circle-ir 3.185.0 → 3.187.0

package/dist/browser/circle-ir.js

@@ -13239,10 +13239,49 @@ var DEFAULT_SINKS = [
 var DEFAULT_SANITIZERS = [
   // SQL Injection - proper parameter binding sanitizes input
   // Note: prepareStatement alone is NOT a sanitizer - it's a sink when used with concatenation
+  //
+  // Full PreparedStatement setter coverage (cognium-dev #213 seventh slice).
+  // Every JDBC PreparedStatement.setXxx binds a parameter placeholder via
+  // the driver wire protocol — the SQL text is fixed, only the value slot
+  // varies. Prior coverage was setString/setInt/setLong only; extending
+  // to the full JDBC 4.x setter surface so real Java apps using date/
+  // decimal/object/binary bindings credit as sanitized.
   { method: "setString", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setNString", class: "PreparedStatement", removes: ["sql_injection"] },
   { method: "setInt", class: "PreparedStatement", removes: ["sql_injection"] },
   { method: "setLong", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setShort", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setByte", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setBoolean", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setDouble", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setFloat", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setBigDecimal", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setBytes", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setDate", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setTime", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setTimestamp", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setObject", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setNull", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setArray", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setBlob", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setClob", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setNClob", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setRef", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setRowId", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setSQLXML", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setURL", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setBinaryStream", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setCharacterStream", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setAsciiStream", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setNCharacterStream", class: "PreparedStatement", removes: ["sql_injection"] },
+  // JPA / Hibernate Query.setParameter — covered above; add TypedQuery
+  // (same interface but distinct type name).
   { method: "setParameter", class: "Query", removes: ["sql_injection"] },
+  { method: "setParameter", class: "TypedQuery", removes: ["sql_injection"] },
+  // Spring JdbcTemplate `NamedParameterJdbcTemplate.update / queryForObject`
+  // parameterized shapes use SqlParameterSource.addValue — the addValue
+  // call binds the parameter safely.
+  { method: "addValue", class: "MapSqlParameterSource", removes: ["sql_injection"] },
   { annotation: "Param", removes: ["sql_injection"] },
   // XSS
   { method: "escapeHtml", removes: ["xss"] },
@@ -13268,6 +13307,48 @@ var DEFAULT_SANITIZERS = [
   // Rust askama auto-escapes
   { method: "encodeForJavaScript", removes: ["xss"] },
   { method: "encodeForCSS", removes: ["xss"] },
+  // Additional Java XSS sanitizers (cognium-dev #213 seventh slice).
+  //
+  //   Guava `HtmlEscapers.htmlEscaper().escape(x)` — the `.escape` call
+  //     on the returned Escaper is caught by the generic `escape` rule
+  //     above, but explicit registration makes intent clear.
+  //   Spring `HtmlUtils.htmlEscape(x)` — htmlEscape already covered
+  //     above (bare method name).
+  //   Apache Commons Text `StringEscapeUtils.escapeJson / escapeXml11 /
+  //     escapeEcmaScript / escapeCsv / escapeXsi`.
+  //   OWASP HTML Sanitizer `PolicyFactory.sanitize(html)`.
+  { method: "escape", class: "Escaper", removes: ["xss"] },
+  { method: "escape", class: "HtmlEscapers", removes: ["xss"] },
+  { method: "escapeJson", class: "StringEscapeUtils", removes: ["xss"] },
+  { method: "escapeEcmaScript", class: "StringEscapeUtils", removes: ["xss"] },
+  { method: "escapeXml11", class: "StringEscapeUtils", removes: ["xss"] },
+  { method: "escapeXml10", class: "StringEscapeUtils", removes: ["xss"] },
+  { method: "escapeCsv", class: "StringEscapeUtils", removes: ["xss"] },
+  { method: "escapeXsi", class: "StringEscapeUtils", removes: ["xss"] },
+  { method: "escapeJava", class: "StringEscapeUtils", removes: ["xss"] },
+  // Bare escapeJson / escapeEcmaScript / escapeCsv aliases — common
+  // when statically imported.
+  { method: "escapeJson", removes: ["xss"] },
+  { method: "escapeEcmaScript", removes: ["xss"] },
+  { method: "escapeCsv", removes: ["xss"] },
+  // OWASP HTML sanitizer (`com.googlecode.owasp-java-html-sanitizer`).
+  { method: "sanitize", class: "PolicyFactory", removes: ["xss"] },
+  // Java Base64 / Hex / MessageDigest — encoded output is binary-safe
+  // (cognium-dev #213 seventh slice). None of these carry attacker
+  // shell/SQL/HTML metacharacters through the encoding — Base64 emits
+  // [A-Za-z0-9+/=], Hex emits [0-9a-f], MessageDigest.digest returns
+  // opaque bytes usually toHex/toBase64-encoded downstream.
