circle-ir 3.176.0 → 3.178.0

package/dist/analysis/dependency-versions.js

@@ -0,0 +1,153 @@
+/**
+ * Dependency-manifest helpers for the deserialization-safety-gate pass.
+ *
+ * cognium-dev #258 — dependency-version-aware sink gating. The engine
+ * never reads the filesystem (Pillar I / browser-safety); the caller
+ * (cognium-dev CLI or `analyzeProject`) reads the manifest and passes
+ * it as raw text via `AnalyzerOptions.dependencyContext`. Helpers here
+ * turn that raw text into the boolean predicates the gate needs.
+ *
+ * All parsers here are string-scoped: regex over the raw manifest
+ * rather than a full XML/JSON tree. That is deliberate — the gate only
+ * needs a handful of narrow signals (Fastjson version, presence of a
+ * safe classifier), and every existing runtime dep in circle-ir is
+ * either `web-tree-sitter` or `yaml`. Pulling in an XML parser purely
+ * for one Fastjson property would violate the minimal-dependencies
+ * guardrail.
+ */
+/**
+ * Extract the effective Fastjson version from a `pom.xml`. Two sources
+ * are consulted:
+ *
+ *   1. A `<properties>` entry named exactly `<fastjson.version>` — the
+ *      idiomatic way Maven projects centralise a dep version they
+ *      reference in a `<dependencies>` block. This is where
+ *      alibaba/Sentinel pins `1.2.83_noneautotype`.
+ *   2. A `<dependency>` block whose `<groupId>` is `com.alibaba` and
+ *      `<artifactId>` is `fastjson` — read as a fallback when the
+ *      version is declared inline rather than as a property.
+ *
+ * Returns `null` when no Fastjson coordinate can be resolved from the
+ * pom (no properties entry AND no matching dependency block, or the
+ * dependency uses a `${...}` reference the properties block doesn't
+ * define).
+ */
+export function resolveFastjsonFromPom(pomXml) {
+    if (!pomXml)
+        return null;
+    const propMatch = pomXml.match(/<fastjson\.version>\s*([^<\s]+)\s*<\/fastjson\.version>/);
+    if (propMatch) {
+        const version = propMatch[1];
+        return { version, noneAutotype: /_noneautotype/i.test(version) };
+    }
+    // Fallback: scan every <dependency>...</dependency> block for
+    // com.alibaba:fastjson (or fastjson2). Non-greedy so we don't fuse
+    // sibling blocks. Case-sensitive on artifact / group; Maven's own
+    // resolution is case-sensitive too.
+    const depRe = /<dependency>[\s\S]*?<\/dependency>/g;
+    let m;
+    while ((m = depRe.exec(pomXml)) !== null) {
+        const block = m[0];
+        const gid = block.match(/<groupId>\s*([^<\s]+)\s*<\/groupId>/)?.[1];
+        const aid = block.match(/<artifactId>\s*([^<\s]+)\s*<\/artifactId>/)?.[1];
+        if (gid !== 'com.alibaba')
+            continue;
+        if (aid !== 'fastjson' && aid !== 'fastjson2')
+            continue;
+        const ver = block.match(/<version>\s*([^<\s]+)\s*<\/version>/)?.[1];
+        if (!ver)
+            continue;
+        // `${fastjson.version}` reference the properties block did not
+        // resolve — treat as unknown so the gate defaults to fire.
+        if (/^\$\{/.test(ver))
+            return null;
+        return { version: ver, noneAutotype: /_noneautotype/i.test(ver) };
+    }
+    return null;
+}
+/**
+ * Return true when the given source text contains an in-file call that
+ * re-enables Fastjson autotype. Even a `_noneautotype` build does not
+ * protect against code that programmatically re-enables the feature
+ * (which the hardened build documents as impossible, but the classifier
+ * is a build-time strip, not a runtime lock). Defense-in-depth for the
+ * `resolveFastjsonFromPom` gate.
+ */
+export function fileReenablesFastjsonAutotype(source) {
+    if (!source)
+        return false;
+    // ParserConfig.getGlobalInstance().setAutoTypeSupport(true)
+    // ParserConfig.setAutoTypeSupport(true)   (static-import form)
+    return /\bsetAutoTypeSupport\s*\(\s*true\b/.test(source);
+}
+/**
+ * Return true when the given Java source contains a call that enables
+ * Jackson polymorphic type handling — either the legacy
+ * `enableDefaultTyping(...)` (deprecated in Jackson 2.10+ but still
+ * shipped) or the current `activateDefaultTyping(...)`.
+ *
+ * When neither is present in the file (and no `@JsonTypeInfo` is used
+ * on the target type — best-effort scan below), Jackson's default
+ * behaviour since 2.10 is safe: `ObjectMapper.readValue(json,
+ * targetType)` cannot instantiate arbitrary classes. The gate uses
+ * this to distinguish a genuine `readValue` sink from a safely-
+ * configured one.
+ *
+ * `@JsonTypeInfo` scan is intentionally file-local. A `@JsonTypeInfo`
+ * annotation on a target type in a different file would still allow
+ * polymorphic construction, but the engine treats that as unknown
+ * risk and preserves the sink (the gate only fires when the *file
+ * itself* provides positive evidence of a safe configuration).
+ */
+export function fileEnablesJacksonPolymorphism(source) {
+    if (!source)
+        return false;
+    if (/\benableDefaultTyping\s*\(/.test(source))
+        return true;
+    if (/\bactivateDefaultTyping\s*\(/.test(source))
+        return true;
+    // @JsonTypeInfo(use = Id.CLASS) / (use = Id.MINIMAL_CLASS) / (use = Id.NAME)
+    // enables polymorphic type handling on the annotated field or type.
+    // The exact `use` argument doesn't matter for the gate — any
+    // @JsonTypeInfo signals polymorphism is in play somewhere.
+    if (/@JsonTypeInfo\b/.test(source))
+        return true;
+    return false;
+}
+/**
+ * Return true when the given Java source contains a
+ * `new Yaml(new SafeConstructor(...))` or an equivalent hardened
+ * SnakeYAML constructor. When any `Yaml` instance in the file is
+ * built with the safe constructor family, we assume the file's
+ * `Yaml.load(...)` calls are safely configured; the gate then drops
+ * the deserialization sink for those calls.
+ *
+ * Recognised safe constructor classes (SnakeYAML 1.x + 2.x):
+ *   - SafeConstructor              — canonical safe loader
+ *   - SafeSchema (rare, YAML 1.2)  — safe schema-based loader
+ *
+ * Recognised safe factory calls (SnakeYAML 2.x LoaderOptions API):
+ *   - Yaml.load()   with a Constructor that extends SafeConstructor
+ *     (heuristic: any `SafeConstructor`-typed variable is safe)
+ *
+ * NOTE: A file that mixes `new Yaml(new SafeConstructor())` with
+ * `new Yaml(new Constructor(SomeClass.class))` on separate call sites
+ * would over-suppress the unsafe site. In practice this is rare (SAST
+ * teams write one wrapper per file), and the current sink-filter
+ * stage 9b handles the analogous compiled-template case with the same
+ * file-scoped heuristic. If it becomes a problem, tighten to
+ * receiver-scoped: check the specific `Yaml` receiver that carries
+ * the load() call.
+ */
+export function fileConfiguresSnakeYamlSafely(source) {
+    if (!source)
+        return false;
+    if (/\bnew\s+SafeConstructor\s*\(/.test(source))
+        return true;
+    // Explicit typed declaration form: `SafeConstructor sc = new SafeConstructor()`
+    // or `SafeConstructor sc = ...` used in a Yaml constructor.
+    if (/\bSafeConstructor\s+\w+\s*=/.test(source))
+        return true;
+    return false;
+}
+//# sourceMappingURL=dependency-versions.js.map

