circle-ir 3.194.0 → 3.197.0

package/dist/languages/plugins/python.js

@@ -178,13 +178,15 @@ export class PythonPlugin extends BaseLanguagePlugin {
                 returnTainted: true,
             },
             // Standard library sources
-            {
-                method: 'input',
-                type: 'user_input',
-                severity: 'high',
-                confidence: 0.95,
-                returnTainted: true,
-            },
+            //
+            // `input()` and `os.getenv()` are registered in DEFAULT_SOURCES as
+            // `io_input` / `env_input`. The duplicates that used to sit here typed
+            // them `user_input` / `env_var` — strings outside the published
+            // `SourceType` union, which reach consumers only because the merge in
+            // TaintMatcherPass casts `TaintSourcePattern.type` (a bare `string`) to
+            // `SourceType`. Both entries fired, so one call emitted two sources with
+            // two different type strings. Removed in favour of the canonical
+            // registry (ADR-004).
             {
                 method: 'argv',
                 class: 'sys',
@@ -201,136 +203,27 @@ export class PythonPlugin extends BaseLanguagePlugin {
                 confidence: 0.85,
                 returnTainted: true,
             },
-            {
-                method: 'getenv',
-                class: 'os',
-                type: 'env_var',
-                severity: 'medium',
-                confidence: 0.85,
-                returnTainted: true,
-            },
-            // File reading
-            {
-                method: 'read',
-                type: 'file_input',
-                severity: 'medium',
-                confidence: 0.8,
-                returnTainted: true,
-            },
-            {
-                method: 'readline',
-                type: 'file_input',
-                severity: 'medium',
-                confidence: 0.8,
-                returnTainted: true,
-            },
-            {
-                method: 'readlines',
-                type: 'file_input',
-                severity: 'medium',
-                confidence: 0.8,
-                returnTainted: true,
-            },
+            // NOTE: the file-reading sources (`read`, `readline`, `readlines` as
+            // file_input) are registered identically in DEFAULT_SOURCES. Since
+            // `findSources` pushes one TaintSource per matching pattern with no
+            // dedup, these duplicates emitted a second, byte-identical source at
+            // every call site. Removed in the #4 follow-up consolidation —
+            // DEFAULT_SOURCES is the canonical registry (ADR-004).
         ];
     }
     /**
      * Python taint sink patterns.
+     *
+     * Only patterns that have NO counterpart in `DEFAULT_SINKS` belong here —
+     * `DEFAULT_SINKS` (`analysis/config-loader.ts`) is the canonical registry
+     * (ADR-004). Duplicated entries were dead weight: `TaintMatcherPass` merges
+     * plugin builtins *after* the config patterns, and `findSinks` dedupes by
+     * `location:line:cwe` keeping the higher-confidence match, so the config
+     * copy always won the slot. Removed in the #4 follow-up consolidation.
      */
     getBuiltinSinks() {
         return [
-            // Command Injection
-            {
-                method: 'system',
-                class: 'os',
-                type: 'command_injection',
-                cwe: 'CWE-78',
-                severity: 'critical',
-                argPositions: [0],
-            },
-            {
-                method: 'popen',
-                class: 'os',
-                type: 'command_injection',
-                cwe: 'CWE-78',
-                severity: 'critical',
-                argPositions: [0],
-            },
-            {
-                method: 'run',
-                class: 'subprocess',
-                type: 'command_injection',
-                cwe: 'CWE-78',
-                severity: 'critical',
-                argPositions: [0],
-            },
-            {
-                method: 'call',
-                class: 'subprocess',
-                type: 'command_injection',
-                cwe: 'CWE-78',
-                severity: 'critical',
-                argPositions: [0],
-            },
-            {
-                method: 'Popen',
-                class: 'subprocess',
-                type: 'command_injection',
-                cwe: 'CWE-78',
-                severity: 'critical',
-                argPositions: [0],
-            },
-            // Code Injection
-            {
-                method: 'eval',
-                type: 'code_injection',
-                cwe: 'CWE-94',
-                severity: 'critical',
-                argPositions: [0],
-            },
-            {
-                method: 'exec',
-                type: 'code_injection',
-                cwe: 'CWE-94',
-                severity: 'critical',
-                argPositions: [0],
-            },
-            {
-                method: 'compile',
-                type: 'code_injection',
-                cwe: 'CWE-94',
-                severity: 'high',
-                argPositions: [0],
-            },
-            // SQL Injection
-            {
-                method: 'execute',
-                type: 'sql_injection',
-                cwe: 'CWE-89',
-                severity: 'critical',
-                argPositions: [0],
-            },
-            {
-                method: 'executemany',
-                type: 'sql_injection',
-                cwe: 'CWE-89',
-                severity: 'critical',
-                argPositions: [0],
-            },
-            {
-                method: 'raw',
-                type: 'sql_injection',
-                cwe: 'CWE-89',
-                severity: 'critical',
-                argPositions: [0],
-            },
             // Path Traversal
-            {
-                method: 'open',
-                type: 'path_traversal',
-                cwe: 'CWE-22',
-                severity: 'high',
-                argPositions: [0],
-            },
             {
                 method: 'read',
                 class: 'pathlib',
@@ -340,13 +233,6 @@ export class PythonPlugin extends BaseLanguagePlugin {
                 argPositions: [0],
             },
             // XSS (template injection)
-            {
-                method: 'Markup',
-                type: 'xss',
-                cwe: 'CWE-79',
-                severity: 'high',
-                argPositions: [0],
-            },
             {
                 method: 'safe',
                 type: 'xss',
@@ -355,22 +241,6 @@ export class PythonPlugin extends BaseLanguagePlugin {
                 argPositions: [0],
             },
             // SSRF
-            {
-                method: 'get',
-                class: 'requests',
-                type: 'ssrf',
-                cwe: 'CWE-918',
-                severity: 'high',
-                argPositions: [0],
-            },
-            {
-                method: 'post',
-                class: 'requests',
-                type: 'ssrf',
-                cwe: 'CWE-918',
-                severity: 'high',
-                argPositions: [0],
-            },
             {
                 method: 'urlopen',
                 class: 'urllib',
@@ -398,34 +268,11 @@ export class PythonPlugin extends BaseLanguagePlugin {
                 argPositions: [1],
             },
             // Deserialization
-            {
-                method: 'loads',
-                class: 'pickle',
-                type: 'deserialization',
-                cwe: 'CWE-502',
-                severity: 'critical',
-                argPositions: [0],
-            },
-            {
-                method: 'load',
-                class: 'pickle',
-                type: 'deserialization',
-                cwe: 'CWE-502',
-                severity: 'critical',
-                argPositions: [0],
-            },
             // NOTE: yaml.safe_load / yaml.SafeLoader are intentionally NOT sinks.
             // safe_load constructs only standard scalar/list/dict types and cannot
             // instantiate arbitrary Python objects, so it is not a CWE-502 sink
-            // (unlike yaml.load / yaml.unsafe_load / yaml.full_load below).
-            {
-                method: 'load',
-                class: 'yaml',
-                type: 'deserialization',
-                cwe: 'CWE-502',
-                severity: 'critical',
-                argPositions: [0],
-            },
+            // (unlike yaml.load — registered in DEFAULT_SINKS — and
+            // yaml.unsafe_load / yaml.full_load below).
             {
                 method: 'unsafe_load',
                 class: 'yaml',

