circle-ir 3.155.0 → 3.157.0

package/dist/analysis/passes/mybatis-annotation-sql-sink-pass.d.ts

@@ -0,0 +1,49 @@
+/**
+ * MyBatisAnnotationSqlSinkPass — cognium-dev #241 Java
+ *
+ * Detects SQL injection sinks on MyBatis annotation-driven Mapper interface
+ * methods. MyBatis distinguishes two placeholder syntaxes in `@Select` /
+ * `@Update` / `@Insert` / `@Delete` (and their `*Provider` variants):
+ *
+ *   - `#{name}` — JDBC PreparedStatement parameter binding. SAFE.
+ *   - `${name}` — raw string interpolation into the SQL string. **SQLi.**
+ *
+ * The taint-matcher's YAML sink registry (`configs/sinks/sql.yaml`) covers
+ * standard Mapper method names (insert/update/select-wildcard/delete) via a
+ * generic `mybatis_mapper_call` discovery marker, but cannot inspect the
+ * contents of an annotation string. Custom method names (`findByName`,
+ * `getUserById`) with `${}` interpolation therefore fall through both the
+ * name-based Mapper matcher and any downstream SQLi flow generator.
+ *
+ * This pass closes that gap. For every Java interface whose method carries
+ * a MyBatis SQL annotation containing at least one `${varname}`, the pass
+ * records the tainted parameter positions (correlated to `@Param("name")`
+ * annotations or MyBatis positional convention `${param1}` / `${0}`), then
+ * walks `graph.calls` for call sites targeting those Mapper methods and
+ * emits a synthetic `sql_injection` (CWE-89) `TaintSink` at each match.
+ *
+ * The synthetic sinks are pushed onto the `TaintMatcherResult.sinks` list
+ * so `SinkFilterPass` (which merges taint-matcher + language-sources) and
+ * downstream flow generators pick them up without any registry changes.
+ *
+ * Pipeline slot: runs after `LanguageSourcesPass` and before
+ * `SinkFilterPass` so the synthetic sinks are visible to the four-stage
+ * FP-elimination filter and to `TaintPropagationPass` / `InterproceduralPass`.
+ *
+ * Language scope: Java only. Non-Java files short-circuit at run().
+ *
+ * Kill switch: opt out via `disabledPasses: ['mybatis-annotation-sql-sink']`.
+ */
+import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
+export interface MyBatisAnnotationSqlSinkResult {
+    /** Number of annotated Mapper methods with `${}` interpolation found. */
+    annotatedMethodCount: number;
+    /** Number of synthetic `sql_injection` sinks added. */
+    addedSinkCount: number;
+}
+export declare class MyBatisAnnotationSqlSinkPass implements AnalysisPass<MyBatisAnnotationSqlSinkResult> {
+    readonly name = "mybatis-annotation-sql-sink";
+    readonly category: "security";
+    run(ctx: PassContext): MyBatisAnnotationSqlSinkResult;
+}
+//# sourceMappingURL=mybatis-annotation-sql-sink-pass.d.ts.map

package/dist/analysis/passes/mybatis-annotation-sql-sink-pass.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mybatis-annotation-sql-sink-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/mybatis-annotation-sql-sink-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAQH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E,MAAM,WAAW,8BAA8B;IAC7C,yEAAyE;IACzE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,cAAc,EAAE,MAAM,CAAC;CACxB;AAqND,qBAAa,4BACX,YAAW,YAAY,CAAC,8BAA8B,CAAC;IAEvD,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,8BAA8B;CA0HtD"}

package/dist/analysis/passes/mybatis-annotation-sql-sink-pass.js

@@ -0,0 +1,329 @@
+/**
+ * MyBatisAnnotationSqlSinkPass — cognium-dev #241 Java
+ *
+ * Detects SQL injection sinks on MyBatis annotation-driven Mapper interface
+ * methods. MyBatis distinguishes two placeholder syntaxes in `@Select` /
+ * `@Update` / `@Insert` / `@Delete` (and their `*Provider` variants):
+ *
+ *   - `#{name}` — JDBC PreparedStatement parameter binding. SAFE.