package/dist/analysis/dependency-versions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-versions.js","sourceRoot":"","sources":["../../src/analysis/dependency-versions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAcH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC1F,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;IACnE,CAAC;IAED,8DAA8D;IAC9D,mEAAmE;IACnE,kEAAkE;IAClE,oCAAoC;IACpC,MAAM,KAAK,GAAG,qCAAqC,CAAC;IACpD,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,2CAA2C,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,GAAG,KAAK,aAAa;YAAE,SAAS;QACpC,IAAI,GAAG,KAAK,UAAU,IAAI,GAAG,KAAK,WAAW;YAAE,SAAS;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,+DAA+D;QAC/D,2DAA2D;QAC3D,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,4DAA4D;IAC5D,+DAA+D;IAC/D,OAAO,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,8BAA8B,CAAC,MAAc;IAC3D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,6EAA6E;IAC7E,oEAAoE;IACpE,6DAA6D;IAC7D,2DAA2D;IAC3D,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,gFAAgF;IAChF,4DAA4D;IAC5D,IAAI,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/analysis/dfg-walk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dfg-walk.d.ts","sourceRoot":"","sources":["../../src/analysis/dfg-walk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE1D,MAAM,WAAW,kBAAkB;IACjC,kDAAkD;IAClD,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,oDAAoD;IACpD,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,yEAAyE;IACzE,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAC9C,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,OAAO,GAAE,mBAAwB,GAChC,kBAAkB,CA0CpB"}
+{"version":3,"file":"dfg-walk.d.ts","sourceRoot":"","sources":["../../src/analysis/dfg-walk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAE1D,MAAM,WAAW,kBAAkB;IACjC,kDAAkD;IAClD,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7B,oDAAoD;IACpD,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,yEAAyE;IACzE,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAoBD;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAC9C,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,EACpC,OAAO,GAAE,mBAAwB,GAChC,kBAAkB,CA0DpB"}

