circle-ir 3.160.0 → 3.162.0

package/dist/analysis/taint-propagation.js

@@ -301,7 +301,7 @@ const KNOWN_SINK_TYPES = new Set([
  *     later flows to a SQL sink) but eliminates false positives for correctly
  *     sanitized code.
  */
-function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine, ctx) {
+function checkSanitized(fromLine, toLine, sinkType, sanitizersByLine, ctx) {
     const isKnownSinkType = KNOWN_SINK_TYPES.has(sinkType);
     // Per-line fast path — preserves 3.154.0 semantics for site #1 (propagation
     // hop check) and site #3 (interprocedural fallback), and remains the primary
@@ -322,11 +322,24 @@ function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine, ctx) {
     // cognium-dev #238 — widen the search to the transitive reaching-def chain
     // of the tainted use. Only fires when the caller opts in via `ctx` (site #2
     // sink-reachability check). Cycle-safe + bounded via walkBackwardDefs.
+    //
+    // cognium-dev #249 3.162.0 — bound sanitizer credit to lines >= fromLine.
+    // When a re-taint source (e.g. `URLDecoder.decode` on a previously-encoded
+    // value) sits between an upstream sanitizer and the sink, the backward
+    // reaching-def walk crosses through the re-taint source. Sanitizers on
+    // lines strictly before the current taint's origin cannot cover the
+    // freshly re-introduced taint (SecuriBench Micro `sanitizers/Sanitizers5.java`
+    // encode-then-decode bypass). The upper hop cap already bounds the walk;
+    // this lower bound closes the semantic gap without affecting the classical
+    // `safe = escape(x); sink(safe)` credit path (that sanitizer is at
+    // `fromLine == taintInfo.line`, which the `>=` check preserves).
     if (ctx) {
         const walk = walkBackwardDefs(ctx.startDefId, ctx.chainsByToDef, ctx.defById, { maxHops: ctx.maxHops ?? 32 });
         for (const line of walk.lines) {
             if (line === toLine)
                 continue; // already checked above
+            if (line < fromLine)
+                continue; // upstream of the current taint's origin
             const sansAtLine = sanitizersByLine.get(line);
             if (!sansAtLine || sansAtLine.length === 0)
                 continue;

package/dist/analysis/taint-propagation.js.map

@@ -1 +1 @@
-{"version":3,"file":"taint-propagation.js","sourceRoot":"","sources":["../../src/analysis/taint-propagation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AA8DjD;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,UAA4B;IACzD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA4B,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;YAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,UAA2B,EAC3B,cAA0C,EAC1C,cAA2C,EAC3C,iBAAiD,EACjD,aAAgC;IAEhC,IAAI,KAAgB,CAAC;IACrB,IAAI,OAAsB,CAAC;IAC3B,IAAI,KAAkB,CAAC;IACvB,IAAI,UAA4B,CAAC;IAEjC,IAAI,UAAU,YAAY,SAAS,EAAE,CAAC;QACpC,qDAAqD;QACrD,KAAK,GAAG,UAAU,CAAC;QACnB,OAAO,GAAG,cAA+B,CAAC;QAC1C,KAAK,GAAG,cAA6B,CAAC;QACtC,UAAU,GAAG,iBAAqC,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,6DAA6D;QAC7D,MAAM,GAAG,GAAG,UAAiB,CAAC;QAC9B,MAAM,KAAK,GAAG,cAA4B,CAAC;QAC3C,OAAO,GAAG,cAA+B,CAAC;QAC1C,KAAK,GAAG,iBAAgC,CAAC;QACzC,UAAU,GAAG,aAAa,IAAI,EAAE,CAAC;QACjC,KAAK,GAAG,IAAI,SAAS,CAAC;YACpB,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;YACxE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG;YACrD,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE;YAC7C,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE;SACvD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,cAAc,GAAG,IAAI,GAAG,EAA4B,CAAC;IAE3D,yEAAyE;IACzE,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,4EAA4E;IAC5E,6EAA6E;IAC7E,uEAAuE;IACvE,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,gBAAgB,GAAkC,UAAU,CAAC,MAAM,GAAG,CAAC;QAC3E,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC;QACnC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAE9B,8DAA8D;IAC9D,MAAM,eAAe,GAAG,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAE3E,6EAA6E;IAC7E,uEAAuE;IACvE,6EAA6E;IAC7E,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QAC/C,IAAI,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QACzF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAC7B,CAAC,CAAC,CAAC;IACH,WAAW,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IAElC,iDAAiD;IACjD,MAAM,eAAe,GAAG,sBAAsB,CAC5C,YAAY,EACZ,KAAK,CAAC,eAAe,EACrB,OAAO,EACP,gBAAgB,CACjB,CAAC;IACF,WAAW,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;IAErC,kCAAkC;IAClC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,MAAM,YAAY,GAAG,IAAI,GAAG,EAA2B,CAAC;IACxD,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAC/B,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,iEAAiE;IACjE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAErD,oDAAoD;QACpD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACjC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;oBACjB,yEAAyE;oBACzE,uEAAuE;oBACvE,oEAAoE;oBACpE,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACtD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;4BAC9C,SAAS;wBACX,CAAC;oBACH,CAAC;oBACD,uCAAuC;oBACvC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;wBAC7B,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;4BACzD,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gCACrC,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gCAC/C,IAAI,SAAS,EAAE,CAAC;oCACd,sBAAsB;oCACtB,EAAE;oCACF,iDAAiD;oCACjD,yDAAyD;oCACzD,qDAAqD;oCACrD,6DAA6D;oCAC7D,qCAAqC;oCACrC,MAAM,WAAW,GAAG,cAAc,CAChC,SAAS,CAAC,IAAI,EACd,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,IAAI,EACT,gBAAgB,EAChB;wCACE,UAAU,EAAE,GAAG,CAAC,MAAM;wCACtB,aAAa,EAAE,KAAK,CAAC,aAAa;wCAClC,OAAO;qCACR,CACF,CAAC;oCAEF,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;wCAC3B,kBAAkB;wCAClB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,UAAU,CAAC,CAAC;wCAClE,IAAI,MAAM,EAAE,CAAC;4CACX,kBAAkB;4CAClB,MAAM,IAAI,GAAG,cAAc,CACzB,MAAM,EACN,IAAI,EACJ,SAAS,CACV,CAAC;4CACF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;4CAEjB,wBAAwB;4CACxB,MAAM,eAAe,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;4CACvD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gDACvD,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;4CAC/B,CAAC;4CACD,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;wCAC5C,CAAC;oCACH,CAAC;gCACH,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