+  { method: "encodeToString", class: "Encoder", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
+  { method: "encode", class: "Encoder", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
+  { method: "encodeHexString", class: "Hex", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
+  { method: "digest", class: "MessageDigest", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
+  // Bare aliases for encoder chains — `Base64.getEncoder().encodeToString(x)`
+  // has a call-expression receiver (`Base64.getEncoder()`) that the Java IR
+  // rarely resolves to `Encoder`. Same story for `Hex.encodeHexString(x)`
+  // when Hex is imported. These bare-method names are dominated by their
+  // encoding use in practice; false-positive risk is low.
+  { method: "encodeToString", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
+  { method: "encodeHexString", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
   // cognium-dev #249 3.162.0: `open_redirect` restored to the URL-encoder
   // sanitizer cluster. Sprint 82 (#189) reclassified `sendRedirect` from
   // `ssrf` → `open_redirect` (config-loader.ts:1296-1299) without updating
@@ -13397,6 +13478,91 @@ var DEFAULT_SANITIZERS = [
   // Command injection - shell escaping
   { method: "quote", class: "shell", removes: ["command_injection"] },
   { method: "escape", class: "shell-escape", removes: ["command_injection"] },
+  // JS/Node — additional XSS/HTML encoders (cognium-dev #213 sixth slice).
+  //
+  //   he.encode(x) / he.escape(x)               — `he` npm package
+  //   sanitizeHtml(x)                            — `sanitize-html` npm
+  //   xss(x) / filterXSS(x)                      — `xss` npm (Yahoo)
+  //   escapeHtml(x) / escapeHTML(x)              — common bare helpers
+  //   entities.encode(x) / entities.escape(x)    — `entities` npm
+  //   xssFilters.inHTMLData(x) / inHTMLComment(x) / uriInHTMLData(x)
+  //                                              — `xss-filters` npm (Yahoo)
+  //
+  // `external_taint_escape` is included alongside `xss` — the CWE-668
+  // fallback fires on any call receiving tainted data that the engine
+  // does not otherwise recognize. Since these functions are explicitly
+  // registered as sanitizers (they PURIFY input), they should also
+  // suppress the fallback so a `res.send(sanitizeHtml(x))` flow does
+  // not report an external-taint-escape at the sanitizer call itself.
+  { method: "encode", class: "he", removes: ["xss", "external_taint_escape"] },
+  { method: "escape", class: "he", removes: ["xss", "external_taint_escape"] },
+  { method: "sanitizeHtml", removes: ["xss", "external_taint_escape"] },
+  { method: "xss", removes: ["xss", "external_taint_escape"] },
+  { method: "filterXSS", removes: ["xss", "external_taint_escape"] },
+  { method: "escapeHtml", removes: ["xss", "external_taint_escape"] },
+  { method: "escapeHTML", removes: ["xss", "external_taint_escape"] },
+  { method: "encode", class: "entities", removes: ["xss", "external_taint_escape"] },
+  { method: "escape", class: "entities", removes: ["xss", "external_taint_escape"] },
+  // xss-filters: context-specific helpers, all XSS-safe by construction.
+  { method: "inHTMLData", class: "xssFilters", removes: ["xss", "external_taint_escape"] },
+  { method: "inHTMLComment", class: "xssFilters", removes: ["xss", "external_taint_escape"] },
+  { method: "uriInHTMLData", class: "xssFilters", removes: ["xss", "external_taint_escape"] },
+  // JS/Node — SQL escaping (in addition to the mysql class above).
+  //
+  //   SqlString.escape / .escapeId               — `sqlstring` npm (raw
+  //                                                escape used by mysql /
+  //                                                node-mysql2 drivers)
+  //   pgFormat(sql, ...args) / format(bare)      — `pg-format` npm
+  //   SQL.raw / SQL(bare)                        — `sql-template-strings`
+  //
+  // Bare `format` is intentionally NOT registered — it collides with
+  // string.format-style helpers unrelated to SQL. Callers should use the
+  // qualified form.
+  { method: "escape", class: "SqlString", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "escapeId", class: "SqlString", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "format", class: "SqlString", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "format", class: "pgFormat", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "ident", class: "pgFormat", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "literal", class: "pgFormat", removes: ["sql_injection", "external_taint_escape"] },
+  // JS/Node — crypto.randomUUID() and Node's crypto.randomBytes(...)toString()
+  // produce cryptographically-secure typed strings that cannot carry
+  // attacker-injected payload. Registered as type coercion.