package/dist/analysis/dfg-walk.js

@@ -15,12 +15,33 @@
  *
  * Cycle-safe via a `visited` Set. Bounded via `maxHops` (default 32).
  */
+/**
+ * Per-file memo for `walkBackwardDefs`. Keyed on `chainsByToDef` identity,
+ * so results auto-clear when the caller moves to a new file (each file's
+ * `analyze()` builds a fresh `chainsByToDef` map, releasing the previous
+ * entry when nothing else references it). Inner key is
+ * `${startDefId}|${maxHops}` — same starting def + hop cap within a file
+ * returns the cached `BackwardWalkResult` directly.
+ *
+ * cognium-dev #254 T2#10: multiple sinks in a single file frequently walk
+ * back to the same source def; without a memo the DFG chain from that def
+ * is re-traversed once per sink. Result Sets are immutable (`ReadonlySet`
+ * via the return type), so sharing them across callers is safe.
+ */
+const walkBackwardDefsMemo = new WeakMap();
 /**
  * Bounded backward BFS from `startDefId` along `chainsByToDef`. Every def
  * reached is added to `lines` (via `defById`). Cycle-safe.
  */
 export function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
     const maxHops = options.maxHops ?? 32;
+    let perFile = walkBackwardDefsMemo.get(chainsByToDef);
+    if (perFile !== undefined) {
+        const key = `${startDefId}|${maxHops}`;
+        const hit = perFile.get(key);
+        if (hit !== undefined)
+            return hit;
+    }
     const visited = new Set();
     const lines = new Set();
     let hopCapReached = false;
@@ -54,6 +75,12 @@ export function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {
             queue.push(fromId);
         }
     }
-    return { visited, lines, hopCapReached };
+    const result = { visited, lines, hopCapReached };
+    if (perFile === undefined) {
+        perFile = new Map();
+        walkBackwardDefsMemo.set(chainsByToDef, perFile);
+    }
+    perFile.set(`${startDefId}|${maxHops}`, result);
+    return result;
 }
 //# sourceMappingURL=dfg-walk.js.map

package/dist/analysis/dfg-walk.js.map

@@ -1 +1 @@
-{"version":3,"file":"dfg-walk.js","sourceRoot":"","sources":["../../src/analysis/dfg-walk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAkBH;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAkB,EAClB,aAA8C,EAC9C,OAAoC,EACpC,UAA+B,EAAE;IAEjC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,aAAa,GAAG,KAAK,CAAC;IAE1B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxB,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAEzB,MAAM,KAAK,GAAa,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,IAAI,GAAG,CAAC,CAAC;IAEb,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC;YACpB,aAAa,GAAG,IAAI,CAAC;YACrB,MAAM;QACR,CAAC;QACD,IAAI,EAAE,CAAC;QAEP,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,EAAY,CAAC;QAC1C,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC;YAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,SAAS;YAElC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,OAAO,EAAE,CAAC;gBACZ,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"dfg-walk.js","sourceRoot":"","sources":["../../src/analysis/dfg-walk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAkBH;;;;;;;;;;;;GAYG;AACH,MAAM,oBAAoB,GAAG,IAAI,OAAO,EAGrC,CAAC;AAEJ;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAkB,EAClB,aAA8C,EAC9C,OAAoC,EACpC,UAA+B,EAAE;IAEjC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IAEtC,IAAI,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACtD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC;IACpC,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,aAAa,GAAG,KAAK,CAAC;IAE1B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAClD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACxB,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAEzB,MAAM,KAAK,GAAa,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,IAAI,GAAG,CAAC,CAAC;IAEb,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC;YACpB,aAAa,GAAG,IAAI,CAAC;YACrB,MAAM;QACR,CAAC;QACD,IAAI,EAAE,CAAC;QAEP,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,EAAY,CAAC;QAC1C,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ;YAAE,SAAS;QAExB,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC;YAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,SAAS;YAElC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,OAAO,EAAE,CAAC;gBACZ,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;IAErE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,GAAG,IAAI,GAAG,EAAE,CAAC;QACpB,oBAAoB,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,IAAI,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAEhD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/analysis/note-coalescer.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Note-level finding coalescer — cognium-dev #143.
+ *
+ * Groups `SastFinding[]` by `(file, line)` and folds any group of two or
+ * more `level === 'note'` findings into a single record. The primary
+ * finding is picked deterministically (lexicographic `rule_id`) and
+ * the co-located rule_ids are attached as `labels[]`. Every other
+ * (`level === 'warning' | 'error'`) finding passes through untouched.
+ *
+ * Empirical basis (from the OWASP-Benchmark instrumentation capture on
+ * cognium-dev#145, comment 2026-07-03):
+ *   - 5,481 `(file, line)` locations (31.3% of files) were hit by ≥ 2
+ *     distinct advisory rules.
+ *   - Most-common pairs:
+ *       missing-public-doc + naming-convention   × 2,740
+ *       missing-csp-frame-ancestors + missing-x-frame-options × 2,740
+ *       unused-variable + variable-shadowing     (co-located)
+ *   - HIGH-severity: 0 co-locations in the same capture.
+ *
+ * Design invariants:
+ *   - Additive: consumers that key on `rule_id` continue to work
+ *     unchanged. Consumers that surface every co-located rule read
+ *     both `rule_id` and `labels`.
+ *   - Level-gated: only fires when EVERY finding in the group has
+ *     `level === 'note'`. If any group member is `warning` or `error`,
+ *     the group passes through un-coalesced — visibility of higher-
+ *     severity findings is never diminished.
+ *   - Deterministic: sort by `rule_id` inside a group before picking
+ *     the primary, so the same input always produces the same output
+ *     (test-friendly, diff-friendly, cache-friendly).
+ *   - Message preservation: the primary finding's `message` is kept
+ *     verbatim. The `labels[]` field is the sole signal that more
+ *     rules co-located there.
+ *
+ * This is the MVP of the reopen. Follow-ups on #143 include a full
+ * instrumentation rerun on multi-severity data + a broader
+ * medium-severity coalesce policy — both deferred until the data
+ * capture is redone.
+ */
+import type { SastFinding } from '../types/index.js';
+/**
+ * Coalesce note-level findings at the same `(file, line)` location.
+ * Returns a new array; the input is not mutated.
+ */
+export declare function coalesceNoteLevelFindings(findings: readonly SastFinding[]): SastFinding[];
+//# sourceMappingURL=note-coalescer.d.ts.map

