circle-ir 3.153.0 → 3.154.0

package/dist/analysis/passes/library-profile-sink-gate-pass.d.ts

@@ -1,11 +1,24 @@
 /**
  * LibraryProfileSinkGatePass — cognium-dev #232
+ * LibraryProfileCwe22PathGatePass — cognium-dev #245 RC1 (belt-and-suspenders)
  *
  * Sink-side companion to `LibraryProfileSourceGatePass` (#236,
  * shipped 3.151.0). Under the `library/*` project profile, drops
  * sinks whose entire vulnerability class is off-topic for library
  * code — currently just `log_injection` (CWE-117).
  *
+ * The second (companion) class `LibraryProfileCwe22PathGatePass`
+ * runs post-`InterproceduralPass` and filters `graph.ir.taint.flows`
+ * for CWE-22 (`path_traversal`) flows whose source shape is
+ * speculative (`interprocedural_param` / `constructor_field`).
+ * `LibraryProfileSourceGatePass` already drops those `SourceType`s
+ * from `graph.ir.taint.sources` under `library/*`, but this
+ * companion catches any residual flows synthesised downstream that
+ * bypassed the source-list mutation (belt-and-suspenders).
+ * Empirically 170/246 CWE-22 H+C findings on the Tier 2 10-repo
+ * cohort carried an `interprocedural_param` source with empty
+ * `source.code` (cognium-ai#189 §4).
+ *
  * Motivation:
  *
  *   `log_injection` requires a downstream log-viewer that interprets
@@ -56,7 +69,7 @@
  * residuals; the Tier 2 8-repo cohort is Java-heavy.
  */
 import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
-import type { ProjectProfile, SinkType } from '../../types/index.js';
+import type { ProjectProfile, SinkType, SourceType } from '../../types/index.js';
 export interface LibraryProfileSinkGateResult {
     /**
      * Resolved `ProjectProfile` observed on `graph.ir.meta.projectProfile`
@@ -86,4 +99,33 @@ export declare class LibraryProfileSinkGatePass implements AnalysisPass<LibraryP
     readonly category: "security";
     run(ctx: PassContext): LibraryProfileSinkGateResult;
 }
+export interface LibraryProfileCwe22PathGateResult {
+    /**
+     * Resolved `ProjectProfile` observed on `graph.ir.meta.projectProfile`
+     * at the time this pass ran. `undefined` when no profile was
+     * supplied by the caller.
+     */
+    profile: ProjectProfile | undefined;
+    /**
+     * Whether the profile matched the library-shape trigger and the
+     * gate was applied. `false` for every non-library shape and for
+     * `'unknown'` / absent profiles.
+     */
+    applied: boolean;
+    /**
+     * Number of CWE-22 flows removed from `graph.ir.taint.flows`.
+     * Zero when `applied === false` or when no matching flow existed.
+     */
+    dropped: number;
+    /**
+     * Breakdown of drops by speculative source shape. Empty object
+     * when `applied === false` or when no drops fired.
+     */
+    droppedBySourceType: Partial<Record<SourceType, number>>;
+}
+export declare class LibraryProfileCwe22PathGatePass implements AnalysisPass<LibraryProfileCwe22PathGateResult> {
+    readonly name = "library-profile-cwe22-path-gate";
+    readonly category: "security";
+    run(ctx: PassContext): LibraryProfileCwe22PathGateResult;
+}
 //# sourceMappingURL=library-profile-sink-gate-pass.d.ts.map

package/dist/analysis/passes/library-profile-sink-gate-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"library-profile-sink-gate-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/library-profile-sink-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAa,MAAM,sBAAsB,CAAC;AAYhF,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,OAAO,EAAE,cAAc,GAAG,SAAS,CAAC;IACpC;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;CAClD;AAaD,qBAAa,0BACX,YAAW,YAAY,CAAC,4BAA4B,CAAC;IAErD,QAAQ,CAAC,IAAI,+BAA+B;IAC5C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,4BAA4B;CA0DpD"}
+{"version":3,"file":"library-profile-sink-gate-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/library-profile-sink-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAA4B,MAAM,sBAAsB,CAAC;AAY3G,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,OAAO,EAAE,cAAc,GAAG,SAAS,CAAC;IACpC;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;CAClD;AAaD,qBAAa,0BACX,YAAW,YAAY,CAAC,4BAA4B,CAAC;IAErD,QAAQ,CAAC,IAAI,+BAA+B;IAC5C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,4BAA4B;CA0DpD;AAcD,MAAM,WAAW,iCAAiC;IAChD;;;;OAIG;IACH,OAAO,EAAE,cAAc,GAAG,SAAS,CAAC;IACpC;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;CAC1D;AAED,qBAAa,+BACX,YAAW,YAAY,CAAC,iCAAiC,CAAC;IAE1D,QAAQ,CAAC,IAAI,qCAAqC;IAClD,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,iCAAiC;CAuDzD"}

