circle-ir 3.174.0 → 3.176.0

package/dist/core/circle-ir-core.cjs

@@ -10610,6 +10610,66 @@ var DEFAULT_SOURCES = [
   { method: "decode", class: "JWT", type: "http_header", severity: "high", return_tainted: true, languages: ["java"] },
   { method: "ParseUnverified", class: "jwt", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] }
 ];
+var OPEN_REDIRECT_FRAMEWORK_SINKS = [
+  // --- Python: django / starlette / fastapi -------------------------------
+  { method: "HttpResponseRedirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["python"] },
+  { method: "HttpResponsePermanentRedirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["python"] },
+  { method: "RedirectResponse", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["python"] },
+  // --- JS/TS: koa / fastify / express / next.js ---------------------------
+  { method: "redirect", class: "Context", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "redirect", class: "FastifyReply", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // Express: res.location(url) sets Location header without redirect status,
+  // still an open-redirect vector when combined with a downstream redirect.
+  { method: "location", class: "Response", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // Next.js App Router: NextResponse.redirect(url) — static method matched
+  // by receiver-class name.
+  { method: "redirect", class: "NextResponse", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // --- Java: Spring MVC RedirectView + JAX-RS Response --------------------
+  { method: "RedirectView", class: "RedirectView", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "setUrl", class: "RedirectView", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0], languages: ["java"] },
+  // JAX-RS Response builder — static factory methods that take a target URI.
+  { method: "seeOther", class: "Response", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "temporaryRedirect", class: "Response", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0], languages: ["java"] },
+  // --- Go: gin / echo / fiber ---------------------------------------------
+  // gin/echo: c.Redirect(302, url) — status at arg[0], url at arg[1].
+  // fiber:   c.Redirect(url)         — url at arg[0].
+  // These entries fire once Go local-receiver type resolution lands
+  // (see taint-matcher.ts:2137 receiverMightBeClass — currently returns
+  // false for `c` against 'Context'/'Ctx'). Until then, the
+  // external_taint_escape fallback preserves recall on these call sites.
+  // net/http.Redirect (class 'http') is unaffected — declares class 'http'
+  // and matches via package receiver.
+  { method: "Redirect", class: "Context", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [1], languages: ["go"] },
+  { method: "Redirect", class: "Ctx", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["go"] }
+];
+var TRUST_BOUNDARY_FRAMEWORK_SINKS = [
+  // --- Python: Django cache write -----------------------------------------
+  { method: "set", class: "cache", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["python"] },
+  { method: "set_many", class: "cache", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [0], languages: ["python"] },
+  // --- JS/TS: client-side Storage + Express cookie ------------------------
+  // localStorage / sessionStorage — browser Storage.setItem(key, value).
+  { method: "setItem", class: "Storage", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["javascript", "typescript"] },
+  // Express: res.cookie(name, value, opts) — cookie-jar write.
+  { method: "cookie", class: "Response", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["javascript", "typescript"] },
+  // --- Java: Cookie / SecurityContext / System.setProperty ----------------
+  // `new Cookie(name, value)` — constructor with tainted value crosses the
+  // client-server trust boundary via Set-Cookie.
+  { method: "Cookie", class: "Cookie", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["java"] },
+  { method: "setValue", class: "Cookie", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [0], languages: ["java"] },
+  // Spring Security: SecurityContext.setAuthentication(userSuppliedAuth) —
+  // installs an untrusted principal into the request-scoped security
+  // context; downstream authz decisions become attacker-controlled.
+  { method: "setAuthentication", class: "SecurityContext", type: "trust_boundary", cwe: "CWE-501", severity: "high", arg_positions: [0], languages: ["java"] },
+  // JVM-wide System property write with tainted value pollutes process
+  // state observable to every thread.
+  { method: "setProperty", class: "System", type: "trust_boundary", cwe: "CWE-501", severity: "high", arg_positions: [1], languages: ["java"] },
+  // --- Go: http.SetCookie / gin.SetCookie ---------------------------------
+  // Package-level `http.SetCookie(w, &http.Cookie{Value: tainted})` — sink
+  // on arg[1] (the *Cookie) catches struct-literal composite tainting.
