circle-ir 3.180.0 → 3.182.0

package/dist/analysis/passes/python-receiver-taint-format-pass.d.ts

@@ -1,43 +1,59 @@
 /**
  * PythonReceiverTaintFormatPass — cognium-dev #264 (Python receiver-taint).
  *
- * Emits `format_string` (CWE-134) findings for Python `.format(...)`
- * calls whose RECEIVER is tainted. The pre-#264-Python-slice sink
- * patterns key exclusively on `arg_positions`, which cannot represent
- * a taint that lives on the call's receiver — Python's
- * `str.format(*args)` shape puts the format template AS the receiver,
- * not as an argument. Same is true of the `%`-operator shape
- * (`taintedFmt % args`), which lives entirely in a binary-operator
- * AST node, not a call.
- *
- * This pass takes the receiver-taint half of that gap by scanning
- * `graph.ir.calls` for `.format(...)` calls whose receiver appears in
- * the constant-propagation `tainted` set. On a hit, emits a direct
- * `format_string` finding at the call site (severity `medium`, level
- * `warning`).
- *
- * The `%`-operator half is genuinely bigger — needs a new AST scan
- * over `binary_operator` nodes with format-shape RHS detection — and
- * remains deferred on #264.
+ * Emits `format_string` (CWE-134) findings for Python `.format(...)` /
+ * `.format_map(...)` calls whose RECEIVER is a tainted variable. The
+ * generic sink-pattern schema keys exclusively on `arg_positions`,
+ * which cannot represent a taint that lives on the call's receiver —
+ * Python's `str.format(*args)` shape puts the format template AS the
+ * receiver, not as an argument.
+ *
+ * ## Coverage overlap with Sprint 86 (#189)
+ *
+ * `language-sources-pass.ts` already carries a Sprint 86 (#189)
+ * codepath that regex-matches `.format(` and `<name> %` shapes at
+ * file scope, gated on the presence of a Flask / Django / FastAPI
+ * request extractor in the source. **That path handles the common
+ * case.** This pass is intentionally a fallback for the shapes
+ * Sprint 86 misses:
+ *
+ *   - Files that don't reference `request.args` / `flask.request`
+ *     (Sprint 86 short-circuits and never runs).
+ *   - `.format_map(...)` calls — Sprint 86's regex only accepts
+ *     `.format\s*\(`, not `.format_map`. As of 3.181.0 Sprint 86's
+ *     regex is extended, but this pass is kept as belt-and-suspenders.
+ *   - Non-Flask taint sources (e.g. `os.environ`, `sys.stdin`) that
+ *     the plugin's `getBuiltinSources()` catches but Sprint 86's
+ *     framework-gate excludes.
+ *
+ * ## Taint signal
+ *
+ * The pass consumes `graph.ir.taint.sources` (populated by
+ * `TaintMatcherPass` before this pass runs). Each source has an
+ * optional `variable` field naming the identifier the source's
+ * return-value flows into. A `.format` call whose receiver name
+ * matches any source's `variable` name in the same file is
+ * treated as receiver-taint.
+ *
+ * (Prior to 3.181.0 this pass read `ConstantPropagatorResult.tainted`
+ * which is empty for many Python cases — the pass no-op'd whenever
+ * constant-propagation didn't populate the set. The switch to
+ * `graph.ir.taint.sources[].variable` matches the taint-tracker's
+ * own view of tainted identifiers and no longer depends on
+ * constant-propagation state.)
  *
  * Python-only. No-op on other languages.
  *
- * Pipeline slot: runs after `ConstantPropagationPass` so the
- * `tainted` set is populated. Any pass position after
- * `constant-propagation` is safe; placing near the sink-emission
- * chain keeps like-with-like grouped.
- *
- * Direct-finding emission (via `ctx.addFinding`) rather than
- * synthetic-sink emission because the format-string vulnerability
- * here doesn't need a taint-source → sink flow trace: the
- * `constant-propagation.tainted` set implicitly encodes that the
- * receiver traces back to a source. Emitting a sink would require
- * TaintPropagationPass to also understand receiver-taint, which
- * would be a much broader engine change.