package/dist/analysis/passes/library-profile-sink-gate-pass.js

@@ -1,11 +1,24 @@
 /**
  * LibraryProfileSinkGatePass — cognium-dev #232
+ * LibraryProfileCwe22PathGatePass — cognium-dev #245 RC1 (belt-and-suspenders)
  *
  * Sink-side companion to `LibraryProfileSourceGatePass` (#236,
  * shipped 3.151.0). Under the `library/*` project profile, drops
  * sinks whose entire vulnerability class is off-topic for library
  * code — currently just `log_injection` (CWE-117).
  *
+ * The second (companion) class `LibraryProfileCwe22PathGatePass`
+ * runs post-`InterproceduralPass` and filters `graph.ir.taint.flows`
+ * for CWE-22 (`path_traversal`) flows whose source shape is
+ * speculative (`interprocedural_param` / `constructor_field`).
+ * `LibraryProfileSourceGatePass` already drops those `SourceType`s
+ * from `graph.ir.taint.sources` under `library/*`, but this
+ * companion catches any residual flows synthesised downstream that
+ * bypassed the source-list mutation (belt-and-suspenders).
+ * Empirically 170/246 CWE-22 H+C findings on the Tier 2 10-repo
+ * cohort carried an `interprocedural_param` source with empty
+ * `source.code` (cognium-ai#189 §4).
+ *
  * Motivation:
  *
  *   `log_injection` requires a downstream log-viewer that interprets
@@ -129,4 +142,66 @@ export class LibraryProfileSinkGatePass {
         };
     }
 }
+/**
+ * `SourceType`s eligible for the CWE-22 belt-and-suspenders drop.
+ * These are the same speculative shapes that `LibraryProfileSourceGatePass`
+ * drops from `graph.ir.taint.sources` under `library/*`. Listed
+ * here so the post-flow companion catches any flow that made it
+ * past the source-list mutation.
+ */
+const CWE22_SPECULATIVE_SOURCE_TYPES = new Set([
+    'interprocedural_param',
+    'constructor_field',
+]);
+export class LibraryProfileCwe22PathGatePass {
+    name = 'library-profile-cwe22-path-gate';
+    category = 'security';
+    run(ctx) {
+        const { graph } = ctx;
+        const profile = graph.ir.meta.projectProfile;
+        if (!isLibraryShape(profile)) {
+            return {
+                profile,
+                applied: false,
+                dropped: 0,
+                droppedBySourceType: {},
+            };
+        }
+        // `TaintPropagationPass` / `InterproceduralPass` populate
+        // `graph.ir.taint.flows`. Nothing to filter if no flow ever ran.
+        const flows = graph.ir.taint.flows;
+        if (!flows || flows.length === 0) {
+            return {
+                profile,
+                applied: true,
+                dropped: 0,
+                droppedBySourceType: {},
+            };
+        }
+        const droppedBySourceType = {};
+        const kept = [];
+        for (const flow of flows) {
+            if (flow.sink_type === 'path_traversal' &&
+                CWE22_SPECULATIVE_SOURCE_TYPES.has(flow.source_type)) {
+                droppedBySourceType[flow.source_type] =
+                    (droppedBySourceType[flow.source_type] ?? 0) + 1;
+                continue;
+            }
+            kept.push(flow);
+        }
+        const dropped = flows.length - kept.length;
+        // Mutate the flow array in place so downstream consumers
+        // (`CrossFilePass`, SARIF writer) see the filtered list.
+        if (dropped > 0) {
+            flows.length = 0;
+            flows.push(...kept);
+        }
+        return {
+            profile,
+            applied: true,
+            dropped,
+            droppedBySourceType,
+        };
+    }
+}
 //# sourceMappingURL=library-profile-sink-gate-pass.js.map