package/dist/languages/plugins/python.js.map

@@ -1 +1 @@
-{"version":3,"file":"python.js","sourceRoot":"","sources":["../../../src/languages/plugins/python.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C;;GAEG;AACH,MAAM,OAAO,YAAa,SAAQ,kBAAkB;IACzC,EAAE,GAAG,QAAiB,CAAC;IACvB,IAAI,GAAG,QAAQ,CAAC;IAChB,UAAU,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7B,QAAQ,GAAG,yBAAyB,CAAC;IAErC,SAAS,GAAsB;QACtC,oBAAoB;QACpB,gBAAgB,EAAE,CAAC,kBAAkB,CAAC;QACtC,oBAAoB,EAAE,EAAE,EAAG,iCAAiC;QAC5D,eAAe,EAAE,EAAE,EAAG,2BAA2B;QACjD,mBAAmB,EAAE,CAAC,qBAAqB,CAAC;QAC5C,iBAAiB,EAAE,CAAC,qBAAqB,CAAC,EAAG,+CAA+C;QAE5F,cAAc;QACd,UAAU,EAAE,CAAC,MAAM,CAAC;QACpB,YAAY,EAAE,CAAC,MAAM,CAAC;QACtB,UAAU,EAAE,CAAC,YAAY,EAAE,sBAAsB,CAAC;QAClD,mBAAmB,EAAE,CAAC,YAAY,CAAC,EAAG,4CAA4C;QAElF,2BAA2B;QAC3B,SAAS,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,CAAC;QACjE,QAAQ,EAAE,CAAC,eAAe,CAAC;QAE3B,yBAAyB;QACzB,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,CAAC,WAAW,CAAC;QAExB,UAAU;QACV,eAAe,EAAE,CAAC,kBAAkB,EAAE,uBAAuB,CAAC;QAE9D,eAAe;QACf,WAAW,EAAE,CAAC,cAAc,CAAC;QAC7B,YAAY,EAAE,CAAC,eAAe,CAAC;QAC/B,cAAc,EAAE,CAAC,iBAAiB,CAAC;QACnC,YAAY,EAAE,CAAC,eAAe,CAAC;QAC/B,eAAe,EAAE,CAAC,kBAAkB,CAAC;KACtC,CAAC;IAEF;;OAEG;IACH,eAAe,CAAC,OAA0B;QACxC,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,SAA6B,CAAC;QAClC,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,aAAa,CAAC;YAEnD,QAAQ;YACR,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClD,SAAS,GAAG,OAAO,CAAC;gBACpB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;YAED,SAAS;YACT,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpD,SAAS,GAAG,QAAQ,CAAC;gBACrB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;YAED,UAAU;YACV,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,SAAS,GAAG,SAAS,CAAC;gBACtB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;YAED,UAAU;YACV,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,SAAS,GAAG,SAAS,CAAC;gBACtB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;YAED,UAAU;YACV,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,SAAS,GAAG,SAAS,CAAC;gBACtB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;YAED,UAAU;YACV,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,SAAS,GAAG,SAAS,CAAC;gBACtB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QACrD,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO;YACL,uBAAuB;YACvB;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YAED,wBAAwB;YACxB;gBACE,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YAED,2BAA2B;YAC3B;gBACE,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YAED,eAAe;YACf;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,UAAU;gBAClB,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,WAAW;gBACnB,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO;YACL,oBAAoB;YACpB;gBACE,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,mBAAmB;gBACzB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,mBAAmB;gBACzB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,YAAY;gBACnB,IAAI,EAAE,mBAAmB;gBACzB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,YAAY;gBACnB,IAAI,EAAE,mBAAmB;gBACzB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,YAAY;gBACnB,IAAI,EAAE,mBAAmB;gBACzB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,iBAAiB;YACjB;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,SAAS;gBACjB,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,gBAAgB;YAChB;gBACE,MAAM,EAAE,SAAS;gBACjB,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,aAAa;gBACrB,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,iBAAiB;YACjB;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,2BAA2B;YAC3B;gBACE,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,OAAO;YACP;gBACE,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,UAAU;gBACjB,IAAI,EAAE,MAAM;gBACZ,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,UAAU;gBACjB,IAAI,EAAE,MAAM;gBACZ,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,QAAQ;gBACf,IAAI,EAAE,MAAM;gBACZ,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD,+DAA+D;YAC/D,kDAAkD;YAClD;gBACE,MAAM,EAAE,aAAa;gBACrB,KAAK,EAAE,gBAAgB;gBACvB,IAAI,EAAE,MAAM;gBACZ,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,aAAa;gBACrB,KAAK,EAAE,gBAAgB;gBACvB,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,kBAAkB;YAClB;gBACE,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,QAAQ;gBACf,IAAI,EAAE,iBAAiB;gBACvB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,QAAQ;gBACf,IAAI,EAAE,iBAAiB;gBACvB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD,sEAAsE;YACtE,uEAAuE;YACvE,oEAAoE;YACpE,gEAAgE;YAChE;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,iBAAiB;gBACvB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,aAAa;gBACrB,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,iBAAiB;gBACvB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,WAAW;gBACnB,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,iBAAiB;gBACvB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,iBAAiB;YACjB;gBACE,MAAM,EAAE,UAAU;gBAClB,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;aACrB;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,IAAgB,EAAE,OAA0B;QAC1D,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,SAAS,CAAC;QAE3C,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAE5B,yCAAyC;QACzC,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAChD,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,MAAM,CAAC,IAAI,CAAC;YACrB,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,IAAgB;QAC9B,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YACtB,IAAI,CAAC,IAAI,KAAK,qBAAqB,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,IAAgB;QAC7B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAElD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAEvB,wDAAwD;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACjE,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+DAA+D;IAE/D,YAAY,CAAC,OAA0B;QACrC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,YAAY,CAAC,OAA0B;QACrC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,cAAc,CAAC,OAA0B;QACvC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,cAAc,CAAC,OAA0B;QACvC,uCAAuC;QACvC,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}