+ *   - `${name}` — raw string interpolation into the SQL string. **SQLi.**
+ *
+ * The taint-matcher's YAML sink registry (`configs/sinks/sql.yaml`) covers
+ * standard Mapper method names (insert/update/select-wildcard/delete) via a
+ * generic `mybatis_mapper_call` discovery marker, but cannot inspect the
+ * contents of an annotation string. Custom method names (`findByName`,
+ * `getUserById`) with `${}` interpolation therefore fall through both the
+ * name-based Mapper matcher and any downstream SQLi flow generator.
+ *
+ * This pass closes that gap. For every Java interface whose method carries
+ * a MyBatis SQL annotation containing at least one `${varname}`, the pass
+ * records the tainted parameter positions (correlated to `@Param("name")`
+ * annotations or MyBatis positional convention `${param1}` / `${0}`), then
+ * walks `graph.calls` for call sites targeting those Mapper methods and
+ * emits a synthetic `sql_injection` (CWE-89) `TaintSink` at each match.
+ *
+ * The synthetic sinks are pushed onto the `TaintMatcherResult.sinks` list
+ * so `SinkFilterPass` (which merges taint-matcher + language-sources) and
+ * downstream flow generators pick them up without any registry changes.
+ *
+ * Pipeline slot: runs after `LanguageSourcesPass` and before
+ * `SinkFilterPass` so the synthetic sinks are visible to the four-stage
+ * FP-elimination filter and to `TaintPropagationPass` / `InterproceduralPass`.
+ *
+ * Language scope: Java only. Non-Java files short-circuit at run().
+ *
+ * Kill switch: opt out via `disabledPasses: ['mybatis-annotation-sql-sink']`.
+ */
+/**
+ * MyBatis SQL annotations. The `*Provider` variants take a
+ * `type = X.class, method = "y"` pair whose provider method returns the
+ * SQL string; we still scan the annotation-attached literal (if any) for
+ * `${}` markers as a best-effort recall bump.
+ */
+const MYBATIS_SQL_ANNOTATIONS = new Set([
+    'Select',
+    'Update',
+    'Insert',
+    'Delete',
+    'SelectProvider',
+    'UpdateProvider',
+    'InsertProvider',
+    'DeleteProvider',
+]);
+/**
+ * Regex to extract `${varname}` interpolation markers from an annotation
+ * string. Deliberately does NOT match `#{name}` (safe binding).
+ * Variable names follow the MyBatis convention (identifier + optional
+ * dotted property access, e.g. `${user.id}`) — we only use the leading
+ * identifier when correlating to `@Param`.
+ */
+const DOLLAR_BRACE_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)(?:\.[A-Za-z0-9_.]+)?\}/g;
+/**
+ * MyBatis positional convention: `${param1}` refers to the first argument
+ * (1-based). `${0}` — some MyBatis versions — refers to the first argument
+ * (0-based). We map both forms to a 0-based index.
+ */
+function parsePositionalRef(name) {
+    const paramMatch = /^param(\d+)$/.exec(name);
+    if (paramMatch) {
+        const oneBased = Number.parseInt(paramMatch[1], 10);
+        if (Number.isFinite(oneBased) && oneBased >= 1)
+            return oneBased - 1;
+    }
+    const zeroMatch = /^(\d+)$/.exec(name);
+    if (zeroMatch) {
+        const zeroBased = Number.parseInt(zeroMatch[1], 10);
+        if (Number.isFinite(zeroBased) && zeroBased >= 0)
+            return zeroBased;
+    }
+    return null;
+}
+/**
+ * Extract the raw annotation-argument string from a stored annotation.
+ * Annotations are stored as e.g. `Select("SELECT ... ${x} ...")` (without
+ * the leading `@`). We return the substring between the outermost
+ * parentheses, or `null` for a marker annotation with no arguments.
+ */
+function extractAnnotationBody(annotation) {
+    const openIdx = annotation.indexOf('(');
+    if (openIdx < 0)
+        return null;
+    const closeIdx = annotation.lastIndexOf(')');
+    if (closeIdx <= openIdx)
+        return null;
+    return annotation.substring(openIdx + 1, closeIdx);
+}
+/**
+ * Given a stored annotation `Foo(...)`, return the leading identifier
+ * `Foo`. For marker annotations without parens, returns the whole string.
+ */
+function annotationName(annotation) {
+    const openIdx = annotation.indexOf('(');
+    return openIdx < 0 ? annotation : annotation.substring(0, openIdx);
+}
+/**
+ * Return the value of the first string argument to a `@Param("name")`
+ * annotation, or `null` if the annotation is not `@Param` or has no
+ * literal string argument.