CACvB,OAAsB,EACtB,WAAoC,EACpC,UAAiC;IAEjC,MAAM,OAAO,GAAsB,EAAE,CAAC;IAEtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,kDAAkD;QAClD,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAErD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,KAAK,EAAE,GAAG,CAAC,EAAE;gBACb,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CAAC;QACL,CAAC;QAED,oFAAoF;QACpF,EAAE;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,mEAAmE;QACnE,iEAAiE;QACjE,yEAAyE;QACzE,qEAAqE;QACrE,sEAAsE;QACtE,mEAAmE;QACnE,0DAA0D;QAC1D,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,oDAAoD;YACpD,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7D,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjC,IAAI,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;oBAAE,SAAS;gBAClE,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,KAAK,EAAE,GAAG,CAAC,EAAE;oBACb,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,UAAU,EAAE,MAAM,CAAC,UAAU,GAAG,GAAG,EAAE,4BAA4B;iBAClE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,6EAA6E;QAC7E,8EAA8E;QAC9E,6EAA6E;QAC7E,4BAA4B;QAC5B,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAC7D,OAAO,CAAC,IAAI,CAAC;wBACX,QAAQ,EAAE,GAAG,CAAC,QAAQ;wBACtB,KAAK,EAAE,GAAG,CAAC,EAAE;wBACb,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,UAAU,EAAE,MAAM,CAAC,IAAI;wBACvB,UAAU,EAAE,MAAM,CAAC,IAAI;wBACvB,UAAU,EAAE,MAAM,CAAC,UAAU;qBAC9B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAC7B,YAA+B,EAC/B,eAAwC,EACxC,OAA4B,EAC5B,gBAA+C;IAE/C,MAAM,UAAU,GAAsB,EAAE,CAAC;IACzC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE5D,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,yBAAyB;IACzB,MAAM,KAAK,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,KAAK,CAAC,CAAC;IAEvC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QACpC,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,YAAY;YAAE,SAAS;QAE5B,MAAM,cAAc,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAE/D,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;gBAAE,SAAS;YAExC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,2DAA2D;YAC3D,MAAM,aAAa,GAAG,cAAc,CAClC,YAAY,CAAC,UAAU,EACvB,SAAS,CAAC,IAAI,EACd,YAAY,CAAC,UAAU,EACvB,gBAAgB,CACjB,CAAC;YAEF,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;gBAC7B,MAAM,QAAQ,GAAoB;oBAChC,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,KAAK,EAAE,SAAS,CAAC,EAAE;oBACnB,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,UAAU,EAAE,YAAY,CAAC,UAAU;oBACnC,UAAU,EAAE,YAAY,CAAC,UAAU;oBACnC,UAAU,EAAE,YAAY,CAAC,UAAU,GAAG,IAAI,EAAE,4BAA4B;iBACzE,CAAC;gBAEF,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC1B,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAChC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;gBAC7C,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,wEAAwE;AACxE,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAS;IACvC,eAAe,EAAE,KAAK,EAAE,gBAAgB,EAAE,mBAAmB;IAC7D,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe;IAC5D,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,qBAAqB;IACjE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,iBAAiB;CACpD,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,cAAc,CACrB,SAAiB,EACjB,MAAc,EACd,QAAgB,EAChB,gBAA+C,EAC/C,GAAuB;IAEvB,MAAM,eAAe,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEvD,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,kBAAkB,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACrC,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAoB,CAAC,EAAE,CAAC;oBACjD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;gBAC7C,CAAC;YACH,CAAC;iBAAM,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,uEAAuE;IACvE,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,IAAI,GAAG,gBAAgB,CAC3B,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,aAAa,EACjB,GAAG,CAAC,OAAO,EACX,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAC/B,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,IAAI,KAAK,MAAM;gBAAE,SAAS,CAAC,wBAAwB;YACvD,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACrD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,IAAI,eAAe,EAAE,CAAC;oBACpB,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAoB,CAAC,EAAE,CAAC;wBACjD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;oBAC7C,CAAC;gBACH,CAAC;qBAAM,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;gBAC7C,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CACrB,MAAmB,EACnB,IAAe,EACf,SAA0B;IAE1B,MAAM,IAAI,GAAoB,EAAE,CAAC;IAEjC,oBAAoB;IACpB,IAAI,CAAC,IAAI,CAAC;QACR,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,2BAA2B,MAAM,CAAC,IAAI,EAAE;KACtD,CAAC,CAAC;IAEH,oDAAoD;IACpD,oDAAoD;IACpD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,6BAA6B,SAAS,CAAC,QAAQ,EAAE;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB;IAChB,IAAI,CAAC,IAAI,CAAC;QACR,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,yBAAyB,IAAI,CAAC,IAAI,OAAO;KACvD,CAAC,CAAC;IAEH,OAAO;QACL,MAAM;QACN,IAAI;QACJ,IAAI;QACJ,SAAS,EAAE,KAAK;QAChB,UAAU,EAAE,SAAS,CAAC,UAAU,GAAG,GAAG,EAAE,wBAAwB;KACjE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAQ,EACR,KAAiB,EACjB,WAA8B;IAE9B,MAAM,eAAe,GAAsB,EAAE,CAAC;IAC9C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAE7D,oDAAoD;IACpD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAE7D,8DAA8D;IAC9D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,8DAA8D;QAC9D,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC;QAEnE,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzD,gDAAgD;gBAChD,wDAAwD;gBACxD,mEAAmE;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAe;IACrD,IAAI,UAAU,GAAG,GAAG,CAAC;IAErB,8BAA8B;IAC9B,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;IAErC,wDAAwD;IACxD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;IACpC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,yBAAyB;IAEvE,yBAAyB;IACzB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,UAAU,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,MAA8B;IAM1D,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAElD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;QAC9E,CAAC,CAAC,CAAC,CAAC;IAEN,OAAO;QACL,gBAAgB,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM;QAC3C,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;QAC/B,eAAe;QACf,aAAa;KACd,CAAC;AACJ,CAAC"}
