sitter often
+        // omits the flag).
+        for (const call of calls) {
+            if (!WRAPPER_CTORS.has(call.method_name))
+                continue;
+            if (call.location.line < fromLine || call.location.line > toLine)
+                continue;
+            for (const arg of call.arguments) {
+                if (arg.variable === variable)
+                    return true;
+            }
+        }
+        return false;
+    }
+    /**
+     * #227 — true if `variable` refers to a field of the enclosing class
+     * that is closed inside a worker-literal method (Runnable#run,
+     * Callable#call, Consumer#accept, ...) declared in the same enclosing
+     * method. Ownership transfers to the executor thread.
+     *
+     * The heuristic is intentionally conservative: it requires both
+     *  (a) the resource variable to match a declared field name on the
+     *      enclosing class (so a stray local named `selector` cannot
+     *      accidentally opt in to the suppression), AND
+     *  (b) a `<field>.close()` (or CLOSE_METHODS) call to appear on a
+     *      line inside a method whose name is one of WORKER_METHODS and
+     *      whose start_line is strictly within the enclosing method's
+     *      body (nested literal indicator).
+     */
+    isClosedInNestedWorker(graph, lines, variable, methodInfo, fromLine, toLine) {
+        // (a) resource variable must match a declared field of the class,
+        // or be text-assigned to a field within the outer method.
+        const fieldNames = new Set(methodInfo.type.fields.map(f => f.name));
+        let candidateField = null;
+        if (fieldNames.has(variable)) {
+            candidateField = variable;
+        }
+        else {
+            // Fallback: `this.<field> = variable` or `<field> = variable`
+            // where <field> is a declared field.
+            const thisAssignRe = new RegExp(`(?:\\bthis\\s*\\.\\s*)?(\\w+)\\s*=\\s*${escapeRegex(variable)}\\b`);
+            for (let l = fromLine; l <= toLine && l <= lines.length; l++) {
+                const m = thisAssignRe.exec(lines[l - 1] ?? '');
+                if (m && fieldNames.has(m[1])) {
+                    candidateField = m[1];
+                    break;
+                }
+            }
+        }
+        if (!candidateField)
+            return false;
+        // (b) find a close-style call on the candidate field whose line
+        // falls inside a WORKER_METHODS method nested in the enclosing
+        // method's body.
+        for (const call of graph.ir.calls) {
+            if (call.receiver !== candidateField)
+                continue;
+            if (!CLOSE_METHODS.has(call.method_name))
+                continue;
+            const closeLine = call.location.line;
+            if (closeLine < fromLine || closeLine > toLine)
+                continue;
+            const enclosing = graph.methodAtLine(closeLine);
+            if (!enclosing)
+                continue;
+            // Same outer method — not nested.
+            if (enclosing.method === methodInfo.method)
+                continue;
+            if (!WORKER_METHODS.has(enclosing.method.name))
+                continue;
+            // Nested worker start must lie inside the outer method body.
+            if (enclosing.method.start_line > fromLine &&
+                enclosing.method.start_line <= toLine) {
+                return true;
+            }
+        }
+        return false;
+    }
 }
 //# sourceMappingURL=resource-leak-pass.js.map