+ * Direct-finding emission via `ctx.addFinding` rather than
+ * synthetic-sink emission because the source→sink relationship is
+ * already established: the taint source populated `variable` at
+ * assignment time; the format-call at the sink line consumes it
+ * directly. Emitting a sink would require TaintPropagationPass to
+ * also understand receiver-taint, a much broader engine change.
  */
 import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
 export interface PythonReceiverTaintFormatResult {
-    /** Number of `.format()` calls flagged this run. */
+    /** Number of `.format()` / `.format_map()` calls flagged this run. */
     findingsEmitted: number;
 }
 export declare class PythonReceiverTaintFormatPass implements AnalysisPass<PythonReceiverTaintFormatResult> {

package/dist/analysis/passes/python-receiver-taint-format-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"python-receiver-taint-format-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/python-receiver-taint-format-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E,MAAM,WAAW,+BAA+B;IAC9C,oDAAoD;IACpD,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,6BACX,YAAW,YAAY,CAAC,+BAA+B,CAAC;IAExD,QAAQ,CAAC,IAAI,kCAAkC;IAC/C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,+BAA+B;CAsDvD"}
+{"version":3,"file":"python-receiver-taint-format-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/python-receiver-taint-format-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAE9E,MAAM,WAAW,+BAA+B;IAC9C,sEAAsE;IACtE,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,6BACX,YAAW,YAAY,CAAC,+BAA+B,CAAC;IAExD,QAAQ,CAAC,IAAI,kCAAkC;IAC/C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,+BAA+B;CA6EvD"}

package/dist/analysis/passes/python-receiver-taint-format-pass.js

@@ -1,39 +1,55 @@
 /**
  * PythonReceiverTaintFormatPass — cognium-dev #264 (Python receiver-taint).
  *
- * Emits `format_string` (CWE-134) findings for Python `.format(...)`
- * calls whose RECEIVER is tainted. The pre-#264-Python-slice sink
- * patterns key exclusively on `arg_positions`, which cannot represent
- * a taint that lives on the call's receiver — Python's
- * `str.format(*args)` shape puts the format template AS the receiver,
- * not as an argument. Same is true of the `%`-operator shape
- * (`taintedFmt % args`), which lives entirely in a binary-operator
- * AST node, not a call.
+ * Emits `format_string` (CWE-134) findings for Python `.format(...)` /
+ * `.format_map(...)` calls whose RECEIVER is a tainted variable. The
+ * generic sink-pattern schema keys exclusively on `arg_positions`,
+ * which cannot represent a taint that lives on the call's receiver —
+ * Python's `str.format(*args)` shape puts the format template AS the
+ * receiver, not as an argument.
  *
- * This pass takes the receiver-taint half of that gap by scanning
- * `graph.ir.calls` for `.format(...)` calls whose receiver appears in
- * the constant-propagation `tainted` set. On a hit, emits a direct
- * `format_string` finding at the call site (severity `medium`, level
- * `warning`).
+ * ## Coverage overlap with Sprint 86 (#189)
  *
- * The `%`-operator half is genuinely bigger — needs a new AST scan
- * over `binary_operator` nodes with format-shape RHS detection — and
- * remains deferred on #264.
+ * `language-sources-pass.ts` already carries a Sprint 86 (#189)
+ * codepath that regex-matches `.format(` and `<name> %` shapes at
+ * file scope, gated on the presence of a Flask / Django / FastAPI
+ * request extractor in the source. **That path handles the common
+ * case.** This pass is intentionally a fallback for the shapes
+ * Sprint 86 misses:
  *
- * Python-only. No-op on other languages.
+ *   - Files that don't reference `request.args` / `flask.request`
+ *     (Sprint 86 short-circuits and never runs).
+ *   - `.format_map(...)` calls — Sprint 86's regex only accepts
+ *     `.format\s*\(`, not `.format_map`. As of 3.181.0 Sprint 86's
+ *     regex is extended, but this pass is kept as belt-and-suspenders.
+ *   - Non-Flask taint sources (e.g. `os.environ`, `sys.stdin`) that
+ *     the plugin's `getBuiltinSources()` catches but Sprint 86's
+ *     framework-gate excludes.
+ *
+ * ## Taint signal
+ *
+ * The pass consumes `graph.ir.taint.sources` (populated by
+ * `TaintMatcherPass` before this pass runs). Each source has an
+ * optional `variable` field naming the identifier the source's
+ * return-value flows into. A `.format` call whose receiver name
+ * matches any source's `variable` name in the same file is
+ * treated as receiver-taint.