+{"version":3,"file":"taint-propagation.js","sourceRoot":"","sources":["../../src/analysis/taint-propagation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AA8DjD;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,UAA4B;IACzD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA4B,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;;YAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,UAA2B,EAC3B,cAA0C,EAC1C,cAA2C,EAC3C,iBAAiD,EACjD,aAAgC;IAEhC,IAAI,KAAgB,CAAC;IACrB,IAAI,OAAsB,CAAC;IAC3B,IAAI,KAAkB,CAAC;IACvB,IAAI,UAA4B,CAAC;IAEjC,IAAI,UAAU,YAAY,SAAS,EAAE,CAAC;QACpC,qDAAqD;QACrD,KAAK,GAAG,UAAU,CAAC;QACnB,OAAO,GAAG,cAA+B,CAAC;QAC1C,KAAK,GAAG,cAA6B,CAAC;QACtC,UAAU,GAAG,iBAAqC,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,6DAA6D;QAC7D,MAAM,GAAG,GAAG,UAAiB,CAAC;QAC9B,MAAM,KAAK,GAAG,cAA4B,CAAC;QAC3C,OAAO,GAAG,cAA+B,CAAC;QAC1C,KAAK,GAAG,iBAAgC,CAAC;QACzC,UAAU,GAAG,aAAa,IAAI,EAAE,CAAC;QACjC,KAAK,GAAG,IAAI,SAAS,CAAC;YACpB,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;YACxE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG;YACrD,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE;YAC7C,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE;SACvD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,cAAc,GAAG,IAAI,GAAG,EAA4B,CAAC;IAE3D,yEAAyE;IACzE,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,4EAA4E;IAC5E,6EAA6E;IAC7E,uEAAuE;IACvE,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,gBAAgB,GAAkC,UAAU,CAAC,MAAM,GAAG,CAAC;QAC3E,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC;QACnC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAE9B,8DAA8D;IAC9D,MAAM,eAAe,GAAG,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAE3E,6EAA6E;IAC7E,uEAAuE;IACvE,6EAA6E;IAC7E,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QAC/C,IAAI,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QACzF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAC7B,CAAC,CAAC,CAAC;IACH,WAAW,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IAElC,iDAAiD;IACjD,MAAM,eAAe,GAAG,sBAAsB,CAC5C,YAAY,EACZ,KAAK,CAAC,eAAe,EACrB,OAAO,EACP,gBAAgB,CACjB,CAAC;IACF,WAAW,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,CAAC;IAErC,kCAAkC;IAClC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,MAAM,YAAY,GAAG,IAAI,GAAG,EAA2B,CAAC;IACxD,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAC/B,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,iEAAiE;IACjE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAErD,oDAAoD;QACpD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACjC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;oBACjB,yEAAyE;oBACzE,uEAAuE;oBACvE,oEAAoE;oBACpE,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACtD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;4BAC9C,SAAS;wBACX,CAAC;oBACH,CAAC;oBACD,uCAAuC;oBACvC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;wBAC7B,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;4BACzD,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gCACrC,MAAM,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gCAC/C,IAAI,SAAS,EAAE,CAAC;oCACd,sBAAsB;oCACtB,EAAE;oCACF,iDAAiD;oCACjD,yDAAyD;oCACzD,qDAAqD;oCACrD,6DAA6D;oCAC7D,qCAAqC;oCACrC,MAAM,WAAW,GAAG,cAAc,CAChC,SAAS,CAAC,IAAI,EACd,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,IAAI,EACT,gBAAgB,EAChB;wCACE,UAAU,EAAE,GAAG,CAAC,MAAM;wCACtB,aAAa,EAAE,KAAK,CAAC,aAAa;wCAClC,OAAO;qCACR,CACF,CAAC;oCAEF,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;wCAC3B,kBAAkB;wCAClB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,UAAU,CAAC,CAAC;wCAClE,IAAI,MAAM,EAAE,CAAC;4CACX,kBAAkB;4CAClB,MAAM,IAAI,GAAG,cAAc,CACzB,MAAM,EACN,IAAI,EACJ,SAAS,CACV,CAAC;4CACF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;4CAEjB,wBAAwB;4CACxB,MAAM,eAAe,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;4CACvD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gDACvD,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;4CAC/B,CAAC;4CACD,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;wCAC5C,CAAC;oCACH,CAAC;gCACH,CAAC;4BACH,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CACvB,OAAsB,EACtB,WAAoC,EACpC,UAAiC;IAEjC,MAAM,OAAO,GAAsB,EAAE,CAAC;IAEtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,kDAAkD;QAClD,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAErD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC;gBACX,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,KAAK,EAAE,GAAG,CAAC,EAAE;gBACb,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CAAC;QACL,CAAC;QAED,oFAAoF;QACpF,EAAE;QACF,0EAA0E;QAC1E,yEAAyE;QACzE,mEAAmE;QACnE,iEAAiE;QACjE,yEAAyE;QACzE,qEAAqE;QACrE,sEAAsE;QACtE,mEAAmE;QACnE,0DAA0D;QAC1D,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,oDAAoD;YACpD,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7D,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjC,IAAI,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;oBAAE,SAAS;gBAClE,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,KAAK,EAAE,GAAG,CAAC,EAAE;oBACb,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,UAAU,EAAE,MAAM,CAAC,UAAU,GAAG,GAAG,EAAE,4BAA4B;iBAClE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,2EAA2E;QAC3E,6EAA6E;QAC7E,8EAA8E;QAC9E,6EAA6E;QAC7E,4BAA4B;QAC5B,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;oBAC7D,OAAO,CAAC,IAAI,CAAC;wBACX,QAAQ,EAAE,GAAG,CAAC,QAAQ;wBACtB,KAAK,EAAE,GAAG,CAAC,EAAE;wBACb,IAAI,EAAE,GAAG,CAAC,IAAI;wBACd,UAAU,EAAE,MAAM,CAAC,IAAI;wBACvB,UAAU,EAAE,MAAM,CAAC,IAAI;wBACvB,UAAU,EAAE,MAAM,CAAC,UAAU;qBAC9B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAC7B,YAA+B,EAC/B,eAAwC,EACxC,OAA4B,EAC5B,gBAA+C;IAE/C,MAAM,UAAU,GAAsB,EAAE,CAAC;IACzC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE5D,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,yBAAyB;IACzB,MAAM,KAAK,GAAG,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,KAAK,CAAC,CAAC;IAEvC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QACpC,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,YAAY;YAAE,SAAS;QAE5B,MAAM,cAAc,GAAG,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAE/D,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;gBAAE,SAAS;YAExC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,2DAA2D;YAC3D,MAAM,aAAa,GAAG,cAAc,CAClC,YAAY,CAAC,UAAU,EACvB,SAAS,CAAC,IAAI,EACd,YAAY,CAAC,UAAU,EACvB,gBAAgB,CACjB,CAAC;YAEF,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;gBAC7B,MAAM,QAAQ,GAAoB;oBAChC,QAAQ,EAAE,SAAS,CAAC,QAAQ;oBAC5B,KAAK,EAAE,SAAS,CAAC,EAAE;oBACnB,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