circle-ir 3.177.0 → 3.179.0

package/dist/analysis/note-coalescer.js

@@ -0,0 +1,106 @@
+/**
+ * Note-level finding coalescer — cognium-dev #143.
+ *
+ * Groups `SastFinding[]` by `(file, line)` and folds any group of two or
+ * more `level === 'note'` findings into a single record. The primary
+ * finding is picked deterministically (lexicographic `rule_id`) and
+ * the co-located rule_ids are attached as `labels[]`. Every other
+ * (`level === 'warning' | 'error'`) finding passes through untouched.
+ *
+ * Empirical basis (from the OWASP-Benchmark instrumentation capture on
+ * cognium-dev#145, comment 2026-07-03):
+ *   - 5,481 `(file, line)` locations (31.3% of files) were hit by ≥ 2
+ *     distinct advisory rules.
+ *   - Most-common pairs:
+ *       missing-public-doc + naming-convention   × 2,740
+ *       missing-csp-frame-ancestors + missing-x-frame-options × 2,740
+ *       unused-variable + variable-shadowing     (co-located)
+ *   - HIGH-severity: 0 co-locations in the same capture.
+ *
+ * Design invariants:
+ *   - Additive: consumers that key on `rule_id` continue to work
+ *     unchanged. Consumers that surface every co-located rule read
+ *     both `rule_id` and `labels`.
+ *   - Level-gated: only fires when EVERY finding in the group has
+ *     `level === 'note'`. If any group member is `warning` or `error`,
+ *     the group passes through un-coalesced — visibility of higher-
+ *     severity findings is never diminished.
+ *   - Deterministic: sort by `rule_id` inside a group before picking
+ *     the primary, so the same input always produces the same output
+ *     (test-friendly, diff-friendly, cache-friendly).
+ *   - Message preservation: the primary finding's `message` is kept
+ *     verbatim. The `labels[]` field is the sole signal that more
+ *     rules co-located there.
+ *
+ * This is the MVP of the reopen. Follow-ups on #143 include a full
+ * instrumentation rerun on multi-severity data + a broader
+ * medium-severity coalesce policy — both deferred until the data
+ * capture is redone.
+ */
+/**
+ * Coalesce note-level findings at the same `(file, line)` location.
+ * Returns a new array; the input is not mutated.
+ */
+export function coalesceNoteLevelFindings(findings) {
+    if (findings.length < 2)
+        return [...findings];
+    // Bucket by (file, line). We keep original insertion order so
+    // higher-level findings interleaved with note-level findings are
+    // preserved in-place; only the note-level subset is folded.
+    const groups = new Map();
+    const order = [];
+    for (const f of findings) {
+        const key = `${f.file}\0${f.line}`;
+        const bucket = groups.get(key);
+        if (bucket) {
+            bucket.push(f);
+        }
+        else {
+            groups.set(key, [f]);
+            order.push(key);
+        }
+    }
+    const out = [];
+    for (const key of order) {
+        const bucket = groups.get(key);
+        if (bucket.length === 1) {
+            out.push(bucket[0]);
+            continue;
+        }
+        // Split by level. Only same-key finding groups where EVERY entry
+        // is `note` get coalesced; mixed-level groups pass through
+        // un-coalesced (visibility of warnings / errors preserved).
+        const allNote = bucket.every((f) => f.level === 'note');
+        if (!allNote) {
+            for (const f of bucket)
+                out.push(f);
+            continue;
+        }
+        // Also skip when every entry has the SAME rule_id — those are
+        // duplicate emissions, not multi-rule collisions. Passing them
+        // through preserves the existing dedup behaviour handled elsewhere
+        // (e.g. taint-matcher's sinkMap dedup). Coalescer's job is only
+        // multi-rule folding.
+        const uniqueRuleIds = new Set(bucket.map((f) => f.rule_id));
+        if (uniqueRuleIds.size < 2) {
+            for (const f of bucket)
+                out.push(f);
+            continue;
+        }
+        // Deterministic primary pick: lexicographic rule_id.
+        const sorted = [...bucket].sort((a, b) => a.rule_id.localeCompare(b.rule_id));
+        const primary = sorted[0];
+        const additional = sorted
+            .slice(1)
+            .map((f) => f.rule_id)
+            // Preserve `labels[]` carried on the primary or others from a
+            // prior coalesce (idempotent when re-run).
+            .concat(...sorted.map((f) => f.labels ?? []));
+        // Dedup labels; drop the primary's rule_id if it accidentally
+        // appears in a prior labels[] entry.
+        const uniqueLabels = Array.from(new Set(additional)).filter((l) => l !== primary.rule_id);
+        out.push({ ...primary, labels: uniqueLabels });
+    }
+    return out;
+}
+//# sourceMappingURL=note-coalescer.js.map

