circle-ir 3.153.0 → 3.155.0

package/dist/browser/circle-ir.js

@@ -11304,9 +11304,16 @@ var DEFAULT_SINKS = [
   { method: "newBufferedWriter", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "copy", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1] },
   { method: "move", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1] },
-  { method: "exists", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
-  { method: "isDirectory", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
-  { method: "isRegularFile", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
+  // NOTE: `Files.exists`, `Files.isDirectory`, `Files.isRegularFile`
+  // were removed in 3.154.0 (#245 RC2). These NIO methods are pure
+  // boolean queries — they read a filesystem attribute and cannot
+  // cause traversal escape. A CWE-22 sink must consume the path to
+  // open, read, write, delete, list, or link a filesystem entry;
+  // check-only receivers reveal at most a boolean. Empirically
+  // ~12 H+C FPs across the 10-repo Tier 2 cohort
+  // (cognium-ai#189 §4). `java.io.File` instance methods
+  // (`file.isDirectory()`, `file.exists()`, `file.canRead()`, …)
+  // are already not registered as CWE-22 sinks.
   // RandomAccessFile
   { method: "RandomAccessFile", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   // Framework-specific resource loading (Cocoon, Spring, etc.)
@@ -12895,6 +12902,9 @@ var DEFAULT_SANITIZERS = [
   { method: "parseDouble", class: "Double", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "parseShort", class: "Short", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "parseByte", class: "Byte", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
+  // cognium-dev #238 A.3 — parseBoolean and expanded coercion coverage for XSS/CRLF/log/xpath/ldap/xxe.
+  // A parsed boolean/numeric cannot carry a string-injection payload for any string-based sink.
+  { method: "parseBoolean", class: "Boolean", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection", "xss", "crlf", "log_injection", "xpath_injection", "ldap_injection", "xxe"] },
   // Java UUID parse — UUID.fromString rejects non-UUID strings
   { method: "fromString", class: "UUID", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   // JavaScript numeric coercion (Number/parseInt/parseFloat already covered above; add path_traversal/code_injection)
@@ -15026,6 +15036,23 @@ var CodeGraph = class {
     }
     return this._chainsByFromDef;
   }
+  /**
+   * Mirror of chainsByFromDef keyed by chain.to_def. Enables backward
+   * walks from a use's reaching def to earlier defs in the chain
+   * (cognium-dev #238 — DFG-walk sanitizer credit).
+   */
+  _chainsByToDef = null;
+  get chainsByToDef() {
+    if (!this._chainsByToDef) {
+      this._chainsByToDef = /* @__PURE__ */ new Map();
+      for (const chain of this.ir.dfg.chains ?? []) {
+        const arr = this._chainsByToDef.get(chain.to_def) ?? [];
+        arr.push(chain);
+        this._chainsByToDef.set(chain.to_def, arr);
+      }
+    }
+    return this._chainsByToDef;
+  }
   // ---------------------------------------------------------------------------
   // Call indexes
   // ---------------------------------------------------------------------------
@@ -15950,6 +15977,43 @@ var AnalysisPipeline = class {
   }
 };
 
+// src/analysis/dfg-walk.ts
+function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
+  const maxHops = options.maxHops ?? 32;
+  const visited = /* @__PURE__ */ new Set();
+  const lines = /* @__PURE__ */ new Set();
+  let hopCapReached = false;
+  const startDef = defById.get(startDefId);
+  if (!startDef) {
+    return { visited, lines, hopCapReached: false };
+  }
+  visited.add(startDefId);
+  lines.add(startDef.line);
+  const queue = [startDefId];
+  let hops = 0;
+  while (queue.length > 0) {
+    if (hops >= maxHops) {
+      hopCapReached = true;
+      break;
+    }
+    hops++;
+    const currentId = queue.shift();
+    const incoming = chainsByToDef.get(currentId);
+    if (!incoming) continue;
+    for (const chain of incoming) {
+      const fromId = chain.from_def;
+      if (visited.has(fromId)) continue;
+      visited.add(fromId);
+      const fromDef = defById.get(fromId);
+      if (fromDef) {
+        lines.add(fromDef.line);
+      }
+      queue.push(fromId);
+    }
+  }
+  return { visited, lines, hopCapReached };
+}
+
 // src/analysis/taint-propagation.ts
 function buildSanitizersByLine(sanitizers) {
   const out2 = /* @__PURE__ */ new Map();
@@ -16037,7 +16101,12 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
                     taintInfo.line,
                     sink.line,
                     sink.type,
-                    sanitizersByLine
+                    sanitizersByLine,
+                    {
