circle-ir 3.152.0 → 3.154.0

package/dist/analysis/require-entry-path.js

@@ -0,0 +1,387 @@
+/**
+ * Require-entry-path anchor (cognium-dev#234, ships 3.153.0).
+ *
+ * Post-pipeline, project-level helper that:
+ *   1. Annotates high+critical (H+C) taint findings with an
+ *      `entryPath[]` chain of methods traversed from a classified
+ *      Tier-1 entry point (Spring MVC handler, JAX-RS resource,
+ *      Servlet lifecycle method, Netty channel handler, `main(String[])`,
+ *      …) down to the finding's sink method.
+ *   2. Drops H+C findings under `application` / `server` / `cli` /
+ *      `plugin` / `unknown` project profiles when the reverse-BFS
+ *      conclusively returns no such chain — i.e. the finding lives on a
+ *      method that no HTTP / RPC / lifecycle entry point in the scan can
+ *      reach.
+ *
+ * # Why
+ *
+ * cognium-ai#189 §1 (2026-07 Tier-2 Java cohort — hutool, Sentinel,
+ * plantuml, mockserver) surfaced 1942 H+C findings on hutool with
+ * *zero* classified HTTP/RPC entry point and no reachable path from
+ * `main`. #236 (source-side profile gate, 3.151.0) and #232
+ * (sink-side profile gate, 3.152.0) each attacked the problem via
+ * profile-conditional per-file drops, but both leave the residual
+ * signal on files whose profile is `application/*` or `unknown` even
+ * though the enclosing method is manifestly unreachable from any
+ * classified boundary.
+ *
+ * This helper closes that hole: no entry point → no path from an
+ * entry point → no H+C finding. Every remaining H+C finding under
+ * `application/*` carries a demonstrable call chain from a real
+ * boundary as evidence, materialised on `entryPath[]` for consumers
+ * (CLI, SARIF, cognium-ai) to display.
+ *
+ * # Scope
+ *
+ * - Java only (relies on `classifyEntryPointTier`, which is Java-primary).
+ *   Non-Java files: pass-through, no annotation, no drop.
+ * - Project-level only. Per-file `analyze()` never runs this helper —
+ *   the reachability question is meaningful only across a full scan.
+ * - Only H+C findings from taint passes are candidates for drop. Metric
+ *   findings, `medium` / `low` taint findings, and findings without a
+ *   resolved containing method are always preserved.
+ *
+ * # Interaction with #236 / #232
+ *
+ * Both #236 and #232 fire when `projectProfile` starts with `library/`:
+ * the source / sink is dropped BEFORE the flow is materialised. This
+ * helper therefore no-ops under `library/*` (an already-dropped flow
+ * never reaches us) but still ANNOTATES findings with `entryPath[]`
+ * whenever a chain is available, so downstream consumers can see the
+ * anchor regardless of the drop decision.
+ *
+ * # Reference
+ *
+ * - cognium-dev#234 — this ticket.
+ * - cognium-dev#128 — entry-point tier classifier.
+ * - cognium-dev#236 (3.151.0) — source-side library-profile gate.
+ * - cognium-dev#232 (3.152.0) — sink-side library-profile gate.
+ * - cognium-ai#189  — Tier-2 Java cohort audit.
+ * - `docs/ARCHITECTURE.md` ADR-010.
+ */
+import { classifyEntryPointTier } from './entry-point-detection.js';
+// ---------------------------------------------------------------------------
+// Public rule id + constants
+// ---------------------------------------------------------------------------
+/** Rule identifier used for `disabledPasses` lookups. */
+export const RULE_ID_REQUIRE_ENTRY_PATH = 'require-entry-path';
+/**
+ * BFS visit budget. Chosen empirically to comfortably cover the
+ * largest-repo call graphs we see on the Tier-2 cohort (`plantuml`
+ * ~7k methods, `sentinel` ~6k) while still guaranteeing the pass
+ * terminates in bounded time. Findings whose BFS hits the budget are
+ * treated as `unknown` and preserved — never dropped on a bailout.