+ */
+function extractParamName(annotation) {
+    if (annotationName(annotation) !== 'Param')
+        return null;
+    const body = extractAnnotationBody(annotation);
+    if (body === null)
+        return null;
+    // Match "..." or '...' at the start of the body. MyBatis @Param only
+    // takes a single string literal, so a simple match is sufficient.
+    const strMatch = /^\s*["']([^"']*)["']/.exec(body);
+    return strMatch ? strMatch[1] : null;
+}
+/**
+ * Extract every `${varname}` reference from a MyBatis annotation body
+ * (typically a single quoted string literal, sometimes concatenated).
+ * Returns the deduplicated ordered list of leading identifiers.
+ */
+function extractDollarBraceRefs(annotationBody) {
+    const seen = new Set();
+    const out = [];
+    DOLLAR_BRACE_RE.lastIndex = 0;
+    let m;
+    while ((m = DOLLAR_BRACE_RE.exec(annotationBody)) !== null) {
+        const name = m[1];
+        if (!seen.has(name)) {
+            seen.add(name);
+            out.push(name);
+        }
+    }
+    return out;
+}
+/**
+ * Check if the file imports MyBatis annotations, either directly or via
+ * wildcard. Used to distinguish MyBatis `@Select` from unrelated libraries
+ * (e.g. Reactor's `@Select`, custom application `@Select`) that happen to
+ * share the simple annotation name.
+ */
+function fileImportsMyBatis(imports) {
+    for (const imp of imports) {
+        const pkg = imp.from_package;
+        if (!pkg)
+            continue;
+        if (pkg === 'org.apache.ibatis.annotations' ||
+            pkg.startsWith('org.apache.ibatis.annotations.') ||
+            pkg === 'org.apache.ibatis' ||
+            pkg.startsWith('org.apache.ibatis.')) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Correlate every `${name}` reference to a 0-based parameter index. When
+ * the method carries `@Param("name")` on any parameter, that mapping wins.
+ * Otherwise MyBatis positional convention is used (`${param1}`, `${0}`).
+ * Returns the deduplicated ascending list of tainted arg positions.
+ */
+function correlateDollarBraceToArgPositions(method, refs) {
+    const paramNameToIndex = new Map();
+    method.parameters.forEach((param, idx) => {
+        for (const ann of param.annotations) {
+            const paramName = extractParamName(ann);
+            if (paramName !== null) {
+                paramNameToIndex.set(paramName, idx);
+            }
+        }
+    });
+    const positions = new Set();
+    for (const ref of refs) {
+        const namedIdx = paramNameToIndex.get(ref);
+        if (namedIdx !== undefined) {
+            positions.add(namedIdx);
+            continue;
+        }
+        const positionalIdx = parsePositionalRef(ref);
+        if (positionalIdx !== null &&
+            positionalIdx < method.parameters.length) {
+            positions.add(positionalIdx);
+        }
+    }
+    return Array.from(positions).sort((a, b) => a - b);
+}
+/**
+ * Return the fully-qualified name of a Mapper interface method for use as
+ * a callee lookup key. Falls back to `<simpleName>.<methodName>` when the
+ * interface has no declared package.
+ */
+function mapperMethodKey(type, method) {
+    const iface = type.package ? `${type.package}.${type.name}` : type.name;
+    return `${iface}.${method.name}`;
+}
+/**
+ * Match a call site against a Mapper interface method by callee tail. We
+ * accept:
+ *   - `resolution.target` equal to or ending with the mapper key
+ *   - simple `method_name` equal to the mapper's method AND
+ *     `receiver_type` or `receiver_type_fqn` equal to the mapper's
+ *     interface (simple- or fully-qualified name).
+ *
+ * Conservative on both sides — unresolved receivers fall through.
+ */
+function isMapperMethodCall(call, interfaceSimpleName, interfaceFqn, methodName) {
+    // Path 1 — resolution target tail match.
+    const target = call.resolution?.target;
+    if (target) {
+        const suffix = `${interfaceSimpleName}.${methodName}`;
+        const suffixFqn = `${interfaceFqn}.${methodName}`;
+        if (target === suffix ||
+            target === suffixFqn ||
+            target.endsWith('.' + suffix) ||
+            target.endsWith('.' + suffixFqn)) {
+            return true;
+        }
+    }
+    // Path 2 — method name + receiver type match.