package/dist/analysis/note-coalescer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"note-coalescer.d.ts","sourceRoot":"","sources":["../../src/analysis/note-coalescer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,SAAS,WAAW,EAAE,GAC/B,WAAW,EAAE,CAkEf"}

package/dist/analysis/note-coalescer.js

@@ -0,0 +1,106 @@
+/**
+ * Note-level finding coalescer — cognium-dev #143.
+ *
+ * Groups `SastFinding[]` by `(file, line)` and folds any group of two or
+ * more `level === 'note'` findings into a single record. The primary
+ * finding is picked deterministically (lexicographic `rule_id`) and
+ * the co-located rule_ids are attached as `labels[]`. Every other
+ * (`level === 'warning' | 'error'`) finding passes through untouched.
+ *
+ * Empirical basis (from the OWASP-Benchmark instrumentation capture on
+ * cognium-dev#145, comment 2026-07-03):
+ *   - 5,481 `(file, line)` locations (31.3% of files) were hit by ≥ 2
+ *     distinct advisory rules.
+ *   - Most-common pairs:
+ *       missing-public-doc + naming-convention   × 2,740
+ *       missing-csp-frame-ancestors + missing-x-frame-options × 2,740
+ *       unused-variable + variable-shadowing     (co-located)
+ *   - HIGH-severity: 0 co-locations in the same capture.
+ *
+ * Design invariants:
+ *   - Additive: consumers that key on `rule_id` continue to work
+ *     unchanged. Consumers that surface every co-located rule read
+ *     both `rule_id` and `labels`.
+ *   - Level-gated: only fires when EVERY finding in the group has
+ *     `level === 'note'`. If any group member is `warning` or `error`,
+ *     the group passes through un-coalesced — visibility of higher-
+ *     severity findings is never diminished.
+ *   - Deterministic: sort by `rule_id` inside a group before picking
+ *     the primary, so the same input always produces the same output
+ *     (test-friendly, diff-friendly, cache-friendly).
+ *   - Message preservation: the primary finding's `message` is kept
+ *     verbatim. The `labels[]` field is the sole signal that more
+ *     rules co-located there.
+ *
+ * This is the MVP of the reopen. Follow-ups on #143 include a full
+ * instrumentation rerun on multi-severity data + a broader
+ * medium-severity coalesce policy — both deferred until the data
+ * capture is redone.
+ */
+/**
+ * Coalesce note-level findings at the same `(file, line)` location.
+ * Returns a new array; the input is not mutated.
+ */
+export function coalesceNoteLevelFindings(findings) {
+    if (findings.length < 2)
+        return [...findings];
+    // Bucket by (file, line). We keep original insertion order so
+    // higher-level findings interleaved with note-level findings are
+    // preserved in-place; only the note-level subset is folded.
+    const groups = new Map();
+    const order = [];
+    for (const f of findings) {
+        const key = `${f.file}\0${f.line}`;
+        const bucket = groups.get(key);
+        if (bucket) {
+            bucket.push(f);
+        }
+        else {
+            groups.set(key, [f]);
+            order.push(key);
+        }
+    }
+    const out = [];
+    for (const key of order) {
+        const bucket = groups.get(key);
+        if (bucket.length === 1) {
+            out.push(bucket[0]);
+            continue;
+        }
+        // Split by level. Only same-key finding groups where EVERY entry
+        // is `note` get coalesced; mixed-level groups pass through
+        // un-coalesced (visibility of warnings / errors preserved).
+        const allNote = bucket.every((f) => f.level === 'note');
+        if (!allNote) {
+            for (const f of bucket)
+                out.push(f);
+            continue;
+        }
+        // Also skip when every entry has the SAME rule_id — those are
+        // duplicate emissions, not multi-rule collisions. Passing them
+        // through preserves the existing dedup behaviour handled elsewhere
+        // (e.g. taint-matcher's sinkMap dedup). Coalescer's job is only
+        // multi-rule folding.
+        const uniqueRuleIds = new Set(bucket.map((f) => f.rule_id));
+        if (uniqueRuleIds.size < 2) {
+            for (const f of bucket)
+                out.push(f);
+            continue;
+        }
+        // Deterministic primary pick: lexicographic rule_id.
+        const sorted = [...bucket].sort((a, b) => a.rule_id.localeCompare(b.rule_id));
+        const primary = sorted[0];
+        const additional = sorted
+            .slice(1)
+            .map((f) => f.rule_id)
+            // Preserve `labels[]` carried on the primary or others from a
+            // prior coalesce (idempotent when re-run).
+            .concat(...sorted.map((f) => f.labels ?? []));
+        // Dedup labels; drop the primary's rule_id if it accidentally
+        // appears in a prior labels[] entry.
+        const uniqueLabels = Array.from(new Set(additional)).filter((l) => l !== primary.rule_id);
+        out.push({ ...primary, labels: uniqueLabels });
+    }
+    return out;
+}
+//# sourceMappingURL=note-coalescer.js.map

