circle-ir 3.152.0 → 3.154.0

package/dist/browser/circle-ir.js

@@ -11286,11 +11286,11 @@ var DEFAULT_SINKS = [
   { method: "FileOutputStream", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "FileReader", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "FileWriter", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
-  // ClassLoader/Class resource loading (can be abused for path traversal)
-  { method: "getResource", class: "ClassLoader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
-  { method: "getResourceAsStream", class: "ClassLoader", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
-  { method: "getResource", class: "Class", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
-  { method: "getResourceAsStream", class: "Class", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
+  // NOTE: ClassLoader.getResource / Class.getResource were removed in
+  // 3.153.0 (#233). Classpath resource resolution cannot escape the
+  // classpath root via `../` (JAR entries are opaque). If reintroduced,
+  // the correct CWE is CWE-829 (untrusted-classpath-resource), not
+  // CWE-22 path traversal.
   // Paths.get can be used for path traversal
   { method: "get", class: "Paths", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "of", class: "Path", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
@@ -11304,9 +11304,16 @@ var DEFAULT_SINKS = [
   { method: "newBufferedWriter", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "copy", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1] },
   { method: "move", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1] },
-  { method: "exists", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
-  { method: "isDirectory", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
-  { method: "isRegularFile", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
+  // NOTE: `Files.exists`, `Files.isDirectory`, `Files.isRegularFile`
+  // were removed in 3.154.0 (#245 RC2). These NIO methods are pure
+  // boolean queries — they read a filesystem attribute and cannot
+  // cause traversal escape. A CWE-22 sink must consume the path to
+  // open, read, write, delete, list, or link a filesystem entry;
+  // check-only receivers reveal at most a boolean. Empirically
+  // ~12 H+C FPs across the 10-repo Tier 2 cohort
+  // (cognium-ai#189 §4). `java.io.File` instance methods
+  // (`file.isDirectory()`, `file.exists()`, `file.canRead()`, …)
+  // are already not registered as CWE-22 sinks.
   // RandomAccessFile
   { method: "RandomAccessFile", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   // Framework-specific resource loading (Cocoon, Spring, etc.)
@@ -11793,6 +11800,15 @@ var DEFAULT_SINKS = [
   { method: "parseObject", class: "JSON", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0], safe_if_class_literal_at: 1 },
   { method: "parseObject", class: "JSONObject", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0], safe_if_class_literal_at: 1 },
   { method: "fromJson", class: "Gson", type: "deserialization", cwe: "CWE-502", severity: "medium", arg_positions: [0], safe_if_class_literal_at: 1 },
+  // Jackson ObjectReader — pre-configured reader; typed 2-arg overload is safe
+  // when arg[1] is a class literal or TypeReference<>()/TypeToken<>() (handled
+  // by argIsClassLiteral extension). Added 3.153.0 (cognium-dev #233).
+  { method: "readValue", class: "ObjectReader", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0], safe_if_class_literal_at: 1 },
+  // Jackson ObjectMapper.convertValue — same class-literal shape as readValue.
+  { method: "convertValue", class: "ObjectMapper", type: "deserialization", cwe: "CWE-502", severity: "medium", arg_positions: [0], safe_if_class_literal_at: 1 },
+  // Kryo.readObject(input, User.class) — typed form is safe; polymorphic form
+  // (Kryo.readClassAndObject or non-literal type) remains a sink.