+ */
+const MAX_VISITED_METHODS = 2000;
+/**
+ * Apply the entry-path gate + annotation to every file's findings in
+ * `fileAnalyses`, mutating each `analysis.findings` array in place.
+ *
+ * The mutation is idempotent — running twice produces the same result
+ * (BFS is deterministic; annotation always overwrites prior fields
+ * with the same values).
+ */
+export function applyRequireEntryPath(fileAnalyses, options = {}) {
+    const disabledSet = normalizeDisabled(options.disabledPasses);
+    if (disabledSet.has(RULE_ID_REQUIRE_ENTRY_PATH))
+        return;
+    // Build the project-wide method index + reverse-caller adjacency once.
+    const graph = buildProjectMethodGraph(fileAnalyses);
+    if (graph.methodsByKey.size === 0)
+        return;
+    // Classify entry points once — reused for every finding.
+    const entryPointKeys = collectEntryPointKeys(graph);
+    const profileResolver = makeProfileResolver(options.projectProfile);
+    for (const fa of fileAnalyses) {
+        const findings = fa.analysis.findings;
+        if (!findings || findings.length === 0)
+            continue;
+        const kept = [];
+        for (const finding of findings) {
+            const decision = classifyFinding(finding, fa.analysis, graph, entryPointKeys, profileResolver(fa.file));
+            switch (decision.action) {
+                case 'keep':
+                    kept.push(finding);
+                    break;
+                case 'annotate':
+                    kept.push({
+                        ...finding,
+                        entryPath: decision.entryPath,
+                        entryPathTier: decision.tier,
+                    });
+                    break;
+                case 'drop':
+                    // Findings dropped by the entry-path gate carry no
+                    // side-channel signal — downstream consumers see them
+                    // as if they were never emitted.
+                    break;
+            }
+        }
+        fa.analysis.findings = kept.length > 0 ? kept : undefined;
+    }
+}
+function buildProjectMethodGraph(fileAnalyses) {
+    const methodsByKey = new Map();
+    const methodsByName = new Map();
+    const callersOf = new Map();
+    // Pass 1 — index every method.
+    for (const fa of fileAnalyses) {
+        const language = (fa.analysis.meta.language ?? '').toLowerCase();
+        for (const type of fa.analysis.types ?? []) {
+            for (const method of type.methods ?? []) {
+                const key = makeMethodKey(fa.file, type.name, method.name, method.start_line);
+                methodsByKey.set(key, {
+                    key,
+                    file: fa.file,
+                    className: type.name,
+                    method,
+                    enclosingType: type,
+                    language,
+                });
+                const bucket = methodsByName.get(method.name);
+                if (bucket)
+                    bucket.push(key);
+                else
+                    methodsByName.set(method.name, [key]);
+            }
+        }
+    }
+    // Pass 2 — index every call and resolve callee(s) into edges.
+    for (const fa of fileAnalyses) {
+        const calls = fa.analysis.calls ?? [];
+        for (const call of calls) {
+            if (!call.in_method)
+                continue;
+            const callerKey = resolveCallerKey(fa, call.in_method, call.location.line);
+            if (!callerKey)
+                continue;
+            const calleeKeys = resolveCalleeKeys(call, methodsByKey, methodsByName);
+            if (calleeKeys.length === 0)
+                continue;
+            const code = call.receiver
+                ? `${call.receiver}.${call.method_name}(...)`
+                : `${call.method_name}(...)`;
+            for (const calleeKey of calleeKeys) {
+                const edge = {
+                    callerKey,
+                    calleeKey,
+                    callSiteLine: call.location.line,
+                    code,
+                };
+                const bucket = callersOf.get(calleeKey);
+                if (bucket)
+                    bucket.push(edge);
+                else
+                    callersOf.set(calleeKey, [edge]);
+            }
+        }
+    }
+    return { methodsByKey, methodsByName, callersOf };
+}
+function makeMethodKey(file, className, methodName, startLine) {
+    return `${file}|${className}#${methodName}@${startLine}`;
+}
+function resolveCallerKey(fa, inMethod, callLine) {
+    // `in_method` is the simple method name of the enclosing method.