package/dist/analysis/passes/library-profile-sink-gate-pass.js.map

@@ -1 +1 @@
-{"version":3,"file":"library-profile-sink-gate-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/library-profile-sink-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAMH;;;;GAIG;AACH,MAAM,kBAAkB,GAA0B,IAAI,GAAG,CAAW;IAClE,eAAe;CAChB,CAAC,CAAC;AA2BH;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAmC;IACzD,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,OAAO,0BAA0B;IAG5B,IAAI,GAAG,2BAA2B,CAAC;IACnC,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;QACtB,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC;QAE7C,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,CAAC;gBACV,aAAa,EAAE,EAAE;aAClB,CAAC;QACJ,CAAC;QAED,uDAAuD;QACvD,6DAA6D;QAC7D,8DAA8D;QAC9D,4DAA4D;QAC5D,mCAAmC;QACnC,MAAM,KAAK,GAAgB,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC;YACrD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC,KAAK;YACtD,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAEzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC;gBACV,aAAa,EAAE,EAAE;aAClB,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAsC,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAgB,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC/D,SAAS;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE3C,yDAAyD;QACzD,gEAAgE;QAChE,6CAA6C;QAC7C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,OAAO;YACL,OAAO;YACP,OAAO,EAAE,IAAI;YACb,OAAO;YACP,aAAa;SACd,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"library-profile-sink-gate-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/library-profile-sink-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAMH;;;;GAIG;AACH,MAAM,kBAAkB,GAA0B,IAAI,GAAG,CAAW;IAClE,eAAe;CAChB,CAAC,CAAC;AA2BH;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAmC;IACzD,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,OAAO,0BAA0B;IAG5B,IAAI,GAAG,2BAA2B,CAAC;IACnC,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;QACtB,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC;QAE7C,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,CAAC;gBACV,aAAa,EAAE,EAAE;aAClB,CAAC;QACJ,CAAC;QAED,uDAAuD;QACvD,6DAA6D;QAC7D,8DAA8D;QAC9D,4DAA4D;QAC5D,mCAAmC;QACnC,MAAM,KAAK,GAAgB,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC;YACrD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC,KAAK;YACtD,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAEzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC;gBACV,aAAa,EAAE,EAAE;aAClB,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAsC,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAgB,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC/D,SAAS;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE3C,yDAAyD;QACzD,gEAAgE;QAChE,6CAA6C;QAC7C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,OAAO;YACL,OAAO;YACP,OAAO,EAAE,IAAI;YACb,OAAO;YACP,aAAa;SACd,CAAC;IACJ,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,8BAA8B,GAA4B,IAAI,GAAG,CAAa;IAClF,uBAAuB;IACvB,mBAAmB;CACpB,CAAC,CAAC;AA2BH,MAAM,OAAO,+BAA+B;IAGjC,IAAI,GAAG,iCAAiC,CAAC;IACzC,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;QACtB,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC;QAE7C,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,CAAC;gBACV,mBAAmB,EAAE,EAAE;aACxB,CAAC;QACJ,CAAC;QAED,0DAA0D;QAC1D,iEAAiE;QACjE,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC;gBACV,mBAAmB,EAAE,EAAE;aACxB,CAAC;QACJ,CAAC;QAED,MAAM,mBAAmB,GAAwC,EAAE,CAAC;QACpE,MAAM,IAAI,GAAoB,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IACE,IAAI,CAAC,SAAS,KAAK,gBAAgB;gBACnC,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,EACpD,CAAC;gBACD,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC;oBACnC,CAAC,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBACnD,SAAS;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE3C,yDAAyD;QACzD,yDAAyD;QACzD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,OAAO;YACL,OAAO;YACP,OAAO,EAAE,IAAI;YACb,OAAO;YACP,mBAAmB;SACpB,CAAC;IACJ,CAAC;CACF"}

