circle-ir 3.193.0 → 3.195.0

package/dist/core/circle-ir-core.cjs

@@ -9981,6 +9981,7 @@ var GO_KEYWORDS = /* @__PURE__ */ new Set([
 function buildGoDFG(tree) {
   const defs = [];
   const uses = [];
+  const extraChains = [];
   let defIdCounter = 1;
   let useIdCounter = 1;
   const scopeStack = [/* @__PURE__ */ new Map()];
@@ -10002,7 +10003,7 @@ function buildGoDFG(tree) {
     }
     const body2 = func2.childForFieldName("body");
     if (body2) {
-      processGoBlock(body2, defs, uses, scopeStack, { defId: defIdCounter, useId: useIdCounter });
+      processGoBlock(body2, defs, uses, scopeStack, { defId: defIdCounter, useId: useIdCounter }, extraChains);
       defIdCounter = defs.length + 1;
       useIdCounter = uses.length + 1;
     }
@@ -10017,6 +10018,15 @@ function buildGoDFG(tree) {
     }
   }
   const chains = computeChains(defs, uses);
+  const seen = new Set(chains.map((c) => `${c.from_def}|${c.to_def}|${c.via}`));
+  for (const ch of extraChains) {
+    const key = `${ch.from_def}|${ch.to_def}|${ch.via}`;
+    if (!seen.has(key)) {
+      seen.add(key);
+      chains.push(ch);
+    }
+  }
+  chains.sort((a, b) => a.from_def - b.from_def || a.to_def - b.to_def);
   return { defs, uses, chains };
 }
 function extractGoParamDefs(params, defs, _startId, scopeStack) {
@@ -10041,28 +10051,47 @@ function extractGoParamDefs(params, defs, _startId, scopeStack) {
     }
   }
 }
-function processGoBlock(node, defs, uses, scopeStack, counters) {
+function processGoBlock(node, defs, uses, scopeStack, counters, extraChains = []) {
+  const linkMultiLineRhs = (right, useStart, useEnd, defStart, defEnd) => {
+    if (right.endPosition.row <= right.startPosition.row) return;
+    for (let ui = useStart; ui < useEnd; ui++) {
+      const u = uses[ui];
+      if (!u || u.def_id === null) continue;
+      for (let di = defStart; di < defEnd; di++) {
+        const d = defs[di];
+        if (d && d.kind === "local" && d.id !== u.def_id) {
+          extraChains.push({ from_def: u.def_id, to_def: d.id, via: u.variable });
+        }
+      }
+    }
+  };
   walkTree(node, (child) => {
     if (child.type === "short_var_declaration") {
       const left = child.childForFieldName("left");
       const right = child.childForFieldName("right");
+      const usesBefore = uses.length;
       if (right) {
         extractGoUses(right, uses, scopeStack);
       }
+      const defsBefore = defs.length;
       if (left) {
         extractGoLhsDefs(left, defs, scopeStack, child.startPosition.row + 1);
       }
+      if (right) linkMultiLineRhs(right, usesBefore, uses.length, defsBefore, defs.length);
     } else if (child.type === "var_declaration") {
       processGoVarDecl(child, defs, scopeStack, counters);
     } else if (child.type === "assignment_statement") {
       const left = child.childForFieldName("left");
       const right = child.childForFieldName("right");
+      const usesBefore = uses.length;
       if (right) {
         extractGoUses(right, uses, scopeStack);
       }
+      const defsBefore = defs.length;
       if (left) {
         extractGoLhsDefs(left, defs, scopeStack, child.startPosition.row + 1);
       }
+      if (right) linkMultiLineRhs(right, usesBefore, uses.length, defsBefore, defs.length);
     } else if (child.type === "for_statement") {
       const rangeClause = findChildByTypeGo(child, "range_clause");
       if (rangeClause) {
@@ -10726,7 +10755,11 @@ var DEFAULT_SOURCES = [
   { method: "Json", type: "http_body", severity: "high", return_tainted: true, languages: ["rust"] },
   { method: "Query", type: "http_param", severity: "high", return_tainted: true, languages: ["rust"] },
   { method: "Path", type: "http_path", severity: "high", return_tainted: true, languages: ["rust"] },
-  { method: "Form", type: "http_param", severity: "high", return_tainted: true, languages: ["rust"] },
+  // `Form<T>` decodes the urlencoded request *body* (`Query<T>` above is the
+  // query-string extractor), so it is http_body — retyped from http_param
+  // when the RustPlugin's http_body duplicate was removed, so the two
+  // surfaces no longer disagree. Matches Gin's `Context.PostForm`.