+  { method: "randomUUID", class: "crypto", removes: ["sql_injection", "nosql_injection", "command_injection", "path_traversal", "code_injection", "xss"] },
+  // Bare `randomUUID()` alias — `import { randomUUID } from 'crypto'`.
+  { method: "randomUUID", removes: ["sql_injection", "nosql_injection", "command_injection", "path_traversal", "code_injection", "xss"] },
+  // JS/Node — URL construction. `new URL(x, base)` (constructor-call
+  // matched by method_name === 'URL') and `URLSearchParams.toString()`
+  // safely encode components for URL context.
+  { method: "toString", class: "URLSearchParams", removes: ["ssrf", "open_redirect", "xss"] },
+  // Go — additional sanitizers (cognium-dev #213 sixth slice).
+  //
+  //   regexp.QuoteMeta(x)  — mirror of Python re.escape; strips regex
+  //                          metacharacters so downstream compile/match
+  //                          cannot execute attacker-crafted patterns.
+  //   bluemonday.Sanitize  — dominant Go HTML sanitizer library
+  //                          (`microcosm-cc/bluemonday`). Called on a
+  //                          Policy value returned by UGCPolicy() /
+  //                          StrictPolicy() / etc. Match by method name
+  //                          alone — Policy is the receiver type.
+  //   net.ParseIP(x)        — validates the input is a well-formed IP;
+  //                          returns nil for bad input (developer must
+  //                          check, but the sanitizer only applies when
+  //                          the parsed IP flows onward).
+  //   sql.Named(name, val) — parameterized query binding.
+  { method: "QuoteMeta", class: "regexp", removes: ["redos", "code_injection", "external_taint_escape"] },
+  { method: "Sanitize", class: "bluemonday", removes: ["xss", "external_taint_escape"] },
+  { method: "Sanitize", class: "Policy", removes: ["xss", "external_taint_escape"] },
+  // Bare `Sanitize` — the receiver is a Policy variable (`p := bluemonday.UGCPolicy(); p.Sanitize(x)`).
+  // `Policy` class-matching only fires when the IR resolves the receiver type;
+  // since Go DFG rarely propagates the type of a locally-assigned variable
+  // from a package factory call, we also register the bare method name.
+  // Narrow FP risk: `Sanitize` bare is uncommon outside bluemonday context.
+  { method: "Sanitize", removes: ["xss", "external_taint_escape"] },
+  { method: "SanitizeBytes", class: "bluemonday", removes: ["xss", "external_taint_escape"] },
+  { method: "SanitizeBytes", class: "Policy", removes: ["xss", "external_taint_escape"] },
+  { method: "SanitizeBytes", removes: ["xss", "external_taint_escape"] },
+  { method: "ParseIP", class: "net", removes: ["ssrf", "command_injection", "path_traversal", "external_taint_escape"] },
+  { method: "Named", class: "sql", removes: ["sql_injection", "external_taint_escape"] },
   // =========================================================================
   // Python Sanitizers
   // =========================================================================

package/dist/core/circle-ir-core.cjs

@@ -12634,10 +12634,49 @@ var DEFAULT_SINKS = [
 var DEFAULT_SANITIZERS = [
   // SQL Injection - proper parameter binding sanitizes input
   // Note: prepareStatement alone is NOT a sanitizer - it's a sink when used with concatenation
+  //
+  // Full PreparedStatement setter coverage (cognium-dev #213 seventh slice).
+  // Every JDBC PreparedStatement.setXxx binds a parameter placeholder via
+  // the driver wire protocol — the SQL text is fixed, only the value slot
+  // varies. Prior coverage was setString/setInt/setLong only; extending
+  // to the full JDBC 4.x setter surface so real Java apps using date/
+  // decimal/object/binary bindings credit as sanitized.
   { method: "setString", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setNString", class: "PreparedStatement", removes: ["sql_injection"] },
   { method: "setInt", class: "PreparedStatement", removes: ["sql_injection"] },
   { method: "setLong", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setShort", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setByte", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setBoolean", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setDouble", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setFloat", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setBigDecimal", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setBytes", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setDate", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setTime", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setTimestamp", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setObject", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setNull", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setArray", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setBlob", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setClob", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setNClob", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setRef", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setRowId", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setSQLXML", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setURL", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setBinaryStream", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setCharacterStream", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setAsciiStream", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setNCharacterStream", class: "PreparedStatement", removes: ["sql_injection"] },
+  // JPA / Hibernate Query.setParameter — covered above; add TypedQuery
+  // (same interface but distinct type name).