package/dist/analysis/passes/library-profile-xss-gate-pass.d.ts

@@ -0,0 +1,104 @@
+/**
+ * LibraryProfileXssGatePass — cognium-dev #244
+ *
+ * Sink-side companion to `LibraryProfileSinkGatePass` (#232, canonical
+ * #112, shipped 3.152.0). Where #112 drops entire `SinkType`s under
+ * `library/*` (currently `log_injection`), this pass narrows the
+ * `xss` `SinkType` on a per-receiver-class basis: `TaintSink`s whose
+ * simple-name receiver class is in `XSS_NON_HTML_OUTPUT_CLASSES` are
+ * dropped before flow generation.
+ *
+ * Motivation:
+ *
+ *   The current `xss` sink class treats any `String`-valued method
+ *   receiver as a potential CWE-79 sink. Under `library/*` this
+ *   over-collects by ~100x. A 10-repo Tier 2 library-profile audit
+ *   (cognium-ai#189 §3, 2026-07) surfaced 507 H+C findings across
+ *   hutool, xdocreport, languagetool, AndroidAsync, Sentinel,
+ *   mybatis-plus, flyingsaucer, jedis — **zero** of which are actual
+ *   HTML-output sinks. The 507 decompose as:
+ *
+ *     - 149 (29.4%) `StringBuilder.append` / `StringBuffer.append` —
+ *       in-memory buffers, not HTML output.
+ *     - 66  (13.0%) `PrintStream.println` on `System.out` / `System.err` —
+ *       CLI stdio, not HTML output.
+ *     - 43  ( 8.5%) `response.body()` on `HttpRequest` / `HttpResponse` —
+ *       outbound HTTP client body READ — a taint SOURCE, not sink.
+ *     - 27  ( 5.3%) `response.end()` header terminator (AndroidAsync).
+ *     - 26  ( 5.1%) `HttpSession.setAttribute` — session store IO.
+ *     - 33  ( 6.5%) `write` on jedis wire-protocol writers.
+ *     - 91  (17.9%) other (Loggers, JSON parsers, Netflix Zuul
+ *       `RequestContext`, Sentinel `Context`).
+ *
+ *   All eight buckets are `library/*` internal buffer / IO / logger /
+ *   HTTP-client / router / JSON-parser plumbing. No web-app response
+ *   writes reach `HttpServletResponse.getWriter().println(taint)` or
+ *   a template renderer.
+ *
+ * Where #112 targets the whole vulnerability class (`log_injection`
+ * is off-topic for every library), CWE-79 is legitimate for library
+ * code that writes HTML (Thymeleaf, FreeMarker, Velocity, JSP
+ * fragments); it is only the RECEIVER SHAPE that is off-topic.
+ * Hence a class-level allowlist would over-drop and a class-level
+ * denylist is the calibrated response.
+ *
+ * Pipeline slot: runs immediately after `LibraryProfileSinkGatePass`
+ * (#112) and before `TaintPropagationPass` (so no dropped sink ever
+ * reaches the flow generators). Ordering ensures both library-profile
+ * gates fire under the same predicate before flow synthesis.
+ *
+ * Guardrails:
+ *   - Pass is a no-op when `graph.ir.meta.projectProfile` is absent,
+ *     `'unknown'`, or does not start with `library/`. Callers that do
+ *     not opt in to profile detection get the unmodified sink list.
+ *   - Only `xss`-type sinks are eligible; every other `SinkType`
+ *     (`sql_injection`, `command_injection`, `path_traversal`,
+ *     `deserialization`, …) is preserved unconditionally.
+ *   - The class denylist is intentionally conservative: it only
+ *     targets classes measured with zero HTML-output flows across the
+ *     10-repo cohort. `HttpServletResponse`, `JspWriter`,
+ *     `ServletOutputStream`, `PrintWriter` (in servlet context),
+ *     template engines (Thymeleaf `SpringWebContext`, FreeMarker
+ *     `Environment`, Velocity `VelocityContext`) are **not** on the
+ *     denylist and continue to fire.
+ *   - Guarded on `disabledPasses.has('library-profile-xss-gate')` at
+ *     the pipeline registration site.
+ *
+ * Reference:
+ *   - cognium-dev#244 — this ticket.
+ *   - cognium-dev#232 (#112, 3.152.0) — sink-side profile gate template.
+ *   - cognium-ai#189 §3 — Tier 2 library-profile CWE-79 audit.
+ *   - `docs/ARCHITECTURE.md` ADR-011.
+ */
+import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
+import type { ProjectProfile } from '../../types/index.js';
+export interface LibraryProfileXssGateResult {
+    /**
+     * Resolved `ProjectProfile` observed on `graph.ir.meta.projectProfile`
+     * at the time this pass ran. `undefined` when no profile was
+     * supplied by the caller.
+     */
+    profile: ProjectProfile | undefined;
+    /**
+     * Whether the profile matched the library-shape trigger and the
+     * gate was applied. `false` for every non-library shape and for
+     * `'unknown'` / absent profiles.
+     */
+    applied: boolean;
+    /**
+     * Number of `xss` sinks removed from the authoritative sink list.
+     * Zero when `applied === false`.
+     */
+    dropped: number;
+    /**
+     * Breakdown of drops by receiver class (simple name). Empty object
+     * when `applied === false` or when no drops fired.
+     */
+    droppedByClass: Record<string, number>;
+}
+export declare class LibraryProfileXssGatePass implements AnalysisPass<LibraryProfileXssGateResult> {
+    readonly name = "library-profile-xss-gate";
+    readonly category: "security";
+    run(ctx: PassContext): LibraryProfileXssGateResult;
+}
+//# sourceMappingURL=library-profile-xss-gate-pass.d.ts.map

package/dist/analysis/passes/library-profile-xss-gate-pass.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"library-profile-xss-gate-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/library-profile-xss-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuEG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAa,MAAM,sBAAsB,CAAC;AA6DtE,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,OAAO,EAAE,cAAc,GAAG,SAAS,CAAC;IACpC;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAaD,qBAAa,yBACX,YAAW,YAAY,CAAC,2BAA2B,CAAC;IAEpD,QAAQ,CAAC,IAAI,8BAA8B;IAC3C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,2BAA2B;CA0DnD"}