  *
- * Pipeline slot: runs after `ConstantPropagationPass` so the
- * `tainted` set is populated. Any pass position after
- * `constant-propagation` is safe; placing near the sink-emission
- * chain keeps like-with-like grouped.
+ * (Prior to 3.181.0 this pass read `ConstantPropagatorResult.tainted`
+ * which is empty for many Python cases — the pass no-op'd whenever
+ * constant-propagation didn't populate the set. The switch to
+ * `graph.ir.taint.sources[].variable` matches the taint-tracker's
+ * own view of tainted identifiers and no longer depends on
+ * constant-propagation state.)
+ *
+ * Python-only. No-op on other languages.
  *
- * Direct-finding emission (via `ctx.addFinding`) rather than
- * synthetic-sink emission because the format-string vulnerability
- * here doesn't need a taint-source → sink flow trace: the
- * `constant-propagation.tainted` set implicitly encodes that the
- * receiver traces back to a source. Emitting a sink would require
- * TaintPropagationPass to also understand receiver-taint, which
- * would be a much broader engine change.
+ * Direct-finding emission via `ctx.addFinding` rather than
+ * synthetic-sink emission because the source→sink relationship is
+ * already established: the taint source populated `variable` at
+ * assignment time; the format-call at the sink line consumes it
+ * directly. Emitting a sink would require TaintPropagationPass to
+ * also understand receiver-taint, a much broader engine change.
  */
 export class PythonReceiverTaintFormatPass {
     name = 'python-receiver-taint-format';
@@ -42,33 +58,54 @@ export class PythonReceiverTaintFormatPass {
         if (ctx.language !== 'python') {
             return { findingsEmitted: 0 };
         }
-        const { calls, meta } = ctx.graph.ir;
-        const constProp = ctx.getResult('constant-propagation');
-        const tainted = constProp.tainted;
+        const { calls, meta, taint } = ctx.graph.ir;
+        // Collect the set of variable names that hold tainted values,
+        // as seen by the taint-matcher (from `getBuiltinSources()`
+        // patterns with `return_tainted: true`). This is a smaller, more
+        // targeted signal than constant-propagation's `tainted` set —
+        // and, crucially, it's populated for Python files even when
+        // Sprint 86's Flask/Django/FastAPI regex gate short-circuits.
+        const taintedVarNames = new Set();
+        for (const s of taint.sources) {
+            if (typeof s.variable === 'string' && s.variable.length > 0) {
+                taintedVarNames.add(s.variable);
+            }
+        }
+        if (taintedVarNames.size === 0) {
+            return { findingsEmitted: 0 };
+        }
+        // Track (line, receiver) pairs we've already flagged this file
+        // to avoid emitting a second finding when Sprint 86 also fired
+        // on the same call — the two paths produce different `id` values
+        // but describe the same vulnerability at the same location.
+        const seen = new Set();
         let count = 0;
         for (const call of calls) {
-            if (call.method_name !== 'format')
+            // `format` and `format_map` share the receiver-taint risk shape.
+            // Both put the format template as the receiver rather than an
+            // argument. `format_map` accepts a mapping instead of *args but
+            // the attribute-leak / DoS surface is identical.
+            if (call.method_name !== 'format' && call.method_name !== 'format_map')
                 continue;
             const receiver = call.receiver;
             if (!receiver)
                 continue;
-            // Only bare-identifier receivers can be looked up in the tainted
-            // set. Skip complex receivers (`obj.attr.format()`, `f(x).format()`)
-            // — those don't correspond to a variable name the taint tracker
-            // would have on file. Recall may improve later with attribute-
-            // chain resolution, but the direct-identifier form is the common
-            // shape for user-controlled templates.
+            // Only bare-identifier receivers can be looked up in the
+            // tainted-source set. Skip complex receivers
+            // (`obj.attr.format()`, `f(x).format()`, `"literal".format()`)
+            // — those either don't correspond to a taintable variable name
+            // or need attribute-chain resolution the taint tracker doesn't
+            // currently do.
             if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(receiver))
                 continue;
-            // constant-propagation stores both scoped (`method:var`) and
-            // unscoped forms in the tainted set. Check both.