,UAAU,EAAE,YAAY,CAAC,UAAU;oBACnC,UAAU,EAAE,YAAY,CAAC,UAAU;oBACnC,UAAU,EAAE,YAAY,CAAC,UAAU,GAAG,IAAI,EAAE,4BAA4B;iBACzE,CAAC;gBAEF,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC1B,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAChC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;gBAC7C,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC1B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,wEAAwE;AACxE,8EAA8E;AAC9E,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAS;IACvC,eAAe,EAAE,KAAK,EAAE,gBAAgB,EAAE,mBAAmB;IAC7D,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe;IAC5D,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,qBAAqB;IACjE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,iBAAiB;CACpD,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAS,cAAc,CACrB,QAAgB,EAChB,MAAc,EACd,QAAgB,EAChB,gBAA+C,EAC/C,GAAuB;IAEvB,MAAM,eAAe,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEvD,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,kBAAkB,IAAI,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACrC,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAoB,CAAC,EAAE,CAAC;oBACjD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;gBAC7C,CAAC;YACH,CAAC;iBAAM,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,uEAAuE;IACvE,EAAE;IACF,0EAA0E;IAC1E,2EAA2E;IAC3E,uEAAuE;IACvE,uEAAuE;IACvE,oEAAoE;IACpE,+EAA+E;IAC/E,yEAAyE;IACzE,2EAA2E;IAC3E,mEAAmE;IACnE,iEAAiE;IACjE,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,IAAI,GAAG,gBAAgB,CAC3B,GAAG,CAAC,UAAU,EACd,GAAG,CAAC,aAAa,EACjB,GAAG,CAAC,OAAO,EACX,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAC/B,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,IAAI,KAAK,MAAM;gBAAE,SAAS,CAAC,wBAAwB;YACvD,IAAI,IAAI,GAAG,QAAQ;gBAAE,SAAS,CAAC,yCAAyC;YACxE,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACrD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,IAAI,eAAe,EAAE,CAAC;oBACpB,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAoB,CAAC,EAAE,CAAC;wBACjD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;oBAC7C,CAAC;gBACH,CAAC;qBAAM,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACpC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;gBAC7C,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CACrB,MAAmB,EACnB,IAAe,EACf,SAA0B;IAE1B,MAAM,IAAI,GAAoB,EAAE,CAAC;IAEjC,oBAAoB;IACpB,IAAI,CAAC,IAAI,CAAC;QACR,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,QAAQ;QACd,WAAW,EAAE,2BAA2B,MAAM,CAAC,IAAI,EAAE;KACtD,CAAC,CAAC;IAEH,oDAAoD;IACpD,oDAAoD;IACpD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,6BAA6B,SAAS,CAAC,QAAQ,EAAE;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB;IAChB,IAAI,CAAC,IAAI,CAAC;QACR,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,yBAAyB,IAAI,CAAC,IAAI,OAAO;KACvD,CAAC,CAAC;IAEH,OAAO;QACL,MAAM;QACN,IAAI;QACJ,IAAI;QACJ,SAAS,EAAE,KAAK;QAChB,UAAU,EAAE,SAAS,CAAC,UAAU,GAAG,GAAG,EAAE,wBAAwB;KACjE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAQ,EACR,KAAiB,EACjB,WAA8B;IAE9B,MAAM,eAAe,GAAsB,EAAE,CAAC;IAC9C,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAE7D,oDAAoD;IACpD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAE7D,8DAA8D;IAC9D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,8DAA8D;QAC9D,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC;QAEnE,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzD,gDAAgD;gBAChD,wDAAwD;gBACxD,mEAAmE;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAe;IACrD,IAAI,UAAU,GAAG,GAAG,CAAC;IAErB,8BAA8B;IAC9B,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;IAErC,wDAAwD;IACxD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;IACpC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,yBAAyB;IAEvE,yBAAyB;IACzB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,UAAU,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,MAA8B;IAM1D,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAElD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;QAC9E,CAAC,CAAC,CAAC,CAAC;IAEN,OAAO;QACL,gBAAgB,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM;QAC3C,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;QAC/B,eAAe;QACf,aAAa;KACd,CAAC;AACJ,CAAC"}

package/dist/browser/circle-ir.js

@@ -10767,6 +10767,15 @@ var DEFAULT_SOURCES = [
   { method: "getPathWithinApplication", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
   { method: "getRequestUri", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
   { method: "decodeRequestString", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
+  // cognium-dev #249 3.162.0: java.net.URLDecoder.decode reintroduces taint
+  // by expanding %XX sequences into arbitrary bytes. This is the
+  // decode-after-encode bypass pattern exercised by SecuriBench Micro
+  // `sanitizers/Sanitizers5.java`: encode sanitizes `//evil.com` into
+  // `%2F%2Fevil.com`, then decode restores the redirect payload before
+  // it reaches `sendRedirect`. Registering as a source ensures the
+  // reaching-def walk does not credit an upstream URLEncoder.encode
+  // sanitizer for taint that has since been re-expanded.
+  { method: "decode", class: "URLDecoder", type: "http_path", severity: "high", return_tainted: true },
   // Additional HTTP request methods that can be attacker-controlled
   { method: "getProtocol", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
   { method: "getScheme", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
@@ -12662,7 +12671,39 @@ var DEFAULT_SINKS = [
   // (`const { unserialize } = require('node-serialize')`).
   { method: "unserialize", class: "serialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "unserialize", class: "node-serialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
-  { method: "unserialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] }
+  { method: "unserialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // =========================================================================
+  // cognium-dev #241 (non-Java) — real-world sink signatures
+  // =========================================================================
+  // Python SSRF — httpx (sync + async client + top-level module)
+  { method: "get", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "post", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "request", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [1] },
+  // request(method, url, ...)