package/dist/analysis/note-coalescer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"note-coalescer.js","sourceRoot":"","sources":["../../src/analysis/note-coalescer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAIH;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAgC;IAEhC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC;IAE9C,8DAA8D;IAC9D,iEAAiE;IACjE,4DAA4D;IAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAyB,CAAC;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QAChC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QAED,iEAAiE;QACjE,2DAA2D;QAC3D,4DAA4D;QAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpC,SAAS;QACX,CAAC;QAED,8DAA8D;QAC9D,+DAA+D;QAC/D,mEAAmE;QACnE,gEAAgE;QAChE,sBAAsB;QACtB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5D,IAAI,aAAa,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACpC,SAAS;QACX,CAAC;QAED,qDAAqD;QACrD,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,UAAU,GAAG,MAAM;aACtB,KAAK,CAAC,CAAC,CAAC;aACR,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YACtB,8DAA8D;YAC9D,2CAA2C;aAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;QAChD,8DAA8D;QAC9D,qCAAqC;QACrC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CACzD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,OAAO,CAC7B,CAAC;QAEF,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/analysis/passes/deserialization-safety-gate-pass.d.ts

@@ -0,0 +1,60 @@
+/**
+ * DeserializationSafetyGatePass — cognium-dev #258
+ *
+ * Drops `deserialization` sinks whose surrounding library configuration
+ * renders them non-exploitable. Java-only in the MVP scope; runs after
+ * `SinkSemanticsPass` (so upstream registry gates have already fired)
+ * and before `TaintPropagationPass` (so flow generators never see the
+ * dropped sinks).
+ *
+ * Three sub-gates:
+ *
+ *   Gate A — Fastjson `*_noneautotype` build (manifest-based).
+ *     Reads `AnalyzerOptions.dependencyContext.java.pomXml`, resolves
+ *     the effective Fastjson coordinate, and drops
+ *     `JSON.parseObject` / `JSON.parse` deserialization sinks when the
+ *     version literally matches the hardened classifier — UNLESS the
+ *     file itself re-enables autotype via `setAutoTypeSupport(true)`
+ *     (in which case the pinned build's protection is defeated and the
+ *     sink continues to fire).
+ *
+ *   Gate B — Jackson polymorphism not enabled (in-file scan).
+ *     `ObjectMapper.readValue(json, targetType)` is safe on Jackson
+ *     ≥ 2.10 unless the file enables polymorphic type handling via
+ *     `enableDefaultTyping` / `activateDefaultTyping` or applies
+ *     `@JsonTypeInfo` somewhere. When none of those signals appear in
+ *     the file, drop `ObjectMapper.readValue` deserialization sinks.
+ *
+ *   Gate C — SnakeYAML `SafeConstructor` (in-file scan).
+ *     `new Yaml(new SafeConstructor())` gives a Yaml instance whose
+ *     `.load(...)` cannot instantiate arbitrary classes. When the file
+ *     builds any Yaml with SafeConstructor, drop `Yaml.load` /
+ *     `Yaml.loadAs` / `Yaml.loadAll` deserialization sinks.
+ *
+ * Each sub-gate is defensive: on missing signal it defaults to *do
+ * not drop* (the sink continues to fire). So a resolver bug can only
+ * ever regress toward the current over-firing behaviour, never toward
+ * a false negative.
+ *
+ * See `docs/PASSES.md` for the canonical pass registry entry.
+ */
+import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
+import type { DependencyContext } from '../../analyzer.js';
+export interface DeserializationSafetyGateResult {
+    /** Sinks dropped by Gate A (Fastjson noneautotype). */
+    droppedFastjson: number;
+    /** Sinks dropped by Gate B (Jackson polymorphism not enabled). */
+    droppedJackson: number;
+    /** Sinks dropped by Gate C (SnakeYAML SafeConstructor). */
+    droppedSnakeYaml: number;
+    /** Sinks dropped by Gate D (Python PyYAML ≥ 6.0 default-safe). */
+    droppedPyYaml: number;
+}
+export declare class DeserializationSafetyGatePass implements AnalysisPass<DeserializationSafetyGateResult> {
+    private readonly dependencyContext?;
+    readonly name = "deserialization-safety-gate";
+    readonly category: "security";
+    constructor(dependencyContext?: DependencyContext | undefined);
+    run(ctx: PassContext): DeserializationSafetyGateResult;
+}
+//# sourceMappingURL=deserialization-safety-gate-pass.d.ts.map