package/dist/analysis/note-coalescer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"note-coalescer.js","sourceRoot":"","sources":["../../src/analysis/note-coalescer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAIH;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAgC;IAEhC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;IAE9C,8DAA8D;IAC9D,iEAAiE;IACjE,4DAA4D;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QAChC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QAED,iEAAiE;QACjE,2DAA2D;QAC3D,4DAA4D;QAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpC,SAAS;QACX,CAAC;QAED,8DAA8D;QAC9D,+DAA+D;QAC/D,mEAAmE;QACnE,gEAAgE;QAChE,sBAAsB;QACtB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5D,IAAI,aAAa,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpC,SAAS;QACX,CAAC;QAED,qDAAqD;QACrD,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,UAAU,GAAG,MAAM;aACtB,KAAK,CAAC,CAAC,CAAC;aACR,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACtB,8DAA8D;YAC9D,2CAA2C;aAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QAChD,8DAA8D;QAC9D,qCAAqC;QACrC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CACzD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,OAAO,CAC7B,CAAC;QAEF,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/analysis/passes/deserialization-safety-gate-pass.d.ts

@@ -0,0 +1,58 @@
+/**
+ * DeserializationSafetyGatePass — cognium-dev #258
+ *
+ * Drops `deserialization` sinks whose surrounding library configuration
+ * renders them non-exploitable. Java-only in the MVP scope; runs after
+ * `SinkSemanticsPass` (so upstream registry gates have already fired)
+ * and before `TaintPropagationPass` (so flow generators never see the
+ * dropped sinks).
+ *
+ * Three sub-gates:
+ *
+ *   Gate A — Fastjson `*_noneautotype` build (manifest-based).
+ *     Reads `AnalyzerOptions.dependencyContext.java.pomXml`, resolves
+ *     the effective Fastjson coordinate, and drops
+ *     `JSON.parseObject` / `JSON.parse` deserialization sinks when the
+ *     version literally matches the hardened classifier — UNLESS the
+ *     file itself re-enables autotype via `setAutoTypeSupport(true)`
+ *     (in which case the pinned build's protection is defeated and the
+ *     sink continues to fire).
+ *
+ *   Gate B — Jackson polymorphism not enabled (in-file scan).
+ *     `ObjectMapper.readValue(json, targetType)` is safe on Jackson
+ *     ≥ 2.10 unless the file enables polymorphic type handling via
+ *     `enableDefaultTyping` / `activateDefaultTyping` or applies
+ *     `@JsonTypeInfo` somewhere. When none of those signals appear in
+ *     the file, drop `ObjectMapper.readValue` deserialization sinks.
+ *
+ *   Gate C — SnakeYAML `SafeConstructor` (in-file scan).
+ *     `new Yaml(new SafeConstructor())` gives a Yaml instance whose
+ *     `.load(...)` cannot instantiate arbitrary classes. When the file
+ *     builds any Yaml with SafeConstructor, drop `Yaml.load` /
+ *     `Yaml.loadAs` / `Yaml.loadAll` deserialization sinks.
+ *
+ * Each sub-gate is defensive: on missing signal it defaults to *do
+ * not drop* (the sink continues to fire). So a resolver bug can only
+ * ever regress toward the current over-firing behaviour, never toward
+ * a false negative.
+ *
+ * See `docs/PASSES.md` for the canonical pass registry entry.
+ */
+import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
+import type { DependencyContext } from '../../analyzer.js';
+export interface DeserializationSafetyGateResult {
+    /** Sinks dropped by Gate A (Fastjson noneautotype). */
+    droppedFastjson: number;
+    /** Sinks dropped by Gate B (Jackson polymorphism not enabled). */
+    droppedJackson: number;
+    /** Sinks dropped by Gate C (SnakeYAML SafeConstructor). */
+    droppedSnakeYaml: number;
+}
+export declare class DeserializationSafetyGatePass implements AnalysisPass<DeserializationSafetyGateResult> {
+    private readonly dependencyContext?;
+    readonly name = "deserialization-safety-gate";
+    readonly category: "security";
+    constructor(dependencyContext?: DependencyContext | undefined);
+    run(ctx: PassContext): DeserializationSafetyGateResult;
+}
+//# sourceMappingURL=deserialization-safety-gate-pass.d.ts.map