+    // Disambiguate by finding the type whose method range contains
+    // `callLine` (handles overloaded methods sharing the same name).
+    for (const type of fa.analysis.types ?? []) {
+        for (const method of type.methods ?? []) {
+            if (method.name !== inMethod)
+                continue;
+            if (callLine >= method.start_line && callLine <= method.end_line) {
+                return makeMethodKey(fa.file, type.name, method.name, method.start_line);
+            }
+        }
+    }
+    return null;
+}
+function resolveCalleeKeys(call, methodsByKey, methodsByName) {
+    const candidates = methodsByName.get(call.method_name);
+    if (!candidates || candidates.length === 0)
+        return [];
+    // Prefer receiver-type match when we have it — cuts the fan-out on
+    // common names like `execute` / `run` / `handle` from ~50 to ~1.
+    if (call.receiver_type) {
+        const simple = call.receiver_type.replace(/<.*$/, '').trim();
+        const matches = [];
+        for (const key of candidates) {
+            const rec = methodsByKey.get(key);
+            if (rec?.className === simple)
+                matches.push(key);
+        }
+        if (matches.length > 0)
+            return matches;
+    }
+    // Fallback — name-only. Duplicates fan out the BFS but the visit
+    // budget bounds it. Wrong callees do not corrupt correctness: a
+    // spurious edge only expands the reachable set, never contracts it,
+    // and this helper only DROPS on empty-reachable.
+    return candidates;
+}
+// ---------------------------------------------------------------------------
+// Entry-point classification
+// ---------------------------------------------------------------------------
+function collectEntryPointKeys(graph) {
+    const entryPoints = new Set();
+    for (const rec of graph.methodsByKey.values()) {
+        const tier = classifyEntryPointTier(rec.method, rec.enclosingType, {
+            types: [rec.enclosingType],
+            language: rec.language,
+        });
+        if (tier === 'TIER_1_ENTRY_POINT')
+            entryPoints.add(rec.key);
+    }
+    return entryPoints;
+}
+function classifyFinding(finding, ir, graph, entryPointKeys, profile) {
+    // Only taint findings from the security category are in scope.
+    if (finding.category !== 'security')
+        return { action: 'keep' };
+    // Only H+C findings are candidates for drop; lower-severity findings
+    // are preserved regardless of reachability (may still be annotated
+    // when we can).
+    const isHighOrCritical = finding.severity === 'high' || finding.severity === 'critical';
+    // Java-only. The classifier is Java-primary (`classifyEntryPointTier`
+    // returns `TIER_UNKNOWN` for every other language), so applying the
+    // reachability drop to non-Java findings would strip legitimate
+    // signal on Python / Node / Go / Rust — pass through unchanged.
+    const language = (ir.meta.language ?? '').toLowerCase();
+    if (language !== 'java')
+        return { action: 'keep' };
+    // Resolve containing method by (file, line-range) lookup.
+    const containing = findContainingMethod(finding, ir, graph);
+    if (!containing) {
+        // Sink lives in a field initializer, static block, or another
+        // no-method context — cannot classify. Never drop.
+        return { action: 'keep' };
+    }
+    // Reverse BFS from the containing method.
+    const bfs = reverseBfsToEntryPoint(containing.key, graph, entryPointKeys);
+    if (bfs.status === 'hit') {
+        const entryPath = reconstructPath(bfs.entryKey, containing.key, bfs.parent, graph, finding);
+        return {
+            action: 'annotate',
+            entryPath,
+            tier: 'tier1-entry-point',
+        };
+    }
+    if (bfs.status === 'budget') {
+        // Depth bailout — insufficient evidence, preserve.
+        return { action: 'keep' };
+    }
+    // bfs.status === 'miss' — no entry point reaches this method.