   { method: "setParameter", class: "Query", removes: ["sql_injection"] },
+  { method: "setParameter", class: "TypedQuery", removes: ["sql_injection"] },
+  // Spring JdbcTemplate `NamedParameterJdbcTemplate.update / queryForObject`
+  // parameterized shapes use SqlParameterSource.addValue — the addValue
+  // call binds the parameter safely.
+  { method: "addValue", class: "MapSqlParameterSource", removes: ["sql_injection"] },
   { annotation: "Param", removes: ["sql_injection"] },
   // XSS
   { method: "escapeHtml", removes: ["xss"] },
@@ -12663,6 +12702,48 @@ var DEFAULT_SANITIZERS = [
   // Rust askama auto-escapes
   { method: "encodeForJavaScript", removes: ["xss"] },
   { method: "encodeForCSS", removes: ["xss"] },
+  // Additional Java XSS sanitizers (cognium-dev #213 seventh slice).
+  //
+  //   Guava `HtmlEscapers.htmlEscaper().escape(x)` — the `.escape` call
+  //     on the returned Escaper is caught by the generic `escape` rule
+  //     above, but explicit registration makes intent clear.
+  //   Spring `HtmlUtils.htmlEscape(x)` — htmlEscape already covered
+  //     above (bare method name).
+  //   Apache Commons Text `StringEscapeUtils.escapeJson / escapeXml11 /
+  //     escapeEcmaScript / escapeCsv / escapeXsi`.
+  //   OWASP HTML Sanitizer `PolicyFactory.sanitize(html)`.
+  { method: "escape", class: "Escaper", removes: ["xss"] },
+  { method: "escape", class: "HtmlEscapers", removes: ["xss"] },
+  { method: "escapeJson", class: "StringEscapeUtils", removes: ["xss"] },
+  { method: "escapeEcmaScript", class: "StringEscapeUtils", removes: ["xss"] },
+  { method: "escapeXml11", class: "StringEscapeUtils", removes: ["xss"] },
+  { method: "escapeXml10", class: "StringEscapeUtils", removes: ["xss"] },
+  { method: "escapeCsv", class: "StringEscapeUtils", removes: ["xss"] },
+  { method: "escapeXsi", class: "StringEscapeUtils", removes: ["xss"] },
+  { method: "escapeJava", class: "StringEscapeUtils", removes: ["xss"] },
+  // Bare escapeJson / escapeEcmaScript / escapeCsv aliases — common
+  // when statically imported.
+  { method: "escapeJson", removes: ["xss"] },
+  { method: "escapeEcmaScript", removes: ["xss"] },
+  { method: "escapeCsv", removes: ["xss"] },
+  // OWASP HTML sanitizer (`com.googlecode.owasp-java-html-sanitizer`).
+  { method: "sanitize", class: "PolicyFactory", removes: ["xss"] },
+  // Java Base64 / Hex / MessageDigest — encoded output is binary-safe
+  // (cognium-dev #213 seventh slice). None of these carry attacker
+  // shell/SQL/HTML metacharacters through the encoding — Base64 emits
+  // [A-Za-z0-9+/=], Hex emits [0-9a-f], MessageDigest.digest returns
+  // opaque bytes usually toHex/toBase64-encoded downstream.
+  { method: "encodeToString", class: "Encoder", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
+  { method: "encode", class: "Encoder", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
+  { method: "encodeHexString", class: "Hex", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
+  { method: "digest", class: "MessageDigest", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
+  // Bare aliases for encoder chains — `Base64.getEncoder().encodeToString(x)`
+  // has a call-expression receiver (`Base64.getEncoder()`) that the Java IR
+  // rarely resolves to `Encoder`. Same story for `Hex.encodeHexString(x)`
+  // when Hex is imported. These bare-method names are dominated by their
+  // encoding use in practice; false-positive risk is low.
+  { method: "encodeToString", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
+  { method: "encodeHexString", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
   // cognium-dev #249 3.162.0: `open_redirect` restored to the URL-encoder
   // sanitizer cluster. Sprint 82 (#189) reclassified `sendRedirect` from
   // `ssrf` → `open_redirect` (config-loader.ts:1296-1299) without updating
@@ -12792,6 +12873,91 @@ var DEFAULT_SANITIZERS = [
   // Command injection - shell escaping
   { method: "quote", class: "shell", removes: ["command_injection"] },
   { method: "escape", class: "shell-escape", removes: ["command_injection"] },
+  // JS/Node — additional XSS/HTML encoders (cognium-dev #213 sixth slice).