+  { method: "Form", type: "http_body", severity: "high", return_tainted: true, languages: ["rust"] },
   // Rust std library
   { method: "var", class: "env", type: "env_input", severity: "medium", return_tainted: true },
   { method: "var_os", class: "env", type: "env_input", severity: "medium", return_tainted: true },
@@ -12004,7 +12037,11 @@ var DEFAULT_SINKS = [
   // Also match without receiver (destructured imports: const { exec } = require('child_process'))
   // `exec` is intentionally classless: catches Node.js child_process.exec AND
   // Java Runtime.exec (via `r.exec()` where heuristic can't resolve r → Runtime).
-  { method: "exec", type: "command_injection", cwe: "CWE-78", severity: "high", arg_positions: [0] },
+  // Excluded from Python: there, bare `exec(code)` is the code-execution
+  // builtin, registered below as code_injection / CWE-94. Before the exclusion
+  // a Python `exec(user_code)` matched both patterns and emitted two findings
+  // for one call — CWE-78 (wrong: no shell is involved) and CWE-94 (right).
+  { method: "exec", type: "command_injection", cwe: "CWE-78", severity: "high", arg_positions: [0], exclude_languages: ["python"] },
   // `execSync`/`spawn`/`spawnSync`/`execFile` are Node-specific — language-scope them.
   { method: "execSync", type: "command_injection", cwe: "CWE-78", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "spawn", type: "command_injection", cwe: "CWE-78", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
@@ -12032,7 +12069,11 @@ var DEFAULT_SINKS = [
   // Note: classless { method: 'query' } removed — too many FPs (UriComponentsBuilder.query(), etc.)
   // SQL query calls are covered by class-specific patterns above (Connection, Pool, Client, JdbcTemplate)
   // Note: `raw` is shared with Python (Django ORM) — scoped to JS+TS to avoid leaking.
-  { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // Severity `critical` (not `high`) preserves what the JS plugin's duplicate
+  // builtin emitted before the #4 follow-up consolidation removed it: the
+  // plugin copy carried `critical`, which won the `findSinks` dedup slot via
+  // the +0.1 critical-severity confidence boost.
+  { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   // sqlite3 (npm) — Database/Statement methods. The JS plugin resolves
   // `const db = new sqlite3.Database(...); db.all(sql)` to the resolution
   // target `Connection.all`, so class-scoped patterns matching `Connection`
@@ -12591,10 +12632,30 @@ var DEFAULT_SINKS = [
   { method: "Sprintf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   { method: "Printf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   { method: "Errorf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
+  // `fmt.Fprintf` is deliberately dual-classified: this CWE-134 entry and the
+  // Go plugin's xss (CWE-79) entry both cover arg[1], so a tainted format
+  // string emits two findings. Unlike the logger case above, neither is
+  // redundant — CWE-134 holds for any writer, while CWE-79 is the actionable
+  // finding when the writer is an http.ResponseWriter (`fmt.Fprintf(w, taint)`
+  // is the standard Go reflected-XSS shape). Collapsing it requires deciding
+  // by the *type of arg[0]*, which sink patterns cannot express today: the
+  // options are a Go-specific gate (mirroring isSafeGoJsonUnmarshalCall) that
+  // emits xss only for a resolved ResponseWriter, or dropping one CWE and
+  // accepting either lost XSS recall or a mis-classified stderr write.