+{"version":3,"file":"python.js","sourceRoot":"","sources":["../../../src/languages/plugins/python.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C;;GAEG;AACH,MAAM,OAAO,YAAa,SAAQ,kBAAkB;IACzC,EAAE,GAAG,QAAiB,CAAC;IACvB,IAAI,GAAG,QAAQ,CAAC;IAChB,UAAU,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7B,QAAQ,GAAG,yBAAyB,CAAC;IAErC,SAAS,GAAsB;QACtC,oBAAoB;QACpB,gBAAgB,EAAE,CAAC,kBAAkB,CAAC;QACtC,oBAAoB,EAAE,EAAE,EAAG,iCAAiC;QAC5D,eAAe,EAAE,EAAE,EAAG,2BAA2B;QACjD,mBAAmB,EAAE,CAAC,qBAAqB,CAAC;QAC5C,iBAAiB,EAAE,CAAC,qBAAqB,CAAC,EAAG,+CAA+C;QAE5F,cAAc;QACd,UAAU,EAAE,CAAC,MAAM,CAAC;QACpB,YAAY,EAAE,CAAC,MAAM,CAAC;QACtB,UAAU,EAAE,CAAC,YAAY,EAAE,sBAAsB,CAAC;QAClD,mBAAmB,EAAE,CAAC,YAAY,CAAC,EAAG,4CAA4C;QAElF,2BAA2B;QAC3B,SAAS,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,CAAC;QACjE,QAAQ,EAAE,CAAC,eAAe,CAAC;QAE3B,yBAAyB;QACzB,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,CAAC,WAAW,CAAC;QAExB,UAAU;QACV,eAAe,EAAE,CAAC,kBAAkB,EAAE,uBAAuB,CAAC;QAE9D,eAAe;QACf,WAAW,EAAE,CAAC,cAAc,CAAC;QAC7B,YAAY,EAAE,CAAC,eAAe,CAAC;QAC/B,cAAc,EAAE,CAAC,iBAAiB,CAAC;QACnC,YAAY,EAAE,CAAC,eAAe,CAAC;QAC/B,eAAe,EAAE,CAAC,kBAAkB,CAAC;KACtC,CAAC;IAEF;;OAEG;IACH,eAAe,CAAC,OAA0B;QACxC,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,SAA6B,CAAC;QAClC,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,aAAa,CAAC;YAEnD,QAAQ;YACR,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClD,SAAS,GAAG,OAAO,CAAC;gBACpB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;YAED,SAAS;YACT,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpD,SAAS,GAAG,QAAQ,CAAC;gBACrB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;YAED,UAAU;YACV,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,SAAS,GAAG,SAAS,CAAC;gBACtB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;YAED,UAAU;YACV,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,SAAS,GAAG,SAAS,CAAC;gBACtB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;YAED,UAAU;YACV,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtD,SAAS,GAAG,SAAS,CAAC;gBACtB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;YAED,UAAU;YACV,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,SAAS,GAAG,SAAS,CAAC;gBACtB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QACrD,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO;YACL,uBAAuB;YACvB;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YAED,wBAAwB;YACxB;gBACE,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YAED,2BAA2B;YAC3B,EAAE;YACF,mEAAmE;YACnE,uEAAuE;YACvE,gEAAgE;YAChE,sEAAsE;YACtE,wEAAwE;YACxE,yEAAyE;YACzE,iEAAiE;YACjE,sBAAsB;YACtB;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YAED,qEAAqE;YACrE,mEAAmE;YACnE,oEAAoE;YACpE,qEAAqE;YACrE,+DAA+D;YAC/D,uDAAuD;SACxD,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,eAAe;QACb,OAAO;YACL,iBAAiB;YACjB;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,2BAA2B;YAC3B;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,OAAO;YACP;gBACE,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,QAAQ;gBACf,IAAI,EAAE,MAAM;gBACZ,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD,+DAA+D;YAC/D,kDAAkD;YAClD;gBACE,MAAM,EAAE,aAAa;gBACrB,KAAK,EAAE,gBAAgB;gBACvB,IAAI,EAAE,MAAM;gBACZ,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,aAAa;gBACrB,KAAK,EAAE,gBAAgB;gBACvB,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,kBAAkB;YAClB,sEAAsE;YACtE,uEAAuE;YACvE,oEAAoE;YACpE,wDAAwD;YACxD,4CAA4C;YAC5C;gBACE,MAAM,EAAE,aAAa;gBACrB,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,iBAAiB;gBACvB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,WAAW;gBACnB,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,iBAAiB;gBACvB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,iBAAiB;YACjB;gBACE,MAAM,EAAE,UAAU;gBAClB,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;aACrB;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,IAAgB,EAAE,OAA0B;QAC1D,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;YAAE,OAAO,SAAS,CAAC;QAE3C,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAE5B,yCAAyC;QACzC,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAChD,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,MAAM,CAAC,IAAI,CAAC;YACrB,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,IAAgB;QAC9B,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YACtB,IAAI,CAAC,IAAI,KAAK,qBAAqB,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,IAAgB;QAC7B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAElD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAEvB,wDAAwD;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACjE,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+DAA+D;IAE/D,YAAY,CAAC,OAA0B;QACrC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,YAAY,CAAC,OAA0B;QACrC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,cAAc,CAAC,OAA0B;QACvC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,cAAc,CAAC,OAA0B;QACvC,uCAAuC;QACvC,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}

package/dist/languages/plugins/rust.d.ts

@@ -26,6 +26,15 @@ export declare class RustPlugin extends BaseLanguagePlugin {
     getBuiltinSources(): TaintSourcePattern[];
     /**
      * Rust taint sink patterns.
+     *
+     * Only patterns that have NO counterpart in `DEFAULT_SINKS` belong here —
+     * `DEFAULT_SINKS` (`analysis/config-loader.ts`) is the canonical registry
+     * (ADR-004). Duplicated entries were dead weight: `TaintMatcherPass` merges
+     * plugin builtins *after* the config patterns, and `findSinks` dedupes by
+     * `location:line:cwe` keeping the higher-confidence match, so the config
+     * copy always won the slot. Removed in the #4 follow-up consolidation
+     * (`Command.arg/args`, classless `execute`, `File.open/create`,
+     * `serde_json.from_str/from_slice`, `reqwest.get/post`).
      */
     getBuiltinSinks(): TaintSinkPattern[];
     /**

