circle-ir 3.175.0 → 3.177.0

package/dist/core/circle-ir-core.js

@@ -7349,8 +7349,16 @@ function extractGoCallInfo(node) {
   if (funcNode.type === "selector_expression") {
     const operand = funcNode.childForFieldName("operand");
     const field = funcNode.childForFieldName("field");
-    receiver = operand ? getNodeText(operand) : null;
     methodName = field ? getNodeText(field) : getNodeText(funcNode);
+    if (operand) {
+      const opText = getNodeText(operand);
+      if (operand.type === "identifier") {
+        const resolved = resolveGoLocalReceiverType(opText, node);
+        receiver = resolved !== null ? resolved : opText;
+      } else {
+        receiver = opText;
+      }
+    }
   } else if (funcNode.type === "identifier") {
     methodName = getNodeText(funcNode);
   } else {
@@ -7428,6 +7436,80 @@ function findGoEnclosingFunction(node) {
   }
   return null;
 }
+function resolveGoLocalReceiverType(operandName, callNode) {
+  let cur = callNode.parent;
+  while (cur) {
+    if (cur.type === "method_declaration") {
+      const receiver = cur.childForFieldName("receiver");
+      if (receiver) {
+        const t = extractGoParamTypeForName(receiver, operandName);
+        if (t !== null) return t;
+      }
+      const params = cur.childForFieldName("parameters");
+      if (params) {
+        const t = extractGoParamTypeForName(params, operandName);
+        if (t !== null) return t;
+      }
+      return null;
+    }
+    if (cur.type === "function_declaration" || cur.type === "func_literal") {
+      const params = cur.childForFieldName("parameters");
+      if (params) {
+        const t = extractGoParamTypeForName(params, operandName);
+        if (t !== null) return t;
+      }
+      return null;
+    }
+    cur = cur.parent;
+  }
+  return null;
+}
+function extractGoParamTypeForName(list, operandName) {
+  for (let i2 = 0; i2 < list.namedChildCount; i2++) {
+    const child = list.namedChild(i2);
+    if (!child || child.type !== "parameter_declaration") continue;
+    const typeNode = child.childForFieldName("type");
+    if (!typeNode) continue;
+    let matched = false;
+    for (let j = 0; j < child.namedChildCount; j++) {
+      const c = child.namedChild(j);
+      if (!c) continue;
+      if (c.type === "identifier" && getNodeText(c) === operandName) {
+        matched = true;
+        break;
+      }
+      if (c.type === "identifier_list") {
+        for (let k = 0; k < c.namedChildCount; k++) {
+          const id = c.namedChild(k);
+          if (id && id.type === "identifier" && getNodeText(id) === operandName) {
+            matched = true;
+            break;
+          }
+        }
+        if (matched) break;
+      }
+    }
+    if (!matched) continue;
+    return extractGoTypeLastSegment(typeNode);
+  }
+  return null;
+}
+function extractGoTypeLastSegment(typeNode) {
+  if (typeNode.type === "pointer_type") {
+    const inner = typeNode.namedChild(0);
+    return inner ? extractGoTypeLastSegment(inner) : null;
+  }
+  if (typeNode.type === "qualified_type") {
+    const name2 = typeNode.childForFieldName("name");
+    if (name2) return getNodeText(name2);
+    const last = typeNode.namedChild(typeNode.namedChildCount - 1);
+    return last ? getNodeText(last) : null;
+  }
+  if (typeNode.type === "type_identifier" || typeNode.type === "identifier") {
+    return getNodeText(typeNode);
+  }
+  return null;
+}
 
 // src/core/extractors/imports.ts
 function detectLanguage2(tree) {
@@ -8176,10 +8258,10 @@ function buildCFG(tree, language, cache) {
   const allEdges = [];
   let blockIdCounter = 0;
   if (effectiveLanguage === "bash") {
-    return buildBashCFG(tree, blockIdCounter);
+    return buildBashCFG(tree, blockIdCounter, cache);
   }
   if (effectiveLanguage === "go") {
-    return buildGoCFG(tree, blockIdCounter);
+    return buildGoCFG(tree, blockIdCounter, cache);
   }
   if (isJavaScript) {