+  // Left as-is pending the Go corpus run — see tasks.md.
   { method: "Fprintf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [1], languages: ["go"] },
   // cognium-dev #264 — Go stdlib `log` package format-string entry points.
   // log.Printf / Fatalf / Panicf take the format string at arg[0]; tainted
   // format string reaches the same fmt.Sprintf machinery internally.
+  //
+  // These deliberately coexist with the Go plugin's log_injection (CWE-117)
+  // entries for the same methods, so such a call emits both. The Logger
+  // decision note in the Java log_injection section above does NOT apply
+  // here: it reasons about SLF4J-style APIs where the format string is a
+  // literal with `{}` placeholders, whereas Go's `log.Printf(fmt, ...)` takes
+  // a real format string that an attacker can control. CWE-117 covers the
+  // forged log line, CWE-134 the format string itself. Locked by
+  // tests/analysis/passes/format-string-additions.test.ts.
   { method: "Printf", class: "log", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   { method: "Fatalf", class: "log", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   { method: "Panicf", class: "log", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
@@ -12608,6 +12669,14 @@ var DEFAULT_SINKS = [
   { method: "cookie", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["javascript", "typescript"] },
   // Express: res.location(url) and res.redirect(url) — Location header.
   { method: "location", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // `redirect` is deliberately dual-classified: this crlf (CWE-113) entry
+  // coexists with the open_redirect (CWE-601) entry for js/ts, so a tainted
+  // redirect target emits two flows. That is intentional, not duplication —
+  // #189 Sprint 82 shipped a sink-type-aware flow dedup specifically so both
+  // survive ("res.redirect is both open_redirect AND crlf"), and #132 added a
+  // crlf recall test for the bare `res.redirect(req.query.url)` shape. Locked
+  // by issue-189-sprint82-open-redirect-cluster.test.ts and
+  // crlf-stage8-fp.test.ts — do not collapse without revisiting both tickets.
   { method: "redirect", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
   // Go net/http: w.Header().Set(k, v) / Add(k, v) — first arg is the value
   // (Header is a map; the actual `value` is arg 1 of the call). We flag the
@@ -13433,18 +13502,28 @@ function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy,
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
   return { sources, sinks, sanitizers };
 }
+function sinkPatternAppliesTo(pattern, language) {
+  if (language === void 0) return true;
+  if (pattern.languages && pattern.languages.length > 0 && !pattern.languages.includes(language)) {
+    return false;
+  }
+  if (pattern.exclude_languages && pattern.exclude_languages.includes(language)) {
+    return false;
+  }
+  return true;
+}
 function expandPromisifyAliases(patterns, sourceLines, language) {
   if (!sourceLines || sourceLines.length === 0) return patterns;
   if (language !== "javascript" && language !== "typescript") return patterns;
   const PROMISIFY_RE = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:util\s*\.\s*)?promisify\s*\(\s*([A-Za-z_$][\w$]*)\s*\)/;
   const innerToPattern = /* @__PURE__ */ new Map();
   for (const p of patterns) {
-    if (p.languages && !p.languages.includes(language)) continue;
+    if (!sinkPatternAppliesTo(p, language)) continue;
     if (p.class !== void 0) continue;
     if (!innerToPattern.has(p.method)) innerToPattern.set(p.method, p);
   }
   for (const p of patterns) {
-    if (p.languages && !p.languages.includes(language)) continue;
+    if (!sinkPatternAppliesTo(p, language)) continue;
     if (innerToPattern.has(p.method)) continue;
     innerToPattern.set(p.method, p);
