circle-ir 3.175.0 → 3.176.0

package/dist/analysis/arg-type-resolver.d.ts

@@ -0,0 +1,90 @@
+/**
+ * cognium-dev #256 — same-file argument-type resolver.
+ *
+ * Two sink-shape gates ship in circle-ir today match only the DIRECT/LITERAL
+ * argument form and miss argument indirection:
+ *
+ *   1. `safe_if_class_literal_at` (taint-matcher.ts, #22) — matches
+ *      `readValue(json, Foo.class)` but not `readValue(json, templateClass)`
+ *      where `templateClass` is a `Class<T>` parameter.
+ *   2. Stage-11 `PROCESS_BUILDER_ARGV_FORM_RE` (sink-filter-pass.ts, #179)
+ *      matches `new ProcessBuilder(Arrays.asList(...))` but not
+ *      `new ProcessBuilder(buildCommand(...))` where `buildCommand` returns
+ *      `List<String>`.
+ *
+ * This module provides two pure, same-file, `TypeInfo[]`-based helpers to
+ * resolve the effective type of an argument that is either:
+ *   - a bare identifier (parameter or field name), or
+ *   - a method-call expression (callee name).
+ *
+ * Same-file only — locals declared inside method bodies and cross-file
+ * resolutions are deferred. Both #256 repros (jib, flyingsaucer) are
+ * same-method-parameter / same-class-static-callee, so this scope suffices.
+ *
+ * Design guarantee: both resolvers return null liberally. A null return
+ * flows to the existing gate's default-dangerous behavior (sink fires) —
+ * so any resolver bug regresses gracefully to current (over-firing)
+ * behavior, never to false-negative.
+ */
+import type { TypeInfo } from '../types/index.js';
+/**
+ * Resolve the declared type of a bare-identifier argument (parameter or
+ * field) visible at `callInMethod` scope.
+ *
+ * Lookup order:
+ *   1. Parameters of the enclosing method (matching `callInMethod`).
+ *   2. Fields of the enclosing type (any visibility).
+ *   3. If enclosing type not found, scan ALL types' method params + fields
+ *      (best-effort for top-level functions or method-name collisions).
+ *
+ * Returns the raw type string as extracted (`"Class<T>"`, `"List<String>"`,
+ * `"java.util.List<String>"`, `"Class<? extends JsonTemplate>"`, …) or null.
+ */
+export declare function resolveIdentifierType(name: string, callInMethod: string | null | undefined, types: TypeInfo[]): string | null;
+/**
+ * Resolve the declared return type of a same-file method invoked by
+ * `calleeName`. Accepts a bare callee name (as extracted into
+ * `ArgumentInfo.variable` for call expressions like `buildCommand(x, y)`).
+ *
+ * Preference order:
+ *   1. Method on the enclosing type matching `callInMethod`.
+ *   2. Method on any type in the file (static call `MyClass.foo()` case).
+ *
+ * Overload handling: if the enclosing type has multiple methods with the
+ * same name, returns the first one whose `return_type` is non-null. Full
+ * overload resolution would need argument-expression typing that we don't
+ * have; ambiguity is rare in practice and biases toward null (which
+ * flows to the current default-dangerous behavior).
+ */
+export declare function resolveCallReturnType(calleeName: string, callInMethod: string | null | undefined, types: TypeInfo[]): string | null;
+/**
+ * true when the raw type string represents a Java `Class` type (any bound):
+ * `Class`, `Class<T>`, `Class<? extends X>`, `Class<Foo>`, `java.lang.Class<...>`.
+ *
+ * NEVER matches:
+ *   - `Class.forName(x)` — that's a call expression, not a declared type;
+ *      lookups against `ir.types` won't find it (JDK reflection isn't
+ *      user code).
+ *   - `getClass()` return type — for the same reason.
+ *   - Raw types missing generic bounds are Jackson-safe in the same way
+ *     as the generic form: a bare `Class` param still has a compile-time
+ *     type identity, so we accept it.
+ */
+export declare function isBoundedClassType(rawType: string | null): boolean;
+/**
+ * true when the raw type resolves to a container shape that
+ * `ProcessBuilder(argv)` accepts as non-exploitable — the JVM passes the
+ * elements to `fork(2)` directly, no shell interpolation:
+ *
+ *   - `List<String>` (any parameterization narrower than `Object`)
+ *   - `ArrayList<String>`, `LinkedList<String>`
+ *   - `Collection<String>`, `Iterable<String>`, `Deque<String>`, `Queue<String>`
+ *   - `String[]`, `String ...` (varargs)
+ *   - Fully qualified variants: `java.util.List<String>`, etc.
+ *
+ * Excludes bare `List` / `List<Object>` / `Collection<?>` — those permit
+ * arbitrary element types that could carry non-String content the JVM
+ * would `.toString()` unsafely.
+ */
+export declare function isArgvContainerType(rawType: string | null): boolean;
+//# sourceMappingURL=arg-type-resolver.d.ts.map