+  { method: "readObject", class: "Kryo", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0], safe_if_class_literal_at: 1 },
   // XMLDecoder
   { method: "readObject", class: "XMLDecoder", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [] },
   // Java serialization constructors
@@ -13652,7 +13668,17 @@ function argIsClassLiteral(call, position) {
   if (!arg) return false;
   const expr = (arg.literal ?? arg.expression ?? "").trim();
   if (!expr) return false;
-  return CLASS_LITERAL_RE.test(expr);
+  if (CLASS_LITERAL_RE.test(expr)) return true;
+  return TYPE_TOKEN_RE.test(expr);
+}
+var TYPE_TOKEN_RE = /^new\s+(?:TypeReference|TypeToken)\s*<[\s\S]*>\s*\(\s*\)\s*\{\s*\}$/;
+function argIsStringLiteral(call, position) {
+  const arg = call.arguments.find((a) => a.position === position);
+  if (!arg) return false;
+  if (arg.literal !== void 0 && arg.literal !== null && arg.literal !== "") return true;
+  const expr = (arg.expression ?? "").trim();
+  if (!expr) return false;
+  return expr.startsWith('"') && expr.endsWith('"') && expr.length >= 2 || expr.startsWith("'") && expr.endsWith("'") && expr.length >= 2 || expr.startsWith('"""') && expr.endsWith('"""');
 }
 var CWE_78_RECEIVER_ALLOWLIST = /* @__PURE__ */ new Set([
   // java.lang.*
@@ -13827,6 +13853,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (pattern.safe_if_class_literal_at !== void 0 && argIsClassLiteral(call, pattern.safe_if_class_literal_at)) {
           continue;
         }
+        if (pattern.safe_if_string_literal_at !== void 0 && argIsStringLiteral(call, pattern.safe_if_string_literal_at)) {
+          continue;
+        }
         if (pattern.type === "command_injection") {
           if (call.is_constructor) {
             if (!CWE_78_RECEIVER_ALLOWLIST.has(call.method_name)) {
@@ -19553,6 +19582,238 @@ function applyLibraryApiSurfaceDowngrade(findings) {
   });
 }
 
+// src/analysis/entry-point-detection.ts
+var TIER_1_METHOD_ANNOTATIONS = /* @__PURE__ */ new Set([
+  // Spring MVC
+  "RequestMapping",
+  "GetMapping",
+  "PostMapping",
+  "PutMapping",
+  "DeleteMapping",
+  "PatchMapping",
+  // Spring messaging / WebSocket
+  "MessageMapping",
+  "SubscribeMapping",
+  // Spring messaging listeners
+  "KafkaListener",
+  "KafkaHandler",
+  "RabbitListener",
+  "RabbitHandler",
+  "JmsListener",
+  "StreamListener",
+  // Spring Cloud AWS
+  "SqsListener",
+  "SqsHandler",
+  // Spring application events (borderline — inclusive in ship 1)
+  "EventListener",
+  // CRON / scheduled
+  "Scheduled",
+  // JAX-RS
+  "Path",
+  "GET",
+  "POST",
+  "PUT",
+  "DELETE",
+  "PATCH",
+  "HEAD",
+  "OPTIONS",
+  // Jenkins Stapler form-binding (#224 — CVE-2022-20617 docker-commons).
+  // `@DataBoundConstructor` / `@DataBoundSetter` mark the trust boundary
+  // between Jenkins UI (or `config.xml` unmarshal) and the plugin: the
+  // Stapler runtime invokes the annotated constructor / setter with
+  // user-supplied strings from a submitted form or a persisted job
+  // config. Every parameter is a user-supplied taint source.
+  "DataBoundConstructor",
+  "DataBoundSetter"
+]);
+var TIER_1_CLASS_ANNOTATIONS = /* @__PURE__ */ new Set([
+  // Spring MVC
+  "RestController",
+  "Controller",
+  // Spring stereotype beans (#136 — see header)
+  "Service",
+  "Repository",
+  "Component",
+  // JAX-RS resource class
+  "Path",
+  // Servlet 3.0 annotation-based servlet
+  "WebServlet",
+  // JSR-356 WebSocket endpoint
+  "ServerEndpoint",
+  // Declarative HTTP client (borderline — inclusive in ship 1; contract-defined
+  // parameter shapes are downstream-relevant trust boundaries)
+  "FeignClient"
+]);
+var TIER_1_BY_SUPERTYPE = /* @__PURE__ */ new Map([
+  // Servlet API
+  ["HttpServlet", /* @__PURE__ */ new Set(["doGet", "doPost", "doPut", "doDelete", "doHead", "doOptions", "doTrace", "service"])],
+  ["GenericServlet", /* @__PURE__ */ new Set(["service"])],
+  ["Filter", /* @__PURE__ */ new Set(["doFilter"])],
+  // Spring web
+  ["HandlerInterceptor", /* @__PURE__ */ new Set(["preHandle", "postHandle", "afterCompletion"])],
+  ["AsyncHandlerInterceptor", /* @__PURE__ */ new Set(["preHandle", "postHandle", "afterCompletion", "afterConcurrentHandlingStarted"])],
+  // Spring boot CLI entry points
+  ["CommandLineRunner", /* @__PURE__ */ new Set(["run"])],
+  ["ApplicationRunner", /* @__PURE__ */ new Set(["run"])],
+  // Netty channel handlers (#154 — CVE-2022-26884 dolphinscheduler).
+  // `SimpleChannelInboundHandler<T>.channelRead0(ctx, msg)` is the
+  // standard typed read entry; `ChannelInboundHandler.channelRead(ctx,
+  // Object)` is the untyped base. `ChannelInboundHandlerAdapter` and
+  // `ChannelDuplexHandler` are the most-common adapter classes user
+  // handlers extend. `NettyRequestProcessor` is the dolphinscheduler-
+  // specific (and other Netty-RPC projects') wire-message processor
+  // surface — `process(channel, command)` is the network entry point.