+  { method: "SetCookie", class: "http", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["go"] },
+  // gin: c.SetCookie(name, value, maxAge, path, domain, secure, httpOnly).
+  { method: "SetCookie", class: "Context", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["go"] }
+];
 var DEFAULT_SINKS = [
   // SQL Injection (CWE-89)
   { method: "executeQuery", class: "Statement", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
@@ -11971,7 +12031,10 @@ var DEFAULT_SINKS = [
   { method: "parse", class: "Uri", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   // Rust Open Redirect
   { method: "redirect", class: "HttpResponse", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0] },
-  { method: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0] },
+  // Actix/warp `Redirect::to(url)` — scoped to Rust to avoid collision with
+  // Go's `c.Redirect(status, url)` on gin/echo, which lives further down in
+  // the OPEN_REDIRECT_FRAMEWORK_SINKS block with `arg_positions: [0, 1]`.
+  { method: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["rust"] },
   { method: "see_other", class: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
   { method: "to", class: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
   { method: "temporary", class: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
@@ -12255,7 +12318,14 @@ var DEFAULT_SINKS = [
   // --- Go: langchaingo ----------------------------------------------------
   { method: "Call", class: "LLM", type: "prompt_injection", cwe: "CWE-1427", severity: "high", arg_positions: [0, 1, 2, 3], languages: ["go"] },
   { method: "Generate", class: "LLM", type: "prompt_injection", cwe: "CWE-1427", severity: "high", arg_positions: [0, 1, 2, 3], languages: ["go"] },
-  { method: "GenerateContent", class: "Model", type: "prompt_injection", cwe: "CWE-1427", severity: "high", arg_positions: [0, 1, 2, 3], languages: ["go"] }
+  { method: "GenerateContent", class: "Model", type: "prompt_injection", cwe: "CWE-1427", severity: "high", arg_positions: [0, 1, 2, 3], languages: ["go"] },
+  // cognium-dev #240 ship 1 — extended framework sinks for open_redirect
+  // (CWE-601) and trust_boundary (CWE-501). Definitions extracted above
+  // as OPEN_REDIRECT_FRAMEWORK_SINKS / TRUST_BOUNDARY_FRAMEWORK_SINKS to
+  // keep the DEFAULT_SINKS literal within TypeScript's union-type
+  // inference complexity limit (TS2590). See ~lines 661-752.
+  ...OPEN_REDIRECT_FRAMEWORK_SINKS,
+  ...TRUST_BOUNDARY_FRAMEWORK_SINKS
 ];
 var DEFAULT_SANITIZERS = [
   // SQL Injection - proper parameter binding sanitizes input
@@ -12598,6 +12668,64 @@ function getDefaultConfig() {
   };
 }
 
+// src/analysis/arg-type-resolver.ts
+function findEnclosingType(callInMethod, types) {
+  if (!callInMethod) return null;
+  for (const t of types) {
+    for (const m of t.methods) {
+      if (m.name === callInMethod) return t;
+    }
+  }
+  return null;
+}
+function resolveIdentifierType(name2, callInMethod, types) {
+  if (!name2) return null;
+  const enclosing = findEnclosingType(callInMethod, types);
+  if (enclosing) {
+    for (const m of enclosing.methods) {
+      if (m.name !== callInMethod) continue;
+      for (const p of m.parameters) {
+        if (p.name === name2 && p.type) return p.type;
+      }
+    }
+    for (const f of enclosing.fields) {
+      if (f.name === name2 && f.type) return f.type;
+    }
+    return null;
+  }
+  for (const t of types) {
+    for (const m of t.methods) {
+      for (const p of m.parameters) {
+        if (p.name === name2 && p.type) return p.type;
+      }
+    }
+    for (const f of t.fields) {
+      if (f.name === name2 && f.type) return f.type;
+    }
+  }
+  return null;
+}
+function resolveCallReturnType(calleeName, callInMethod, types) {
+  if (!calleeName) return null;
+  const enclosing = findEnclosingType(callInMethod, types);
+  if (enclosing) {
+    for (const m of enclosing.methods) {
+      if (m.name === calleeName && m.return_type) return m.return_type;
+    }
+  }
+  for (const t of types) {
+    for (const m of t.methods) {
+      if (m.name === calleeName && m.return_type) return m.return_type;
+    }
+  }
+  return null;
+}
+function isBoundedClassType(rawType) {
+  if (!rawType) return false;
+  const stripped = rawType.trim().replace(/^(?:java\.lang\.)+/, "");