package/dist/languages/plugins/rust.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rust.d.ts","sourceRoot":"","sources":["../../../src/languages/plugins/rust.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EACV,QAAQ,EACR,QAAQ,EACR,UAAU,EACX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C;;GAEG;AACH,qBAAa,UAAW,SAAQ,kBAAkB;IAChD,QAAQ,CAAC,EAAE,EAAG,MAAM,CAAU;IAC9B,QAAQ,CAAC,IAAI,UAAU;IACvB,QAAQ,CAAC,UAAU,WAAW;IAC9B,QAAQ,CAAC,QAAQ,2BAA2B;IAE5C,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CA+BnC;IAEF;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,iBAAiB,GAAG,aAAa,GAAG,SAAS;IAwDtE;;OAEG;IACH,iBAAiB,IAAI,kBAAkB,EAAE;IAgGzC;;OAEG;IACH,eAAe,IAAI,gBAAgB,EAAE;IA8JrC;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS;IAyBjF;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO;IAK1C;;OAEG;IACH,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS;IAqBpD,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,EAAE;IAIpD,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,EAAE;IAIpD,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,UAAU,EAAE;IAIxD,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS;CAK/D"}
+{"version":3,"file":"rust.d.ts","sourceRoot":"","sources":["../../../src/languages/plugins/rust.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EACV,QAAQ,EACR,QAAQ,EACR,UAAU,EACX,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C;;GAEG;AACH,qBAAa,UAAW,SAAQ,kBAAkB;IAChD,QAAQ,CAAC,EAAE,EAAG,MAAM,CAAU;IAC9B,QAAQ,CAAC,IAAI,UAAU;IACvB,QAAQ,CAAC,UAAU,WAAW;IAC9B,QAAQ,CAAC,QAAQ,2BAA2B;IAE5C,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CA+BnC;IAEF;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,iBAAiB,GAAG,aAAa,GAAG,SAAS;IAwDtE;;OAEG;IACH,iBAAiB,IAAI,kBAAkB,EAAE;IAwEzC;;;;;;;;;;;OAWG;IACH,eAAe,IAAI,gBAAgB,EAAE;IAmFrC;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS;IAyBjF;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO;IAK1C;;OAEG;IACH,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS;IAqBpD,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,EAAE;IAIpD,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,EAAE;IAIpD,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,UAAU,EAAE;IAIxD,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS;CAK/D"}

package/dist/languages/plugins/rust.js

@@ -94,34 +94,17 @@ export class RustPlugin extends BaseLanguagePlugin {
     getBuiltinSources() {
         return [
             // Actix-web request extractors
-            {
-                method: 'Query',
-                type: 'http_param',
-                severity: 'high',
-                confidence: 0.95,
-                returnTainted: true,
-            },
-            {
-                method: 'Json',
-                type: 'http_body',
-                severity: 'high',
-                confidence: 0.95,
-                returnTainted: true,
-            },
-            {
-                method: 'Path',
-                type: 'http_path',
-                severity: 'high',
-                confidence: 0.95,
-                returnTainted: true,
-            },
-            {
-                method: 'Form',
-                type: 'http_body',
-                severity: 'high',
-                confidence: 0.95,
-                returnTainted: true,
-            },
+            // NOTE: `Query` (http_param), `Json` (http_body) and `Path` (http_path)
+            // are registered identically in DEFAULT_SOURCES; the duplicates here
+            // emitted a second, byte-identical source at every call site
+            // (`findSources` has no dedup). Removed in the #4 follow-up
+            // consolidation — DEFAULT_SOURCES is the canonical registry (ADR-004).
+            // `Form` stays because the two surfaces disagree on its type
+            // `Form` is registered in DEFAULT_SOURCES, retyped there to `http_body`
+            // to match this entry (actix/axum `Form<T>` decodes the urlencoded
+            // request body, not the query string — `Query<T>` is the query one).
+            // The duplicate that used to sit here made every extractor emit two
+            // sources with different types.
             // Standard library sources
             {
                 method: 'args',
@@ -172,19 +155,21 @@ export class RustPlugin extends BaseLanguagePlugin {
                 confidence: 0.8,
                 returnTainted: true,
             },
-            // Network input
-            {
-                method: 'read',
-                class: 'TcpStream',
-                type: 'network_input',
-                severity: 'high',
-                confidence: 0.85,
-                returnTainted: true,
-            },
+            // NOTE: `TcpStream.read` (network_input) is registered identically in
+            // DEFAULT_SOURCES — duplicate removed in the #4 follow-up consolidation.
         ];
     }
     /**
      * Rust taint sink patterns.
+     *
+     * Only patterns that have NO counterpart in `DEFAULT_SINKS` belong here —
+     * `DEFAULT_SINKS` (`analysis/config-loader.ts`) is the canonical registry
+     * (ADR-004). Duplicated entries were dead weight: `TaintMatcherPass` merges
+     * plugin builtins *after* the config patterns, and `findSinks` dedupes by
+     * `location:line:cwe` keeping the higher-confidence match, so the config
+     * copy always won the slot. Removed in the #4 follow-up consolidation
+     * (`Command.arg/args`, classless `execute`, `File.open/create`,
+     * `serde_json.from_str/from_slice`, `reqwest.get/post`).
      */
     getBuiltinSinks() {
         return [
@@ -197,30 +182,7 @@ export class RustPlugin extends BaseLanguagePlugin {
                 severity: 'critical',
                 argPositions: [0],
             },
-            {
-                method: 'arg',
-                class: 'Command',
-                type: 'command_injection',
-                cwe: 'CWE-78',
-                severity: 'critical',
-                argPositions: [0],
-            },
-            {
-                method: 'args',
-                class: 'Command',
-                type: 'command_injection',
-                cwe: 'CWE-78',
-                severity: 'critical',
-                argPositions: [0],
-            },
             // SQL Injection
-            {
-                method: 'execute',
-                type: 'sql_injection',
-                cwe: 'CWE-89',
-                severity: 'critical',
-                argPositions: [0],
-            },
             {
                 method: 'query',
                 type: 'sql_injection',
@@ -236,22 +198,6 @@ export class RustPlugin extends BaseLanguagePlugin {
                 argPositions: [0],
             },
             // Path Traversal
-            {
-                method: 'open',
-                class: 'File',
-                type: 'path_traversal',
-                cwe: 'CWE-22',
-                severity: 'high',
-                argPositions: [0],
-            },
-            {
-                method: 'create',
-                class: 'File',
-                type: 'path_traversal',
-                cwe: 'CWE-22',
-                severity: 'high',
-                argPositions: [0],
-            },
             {
                 method: 'read_to_string',
                 class: 'std::fs',
@@ -291,40 +237,6 @@ export class RustPlugin extends BaseLanguagePlugin {
                 severity: 'critical',
                 argPositions: [0],
             },
-            // Deserialization (with serde)
-            {
-                method: 'from_str',
-                class: 'serde_json',
-                type: 'deserialization',
-                cwe: 'CWE-502',
-                severity: 'medium',
-                argPositions: [0],
-            },
-            {
-                method: 'from_slice',
-                class: 'serde_json',
-                type: 'deserialization',
-                cwe: 'CWE-502',
-                severity: 'medium',
-                argPositions: [0],
-            },
-            // SSRF
-            {
-                method: 'get',
-                class: 'reqwest',
-                type: 'ssrf',
-                cwe: 'CWE-918',
-                severity: 'high',
-                argPositions: [0],
-            },
-            {
-                method: 'post',
-                class: 'reqwest',
-                type: 'ssrf',
-                cwe: 'CWE-918',
-                severity: 'high',
-                argPositions: [0],
-            },
             // Regex DoS
             {
                 method: 'new',