+  ["SimpleChannelInboundHandler", /* @__PURE__ */ new Set(["channelRead0", "messageReceived"])],
+  ["ChannelInboundHandler", /* @__PURE__ */ new Set(["channelRead", "channelReadComplete"])],
+  ["ChannelInboundHandlerAdapter", /* @__PURE__ */ new Set(["channelRead", "channelReadComplete"])],
+  ["ChannelDuplexHandler", /* @__PURE__ */ new Set(["channelRead", "channelReadComplete"])],
+  ["NettyRequestProcessor", /* @__PURE__ */ new Set(["process"])],
+  // XStream deserialization converters (#224 — CVE-2020-26217,
+  // CVE-2021-21345). The xstream deserializer invokes `unmarshal`
+  // with attacker-controlled `HierarchicalStreamReader` state whenever
+  // untrusted XML reaches `XStream.fromXML`. Each converter is a
+  // deserialization gadget surface — its `unmarshal` parameters are
+  // network-facing taint sources even though the enclosing class
+  // carries no framework annotation. `marshal` is included for the
+  // symmetric round-trip surface but is rarely exploitable on its
+  // own; the fixup targets `unmarshal` primarily.
+  //
+  // `SingleValueConverter` is the string-form variant (fromString
+  // parses an attacker string; toString is the sink half of the
+  // round-trip). `ConverterMatcher` is the shared base and some
+  // downstream projects subclass it directly.
+  ["Converter", /* @__PURE__ */ new Set(["marshal", "unmarshal"])],
+  ["SingleValueConverter", /* @__PURE__ */ new Set(["fromString", "toString"])],
+  ["ConverterMatcher", /* @__PURE__ */ new Set(["marshal", "unmarshal"])],
+  // XStream abstract base classes — direct-parent `extends` match
+  // covers the common shape where user converters subclass a base
+  // rather than implementing `Converter` directly.
+  ["AbstractReflectionConverter", /* @__PURE__ */ new Set(["marshal", "unmarshal", "doMarshal", "doUnmarshal"])],
+  ["AbstractSingleValueConverter", /* @__PURE__ */ new Set(["fromString", "toString"])],
+  ["AbstractCollectionConverter", /* @__PURE__ */ new Set(["marshal", "unmarshal"])]
+]);
+var TIER_3_CLASS_SUFFIXES = [
+  "Util",
+  "Utils",
+  "Helper",
+  "Helpers"
+];
+var TIER_3_PACKAGE_FRAGMENTS = [
+  ".template.",
+  ".templates.",
+  ".engine.",
+  ".engines."
+];
+var TIER_3_JDK_FACADE_INTERFACES = /* @__PURE__ */ new Set([
+  // Collection root + common containers
+  "Collection",
+  "List",
+  "Set",
+  "Map",
+  "Queue",
+  "Deque",
+  "SortedSet",
+  "SortedMap",
+  "NavigableSet",
+  "NavigableMap",
+  // Iteration / ordering / equality contracts
+  "Iterator",
+  "Iterable",
+  "ListIterator",
+  "Comparator",
+  "Comparable",
+  // Serialization / cloning contracts
+  "Serializable",
+  "Externalizable",
+  "Cloneable"
+]);
+function classNameLooksLikeUtility(name2) {
+  if (!name2) return false;
+  for (const suffix of TIER_3_CLASS_SUFFIXES) {
+    if (name2.length > suffix.length && name2.endsWith(suffix)) return true;
+  }
+  return false;
+}
+function packageLooksLikeTemplateOrEngine(pkg) {
+  if (!pkg) return false;
+  const padded = `.${pkg}.`;
+  for (const frag of TIER_3_PACKAGE_FRAGMENTS) {
+    if (padded.includes(frag)) return true;
+  }
+  return false;
+}
+function implementsJdkFacade(t) {
+  if (!t) return false;
+  for (const impl of t.implements ?? []) {
+    if (TIER_3_JDK_FACADE_INTERFACES.has(simpleTypeName(impl))) return true;
+  }
+  return false;
+}
+function classShapeIsLibraryFacade(enclosingType) {
+  if (!enclosingType) return false;
+  if (classNameLooksLikeUtility(enclosingType.name)) return true;
+  if (packageLooksLikeTemplateOrEngine(enclosingType.package)) return true;
+  if (implementsJdkFacade(enclosingType)) return true;
+  return false;
+}
+function annotationsInclude(annotations, targets) {