+                      startDefId: use.def_id,
+                      chainsByToDef: graph.chainsByToDef,
+                      defById
+                    }
                   );
                   if (!isSanitized.sanitized) {
                     const source = sources.find((s) => s.line === taintInfo.sourceLine);
@@ -16175,20 +16244,39 @@ var KNOWN_SINK_TYPES = /* @__PURE__ */ new Set([
   "crlf",
   "mass_assignment"
 ]);
-function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine) {
-  const sanitizersAtTarget = sanitizersByLine.get(toLine);
-  if (!sanitizersAtTarget || sanitizersAtTarget.length === 0) {
-    return { sanitized: false };
-  }
+function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine, ctx) {
   const isKnownSinkType = KNOWN_SINK_TYPES.has(sinkType);
-  for (const san of sanitizersAtTarget) {
-    if (isKnownSinkType) {
-      if (san.sanitizes.includes(sinkType)) {
+  const sanitizersAtTarget = sanitizersByLine.get(toLine);
+  if (sanitizersAtTarget && sanitizersAtTarget.length > 0) {
+    for (const san of sanitizersAtTarget) {
+      if (isKnownSinkType) {
+        if (san.sanitizes.includes(sinkType)) {
+          return { sanitized: true, sanitizer: san };
+        }
+      } else if (san.sanitizes.length > 0) {
         return { sanitized: true, sanitizer: san };
       }
-    } else {
-      if (san.sanitizes.length > 0) {
-        return { sanitized: true, sanitizer: san };
+    }
+  }
+  if (ctx) {
+    const walk = walkBackwardDefs(
+      ctx.startDefId,
+      ctx.chainsByToDef,
+      ctx.defById,
+      { maxHops: ctx.maxHops ?? 32 }
+    );
+    for (const line of walk.lines) {
+      if (line === toLine) continue;
+      const sansAtLine = sanitizersByLine.get(line);
+      if (!sansAtLine || sansAtLine.length === 0) continue;
+      for (const san of sansAtLine) {
+        if (isKnownSinkType) {
+          if (san.sanitizes.includes(sinkType)) {
+            return { sanitized: true, sanitizer: san };
+          }
+        } else if (san.sanitizes.length > 0) {
+          return { sanitized: true, sanitizer: san };
+        }
       }
     }
   }
@@ -24988,6 +25076,20 @@ function findJavaScriptDOMSinks(sourceCode, language) {
         else if (line.includes(".href")) method = "href";
         else if (line.includes(".cssText")) method = "cssText";
         else if (line.includes("style.textContent")) method = "textContent";
+        if (method === "document.write" || method === "document.writeln") {
+          const argMatch = line.match(/document\.write(?:ln)?\s*\(\s*([^)]*)\)/);
+          if (argMatch) {
+            const arg = argMatch[1].trim();
+            if (!arg.includes("+")) {
+              const doubleQ = /^"(?:[^"\\]|\\.)*"$/;
+              const singleQ = /^'(?:[^'\\]|\\.)*'$/;
+              const backtick = /^`(?:[^`\\$]|\\.|\$(?!\{))*`$/;
+              if (doubleQ.test(arg) || singleQ.test(arg) || backtick.test(arg)) {
+                break;
+              }
+            }
+          }
+        }
         const alreadyExists = sinks.some((s) => s.line === lineNumber && s.cwe === cwe);
         if (!alreadyExists) {
           sinks.push({ type, cwe, severity, line: lineNumber, location: line.trim().substring(0, 80), method });
@@ -31298,6 +31400,153 @@ var LibraryProfileSinkGatePass = class {
     };
   }
 };
+var CWE22_SPECULATIVE_SOURCE_TYPES = /* @__PURE__ */ new Set([
+  "interprocedural_param",
+  "constructor_field"
+]);
+var LibraryProfileCwe22PathGatePass = class {
+  name = "library-profile-cwe22-path-gate";
+  category = "security";
+  run(ctx) {
+    const { graph } = ctx;
+    const profile = graph.ir.meta.projectProfile;
+    if (!isLibraryShape2(profile)) {
+      return {
+        profile,
+        applied: false,
+        dropped: 0,
+        droppedBySourceType: {}
+      };
+    }
+    const flows = graph.ir.taint.flows;
+    if (!flows || flows.length === 0) {
+      return {
+        profile,
+        applied: true,
+        dropped: 0,
+        droppedBySourceType: {}
+      };
+    }
+    const droppedBySourceType = {};
+    const kept = [];
+    for (const flow of flows) {
+      if (flow.sink_type === "path_traversal" && CWE22_SPECULATIVE_SOURCE_TYPES.has(flow.source_type)) {
+        droppedBySourceType[flow.source_type] = (droppedBySourceType[flow.source_type] ?? 0) + 1;
+        continue;
+      }
+      kept.push(flow);
+    }
+    const dropped = flows.length - kept.length;
+    if (dropped > 0) {
+      flows.length = 0;
+      flows.push(...kept);
+    }
+    return {
+      profile,
+      applied: true,
+      dropped,
+      droppedBySourceType
+    };
+  }
+};
+
+// src/analysis/passes/library-profile-xss-gate-pass.ts
+var XSS_NON_HTML_OUTPUT_CLASSES = /* @__PURE__ */ new Set([
+  // In-memory buffers — no HTML output surface.