package/dist/analysis/passes/deserialization-safety-gate-pass.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deserialization-safety-gate-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/deserialization-safety-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAY3D,MAAM,WAAW,+BAA+B;IAC9C,uDAAuD;IACvD,eAAe,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,cAAc,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,gBAAgB,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,aAAa,EAAE,MAAM,CAAC;CACvB;AAeD,qBAAa,6BACX,YAAW,YAAY,CAAC,+BAA+B,CAAC;IAK5C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAH/C,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;gBAEX,iBAAiB,CAAC,EAAE,iBAAiB,YAAA;IAElE,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,+BAA+B;CAiIvD"}

package/dist/analysis/passes/deserialization-safety-gate-pass.js

@@ -0,0 +1,165 @@
+/**
+ * DeserializationSafetyGatePass — cognium-dev #258
+ *
+ * Drops `deserialization` sinks whose surrounding library configuration
+ * renders them non-exploitable. Java-only in the MVP scope; runs after
+ * `SinkSemanticsPass` (so upstream registry gates have already fired)
+ * and before `TaintPropagationPass` (so flow generators never see the
+ * dropped sinks).
+ *
+ * Three sub-gates:
+ *
+ *   Gate A — Fastjson `*_noneautotype` build (manifest-based).
+ *     Reads `AnalyzerOptions.dependencyContext.java.pomXml`, resolves
+ *     the effective Fastjson coordinate, and drops
+ *     `JSON.parseObject` / `JSON.parse` deserialization sinks when the
+ *     version literally matches the hardened classifier — UNLESS the
+ *     file itself re-enables autotype via `setAutoTypeSupport(true)`
+ *     (in which case the pinned build's protection is defeated and the
+ *     sink continues to fire).
+ *
+ *   Gate B — Jackson polymorphism not enabled (in-file scan).
+ *     `ObjectMapper.readValue(json, targetType)` is safe on Jackson
+ *     ≥ 2.10 unless the file enables polymorphic type handling via
+ *     `enableDefaultTyping` / `activateDefaultTyping` or applies
+ *     `@JsonTypeInfo` somewhere. When none of those signals appear in
+ *     the file, drop `ObjectMapper.readValue` deserialization sinks.
+ *
+ *   Gate C — SnakeYAML `SafeConstructor` (in-file scan).
+ *     `new Yaml(new SafeConstructor())` gives a Yaml instance whose
+ *     `.load(...)` cannot instantiate arbitrary classes. When the file
+ *     builds any Yaml with SafeConstructor, drop `Yaml.load` /
+ *     `Yaml.loadAs` / `Yaml.loadAll` deserialization sinks.
+ *
+ * Each sub-gate is defensive: on missing signal it defaults to *do
+ * not drop* (the sink continues to fire). So a resolver bug can only
+ * ever regress toward the current over-firing behaviour, never toward
+ * a false negative.
+ *
+ * See `docs/PASSES.md` for the canonical pass registry entry.
+ */
+import { resolveFastjsonFromPom, resolveFastjsonFromGradle, resolvePyYamlFromRequirements, resolvePyYamlFromPyproject, fileHasUnsafePyYamlLoader, fileReenablesFastjsonAutotype, fileEnablesJacksonPolymorphism, fileConfiguresSnakeYamlSafely, } from '../dependency-versions.js';
+const FASTJSON_METHODS = new Set(['parseObject', 'parse']);
+const FASTJSON_CLASSES = new Set(['JSON', 'JSONObject']);
+const JACKSON_METHODS = new Set(['readValue', 'convertValue', 'treeToValue']);
+const JACKSON_CLASSES = new Set(['ObjectMapper', 'ObjectReader']);
+const SNAKEYAML_METHODS = new Set(['load', 'loadAs', 'loadAll']);
+const SNAKEYAML_CLASSES = new Set(['Yaml']);
+// Python PyYAML gate (Gate D — cognium-dev #261 Python slice).
+const PYYAML_METHODS = new Set(['load']);
+const PYYAML_CLASSES = new Set(['yaml']);
+export class DeserializationSafetyGatePass {
+    dependencyContext;
+    name = 'deserialization-safety-gate';
+    category = 'security';
+    constructor(dependencyContext) {
+        this.dependencyContext = dependencyContext;
+    }
+    run(ctx) {
+        const { graph, language, code } = ctx;
+        // Java + Python for the MVP. Other languages (JS Deserialize,
+        // Rust bincode) can extend the gate on their own manifests in
+        // follow-up scopes.
+        if (language !== 'java' && language !== 'python') {
+            return { droppedFastjson: 0, droppedJackson: 0, droppedSnakeYaml: 0, droppedPyYaml: 0 };
+        }
+        // Same sink-source discovery as SinkSemanticsPass: prefer
+        // SinkFilterResult when the real pipeline has run, otherwise fall
+        // back to the graph's initial (usually empty) sink array so
+        // stand-alone unit-test harnesses can drive the gate directly.
+        const sinks = ctx.hasResult('sink-filter')
+            ? ctx.getResult('sink-filter').sinks
+            : graph.ir.taint.sinks;
+        // --- Gate A: Fastjson _noneautotype ------------------------------------