+  if (!annotations || annotations.length === 0) return false;
+  for (const raw of annotations) {
+    const simple = raw.replace(/^@/, "").replace(/[<(].*$/, "").trim();
+    if (targets.has(simple)) return true;
+  }
+  return false;
+}
+function simpleTypeName(ref) {
+  return ref.replace(/<.*$/, "").trim();
+}
+function looksLikeMainMethod(method) {
+  if (method.name !== "main") return false;
+  const params = method.parameters ?? [];
+  if (params.length !== 1) return false;
+  const t = (params[0].type ?? "").replace(/\s+/g, "");
+  return t === "String[]" || t === "String..." || t === "java.lang.String[]";
+}
+function methodIsSupertypeLifecycleEntryPoint(method, enclosingType) {
+  if (!method.name) return false;
+  if (!enclosingType) return false;
+  const candidates = [];
+  if (enclosingType.extends) candidates.push(simpleTypeName(enclosingType.extends));
+  for (const i2 of enclosingType.implements ?? []) candidates.push(simpleTypeName(i2));
+  for (const supertype of candidates) {
+    const lifecycleMethods = TIER_1_BY_SUPERTYPE.get(supertype);
+    if (lifecycleMethods?.has(method.name)) return true;
+  }
+  return false;
+}
+function classifyEntryPointTier(method, enclosingType, ctx) {
+  const language = (ctx.language ?? "").toLowerCase();
+  if (language !== "java") return "TIER_UNKNOWN";
+  if (!method) return "TIER_UNKNOWN";
+  if (classShapeIsLibraryFacade(enclosingType)) {
+    return "TIER_3_LIBRARY_API";
+  }
+  if (annotationsInclude(method.annotations, TIER_1_METHOD_ANNOTATIONS)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (enclosingType && annotationsInclude(enclosingType.annotations, TIER_1_CLASS_ANNOTATIONS)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (methodIsSupertypeLifecycleEntryPoint(method, enclosingType)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  if (looksLikeMainMethod(method)) {
+    return "TIER_1_ENTRY_POINT";
+  }
+  return "TIER_3_LIBRARY_API";
+}
+function shouldGateInterproceduralParam(sourceType, enclosingMethod, enclosingType, ctx) {
+  if (sourceType !== "interprocedural_param") return false;
+  if (!enclosingMethod) return false;
+  const tier = classifyEntryPointTier(enclosingMethod, enclosingType, ctx);
+  return tier === "TIER_3_LIBRARY_API";
+}
+
 // src/analysis/project-profile-transform.ts
 var DOWNGRADE_ELIGIBLE_RULE_IDS = /* @__PURE__ */ new Set([
   "code_injection",
@@ -30818,7 +31079,7 @@ var REFLECTION_SINK_METHODS = /* @__PURE__ */ new Set([
   "loadClass",
   "defineClass"
 ]);
-var TIER_1_CLASS_ANNOTATIONS = /* @__PURE__ */ new Set([
+var TIER_1_CLASS_ANNOTATIONS2 = /* @__PURE__ */ new Set([
   // Spring MVC
   "RestController",
   "Controller",
@@ -30835,7 +31096,7 @@ var TIER_1_CLASS_ANNOTATIONS = /* @__PURE__ */ new Set([
   // Declarative HTTP client
   "FeignClient"
 ]);
-var TIER_1_METHOD_ANNOTATIONS = /* @__PURE__ */ new Set([
+var TIER_1_METHOD_ANNOTATIONS2 = /* @__PURE__ */ new Set([
   // Spring MVC
   "RequestMapping",
   "GetMapping",
@@ -30936,7 +31197,7 @@ var CliMainReflectionSuppressPass = class {
     let hasFrameworkSignal = false;
     for (const type of types) {
       for (const ann of type.annotations) {
-        if (TIER_1_CLASS_ANNOTATIONS.has(normalizeAnnotation(ann))) {
+        if (TIER_1_CLASS_ANNOTATIONS2.has(normalizeAnnotation(ann))) {
           hasFrameworkSignal = true;
           break;
         }
@@ -30955,7 +31216,7 @@ var CliMainReflectionSuppressPass = class {
       if (hasFrameworkSignal) break;
       for (const method of type.methods) {
         for (const ann of method.annotations) {
-          if (TIER_1_METHOD_ANNOTATIONS.has(normalizeAnnotation(ann))) {