+  return /^Class(?:\s*<[\s\S]*>)?$/.test(stripped);
+}
+
 // src/analysis/taint-matcher.ts
 var PYTHON_TAINTED_PATTERNS = [
   { pattern: /\brequest\.args\b/, sourceType: "http_param" },
@@ -12623,7 +12751,7 @@ function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy,
   const sources = findSources(calls, types, config.sources, sourceLines, language);
   let sinkPatterns = expandPromisifyAliases(config.sinks, sourceLines, language);
   sinkPatterns = expandIndirectEvalAliases(sinkPatterns, sourceLines, language);
-  const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines);
+  const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines, types);
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
   return { sources, sinks, sanitizers };
 }
@@ -13201,13 +13329,30 @@ function isSafeRustCommandCall(call, pattern, language) {
   return false;
 }
 var CLASS_LITERAL_RE = /^(?:[A-Za-z_][\w]*\.)*[A-Z][\w]*(?:\[\])*\.class$/;
-function argIsClassLiteral(call, position) {
+function argIsClassLiteral(call, position, types) {
   const arg = call.arguments.find((a) => a.position === position);
   if (!arg) return false;
   const expr = (arg.literal ?? arg.expression ?? "").trim();
   if (!expr) return false;
   if (CLASS_LITERAL_RE.test(expr)) return true;
-  return TYPE_TOKEN_RE.test(expr);
+  if (TYPE_TOKEN_RE.test(expr)) return true;
+  if (!types || types.length === 0) return false;
+  const argExpr = (arg.expression ?? "").trim();
+  const varName = arg.variable ?? "";
+  const isBareIdentifier = varName !== "" && argExpr === varName && !/[(.]/.test(argExpr);
+  if (isBareIdentifier) {
+    const t = resolveIdentifierType(varName, call.in_method, types);
+    if (isBoundedClassType(t)) return true;
+  }
+  const isCallExpr = varName !== "" && new RegExp(`^${escapeRe(varName)}\\s*\\(`).test(argExpr);
+  if (isCallExpr) {
+    const t = resolveCallReturnType(varName, call.in_method, types);
+    if (isBoundedClassType(t)) return true;
+  }
+  return false;
+}
+function escapeRe(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 var TYPE_TOKEN_RE = /^new\s+(?:TypeReference|TypeToken)\s*<[\s\S]*>\s*\(\s*\)\s*\{\s*\}$/;
 function argIsStringLiteral(call, position) {
@@ -13368,7 +13513,7 @@ function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   }
   return false;
 }
-function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
+function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types) {
   const sinkMap = /* @__PURE__ */ new Map();
   for (const call of calls) {
     for (const pattern of patterns) {
@@ -13388,7 +13533,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (isSafeJSChildProcessCall(call, pattern, language)) {
           continue;
         }
-        if (pattern.safe_if_class_literal_at !== void 0 && argIsClassLiteral(call, pattern.safe_if_class_literal_at)) {
+        if (pattern.safe_if_class_literal_at !== void 0 && argIsClassLiteral(call, pattern.safe_if_class_literal_at, types)) {
           continue;
         }
         if (pattern.safe_if_string_literal_at !== void 0 && argIsStringLiteral(call, pattern.safe_if_string_literal_at)) {

package/dist/core/circle-ir-core.js

@@ -10544,6 +10544,66 @@ var DEFAULT_SOURCES = [
   { method: "decode", class: "JWT", type: "http_header", severity: "high", return_tainted: true, languages: ["java"] },
   { method: "ParseUnverified", class: "jwt", type: "http_header", severity: "high", return_tainted: true, languages: ["go"] }
 ];
+var OPEN_REDIRECT_FRAMEWORK_SINKS = [
+  // --- Python: django / starlette / fastapi -------------------------------
+  { method: "HttpResponseRedirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["python"] },
+  { method: "HttpResponsePermanentRedirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["python"] },
+  { method: "RedirectResponse", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["python"] },
+  // --- JS/TS: koa / fastify / express / next.js ---------------------------
+  { method: "redirect", class: "Context", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
+  { method: "redirect", class: "FastifyReply", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // Express: res.location(url) sets Location header without redirect status,
+  // still an open-redirect vector when combined with a downstream redirect.