     const functions = [
@@ -8536,11 +8618,11 @@ function processSwitchStatement(stmt, startId, blocks, edges, isJavaScript) {
     nextId: currentId
   };
 }
-function buildBashCFG(tree, startId) {
+function buildBashCFG(tree, startId, cache) {
   const allBlocks = [];
   const allEdges = [];
   let blockIdCounter = startId;
-  const functions = findNodes(tree.rootNode, "function_definition");
+  const functions = getNodesFromCache(tree.rootNode, "function_definition", cache);
   for (const func2 of functions) {
     const body2 = func2.childForFieldName("body");
     if (!body2) continue;
@@ -8657,12 +8739,12 @@ function isStatement(node, isJavaScript) {
   ]);
   return isJavaScript ? jsStatementTypes.has(node.type) : javaStatementTypes.has(node.type);
 }
-function buildGoCFG(tree, blockIdCounter) {
+function buildGoCFG(tree, blockIdCounter, cache) {
   const allBlocks = [];
   const allEdges = [];
   const functions = [
-    ...findNodes(tree.rootNode, "function_declaration"),
-    ...findNodes(tree.rootNode, "method_declaration")
+    ...getNodesFromCache(tree.rootNode, "function_declaration", cache),
+    ...getNodesFromCache(tree.rootNode, "method_declaration", cache)
   ];
   for (const func2 of functions) {
     const body2 = func2.childForFieldName("body");
@@ -10576,6 +10658,59 @@ var OPEN_REDIRECT_FRAMEWORK_SINKS = [
   { method: "Redirect", class: "Context", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [1], languages: ["go"] },
   { method: "Redirect", class: "Ctx", type: "open_redirect", cwe: "CWE-601", severity: "medium", arg_positions: [0], languages: ["go"] }
 ];
+var DESERIALIZATION_FRAMEWORK_SINKS = [
+  // --- Python: stdlib + popular third-party --------------------------------
+  // pickle: known-dangerous, any unpickle on untrusted bytes is RCE.
+  { method: "loads", class: "pickle", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "load", class: "pickle", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
+  // cPickle alias (Python 2 name, still around in older codebases).
+  { method: "loads", class: "cPickle", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "load", class: "cPickle", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
+  // marshal: stdlib code-object deserializer. Loading a tainted bytestring
+  // as a code object followed by `exec` is arbitrary-code execution.
+  { method: "loads", class: "marshal", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "load", class: "marshal", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
+  // dill: pickle superset — same RCE profile.
+  { method: "loads", class: "dill", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
+  { method: "load", class: "dill", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
+  // jsonpickle: JSON wrapper around pickle — trusts `py/object` marker.
+  { method: "decode", class: "jsonpickle", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["python"] },
+  // --- Go: encoding/gob + yaml.Unmarshal -----------------------------------
+  // gob.NewDecoder(r).Decode(&v): tainted io.Reader → arbitrary Go values.
+  { method: "Decode", class: "Decoder", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0], languages: ["go"] },
+  // gopkg.in/yaml.v2 + v3 top-level function; interface{} target is unsafe.
+  { method: "Unmarshal", class: "yaml", type: "deserialization", cwe: "CWE-502", severity: "high", arg_positions: [0], languages: ["go"] },
+  // --- JS/TS: node-serialize ------------------------------------------------
+  // Known-dangerous — accepts embedded IIFE that runs during deserialize.
+  { method: "unserialize", class: "nodeSerialize", type: "deserialization", cwe: "CWE-502", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] }
+];
+var NOSQL_FRAMEWORK_SINKS = [
+  // --- Python: pymongo Collection ------------------------------------------
+  // Every filter-taking Collection method; filter arg[0] is the query dict.