   }
@@ -13478,7 +13557,7 @@ function expandIndirectEvalAliases(patterns, sourceLines, language) {
   const INDIRECT_EVAL_RE = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=]+)?=\s*(eval|Function)\b(?!\s*\()/;
   const innerToPattern = /* @__PURE__ */ new Map();
   for (const p of patterns) {
-    if (p.languages && !p.languages.includes(language)) continue;
+    if (!sinkPatternAppliesTo(p, language)) continue;
     if (p.class !== void 0) continue;
     if (p.method !== "eval" && p.method !== "Function") continue;
     if (!innerToPattern.has(p.method)) innerToPattern.set(p.method, p);
@@ -14186,9 +14265,7 @@ function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   return false;
 }
 function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types) {
-  const patternsForLanguage = language === void 0 ? patterns : patterns.filter(
-    (p) => !p.languages || p.languages.length === 0 || p.languages.includes(language)
-  );
+  const patternsForLanguage = language === void 0 ? patterns : patterns.filter((p) => sinkPatternAppliesTo(p, language));
   const sinkMap = /* @__PURE__ */ new Map();
   for (const call of calls) {
     for (const pattern of patternsForLanguage) {
@@ -14533,10 +14610,8 @@ var SINK_FQN_EXCLUSIONS = {
   ]
 };
 function matchesSinkPattern(call, pattern, typeHierarchy, language) {
-  if (pattern.languages && pattern.languages.length > 0 && language !== void 0) {
-    if (!pattern.languages.includes(language)) {
-      return false;
-    }
+  if (!sinkPatternAppliesTo(pattern, language)) {
+    return false;
   }
   const callMethodName = call.method_name;
   const patternMethod = pattern.method;

package/dist/core/circle-ir-core.js

@@ -9915,6 +9915,7 @@ var GO_KEYWORDS = /* @__PURE__ */ new Set([
 function buildGoDFG(tree) {
   const defs = [];
   const uses = [];
+  const extraChains = [];
   let defIdCounter = 1;
   let useIdCounter = 1;
   const scopeStack = [/* @__PURE__ */ new Map()];
@@ -9936,7 +9937,7 @@ function buildGoDFG(tree) {
     }
     const body2 = func2.childForFieldName("body");
     if (body2) {
-      processGoBlock(body2, defs, uses, scopeStack, { defId: defIdCounter, useId: useIdCounter });
+      processGoBlock(body2, defs, uses, scopeStack, { defId: defIdCounter, useId: useIdCounter }, extraChains);
       defIdCounter = defs.length + 1;
       useIdCounter = uses.length + 1;
     }
@@ -9951,6 +9952,15 @@ function buildGoDFG(tree) {
     }
   }
   const chains = computeChains(defs, uses);
+  const seen = new Set(chains.map((c) => `${c.from_def}|${c.to_def}|${c.via}`));
+  for (const ch of extraChains) {
+    const key = `${ch.from_def}|${ch.to_def}|${ch.via}`;
+    if (!seen.has(key)) {
+      seen.add(key);
+      chains.push(ch);
+    }
+  }
+  chains.sort((a, b) => a.from_def - b.from_def || a.to_def - b.to_def);
   return { defs, uses, chains };
 }
 function extractGoParamDefs(params, defs, _startId, scopeStack) {
@@ -9975,28 +9985,47 @@ function extractGoParamDefs(params, defs, _startId, scopeStack) {
     }
   }
 }
-function processGoBlock(node, defs, uses, scopeStack, counters) {
+function processGoBlock(node, defs, uses, scopeStack, counters, extraChains = []) {
+  const linkMultiLineRhs = (right, useStart, useEnd, defStart, defEnd) => {
+    if (right.endPosition.row <= right.startPosition.row) return;
+    for (let ui = useStart; ui < useEnd; ui++) {
+      const u = uses[ui];
+      if (!u || u.def_id === null) continue;
+      for (let di = defStart; di < defEnd; di++) {
+        const d = defs[di];
+        if (d && d.kind === "local" && d.id !== u.def_id) {
+          extraChains.push({ from_def: u.def_id, to_def: d.id, via: u.variable });
+        }
+      }
+    }
+  };
   walkTree(node, (child) => {
     if (child.type === "short_var_declaration") {
       const left = child.childForFieldName("left");