+    if (call.method_name !== methodName)
+        return false;
+    if (call.receiver_type === interfaceSimpleName)
+        return true;
+    if (call.receiver_type_fqn === interfaceFqn)
+        return true;
+    return false;
+}
+export class MyBatisAnnotationSqlSinkPass {
+    name = 'mybatis-annotation-sql-sink';
+    category = 'security';
+    run(ctx) {
+        if (ctx.language !== 'java') {
+            return { annotatedMethodCount: 0, addedSinkCount: 0 };
+        }
+        const { types, imports, calls } = ctx.graph.ir;
+        // Gate on file-level MyBatis import to distinguish real Mapper
+        // interfaces from unrelated libraries reusing the `@Select` name.
+        if (!fileImportsMyBatis(imports)) {
+            return { annotatedMethodCount: 0, addedSinkCount: 0 };
+        }
+        const mapperMethods = [];
+        for (const type of types) {
+            if (type.kind !== 'interface')
+                continue;
+            for (const method of type.methods) {
+                // Find MyBatis SQL annotation, extract body, scan for `${}`.
+                let matchedRefs = [];
+                for (const ann of method.annotations) {
+                    if (!MYBATIS_SQL_ANNOTATIONS.has(annotationName(ann)))
+                        continue;
+                    const body = extractAnnotationBody(ann);
+                    if (body === null)
+                        continue;
+                    const refs = extractDollarBraceRefs(body);
+                    if (refs.length > 0) {
+                        matchedRefs = [...matchedRefs, ...refs];
+                    }
+                }
+                if (matchedRefs.length === 0)
+                    continue;
+                const positions = correlateDollarBraceToArgPositions(method, matchedRefs);
+                if (positions.length === 0)
+                    continue;
+                const interfaceFqn = type.package
+                    ? `${type.package}.${type.name}`
+                    : type.name;
+                mapperMethods.push({
+                    interfaceSimpleName: type.name,
+                    interfaceFqn,
+                    methodName: method.name,
+                    taintedArgPositions: positions,
+                });
+            }
+        }
+        if (mapperMethods.length === 0) {
+            return {
+                annotatedMethodCount: 0,
+                addedSinkCount: 0,
+            };
+        }
+        // Grab the taint-matcher sinks array to append into. When the pass is
+        // run stand-alone (unit-test harness) without TaintMatcherPass, we
+        // fall back to graph.ir.taint.sinks so tests can still observe the
+        // added sinks.
+        const sinks = ctx.hasResult('taint-matcher')
+            ? ctx.getResult('taint-matcher').sinks
+            : ctx.graph.ir.taint.sinks;
+        let addedSinkCount = 0;
+        for (const call of calls) {
+            for (const rec of mapperMethods) {
+                if (!isMapperMethodCall(call, rec.interfaceSimpleName, rec.interfaceFqn, rec.methodName)) {
+                    continue;
+                }
+                // Dedup: skip if a `sql_injection` sink already exists at this
+                // call site.
+                const line = call.location.line;
+                if (sinks.some((s) => s.line === line &&
+                    s.type === 'sql_injection' &&
+                    s.method === rec.methodName)) {
+                    continue;
+                }
+                const receiverLoc = call.receiver
+                    ? `${call.receiver}.${rec.methodName}()`
+                    : `${rec.methodName}()`;
+                sinks.push({
+                    type: 'sql_injection',
+                    cwe: 'CWE-89',
+                    location: call.in_method
+                        ? `${receiverLoc} in ${call.in_method}`
+                        : receiverLoc,
+                    line,
+                    confidence: 0.95,
+                    method: rec.methodName,
+                    argPositions: rec.taintedArgPositions,
+                    class: rec.interfaceSimpleName,
+                });
+                addedSinkCount++;
+            }
+        }
+        return {
+            annotatedMethodCount: mapperMethods.length,
+            addedSinkCount,
+        };
+    }
+}
+//# sourceMappingURL=mybatis-annotation-sql-sink-pass.js.map