+  { method: "location", class: "Response", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // Next.js App Router: NextResponse.redirect(url) — static method matched
+  // by receiver-class name.
+  { method: "redirect", class: "NextResponse", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // --- Java: Spring MVC RedirectView + JAX-RS Response --------------------
+  { method: "RedirectView", class: "RedirectView", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "setUrl", class: "RedirectView", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0], languages: ["java"] },
+  // JAX-RS Response builder — static factory methods that take a target URI.
+  { method: "seeOther", class: "Response", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "temporaryRedirect", class: "Response", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0], languages: ["java"] },
+  // --- Go: gin / echo / fiber ---------------------------------------------
+  // gin/echo: c.Redirect(302, url) — status at arg[0], url at arg[1].
+  // fiber:   c.Redirect(url)         — url at arg[0].
+  // These entries fire once Go local-receiver type resolution lands
+  // (see taint-matcher.ts:2137 receiverMightBeClass — currently returns
+  // false for `c` against 'Context'/'Ctx'). Until then, the
+  // external_taint_escape fallback preserves recall on these call sites.
+  // net/http.Redirect (class 'http') is unaffected — declares class 'http'
+  // and matches via package receiver.
+  { method: "Redirect", class: "Context", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [1], languages: ["go"] },
+  { method: "Redirect", class: "Ctx", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["go"] }
+];
+var TRUST_BOUNDARY_FRAMEWORK_SINKS = [
+  // --- Python: Django cache write -----------------------------------------
+  { method: "set", class: "cache", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["python"] },
+  { method: "set_many", class: "cache", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [0], languages: ["python"] },
+  // --- JS/TS: client-side Storage + Express cookie ------------------------
+  // localStorage / sessionStorage — browser Storage.setItem(key, value).
+  { method: "setItem", class: "Storage", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["javascript", "typescript"] },
+  // Express: res.cookie(name, value, opts) — cookie-jar write.
+  { method: "cookie", class: "Response", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["javascript", "typescript"] },
+  // --- Java: Cookie / SecurityContext / System.setProperty ----------------
+  // `new Cookie(name, value)` — constructor with tainted value crosses the
+  // client-server trust boundary via Set-Cookie.
+  { method: "Cookie", class: "Cookie", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["java"] },
+  { method: "setValue", class: "Cookie", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [0], languages: ["java"] },
+  // Spring Security: SecurityContext.setAuthentication(userSuppliedAuth) —
+  // installs an untrusted principal into the request-scoped security
+  // context; downstream authz decisions become attacker-controlled.
+  { method: "setAuthentication", class: "SecurityContext", type: "trust_boundary", cwe: "CWE-501", severity: "high", arg_positions: [0], languages: ["java"] },
+  // JVM-wide System property write with tainted value pollutes process
+  // state observable to every thread.
+  { method: "setProperty", class: "System", type: "trust_boundary", cwe: "CWE-501", severity: "high", arg_positions: [1], languages: ["java"] },
+  // --- Go: http.SetCookie / gin.SetCookie ---------------------------------
+  // Package-level `http.SetCookie(w, &http.Cookie{Value: tainted})` — sink
+  // on arg[1] (the *Cookie) catches struct-literal composite tainting.