+  //
+  //   he.encode(x) / he.escape(x)               — `he` npm package
+  //   sanitizeHtml(x)                            — `sanitize-html` npm
+  //   xss(x) / filterXSS(x)                      — `xss` npm (Yahoo)
+  //   escapeHtml(x) / escapeHTML(x)              — common bare helpers
+  //   entities.encode(x) / entities.escape(x)    — `entities` npm
+  //   xssFilters.inHTMLData(x) / inHTMLComment(x) / uriInHTMLData(x)
+  //                                              — `xss-filters` npm (Yahoo)
+  //
+  // `external_taint_escape` is included alongside `xss` — the CWE-668
+  // fallback fires on any call receiving tainted data that the engine
+  // does not otherwise recognize. Since these functions are explicitly
+  // registered as sanitizers (they PURIFY input), they should also
+  // suppress the fallback so a `res.send(sanitizeHtml(x))` flow does
+  // not report an external-taint-escape at the sanitizer call itself.
+  { method: "encode", class: "he", removes: ["xss", "external_taint_escape"] },
+  { method: "escape", class: "he", removes: ["xss", "external_taint_escape"] },
+  { method: "sanitizeHtml", removes: ["xss", "external_taint_escape"] },
+  { method: "xss", removes: ["xss", "external_taint_escape"] },
+  { method: "filterXSS", removes: ["xss", "external_taint_escape"] },
+  { method: "escapeHtml", removes: ["xss", "external_taint_escape"] },
+  { method: "escapeHTML", removes: ["xss", "external_taint_escape"] },
+  { method: "encode", class: "entities", removes: ["xss", "external_taint_escape"] },
+  { method: "escape", class: "entities", removes: ["xss", "external_taint_escape"] },
+  // xss-filters: context-specific helpers, all XSS-safe by construction.
+  { method: "inHTMLData", class: "xssFilters", removes: ["xss", "external_taint_escape"] },
+  { method: "inHTMLComment", class: "xssFilters", removes: ["xss", "external_taint_escape"] },
+  { method: "uriInHTMLData", class: "xssFilters", removes: ["xss", "external_taint_escape"] },
+  // JS/Node — SQL escaping (in addition to the mysql class above).
+  //
+  //   SqlString.escape / .escapeId               — `sqlstring` npm (raw
+  //                                                escape used by mysql /
+  //                                                node-mysql2 drivers)
+  //   pgFormat(sql, ...args) / format(bare)      — `pg-format` npm
+  //   SQL.raw / SQL(bare)                        — `sql-template-strings`
+  //
+  // Bare `format` is intentionally NOT registered — it collides with
+  // string.format-style helpers unrelated to SQL. Callers should use the
+  // qualified form.
+  { method: "escape", class: "SqlString", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "escapeId", class: "SqlString", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "format", class: "SqlString", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "format", class: "pgFormat", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "ident", class: "pgFormat", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "literal", class: "pgFormat", removes: ["sql_injection", "external_taint_escape"] },
+  // JS/Node — crypto.randomUUID() and Node's crypto.randomBytes(...)toString()
+  // produce cryptographically-secure typed strings that cannot carry
+  // attacker-injected payload. Registered as type coercion.
+  { method: "randomUUID", class: "crypto", removes: ["sql_injection", "nosql_injection", "command_injection", "path_traversal", "code_injection", "xss"] },
+  // Bare `randomUUID()` alias — `import { randomUUID } from 'crypto'`.
+  { method: "randomUUID", removes: ["sql_injection", "nosql_injection", "command_injection", "path_traversal", "code_injection", "xss"] },
+  // JS/Node — URL construction. `new URL(x, base)` (constructor-call
+  // matched by method_name === 'URL') and `URLSearchParams.toString()`
+  // safely encode components for URL context.
+  { method: "toString", class: "URLSearchParams", removes: ["ssrf", "open_redirect", "xss"] },
+  // Go — additional sanitizers (cognium-dev #213 sixth slice).
+  //
+  //   regexp.QuoteMeta(x)  — mirror of Python re.escape; strips regex
+  //                          metacharacters so downstream compile/match
+  //                          cannot execute attacker-crafted patterns.
+  //   bluemonday.Sanitize  — dominant Go HTML sanitizer library
+  //                          (`microcosm-cc/bluemonday`). Called on a
+  //                          Policy value returned by UGCPolicy() /
+  //                          StrictPolicy() / etc. Match by method name
+  //                          alone — Policy is the receiver type.
+  //   net.ParseIP(x)        — validates the input is a well-formed IP;
+  //                          returns nil for bad input (developer must
+  //                          check, but the sanitizer only applies when
+  //                          the parsed IP flows onward).
+  //   sql.Named(name, val) — parameterized query binding.