package/dist/analysis/passes/deserialization-safety-gate-pass.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deserialization-safety-gate-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/deserialization-safety-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAQ3D,MAAM,WAAW,+BAA+B;IAC9C,uDAAuD;IACvD,eAAe,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,cAAc,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAWD,qBAAa,6BACX,YAAW,YAAY,CAAC,+BAA+B,CAAC;IAK5C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAH/C,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;gBAEX,iBAAiB,CAAC,EAAE,iBAAiB,YAAA;IAElE,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,+BAA+B;CAoFvD"}

package/dist/analysis/passes/deserialization-safety-gate-pass.js

@@ -0,0 +1,122 @@
+/**
+ * DeserializationSafetyGatePass — cognium-dev #258
+ *
+ * Drops `deserialization` sinks whose surrounding library configuration
+ * renders them non-exploitable. Java-only in the MVP scope; runs after
+ * `SinkSemanticsPass` (so upstream registry gates have already fired)
+ * and before `TaintPropagationPass` (so flow generators never see the
+ * dropped sinks).
+ *
+ * Three sub-gates:
+ *
+ *   Gate A — Fastjson `*_noneautotype` build (manifest-based).
+ *     Reads `AnalyzerOptions.dependencyContext.java.pomXml`, resolves
+ *     the effective Fastjson coordinate, and drops
+ *     `JSON.parseObject` / `JSON.parse` deserialization sinks when the
+ *     version literally matches the hardened classifier — UNLESS the
+ *     file itself re-enables autotype via `setAutoTypeSupport(true)`
+ *     (in which case the pinned build's protection is defeated and the
+ *     sink continues to fire).
+ *
+ *   Gate B — Jackson polymorphism not enabled (in-file scan).
+ *     `ObjectMapper.readValue(json, targetType)` is safe on Jackson
+ *     ≥ 2.10 unless the file enables polymorphic type handling via
+ *     `enableDefaultTyping` / `activateDefaultTyping` or applies
+ *     `@JsonTypeInfo` somewhere. When none of those signals appear in
+ *     the file, drop `ObjectMapper.readValue` deserialization sinks.
+ *
+ *   Gate C — SnakeYAML `SafeConstructor` (in-file scan).
+ *     `new Yaml(new SafeConstructor())` gives a Yaml instance whose
+ *     `.load(...)` cannot instantiate arbitrary classes. When the file
+ *     builds any Yaml with SafeConstructor, drop `Yaml.load` /
+ *     `Yaml.loadAs` / `Yaml.loadAll` deserialization sinks.
+ *
+ * Each sub-gate is defensive: on missing signal it defaults to *do
+ * not drop* (the sink continues to fire). So a resolver bug can only
+ * ever regress toward the current over-firing behaviour, never toward
+ * a false negative.
+ *
+ * See `docs/PASSES.md` for the canonical pass registry entry.
+ */
+import { resolveFastjsonFromPom, fileReenablesFastjsonAutotype, fileEnablesJacksonPolymorphism, fileConfiguresSnakeYamlSafely, } from '../dependency-versions.js';
+const FASTJSON_METHODS = new Set(['parseObject', 'parse']);
+const FASTJSON_CLASSES = new Set(['JSON', 'JSONObject']);
+const JACKSON_METHODS = new Set(['readValue', 'convertValue', 'treeToValue']);
+const JACKSON_CLASSES = new Set(['ObjectMapper', 'ObjectReader']);
+const SNAKEYAML_METHODS = new Set(['load', 'loadAs', 'loadAll']);
+const SNAKEYAML_CLASSES = new Set(['Yaml']);
+export class DeserializationSafetyGatePass {
+    dependencyContext;
+    name = 'deserialization-safety-gate';
+    category = 'security';
+    constructor(dependencyContext) {
+        this.dependencyContext = dependencyContext;
+    }
+    run(ctx) {
+        const { graph, language, code } = ctx;
+        // Java-only for the MVP. Other languages (Python pyyaml, JS
+        // Deserialize, Rust bincode) can extend the gate on their own
+        // manifests in follow-up scopes.
+        if (language !== 'java') {
+            return { droppedFastjson: 0, droppedJackson: 0, droppedSnakeYaml: 0 };
+        }
+        // Same sink-source discovery as SinkSemanticsPass: prefer
+        // SinkFilterResult when the real pipeline has run, otherwise fall
+        // back to the graph's initial (usually empty) sink array so
+        // stand-alone unit-test harnesses can drive the gate directly.
+        const sinks = ctx.hasResult('sink-filter')
+            ? ctx.getResult('sink-filter').sinks
+            : graph.ir.taint.sinks;
+        // --- Gate A: Fastjson _noneautotype ------------------------------------
+        const pomXml = this.dependencyContext?.java?.pomXml;
+        const fastjson = pomXml ? resolveFastjsonFromPom(pomXml) : null;
+        const fastjsonHardened = fastjson?.noneAutotype === true &&
+            !fileReenablesFastjsonAutotype(code);