+    if (!isHighOrCritical)
+        return { action: 'keep' };
+    if (!shouldDropUnderProfile(profile))
+        return { action: 'keep' };
+    return { action: 'drop' };
+}
+function findContainingMethod(finding, ir, graph) {
+    const line = finding.line;
+    for (const type of ir.types ?? []) {
+        for (const method of type.methods ?? []) {
+            if (line >= method.start_line && line <= method.end_line) {
+                const key = makeMethodKey(finding.file, type.name, method.name, method.start_line);
+                const rec = graph.methodsByKey.get(key);
+                if (rec)
+                    return rec;
+            }
+        }
+    }
+    return null;
+}
+function reverseBfsToEntryPoint(startKey, graph, entryPointKeys) {
+    const parent = new Map();
+    const visited = new Set([startKey]);
+    const queue = [startKey];
+    // Corner case: the sink method is itself an entry point.
+    if (entryPointKeys.has(startKey)) {
+        return { status: 'hit', entryKey: startKey, parent };
+    }
+    while (queue.length > 0) {
+        if (visited.size > MAX_VISITED_METHODS) {
+            return { status: 'budget', entryKey: null, parent };
+        }
+        const current = queue.shift();
+        const incoming = graph.callersOf.get(current) ?? [];
+        // Deterministic ordering — sort by caller key for reproducibility.
+        incoming.sort((a, b) => a.callerKey.localeCompare(b.callerKey));
+        for (const edge of incoming) {
+            if (visited.has(edge.callerKey))
+                continue;
+            visited.add(edge.callerKey);
+            parent.set(edge.callerKey, edge);
+            if (entryPointKeys.has(edge.callerKey)) {
+                return { status: 'hit', entryKey: edge.callerKey, parent };
+            }
+            queue.push(edge.callerKey);
+        }
+    }
+    return { status: 'miss', entryKey: null, parent };
+}
+function reconstructPath(entryKey, sinkKey, parent, graph, finding) {
+    // Walk from entry down to sink by iteratively following the parent
+    // map forward. `parent.get(x)` yields the edge whose `callerKey === x`
+    // (i.e. the call FROM x to its callee on the path).
+    const hops = [];
+    let cursor = entryKey;
+    const guard = new Set();
+    while (cursor !== sinkKey) {
+        if (guard.has(cursor))
+            break; // paranoia — should never cycle
+        guard.add(cursor);
+        const rec = graph.methodsByKey.get(cursor);
+        const edge = parent.get(cursor);
+        if (!rec || !edge)
+            break;
+        hops.push({
+            file: rec.file,
+            method: `${rec.className}.${rec.method.name}`,
+            line: edge.callSiteLine,
+            code: edge.code,
+            variable: '',
+        });
+        cursor = edge.calleeKey;
+    }
+    // Terminal hop — the sink method itself, at the finding's line.
+    const sinkRec = graph.methodsByKey.get(sinkKey);
+    if (sinkRec) {
+        hops.push({
+            file: sinkRec.file,
+            method: `${sinkRec.className}.${sinkRec.method.name}`,
+            line: finding.line,
+            code: finding.message,
+            variable: '',
+        });
+    }
+    return hops;
+}
+// ---------------------------------------------------------------------------
+// Profile predicate
+// ---------------------------------------------------------------------------
+function shouldDropUnderProfile(profile) {
+    // #236 / #232 already own the `library/*` drop path — this helper
+    // must not double-drop findings that survived those gates on
+    // library files, so we only fire on non-library profiles.