+  { method: "find", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["python"] },
+  { method: "find_one", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["python"] },
+  { method: "aggregate", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["python"] },
+  { method: "update_one", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0, 1], languages: ["python"] },
+  { method: "update_many", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0, 1], languages: ["python"] },
+  { method: "delete_one", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["python"] },
+  { method: "delete_many", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["python"] },
+  { method: "count_documents", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["python"] },
+  // --- Java: Spring Data MongoTemplate + native MongoCollection ------------
+  { method: "find", class: "MongoTemplate", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "findOne", class: "MongoTemplate", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "findAll", class: "MongoTemplate", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "find", class: "MongoCollection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "aggregate", class: "MongoCollection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [0], languages: ["java"] },
+  // --- Go: go.mongodb.org/mongo-driver Collection --------------------------
+  // These fire once Go local-receiver type resolution lands (see
+  // taint-matcher.ts + #240 ship 2 Go receiver work). Same gate as the
+  // gin/fiber Ctx sinks in ship 1.
+  { method: "Find", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [1], languages: ["go"] },
+  { method: "FindOne", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [1], languages: ["go"] },
+  { method: "UpdateOne", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [1, 2], languages: ["go"] },
+  { method: "UpdateMany", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [1, 2], languages: ["go"] },
+  { method: "DeleteOne", class: "Collection", type: "nosql_injection", cwe: "CWE-943", severity: "high", arg_positions: [1], languages: ["go"] }
+];
 var TRUST_BOUNDARY_FRAMEWORK_SINKS = [
   // --- Python: Django cache write -----------------------------------------
   { method: "set", class: "cache", type: "trust_boundary", cwe: "CWE-501", severity: "medium", arg_positions: [1], languages: ["python"] },
@@ -12259,7 +12394,12 @@ var DEFAULT_SINKS = [
   // keep the DEFAULT_SINKS literal within TypeScript's union-type
   // inference complexity limit (TS2590). See ~lines 661-752.
   ...OPEN_REDIRECT_FRAMEWORK_SINKS,
-  ...TRUST_BOUNDARY_FRAMEWORK_SINKS
+  ...TRUST_BOUNDARY_FRAMEWORK_SINKS,
+  // cognium-dev #240 ship 2 — extended framework sinks for
+  // deserialization (CWE-502) and nosql_injection (CWE-943). Same
+  // pattern: constants defined near the ship-1 blocks and spread here.
+  ...DESERIALIZATION_FRAMEWORK_SINKS,
+  ...NOSQL_FRAMEWORK_SINKS
 ];
 var DEFAULT_SANITIZERS = [
   // SQL Injection - proper parameter binding sanitizes input
@@ -12602,6 +12742,64 @@ function getDefaultConfig() {
   };
 }
 
+// src/analysis/arg-type-resolver.ts
+function findEnclosingType(callInMethod, types) {
+  if (!callInMethod) return null;
+  for (const t of types) {
+    for (const m of t.methods) {
+      if (m.name === callInMethod) return t;
+    }
+  }
+  return null;
+}
+function resolveIdentifierType(name2, callInMethod, types) {
+  if (!name2) return null;
+  const enclosing = findEnclosingType(callInMethod, types);
+  if (enclosing) {
+    for (const m of enclosing.methods) {
+      if (m.name !== callInMethod) continue;
+      for (const p of m.parameters) {
+        if (p.name === name2 && p.type) return p.type;
+      }
+    }
+    for (const f of enclosing.fields) {
+      if (f.name === name2 && f.type) return f.type;
+    }
+    return null;
+  }
+  for (const t of types) {
+    for (const m of t.methods) {
+      for (const p of m.parameters) {
+        if (p.name === name2 && p.type) return p.type;
+      }
+    }
+    for (const f of t.fields) {
+      if (f.name === name2 && f.type) return f.type;
+    }
+  }
+  return null;
+}
+function resolveCallReturnType(calleeName, callInMethod, types) {
+  if (!calleeName) return null;
+  const enclosing = findEnclosingType(callInMethod, types);
+  if (enclosing) {
+    for (const m of enclosing.methods) {
+      if (m.name === calleeName && m.return_type) return m.return_type;