+  "StringBuilder",
+  "StringBuffer",
+  "CharArrayWriter",
+  "ByteArrayOutputStream",
+  // CLI stdio — CLI apps, not web response bodies.
+  "PrintStream",
+  "System",
+  // HTTP client builders — these are taint SOURCES (outbound reads),
+  // not XSS sinks. `response.body()`, `.post()`, `.get()` on
+  // hutool `HttpRequest` / `HttpResponse` reach us as sink
+  // matches only because xss.yaml catches String-valued receivers.
+  "HttpRequest",
+  "HttpRequestBuilder",
+  "HttpResponse",
+  // Servlet non-body IO. `HttpSession.setAttribute`, `HttpSession.putValue`,
+  // `HttpServletRequest.setAttribute` are session/request attribute
+  // IO, not HTML output. Under `library/*` there is no JSP renderer
+  // reflecting them back. `HttpServletResponse` itself is NOT on
+  // this list — its writers are genuine XSS sinks.
+  "HttpSession",
+  "ServletRequest",
+  "HttpServletRequest",
+  // Wire-protocol writers (jedis internal).
+  "RedisOutputStream",
+  "SafeEncoder",
+  "RESP2",
+  "Protocol",
+  // JSON parsers — these read JSON into POJOs. Source, not sink.
+  "JSONUtil",
+  "JSON",
+  "ObjectMapper",
+  "JsonReader",
+  // Loggers — log injection is CWE-117 (already covered by #112);
+  // these appear here because xss.yaml has a String-valued catch-all
+  // that hits Logger receivers.
+  "Logger",
+  "LoggerFactory",
+  "Log",
+  "Slf4jLogger",
+  // Router / interceptor context stores. Zuul `RequestContext`,
+  // Sentinel `Context` are internal request-processing state, not
+  // HTML output.
+  "RequestContext",
+  "Context"
+]);
+function isLibraryShape3(profile) {
+  if (!profile || profile === "unknown") return false;
+  return profile.startsWith("library/");
+}
+var LibraryProfileXssGatePass = class {
+  name = "library-profile-xss-gate";
+  category = "security";
+  run(ctx) {
+    const { graph } = ctx;
+    const profile = graph.ir.meta.projectProfile;
+    if (!isLibraryShape3(profile)) {
+      return {
+        profile,
+        applied: false,
+        dropped: 0,
+        droppedByClass: {}
+      };
+    }
+    const sinks = ctx.hasResult("sink-filter") ? ctx.getResult("sink-filter").sinks : graph.ir.taint.sinks;
+    if (sinks.length === 0) {
+      return {
+        profile,
+        applied: true,
+        dropped: 0,
+        droppedByClass: {}
+      };
+    }
+    const droppedByClass = {};
+    const kept = [];
+    for (const sink of sinks) {
+      if (sink.type === "xss" && sink.class && XSS_NON_HTML_OUTPUT_CLASSES.has(sink.class)) {
+        droppedByClass[sink.class] = (droppedByClass[sink.class] ?? 0) + 1;
+        continue;
+      }
+      kept.push(sink);
+    }
+    const dropped = sinks.length - kept.length;
+    if (dropped > 0) {
+      sinks.length = 0;
+      sinks.push(...kept);
+    }
+    return {
+      profile,
+      applied: true,
+      dropped,
+      droppedByClass
+    };
+  }
+};
 
 // src/analysis/passes/taint-propagation-pass.ts
 var TaintPropagationPass = class {
@@ -37107,6 +37356,34 @@ var WeakHashPass = class {
   }
 };
 
+// src/analysis/path-classification.ts
+var TEST_PATH_PATTERNS = [
+  // Directory-based conventions
+  /(^|\/)test\//i,
+  /(^|\/)tests\//i,
+  /(^|\/)testing\//i,
+  /(^|\/)__tests__\//i,
+  /(^|\/)spec\//i,
+  // Go test file suffix
+  /_test\.go$/i,
+  // Python pytest naming
+  /(^|\/)test_[^/]+\.py$/i,
+  /_test\.py$/i,
+  // JS/TS unit / spec naming
+  /\.test\.(?:tsx?|jsx?|mjs|cjs)$/i,
+  /\.spec\.(?:tsx?|jsx?|mjs|cjs)$/i,
+  // JVM alt naming
+  /\.test\.(?:java|kt)$/i
+];
+function isTestPath(filepath) {
+  if (!filepath) return false;
+  const normalized = filepath.replace(/\\/g, "/");
+  for (const pattern of TEST_PATH_PATTERNS) {
+    if (pattern.test(normalized)) return true;
+  }
+  return false;
+}
+
 // src/analysis/passes/weak-crypto-pass.ts
 var WEAK_CIPHER_BASES = /* @__PURE__ */ new Set([
   "des",
@@ -37295,6 +37572,9 @@ var WeakCryptoPass = class {
     if (isProtocolMandatedCryptoFile(file, code)) {