package/dist/analysis/arg-type-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arg-type-resolver.d.ts","sourceRoot":"","sources":["../../src/analysis/arg-type-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAoBlD;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACvC,KAAK,EAAE,QAAQ,EAAE,GAChB,MAAM,GAAG,IAAI,CA8Bf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACvC,KAAK,EAAE,QAAQ,EAAE,GAChB,MAAM,GAAG,IAAI,CAef;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAIlE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAUnE"}

package/dist/analysis/arg-type-resolver.js

@@ -0,0 +1,174 @@
+/**
+ * cognium-dev #256 — same-file argument-type resolver.
+ *
+ * Two sink-shape gates ship in circle-ir today match only the DIRECT/LITERAL
+ * argument form and miss argument indirection:
+ *
+ *   1. `safe_if_class_literal_at` (taint-matcher.ts, #22) — matches
+ *      `readValue(json, Foo.class)` but not `readValue(json, templateClass)`
+ *      where `templateClass` is a `Class<T>` parameter.
+ *   2. Stage-11 `PROCESS_BUILDER_ARGV_FORM_RE` (sink-filter-pass.ts, #179)
+ *      matches `new ProcessBuilder(Arrays.asList(...))` but not
+ *      `new ProcessBuilder(buildCommand(...))` where `buildCommand` returns
+ *      `List<String>`.
+ *
+ * This module provides two pure, same-file, `TypeInfo[]`-based helpers to
+ * resolve the effective type of an argument that is either:
+ *   - a bare identifier (parameter or field name), or
+ *   - a method-call expression (callee name).
+ *
+ * Same-file only — locals declared inside method bodies and cross-file
+ * resolutions are deferred. Both #256 repros (jib, flyingsaucer) are
+ * same-method-parameter / same-class-static-callee, so this scope suffices.
+ *
+ * Design guarantee: both resolvers return null liberally. A null return
+ * flows to the existing gate's default-dangerous behavior (sink fires) —
+ * so any resolver bug regresses gracefully to current (over-firing)
+ * behavior, never to false-negative.
+ */
+/**
+ * Locate the TypeInfo whose `methods` list contains a method named
+ * `callInMethod`. Falls back to `null` if not found (e.g. top-level
+ * function, or method name collision that our best-effort match misses).
+ */
+function findEnclosingType(callInMethod, types) {
+    if (!callInMethod)
+        return null;
+    for (const t of types) {
+        for (const m of t.methods) {
+            if (m.name === callInMethod)
+                return t;
+        }
+    }
+    return null;
+}
+/**
+ * Resolve the declared type of a bare-identifier argument (parameter or
+ * field) visible at `callInMethod` scope.
+ *
+ * Lookup order:
+ *   1. Parameters of the enclosing method (matching `callInMethod`).
+ *   2. Fields of the enclosing type (any visibility).
+ *   3. If enclosing type not found, scan ALL types' method params + fields
+ *      (best-effort for top-level functions or method-name collisions).
+ *
+ * Returns the raw type string as extracted (`"Class<T>"`, `"List<String>"`,
+ * `"java.util.List<String>"`, `"Class<? extends JsonTemplate>"`, …) or null.
+ */
+export function resolveIdentifierType(name, callInMethod, types) {
+    if (!name)
+        return null;
+    const enclosing = findEnclosingType(callInMethod, types);
+    if (enclosing) {
+        // Parameter check (preferred — narrower scope, shadows fields).
+        for (const m of enclosing.methods) {
+            if (m.name !== callInMethod)
+                continue;
+            for (const p of m.parameters) {
+                if (p.name === name && p.type)
+                    return p.type;
+            }
+        }
+        // Field check on the enclosing type.
+        for (const f of enclosing.fields) {
+            if (f.name === name && f.type)
+                return f.type;
+        }
+        return null;
+    }
+    // Fallback: scan all types (top-level function case, or extractor didn't
+    // populate `in_method` reliably for this language).
+    for (const t of types) {
+        for (const m of t.methods) {
+            for (const p of m.parameters) {
+                if (p.name === name && p.type)
+                    return p.type;
+            }
+        }
+        for (const f of t.fields) {
+            if (f.name === name && f.type)
+                return f.type;
+        }
+    }
+    return null;
+}
+/**
+ * Resolve the declared return type of a same-file method invoked by
+ * `calleeName`. Accepts a bare callee name (as extracted into
+ * `ArgumentInfo.variable` for call expressions like `buildCommand(x, y)`).
+ *
+ * Preference order:
+ *   1. Method on the enclosing type matching `callInMethod`.
+ *   2. Method on any type in the file (static call `MyClass.foo()` case).
+ *
+ * Overload handling: if the enclosing type has multiple methods with the
+ * same name, returns the first one whose `return_type` is non-null. Full
+ * overload resolution would need argument-expression typing that we don't
+ * have; ambiguity is rare in practice and biases toward null (which
+ * flows to the current default-dangerous behavior).
+ */
+export function resolveCallReturnType(calleeName, callInMethod, types) {
+    if (!calleeName)
+        return null;
+    const enclosing = findEnclosingType(callInMethod, types);
+    if (enclosing) {
+        for (const m of enclosing.methods) {
+            if (m.name === calleeName && m.return_type)
+                return m.return_type;
+        }
+    }
+    // Fallback: any type in file. Static calls / helper classes.
+    for (const t of types) {
+        for (const m of t.methods) {
+            if (m.name === calleeName && m.return_type)
+                return m.return_type;
+        }
+    }
+    return null;
+}
+/**
+ * true when the raw type string represents a Java `Class` type (any bound):
+ * `Class`, `Class<T>`, `Class<? extends X>`, `Class<Foo>`, `java.lang.Class<...>`.
+ *
+ * NEVER matches:
+ *   - `Class.forName(x)` — that's a call expression, not a declared type;
+ *      lookups against `ir.types` won't find it (JDK reflection isn't
+ *      user code).
+ *   - `getClass()` return type — for the same reason.
+ *   - Raw types missing generic bounds are Jackson-safe in the same way
+ *     as the generic form: a bare `Class` param still has a compile-time
+ *     type identity, so we accept it.
+ */
+export function isBoundedClassType(rawType) {
+    if (!rawType)
+        return false;
+    const stripped = rawType.trim().replace(/^(?:java\.lang\.)+/, '');
+    return /^Class(?:\s*<[\s\S]*>)?$/.test(stripped);
+}
+/**
+ * true when the raw type resolves to a container shape that
+ * `ProcessBuilder(argv)` accepts as non-exploitable — the JVM passes the
+ * elements to `fork(2)` directly, no shell interpolation:
+ *
+ *   - `List<String>` (any parameterization narrower than `Object`)
+ *   - `ArrayList<String>`, `LinkedList<String>`
+ *   - `Collection<String>`, `Iterable<String>`, `Deque<String>`, `Queue<String>`
+ *   - `String[]`, `String ...` (varargs)
+ *   - Fully qualified variants: `java.util.List<String>`, etc.
+ *
+ * Excludes bare `List` / `List<Object>` / `Collection<?>` — those permit
+ * arbitrary element types that could carry non-String content the JVM
+ * would `.toString()` unsafely.
+ */
+export function isArgvContainerType(rawType) {
+    if (!rawType)
+        return false;
+    const s = rawType.trim().replace(/^(?:java\.util\.|java\.lang\.)+/, '');
+    // String[] or String...
+    if (/^String\s*(?:\[\s*\]|\.\.\.)$/.test(s))
+        return true;
+    // Container<String>-like — permit CharSequence too (String subtype narrower
+    // than Object). Reject `<?>`, `<? extends Object>`, bare `<Object>`.
+    return /^(?:List|ArrayList|LinkedList|Collection|Iterable|Deque|Queue)\s*<\s*(?:String|CharSequence|java\.lang\.String)\b/.test(s);
+}
+//# sourceMappingURL=arg-type-resolver.js.map