+          if (TIER_1_METHOD_ANNOTATIONS2.has(normalizeAnnotation(ann))) {
             hasFrameworkSignal = true;
             break;
           }
@@ -31044,21 +31305,168 @@ var LibraryProfileSinkGatePass = class {
     };
   }
 };
-
-// src/analysis/passes/taint-propagation-pass.ts
-var TaintPropagationPass = class {
-  name = "taint-propagation";
+var CWE22_SPECULATIVE_SOURCE_TYPES = /* @__PURE__ */ new Set([
+  "interprocedural_param",
+  "constructor_field"
+]);
+var LibraryProfileCwe22PathGatePass = class {
+  name = "library-profile-cwe22-path-gate";
   category = "security";
   run(ctx) {
     const { graph } = ctx;
-    const { calls, types } = graph.ir;
-    const constProp = ctx.getResult("constant-propagation");
-    const sinkFilter = ctx.getResult("sink-filter");
-    const { sources, sinks, sanitizers } = sinkFilter;
-    if (sinks.length === 0) {
-      return { flows: [] };
-    }
-    const canSynthesize = ctx.language === "python" && typeof ctx.code === "string";
+    const profile = graph.ir.meta.projectProfile;
+    if (!isLibraryShape2(profile)) {
+      return {
+        profile,
+        applied: false,
+        dropped: 0,
+        droppedBySourceType: {}
+      };
+    }
+    const flows = graph.ir.taint.flows;
+    if (!flows || flows.length === 0) {
+      return {
+        profile,
+        applied: true,
+        dropped: 0,
+        droppedBySourceType: {}
+      };
+    }
+    const droppedBySourceType = {};
+    const kept = [];
+    for (const flow of flows) {
+      if (flow.sink_type === "path_traversal" && CWE22_SPECULATIVE_SOURCE_TYPES.has(flow.source_type)) {
+        droppedBySourceType[flow.source_type] = (droppedBySourceType[flow.source_type] ?? 0) + 1;
+        continue;
+      }
+      kept.push(flow);
+    }
+    const dropped = flows.length - kept.length;
+    if (dropped > 0) {
+      flows.length = 0;
+      flows.push(...kept);
+    }
+    return {
+      profile,
+      applied: true,
+      dropped,
+      droppedBySourceType
+    };
+  }
+};
+
+// src/analysis/passes/library-profile-xss-gate-pass.ts
+var XSS_NON_HTML_OUTPUT_CLASSES = /* @__PURE__ */ new Set([
+  // In-memory buffers — no HTML output surface.
+  "StringBuilder",
+  "StringBuffer",
+  "CharArrayWriter",
+  "ByteArrayOutputStream",
+  // CLI stdio — CLI apps, not web response bodies.
+  "PrintStream",
+  "System",
+  // HTTP client builders — these are taint SOURCES (outbound reads),
+  // not XSS sinks. `response.body()`, `.post()`, `.get()` on
+  // hutool `HttpRequest` / `HttpResponse` reach us as sink
+  // matches only because xss.yaml catches String-valued receivers.
+  "HttpRequest",
+  "HttpRequestBuilder",
+  "HttpResponse",
+  // Servlet non-body IO. `HttpSession.setAttribute`, `HttpSession.putValue`,
+  // `HttpServletRequest.setAttribute` are session/request attribute
+  // IO, not HTML output. Under `library/*` there is no JSP renderer
+  // reflecting them back. `HttpServletResponse` itself is NOT on
+  // this list — its writers are genuine XSS sinks.
+  "HttpSession",
+  "ServletRequest",
+  "HttpServletRequest",
+  // Wire-protocol writers (jedis internal).
+  "RedisOutputStream",
+  "SafeEncoder",
+  "RESP2",
+  "Protocol",
+  // JSON parsers — these read JSON into POJOs. Source, not sink.
+  "JSONUtil",
+  "JSON",
+  "ObjectMapper",
+  "JsonReader",
+  // Loggers — log injection is CWE-117 (already covered by #112);
+  // these appear here because xss.yaml has a String-valued catch-all
+  // that hits Logger receivers.
+  "Logger",
+  "LoggerFactory",
+  "Log",
+  "Slf4jLogger",
+  // Router / interceptor context stores. Zuul `RequestContext`,
+  // Sentinel `Context` are internal request-processing state, not
+  // HTML output.