       return { findings: [] };
     }
+    if (isTestPath(file)) {
+      return { findings: [] };
+    }
     const findings = [];
     const constProp = ctx.hasResult("constant-propagation") ? ctx.getResult("constant-propagation") : null;
     const literalBindings = scanLiteralBindings(code, language);
@@ -40765,10 +41045,14 @@ async function analyze(code, filePath, language, options = {}) {
       pipeline.add(new CliMainReflectionSuppressPass());
     if (!disabledPasses.has("library-profile-sink-gate"))
       pipeline.add(new LibraryProfileSinkGatePass());
+    if (!disabledPasses.has("library-profile-xss-gate"))
+      pipeline.add(new LibraryProfileXssGatePass());
     pipeline.add(new TaintPropagationPass());
     pipeline.add(new InterproceduralPass({
       enableEntryPointGate: options.enableEntryPointGate ?? true
     }));
+    if (!disabledPasses.has("library-profile-cwe22-path-gate"))
+      pipeline.add(new LibraryProfileCwe22PathGatePass());
     if (!disabledPasses.has("scan-secrets")) pipeline.add(new ScanSecretsPass());
     if (!disabledPasses.has("dead-code")) pipeline.add(new DeadCodePass());
     if (!disabledPasses.has("missing-await")) pipeline.add(new MissingAwaitPass());

package/dist/core/circle-ir-core.cjs

@@ -10699,9 +10699,16 @@ var DEFAULT_SINKS = [
   { method: "newBufferedWriter", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "copy", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1] },
   { method: "move", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0, 1] },
-  { method: "exists", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
-  { method: "isDirectory", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
-  { method: "isRegularFile", class: "Files", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
+  // NOTE: `Files.exists`, `Files.isDirectory`, `Files.isRegularFile`
+  // were removed in 3.154.0 (#245 RC2). These NIO methods are pure
+  // boolean queries — they read a filesystem attribute and cannot
+  // cause traversal escape. A CWE-22 sink must consume the path to
+  // open, read, write, delete, list, or link a filesystem entry;
+  // check-only receivers reveal at most a boolean. Empirically
+  // ~12 H+C FPs across the 10-repo Tier 2 cohort
+  // (cognium-ai#189 §4). `java.io.File` instance methods
+  // (`file.isDirectory()`, `file.exists()`, `file.canRead()`, …)
+  // are already not registered as CWE-22 sinks.
   // RandomAccessFile
   { method: "RandomAccessFile", class: "constructor", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   // Framework-specific resource loading (Cocoon, Spring, etc.)
@@ -12290,6 +12297,9 @@ var DEFAULT_SANITIZERS = [
   { method: "parseDouble", class: "Double", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "parseShort", class: "Short", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   { method: "parseByte", class: "Byte", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
+  // cognium-dev #238 A.3 — parseBoolean and expanded coercion coverage for XSS/CRLF/log/xpath/ldap/xxe.
+  // A parsed boolean/numeric cannot carry a string-injection payload for any string-based sink.
+  { method: "parseBoolean", class: "Boolean", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection", "xss", "crlf", "log_injection", "xpath_injection", "ldap_injection", "xxe"] },
   // Java UUID parse — UUID.fromString rejects non-UUID strings
   { method: "fromString", class: "UUID", removes: ["sql_injection", "command_injection", "path_traversal", "code_injection"] },
   // JavaScript numeric coercion (Number/parseInt/parseFloat already covered above; add path_traversal/code_injection)
@@ -14039,6 +14049,23 @@ var CodeGraph = class {
     }
     return this._chainsByFromDef;
   }
+  /**
+   * Mirror of chainsByFromDef keyed by chain.to_def. Enables backward
+   * walks from a use's reaching def to earlier defs in the chain
+   * (cognium-dev #238 — DFG-walk sanitizer credit).