+        // Consult pom.xml first; fall back to build.gradle when pom does
+        // not resolve. Both manifests may be supplied by a caller that
+        // scans a multi-build project; either one indicating the hardened
+        // classifier is sufficient to drop the sink.
+        const pomXml = this.dependencyContext?.java?.pomXml;
+        const buildGradle = this.dependencyContext?.java?.buildGradle;
+        const fastjson = (pomXml ? resolveFastjsonFromPom(pomXml) : null) ??
+            (buildGradle ? resolveFastjsonFromGradle(buildGradle) : null);
+        const fastjsonHardened = fastjson?.noneAutotype === true &&
+            !fileReenablesFastjsonAutotype(code);
+        // --- Gate B: Jackson polymorphism ---------------------------------------
+        const jacksonSafe = !fileEnablesJacksonPolymorphism(code);
+        // --- Gate C: SnakeYAML SafeConstructor ----------------------------------
+        const snakeYamlSafe = fileConfiguresSnakeYamlSafely(code);
+        // --- Gate D: PyYAML ≥ 6.0 (Python) --------------------------------------
+        // Under pyyaml ≥ 6.0, `yaml.load(x)` without an explicit `Loader=`
+        // keyword arg raises TypeError (safe-by-default); callers that pass
+        // `Loader=SafeLoader` are safe; callers that pass an unsafe Loader
+        // (`Loader=Loader` / `UnsafeLoader` / `FullLoader`) are still
+        // dangerous regardless of the version pin — those need per-call
+        // inspection to preserve.
+        const requirementsTxt = this.dependencyContext?.python?.requirementsTxt;
+        const pyprojectToml = this.dependencyContext?.python?.pyprojectToml;
+        const pyYaml = (requirementsTxt ? resolvePyYamlFromRequirements(requirementsTxt) : null) ??
+            (pyprojectToml ? resolvePyYamlFromPyproject(pyprojectToml) : null);
+        const pyYamlSafeByDefault = pyYaml?.safeByDefault === true;
+        // Lazy: only split source lines when we actually need per-call
+        // inspection (i.e. gate D is active and could fire).
+        let sourceLines = null;
+        const getSourceLines = () => {
+            if (sourceLines === null)
+                sourceLines = code.split('\n');
+            return sourceLines;
+        };
+        let droppedFastjson = 0;
+        let droppedJackson = 0;
+        let droppedSnakeYaml = 0;
+        let droppedPyYaml = 0;
+        const kept = sinks.filter((sink) => {
+            if (sink.type !== 'deserialization')
+                return true;
+            if (!sink.method)
+                return true;
+            // Gate A — Fastjson
+            if (fastjsonHardened &&
+                FASTJSON_METHODS.has(sink.method) &&
+                (sink.class === undefined || FASTJSON_CLASSES.has(sink.class))) {
+                droppedFastjson++;
+                return false;
+            }
+            // Gate B — Jackson
+            if (jacksonSafe &&
+                JACKSON_METHODS.has(sink.method) &&
+                sink.class !== undefined &&
+                JACKSON_CLASSES.has(sink.class)) {
+                droppedJackson++;
+                return false;
+            }
+            // Gate C — SnakeYAML
+            if (snakeYamlSafe &&
+                SNAKEYAML_METHODS.has(sink.method) &&
+                sink.class !== undefined &&
+                SNAKEYAML_CLASSES.has(sink.class)) {
+                droppedSnakeYaml++;
+                return false;
+            }
+            // Gate D — PyYAML (Python). `sink.class` may be `undefined` for
+            // Python: unlike Java, Python calls do not carry receiver-type
+            // resolution into the CallInfo, so the taint-matcher's sinkMap
+            // assigns undefined for the class field. Accept undefined OR
+            // exact-`'yaml'` (mirrors Gate A's Fastjson check).
+            if (language === 'python' &&
+                pyYamlSafeByDefault &&
+                PYYAML_METHODS.has(sink.method) &&
+                (sink.class === undefined || PYYAML_CLASSES.has(sink.class)) &&
+                !fileHasUnsafePyYamlLoader(getSourceLines(), sink.line)) {
+                droppedPyYaml++;
+                return false;
+            }
+            return true;
+        });
+        const totalDropped = droppedFastjson + droppedJackson + droppedSnakeYaml + droppedPyYaml;
+        if (totalDropped > 0) {
+            // Mutate in place so downstream passes see the reduced sink set.
+            // Matches SinkSemanticsPass's contract.
+            sinks.length = 0;
+            sinks.push(...kept);
+        }
+        return { droppedFastjson, droppedJackson, droppedSnakeYaml, droppedPyYaml };
+    }
+}
+//# sourceMappingURL=deserialization-safety-gate-pass.js.map