package/dist/analysis/arg-type-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arg-type-resolver.js","sourceRoot":"","sources":["../../src/analysis/arg-type-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,YAAuC,EACvC,KAAiB;IAEjB,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY;gBAAE,OAAO,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAY,EACZ,YAAuC,EACvC,KAAiB;IAEjB,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACzD,IAAI,SAAS,EAAE,CAAC;QACd,gEAAgE;QAChE,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY;gBAAE,SAAS;YACtC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;gBAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI;oBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,qCAAqC;QACrC,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACjC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;QAC/C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,yEAAyE;IACzE,oDAAoD;IACpD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;gBAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI;oBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,YAAuC,EACvC,KAAiB;IAEjB,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IACzD,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,WAAW;gBAAE,OAAO,CAAC,CAAC,WAAW,CAAC;QACnE,CAAC;IACH,CAAC;IACD,6DAA6D;IAC7D,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,WAAW;gBAAE,OAAO,CAAC,CAAC,WAAW,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAsB;IACvD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;IAClE,OAAO,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAsB;IACxD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,iCAAiC,EAAE,EAAE,CAAC,CAAC;IACxE,wBAAwB;IACxB,IAAI,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,4EAA4E;IAC5E,qEAAqE;IACrE,OAAO,mHAAmH,CAAC,IAAI,CAC7H,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/analysis/passes/sink-filter-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sink-filter-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/sink-filter-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,MAAM,sBAAsB,CAAC;AACzG,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAokB9E,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,sBAAsB;IACtB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,qBAAa,cAAe,YAAW,YAAY,CAAC,gBAAgB,CAAC;IACnE,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,gBAAgB;CAu6BxC;AAkRD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,KAAK,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AA4I1G,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EACjC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,EACxB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,EACrB,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC3B,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC/B,QAAQ,CAAC,EAAE,MAAM,GAChB,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CA6E5B;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EACjC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,EAC3C,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,GACvB,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CA2C5B"}
+{"version":3,"file":"sink-filter-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/sink-filter-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,MAAM,sBAAsB,CAAC;AACzG,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA8kB9E,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,sBAAsB;IACtB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,qBAAa,cAAe,YAAW,YAAY,CAAC,gBAAgB,CAAC;IACnE,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,gBAAgB;CAu8BxC;AAkRD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,KAAK,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AA4I1G,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EACjC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,EACxB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,EACrB,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC3B,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC/B,QAAQ,CAAC,EAAE,MAAM,GAChB,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CA6E5B;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EACjC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,EAC3C,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,GACvB,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CA2C5B"}