       const right = child.childForFieldName("right");
+      const usesBefore = uses.length;
       if (right) {
         extractGoUses(right, uses, scopeStack);
       }
+      const defsBefore = defs.length;
       if (left) {
         extractGoLhsDefs(left, defs, scopeStack, child.startPosition.row + 1);
       }
+      if (right) linkMultiLineRhs(right, usesBefore, uses.length, defsBefore, defs.length);
     } else if (child.type === "var_declaration") {
       processGoVarDecl(child, defs, scopeStack, counters);
     } else if (child.type === "assignment_statement") {
       const left = child.childForFieldName("left");
       const right = child.childForFieldName("right");
+      const usesBefore = uses.length;
       if (right) {
         extractGoUses(right, uses, scopeStack);
       }
+      const defsBefore = defs.length;
       if (left) {
         extractGoLhsDefs(left, defs, scopeStack, child.startPosition.row + 1);
       }
+      if (right) linkMultiLineRhs(right, usesBefore, uses.length, defsBefore, defs.length);
     } else if (child.type === "for_statement") {
       const rangeClause = findChildByTypeGo(child, "range_clause");
       if (rangeClause) {
@@ -10660,7 +10689,11 @@ var DEFAULT_SOURCES = [
   { method: "Json", type: "http_body", severity: "high", return_tainted: true, languages: ["rust"] },
   { method: "Query", type: "http_param", severity: "high", return_tainted: true, languages: ["rust"] },
   { method: "Path", type: "http_path", severity: "high", return_tainted: true, languages: ["rust"] },
-  { method: "Form", type: "http_param", severity: "high", return_tainted: true, languages: ["rust"] },
+  // `Form<T>` decodes the urlencoded request *body* (`Query<T>` above is the
+  // query-string extractor), so it is http_body — retyped from http_param
+  // when the RustPlugin's http_body duplicate was removed, so the two
+  // surfaces no longer disagree. Matches Gin's `Context.PostForm`.
+  { method: "Form", type: "http_body", severity: "high", return_tainted: true, languages: ["rust"] },
   // Rust std library
   { method: "var", class: "env", type: "env_input", severity: "medium", return_tainted: true },
   { method: "var_os", class: "env", type: "env_input", severity: "medium", return_tainted: true },
@@ -11938,7 +11971,11 @@ var DEFAULT_SINKS = [
   // Also match without receiver (destructured imports: const { exec } = require('child_process'))
   // `exec` is intentionally classless: catches Node.js child_process.exec AND
   // Java Runtime.exec (via `r.exec()` where heuristic can't resolve r → Runtime).
-  { method: "exec", type: "command_injection", cwe: "CWE-78", severity: "high", arg_positions: [0] },
+  // Excluded from Python: there, bare `exec(code)` is the code-execution
+  // builtin, registered below as code_injection / CWE-94. Before the exclusion
+  // a Python `exec(user_code)` matched both patterns and emitted two findings
+  // for one call — CWE-78 (wrong: no shell is involved) and CWE-94 (right).
+  { method: "exec", type: "command_injection", cwe: "CWE-78", severity: "high", arg_positions: [0], exclude_languages: ["python"] },
   // `execSync`/`spawn`/`spawnSync`/`execFile` are Node-specific — language-scope them.
   { method: "execSync", type: "command_injection", cwe: "CWE-78", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
   { method: "spawn", type: "command_injection", cwe: "CWE-78", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
@@ -11966,7 +12003,11 @@ var DEFAULT_SINKS = [
   // Note: classless { method: 'query' } removed — too many FPs (UriComponentsBuilder.query(), etc.)
   // SQL query calls are covered by class-specific patterns above (Connection, Pool, Client, JdbcTemplate)
   // Note: `raw` is shared with Python (Django ORM) — scoped to JS+TS to avoid leaking.