package/dist/analysis/passes/deserialization-safety-gate-pass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deserialization-safety-gate-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/deserialization-safety-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAMH,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,6BAA6B,EAC7B,0BAA0B,EAC1B,yBAAyB,EACzB,6BAA6B,EAC7B,8BAA8B,EAC9B,6BAA6B,GAC9B,MAAM,2BAA2B,CAAC;AAanC,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;AAEzD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;AAC9E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;AAElE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AACjE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE5C,+DAA+D;AAC/D,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACzC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAEzC,MAAM,OAAO,6BAA6B;IAMX;IAHpB,IAAI,GAAG,6BAA6B,CAAC;IACrC,QAAQ,GAAG,UAAmB,CAAC;IAExC,YAA6B,iBAAqC;QAArC,sBAAiB,GAAjB,iBAAiB,CAAoB;IAAG,CAAC;IAEtE,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QAEtC,8DAA8D;QAC9D,8DAA8D;QAC9D,oBAAoB;QACpB,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjD,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;QAC1F,CAAC;QAED,0DAA0D;QAC1D,kEAAkE;QAClE,4DAA4D;QAC5D,+DAA+D;QAC/D,MAAM,KAAK,GAAgB,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC;YACrD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC,KAAK;YACtD,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAEzB,0EAA0E;QAC1E,iEAAiE;QACjE,+DAA+D;QAC/D,kEAAkE;QAClE,6CAA6C;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,MAAM,CAAC;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,EAAE,IAAI,EAAE,WAAW,CAAC;QAC9D,MAAM,QAAQ,GACZ,CAAC,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAChD,CAAC,WAAW,CAAC,CAAC,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,gBAAgB,GACpB,QAAQ,EAAE,YAAY,KAAK,IAAI;YAC/B,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAEvC,2EAA2E;QAC3E,MAAM,WAAW,GAAG,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC;QAE1D,2EAA2E;QAC3E,MAAM,aAAa,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC;QAE1D,2EAA2E;QAC3E,mEAAmE;QACnE,oEAAoE;QACpE,mEAAmE;QACnE,8DAA8D;QAC9D,gEAAgE;QAChE,0BAA0B;QAC1B,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,eAAe,CAAC;QACxE,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,aAAa,CAAC;QACpE,MAAM,MAAM,GACV,CAAC,eAAe,CAAC,CAAC,CAAC,6BAA6B,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACzE,CAAC,aAAa,CAAC,CAAC,CAAC,0BAA0B,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,mBAAmB,GAAG,MAAM,EAAE,aAAa,KAAK,IAAI,CAAC;QAC3D,+DAA+D;QAC/D,qDAAqD;QACrD,IAAI,WAAW,GAAoB,IAAI,CAAC;QACxC,MAAM,cAAc,GAAG,GAAa,EAAE;YACpC,IAAI,WAAW,KAAK,IAAI;gBAAE,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzD,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC;QAEF,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,gBAAgB,GAAG,CAAC,CAAC;QACzB,IAAI,aAAa,GAAG,CAAC,CAAC;QAEtB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;gBAAE,OAAO,IAAI,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAE9B,oBAAoB;YACpB,IACE,gBAAgB;gBAChB,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBACjC,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAC9D,CAAC;gBACD,eAAe,EAAE,CAAC;gBAClB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,mBAAmB;YACnB,IACE,WAAW;gBACX,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAChC,IAAI,CAAC,KAAK,KAAK,SAAS;gBACxB,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAC/B,CAAC;gBACD,cAAc,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,qBAAqB;YACrB,IACE,aAAa;gBACb,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAClC,IAAI,CAAC,KAAK,KAAK,SAAS;gBACxB,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EACjC,CAAC;gBACD,gBAAgB,EAAE,CAAC;gBACnB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,gEAAgE;YAChE,+DAA+D;YAC/D,+DAA+D;YAC/D,6DAA6D;YAC7D,oDAAoD;YACpD,IACE,QAAQ,KAAK,QAAQ;gBACrB,mBAAmB;gBACnB,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC/B,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC5D,CAAC,yBAAyB,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EACvD,CAAC;gBACD,aAAa,EAAE,CAAC;gBAChB,OAAO,KAAK,CAAC;YACf,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,eAAe,GAAG,cAAc,GAAG,gBAAgB,GAAG,aAAa,CAAC;QACzF,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,iEAAiE;YACjE,wCAAwC;YACxC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC;IAC9E,CAAC;CACF"}