-            const scopedName = call.in_method
-                ? `${call.in_method}:${receiver}`
-                : receiver;
-            if (!tainted.has(receiver) && !tainted.has(scopedName))
+            if (!taintedVarNames.has(receiver))
+                continue;
+            const seenKey = `${call.location.line}:${receiver}`;
+            if (seen.has(seenKey))
                 continue;
+            seen.add(seenKey);
             ctx.addFinding({
-                id: `format_string-${meta.file}-${call.location.line}-${receiver}`,
+                id: `format_string-${meta.file}-${call.location.line}-${receiver}-${call.method_name}`,
                 pass: this.name,
                 category: 'security',
                 rule_id: 'format_string',
@@ -76,7 +113,8 @@ export class PythonReceiverTaintFormatPass {
                 severity: 'medium',
                 level: 'warning',
                 message: `Format-string vulnerability: the format template \`${receiver}\` ` +
-                    `is tainted (traces back to a taint source). Attacker can leak ` +
+                    `is tainted (traces back to a taint source) and used as the ` +
+                    `receiver of \`${call.method_name}(...)\`. Attacker can leak ` +
                     `object attributes via \`{obj.__class__.__mro__[…]}\` chains or ` +
                     `crash the process via unbounded specifiers. Use a literal ` +
                     `format string and pass user input as an argument instead.`,

package/dist/analysis/passes/python-receiver-taint-format-pass.js.map

@@ -1 +1 @@
-{"version":3,"file":"python-receiver-taint-format-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/python-receiver-taint-format-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAUH,MAAM,OAAO,6BAA6B;IAG/B,IAAI,GAAG,8BAA8B,CAAC;IACtC,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QAChC,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAC7B,sBAAsB,CACvB,CAAC;QACF,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;QAElC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,WAAW,KAAK,QAAQ;gBAAE,SAAS;YAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;YAC/B,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAExB,iEAAiE;YACjE,qEAAqE;YACrE,gEAAgE;YAChE,+DAA+D;YAC/D,iEAAiE;YACjE,uCAAuC;YACvC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAEzD,6DAA6D;YAC7D,iDAAiD;YACjD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS;gBAC/B,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,QAAQ,EAAE;gBACjC,CAAC,CAAC,QAAQ,CAAC;YACb,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,SAAS;YAEjE,GAAG,CAAC,UAAU,CAAC;gBACb,EAAE,EAAE,iBAAiB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,EAAE;gBAClE,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,eAAe;gBACxB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,SAAS;gBAChB,OAAO,EACL,sDAAsD,QAAQ,KAAK;oBACnE,gEAAgE;oBAChE,iEAAiE;oBACjE,4DAA4D;oBAC5D,2DAA2D;gBAC7D,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;aACzB,CAAC,CAAC;YACH,KAAK,EAAE,CAAC;QACV,CAAC;QAED,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IACpC,CAAC;CACF"}
+{"version":3,"file":"python-receiver-taint-format-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/python-receiver-taint-format-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AASH,MAAM,OAAO,6BAA6B;IAG/B,IAAI,GAAG,8BAA8B,CAAC;IACtC,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QAChC,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAE5C,8DAA8D;QAC9D,2DAA2D;QAC3D,iEAAiE;QACjE,8DAA8D;QAC9D,4DAA4D;QAC5D,8DAA8D;QAC9D,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5D,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;QAChC,CAAC;QAED,+DAA+D;QAC/D,+DAA+D;QAC/D,iEAAiE;QACjE,4DAA4D;QAC5D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAE/B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,iEAAiE;YACjE,8DAA8D;YAC9D,gEAAgE;YAChE,iDAAiD;YACjD,IAAI,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,KAAK,YAAY;gBAAE,SAAS;YAEjF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;YAC/B,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAExB,yDAAyD;YACzD,6CAA6C;YAC7C,+DAA+D;YAC/D,+DAA+D;YAC/D,+DAA+D;YAC/D,gBAAgB;YAChB,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAEzD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAE7C,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YAChC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAElB,GAAG,CAAC,UAAU,CAAC;gBACb,EAAE,EAAE,iBAAiB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,IAAI,IAAI,CAAC,WAAW,EAAE;gBACtF,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,eAAe;gBACxB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,SAAS;gBAChB,OAAO,EACL,sDAAsD,QAAQ,KAAK;oBACnE,6DAA6D;oBAC7D,iBAAiB,IAAI,CAAC,WAAW,6BAA6B;oBAC9D,iEAAiE;oBACjE,4DAA4D;oBAC5D,2DAA2D;gBAC7D,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI;aACzB,CAAC,CAAC;YACH,KAAK,EAAE,CAAC;QACV,CAAC;QAED,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IACpC,CAAC;CACF"}