package/dist/analysis/passes/library-profile-xss-gate-pass.js

@@ -0,0 +1,196 @@
+/**
+ * LibraryProfileXssGatePass — cognium-dev #244
+ *
+ * Sink-side companion to `LibraryProfileSinkGatePass` (#232, canonical
+ * #112, shipped 3.152.0). Where #112 drops entire `SinkType`s under
+ * `library/*` (currently `log_injection`), this pass narrows the
+ * `xss` `SinkType` on a per-receiver-class basis: `TaintSink`s whose
+ * simple-name receiver class is in `XSS_NON_HTML_OUTPUT_CLASSES` are
+ * dropped before flow generation.
+ *
+ * Motivation:
+ *
+ *   The current `xss` sink class treats any `String`-valued method
+ *   receiver as a potential CWE-79 sink. Under `library/*` this
+ *   over-collects by ~100x. A 10-repo Tier 2 library-profile audit
+ *   (cognium-ai#189 §3, 2026-07) surfaced 507 H+C findings across
+ *   hutool, xdocreport, languagetool, AndroidAsync, Sentinel,
+ *   mybatis-plus, flyingsaucer, jedis — **zero** of which are actual
+ *   HTML-output sinks. The 507 decompose as:
+ *
+ *     - 149 (29.4%) `StringBuilder.append` / `StringBuffer.append` —
+ *       in-memory buffers, not HTML output.
+ *     - 66  (13.0%) `PrintStream.println` on `System.out` / `System.err` —
+ *       CLI stdio, not HTML output.
+ *     - 43  ( 8.5%) `response.body()` on `HttpRequest` / `HttpResponse` —
+ *       outbound HTTP client body READ — a taint SOURCE, not sink.
+ *     - 27  ( 5.3%) `response.end()` header terminator (AndroidAsync).
+ *     - 26  ( 5.1%) `HttpSession.setAttribute` — session store IO.
+ *     - 33  ( 6.5%) `write` on jedis wire-protocol writers.
+ *     - 91  (17.9%) other (Loggers, JSON parsers, Netflix Zuul
+ *       `RequestContext`, Sentinel `Context`).
+ *
+ *   All eight buckets are `library/*` internal buffer / IO / logger /
+ *   HTTP-client / router / JSON-parser plumbing. No web-app response
+ *   writes reach `HttpServletResponse.getWriter().println(taint)` or
+ *   a template renderer.
+ *
+ * Where #112 targets the whole vulnerability class (`log_injection`
+ * is off-topic for every library), CWE-79 is legitimate for library
+ * code that writes HTML (Thymeleaf, FreeMarker, Velocity, JSP
+ * fragments); it is only the RECEIVER SHAPE that is off-topic.
+ * Hence a class-level allowlist would over-drop and a class-level
+ * denylist is the calibrated response.
+ *
+ * Pipeline slot: runs immediately after `LibraryProfileSinkGatePass`
+ * (#112) and before `TaintPropagationPass` (so no dropped sink ever
+ * reaches the flow generators). Ordering ensures both library-profile
+ * gates fire under the same predicate before flow synthesis.
+ *
+ * Guardrails:
+ *   - Pass is a no-op when `graph.ir.meta.projectProfile` is absent,
+ *     `'unknown'`, or does not start with `library/`. Callers that do
+ *     not opt in to profile detection get the unmodified sink list.
+ *   - Only `xss`-type sinks are eligible; every other `SinkType`
+ *     (`sql_injection`, `command_injection`, `path_traversal`,
+ *     `deserialization`, …) is preserved unconditionally.
+ *   - The class denylist is intentionally conservative: it only
+ *     targets classes measured with zero HTML-output flows across the
+ *     10-repo cohort. `HttpServletResponse`, `JspWriter`,
+ *     `ServletOutputStream`, `PrintWriter` (in servlet context),
+ *     template engines (Thymeleaf `SpringWebContext`, FreeMarker
+ *     `Environment`, Velocity `VelocityContext`) are **not** on the
+ *     denylist and continue to fire.
+ *   - Guarded on `disabledPasses.has('library-profile-xss-gate')` at
+ *     the pipeline registration site.
+ *
+ * Reference:
+ *   - cognium-dev#244 — this ticket.
+ *   - cognium-dev#232 (#112, 3.152.0) — sink-side profile gate template.
+ *   - cognium-ai#189 §3 — Tier 2 library-profile CWE-79 audit.
+ *   - `docs/ARCHITECTURE.md` ADR-011.
+ */
+/**
+ * Simple-name receiver classes for which `xss` sinks are dropped
+ * under `library/*` profile. Each entry was measured with zero
+ * true-positive HTML-output flows across the 10-repo Tier 2 cohort
+ * (cognium-ai#189 §3, 2026-07).
+ *
+ * Extending this set is a deliberate, reviewable change. Adding an
+ * entry risks false-negative regressions on the OWASP Benchmark
+ * Java, SecuriBench Micro, and Juliet CWE-79 recall guards.