+   */
+  _chainsByToDef = null;
+  get chainsByToDef() {
+    if (!this._chainsByToDef) {
+      this._chainsByToDef = /* @__PURE__ */ new Map();
+      for (const chain of this.ir.dfg.chains ?? []) {
+        const arr = this._chainsByToDef.get(chain.to_def) ?? [];
+        arr.push(chain);
+        this._chainsByToDef.set(chain.to_def, arr);
+      }
+    }
+    return this._chainsByToDef;
+  }
   // ---------------------------------------------------------------------------
   // Call indexes
   // ---------------------------------------------------------------------------
@@ -14209,6 +14236,43 @@ var CodeGraph = class {
   }
 };
 
+// src/analysis/dfg-walk.ts
+function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
+  const maxHops = options.maxHops ?? 32;
+  const visited = /* @__PURE__ */ new Set();
+  const lines = /* @__PURE__ */ new Set();
+  let hopCapReached = false;
+  const startDef = defById.get(startDefId);
+  if (!startDef) {
+    return { visited, lines, hopCapReached: false };
+  }
+  visited.add(startDefId);
+  lines.add(startDef.line);
+  const queue = [startDefId];
+  let hops = 0;
+  while (queue.length > 0) {
+    if (hops >= maxHops) {
+      hopCapReached = true;
+      break;
+    }
+    hops++;
+    const currentId = queue.shift();
+    const incoming = chainsByToDef.get(currentId);
+    if (!incoming) continue;
+    for (const chain of incoming) {
+      const fromId = chain.from_def;
+      if (visited.has(fromId)) continue;
+      visited.add(fromId);
+      const fromDef = defById.get(fromId);
+      if (fromDef) {
+        lines.add(fromDef.line);
+      }
+      queue.push(fromId);
+    }
+  }
+  return { visited, lines, hopCapReached };
+}
+
 // src/analysis/taint-propagation.ts
 function buildSanitizersByLine(sanitizers) {
   const out2 = /* @__PURE__ */ new Map();
@@ -14296,7 +14360,12 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
                     taintInfo.line,
                     sink.line,
                     sink.type,
-                    sanitizersByLine
+                    sanitizersByLine,
+                    {
+                      startDefId: use.def_id,
+                      chainsByToDef: graph.chainsByToDef,
+                      defById
+                    }
                   );
                   if (!isSanitized.sanitized) {
                     const source = sources.find((s) => s.line === taintInfo.sourceLine);
@@ -14434,20 +14503,39 @@ var KNOWN_SINK_TYPES = /* @__PURE__ */ new Set([
   "crlf",
   "mass_assignment"
 ]);
-function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine) {
-  const sanitizersAtTarget = sanitizersByLine.get(toLine);
-  if (!sanitizersAtTarget || sanitizersAtTarget.length === 0) {
-    return { sanitized: false };
-  }
+function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine, ctx) {
   const isKnownSinkType = KNOWN_SINK_TYPES.has(sinkType);
-  for (const san of sanitizersAtTarget) {
-    if (isKnownSinkType) {
-      if (san.sanitizes.includes(sinkType)) {
+  const sanitizersAtTarget = sanitizersByLine.get(toLine);
+  if (sanitizersAtTarget && sanitizersAtTarget.length > 0) {
+    for (const san of sanitizersAtTarget) {
+      if (isKnownSinkType) {
+        if (san.sanitizes.includes(sinkType)) {
+          return { sanitized: true, sanitizer: san };
+        }
+      } else if (san.sanitizes.length > 0) {
         return { sanitized: true, sanitizer: san };
       }
-    } else {
-      if (san.sanitizes.length > 0) {
-        return { sanitized: true, sanitizer: san };
+    }
+  }
+  if (ctx) {
+    const walk = walkBackwardDefs(
+      ctx.startDefId,
+      ctx.chainsByToDef,
+      ctx.defById,
+      { maxHops: ctx.maxHops ?? 32 }
+    );
+    for (const line of walk.lines) {
+      if (line === toLine) continue;
+      const sansAtLine = sanitizersByLine.get(line);
+      if (!sansAtLine || sansAtLine.length === 0) continue;
+      for (const san of sansAtLine) {
+        if (isKnownSinkType) {
+          if (san.sanitizes.includes(sinkType)) {
+            return { sanitized: true, sanitizer: san };
+          }
+        } else if (san.sanitizes.length > 0) {
+          return { sanitized: true, sanitizer: san };
+        }
       }
     }
   }