package/dist/analysis/passes/taint-propagation-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"taint-propagation-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/taint-propagation-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAU9E,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAED,qBAAa,oBAAqB,YAAW,YAAY,CAAC,0BAA0B,CAAC;IACnF,QAAQ,CAAC,IAAI,uBAAuB;IACpC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,0BAA0B;CAwXlD"}
+{"version":3,"file":"taint-propagation-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/taint-propagation-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAU9E,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAED,qBAAa,oBAAqB,YAAW,YAAY,CAAC,0BAA0B,CAAC;IACnF,QAAQ,CAAC,IAAI,uBAAuB;IACpC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,0BAA0B;CA8YlD"}

package/dist/analysis/passes/taint-propagation-pass.js

@@ -163,6 +163,21 @@ export class TaintPropagationPass {
                 continue;
             pushIfNew(f);
         }
+        // Supplement: Go package-scope var flows (cognium-dev #243).
+        //
+        // Cross-function taint through package-level state that the per-function
+        // DFG cannot see. Text-scans the file for:
+        //   - Package-scope var declarations at the top level
+        //   - Assignments to those vars where the RHS is tainted (source or
+        //     already-tainted derivative)
+        //   - Sink calls anywhere that reference the same var name
+        // Emits one flow per (write-line, sink-line) pair. Language-gated to Go.
+        if (ctx.language === 'go' && typeof ctx.code === 'string') {
+            const goGlobalFlows = detectGoPackageGlobalFlows(ctx.code, calls, sources, sinks, constProp.unreachableLines) ?? [];
+            for (const f of goGlobalFlows) {
+                pushIfNew(f);
+            }
+        }
         // Sprint 9 #58.1 — final pass: drop any flow whose source variable was
         // explicitly marked sanitized by a guard (e.g. regex-allowlist).
         // Applied to ALL flow generators (DFG-built and the four supplements)
@@ -581,6 +596,149 @@ function isInJavaSanitizedMethod(code, types, sinkLine, sinkType) {
 // ---------------------------------------------------------------------------
 // Helpers (moved verbatim from analyzer.ts)
 // ---------------------------------------------------------------------------
+/**
+ * cognium-dev #243 — Go package-scope var flows.
+ *
+ * Detects the store-then-read shape where taint enters a package-level var
+ * in one function and is consumed by a sink in another function. The
+ * per-function DFG cannot link these because each function scope is
+ * independent; this text-scan supplement covers the common case.
+ *
+ * Heuristic (Go-specific):
+ *   - Package-scope defs: top-level `var X ...` / `X = ...` at column 0.
+ *   - Write: any `X = ...` (or `X = expr` inside a function) whose RHS
+ *     contains an identifier that is either a taint source's variable or
+ *     matches a direct source pattern (r.URL.Query()..., r.Header.Get..., …).
+ *   - Read: any sink whose arg expression references `X` at word boundary.
+ *
+ * Bounded conservatism: does not fire when the local scope shadows the
+ * package var (short-var-decl `X := ...`) — that path stays local.
+ */
+function detectGoPackageGlobalFlows(code, _calls, sources, sinks, unreachableLines) {
+    const flows = [];
+    if (!code || sinks.length === 0)
+        return flows;
+    const lines = code.split('\n');
+    const packageVars = new Set();
+    // Step 1: collect package-scope var names. Recognize:
+    //   var X type
+    //   var X = ...
+    //   var ( X ...  Y ... )
+    let inVarBlock = false;
+    for (const line of lines) {
+        const stripped = line.replace(/\s+$/, '');
+        if (!stripped)
+            continue;
+        // Only consider column-0 lines (package scope). Function bodies indent.
+        if (/^[ \t]/.test(line)) {
+            // Multi-line var block runs continue even indented, but the `var (`
+            // opener is at column 0 and we already flagged inVarBlock.