-  { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "high", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // Severity `critical` (not `high`) preserves what the JS plugin's duplicate
+  // builtin emitted before the #4 follow-up consolidation removed it: the
+  // plugin copy carried `critical`, which won the `findSinks` dedup slot via
+  // the +0.1 critical-severity confidence boost.
+  { method: "raw", type: "sql_injection", cwe: "CWE-89", severity: "critical", arg_positions: [0], languages: ["javascript", "typescript"] },
   // sqlite3 (npm) — Database/Statement methods. The JS plugin resolves
   // `const db = new sqlite3.Database(...); db.all(sql)` to the resolution
   // target `Connection.all`, so class-scoped patterns matching `Connection`
@@ -12525,10 +12566,30 @@ var DEFAULT_SINKS = [
   { method: "Sprintf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   { method: "Printf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   { method: "Errorf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
+  // `fmt.Fprintf` is deliberately dual-classified: this CWE-134 entry and the
+  // Go plugin's xss (CWE-79) entry both cover arg[1], so a tainted format
+  // string emits two findings. Unlike the logger case above, neither is
+  // redundant — CWE-134 holds for any writer, while CWE-79 is the actionable
+  // finding when the writer is an http.ResponseWriter (`fmt.Fprintf(w, taint)`
+  // is the standard Go reflected-XSS shape). Collapsing it requires deciding
+  // by the *type of arg[0]*, which sink patterns cannot express today: the
+  // options are a Go-specific gate (mirroring isSafeGoJsonUnmarshalCall) that
+  // emits xss only for a resolved ResponseWriter, or dropping one CWE and
+  // accepting either lost XSS recall or a mis-classified stderr write.
+  // Left as-is pending the Go corpus run — see tasks.md.
   { method: "Fprintf", class: "fmt", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [1], languages: ["go"] },
   // cognium-dev #264 — Go stdlib `log` package format-string entry points.
   // log.Printf / Fatalf / Panicf take the format string at arg[0]; tainted
   // format string reaches the same fmt.Sprintf machinery internally.
+  //
+  // These deliberately coexist with the Go plugin's log_injection (CWE-117)
+  // entries for the same methods, so such a call emits both. The Logger
+  // decision note in the Java log_injection section above does NOT apply
+  // here: it reasons about SLF4J-style APIs where the format string is a
+  // literal with `{}` placeholders, whereas Go's `log.Printf(fmt, ...)` takes
+  // a real format string that an attacker can control. CWE-117 covers the
+  // forged log line, CWE-134 the format string itself. Locked by
+  // tests/analysis/passes/format-string-additions.test.ts.
   { method: "Printf", class: "log", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   { method: "Fatalf", class: "log", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
   { method: "Panicf", class: "log", type: "format_string", cwe: "CWE-134", severity: "medium", arg_positions: [0], languages: ["go"] },
@@ -12542,6 +12603,14 @@ var DEFAULT_SINKS = [
   { method: "cookie", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [1], languages: ["javascript", "typescript"] },
   // Express: res.location(url) and res.redirect(url) — Location header.
   { method: "location", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
+  // `redirect` is deliberately dual-classified: this crlf (CWE-113) entry
+  // coexists with the open_redirect (CWE-601) entry for js/ts, so a tainted
+  // redirect target emits two flows. That is intentional, not duplication —
+  // #189 Sprint 82 shipped a sink-type-aware flow dedup specifically so both
+  // survive ("res.redirect is both open_redirect AND crlf"), and #132 added a
+  // crlf recall test for the bare `res.redirect(req.query.url)` shape. Locked
+  // by issue-189-sprint82-open-redirect-cluster.test.ts and
+  // crlf-stage8-fp.test.ts — do not collapse without revisiting both tickets.