+    if (profile === 'unknown')
+        return true;
+    if (profile.startsWith('library/'))
+        return false;
+    return true;
+}
+function makeProfileResolver(input) {
+    if (input === undefined)
+        return () => 'unknown';
+    if (typeof input === 'string')
+        return () => input;
+    return (file) => input.get(file) ?? 'unknown';
+}
+function normalizeDisabled(input) {
+    if (!input)
+        return new Set();
+    if (input instanceof Set)
+        return input;
+    return new Set(input);
+}
+//# sourceMappingURL=require-entry-path.js.map

package/dist/analysis/require-entry-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-entry-path.js","sourceRoot":"","sources":["../../src/analysis/require-entry-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAUH,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,yDAAyD;AACzD,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAqBjC;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,YAAiE,EACjE,UAAwC,EAAE;IAE1C,MAAM,WAAW,GAAG,iBAAiB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9D,IAAI,WAAW,CAAC,GAAG,CAAC,0BAA0B,CAAC;QAAE,OAAO;IAExD,uEAAuE;IACvE,MAAM,KAAK,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IAE1C,yDAAyD;IACzD,MAAM,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAEpD,MAAM,eAAe,GAAG,mBAAmB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAEpE,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACtC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjD,MAAM,IAAI,GAAkB,EAAE,CAAC;QAC/B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,eAAe,CAC9B,OAAO,EACP,EAAE,CAAC,QAAQ,EACX,KAAK,EACL,cAAc,EACd,eAAe,CAAC,EAAE,CAAC,IAAI,CAAC,CACzB,CAAC;YACF,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACxB,KAAK,MAAM;oBACT,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBACnB,MAAM;gBACR,KAAK,UAAU;oBACb,IAAI,CAAC,IAAI,CAAC;wBACR,GAAG,OAAO;wBACV,SAAS,EAAE,QAAQ,CAAC,SAAS;wBAC7B,aAAa,EAAE,QAAQ,CAAC,IAAI;qBAC7B,CAAC,CAAC;oBACH,MAAM;gBACR,KAAK,MAAM;oBACT,mDAAmD;oBACnD,sDAAsD;oBACtD,iCAAiC;oBACjC,MAAM;YACV,CAAC;QACH,CAAC;QACD,EAAE,CAAC,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,CAAC;AACH,CAAC;AA+BD,SAAS,uBAAuB,CAC9B,YAAiE;IAEjE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAwB,CAAC;IACrD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoB,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEhD,+BAA+B;IAC/B,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACjE,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YAC3C,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBACxC,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC9E,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE;oBACpB,GAAG;oBACH,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,SAAS,EAAE,IAAI,CAAC,IAAI;oBACpB,MAAM;oBACN,aAAa,EAAE,IAAI;oBACnB,QAAQ;iBACT,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC9C,IAAI,MAAM;oBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;oBACxB,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,SAAS;YAC9B,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC3E,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;YACxE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAEtC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ;gBACxB,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,OAAO;gBAC7C,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,OAAO,CAAC;YAE/B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAa;oBACrB,SAAS;oBACT,SAAS;oBACT,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;oBAChC,IAAI;iBACL,CAAC;gBACF,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACxC,IAAI,MAAM;oBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;oBACzB,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,aAAa,CACpB,IAAY,EACZ,SAAiB,EACjB,UAAkB,EAClB,SAAiB;IAEjB,OAAO,GAAG,IAAI,IAAI,SAAS,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,gBAAgB,CACvB,EAAwC,EACxC,QAAgB,EAChB,QAAgB;IAEhB,iEAAiE;IACjE,+DAA+D;IAC/D,iEAAiE;IACjE,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QAC3C,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAAE,SAAS;YACvC,IAAI,QAAQ,IAAI,MAAM,CAAC,UAAU,IAAI,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACjE,OAAO,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CACxB,IAA4D,EAC5D,YAAuC,EACvC,aAAoC;IAEpC,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtD,mEAAmE;IACnE,iEAAiE;IACjE,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,GAAG,EAAE,SAAS,KAAK,MAAM;gBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC;IACzC,CAAC;IAED,iEAAiE;IACjE,gEAAgE;IAChE,oEAAoE;IACpE,iDAAiD;IACjD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,SAAS,qBAAqB,CAAC,KAAyB;IACtD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE;YACjE,KAAK,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC;YAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACvB,CAAC,CAAC;QACH,IAAI,IAAI,KAAK,oBAAoB;YAAE,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAWD,SAAS,eAAe,CACtB,OAAoB,EACpB,EAAY,EACZ,KAAyB,EACzB,cAA2B,EAC3B,OAAuB;IAEvB,+DAA+D;IAC/D,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAE/D,qEAAqE;IACrE,mEAAmE;IACnE,gBAAgB;IAChB,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,CAAC;IAExF,sEAAsE;IACtE,oEAAoE;IACpE,gEAAgE;IAChE,gEAAgE;IAChE,MAAM,QAAQ,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACxD,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAEnD,0DAA0D;IAC1D,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,8DAA8D;QAC9D,mDAAmD;QACnD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,0CAA0C;IAC1C,MAAM,GAAG,GAAG,sBAAsB,