+  { method: "stream", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [1] },
+  { method: "delete", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "put", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "patch", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "head", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  // Python SQLi — asyncpg Connection.*
+  { method: "execute", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
+  { method: "fetch", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
+  { method: "fetchrow", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
+  { method: "fetchval", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
+  // Method-only python-scoped fallback (aliased connections, pool.acquire())
+  { method: "fetchrow", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "fetchval", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
+  // Go Open Redirect — net/http.Redirect(w, r, url, code)
+  { method: "Redirect", class: "http", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [2], languages: ["go"] },
+  // Go SSRF — fasthttp Client instance methods (class 'Client' does not
+  // fuzzy-collide with 'http', unlike class 'fasthttp' which would
+  // suffix-match receiver 'http' via receiverMightBeClass's 40% length
+  // heuristic. Package-level `fasthttp.Get/Post/GetTimeout` sinks live
+  // in the Go plugin (`languages/plugins/go.ts::getBuiltinSinks()`) so
+  // they iterate after net/http entries and don't hijack `http.Get`.
+  { method: "Do", class: "Client", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["go"] },
+  // *fasthttp.Client.Do(req)
+  { method: "DoTimeout", class: "Client", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["go"] }
 ];
 var DEFAULT_SANITIZERS = [
   // SQL Injection - proper parameter binding sanitizes input
@@ -12696,12 +12737,17 @@ var DEFAULT_SANITIZERS = [
   // Rust askama auto-escapes
   { method: "encodeForJavaScript", removes: ["xss"] },
   { method: "encodeForCSS", removes: ["xss"] },
-  { method: "encodeForURL", removes: ["xss", "ssrf"] },
+  // cognium-dev #249 3.162.0: `open_redirect` restored to the URL-encoder
+  // sanitizer cluster. Sprint 82 (#189) reclassified `sendRedirect` from
+  // `ssrf` → `open_redirect` (config-loader.ts:1296-1299) without updating
+  // this table; the drift surfaced as a SecuriBench Micro FP on
+  // `sanitizers/Sanitizers3.java` (`URLEncoder.encode` + `sendRedirect`).
+  { method: "encodeForURL", removes: ["xss", "ssrf", "open_redirect"] },
   // URL encoding wrapper aliases (common patterns in benchmarks and real-world code)
-  { method: "encodeURL", removes: ["xss", "ssrf"] },
-  { method: "urlEncode", removes: ["xss", "ssrf"] },
-  { method: "escapeUrl", removes: ["xss", "ssrf"] },
-  { method: "escapeURL", removes: ["xss", "ssrf"] },
+  { method: "encodeURL", removes: ["xss", "ssrf", "open_redirect"] },
+  { method: "urlEncode", removes: ["xss", "ssrf", "open_redirect"] },
+  { method: "escapeUrl", removes: ["xss", "ssrf", "open_redirect"] },
+  { method: "escapeURL", removes: ["xss", "ssrf", "open_redirect"] },
   // Path Traversal
   { method: "normalize", class: "Path", removes: ["path_traversal"] },
   { method: "getCanonicalPath", class: "File", removes: ["path_traversal"] },
@@ -12746,7 +12792,11 @@ var DEFAULT_SANITIZERS = [
   { method: "setFeature", class: "XMLReader", removes: ["xxe"] },
   { method: "setProperty", class: "XMLReader", removes: ["xxe"] },
   // SSRF / URL encoding
-  { method: "encode", class: "URLEncoder", removes: ["ssrf", "xss", "path_traversal"] },
+  // cognium-dev #249 3.162.0: `open_redirect` added — see rationale on the
+  // `encodeForURL` cluster above. `java.net.URLEncoder.encode` is the specific
+  // sanitizer used by SecuriBench Micro `sanitizers/Sanitizers3.java` before
+  // `HttpServletResponse.sendRedirect` (Sprint 82 CWE-601 sink).
+  { method: "encode", class: "URLEncoder", removes: ["ssrf", "xss", "path_traversal", "open_redirect"] },
   { method: "validateURL", removes: ["ssrf"] },
   { method: "isAllowedHost", removes: ["ssrf"] },
   { method: "isInternalHost", removes: ["ssrf"] },
@@ -14282,7 +14332,7 @@ function receiverMightBeClass(receiver, className) {
   }
   const lowerReceiver = receiver.toLowerCase();
   const lowerClass = className.toLowerCase();
-  if (lowerReceiver.endsWith(lowerClass) || lowerReceiver.endsWith("." + lowerClass)) {
+  if (lowerReceiver === lowerClass || lowerReceiver.endsWith("." + lowerClass)) {
     return true;
   }
   if (receiver.includes(".") && !receiver.endsWith(")")) {
@@ -16467,7 +16517,7 @@ var KNOWN_SINK_TYPES = /* @__PURE__ */ new Set([
   "crlf",
   "mass_assignment"
 ]);
-function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine, ctx) {
+function checkSanitized(fromLine, toLine, sinkType, sanitizersByLine, ctx) {
   const isKnownSinkType = KNOWN_SINK_TYPES.has(sinkType);
   const sanitizersAtTarget = sanitizersByLine.get(toLine);
   if (sanitizersAtTarget && sanitizersAtTarget.length > 0) {
@@ -16490,6 +16540,7 @@ function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine, ctx) {
     );
     for (const line of walk.lines) {
       if (line === toLine) continue;
+      if (line < fromLine) continue;
       const sansAtLine = sanitizersByLine.get(line);
       if (!sansAtLine || sansAtLine.length === 0) continue;
       for (const san of sansAtLine) {
@@ -23183,6 +23234,38 @@ var GoPlugin = class extends BaseLanguagePlugin {
         severity: "high",
         argPositions: [0, 2]
       },
+      // fasthttp package-level helpers — registered here (plugin sinks
+      // iterate after DEFAULT_SINKS) so `net/http.Get` at line 366 wins
+      // the sink-map insertion race for receiver 'http' before the fuzzy
+      // suffix match in `receiverMightBeClass` ('fasthttp'.endsWith('http'))
+      // would otherwise let a `fasthttp` pattern hijack an `http.Get(url)`
+      // call site. Real `fasthttp.Get(dst, url)` calls have receiver
+      // 'fasthttp' which does not fuzzy-match 'http'. cognium-dev #241
+      // non-Java, 3.161.0.