   { method: "redirect", type: "crlf", cwe: "CWE-113", severity: "medium", arg_positions: [0], languages: ["javascript", "typescript"] },
   // Go net/http: w.Header().Set(k, v) / Add(k, v) — first arg is the value
   // (Header is a map; the actual `value` is arg 1 of the call). We flag the
@@ -13367,18 +13436,28 @@ function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy,
   const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
   return { sources, sinks, sanitizers };
 }
+function sinkPatternAppliesTo(pattern, language) {
+  if (language === void 0) return true;
+  if (pattern.languages && pattern.languages.length > 0 && !pattern.languages.includes(language)) {
+    return false;
+  }
+  if (pattern.exclude_languages && pattern.exclude_languages.includes(language)) {
+    return false;
+  }
+  return true;
+}
 function expandPromisifyAliases(patterns, sourceLines, language) {
   if (!sourceLines || sourceLines.length === 0) return patterns;
   if (language !== "javascript" && language !== "typescript") return patterns;
   const PROMISIFY_RE = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:util\s*\.\s*)?promisify\s*\(\s*([A-Za-z_$][\w$]*)\s*\)/;
   const innerToPattern = /* @__PURE__ */ new Map();
   for (const p of patterns) {
-    if (p.languages && !p.languages.includes(language)) continue;
+    if (!sinkPatternAppliesTo(p, language)) continue;
     if (p.class !== void 0) continue;
     if (!innerToPattern.has(p.method)) innerToPattern.set(p.method, p);
   }
   for (const p of patterns) {
-    if (p.languages && !p.languages.includes(language)) continue;
+    if (!sinkPatternAppliesTo(p, language)) continue;
     if (innerToPattern.has(p.method)) continue;
     innerToPattern.set(p.method, p);
   }
@@ -13412,7 +13491,7 @@ function expandIndirectEvalAliases(patterns, sourceLines, language) {
   const INDIRECT_EVAL_RE = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*(?::[^=]+)?=\s*(eval|Function)\b(?!\s*\()/;
   const innerToPattern = /* @__PURE__ */ new Map();
   for (const p of patterns) {
-    if (p.languages && !p.languages.includes(language)) continue;
+    if (!sinkPatternAppliesTo(p, language)) continue;
     if (p.class !== void 0) continue;
     if (p.method !== "eval" && p.method !== "Function") continue;
     if (!innerToPattern.has(p.method)) innerToPattern.set(p.method, p);
@@ -14120,9 +14199,7 @@ function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   return false;
 }
 function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types) {
-  const patternsForLanguage = language === void 0 ? patterns : patterns.filter(
-    (p) => !p.languages || p.languages.length === 0 || p.languages.includes(language)
-  );
+  const patternsForLanguage = language === void 0 ? patterns : patterns.filter((p) => sinkPatternAppliesTo(p, language));
   const sinkMap = /* @__PURE__ */ new Map();
   for (const call of calls) {
     for (const pattern of patternsForLanguage) {
@@ -14467,10 +14544,8 @@ var SINK_FQN_EXCLUSIONS = {
   ]
 };
 function matchesSinkPattern(call, pattern, typeHierarchy, language) {
-  if (pattern.languages && pattern.languages.length > 0 && language !== void 0) {
-    if (!pattern.languages.includes(language)) {
-      return false;
-    }
+  if (!sinkPatternAppliesTo(pattern, language)) {
+    return false;
   }
   const callMethodName = call.method_name;
   const patternMethod = pattern.method;

package/dist/core/extractors/dfg.js

@@ -1274,6 +1274,11 @@ const GO_KEYWORDS = new Set([
 function buildGoDFG(tree) {
     const defs = [];
     const uses = [];
+    // Explicit chains for multi-line composite-literal assignments (#267) —
+    // `computeChains` only links same-line use→def, so a struct/slice literal
+    // that spans lines (`req := T{ … tainted … }`) would not propagate taint
+    // from the tainted field to the assigned var.