package/dist/languages/plugins/rust.js.map

@@ -1 +1 @@
-{"version":3,"file":"rust.js","sourceRoot":"","sources":["../../../src/languages/plugins/rust.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C;;GAEG;AACH,MAAM,OAAO,UAAW,SAAQ,kBAAkB;IACvC,EAAE,GAAG,MAAe,CAAC;IACrB,IAAI,GAAG,MAAM,CAAC;IACd,UAAU,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,QAAQ,GAAG,uBAAuB,CAAC;IAEnC,SAAS,GAAsB;QACtC,oBAAoB;QACpB,gBAAgB,EAAE,CAAC,aAAa,CAAC;QACjC,oBAAoB,EAAE,CAAC,YAAY,CAAC;QACpC,eAAe,EAAE,CAAC,WAAW,CAAC;QAC9B,mBAAmB,EAAE,CAAC,eAAe,CAAC;QACtC,iBAAiB,EAAE,CAAC,eAAe,CAAC,EAAG,wCAAwC;QAE/E,cAAc;QACd,UAAU,EAAE,CAAC,iBAAiB,CAAC;QAC/B,YAAY,EAAE,CAAC,iBAAiB,CAAC;QACjC,UAAU,EAAE,CAAC,uBAAuB,EAAE,iBAAiB,CAAC;QACxD,mBAAmB,EAAE,CAAC,iBAAiB,CAAC;QAExC,2BAA2B;QAC3B,SAAS,EAAE,CAAC,WAAW,EAAE,gBAAgB,CAAC;QAC1C,QAAQ,EAAE,CAAC,WAAW,CAAC;QAEvB,yBAAyB;QACzB,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,SAAS,EAAE,EAAE;QAEb,UAAU;QACV,eAAe,EAAE,CAAC,iBAAiB,CAAC;QAEpC,eAAe;QACf,WAAW,EAAE,CAAC,eAAe,CAAC;QAC9B,YAAY,EAAE,CAAC,gBAAgB,CAAC;QAChC,cAAc,EAAE,CAAC,kBAAkB,CAAC;QACpC,YAAY,EAAE,EAAE,EAAG,yCAAyC;QAC5D,eAAe,EAAE,CAAC,mBAAmB,CAAC;KACvC,CAAC;IAEF;;OAEG;IACH,eAAe,CAAC,OAA0B;QACxC,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,SAA6B,CAAC;QAClC,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,aAAa,CAAC;YAEnD,YAAY;YACZ,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBACjE,SAAS,GAAG,WAAW,CAAC;gBACxB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YAClC,CAAC;YAED,SAAS;YACT,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9B,SAAS,GAAG,QAAQ,CAAC;gBACrB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YAClC,CAAC;YAED,OAAO;YACP,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,SAAS,GAAG,MAAM,CAAC;gBACnB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YAClC,CAAC;YAED,OAAO;YACP,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,SAAS,GAAG,MAAM,CAAC;gBACnB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YAClC,CAAC;YAED,QAAQ;YACR,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7B,SAAS,GAAG,SAAS,IAAI,OAAO,CAAC;gBACjC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YAClC,CAAC;YAED,wBAAwB;YACxB,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7B,UAAU,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QACrD,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO;YACL,+BAA+B;YAC/B;gBACE,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YAED,2BAA2B;YAC3B;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,UAAU;gBACjB,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,UAAU;gBACjB,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,UAAU;gBACjB,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YAED,WAAW;YACX;gBACE,MAAM,EAAE,gBAAgB;gBACxB,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,WAAW;gBACnB,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YAED,gBAAgB;YAChB;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,WAAW;gBAClB,IAAI,EAAE,eAAe;gBACrB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe;QACb,OAAO;YACL,oBAAoB;YACpB;gBACE,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,cAAc;gBACrB,IAAI,EAAE,mBAAmB;gBACzB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,mBAAmB;gBACzB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,mBAAmB;gBACzB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,gBAAgB;YAChB;gBACE,MAAM,EAAE,SAAS;gBACjB,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,WAAW;gBACnB,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,iBAAiB;YACjB;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,gBAAgB;gBACxB,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,8EAA8E;YAC9E;gBACE,MAAM,EAAE,SAAS;gBACjB,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,QAAQ;gBAClB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,oBAAoB;YACpB;gBACE,MAAM,EAAE,gBAAgB;gBACxB,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;aACrB;YACD;gBACE,MAAM,EAAE,WAAW;gBACnB,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,+BAA+B;YAC/B;gBACE,MAAM,EAAE,UAAU;gBAClB,KAAK,EAAE,YAAY;gBACnB,IAAI,EAAE,iBAAiB;gBACvB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,QAAQ;gBAClB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,YAAY;gBACpB,KAAK,EAAE,YAAY;gBACnB,IAAI,EAAE,iBAAiB;gBACvB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,QAAQ;gBAClB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,OAAO;YACP;gBACE,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,MAAM;gBACZ,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,MAAM;gBACZ,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,YAAY;YACZ;gBACE,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,OAAO;gBACd,IAAI,EAAE,WAAW;gBACjB,GAAG,EAAE,UAAU;gBACf,QAAQ,EAAE,QAAQ;gBAClB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,IAAgB,EAAE,OAA0B;QAC1D,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;YAAE,OAAO,SAAS,CAAC;QAEtD,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAE5B,0CAA0C;QAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC,IAAI,CAAC;YACpB,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,IAAI,CAAC,IAAI,CAAC;YACnB,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,IAAgB;QAC9B,OAAO,IAAI,CAAC,IAAI,KAAK,gBAAgB;YAC9B,IAAI,CAAC,IAAI,KAAK,oBAAoB,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,IAAgB;QAC7B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAElD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAEvB,wCAAwC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC9C,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QAED,yBAAyB;QACzB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+DAA+D;IAE/D,YAAY,CAAC,OAA0B;QACrC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,YAAY,CAAC,OAA0B;QACrC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,cAAc,CAAC,OAA0B;QACvC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,cAAc,CAAC,OAA0B;QACvC,mCAAmC;QACnC,4BAA4B;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}