+  "RequestContext",
+  "Context"
+]);
+function isLibraryShape3(profile) {
+  if (!profile || profile === "unknown") return false;
+  return profile.startsWith("library/");
+}
+var LibraryProfileXssGatePass = class {
+  name = "library-profile-xss-gate";
+  category = "security";
+  run(ctx) {
+    const { graph } = ctx;
+    const profile = graph.ir.meta.projectProfile;
+    if (!isLibraryShape3(profile)) {
+      return {
+        profile,
+        applied: false,
+        dropped: 0,
+        droppedByClass: {}
+      };
+    }
+    const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
+    if (sinks.length === 0) {
+      return {
+        profile,
+        applied: true,
+        dropped: 0,
+        droppedByClass: {}
+      };
+    }
+    const droppedByClass = {};
+    const kept = [];
+    for (const sink of sinks) {
+      if (sink.type === "xss" && sink.class && XSS_NON_HTML_OUTPUT_CLASSES.has(sink.class)) {
+        droppedByClass[sink.class] = (droppedByClass[sink.class] ?? 0) + 1;
+        continue;
+      }
+      kept.push(sink);
+    }
+    const dropped = sinks.length - kept.length;
+    if (dropped > 0) {
+      sinks.length = 0;
+      sinks.push(...kept);
+    }
+    return {
+      profile,
+      applied: true,
+      dropped,
+      droppedByClass
+    };
+  }
+};
+
+// src/analysis/passes/taint-propagation-pass.ts
+var TaintPropagationPass = class {
+  name = "taint-propagation";
+  category = "security";
+  run(ctx) {
+    const { graph } = ctx;
+    const { calls, types } = graph.ir;
+    const constProp = ctx.getResult("constant-propagation");
+    const sinkFilter = ctx.getResult("sink-filter");
+    const { sources, sinks, sanitizers } = sinkFilter;
+    if (sinks.length === 0) {
+      return { flows: [] };
+    }
+    const canSynthesize = ctx.language === "python" && typeof ctx.code === "string";
     if (sources.length === 0 && !canSynthesize) {
       return { flows: [] };
     }
@@ -31835,238 +32243,6 @@ function pickScopedSource(sources, sinkLine, methodName, types, taintedVar) {
   return sources[0];
 }
 
-// src/analysis/entry-point-detection.ts
-var TIER_1_METHOD_ANNOTATIONS2 = /* @__PURE__ */ new Set([
-  // Spring MVC
-  "RequestMapping",
-  "GetMapping",
-  "PostMapping",
-  "PutMapping",
-  "DeleteMapping",
-  "PatchMapping",
-  // Spring messaging / WebSocket
-  "MessageMapping",
-  "SubscribeMapping",
-  // Spring messaging listeners
-  "KafkaListener",
-  "KafkaHandler",
-  "RabbitListener",
-  "RabbitHandler",
-  "JmsListener",
-  "StreamListener",
-  // Spring Cloud AWS
-  "SqsListener",
-  "SqsHandler",
-  // Spring application events (borderline — inclusive in ship 1)
-  "EventListener",
-  // CRON / scheduled
-  "Scheduled",
-  // JAX-RS
-  "Path",
-  "GET",
-  "POST",
-  "PUT",
-  "DELETE",
-  "PATCH",
-  "HEAD",
-  "OPTIONS",
-  // Jenkins Stapler form-binding (#224 — CVE-2022-20617 docker-commons).
-  // `@DataBoundConstructor` / `@DataBoundSetter` mark the trust boundary
-  // between Jenkins UI (or `config.xml` unmarshal) and the plugin: the
-  // Stapler runtime invokes the annotated constructor / setter with
-  // user-supplied strings from a submitted form or a persisted job
-  // config. Every parameter is a user-supplied taint source.
-  "DataBoundConstructor",
-  "DataBoundSetter"
-]);
-var TIER_1_CLASS_ANNOTATIONS2 = /* @__PURE__ */ new Set([
-  // Spring MVC
-  "RestController",
-  "Controller",
-  // Spring stereotype beans (#136 — see header)
-  "Service",
-  "Repository",
-  "Component",
-  // JAX-RS resource class
-  "Path",
-  // Servlet 3.0 annotation-based servlet
-  "WebServlet",
-  // JSR-356 WebSocket endpoint
-  "ServerEndpoint",
-  // Declarative HTTP client (borderline — inclusive in ship 1; contract-defined
-  // parameter shapes are downstream-relevant trust boundaries)
-  "FeignClient"
-]);
-var TIER_1_BY_SUPERTYPE = /* @__PURE__ */ new Map([
-  // Servlet API
-  ["HttpServlet", /* @__PURE__ */ new Set(["doGet", "doPost", "doPut", "doDelete", "doHead", "doOptions", "doTrace", "service"])],
-  ["GenericServlet", /* @__PURE__ */ new Set(["service"])],
-  ["Filter", /* @__PURE__ */ new Set(["doFilter"])],
-  // Spring web
-  ["HandlerInterceptor", /* @__PURE__ */ new Set(["preHandle", "postHandle", "afterCompletion"])],
-  ["AsyncHandlerInterceptor", /* @__PURE__ */ new Set(["preHandle", "postHandle", "afterCompletion", "afterConcurrentHandlingStarted"])],
-  // Spring boot CLI entry points
-  ["CommandLineRunner", /* @__PURE__ */ new Set(["run"])],
-  ["ApplicationRunner", /* @__PURE__ */ new Set(["run"])],
-  // Netty channel handlers (#154 — CVE-2022-26884 dolphinscheduler).