package/dist/analysis/passes/mybatis-annotation-sql-sink-pass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mybatis-annotation-sql-sink-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/mybatis-annotation-sql-sink-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAkBH;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;CACjB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,sDAAsD,CAAC;AAE/E;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC;YAAE,OAAO,QAAQ,GAAG,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,UAAkB;IAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,QAAQ,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,UAAU,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,UAAkB;IACxC,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,IAAI,cAAc,CAAC,UAAU,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,IAAI,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,qEAAqE;IACrE,kEAAkE;IAClE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,cAAsB;IACpD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,eAAe,CAAC,SAAS,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACf,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,OAAmD;IAC7E,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC;QAC7B,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,IACE,GAAG,KAAK,+BAA+B;YACvC,GAAG,CAAC,UAAU,CAAC,gCAAgC,CAAC;YAChD,GAAG,KAAK,mBAAmB;YAC3B,GAAG,CAAC,UAAU,CAAC,oBAAoB,CAAC,EACpC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,kCAAkC,CACzC,MAAkB,EAClB,IAAuB;IAEvB,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnD,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACvC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACpC,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACvB,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QACD,MAAM,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC9C,IACE,aAAa,KAAK,IAAI;YACtB,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,EACxC,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAc,EAAE,MAAkB;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACxE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CACzB,IAAc,EACd,mBAA2B,EAC3B,YAAoB,EACpB,UAAkB;IAElB,yCAAyC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC;IACvC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,GAAG,mBAAmB,IAAI,UAAU,EAAE,CAAC;QACtD,MAAM,SAAS,GAAG,GAAG,YAAY,IAAI,UAAU,EAAE,CAAC;QAClD,IACE,MAAM,KAAK,MAAM;YACjB,MAAM,KAAK,SAAS;YACpB,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC;YAC7B,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,SAAS,CAAC,EAChC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,IAAI,CAAC,aAAa,KAAK,mBAAmB;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,IAAI,CAAC,iBAAiB,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,4BAA4B;IAG9B,IAAI,GAAG,6BAA6B,CAAC;IACrC,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,EAAE,oBAAoB,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;QACxD,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAE/C,+DAA+D;QAC/D,kEAAkE;QAClE,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,oBAAoB,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;QACxD,CAAC;QAUD,MAAM,aAAa,GAAyB,EAAE,CAAC;QAE/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;gBAAE,SAAS;YACxC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClC,6DAA6D;gBAC7D,IAAI,WAAW,GAAa,EAAE,CAAC;gBAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACrC,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;wBAAE,SAAS;oBAChE,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;oBACxC,IAAI,IAAI,KAAK,IAAI;wBAAE,SAAS;oBAC5B,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;oBAC1C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACpB,WAAW,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,IAAI,CAAC,CAAC;oBAC1C,CAAC;gBACH,CAAC;gBACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAEvC,MAAM,SAAS,GAAG,kCAAkC,CAClD,MAAM,EACN,WAAW,CACZ,CAAC;gBACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAErC,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO;oBAC/B,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE;oBAChC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;gBACd,aAAa,CAAC,IAAI,CAAC;oBACjB,mBAAmB,EAAE,IAAI,CAAC,IAAI;oBAC9B,YAAY;oBACZ,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,mBAAmB,EAAE,SAAS;iBAC/B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,oBAAoB,EAAE,CAAC;gBACvB,cAAc,EAAE,CAAC;aAClB,CAAC;QACJ,CAAC;QAED,sEAAsE;QACtE,mEAAmE;QACnE,mEAAmE;QACnE,eAAe;QACf,MAAM,KAAK,GAAgB,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC;YACvD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAqB,eAAe,CAAC,CAAC,KAAK;YAC1D,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAE7B,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;gBAChC,IACE,CAAC,kBAAkB,CACjB,IAAI,EACJ,GAAG,CAAC,mBAAmB,EACvB,GAAG,CAAC,YAAY,EAChB,GAAG,CAAC,UAAU,CACf,EACD,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,+DAA+D;gBAC/D,aAAa;gBACb,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAChC,IACE,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,IAAI,KAAK,IAAI;oBACf,CAAC,CAAC,IAAI,KAAK,eAAe;oBAC1B,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,UAAU,CAC9B,EACD,CAAC;oBACD,SAAS;gBACX,CAAC;gBACD,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ;oBAC/B,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,UAAU,IAAI;oBACxC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,eAAe;oBACrB,GAAG,EAAE,QAAQ;oBACb,QAAQ,EAAE,IAAI,CAAC,SAAS;wBACtB,CAAC,CAAC,GAAG,WAAW,OAAO,IAAI,CAAC,SAAS,EAAE;wBACvC,CAAC,CAAC,WAAW;oBACf,IAAI;oBACJ,UAAU,EAAE,IAAI;oBAChB,MAAM,EAAE,GAAG,CAAC,UAAU;oBACtB,YAAY,EAAE,GAAG,CAAC,mBAAmB;oBACrC,KAAK,EAAE,GAAG,CAAC,mBAAmB;iBAC/B,CAAC,CAAC;gBACH,cAAc,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QAED,OAAO;YACL,oBAAoB,EAAE,aAAa,CAAC,MAAM;YAC1C,cAAc;SACf,CAAC;IACJ,CAAC;CACF"}