+      {
+        method: "Get",
+        class: "fasthttp",
+        type: "ssrf",
+        cwe: "CWE-918",
+        severity: "high",
+        argPositions: [1]
+      },
+      {
+        method: "Post",
+        class: "fasthttp",
+        type: "ssrf",
+        cwe: "CWE-918",
+        severity: "high",
+        argPositions: [1]
+      },
+      {
+        method: "GetTimeout",
+        class: "fasthttp",
+        type: "ssrf",
+        cwe: "CWE-918",
+        severity: "high",
+        argPositions: [1]
+      },
       // Deserialization
       {
         method: "Unmarshal",
@@ -32198,6 +32281,7 @@ var TaintPropagationPass = class {
           );
           for (const line of walk.lines) {
             if (line === f.sink_line) continue;
+            if (line < f.source_line) continue;
             const sansAtLine = sanitizersByLine.get(line);
             if (!sansAtLine || sansAtLine.length === 0) continue;
             for (const san of sansAtLine) {

package/dist/core/circle-ir-core.cjs

@@ -10162,6 +10162,15 @@ var DEFAULT_SOURCES = [
   { method: "getPathWithinApplication", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
   { method: "getRequestUri", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
   { method: "decodeRequestString", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
+  // cognium-dev #249 3.162.0: java.net.URLDecoder.decode reintroduces taint
+  // by expanding %XX sequences into arbitrary bytes. This is the
+  // decode-after-encode bypass pattern exercised by SecuriBench Micro
+  // `sanitizers/Sanitizers5.java`: encode sanitizes `//evil.com` into
+  // `%2F%2Fevil.com`, then decode restores the redirect payload before
+  // it reaches `sendRedirect`. Registering as a source ensures the
+  // reaching-def walk does not credit an upstream URLEncoder.encode
+  // sanitizer for taint that has since been re-expanded.
+  { method: "decode", class: "URLDecoder", type: "http_path", severity: "high", return_tainted: true },
   // Additional HTTP request methods that can be attacker-controlled
   { method: "getProtocol", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
   { method: "getScheme", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
@@ -12057,7 +12066,39 @@ var DEFAULT_SINKS = [
   // (`const { unserialize } = require('node-serialize')`).
   { method: "unserialize", class: "serialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "unserialize", class: "node-serialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
-  { method: "unserialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] }
+  { method: "unserialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // =========================================================================
+  // cognium-dev #241 (non-Java) — real-world sink signatures
+  // =========================================================================
+  // Python SSRF — httpx (sync + async client + top-level module)
+  { method: "get", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "post", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "request", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [1] },
+  // request(method, url, ...)
+  { method: "stream", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [1] },
+  { method: "delete", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "put", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "patch", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "head", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  // Python SQLi — asyncpg Connection.*
+  { method: "execute", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
+  { method: "fetch", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
+  { method: "fetchrow", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
+  { method: "fetchval", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
+  // Method-only python-scoped fallback (aliased connections, pool.acquire())
+  { method: "fetchrow", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "fetchval", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
+  // Go Open Redirect — net/http.Redirect(w, r, url, code)
+  { method: "Redirect", class: "http", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [2], languages: ["go"] },
+  // Go SSRF — fasthttp Client instance methods (class 'Client' does not
+  // fuzzy-collide with 'http', unlike class 'fasthttp' which would
+  // suffix-match receiver 'http' via receiverMightBeClass's 40% length
+  // heuristic. Package-level `fasthttp.Get/Post/GetTimeout` sinks live
+  // in the Go plugin (`languages/plugins/go.ts::getBuiltinSinks()`) so
+  // they iterate after net/http entries and don't hijack `http.Get`.
+  { method: "Do", class: "Client", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["go"] },
+  // *fasthttp.Client.Do(req)
+  { method: "DoTimeout", class: "Client", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["go"] }
 ];
 var DEFAULT_SANITIZERS = [
   // SQL Injection - proper parameter binding sanitizes input
@@ -12091,12 +12132,17 @@ var DEFAULT_SANITIZERS = [
   // Rust askama auto-escapes
   { method: "encodeForJavaScript", removes: ["xss"] },
   { method: "encodeForCSS", removes: ["xss"] },
-  { method: "encodeForURL", removes: ["xss", "ssrf"] },
+  // cognium-dev #249 3.162.0: `open_redirect` restored to the URL-encoder
+  // sanitizer cluster. Sprint 82 (#189) reclassified `sendRedirect` from
+  // `ssrf` → `open_redirect` (config-loader.ts:1296-1299) without updating
+  // this table; the drift surfaced as a SecuriBench Micro FP on
+  // `sanitizers/Sanitizers3.java` (`URLEncoder.encode` + `sendRedirect`).
+  { method: "encodeForURL", removes: ["xss", "ssrf", "open_redirect"] },
   // URL encoding wrapper aliases (common patterns in benchmarks and real-world code)
-  { method: "encodeURL", removes: ["xss", "ssrf"] },
-  { method: "urlEncode", removes: ["xss", "ssrf"] },
-  { method: "escapeUrl", removes: ["xss", "ssrf"] },
-  { method: "escapeURL", removes: ["xss", "ssrf"] },
+  { method: "encodeURL", removes: ["xss", "ssrf", "open_redirect"] },
+  { method: "urlEncode", removes: ["xss", "ssrf", "open_redirect"] },
+  { method: "escapeUrl", removes: ["xss", "ssrf", "open_redirect"] },
+  { method: "escapeURL", removes: ["xss", "ssrf", "open_redirect"] },
   // Path Traversal
   { method: "normalize", class: "Path", removes: ["path_traversal"] },
   { method: "getCanonicalPath", class: "File", removes: ["path_traversal"] },
@@ -12141,7 +12187,11 @@ var DEFAULT_SANITIZERS = [
   { method: "setFeature", class: "XMLReader", removes: ["xxe"] },
   { method: "setProperty", class: "XMLReader", removes: ["xxe"] },
   // SSRF / URL encoding
-  { method: "encode", class: "URLEncoder", removes: ["ssrf", "xss", "path_traversal"] },
+  // cognium-dev #249 3.162.0: `open_redirect` added — see rationale on the
+  // `encodeForURL` cluster above. `java.net.URLEncoder.encode` is the specific
+  // sanitizer used by SecuriBench Micro `sanitizers/Sanitizers3.java` before
+  // `HttpServletResponse.sendRedirect` (Sprint 82 CWE-601 sink).