-  // `SimpleChannelInboundHandler<T>.channelRead0(ctx, msg)` is the
-  // standard typed read entry; `ChannelInboundHandler.channelRead(ctx,
-  // Object)` is the untyped base. `ChannelInboundHandlerAdapter` and
-  // `ChannelDuplexHandler` are the most-common adapter classes user
-  // handlers extend. `NettyRequestProcessor` is the dolphinscheduler-
-  // specific (and other Netty-RPC projects') wire-message processor
-  // surface — `process(channel, command)` is the network entry point.
-  ["SimpleChannelInboundHandler", /* @__PURE__ */ new Set(["channelRead0", "messageReceived"])],
-  ["ChannelInboundHandler", /* @__PURE__ */ new Set(["channelRead", "channelReadComplete"])],
-  ["ChannelInboundHandlerAdapter", /* @__PURE__ */ new Set(["channelRead", "channelReadComplete"])],
-  ["ChannelDuplexHandler", /* @__PURE__ */ new Set(["channelRead", "channelReadComplete"])],
-  ["NettyRequestProcessor", /* @__PURE__ */ new Set(["process"])],
-  // XStream deserialization converters (#224 — CVE-2020-26217,
-  // CVE-2021-21345). The xstream deserializer invokes `unmarshal`
-  // with attacker-controlled `HierarchicalStreamReader` state whenever
-  // untrusted XML reaches `XStream.fromXML`. Each converter is a
-  // deserialization gadget surface — its `unmarshal` parameters are
-  // network-facing taint sources even though the enclosing class
-  // carries no framework annotation. `marshal` is included for the
-  // symmetric round-trip surface but is rarely exploitable on its
-  // own; the fixup targets `unmarshal` primarily.
-  //
-  // `SingleValueConverter` is the string-form variant (fromString
-  // parses an attacker string; toString is the sink half of the
-  // round-trip). `ConverterMatcher` is the shared base and some
-  // downstream projects subclass it directly.
-  ["Converter", /* @__PURE__ */ new Set(["marshal", "unmarshal"])],
-  ["SingleValueConverter", /* @__PURE__ */ new Set(["fromString", "toString"])],
-  ["ConverterMatcher", /* @__PURE__ */ new Set(["marshal", "unmarshal"])],
-  // XStream abstract base classes — direct-parent `extends` match
-  // covers the common shape where user converters subclass a base
-  // rather than implementing `Converter` directly.
-  ["AbstractReflectionConverter", /* @__PURE__ */ new Set(["marshal", "unmarshal", "doMarshal", "doUnmarshal"])],
-  ["AbstractSingleValueConverter", /* @__PURE__ */ new Set(["fromString", "toString"])],
-  ["AbstractCollectionConverter", /* @__PURE__ */ new Set(["marshal", "unmarshal"])]
-]);
-var TIER_3_CLASS_SUFFIXES = [
-  "Util",
-  "Utils",
-  "Helper",
-  "Helpers"
-];
-var TIER_3_PACKAGE_FRAGMENTS = [
-  ".template.",
-  ".templates.",
-  ".engine.",
-  ".engines."