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;IAC1E,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,QAAS,EAAE,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAC7F,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,SAAS;YACT,IAAI,EAAE,mBAAmB;SAC1B,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5B,mDAAmD;QACnD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,8DAA8D;IAC9D,IAAI,CAAC,gBAAgB;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjD,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAEhE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAAoB,EACpB,EAAY,EACZ,KAAyB;IAEzB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QAClC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACxC,IAAI,IAAI,IAAI,MAAM,CAAC,UAAU,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACzD,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBACnF,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACxC,IAAI,GAAG;oBAAE,OAAO,GAAG,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAYD,SAAS,sBAAsB,CAC7B,QAAgB,EAChB,KAAyB,EACzB,cAA2B;IAE3B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAa,CAAC,QAAQ,CAAC,CAAC;IAEnC,yDAAyD;IACzD,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACvD,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;YACvC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACtD,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACpD,mEAAmE;QACnE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAChE,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;gBAAE,SAAS;YAC1C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACjC,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACvC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC;YAC7D,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CACtB,QAAgB,EAChB,OAAe,EACf,MAA6B,EAC7B,KAAyB,EACzB,OAAoB;IAEpB,mEAAmE;IACnE,uEAAuE;IACvE,oDAAoD;IACpD,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAG,QAAQ,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,OAAO,MAAM,KAAK,OAAO,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,gCAAgC;QAC9D,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClB,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI;YAAE,MAAM;QACzB,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE;YAC7C,IAAI,EAAE,IAAI,CAAC,YAAY;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,EAAE;SACb,CAAC,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;IAC1B,CAAC;IAED,gEAAgE;IAChE,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;YACrD,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,OAAO;YACrB,QAAQ,EAAE,EAAE;SACb,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,SAAS,sBAAsB,CAAC,OAAuB;IACrD,kEAAkE;IAClE,6DAA6D;IAC7D,0DAA0D;IAC1D,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAA+D;IAE/D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC;IAClD,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;AAChD,CAAC;AAED,SAAS,iBAAiB,CACxB,KAA8D;IAE9D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,KAAK,YAAY,GAAG;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC"}

package/dist/analysis/taint-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"taint-matcher.d.ts","sourceRoot":"","sources":["../../src/analysis/taint-matcher.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAgB,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAkB,KAAK,EAAwB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAClK,OAAO,KAAK,EAAE,WAAW,EAAiB,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACpG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AA2B7E;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EAAE,EACjB,KAAK,EAAE,QAAQ,EAAE,EACjB,MAAM,GAAE,WAAgC,EACxC,aAAa,CAAC,EAAE,qBAAqB,EACrC,QAAQ,CAAC,EAAE,iBAAiB,EAC5B,IAAI,CAAC,EAAE,MAAM,GACZ,KAAK,CASP;AAqID;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EAAE,EACtB,KAAK,EAAE,SAAS,EAAE,EAClB,IAAI,EAAE,MAAM,GACX,IAAI,CAYN;AAknED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,WAAW,GACnB,OAAO,CAET"}
+{"version":3,"file":"taint-matcher.d.ts","sourceRoot":"","sources":["../../src/analysis/taint-matcher.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAgB,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAkB,KAAK,EAAwB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAClK,OAAO,KAAK,EAAE,WAAW,EAAiB,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACpG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AA2B7E;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EAAE,EACjB,KAAK,EAAE,QAAQ,EAAE,EACjB,MAAM,GAAE,WAAgC,EACxC,aAAa,CAAC,EAAE,qBAAqB,EACrC,QAAQ,CAAC,EAAE,iBAAiB,EAC5B,IAAI,CAAC,EAAE,MAAM,GACZ,KAAK,CASP;AAqID;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EAAE,EACtB,KAAK,EAAE,SAAS,EAAE,EAClB,IAAI,EAAE,MAAM,GACX,IAAI,CAYN;AA2qED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,WAAW,GACnB,OAAO,CAET"}

package/dist/analysis/taint-matcher.js

@@ -955,7 +955,51 @@ function argIsClassLiteral(call, position) {
     const expr = (arg.literal ?? arg.expression ?? '').trim();
     if (!expr)
         return false;
-    return CLASS_LITERAL_RE.test(expr);
+    if (CLASS_LITERAL_RE.test(expr))
+        return true;
+    // Added 3.153.0 (cognium-dev #233): recognise Jackson `TypeReference<T>`
+    // and Gson `TypeToken<T>` typed generics — the anonymous inner class
+    // captures the generic type at compile time exactly like `Foo.class`
+    // does for the raw type. Only the empty-body form matches; bodied
+    // subclasses (`new TypeReference<...>() { @Override … }`) are treated
+    // as dynamic to preserve recall on suspicious overrides.