+  { method: "encode", class: "URLEncoder", removes: ["ssrf", "xss", "path_traversal", "open_redirect"] },
   { method: "validateURL", removes: ["ssrf"] },
   { method: "isAllowedHost", removes: ["ssrf"] },
   { method: "isInternalHost", removes: ["ssrf"] },
@@ -13590,7 +13640,7 @@ function receiverMightBeClass(receiver, className) {
   }
   const lowerReceiver = receiver.toLowerCase();
   const lowerClass = className.toLowerCase();
-  if (lowerReceiver.endsWith(lowerClass) || lowerReceiver.endsWith("." + lowerClass)) {
+  if (lowerReceiver === lowerClass || lowerReceiver.endsWith("." + lowerClass)) {
     return true;
   }
   if (receiver.includes(".") && !receiver.endsWith(")")) {
@@ -14524,7 +14574,7 @@ var KNOWN_SINK_TYPES = /* @__PURE__ */ new Set([
   "crlf",
   "mass_assignment"
 ]);
-function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine, ctx) {
+function checkSanitized(fromLine, toLine, sinkType, sanitizersByLine, ctx) {
   const isKnownSinkType = KNOWN_SINK_TYPES.has(sinkType);
   const sanitizersAtTarget = sanitizersByLine.get(toLine);
   if (sanitizersAtTarget && sanitizersAtTarget.length > 0) {
@@ -14547,6 +14597,7 @@ function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine, ctx) {
     );
     for (const line of walk.lines) {
       if (line === toLine) continue;
+      if (line < fromLine) continue;
       const sansAtLine = sanitizersByLine.get(line);
       if (!sansAtLine || sansAtLine.length === 0) continue;
       for (const san of sansAtLine) {

package/dist/core/circle-ir-core.js

@@ -10096,6 +10096,15 @@ var DEFAULT_SOURCES = [
   { method: "getPathWithinApplication", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
   { method: "getRequestUri", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
   { method: "decodeRequestString", class: "WebUtils", type: "http_path", severity: "high", return_tainted: true },
+  // cognium-dev #249 3.162.0: java.net.URLDecoder.decode reintroduces taint
+  // by expanding %XX sequences into arbitrary bytes. This is the
+  // decode-after-encode bypass pattern exercised by SecuriBench Micro
+  // `sanitizers/Sanitizers5.java`: encode sanitizes `//evil.com` into
+  // `%2F%2Fevil.com`, then decode restores the redirect payload before
+  // it reaches `sendRedirect`. Registering as a source ensures the
+  // reaching-def walk does not credit an upstream URLEncoder.encode
+  // sanitizer for taint that has since been re-expanded.
+  { method: "decode", class: "URLDecoder", type: "http_path", severity: "high", return_tainted: true },
   // Additional HTTP request methods that can be attacker-controlled
   { method: "getProtocol", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
   { method: "getScheme", class: "HttpServletRequest", type: "http_header", severity: "medium", return_tainted: true },
@@ -11991,7 +12000,39 @@ var DEFAULT_SINKS = [
   // (`const { unserialize } = require('node-serialize')`).
   { method: "unserialize", class: "serialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "unserialize", class: "node-serialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
-  { method: "unserialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] }
+  { method: "unserialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // =========================================================================
+  // cognium-dev #241 (non-Java) — real-world sink signatures
+  // =========================================================================
+  // Python SSRF — httpx (sync + async client + top-level module)
+  { method: "get", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "post", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "request", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [1] },
+  // request(method, url, ...)
+  { method: "stream", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [1] },
+  { method: "delete", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "put", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "patch", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  { method: "head", class: "httpx", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
+  // Python SQLi — asyncpg Connection.*
+  { method: "execute", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
+  { method: "fetch", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
+  { method: "fetchrow", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
+  { method: "fetchval", class: "Connection", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
+  // Method-only python-scoped fallback (aliased connections, pool.acquire())
+  { method: "fetchrow", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "fetchval", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["python"] },
+  // Go Open Redirect — net/http.Redirect(w, r, url, code)
+  { method: "Redirect", class: "http", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [2], languages: ["go"] },
+  // Go SSRF — fasthttp Client instance methods (class 'Client' does not
+  // fuzzy-collide with 'http', unlike class 'fasthttp' which would
+  // suffix-match receiver 'http' via receiverMightBeClass's 40% length
+  // heuristic. Package-level `fasthttp.Get/Post/GetTimeout` sinks live
+  // in the Go plugin (`languages/plugins/go.ts::getBuiltinSinks()`) so
+  // they iterate after net/http entries and don't hijack `http.Get`.
+  { method: "Do", class: "Client", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["go"] },
+  // *fasthttp.Client.Do(req)
+  { method: "DoTimeout", class: "Client", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0], languages: ["go"] }
 ];
 var DEFAULT_SANITIZERS = [
   // SQL Injection - proper parameter binding sanitizes input
@@ -12025,12 +12066,17 @@ var DEFAULT_SANITIZERS = [
   // Rust askama auto-escapes
   { method: "encodeForJavaScript", removes: ["xss"] },
   { method: "encodeForCSS", removes: ["xss"] },
-  { method: "encodeForURL", removes: ["xss", "ssrf"] },
+  // cognium-dev #249 3.162.0: `open_redirect` restored to the URL-encoder
+  // sanitizer cluster. Sprint 82 (#189) reclassified `sendRedirect` from
+  // `ssrf` → `open_redirect` (config-loader.ts:1296-1299) without updating
+  // this table; the drift surfaced as a SecuriBench Micro FP on
+  // `sanitizers/Sanitizers3.java` (`URLEncoder.encode` + `sendRedirect`).
+  { method: "encodeForURL", removes: ["xss", "ssrf", "open_redirect"] },
   // URL encoding wrapper aliases (common patterns in benchmarks and real-world code)
-  { method: "encodeURL", removes: ["xss", "ssrf"] },
-  { method: "urlEncode", removes: ["xss", "ssrf"] },
-  { method: "escapeUrl", removes: ["xss", "ssrf"] },
-  { method: "escapeURL", removes: ["xss", "ssrf"] },
+  { method: "encodeURL", removes: ["xss", "ssrf", "open_redirect"] },
+  { method: "urlEncode", removes: ["xss", "ssrf", "open_redirect"] },
+  { method: "escapeUrl", removes: ["xss", "ssrf", "open_redirect"] },
+  { method: "escapeURL", removes: ["xss", "ssrf", "open_redirect"] },
   // Path Traversal
   { method: "normalize", class: "Path", removes: ["path_traversal"] },
   { method: "getCanonicalPath", class: "File", removes: ["path_traversal"] },
@@ -12075,7 +12121,11 @@ var DEFAULT_SANITIZERS = [
   { method: "setFeature", class: "XMLReader", removes: ["xxe"] },
   { method: "setProperty", class: "XMLReader", removes: ["xxe"] },
   // SSRF / URL encoding
-  { method: "encode", class: "URLEncoder", removes: ["ssrf", "xss", "path_traversal"] },
+  // cognium-dev #249 3.162.0: `open_redirect` added — see rationale on the
+  // `encodeForURL` cluster above. `java.net.URLEncoder.encode` is the specific
+  // sanitizer used by SecuriBench Micro `sanitizers/Sanitizers3.java` before
+  // `HttpServletResponse.sendRedirect` (Sprint 82 CWE-601 sink).