package/dist/analysis/passes/sink-filter-pass.js

@@ -19,6 +19,11 @@ import { JS_TAINTED_PATTERNS } from './language-sources-pass.js';
 import { LIBRARY_API_SURFACE_TAG } from '../library-api-surface-downgrade.js';
 import { isNonExecutableSourceLine } from '../non-executable-lines.js';
 import { sanitizerCoversSink } from '../sanitizer-index.js';
+import { resolveIdentifierType, resolveCallReturnType, isArgvContainerType, } from '../arg-type-resolver.js';
+/** Escape regex metacharacters for safe pattern building. */
+function escapeReSf(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
 /**
  * Common XSS sanitizer patterns for JavaScript/TypeScript.
  * These indicate the assigned value has been sanitized before use.
@@ -1022,6 +1027,8 @@ export class SinkFilterPass {
         // the exec is non-injectable and the `start` sink is dropped too.
         if (language === 'java') {
             const sourceLines = ctx.code.split('\n');
+            const irCalls = ctx.graph.ir.calls;
+            const irTypes = ctx.graph.ir.types;
             filtered = filtered.filter(sink => {
                 if (sink.type !== 'command_injection')
                     return true;
@@ -1032,6 +1039,37 @@ export class SinkFilterPass {
                     return true;
                 if (PROCESS_BUILDER_ARGV_FORM_RE.test(sinkLineText))
                     return false;
+                // cognium-dev #256 (3.176.0): resolver fallback for method-call and
+                // variable arguments whose declared type is `List<String>` /
+                // `String[]` / etc. The regex above catches literal shapes
+                // (Arrays.asList, List.of, new String[]{}, varargs); this branch
+                // covers `new ProcessBuilder(buildCommand(binary, opts))` where
+                // `buildCommand` returns `List<String>` (flyingsaucer repro), and
+                // `new ProcessBuilder(argv)` where `argv` is a `List<String>`
+                // parameter. Recall-preserving: on any resolver miss, sink survives.
+                const ctorCall = irCalls.find(c => c.method_name === 'ProcessBuilder' &&
+                    c.location.line === sink.line &&
+                    (c.receiver === null || c.receiver === undefined));
+                if (!ctorCall || ctorCall.arguments.length === 0)
+                    return true;
+                const arg0 = ctorCall.arguments[0];
+                if (!arg0)
+                    return true;
+                const argExpr = (arg0.expression ?? '').trim();
+                const varName = arg0.variable ?? '';
+                // Bare identifier — parameter/field lookup.
+                if (varName !== '' && argExpr === varName && !/[(.]/.test(argExpr)) {
+                    const t = resolveIdentifierType(varName, ctorCall.in_method, irTypes);
+                    if (isArgvContainerType(t))
+                        return false;
+                }
+                // Method call — return-type lookup. `variable` field carries the
+                // callee name for call-expression args.
+                if (varName !== '' && new RegExp(`^${escapeReSf(varName)}\\s*\\(`).test(argExpr)) {
+                    const t = resolveCallReturnType(varName, ctorCall.in_method, irTypes);
+                    if (isArgvContainerType(t))
+                        return false;
+                }
                 return true;
             });
         }