+ */
+const XSS_NON_HTML_OUTPUT_CLASSES = new Set([
+    // In-memory buffers — no HTML output surface.
+    'StringBuilder',
+    'StringBuffer',
+    'CharArrayWriter',
+    'ByteArrayOutputStream',
+    // CLI stdio — CLI apps, not web response bodies.
+    'PrintStream',
+    'System',
+    // HTTP client builders — these are taint SOURCES (outbound reads),
+    // not XSS sinks. `response.body()`, `.post()`, `.get()` on
+    // hutool `HttpRequest` / `HttpResponse` reach us as sink
+    // matches only because xss.yaml catches String-valued receivers.
+    'HttpRequest',
+    'HttpRequestBuilder',
+    'HttpResponse',
+    // Servlet non-body IO. `HttpSession.setAttribute`, `HttpSession.putValue`,
+    // `HttpServletRequest.setAttribute` are session/request attribute
+    // IO, not HTML output. Under `library/*` there is no JSP renderer
+    // reflecting them back. `HttpServletResponse` itself is NOT on
+    // this list — its writers are genuine XSS sinks.
+    'HttpSession',
+    'ServletRequest',
+    'HttpServletRequest',
+    // Wire-protocol writers (jedis internal).
+    'RedisOutputStream',
+    'SafeEncoder',
+    'RESP2',
+    'Protocol',
+    // JSON parsers — these read JSON into POJOs. Source, not sink.
+    'JSONUtil',
+    'JSON',
+    'ObjectMapper',
+    'JsonReader',
+    // Loggers — log injection is CWE-117 (already covered by #112);
+    // these appear here because xss.yaml has a String-valued catch-all
+    // that hits Logger receivers.
+    'Logger',
+    'LoggerFactory',
+    'Log',
+    'Slf4jLogger',
+    // Router / interceptor context stores. Zuul `RequestContext`,
+    // Sentinel `Context` are internal request-processing state, not
+    // HTML output.
+    'RequestContext',
+    'Context',
+]);
+/**
+ * Returns true when the resolved profile begins with `library/`
+ * (i.e. any `library/production`, `library/dev`, `library/sample`,
+ * `library/benchmark`, `library/test` environment binding).
+ * `'unknown'` and non-library shapes return false.
+ */
+function isLibraryShape(profile) {
+    if (!profile || profile === 'unknown')
+        return false;
+    return profile.startsWith('library/');
+}
+export class LibraryProfileXssGatePass {
+    name = 'library-profile-xss-gate';
+    category = 'security';
+    run(ctx) {
+        const { graph } = ctx;
+        const profile = graph.ir.meta.projectProfile;
+        if (!isLibraryShape(profile)) {
+            return {
+                profile,
+                applied: false,
+                dropped: 0,
+                droppedByClass: {},
+            };
+        }
+        // Authoritative sink list mirrors the fetch pattern in
+        // `LibraryProfileSinkGatePass` and `SinkSemanticsPass`: prefer
+        // `SinkFilterResult.sinks` (what `analyzer.ts` assembles the
+        // final `taint.sinks` from), fall back to `graph.ir.taint.sinks`
+        // for stand-alone unit tests that don't run `SinkFilterPass`.
+        const sinks = ctx.hasResult('sink-filter')
+            ? ctx.getResult('sink-filter').sinks
+            : graph.ir.taint.sinks;
+        if (sinks.length === 0) {
+            return {
+                profile,
+                applied: true,
+                dropped: 0,
+                droppedByClass: {},
+            };
+        }
+        const droppedByClass = {};
+        const kept = [];
+        for (const sink of sinks) {
+            if (sink.type === 'xss' && sink.class && XSS_NON_HTML_OUTPUT_CLASSES.has(sink.class)) {
+                droppedByClass[sink.class] = (droppedByClass[sink.class] ?? 0) + 1;
+                continue;
+            }
+            kept.push(sink);
+        }
+        const dropped = sinks.length - kept.length;
+        // Mutate the array in place so downstream passes see the
+        // filtered list. Preserves array identity for any consumer that
+        // captured a reference before this pass ran.
+        if (dropped > 0) {
+            sinks.length = 0;
+            sinks.push(...kept);
+        }
+        return {
+            profile,
+            applied: true,
+            dropped,
+            droppedByClass,
+        };
+    }
+}
+//# sourceMappingURL=library-profile-xss-gate-pass.js.map