+  { method: "QuoteMeta", class: "regexp", removes: ["redos", "code_injection", "external_taint_escape"] },
+  { method: "Sanitize", class: "bluemonday", removes: ["xss", "external_taint_escape"] },
+  { method: "Sanitize", class: "Policy", removes: ["xss", "external_taint_escape"] },
+  // Bare `Sanitize` — the receiver is a Policy variable (`p := bluemonday.UGCPolicy(); p.Sanitize(x)`).
+  // `Policy` class-matching only fires when the IR resolves the receiver type;
+  // since Go DFG rarely propagates the type of a locally-assigned variable
+  // from a package factory call, we also register the bare method name.
+  // Narrow FP risk: `Sanitize` bare is uncommon outside bluemonday context.
+  { method: "Sanitize", removes: ["xss", "external_taint_escape"] },
+  { method: "SanitizeBytes", class: "bluemonday", removes: ["xss", "external_taint_escape"] },
+  { method: "SanitizeBytes", class: "Policy", removes: ["xss", "external_taint_escape"] },
+  { method: "SanitizeBytes", removes: ["xss", "external_taint_escape"] },
+  { method: "ParseIP", class: "net", removes: ["ssrf", "command_injection", "path_traversal", "external_taint_escape"] },
+  { method: "Named", class: "sql", removes: ["sql_injection", "external_taint_escape"] },
   // =========================================================================
   // Python Sanitizers
   // =========================================================================

package/dist/core/circle-ir-core.js

@@ -12568,10 +12568,49 @@ var DEFAULT_SINKS = [
 var DEFAULT_SANITIZERS = [
   // SQL Injection - proper parameter binding sanitizes input
   // Note: prepareStatement alone is NOT a sanitizer - it's a sink when used with concatenation
+  //
+  // Full PreparedStatement setter coverage (cognium-dev #213 seventh slice).
+  // Every JDBC PreparedStatement.setXxx binds a parameter placeholder via
+  // the driver wire protocol — the SQL text is fixed, only the value slot
+  // varies. Prior coverage was setString/setInt/setLong only; extending
+  // to the full JDBC 4.x setter surface so real Java apps using date/
+  // decimal/object/binary bindings credit as sanitized.
   { method: "setString", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setNString", class: "PreparedStatement", removes: ["sql_injection"] },
   { method: "setInt", class: "PreparedStatement", removes: ["sql_injection"] },
   { method: "setLong", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setShort", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setByte", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setBoolean", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setDouble", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setFloat", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setBigDecimal", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setBytes", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setDate", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setTime", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setTimestamp", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setObject", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setNull", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setArray", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setBlob", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setClob", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setNClob", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setRef", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setRowId", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setSQLXML", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setURL", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setBinaryStream", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setCharacterStream", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setAsciiStream", class: "PreparedStatement", removes: ["sql_injection"] },
+  { method: "setNCharacterStream", class: "PreparedStatement", removes: ["sql_injection"] },
+  // JPA / Hibernate Query.setParameter — covered above; add TypedQuery
+  // (same interface but distinct type name).
   { method: "setParameter", class: "Query", removes: ["sql_injection"] },
+  { method: "setParameter", class: "TypedQuery", removes: ["sql_injection"] },
+  // Spring JdbcTemplate `NamedParameterJdbcTemplate.update / queryForObject`
+  // parameterized shapes use SqlParameterSource.addValue — the addValue
+  // call binds the parameter safely.
+  { method: "addValue", class: "MapSqlParameterSource", removes: ["sql_injection"] },
   { annotation: "Param", removes: ["sql_injection"] },
   // XSS
   { method: "escapeHtml", removes: ["xss"] },
@@ -12597,6 +12636,48 @@ var DEFAULT_SANITIZERS = [
   // Rust askama auto-escapes
   { method: "encodeForJavaScript", removes: ["xss"] },
   { method: "encodeForCSS", removes: ["xss"] },
+  // Additional Java XSS sanitizers (cognium-dev #213 seventh slice).
+  //
+  //   Guava `HtmlEscapers.htmlEscaper().escape(x)` — the `.escape` call
+  //     on the returned Escaper is caught by the generic `escape` rule
+  //     above, but explicit registration makes intent clear.
+  //   Spring `HtmlUtils.htmlEscape(x)` — htmlEscape already covered
+  //     above (bare method name).
+  //   Apache Commons Text `StringEscapeUtils.escapeJson / escapeXml11 /
+  //     escapeEcmaScript / escapeCsv / escapeXsi`.
+  //   OWASP HTML Sanitizer `PolicyFactory.sanitize(html)`.