package/dist/analysis/taint-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"taint-matcher.d.ts","sourceRoot":"","sources":["../../src/analysis/taint-matcher.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAgB,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAkB,KAAK,EAAwB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAClK,OAAO,KAAK,EAAE,WAAW,EAAiB,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACpG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAgC7E;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EAAE,EACjB,KAAK,EAAE,QAAQ,EAAE,EACjB,MAAM,GAAE,WAAgC,EACxC,aAAa,CAAC,EAAE,qBAAqB,EACrC,QAAQ,CAAC,EAAE,iBAAiB,EAC5B,IAAI,CAAC,EAAE,MAAM,GACZ,KAAK,CASP;AAqID;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EAAE,EACtB,KAAK,EAAE,SAAS,EAAE,EAClB,IAAI,EAAE,MAAM,GACX,IAAI,CAYN;AA02ED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,WAAW,GACnB,OAAO,CAET"}
+{"version":3,"file":"taint-matcher.d.ts","sourceRoot":"","sources":["../../src/analysis/taint-matcher.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAgB,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAkB,KAAK,EAAwB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAClK,OAAO,KAAK,EAAE,WAAW,EAAiB,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACpG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAgC7E;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EAAE,EACjB,KAAK,EAAE,QAAQ,EAAE,EACjB,MAAM,GAAE,WAAgC,EACxC,aAAa,CAAC,EAAE,qBAAqB,EACrC,QAAQ,CAAC,EAAE,iBAAiB,EAC5B,IAAI,CAAC,EAAE,MAAM,GACZ,KAAK,CASP;AAqID;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EAAE,EACtB,KAAK,EAAE,SAAS,EAAE,EAClB,IAAI,EAAE,MAAM,GACX,IAAI,CAYN;AA43ED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,WAAW,GACnB,OAAO,CAET"}

package/dist/analysis/taint-matcher.js

@@ -2407,6 +2407,24 @@ function calculateSinkConfidence(call, pattern) {
     if (pattern.class && call.receiver) {
         if (receiverMightBeClass(call.receiver, pattern.class)) {
             confidence += 0.1;
+            // cognium-dev #260 — EXACT-match tiebreaker. When two patterns
+            // for the same `(method, cwe)` both accept the receiver — one
+            // exactly (e.g. class: 'Ctx' vs receiver 'Ctx') and one via
+            // `receiverMightBeClass` fuzzy heuristics (e.g. class: 'Context'
+            // vs receiver 'Ctx' via the includes/40%-length rule at
+            // taint-matcher.ts:2366) — the fuzzy match used to win the
+            // `sinkMap` dedup slot when it iterated first (both had the same
+            // 0.9 confidence). The extra boost here guarantees the exact-
+            // match pattern's `arg_positions` are the ones emitted on the
+            // final sink. Fixes the fiber `c.Redirect(next)` shape whose
+            // sink was emitted with the gin `class: 'Context'` pattern's
+            // `arg_positions: [1]` instead of fiber `class: 'Ctx'`'s
+            // `arg_positions: [0]`, dropping the taint flow silently.
+            const receiverLc = call.receiver.toLowerCase();
+            const classLc = pattern.class.toLowerCase();
+            if (call.receiver === pattern.class || receiverLc === classLc) {
+                confidence += 0.05;
+            }
         }
     }
     // Higher confidence for critical severity patterns