+    }
+  }
+  for (const t of types) {
+    for (const m of t.methods) {
+      if (m.name === calleeName && m.return_type) return m.return_type;
+    }
+  }
+  return null;
+}
+function isBoundedClassType(rawType) {
+  if (!rawType) return false;
+  const stripped = rawType.trim().replace(/^(?:java\.lang\.)+/, "");
+  return /^Class(?:\s*<[\s\S]*>)?$/.test(stripped);
+}
+
 // src/analysis/taint-matcher.ts
 var PYTHON_TAINTED_PATTERNS = [
   { pattern: /\brequest\.args\b/, sourceType: "http_param" },
@@ -12627,7 +12825,7 @@ function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy,
   const sources = findSources(calls, types, config.sources, sourceLines, language);
   let sinkPatterns = expandPromisifyAliases(config.sinks, sourceLines, language);
   sinkPatterns = expandIndirectEvalAliases(sinkPatterns, sourceLines, language);
-  const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines);
+  const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines, types);
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
   return { sources, sinks, sanitizers };
 }
@@ -12721,11 +12919,11 @@ function attachSourceLineCode(sources, sinks, code) {
 }
 function findSources(calls, types, patterns, sourceLines, language) {
   const sources = [];
+  const patternsForLanguage = language === void 0 ? patterns : patterns.filter(
+    (p) => !p.languages || p.languages.length === 0 || p.languages.includes(language)
+  );
   for (const call of calls) {
-    for (const pattern of patterns) {
-      if (pattern.languages && pattern.languages.length > 0 && language !== void 0 && !pattern.languages.includes(language)) {
-        continue;
-      }
+    for (const pattern of patternsForLanguage) {
       if (matchesSourcePattern(call, pattern)) {
         sources.push({
           type: pattern.type,
@@ -12741,11 +12939,8 @@ function findSources(calls, types, patterns, sourceLines, language) {
   for (const type of types) {
     for (const method of type.methods) {
       for (const param of method.parameters) {
-        for (const pattern of patterns) {
+        for (const pattern of patternsForLanguage) {
           if (pattern.annotation && pattern.param_tainted) {
-            if (pattern.languages && pattern.languages.length > 0 && language !== void 0 && !pattern.languages.includes(language)) {
-              continue;
-            }
             if (matchesAnnotation(param.annotations, pattern.annotation)) {
               const paramLine = param.line ?? method.start_line;
               sources.push({
@@ -12764,11 +12959,8 @@ function findSources(calls, types, patterns, sourceLines, language) {
   }
   for (const type of types) {
     for (const method of type.methods) {
-      for (const pattern of patterns) {
+      for (const pattern of patternsForLanguage) {
         if (!pattern.method_annotation) continue;
-        if (pattern.languages && pattern.languages.length > 0 && language !== void 0 && !pattern.languages.includes(language)) {
-          continue;
-        }
         if (!matchesAnnotation(method.annotations, pattern.method_annotation)) continue;
         for (const param of method.parameters) {
           const paramLine = param.line ?? method.start_line;
@@ -13205,13 +13397,30 @@ function isSafeRustCommandCall(call, pattern, language) {
   return false;
 }
 var CLASS_LITERAL_RE = /^(?:[A-Za-z_][\w]*\.)*[A-Z][\w]*(?:\[\])*\.class$/;
-function argIsClassLiteral(call, position) {
+function argIsClassLiteral(call, position, types) {
   const arg = call.arguments.find((a) => a.position === position);
   if (!arg) return false;
   const expr = (arg.literal ?? arg.expression ?? "").trim();
   if (!expr) return false;
   if (CLASS_LITERAL_RE.test(expr)) return true;
-  return TYPE_TOKEN_RE.test(expr);
+  if (TYPE_TOKEN_RE.test(expr)) return true;
+  if (!types || types.length === 0) return false;
+  const argExpr = (arg.expression ?? "").trim();
+  const varName = arg.variable ?? "";
+  const isBareIdentifier = varName !== "" && argExpr === varName && !/[(.]/.test(argExpr);
+  if (isBareIdentifier) {
+    const t = resolveIdentifierType(varName, call.in_method, types);
+    if (isBoundedClassType(t)) return true;
+  }
+  const isCallExpr = varName !== "" && new RegExp(`^${escapeRe(varName)}\\s*\\(`).test(argExpr);
+  if (isCallExpr) {
+    const t = resolveCallReturnType(varName, call.in_method, types);
+    if (isBoundedClassType(t)) return true;
+  }
+  return false;