+    const extraChains = [];
     let defIdCounter = 1;
     let useIdCounter = 1;
     const scopeStack = [new Map()];
@@ -1299,7 +1304,7 @@ function buildGoDFG(tree) {
         // Process function body
         const body = func.childForFieldName('body');
         if (body) {
-            processGoBlock(body, defs, uses, scopeStack, { defId: defIdCounter, useId: useIdCounter });
+            processGoBlock(body, defs, uses, scopeStack, { defId: defIdCounter, useId: useIdCounter }, extraChains);
             defIdCounter = defs.length + 1;
             useIdCounter = uses.length + 1;
         }
@@ -1315,7 +1320,18 @@ function buildGoDFG(tree) {
             defIdCounter = defs.length + 1;
         }
     }
+    // Merge same-line chains with the explicit multi-line composite-literal
+    // chains (cognium-dev #267), deduplicating on (from_def, to_def, via).
     const chains = computeChains(defs, uses);
+    const seen = new Set(chains.map(c => `${c.from_def}|${c.to_def}|${c.via}`));
+    for (const ch of extraChains) {
+        const key = `${ch.from_def}|${ch.to_def}|${ch.via}`;
+        if (!seen.has(key)) {
+            seen.add(key);
+            chains.push(ch);
+        }
+    }
+    chains.sort((a, b) => a.from_def - b.from_def || a.to_def - b.to_def);
     return { defs, uses, chains };
 }
 /**
@@ -1351,20 +1367,44 @@ function extractGoParamDefs(params, defs, _startId, scopeStack) {
 /**
  * Process a Go block (function body, if body, etc.) for definitions and uses.
  */
-function processGoBlock(node, defs, uses, scopeStack, counters) {
+function processGoBlock(node, defs, uses, scopeStack, counters, extraChains = []) {
+    // cognium-dev #267 — link resolved RHS uses to LHS local defs when the
+    // RHS spans multiple lines (a struct/slice composite literal in gofmt
+    // style). `computeChains` only links same-line use→def, so without this a
+    // tainted value used deep inside a multi-line literal never reaches the
+    // assigned variable. Single-line RHS is already covered by computeChains.
+    const linkMultiLineRhs = (right, useStart, useEnd, defStart, defEnd) => {
+        if (right.endPosition.row <= right.startPosition.row)
+            return; // single line
+        for (let ui = useStart; ui < useEnd; ui++) {
+            const u = uses[ui];
+            if (!u || u.def_id === null)
+                continue;
+            for (let di = defStart; di < defEnd; di++) {
+                const d = defs[di];
+                if (d && d.kind === 'local' && d.id !== u.def_id) {
+                    extraChains.push({ from_def: u.def_id, to_def: d.id, via: u.variable });
+                }
+            }
+        }
+    };
     walkTree(node, (child) => {
         if (child.type === 'short_var_declaration') {
             // x, y := expr
             const left = child.childForFieldName('left');
             const right = child.childForFieldName('right');
             // Extract uses from right side first
+            const usesBefore = uses.length;
             if (right) {
                 extractGoUses(right, uses, scopeStack);
             }
             // Then create defs for left side
+            const defsBefore = defs.length;
             if (left) {
                 extractGoLhsDefs(left, defs, scopeStack, child.startPosition.row + 1);
             }
+            if (right)
+                linkMultiLineRhs(right, usesBefore, uses.length, defsBefore, defs.length);
         }
         else if (child.type === 'var_declaration') {
             processGoVarDecl(child, defs, scopeStack, counters);
@@ -1373,13 +1413,17 @@ function processGoBlock(node, defs, uses, scopeStack, counters) {
             const left = child.childForFieldName('left');
             const right = child.childForFieldName('right');
             // Uses from right side
+            const usesBefore = uses.length;
             if (right) {
                 extractGoUses(right, uses, scopeStack);
             }
             // Defs for left side (reassignment)
+            const defsBefore = defs.length;
             if (left) {
                 extractGoLhsDefs(left, defs, scopeStack, child.startPosition.row + 1);
             }
+            if (right)
+                linkMultiLineRhs(right, usesBefore, uses.length, defsBefore, defs.length);
         }
         else if (child.type === 'for_statement') {
             // range clause: for k, v := range expr