-];
-var TIER_3_JDK_FACADE_INTERFACES = /* @__PURE__ */ new Set([
-  // Collection root + common containers
-  "Collection",
-  "List",
-  "Set",
-  "Map",
-  "Queue",
-  "Deque",
-  "SortedSet",
-  "SortedMap",
-  "NavigableSet",
-  "NavigableMap",
-  // Iteration / ordering / equality contracts
-  "Iterator",
-  "Iterable",
-  "ListIterator",
-  "Comparator",
-  "Comparable",
-  // Serialization / cloning contracts
-  "Serializable",
-  "Externalizable",
-  "Cloneable"
-]);
-function classNameLooksLikeUtility(name2) {
-  if (!name2) return false;
-  for (const suffix of TIER_3_CLASS_SUFFIXES) {
-    if (name2.length > suffix.length && name2.endsWith(suffix)) return true;
-  }
-  return false;
-}
-function packageLooksLikeTemplateOrEngine(pkg) {
-  if (!pkg) return false;
-  const padded = `.${pkg}.`;
-  for (const frag of TIER_3_PACKAGE_FRAGMENTS) {
-    if (padded.includes(frag)) return true;
-  }
-  return false;
-}
-function implementsJdkFacade(t) {
-  if (!t) return false;
-  for (const impl of t.implements ?? []) {
-    if (TIER_3_JDK_FACADE_INTERFACES.has(simpleTypeName(impl))) return true;
-  }
-  return false;
-}
-function classShapeIsLibraryFacade(enclosingType) {
-  if (!enclosingType) return false;
-  if (classNameLooksLikeUtility(enclosingType.name)) return true;
-  if (packageLooksLikeTemplateOrEngine(enclosingType.package)) return true;
-  if (implementsJdkFacade(enclosingType)) return true;
-  return false;
-}
-function annotationsInclude(annotations, targets) {
-  if (!annotations || annotations.length === 0) return false;
-  for (const raw of annotations) {
-    const simple = raw.replace(/^@/, "").replace(/[<(].*$/, "").trim();
-    if (targets.has(simple)) return true;
-  }
-  return false;
-}
-function simpleTypeName(ref) {
-  return ref.replace(/<.*$/, "").trim();
-}
-function looksLikeMainMethod(method) {
-  if (method.name !== "main") return false;
-  const params = method.parameters ?? [];
-  if (params.length !== 1) return false;
-  const t = (params[0].type ?? "").replace(/\s+/g, "");
-  return t === "String[]" || t === "String..." || t === "java.lang.String[]";
-}
-function methodIsSupertypeLifecycleEntryPoint(method, enclosingType) {
-  if (!method.name) return false;
-  if (!enclosingType) return false;
-  const candidates = [];
-  if (enclosingType.extends) candidates.push(simpleTypeName(enclosingType.extends));
-  for (const i2 of enclosingType.implements ?? []) candidates.push(simpleTypeName(i2));
-  for (const supertype of candidates) {
-    const lifecycleMethods = TIER_1_BY_SUPERTYPE.get(supertype);
-    if (lifecycleMethods?.has(method.name)) return true;
-  }
-  return false;
-}
-function classifyEntryPointTier(method, enclosingType, ctx) {
-  const language = (ctx.language ?? "").toLowerCase();
-  if (language !== "java") return "TIER_UNKNOWN";
-  if (!method) return "TIER_UNKNOWN";
-  if (classShapeIsLibraryFacade(enclosingType)) {
-    return "TIER_3_LIBRARY_API";
-  }
-  if (annotationsInclude(method.annotations, TIER_1_METHOD_ANNOTATIONS2)) {
-    return "TIER_1_ENTRY_POINT";
-  }
-  if (enclosingType && annotationsInclude(enclosingType.annotations, TIER_1_CLASS_ANNOTATIONS2)) {
-    return "TIER_1_ENTRY_POINT";
-  }
-  if (methodIsSupertypeLifecycleEntryPoint(method, enclosingType)) {
-    return "TIER_1_ENTRY_POINT";
-  }
-  if (looksLikeMainMethod(method)) {
-    return "TIER_1_ENTRY_POINT";
-  }
-  return "TIER_3_LIBRARY_API";
-}
-function shouldGateInterproceduralParam(sourceType, enclosingMethod, enclosingType, ctx) {
-  if (sourceType !== "interprocedural_param") return false;
-  if (!enclosingMethod) return false;
-  const tier = classifyEntryPointTier(enclosingMethod, enclosingType, ctx);
-  return tier === "TIER_3_LIBRARY_API";
-}
-
 // src/analysis/passes/interprocedural-pass.ts
 var InterproceduralPass = class {
   name = "interprocedural";
@@ -40743,10 +40919,14 @@ async function analyze(code, filePath, language, options = {}) {
       pipeline.add(new CliMainReflectionSuppressPass());
     if (!disabledPasses.has("library-profile-sink-gate"))
       pipeline.add(new LibraryProfileSinkGatePass());
+    if (!disabledPasses.has("library-profile-xss-gate"))
+      pipeline.add(new LibraryProfileXssGatePass());
     pipeline.add(new TaintPropagationPass());
     pipeline.add(new InterproceduralPass({
       enableEntryPointGate: options.enableEntryPointGate ?? true
     }));
+    if (!disabledPasses.has("library-profile-cwe22-path-gate"))
+      pipeline.add(new LibraryProfileCwe22PathGatePass());
     if (!disabledPasses.has("scan-secrets")) pipeline.add(new ScanSecretsPass());
     if (!disabledPasses.has("dead-code")) pipeline.add(new DeadCodePass());
     if (!disabledPasses.has("missing-await")) pipeline.add(new MissingAwaitPass());