+  { method: "encode", class: "URLEncoder", removes: ["ssrf", "xss", "path_traversal", "open_redirect"] },
   { method: "validateURL", removes: ["ssrf"] },
   { method: "isAllowedHost", removes: ["ssrf"] },
   { method: "isInternalHost", removes: ["ssrf"] },
@@ -13524,7 +13574,7 @@ function receiverMightBeClass(receiver, className) {
   }
   const lowerReceiver = receiver.toLowerCase();
   const lowerClass = className.toLowerCase();
-  if (lowerReceiver.endsWith(lowerClass) || lowerReceiver.endsWith("." + lowerClass)) {
+  if (lowerReceiver === lowerClass || lowerReceiver.endsWith("." + lowerClass)) {
     return true;
   }
   if (receiver.includes(".") && !receiver.endsWith(")")) {
@@ -14458,7 +14508,7 @@ var KNOWN_SINK_TYPES = /* @__PURE__ */ new Set([
   "crlf",
   "mass_assignment"
 ]);
-function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine, ctx) {
+function checkSanitized(fromLine, toLine, sinkType, sanitizersByLine, ctx) {
   const isKnownSinkType = KNOWN_SINK_TYPES.has(sinkType);
   const sanitizersAtTarget = sanitizersByLine.get(toLine);
   if (sanitizersAtTarget && sanitizersAtTarget.length > 0) {
@@ -14481,6 +14531,7 @@ function checkSanitized(_fromLine, toLine, sinkType, sanitizersByLine, ctx) {
     );
     for (const line of walk.lines) {
       if (line === toLine) continue;
+      if (line < fromLine) continue;
       const sansAtLine = sanitizersByLine.get(line);
       if (!sansAtLine || sansAtLine.length === 0) continue;
       for (const san of sansAtLine) {

package/dist/languages/plugins/go.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"go.d.ts","sourceRoot":"","sources":["../../../src/languages/plugins/go.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EACV,QAAQ,EACR,QAAQ,EACR,UAAU,EACX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C;;GAEG;AACH,qBAAa,QAAS,SAAQ,kBAAkB;IAC9C,QAAQ,CAAC,EAAE,EAAG,IAAI,CAAU;IAC5B,QAAQ,CAAC,IAAI,QAAQ;IACrB,QAAQ,CAAC,UAAU,WAAW;IAC9B,QAAQ,CAAC,QAAQ,yBAAyB;IAE1C,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CA+BnC;IAEF;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,iBAAiB,GAAG,aAAa,GAAG,SAAS;IAwDtE;;OAEG;IACH,iBAAiB,IAAI,kBAAkB,EAAE;IAkHzC;;OAEG;IACH,eAAe,IAAI,gBAAgB,EAAE;IAgRrC;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS;IAiBlF;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO;IAK1C;;OAEG;IACH,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS;IAkBpD;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,EAAE;IA0FpD;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,EAAE;IAsDpD;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,UAAU,EAAE;IA6BxD;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS;IAkB9D,OAAO,CAAC,eAAe;IA8BvB,OAAO,CAAC,eAAe;CAiBxB"}
+{"version":3,"file":"go.d.ts","sourceRoot":"","sources":["../../../src/languages/plugins/go.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EACV,QAAQ,EACR,QAAQ,EACR,UAAU,EACX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C;;GAEG;AACH,qBAAa,QAAS,SAAQ,kBAAkB;IAC9C,QAAQ,CAAC,EAAE,EAAG,IAAI,CAAU;IAC5B,QAAQ,CAAC,IAAI,QAAQ;IACrB,QAAQ,CAAC,UAAU,WAAW;IAC9B,QAAQ,CAAC,QAAQ,yBAAyB;IAE1C,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CA+BnC;IAEF;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,iBAAiB,GAAG,aAAa,GAAG,SAAS;IAwDtE;;OAEG;IACH,iBAAiB,IAAI,kBAAkB,EAAE;IAkHzC;;OAEG;IACH,eAAe,IAAI,gBAAgB,EAAE;IAiTrC;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS;IAiBlF;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO;IAK1C;;OAEG;IACH,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS;IAkBpD;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,EAAE;IA0FpD;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,EAAE;IAsDpD;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,UAAU,EAAE;IA6BxD;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS;IAkB9D,OAAO,CAAC,eAAe;IA8BvB,OAAO,CAAC,eAAe;CAiBxB"}

package/dist/languages/plugins/go.js

@@ -339,6 +339,38 @@ export class GoPlugin extends BaseLanguagePlugin {
                 severity: 'high',
                 argPositions: [0, 2],
             },
+            // fasthttp package-level helpers — registered here (plugin sinks
+            // iterate after DEFAULT_SINKS) so `net/http.Get` at line 366 wins
+            // the sink-map insertion race for receiver 'http' before the fuzzy
+            // suffix match in `receiverMightBeClass` ('fasthttp'.endsWith('http'))
+            // would otherwise let a `fasthttp` pattern hijack an `http.Get(url)`
+            // call site. Real `fasthttp.Get(dst, url)` calls have receiver
+            // 'fasthttp' which does not fuzzy-match 'http'. cognium-dev #241
+            // non-Java, 3.161.0.
+            {
+                method: 'Get',
+                class: 'fasthttp',
+                type: 'ssrf',
+                cwe: 'CWE-918',
+                severity: 'high',
+                argPositions: [1],
+            },
+            {
+                method: 'Post',
+                class: 'fasthttp',
+                type: 'ssrf',
+                cwe: 'CWE-918',
+                severity: 'high',
+                argPositions: [1],
+            },
+            {
+                method: 'GetTimeout',
+                class: 'fasthttp',
+                type: 'ssrf',
+                cwe: 'CWE-918',
+                severity: 'high',
+                argPositions: [1],
+            },
             // Deserialization
             {
                 method: 'Unmarshal',