+  { method: "escape", class: "Escaper", removes: ["xss"] },
+  { method: "escape", class: "HtmlEscapers", removes: ["xss"] },
+  { method: "escapeJson", class: "StringEscapeUtils", removes: ["xss"] },
+  { method: "escapeEcmaScript", class: "StringEscapeUtils", removes: ["xss"] },
+  { method: "escapeXml11", class: "StringEscapeUtils", removes: ["xss"] },
+  { method: "escapeXml10", class: "StringEscapeUtils", removes: ["xss"] },
+  { method: "escapeCsv", class: "StringEscapeUtils", removes: ["xss"] },
+  { method: "escapeXsi", class: "StringEscapeUtils", removes: ["xss"] },
+  { method: "escapeJava", class: "StringEscapeUtils", removes: ["xss"] },
+  // Bare escapeJson / escapeEcmaScript / escapeCsv aliases — common
+  // when statically imported.
+  { method: "escapeJson", removes: ["xss"] },
+  { method: "escapeEcmaScript", removes: ["xss"] },
+  { method: "escapeCsv", removes: ["xss"] },
+  // OWASP HTML sanitizer (`com.googlecode.owasp-java-html-sanitizer`).
+  { method: "sanitize", class: "PolicyFactory", removes: ["xss"] },
+  // Java Base64 / Hex / MessageDigest — encoded output is binary-safe
+  // (cognium-dev #213 seventh slice). None of these carry attacker
+  // shell/SQL/HTML metacharacters through the encoding — Base64 emits
+  // [A-Za-z0-9+/=], Hex emits [0-9a-f], MessageDigest.digest returns
+  // opaque bytes usually toHex/toBase64-encoded downstream.
+  { method: "encodeToString", class: "Encoder", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
+  { method: "encode", class: "Encoder", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
+  { method: "encodeHexString", class: "Hex", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
+  { method: "digest", class: "MessageDigest", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
+  // Bare aliases for encoder chains — `Base64.getEncoder().encodeToString(x)`
+  // has a call-expression receiver (`Base64.getEncoder()`) that the Java IR
+  // rarely resolves to `Encoder`. Same story for `Hex.encodeHexString(x)`
+  // when Hex is imported. These bare-method names are dominated by their
+  // encoding use in practice; false-positive risk is low.
+  { method: "encodeToString", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
+  { method: "encodeHexString", removes: ["sql_injection", "command_injection", "xss", "path_traversal", "code_injection"] },
   // cognium-dev #249 3.162.0: `open_redirect` restored to the URL-encoder
   // sanitizer cluster. Sprint 82 (#189) reclassified `sendRedirect` from
   // `ssrf` → `open_redirect` (config-loader.ts:1296-1299) without updating
@@ -12726,6 +12807,91 @@ var DEFAULT_SANITIZERS = [
   // Command injection - shell escaping
   { method: "quote", class: "shell", removes: ["command_injection"] },
   { method: "escape", class: "shell-escape", removes: ["command_injection"] },
+  // JS/Node — additional XSS/HTML encoders (cognium-dev #213 sixth slice).
+  //
+  //   he.encode(x) / he.escape(x)               — `he` npm package
+  //   sanitizeHtml(x)                            — `sanitize-html` npm
+  //   xss(x) / filterXSS(x)                      — `xss` npm (Yahoo)
+  //   escapeHtml(x) / escapeHTML(x)              — common bare helpers
+  //   entities.encode(x) / entities.escape(x)    — `entities` npm
+  //   xssFilters.inHTMLData(x) / inHTMLComment(x) / uriInHTMLData(x)
+  //                                              — `xss-filters` npm (Yahoo)
+  //
+  // `external_taint_escape` is included alongside `xss` — the CWE-668
+  // fallback fires on any call receiving tainted data that the engine
+  // does not otherwise recognize. Since these functions are explicitly
+  // registered as sanitizers (they PURIFY input), they should also
+  // suppress the fallback so a `res.send(sanitizeHtml(x))` flow does
+  // not report an external-taint-escape at the sanitizer call itself.
+  { method: "encode", class: "he", removes: ["xss", "external_taint_escape"] },
+  { method: "escape", class: "he", removes: ["xss", "external_taint_escape"] },
+  { method: "sanitizeHtml", removes: ["xss", "external_taint_escape"] },
+  { method: "xss", removes: ["xss", "external_taint_escape"] },
+  { method: "filterXSS", removes: ["xss", "external_taint_escape"] },
+  { method: "escapeHtml", removes: ["xss", "external_taint_escape"] },
+  { method: "escapeHTML", removes: ["xss", "external_taint_escape"] },
+  { method: "encode", class: "entities", removes: ["xss", "external_taint_escape"] },
+  { method: "escape", class: "entities", removes: ["xss", "external_taint_escape"] },
+  // xss-filters: context-specific helpers, all XSS-safe by construction.