+}
+function escapeRe(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 var TYPE_TOKEN_RE = /^new\s+(?:TypeReference|TypeToken)\s*<[\s\S]*>\s*\(\s*\)\s*\{\s*\}$/;
 function argIsStringLiteral(call, position) {
@@ -13372,10 +13581,13 @@ function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   }
   return false;
 }
-function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
+function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types) {
+  const patternsForLanguage = language === void 0 ? patterns : patterns.filter(
+    (p) => !p.languages || p.languages.length === 0 || p.languages.includes(language)
+  );
   const sinkMap = /* @__PURE__ */ new Map();
   for (const call of calls) {
-    for (const pattern of patterns) {
+    for (const pattern of patternsForLanguage) {
       if (matchesSinkPattern(call, pattern, typeHierarchy, language)) {
         if (isParameterizedQueryCall(call, pattern)) {
           continue;
@@ -13392,7 +13604,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines) {
         if (isSafeJSChildProcessCall(call, pattern, language)) {
           continue;
         }
-        if (pattern.safe_if_class_literal_at !== void 0 && argIsClassLiteral(call, pattern.safe_if_class_literal_at)) {
+        if (pattern.safe_if_class_literal_at !== void 0 && argIsClassLiteral(call, pattern.safe_if_class_literal_at, types)) {
           continue;
         }
         if (pattern.safe_if_string_literal_at !== void 0 && argIsStringLiteral(call, pattern.safe_if_string_literal_at)) {
@@ -13793,7 +14005,20 @@ function matchesAnnotation(annotations, targetAnnotation) {
   }
   return false;
 }
+var RECEIVER_MIGHT_BE_CLASS_CACHE = /* @__PURE__ */ new Map();
+var RECEIVER_MIGHT_BE_CLASS_CACHE_CAP = 1e4;
 function receiverMightBeClass(receiver, className) {
+  const key = receiver + "\0" + className;
+  const cached = RECEIVER_MIGHT_BE_CLASS_CACHE.get(key);
+  if (cached !== void 0) return cached;
+  const result = receiverMightBeClassImpl(receiver, className);
+  if (RECEIVER_MIGHT_BE_CLASS_CACHE.size >= RECEIVER_MIGHT_BE_CLASS_CACHE_CAP) {
+    RECEIVER_MIGHT_BE_CLASS_CACHE.clear();
+  }
+  RECEIVER_MIGHT_BE_CLASS_CACHE.set(key, result);
+  return result;
+}
+function receiverMightBeClassImpl(receiver, className) {
   if (className.startsWith("*") && className.length > 1) {
     const suffix = className.slice(1).toLowerCase();
     let simpleReceiver = receiver;
@@ -14497,8 +14722,15 @@ var CodeGraph = class {
 };
 
 // src/analysis/dfg-walk.ts
+var walkBackwardDefsMemo = /* @__PURE__ */ new WeakMap();
 function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
   const maxHops = options.maxHops ?? 32;
+  let perFile = walkBackwardDefsMemo.get(chainsByToDef);
+  if (perFile !== void 0) {
+    const key = `${startDefId}|${maxHops}`;
+    const hit = perFile.get(key);
+    if (hit !== void 0) return hit;
+  }
   const visited = /* @__PURE__ */ new Set();
   const lines = /* @__PURE__ */ new Set();
   let hopCapReached = false;
@@ -14530,7 +14762,13 @@ function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
       queue.push(fromId);
     }
   }
-  return { visited, lines, hopCapReached };
+  const result = { visited, lines, hopCapReached };
+  if (perFile === void 0) {
+    perFile = /* @__PURE__ */ new Map();
+    walkBackwardDefsMemo.set(chainsByToDef, perFile);
+  }
+  perFile.set(`${startDefId}|${maxHops}`, result);
+  return result;
 }
 
 // src/analysis/sanitizer-index.ts
@@ -15513,7 +15751,7 @@ var ConstantPropagator = class _ConstantPropagator {
     this.constructorParamPositions.clear();
     this.safePatternFieldsCache = null;
     this.isTaintedExpressionCache = null;
-    this.collectClassFields(tree.rootNode);
+    const prePassMethods = this.collectClassFieldsAndMethods(tree.rootNode);
     for (const methodName of sanitizerMethods) {
       this.methodReturnsSanitized.add(methodName);
     }
@@ -15521,7 +15759,7 @@ var ConstantPropagator = class _ConstantPropagator {
       this.source,
       (name2) => this.lookupSymbol(name2)
     );
-    this.analyzeMethodReturns(tree.rootNode);
+    this.analyzeMethodReturns(prePassMethods);
     this.seedPythonModuleConstants(tree.rootNode);
     this.visit(tree.rootNode);
     this.refineTaintFromConstants();
@@ -15591,8 +15829,7 @@ var ConstantPropagator = class _ConstantPropagator {
   /**
    * Pre-pass: Analyze all methods to detect those that always return constants or sanitized values.