+{"version":3,"file":"rust.js","sourceRoot":"","sources":["../../../src/languages/plugins/rust.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C;;GAEG;AACH,MAAM,OAAO,UAAW,SAAQ,kBAAkB;IACvC,EAAE,GAAG,MAAe,CAAC;IACrB,IAAI,GAAG,MAAM,CAAC;IACd,UAAU,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,QAAQ,GAAG,uBAAuB,CAAC;IAEnC,SAAS,GAAsB;QACtC,oBAAoB;QACpB,gBAAgB,EAAE,CAAC,aAAa,CAAC;QACjC,oBAAoB,EAAE,CAAC,YAAY,CAAC;QACpC,eAAe,EAAE,CAAC,WAAW,CAAC;QAC9B,mBAAmB,EAAE,CAAC,eAAe,CAAC;QACtC,iBAAiB,EAAE,CAAC,eAAe,CAAC,EAAG,wCAAwC;QAE/E,cAAc;QACd,UAAU,EAAE,CAAC,iBAAiB,CAAC;QAC/B,YAAY,EAAE,CAAC,iBAAiB,CAAC;QACjC,UAAU,EAAE,CAAC,uBAAuB,EAAE,iBAAiB,CAAC;QACxD,mBAAmB,EAAE,CAAC,iBAAiB,CAAC;QAExC,2BAA2B;QAC3B,SAAS,EAAE,CAAC,WAAW,EAAE,gBAAgB,CAAC;QAC1C,QAAQ,EAAE,CAAC,WAAW,CAAC;QAEvB,yBAAyB;QACzB,UAAU,EAAE,CAAC,gBAAgB,CAAC;QAC9B,SAAS,EAAE,EAAE;QAEb,UAAU;QACV,eAAe,EAAE,CAAC,iBAAiB,CAAC;QAEpC,eAAe;QACf,WAAW,EAAE,CAAC,eAAe,CAAC;QAC9B,YAAY,EAAE,CAAC,gBAAgB,CAAC;QAChC,cAAc,EAAE,CAAC,kBAAkB,CAAC;QACpC,YAAY,EAAE,EAAE,EAAG,yCAAyC;QAC5D,eAAe,EAAE,CAAC,mBAAmB,CAAC;KACvC,CAAC;IAEF;;OAEG;IACH,eAAe,CAAC,OAA0B;QACxC,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,IAAI,SAA6B,CAAC;QAClC,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,aAAa,CAAC;YAEnD,YAAY;YACZ,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBACjE,SAAS,GAAG,WAAW,CAAC;gBACxB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YAClC,CAAC;YAED,SAAS;YACT,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9B,SAAS,GAAG,QAAQ,CAAC;gBACrB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YAClC,CAAC;YAED,OAAO;YACP,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,SAAS,GAAG,MAAM,CAAC;gBACnB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YAClC,CAAC;YAED,OAAO;YACP,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,SAAS,GAAG,MAAM,CAAC;gBACnB,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YAClC,CAAC;YAED,QAAQ;YACR,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7B,SAAS,GAAG,SAAS,IAAI,OAAO,CAAC;gBACjC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YAClC,CAAC;YAED,wBAAwB;YACxB,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC7B,UAAU,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;QACrD,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,OAAO;YACL,+BAA+B;YAC/B,wEAAwE;YACxE,qEAAqE;YACrE,6DAA6D;YAC7D,4DAA4D;YAC5D,uEAAuE;YACvE,6DAA6D;YAC7D,wEAAwE;YACxE,mEAAmE;YACnE,qEAAqE;YACrE,oEAAoE;YACpE,gCAAgC;YAEhC,2BAA2B;YAC3B;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,UAAU;gBACjB,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,UAAU;gBACjB,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,UAAU;gBACjB,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,IAAI;gBAChB,aAAa,EAAE,IAAI;aACpB;YAED,WAAW;YACX;gBACE,MAAM,EAAE,gBAAgB;gBACxB,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YACD;gBACE,MAAM,EAAE,WAAW;gBACnB,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,GAAG;gBACf,aAAa,EAAE,IAAI;aACpB;YAED,sEAAsE;YACtE,yEAAyE;SAC1E,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,eAAe;QACb,OAAO;YACL,oBAAoB;YACpB;gBACE,MAAM,EAAE,SAAS;gBACjB,KAAK,EAAE,cAAc;gBACrB,IAAI,EAAE,mBAAmB;gBACzB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,gBAAgB;YAChB;gBACE,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,WAAW;gBACnB,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,iBAAiB;YACjB;gBACE,MAAM,EAAE,gBAAgB;gBACxB,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YACD;gBACE,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,8EAA8E;YAC9E;gBACE,MAAM,EAAE,SAAS;gBACjB,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,QAAQ;gBAClB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,oBAAoB;YACpB;gBACE,MAAM,EAAE,gBAAgB;gBACxB,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,MAAM;gBAChB,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;aACrB;YACD;gBACE,MAAM,EAAE,WAAW;gBACnB,IAAI,EAAE,eAAe;gBACrB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,UAAU;gBACpB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;YAED,YAAY;YACZ;gBACE,MAAM,EAAE,KAAK;gBACb,KAAK,EAAE,OAAO;gBACd,IAAI,EAAE,WAAW;gBACjB,GAAG,EAAE,UAAU;gBACf,QAAQ,EAAE,QAAQ;gBAClB,YAAY,EAAE,CAAC,CAAC,CAAC;aAClB;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,IAAgB,EAAE,OAA0B;QAC1D,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;YAAE,OAAO,SAAS,CAAC;QAEtD,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAE5B,0CAA0C;QAC1C,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC,IAAI,CAAC;YACpB,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,IAAI,CAAC,IAAI,CAAC;YACnB,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,IAAgB;QAC9B,OAAO,IAAI,CAAC,IAAI,KAAK,gBAAgB;YAC9B,IAAI,CAAC,IAAI,KAAK,oBAAoB,CAAC;IAC5C,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,IAAgB;QAC7B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QAElD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QAEvB,wCAAwC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC9C,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QAED,yBAAyB;QACzB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+DAA+D;IAE/D,YAAY,CAAC,OAA0B;QACrC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,YAAY,CAAC,OAA0B;QACrC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,cAAc,CAAC,OAA0B;QACvC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,cAAc,CAAC,OAA0B;QACvC,mCAAmC;QACnC,4BAA4B;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}