+    return TYPE_TOKEN_RE.test(expr);
+}
+/**
+ * Matches `new TypeReference<...>() {}` (Jackson) and
+ * `new TypeToken<...>() {}` (Gson) with an empty anonymous body — the
+ * two canonical shapes for expressing a compile-time-fixed generic
+ * type at a Java call site.
+ *
+ * Whitespace is tolerated between tokens; nested generics
+ * (`<Map<String, List<User>>>`) are captured non-greedily and the
+ * body must be empty (`{}` with only whitespace inside).
+ */
+const TYPE_TOKEN_RE = /^new\s+(?:TypeReference|TypeToken)\s*<[\s\S]*>\s*\(\s*\)\s*\{\s*\}$/;
+/**
+ * Returns true when the call's argument at `position` is a compile-time
+ * string literal (not a variable / expression / concatenation).
+ *
+ * Used by `SinkPattern.safe_if_string_literal_at` — added 3.153.0 for
+ * JDBC `JdbcTemplate` query-family sinks that carry `?` placeholders
+ * (parameterised queries cannot be tainted at the SQL layer).
+ */
+function argIsStringLiteral(call, position) {
+    const arg = call.arguments.find(a => a.position === position);
+    if (!arg)
+        return false;
+    // Prefer `arg.literal` (the extractor's normalised literal value)
+    // when populated; fall back to `arg.expression` for languages whose
+    // extractor does not split literals out separately.
+    if (arg.literal !== undefined && arg.literal !== null && arg.literal !== '')
+        return true;
+    const expr = (arg.expression ?? '').trim();
+    if (!expr)
+        return false;
+    // Double-quoted, single-quoted (Groovy / Bash), or Java text-block (`"""…"""`).
+    return ((expr.startsWith('"') && expr.endsWith('"') && expr.length >= 2) ||
+        (expr.startsWith("'") && expr.endsWith("'") && expr.length >= 2) ||
+        (expr.startsWith('"""') && expr.endsWith('"""')));
 }
 /**
  * CWE-78 (OS Command Injection) receiver-class allowlist (#129).
@@ -1384,6 +1428,16 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
                     argIsClassLiteral(call, pattern.safe_if_class_literal_at)) {
                     continue;
                 }
+                // Skip parameterised SQL query overloads whose SQL is a compile-time
+                // string literal (e.g. `JdbcTemplate.queryForObject("SELECT ... WHERE
+                // id = ?", args, RowMapper)`) — `?` placeholders are bound by the
+                // driver, so a literal at the query position cannot carry taint.
+                // Non-literal overloads (variable, concat, `String.format`) still
+                // match. Added 3.153.0 (cognium-dev #233).
+                if (pattern.safe_if_string_literal_at !== undefined &&
+                    argIsStringLiteral(call, pattern.safe_if_string_literal_at)) {
+                    continue;
+                }
                 // #129 — CWE-78 receiver-class allowlist gate.
                 // Suppress command_injection emissions on receivers known NOT
                 // to invoke OS commands. Constructors check method_name (which