+  { method: "SetCookie", class: "http", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["go"] },
+  // gin: c.SetCookie(name, value, maxAge, path, domain, secure, httpOnly).
+  { method: "SetCookie", class: "Context", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["go"] }
+];
 var DEFAULT_SINKS = [
   // SQL Injection (CWE-89)
   { method: "executeQuery", class: "Statement", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0] },
@@ -11905,7 +11965,10 @@ var DEFAULT_SINKS = [
   { method: "parse", class: "Uri", type: "ssrf", cwe: "CWE-918", severity: "high", arg_positions: [0] },
   // Rust Open Redirect
   { method: "redirect", class: "HttpResponse", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0] },
-  { method: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0] },
+  // Actix/warp `Redirect::to(url)` — scoped to Rust to avoid collision with
+  // Go's `c.Redirect(status, url)` on gin/echo, which lives further down in
+  // the OPEN_REDIRECT_FRAMEWORK_SINKS block with `arg_positions: [0, 1]`.
+  { method: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["rust"] },
   { method: "see_other", class: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
   { method: "to", class: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
   { method: "temporary", class: "Redirect", type: "open_redirect", cwe: "CWE-601", severity: "high", arg_positions: [0] },
@@ -12189,7 +12252,14 @@ var DEFAULT_SINKS = [
   // --- Go: langchaingo ----------------------------------------------------
   { method: "Call", class: "LLM", type: "prompt_injection", cwe: "CWE-1427", severity: "high", arg_positions: [0, 1, 2, 3], languages: ["go"] },
   { method: "Generate", class: "LLM", type: "prompt_injection", cwe: "CWE-1427", severity: "high", arg_positions: [0, 1, 2, 3], languages: ["go"] },
-  { method: "GenerateContent", class: "Model", type: "prompt_injection", cwe: "CWE-1427", severity: "high", arg_positions: [0, 1, 2, 3], languages: ["go"] }
+  { method: "GenerateContent", class: "Model", type: "prompt_injection", cwe: "CWE-1427", severity: "high", arg_positions: [0, 1, 2, 3], languages: ["go"] },
+  // cognium-dev #240 ship 1 — extended framework sinks for open_redirect
+  // (CWE-601) and trust_boundary (CWE-501). Definitions extracted above
+  // as OPEN_REDIRECT_FRAMEWORK_SINKS / TRUST_BOUNDARY_FRAMEWORK_SINKS to
+  // keep the DEFAULT_SINKS literal within TypeScript's union-type
+  // inference complexity limit (TS2590). See ~lines 661-752.
+  ...OPEN_REDIRECT_FRAMEWORK_SINKS,
+  ...TRUST_BOUNDARY_FRAMEWORK_SINKS
 ];
 var DEFAULT_SANITIZERS = [
   // SQL Injection - proper parameter binding sanitizes input
@@ -12532,6 +12602,64 @@ function getDefaultConfig() {
   };
 }
 
+// src/analysis/arg-type-resolver.ts
+function findEnclosingType(callInMethod, types) {
+  if (!callInMethod) return null;
+  for (const t of types) {
+    for (const m of t.methods) {
+      if (m.name === callInMethod) return t;
+    }
+  }
+  return null;
+}
+function resolveIdentifierType(name2, callInMethod, types) {
+  if (!name2) return null;
+  const enclosing = findEnclosingType(callInMethod, types);
+  if (enclosing) {
+    for (const m of enclosing.methods) {
+      if (m.name !== callInMethod) continue;
+      for (const p of m.parameters) {
+        if (p.name === name2 && p.type) return p.type;
+      }
+    }
+    for (const f of enclosing.fields) {
+      if (f.name === name2 && f.type) return f.type;
+    }
+    return null;
+  }
+  for (const t of types) {
+    for (const m of t.methods) {
+      for (const p of m.parameters) {
+        if (p.name === name2 && p.type) return p.type;
+      }
+    }
+    for (const f of t.fields) {
+      if (f.name === name2 && f.type) return f.type;
+    }
+  }
+  return null;
+}
+function resolveCallReturnType(calleeName, callInMethod, types) {