package/dist/analysis/passes/library-profile-xss-gate-pass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"library-profile-xss-gate-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/library-profile-xss-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuEG;AAMH;;;;;;;;;GASG;AACH,MAAM,2BAA2B,GAAwB,IAAI,GAAG,CAAS;IACvE,8CAA8C;IAC9C,eAAe;IACf,cAAc;IACd,iBAAiB;IACjB,uBAAuB;IACvB,iDAAiD;IACjD,aAAa;IACb,QAAQ;IACR,mEAAmE;IACnE,2DAA2D;IAC3D,yDAAyD;IACzD,iEAAiE;IACjE,aAAa;IACb,oBAAoB;IACpB,cAAc;IACd,2EAA2E;IAC3E,kEAAkE;IAClE,kEAAkE;IAClE,+DAA+D;IAC/D,iDAAiD;IACjD,aAAa;IACb,gBAAgB;IAChB,oBAAoB;IACpB,0CAA0C;IAC1C,mBAAmB;IACnB,aAAa;IACb,OAAO;IACP,UAAU;IACV,+DAA+D;IAC/D,UAAU;IACV,MAAM;IACN,cAAc;IACd,YAAY;IACZ,gEAAgE;IAChE,mEAAmE;IACnE,8BAA8B;IAC9B,QAAQ;IACR,eAAe;IACf,KAAK;IACL,aAAa;IACb,8DAA8D;IAC9D,gEAAgE;IAChE,eAAe;IACf,gBAAgB;IAChB,SAAS;CACV,CAAC,CAAC;AA2BH;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAmC;IACzD,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,OAAO,yBAAyB;IAG3B,IAAI,GAAG,0BAA0B,CAAC;IAClC,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;QACtB,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC;QAE7C,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,CAAC;gBACV,cAAc,EAAE,EAAE;aACnB,CAAC;QACJ,CAAC;QAED,uDAAuD;QACvD,+DAA+D;QAC/D,6DAA6D;QAC7D,iEAAiE;QACjE,8DAA8D;QAC9D,MAAM,KAAK,GAAgB,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC;YACrD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC,KAAK;YACtD,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAEzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC;gBACV,cAAc,EAAE,EAAE;aACnB,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAA2B,EAAE,CAAC;QAClD,MAAM,IAAI,GAAgB,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrF,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBACnE,SAAS;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE3C,yDAAyD;QACzD,gEAAgE;QAChE,6CAA6C;QAC7C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,OAAO;YACL,OAAO;YACP,OAAO,EAAE,IAAI;YACb,OAAO;YACP,cAAc;SACf,CAAC;IACJ,CAAC;CACF"}

package/dist/analyzer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAA2B,eAAe,EAAe,cAAc,EAAgE,MAAM,kBAAkB,CAAC;AACxM,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAcL,KAAK,iBAAiB,EACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAKL,eAAe,EAChB,MAAM,qBAAqB,CAAC;AA+C7B,OAAO,EAAwB,KAAK,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAKlH,OAAO,EAA2B,KAAK,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AAe1H,OAAO,EAAwB,KAAK,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACjH,OAAO,EAAuB,KAAK,sBAAsB,EAA6B,MAAM,4CAA4C,CAAC;AAyCzI,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC;IAEhC;;OAEG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC;IAE3D;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAEzE;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAE1B;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAE1B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;;;;;;;;OAkBG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,CAAC,EAAE,cAAc,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CAC/D;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C,iDAAiD;IACjD,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;IACjD,6CAA6C;IAC7C,eAAe,CAAC,EAAE,sBAAsB,CAAC;CAC1C;AAID;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAc/E;AAiMD;;GAEG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,QAAQ,CAAC,CAySnB;AAwHD;;GAEG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAwG3B;AAkID;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,IAAI,CAEpC;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,iBAAiB,CAAA;CAAE,CAAC,EAC7E,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,eAAe,CAAC,CAkG1B;AAsBD,OAAO,EAAE,eAAe,EAAE,CAAC"}
+{"version":3,"file":"analyzer.d.ts","sourceRoot":"","sources":["../src/analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAA2B,eAAe,EAAe,cAAc,EAAgE,MAAM,kBAAkB,CAAC;AACxM,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAcL,KAAK,iBAAiB,EACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAKL,eAAe,EAChB,MAAM,qBAAqB,CAAC;AAgD7B,OAAO,EAAwB,KAAK,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAKlH,OAAO,EAA2B,KAAK,0BAA0B,EAAE,MAAM,gDAAgD,CAAC;AAe1H,OAAO,EAAwB,KAAK,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACjH,OAAO,EAAuB,KAAK,sBAAsB,EAA6B,MAAM,4CAA4C,CAAC;AAyCzI,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,UAAU,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC;IAEhC;;OAEG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC;IAE3D;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAEzE;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAE1B;;OAEG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAE1B;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B;;;;;;;;;;;;;;OAcG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;;;;;;;;OAkBG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAE/B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,CAAC,EAAE,cAAc,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CAC/D;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C,iDAAiD;IACjD,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;IACjD,6CAA6C;IAC7C,eAAe,CAAC,EAAE,sBAAsB,CAAC;CAC1C;AAID;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAc/E;AAiMD;;GAEG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,QAAQ,CAAC,CAgUnB;AAwHD;;GAEG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAwG3B;AAkID;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,IAAI,CAEpC;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,iBAAiB,CAAA;CAAE,CAAC,EAC7E,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,eAAe,CAAC,CAkG1B;AAsBD,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/analyzer.js