    */
-  analyzeMethodReturns(root) {
-    const methods = this.findAllMethods(root);
+  analyzeMethodReturns(methods) {
     for (const method of methods) {
       const methodName = this.getMethodName(method);
       if (!methodName) continue;
@@ -15856,11 +16093,15 @@ var ConstantPropagator = class _ConstantPropagator {
    * Collect all class field names (instance/static variables declared at class level).
    * These are variables declared directly in the class body, not inside methods.
    */
-  collectClassFields(root) {
+  collectClassFieldsAndMethods(root) {
+    const methods = [];
     const stack = [root];
     while (stack.length > 0) {
       const n = stack.pop();
       if (!n) continue;
+      if (n.type === "method_declaration" || n.type === "function_declaration") {
+        methods.push(n);
+      }
       if (n.type === "class_body") {
         for (const child of n.children) {
           if (child.type === "field_declaration") {
@@ -15874,14 +16115,15 @@ var ConstantPropagator = class _ConstantPropagator {
               }
             }
           }
-          stack.push(child);
+          if (child) stack.push(child);
         }
         continue;
       }
       for (const child of n.children) {
-        stack.push(child);
+        if (child) stack.push(child);
       }
     }
+    return methods;
   }
   /**
    * Sprint 9 #55 — seed the symbol table with Python module-level constant
@@ -16039,21 +16281,6 @@ var ConstantPropagator = class _ConstantPropagator {
       this.symbols.set(name2, value);
     }
   }
-  findAllMethods(node) {
-    const methods = [];
-    const stack = [node];
-    while (stack.length > 0) {
-      const n = stack.pop();
-      if (!n) continue;
-      if (n.type === "method_declaration" || n.type === "function_declaration") {
-        methods.push(n);
-      }
-      for (const child of n.children) {
-        if (child) stack.push(child);
-      }
-    }
-    return methods;
-  }
   getMethodName(method) {
     const nameNode = method.childForFieldName("name");
     if (nameNode) {

package/dist/core/extractors/calls.js

@@ -2113,8 +2113,27 @@ function extractGoCallInfo(node) {
         // pkg.Function() or obj.Method()
         const operand = funcNode.childForFieldName('operand');
         const field = funcNode.childForFieldName('field');
-        receiver = operand ? getNodeText(operand) : null;
         methodName = field ? getNodeText(field) : getNodeText(funcNode);
+        // cognium-dev #240 ship 2 — Go local-receiver type resolution.
+        // When the operand is a bare identifier and matches a method
+        // receiver or function parameter in the enclosing declaration,
+        // rewrite receiver to the type's last identifier segment. This
+        // unblocks sinks defined with `class: 'Context'` (gin/echo/fiber),
+        // `class: 'Ctx'` (fiber), and `class: 'Collection'` (mongo-driver)
+        // when the source shape is `c.Redirect(...)` / `c.SetCookie(...)` /
+        // `col.Find(...)`. Package-qualified calls like `fmt.Sprintf(...)`
+        // fall through to the original operand text (fmt is not a
+        // parameter / receiver, resolver returns null).
+        if (operand) {
+            const opText = getNodeText(operand);
+            if (operand.type === 'identifier') {
+                const resolved = resolveGoLocalReceiverType(opText, node);
+                receiver = resolved !== null ? resolved : opText;
+            }
+            else {
+                receiver = opText;
+            }
+        }
     }
     else if (funcNode.type === 'identifier') {
         // Plain function call: funcName()
@@ -2213,4 +2232,115 @@ function findGoEnclosingFunction(node) {
     }
     return null;
 }
+/**
+ * Resolve a Go local-variable operand (bare identifier receiver in a
+ * `selector_expression`) to its declared type's last identifier segment.