+  if (!calleeName) return null;
+  const enclosing = findEnclosingType(callInMethod, types);
+  if (enclosing) {
+    for (const m of enclosing.methods) {
+      if (m.name === calleeName && m.return_type) return m.return_type;
+    }
+  }
+  for (const t of types) {
+    for (const m of t.methods) {
+      if (m.name === calleeName && m.return_type) return m.return_type;
+    }
+  }
+  return null;
+}
+function isBoundedClassType(rawType) {
+  if (!rawType) return false;
+  const stripped = rawType.trim().replace(/^(?:java\.lang\.)+/, "");
+  return /^Class(?:\s*<[\s\S]*>)?$/.test(stripped);
+}
+
 // src/analysis/taint-matcher.ts
 var PYTHON_TAINTED_PATTERNS = [
   { pattern: /\brequest\.args\b/, sourceType: "http_param" },
@@ -12557,7 +12685,7 @@ function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy,
   const sources = findSources(calls, types, config.sources, sourceLines, language);
   let sinkPatterns = expandPromisifyAliases(config.sinks, sourceLines, language);
   sinkPatterns = expandIndirectEvalAliases(sinkPatterns, sourceLines, language);
-  const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines);
+  const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines, types);
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
   return { sources, sinks, sanitizers };
 }
@@ -13135,13 +13263,30 @@ function isSafeRustCommandCall(call, pattern, language) {
   return false;
 }
 var CLASS_LITERAL_RE = /^(?:[A-Za-z_][\w]*\.)*[A-Z][\w]*(?:\[\])*\.class$/;
-function argIsClassLiteral(call, position) {
+function argIsClassLiteral(call, position, types) {
   const arg = call.arguments.find((a) => a.position === position);
   if (!arg) return false;
   const expr = (arg.literal ?? arg.expression ?? "").trim();
   if (!expr) return false;
   if (CLASS_LITERAL_RE.test(expr)) return true;
-  return TYPE_TOKEN_RE.test(expr);
+  if (TYPE_TOKEN_RE.test(expr)) return true;
+  if (!types || types.length === 0) return false;
+  const argExpr = (arg.expression ?? "").trim();
+  const varName = arg.variable ?? "";
+  const isBareIdentifier = varName !== "" && argExpr === varName && !/[(.]/.test(argExpr);
+  if (isBareIdentifier) {
+    const t = resolveIdentifierType(varName, call.in_method, types);
+    if (isBoundedClassType(t)) return true;
+  }
+  const isCallExpr = varName !== "" && new RegExp(`^${escapeRe(varName)}\\s*\\(`).test(argExpr);
+  if (isCallExpr) {
+    const t = resolveCallReturnType(varName, call.in_method, types);
+    if (isBoundedClassType(t)) return true;
+  }
+  return false;
+}
+function escapeRe(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 var TYPE_TOKEN_RE = /^new\s+(?:TypeReference|TypeToken)\s*<[\s\S]*>\s*\(\s*\)\s*\{\s*\}$/;
 function argIsStringLiteral(call, position) {
@@ -13302,7 +13447,7 @@ function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   }
   return false;
 }
-function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
+function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types) {
   const sinkMap = /* @__PURE__ */ new Map();
   for (const call of calls) {
     for (const pattern of patterns) {
@@ -13322,7 +13467,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (isSafeJSChildProcessCall(call, pattern, language)) {
           continue;
         }
-        if (pattern.safe_if_class_literal_at !== void 0 && argIsClassLiteral(call, pattern.safe_if_class_literal_at)) {
+        if (pattern.safe_if_class_literal_at !== void 0 && argIsClassLiteral(call, pattern.safe_if_class_literal_at, types)) {
           continue;
         }
         if (pattern.safe_if_string_literal_at !== void 0 && argIsStringLiteral(call, pattern.safe_if_string_literal_at)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.174.0",
+  "version": "3.176.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",