+        // --- Gate B: Jackson polymorphism ---------------------------------------
+        const jacksonSafe = !fileEnablesJacksonPolymorphism(code);
+        // --- Gate C: SnakeYAML SafeConstructor ----------------------------------
+        const snakeYamlSafe = fileConfiguresSnakeYamlSafely(code);
+        let droppedFastjson = 0;
+        let droppedJackson = 0;
+        let droppedSnakeYaml = 0;
+        const kept = sinks.filter((sink) => {
+            if (sink.type !== 'deserialization')
+                return true;
+            if (!sink.method)
+                return true;
+            // Gate A — Fastjson
+            if (fastjsonHardened &&
+                FASTJSON_METHODS.has(sink.method) &&
+                (sink.class === undefined || FASTJSON_CLASSES.has(sink.class))) {
+                droppedFastjson++;
+                return false;
+            }
+            // Gate B — Jackson
+            if (jacksonSafe &&
+                JACKSON_METHODS.has(sink.method) &&
+                sink.class !== undefined &&
+                JACKSON_CLASSES.has(sink.class)) {
+                droppedJackson++;
+                return false;
+            }
+            // Gate C — SnakeYAML
+            if (snakeYamlSafe &&
+                SNAKEYAML_METHODS.has(sink.method) &&
+                sink.class !== undefined &&
+                SNAKEYAML_CLASSES.has(sink.class)) {
+                droppedSnakeYaml++;
+                return false;
+            }
+            return true;
+        });
+        const totalDropped = droppedFastjson + droppedJackson + droppedSnakeYaml;
+        if (totalDropped > 0) {
+            // Mutate in place so downstream passes see the reduced sink set.
+            // Matches SinkSemanticsPass's contract.
+            sinks.length = 0;
+            sinks.push(...kept);
+        }
+        return { droppedFastjson, droppedJackson, droppedSnakeYaml };
+    }
+}
+//# sourceMappingURL=deserialization-safety-gate-pass.js.map

package/dist/analysis/passes/deserialization-safety-gate-pass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deserialization-safety-gate-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/deserialization-safety-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAMH,OAAO,EACL,sBAAsB,EACtB,6BAA6B,EAC7B,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAWnC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;AAEzD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;AAC9E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;AAElE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AACjE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE5C,MAAM,OAAO,6BAA6B;IAMX;IAHpB,IAAI,GAAG,6BAA6B,CAAC;IACrC,QAAQ,GAAG,UAAmB,CAAC;IAExC,YAA6B,iBAAqC;QAArC,sBAAiB,GAAjB,iBAAiB,CAAoB;IAAG,CAAC;IAEtE,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QAEtC,4DAA4D;QAC5D,8DAA8D;QAC9D,iCAAiC;QACjC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;QACxE,CAAC;QAED,0DAA0D;QAC1D,kEAAkE;QAClE,4DAA4D;QAC5D,+DAA+D;QAC/D,MAAM,KAAK,GAAgB,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC;YACrD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC,KAAK;YACtD,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAEzB,0EAA0E;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,MAAM,CAAC;QACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,MAAM,gBAAgB,GACpB,QAAQ,EAAE,YAAY,KAAK,IAAI;YAC/B,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAEvC,2EAA2E;QAC3E,MAAM,WAAW,GAAG,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;QAE1D,2EAA2E;QAC3E,MAAM,aAAa,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAE1D,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,gBAAgB,GAAG,CAAC,CAAC;QAEzB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;gBAAE,OAAO,IAAI,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAE9B,oBAAoB;YACpB,IACE,gBAAgB;gBAChB,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBACjC,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAC9D,CAAC;gBACD,eAAe,EAAE,CAAC;gBAClB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,mBAAmB;YACnB,IACE,WAAW;gBACX,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAChC,IAAI,CAAC,KAAK,KAAK,SAAS;gBACxB,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAC/B,CAAC;gBACD,cAAc,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,qBAAqB;YACrB,IACE,aAAa;gBACb,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAClC,IAAI,CAAC,KAAK,KAAK,SAAS;gBACxB,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EACjC,CAAC;gBACD,gBAAgB,EAAE,CAAC;gBACnB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,eAAe,GAAG,cAAc,GAAG,gBAAgB,CAAC;QACzE,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,iEAAiE;YACjE,wCAAwC;YACxC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC;IAC/D,CAAC;CACF"}