+            if (inVarBlock) {
+                const m = stripped.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s+/);
+                if (m)
+                    packageVars.add(m[1]);
+                if (/^\s*\)/.test(stripped))
+                    inVarBlock = false;
+            }
+            continue;
+        }
+        if (/^var\s*\(/.test(stripped)) {
+            inVarBlock = true;
+            continue;
+        }
+        if (inVarBlock && /^\)/.test(stripped)) {
+            inVarBlock = false;
+            continue;
+        }
+        const varOne = stripped.match(/^var\s+([A-Za-z_][A-Za-z0-9_]*)\b/);
+        if (varOne)
+            packageVars.add(varOne[1]);
+    }
+    if (packageVars.size === 0)
+        return flows;
+    // Step 2: for each package var, find writes with tainted RHS.
+    // A write is `X = ...` (assignment) — NOT `X := ...` (short-var-decl,
+    // which shadows the package var with a local).
+    const sourceVarNames = new Set();
+    for (const s of sources) {
+        if (typeof s.variable === 'string' && s.variable.length > 0) {
+            sourceVarNames.add(s.variable);
+        }
+    }
+    // Recognize a small set of direct Go source patterns on the RHS.
+    const GO_SOURCE_RE = /\b(r\.(?:URL\.Query|Form|PostForm|Header|Cookie|Body)|mux\.Vars|c\.(?:Query|Param|PostForm|GetHeader|Cookie)|ctx\.(?:Query|Param|PostForm|GetHeader|Cookie))\b/;
+    const writes = [];
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (unreachableLines.has(i + 1))
+            continue;
+        // Skip short-var-decl to preserve local shadowing.
+        if (/:=/.test(line))
+            continue;
+        const m = line.match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.+)$/);
+        if (!m)
+            continue;
+        const [, lhs, rhs] = m;
+        if (!packageVars.has(lhs))
+            continue;
+        // RHS tainted if it references a source var or matches a direct pattern.
+        let taintedBy = null;
+        if (GO_SOURCE_RE.test(rhs)) {
+            const src = sources.find(s => s.line === i + 1);
+            taintedBy = src
+                ? { line: src.line, type: src.type }
+                : { line: i + 1, type: 'http_param' };
+        }
+        else {
+            for (const v of sourceVarNames) {
+                const re = new RegExp(`(?<![A-Za-z0-9_$])${v.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![A-Za-z0-9_$])`);
+                if (re.test(rhs)) {
+                    const src = sources.find(s => s.variable === v);
+                    if (src) {
+                        taintedBy = { line: src.line, type: src.type };
+                        break;
+                    }
+                }
+            }
+        }
+        if (!taintedBy)
+            continue;
+        writes.push({ varName: lhs, line: i + 1, sourceLine: taintedBy.line, sourceType: taintedBy.type });
+    }
+    if (writes.length === 0)
+        return flows;
+    // Step 3: for each sink, if any arg expression references a written var,
+    // emit a flow from the source through the write to the sink.
+    for (const sink of sinks) {
+        if (unreachableLines.has(sink.line))
+            continue;
+        // Look at the sink line's text for identifier-boundary matches.
+        const sinkLineText = lines[sink.line - 1] ?? '';
+        if (!sinkLineText)
+            continue;
+        for (const w of writes) {
+            if (w.line >= sink.line)
+                continue; // write must precede sink lexically
+            const re = new RegExp(`(?<![A-Za-z0-9_$])${w.varName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![A-Za-z0-9_$])`);
+            if (!re.test(sinkLineText))
+                continue;
+            flows.push({
+                source_line: w.sourceLine,
+                sink_line: sink.line,
+                source_type: w.sourceType,
+                sink_type: sink.type,
+                path: [
+                    { variable: w.varName, line: w.sourceLine, type: 'source' },
+                    { variable: w.varName, line: w.line, type: 'assignment' },
+                    { variable: w.varName, line: sink.line, type: 'sink' },
+                ],
+                confidence: 0.9,
+                sanitized: false,
+            });
+        }
+    }
+    return flows;
+}
 function detectCollectionFlows(calls, sources, sinks, taintedVars, unreachableLines, code, types) {
     const flows = [];
     const callsByLine = new Map();