@@ -79,7 +79,8 @@ import { LibraryProfileSourceGatePass } from './analysis/passes/library-profile-
 import { SinkFilterPass, filterCleanVariableSinks, filterSanitizedSinks } from './analysis/passes/sink-filter-pass.js';
 import { SinkSemanticsPass } from './analysis/passes/sink-semantics-pass.js';
 import { CliMainReflectionSuppressPass } from './analysis/passes/cli-main-reflection-suppress-pass.js';
-import { LibraryProfileSinkGatePass } from './analysis/passes/library-profile-sink-gate-pass.js';
+import { LibraryProfileSinkGatePass, LibraryProfileCwe22PathGatePass } from './analysis/passes/library-profile-sink-gate-pass.js';
+import { LibraryProfileXssGatePass } from './analysis/passes/library-profile-xss-gate-pass.js';
 import { TaintPropagationPass } from './analysis/passes/taint-propagation-pass.js';
 import { InterproceduralPass } from './analysis/passes/interprocedural-pass.js';
 import { DeadCodePass } from './analysis/passes/dead-code-pass.js';
@@ -459,10 +460,33 @@ export async function analyze(code, filePath, language, options = {}) {
         // No-op when profile is absent, `'unknown'`, or non-library shape.
         if (!disabledPasses.has('library-profile-sink-gate'))
             pipeline.add(new LibraryProfileSinkGatePass());
+        // cognium-dev #244: under `library/*` project profile, drop `xss`
+        // (CWE-79) sinks whose simple-name receiver class is on a curated
+        // non-HTML-output denylist (`StringBuilder`, `PrintStream`,
+        // `HttpSession`, `HttpRequest`, jedis wire-writers, JSON parsers,
+        // Loggers, Zuul `RequestContext`, Sentinel `Context`). Runs after
+        // #112 so the sink list is already free of `log_injection` sinks;
+        // runs before `TaintPropagationPass` so flow generators never see
+        // the dropped sinks. Empirically drops 507 H+C FPs across the 10-repo
+        // Tier 2 cohort (cognium-ai#189 §3, 2026-07).
+        if (!disabledPasses.has('library-profile-xss-gate'))
+            pipeline.add(new LibraryProfileXssGatePass());
         pipeline.add(new TaintPropagationPass());
         pipeline.add(new InterproceduralPass({
             enableEntryPointGate: options.enableEntryPointGate ?? true,
         }));
+        // cognium-dev #245 RC1 (belt-and-suspenders): under `library/*`
+        // profile, drop CWE-22 (`path_traversal`) flows whose source shape
+        // is `interprocedural_param` / `constructor_field` — the same
+        // speculative shapes `LibraryProfileSourceGatePass` (#236) already
+        // drops from `graph.ir.taint.sources`. Belt-and-suspenders because
+        // 170/246 CWE-22 H+C findings on the Tier 2 10-repo cohort
+        // (cognium-ai#189 §4) carried an `interprocedural_param` source
+        // with empty `source.code`. Runs post-`InterproceduralPass` so it
+        // filters the authoritative `taint.flows` list. No-op when profile
+        // is absent, `'unknown'`, or non-library shape.
+        if (!disabledPasses.has('library-profile-cwe22-path-gate'))
+            pipeline.add(new LibraryProfileCwe22PathGatePass());
         // Secret scanner runs after LanguageSourcesPass so the legacy Bash
         // `hardcoded-credential` findings are already in the dedup buffer.
         if (!disabledPasses.has('scan-secrets'))