+  { method: "inHTMLData", class: "xssFilters", removes: ["xss", "external_taint_escape"] },
+  { method: "inHTMLComment", class: "xssFilters", removes: ["xss", "external_taint_escape"] },
+  { method: "uriInHTMLData", class: "xssFilters", removes: ["xss", "external_taint_escape"] },
+  // JS/Node — SQL escaping (in addition to the mysql class above).
+  //
+  //   SqlString.escape / .escapeId               — `sqlstring` npm (raw
+  //                                                escape used by mysql /
+  //                                                node-mysql2 drivers)
+  //   pgFormat(sql, ...args) / format(bare)      — `pg-format` npm
+  //   SQL.raw / SQL(bare)                        — `sql-template-strings`
+  //
+  // Bare `format` is intentionally NOT registered — it collides with
+  // string.format-style helpers unrelated to SQL. Callers should use the
+  // qualified form.
+  { method: "escape", class: "SqlString", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "escapeId", class: "SqlString", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "format", class: "SqlString", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "format", class: "pgFormat", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "ident", class: "pgFormat", removes: ["sql_injection", "external_taint_escape"] },
+  { method: "literal", class: "pgFormat", removes: ["sql_injection", "external_taint_escape"] },
+  // JS/Node — crypto.randomUUID() and Node's crypto.randomBytes(...)toString()
+  // produce cryptographically-secure typed strings that cannot carry
+  // attacker-injected payload. Registered as type coercion.
+  { method: "randomUUID", class: "crypto", removes: ["sql_injection", "nosql_injection", "command_injection", "path_traversal", "code_injection", "xss"] },
+  // Bare `randomUUID()` alias — `import { randomUUID } from 'crypto'`.
+  { method: "randomUUID", removes: ["sql_injection", "nosql_injection", "command_injection", "path_traversal", "code_injection", "xss"] },
+  // JS/Node — URL construction. `new URL(x, base)` (constructor-call
+  // matched by method_name === 'URL') and `URLSearchParams.toString()`
+  // safely encode components for URL context.
+  { method: "toString", class: "URLSearchParams", removes: ["ssrf", "open_redirect", "xss"] },
+  // Go — additional sanitizers (cognium-dev #213 sixth slice).
+  //
+  //   regexp.QuoteMeta(x)  — mirror of Python re.escape; strips regex
+  //                          metacharacters so downstream compile/match
+  //                          cannot execute attacker-crafted patterns.
+  //   bluemonday.Sanitize  — dominant Go HTML sanitizer library
+  //                          (`microcosm-cc/bluemonday`). Called on a
+  //                          Policy value returned by UGCPolicy() /
+  //                          StrictPolicy() / etc. Match by method name
+  //                          alone — Policy is the receiver type.
+  //   net.ParseIP(x)        — validates the input is a well-formed IP;
+  //                          returns nil for bad input (developer must
+  //                          check, but the sanitizer only applies when
+  //                          the parsed IP flows onward).
+  //   sql.Named(name, val) — parameterized query binding.
+  { method: "QuoteMeta", class: "regexp", removes: ["redos", "code_injection", "external_taint_escape"] },
+  { method: "Sanitize", class: "bluemonday", removes: ["xss", "external_taint_escape"] },
+  { method: "Sanitize", class: "Policy", removes: ["xss", "external_taint_escape"] },
+  // Bare `Sanitize` — the receiver is a Policy variable (`p := bluemonday.UGCPolicy(); p.Sanitize(x)`).
+  // `Policy` class-matching only fires when the IR resolves the receiver type;
+  // since Go DFG rarely propagates the type of a locally-assigned variable
+  // from a package factory call, we also register the bare method name.
+  // Narrow FP risk: `Sanitize` bare is uncommon outside bluemonday context.
+  { method: "Sanitize", removes: ["xss", "external_taint_escape"] },
+  { method: "SanitizeBytes", class: "bluemonday", removes: ["xss", "external_taint_escape"] },
+  { method: "SanitizeBytes", class: "Policy", removes: ["xss", "external_taint_escape"] },
+  { method: "SanitizeBytes", removes: ["xss", "external_taint_escape"] },
+  { method: "ParseIP", class: "net", removes: ["ssrf", "command_injection", "path_traversal", "external_taint_escape"] },
+  { method: "Named", class: "sql", removes: ["sql_injection", "external_taint_escape"] },
   // =========================================================================
   // Python Sanitizers
   // =========================================================================

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir",
-  "version": "3.185.0",
+  "version": "3.187.0",
   "description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
   "main": "dist/index.js",
   "module": "dist/index.js",