+ *
+ * Handles three enclosing-declaration shapes:
+ *   1. Method receiver:   `func (c *gin.Context) H() { c.Redirect(...) }`
+ *   2. Function param:    `func H(c *gin.Context, url string) { c.Redirect(...) }`
+ *   3. Multi-name param:  `func H(a, b *Foo) { a.Bar() }`  (identifier_list)
+ *
+ * Returns `null` when the operand does not match any receiver or
+ * parameter in the nearest enclosing `method_declaration` /
+ * `function_declaration` / `func_literal` — the caller then falls back
+ * to the operand text so package-qualified calls like `fmt.Sprintf(...)`
+ * continue to work.
+ *
+ * cognium-dev #240 ship 2.
+ */
+function resolveGoLocalReceiverType(operandName, callNode) {
+    let cur = callNode.parent;
+    while (cur) {
+        if (cur.type === 'method_declaration') {
+            const receiver = cur.childForFieldName('receiver');
+            if (receiver) {
+                const t = extractGoParamTypeForName(receiver, operandName);
+                if (t !== null)
+                    return t;
+            }
+            const params = cur.childForFieldName('parameters');
+            if (params) {
+                const t = extractGoParamTypeForName(params, operandName);
+                if (t !== null)
+                    return t;
+            }
+            return null;
+        }
+        if (cur.type === 'function_declaration' || cur.type === 'func_literal') {
+            const params = cur.childForFieldName('parameters');
+            if (params) {
+                const t = extractGoParamTypeForName(params, operandName);
+                if (t !== null)
+                    return t;
+            }
+            return null;
+        }
+        cur = cur.parent;
+    }
+    return null;
+}
+/**
+ * Scan a Go `parameter_list` for a `parameter_declaration` naming
+ * `operandName` (directly or inside an `identifier_list`) and return
+ * its type's last identifier segment. Returns `null` on miss.
+ */
+function extractGoParamTypeForName(list, operandName) {
+    for (let i = 0; i < list.namedChildCount; i++) {
+        const child = list.namedChild(i);
+        if (!child || child.type !== 'parameter_declaration')
+            continue;
+        const typeNode = child.childForFieldName('type');
+        if (!typeNode)
+            continue;
+        let matched = false;
+        for (let j = 0; j < child.namedChildCount; j++) {
+            const c = child.namedChild(j);
+            if (!c)
+                continue;
+            if (c.type === 'identifier' && getNodeText(c) === operandName) {
+                matched = true;
+                break;
+            }
+            if (c.type === 'identifier_list') {
+                for (let k = 0; k < c.namedChildCount; k++) {
+                    const id = c.namedChild(k);
+                    if (id && id.type === 'identifier' && getNodeText(id) === operandName) {
+                        matched = true;
+                        break;
+                    }
+                }
+                if (matched)
+                    break;
+            }
+        }
+        if (!matched)
+            continue;
+        return extractGoTypeLastSegment(typeNode);
+    }
+    return null;
+}
+/**
+ * Return the last identifier segment of a Go type expression:
+ *   `*gin.Context` → `"Context"`;  `gin.Context` → `"Context"`;
+ *   `*Context`     → `"Context"`;  `Context`     → `"Context"`;
+ *   `[]byte`       → `null`  (structured types not yet handled).
+ */
+function extractGoTypeLastSegment(typeNode) {
+    if (typeNode.type === 'pointer_type') {
+        const inner = typeNode.namedChild(0);
+        return inner ? extractGoTypeLastSegment(inner) : null;
+    }
+    if (typeNode.type === 'qualified_type') {
+        const name = typeNode.childForFieldName('name');
+        if (name)
+            return getNodeText(name);
+        const last = typeNode.namedChild(typeNode.namedChildCount - 1);
+        return last ? getNodeText(last) : null;
+    }
+    if (typeNode.type === 'type_identifier' || typeNode.type === 'identifier') {
+        return getNodeText(typeNode);
+    }
+    return null;
+}
 //# sourceMappingURL=calls.js.map