package/dist/analysis/passes/taint-propagation-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"taint-propagation-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/taint-propagation-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAQ9E,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAED,qBAAa,oBAAqB,YAAW,YAAY,CAAC,0BAA0B,CAAC;IACnF,QAAQ,CAAC,IAAI,uBAAuB;IACpC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,0BAA0B;CA2TlD"}
+{"version":3,"file":"taint-propagation-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/taint-propagation-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAS9E,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAED,qBAAa,oBAAqB,YAAW,YAAY,CAAC,0BAA0B,CAAC;IACnF,QAAQ,CAAC,IAAI,uBAAuB;IACpC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,0BAA0B;CAkWlD"}

package/dist/analysis/passes/taint-propagation-pass.js

@@ -14,6 +14,7 @@ import { propagateTaint } from '../taint-propagation.js';
 import { isFalsePositive, isCorrelatedPredicateFP } from '../constant-propagation.js';
 import { buildJavaTaintedVars, buildPythonTaintedVars, buildRustTaintedVars } from './language-sources-pass.js';
 import { canSourceReachSink, sourceSemanticsAllowed } from '../findings.js';
+import { walkBackwardDefs } from '../dfg-walk.js';
 export class TaintPropagationPass {
     name = 'taint-propagation';
     category = 'security';
@@ -211,11 +212,50 @@ export class TaintPropagationPass {
                     return true;
                 }
                 const sansAtSink = sanitizersByLine.get(f.sink_line);
-                if (!sansAtSink || sansAtSink.length === 0)
+                if (sansAtSink && sansAtSink.length > 0) {
+                    for (const san of sansAtSink) {
+                        if (san.sanitizes.includes(f.sink_type)) {
+                            return false;
+                        }
+                    }
+                }
+                // cognium-dev #239 C4 residual — DFG-walk sanitizer credit for
+                // configured sinks. Supplementary flow generators
+                // (detectExpressionScanFlows, detectCollectionFlows,
+                // detectParameterSinkFlows) emit sanitizer-blind flows. The
+                // sink-line fast path above misses the common `n = parseInt(x);
+                // sink(n);` shape where the sanitizer lives on the assignment
+                // line, not the sink line. Walk the reaching-def chain of the
+                // sink's tainted use and credit sanitizers on any def line in
+                // the chain. Variable-precise — mirrors site #2 walkback logic
+                // in taint-propagation.ts checkSanitized. Doesn't over-suppress
+                // bare `shlex.quote(host)` on unrelated non-sink lines because
+                // those calls don't create a def in the sink var's chain.
+                const usesAtSink = graph.usesByLine.get(f.sink_line);
+                if (!usesAtSink || usesAtSink.length === 0)
+                    return true;
+                const sinkVar = f.path.length > 0
+                    ? f.path[f.path.length - 1].variable
+                    : undefined;
+                if (!sinkVar)
                     return true;
-                for (const san of sansAtSink) {
-                    if (san.sanitizes.includes(f.sink_type)) {
-                        return false;
+                for (const use of usesAtSink) {
+                    if (use.variable !== sinkVar)
+                        continue;
+                    if (use.def_id === null || use.def_id === undefined)
+                        continue;
+                    const walk = walkBackwardDefs(use.def_id, graph.chainsByToDef, graph.defById, { maxHops: 32 });
+                    for (const line of walk.lines) {
+                        if (line === f.sink_line)
+                            continue; // already checked above
+                        const sansAtLine = sanitizersByLine.get(line);
+                        if (!sansAtLine || sansAtLine.length === 0)
+                            continue;
+                        for (const san of sansAtLine) {
+                            if (san.sanitizes.includes(f.sink_type)) {
+                                return false;
+                            }
+                        }
                     }
                 }
                 return true;