package/dist/languages/types.d.ts

@@ -5,7 +5,7 @@
  * Each language (Java, JavaScript, Python, Rust, Bash, HTML) implements this interface.
  */
 import type { Parser, Node as SyntaxNode, Tree } from 'web-tree-sitter';
-import type { TypeInfo, CallInfo, ImportInfo } from '../types/index.js';
+import type { TypeInfo, CallInfo, ImportInfo, SourceType, SinkType } from '../types/index.js';
 /**
  * Supported languages for analysis
  */
@@ -139,7 +139,7 @@ export interface TaintSourcePattern {
     class?: string;
     annotation?: string;
     parameterPattern?: RegExp;
-    type: string;
+    type: SourceType;
     severity: 'critical' | 'high' | 'medium' | 'low';
     confidence: number;
     returnTainted?: boolean;
@@ -151,7 +151,7 @@ export interface TaintSourcePattern {
 export interface TaintSinkPattern {
     method: string;
     class?: string;
-    type: string;
+    type: SinkType;
     cwe: string;
     severity: 'critical' | 'high' | 'medium' | 'low';
     argPositions: number[];

package/dist/languages/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/languages/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,IAAI,UAAU,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,KAAK,EACV,QAAQ,EAER,QAAQ,EACR,UAAU,EAGX,MAAM,mBAAmB,CAAC;AAE3B;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,GAAG,GAAG,KAAK,GAAG,YAAY,GAAG,YAAY,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,IAAI,CAAC;AAEhJ;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAEhC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAG5B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAG9B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IAGnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;IAGpB,eAAe,EAAE,MAAM,EAAE,CAAC;IAG1B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,QAAQ,CAAC,EAAE,EAAE,iBAAiB,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IAEtC;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1C;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAErC;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,iBAAiB,GAAG,aAAa,GAAG,SAAS,CAAC;IAEvE;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,EAAE,CAAC;IAErD;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,EAAE,CAAC;IAErD;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,UAAU,EAAE,CAAC;IAEzD;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS,CAAC;IAE/D;;;OAGG;IACH,iBAAiB,IAAI,kBAAkB,EAAE,CAAC;IAE1C;;;OAGG;IACH,eAAe,IAAI,gBAAgB,EAAE,CAAC;IAEtC;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS,CAAC;IAElF;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;IAE3C;;OAEG;IACH,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;CACtD;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAEjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IAGf,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,UAAU,EAAE,MAAM,CAAC;IAGnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAE/B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IAGf,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IAGjD,YAAY,EAAE,MAAM,EAAE,CAAC;IAGvB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IAEvC;;OAEG;IACH,GAAG,CAAC,QAAQ,EAAE,iBAAiB,GAAG,cAAc,GAAG,SAAS,CAAC;IAE7D;;OAEG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;IAEzD;;OAEG;IACH,MAAM,IAAI,cAAc,EAAE,CAAC;IAE3B;;OAEG;IACH,qBAAqB,IAAI,iBAAiB,EAAE,CAAC;CAC9C"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/languages/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,IAAI,UAAU,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACxE,OAAO,KAAK,EACV,QAAQ,EAER,QAAQ,EACR,UAAU,EAGV,UAAU,EACV,QAAQ,EACT,MAAM,mBAAmB,CAAC;AAE3B;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,GAAG,GAAG,KAAK,GAAG,YAAY,GAAG,YAAY,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,IAAI,CAAC;AAEhJ;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAEhC,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAG5B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAG9B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IAGnB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,EAAE,CAAC;IAGpB,eAAe,EAAE,MAAM,EAAE,CAAC;IAG1B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,QAAQ,CAAC,EAAE,EAAE,iBAAiB,CAAC;IAE/B;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;IAE9B;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IAEtC;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1C;;OAEG;IACH,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAErC;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,iBAAiB,GAAG,aAAa,GAAG,SAAS,CAAC;IAEvE;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,EAAE,CAAC;IAErD;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,iBAAiB,GAAG,QAAQ,EAAE,CAAC;IAErD;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,UAAU,EAAE,CAAC;IAEzD;;OAEG;IACH,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS,CAAC;IAE/D;;;OAGG;IACH,iBAAiB,IAAI,kBAAkB,EAAE,CAAC;IAE1C;;;OAGG;IACH,eAAe,IAAI,gBAAgB,EAAE,CAAC;IAEtC;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS,CAAC;IAElF;;OAEG;IACH,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;IAE3C;;OAEG;IACH,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC;CACtD;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAEjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IAGf,UAAU,CAAC,EAAE,MAAM,CAAC;IAGpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAI1B,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACjD,UAAU,EAAE,MAAM,CAAC;IAGnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAE/B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IAYf,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IAGjD,YAAY,EAAE,MAAM,EAAE,CAAC;IAGvB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;IAEvC;;OAEG;IACH,GAAG,CAAC,QAAQ,EAAE,iBAAiB,GAAG,cAAc,GAAG,SAAS,CAAC;IAE7D;;OAEG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;IAEzD;;OAEG;IACH,MAAM,IAAI,cAAc,EAAE,CAAC;IAE3B;;OAEG;IACH,qBAAqB,IAAI,iBAAiB,EAAE,CAAC;CAC9C"}