package/dist/analysis/passes/sink-filter-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sink-filter-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/sink-filter-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,MAAM,sBAAsB,CAAC;AACzG,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA8kB9E,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,sBAAsB;IACtB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,qBAAa,cAAe,YAAW,YAAY,CAAC,gBAAgB,CAAC;IACnE,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,gBAAgB;CAu8BxC;AAkRD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,KAAK,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AA4I1G,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EACjC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,EACxB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,EACrB,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC3B,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC/B,QAAQ,CAAC,EAAE,MAAM,GAChB,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CA6E5B;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EACjC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,EAC3C,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,GACvB,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CA2C5B"}
+{"version":3,"file":"sink-filter-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/sink-filter-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,MAAM,sBAAsB,CAAC;AACzG,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqmB9E,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,sBAAsB;IACtB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,qBAAa,cAAe,YAAW,YAAY,CAAC,gBAAgB,CAAC;IACnE,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,gBAAgB;CAk9BxC;AAkRD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,KAAK,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AA4I1G,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EACjC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,EACxB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,EACrB,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC3B,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC/B,QAAQ,CAAC,EAAE,MAAM,GAChB,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CA6E5B;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EACjC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,EAC3C,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,GACvB,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CA2C5B"}

package/dist/analysis/passes/sink-filter-pass.js

@@ -118,6 +118,28 @@ const DATA_PARSER_TYPES = new Set([
     'NumberFormat', 'DecimalFormat',
     'OptionParser', 'CmdLineParser',
 ]);
+// #257 — semantic gate promoting #155's name-based allowlist to an
+// inverse-denylist model. Any Java receiver type name ending in
+// `Parser` that is NOT in the eval denylist below is treated as a
+// domain-specific DSL / query / config parser (its `.parse()` result
+// flows into a data structure, not a script engine). The denylist
+// enumerates the receiver types whose `.parse()` is a real
+// code-evaluation sink and must continue to fire:
+//   - GroovyShell / GroovyClassLoader — Groovy runtime eval
+//   - ScriptEngine — JSR-223 script eval
+//   - CronParser — preserved from the explicit `code_injection` sink
+//     pattern in `config-loader.ts:1383` (schedule DSL parsing that
+//     was previously flagged as CWE-94 by design).
+// (Spring SpelExpressionParser / Thymeleaf StandardExpressionParser
+// end in `Parser` too, but their sinks use `method: 'parseExpression'`,
+// not `parse`, so stage 9a's `method === 'parse'` guard never touches
+// them regardless of what is in this set.)
+const JAVA_EVAL_PARSER_DENYLIST = new Set([
+    'GroovyShell',
+    'GroovyClassLoader',
+    'ScriptEngine',
+    'CronParser',
+]);
 // #156 — compiled-template classes; risk lives at the compile step,
 // not the render step.
 const COMPILED_TEMPLATE_TYPES = new Set([
@@ -819,10 +841,19 @@ export class SinkFilterPass {
                 const method = sink.method ?? receiverMatch?.[2];
                 // 9a — #155: non-script data parsers (commonmark, hutool, zxing,
                 // CLI arg parsers, SimpleDateFormat, DecimalFormat, …).
+                // #257: generalize to any `*Parser` type not in the eval
+                // denylist — Elide's `ExpressionParser`, in-house query DSLs,
+                // config-language parsers, etc. all follow this naming.
                 if (method === 'parse' && receiver) {
                     const recvType = resolveJavaReceiverType(receiver, sink.line, sourceLines);
-                    if (recvType && DATA_PARSER_TYPES.has(recvType))
-                        return false;
+                    if (recvType) {
+                        if (DATA_PARSER_TYPES.has(recvType))
+                            return false;
+                        if (recvType.endsWith('Parser') &&
+                            !JAVA_EVAL_PARSER_DENYLIST.has(recvType)) {
+                            return false;
+                        }
+                    }
                 }
                 // 9b — #156: compiled-template render/process. Risk lives at the
                 // compile step, not the render step.