package/dist/types/config.d.ts

@@ -44,6 +44,21 @@ export interface SinkPattern {
      * `cursor.execute()` vs Java `Executor.execute()`).
      */
     languages?: SupportedLanguage[];
+    /**
+     * Exclude the pattern from specific source languages, keeping it active
+     * everywhere else. The inverse of `languages`, for the case where a broad
+     * classless pattern is correct in most ecosystems but *wrong* in one —
+     * e.g. classless `exec` is command_injection (CWE-78) for Node's
+     * destructured `child_process.exec` and Java's unresolved `r.exec()`, but
+     * in Python `exec(code)` is the code-execution builtin (CWE-94, registered
+     * separately). Without this, both sinks fire on the same Python call and
+     * emit two findings with different CWEs.
+     *
+     * Prefer `languages` when a pattern belongs to one ecosystem; reach for
+     * this only to carve a single language out of a genuinely broad pattern.
+     * When both are present `languages` is applied first.
+     */
+    exclude_languages?: SupportedLanguage[];
     /**
      * Suppress the sink when the argument at the given 0-indexed position is a
      * class literal (e.g. `Foo.class`, `com.example.Bar.class`). Used by

package/dist/types/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/types/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAMhG,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAE5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IAGf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAIhB,UAAU,CAAC,EAAE,MAAM,CAAC;IAIpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IAGnB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAEhC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAMD,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,QAAQ,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAChC;;;;;;;;;OASG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;;;OAOG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;;;;;OASG;IACH,UAAU,EACN,aAAa,GACb,cAAc,GACd,qBAAqB,GACrB,cAAc,GACd,SAAS,GAKT,gBAAgB,GAChB,oBAAoB,CAAC;IAEzB;;;;;OAKG;IACH,SAAS,EAAE,QAAQ,EAAE,CAAC;IAEtB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,kBAAkB,EAAE,CAAC;CAC7B;AAMD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;IAC/B;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACtC;AAMD;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,0DAA0D;IAC1D,KAAK,EAAE,UAAU,CAAC;IAClB,+DAA+D;IAC/D,QAAQ,EAAE,QAAQ,CAAC;IACnB,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,IAAI,EAAE,SAAS,GAAG,YAAY,GAAG,cAAc,CAAC;IAChD;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;CACf"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/types/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAMhG,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAE5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IAGf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAIhB,UAAU,CAAC,EAAE,MAAM,CAAC;IAIpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,IAAI,EAAE,UAAU,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IAGnB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAEhC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAMD,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,QAAQ,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAChC;;;;;;;;;;;;;OAaG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACxC;;;;;;;;;OASG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;;;;OAQG;IACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;;;OAOG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAMD;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;;;;;;OASG;IACH,UAAU,EACN,aAAa,GACb,cAAc,GACd,qBAAqB,GACrB,cAAc,GACd,SAAS,GAKT,gBAAgB,GAChB,oBAAoB,CAAC;IAEzB;;;;;OAKG;IACH,SAAS,EAAE,QAAQ,EAAE,CAAC;IAEtB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,kBAAkB,EAAE,CAAC;CAC7B;AAMD,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,UAAU,EAAE,gBAAgB,EAAE,CAAC;IAC/B;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACtC;AAMD;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;IACZ,0DAA0D;IAC1D,KAAK,EAAE,UAAU,CAAC;IAClB,+DAA+D;IAC/D,QAAQ,EAAE,QAAQ,CAAC;IACnB,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,IAAI,EAAE,SAAS,GAAG,YAAY,GAAG,cAAc,CAAC;IAChD;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,mDAAmD;IACnD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;CACf"}

package/dist/types/index.d.ts

@@ -179,8 +179,19 @@ export interface TaintFlowStep {
     line: number;
     type: 'source' | 'assignment' | 'use' | 'return' | 'field' | 'sink';
 }
-export type SourceType = "http_param" | "http_body" | "http_header" | "http_cookie" | "http_path" | "http_query" | "io_input" | "env_input" | "db_input" | "network_input" | "file_input" | "dom_input" | "config_param" | "interprocedural_param" | "plugin_param" | "constructor_field";
-export type SinkType = "sql_injection" | "nosql_injection" | "command_injection" | "path_traversal" | "xss" | "xxe" | "deserialization" | "ldap_injection" | "xpath_injection" | "ssrf" | "open_redirect" | "code_injection" | "log_injection" | "redos" | "format_string" | "crlf" | "mass_assignment" | "mybatis_mapper_call" | "weak_random" | "weak_hash" | "weak_crypto" | "insecure_cookie" | "trust_boundary" | "prompt_injection" | "external_taint_escape";
+/**
+ * Every taint-source category the engine can emit.
+ *
+ * Exported as a runtime array, not just a type, for two reasons: the
+ * conformance test needs to check emitted values against it, and consumers
+ * switching on `TaintSource.type` can build an exhaustive map from it instead
+ * of hand-copying the list. An unmatched source type is a *silent* failure
+ * downstream — it falls through to a default branch rather than throwing —
+ * so having the set available at runtime is what makes that checkable.
+ */
+export declare const SOURCE_TYPES: readonly ["http_param", "http_body", "http_header", "http_cookie", "http_path", "http_query", "io_input", "env_input", "db_input", "network_input", "file_input", "dom_input", "config_param", "interprocedural_param", "plugin_param", "constructor_field", "cli_arg", "file_upload", "http_response", "message_input", "navigation_param", "storage_input", "url_param", "user_input", "env_var"];
+export type SourceType = (typeof SOURCE_TYPES)[number];
+export type SinkType = "sql_injection" | "nosql_injection" | "command_injection" | "path_traversal" | "xss" | "xxe" | "deserialization" | "ldap_injection" | "xpath_injection" | "ssrf" | "open_redirect" | "code_injection" | "log_injection" | "redos" | "format_string" | "crlf" | "mass_assignment" | "mybatis_mapper_call" | "weak_random" | "weak_hash" | "weak_crypto" | "insecure_cookie" | "trust_boundary" | "prompt_injection" | "insecure_storage" | "prototype_pollution" | "regex_dos" | "unsafe_memory" | "external_taint_escape";
 export type Severity = "critical" | "high" | "medium" | "low";
 /**
  * Project shape axis of the project-profile model (added in 3.106.0).