circle-ir 3.27.1 → 3.29.0

package/dist/analyzer.js

@@ -51,7 +51,7 @@
  *  – MissingGuardDomPass  — false positives in framework-auth codebases (see pass file)
  *  – FeatureEnvyPass      — fires on legitimate delegation patterns (see pass file)
  */
-import { initParser, parse, extractMeta, extractTypes, extractCalls, extractImports, extractExports, buildCFG, buildDFG, collectAllNodes, } from './core/index.js';
+import { initParser, parse, disposeTree, extractMeta, extractTypes, extractCalls, extractImports, extractExports, buildCFG, buildDFG, collectAllNodes, } from './core/index.js';
 import { analyzeTaint, getDefaultConfig, detectUnresolved, analyzeConstantPropagation, isFalsePositive, } from './analysis/index.js';
 import { registerBuiltinPlugins } from './languages/index.js';
 import { logger } from './utils/logger.js';
@@ -249,140 +249,147 @@ export async function analyze(code, filePath, language, options = {}) {
         return analyzeHtmlFile(code, filePath, options);
     }
     logger.debug('Analyzing file', { filePath, language, codeLength: code.length });
-    // Parse the code
+    // Parse the code. The Tree holds tree-sitter WASM memory; we MUST dispose
+    // it before returning, otherwise the WASM heap grows unboundedly across
+    // many analyze() calls in the same process (issue #16).
     const tree = await parse(code, language);
-    logger.trace('Parsed AST', { rootNodeType: tree.rootNode.type });
-    // Collect all node types in a single traversal for better performance
-    const nodeCache = collectAllNodes(tree.rootNode, getNodeTypesForLanguage(language));
-    // Extract all IR components
-    const meta = extractMeta(code, tree, filePath, language);
-    const types = extractTypes(tree, nodeCache, language);
-    const calls = extractCalls(tree, nodeCache, language);
-    const imports = extractImports(tree, language);
-    const exports = extractExports(types);
-    const cfg = buildCFG(tree, language);
-    const dfg = buildDFG(tree, nodeCache, language);
-    // Build CodeGraph once — shared across all passes.
-    // Taint is empty at construction time; sources/sinks/sanitizers are populated by passes.
-    const graph = new CodeGraph({
-        meta, types, calls, cfg, dfg,
-        taint: { sources: [], sinks: [], sanitizers: [] },
-        imports, exports, unresolved: [], enriched: {},
-    });
-    const config = options.taintConfig ?? getDefaultConfig();
-    // Build the analysis pipeline with configurable pass options
-    const disabledPasses = new Set(options.disabledPasses ?? []);
-    const passOpts = options.passOptions ?? {};
-    const pipeline = new AnalysisPipeline();
-    // Core taint analysis passes (always enabled)
-    pipeline.add(new TaintMatcherPass());
-    pipeline.add(new ConstantPropagationPass(tree));
-    pipeline.add(new LanguageSourcesPass());
-    pipeline.add(new SinkFilterPass());
-    pipeline.add(new TaintPropagationPass());
-    pipeline.add(new InterproceduralPass());
-    // Secret scanner runs after LanguageSourcesPass so the legacy Bash
-    // `hardcoded-credential` findings are already in the dedup buffer.
-    if (!disabledPasses.has('scan-secrets'))
-        pipeline.add(new ScanSecretsPass());
-    // Optional passes — can be disabled via disabledPasses
-    if (!disabledPasses.has('dead-code'))
-        pipeline.add(new DeadCodePass());
-    if (!disabledPasses.has('missing-await'))
-        pipeline.add(new MissingAwaitPass());
-    if (!disabledPasses.has('n-plus-one'))
-        pipeline.add(new NPlusOnePass());
-    if (!disabledPasses.has('missing-public-doc'))
-        pipeline.add(new MissingPublicDocPass());
-    if (!disabledPasses.has('todo-in-prod'))
-        pipeline.add(new TodoInProdPass());
-    if (!disabledPasses.has('string-concat-loop'))
-        pipeline.add(new StringConcatLoopPass());
-    if (!disabledPasses.has('sync-io-async'))
-        pipeline.add(new SyncIoAsyncPass());
-    if (!disabledPasses.has('unchecked-return'))
-        pipeline.add(new UncheckedReturnPass());
-    if (!disabledPasses.has('null-deref'))
-        pipeline.add(new NullDerefPass());
-    if (!disabledPasses.has('resource-leak'))
-        pipeline.add(new ResourceLeakPass());
-    if (!disabledPasses.has('variable-shadowing'))
-        pipeline.add(new VariableShadowingPass());
-    if (!disabledPasses.has('leaked-global'))
-        pipeline.add(new LeakedGlobalPass());
-    if (!disabledPasses.has('unused-variable'))
-        pipeline.add(new UnusedVariablePass());
-    if (!disabledPasses.has('dependency-fan-out'))
-        pipeline.add(new DependencyFanOutPass(passOpts.dependencyFanOut));
-    if (!disabledPasses.has('stale-doc-ref'))
-        pipeline.add(new StaleDocRefPass());
-    if (!disabledPasses.has('infinite-loop'))
-        pipeline.add(new InfiniteLoopPass());
-    if (!disabledPasses.has('deep-inheritance'))
-        pipeline.add(new DeepInheritancePass());
-    if (!disabledPasses.has('redundant-loop-computation'))
-        pipeline.add(new RedundantLoopPass());
-    if (!disabledPasses.has('unbounded-collection'))
-        pipeline.add(new UnboundedCollectionPass(passOpts.unboundedCollection));
-    if (!disabledPasses.has('serial-await'))
-        pipeline.add(new SerialAwaitPass());
-    if (!disabledPasses.has('react-inline-jsx'))
-        pipeline.add(new ReactInlineJsxPass());
-    if (!disabledPasses.has('swallowed-exception'))
-        pipeline.add(new SwallowedExceptionPass());
-    if (!disabledPasses.has('broad-catch'))
-        pipeline.add(new BroadCatchPass());
-    if (!disabledPasses.has('unhandled-exception'))
-        pipeline.add(new UnhandledExceptionPass());
-    if (!disabledPasses.has('double-close'))
-        pipeline.add(new DoubleClosePass());
-    if (!disabledPasses.has('use-after-close'))
-        pipeline.add(new UseAfterClosePass());
-    if (!disabledPasses.has('cleanup-verify'))
-        pipeline.add(new CleanupVerifyPass());
-    if (!disabledPasses.has('missing-override'))
-        pipeline.add(new MissingOverridePass());
-    if (!disabledPasses.has('unused-interface-method'))
-        pipeline.add(new UnusedInterfaceMethodPass());
-    if (!disabledPasses.has('blocking-main-thread'))
-        pipeline.add(new BlockingMainThreadPass());
-    if (!disabledPasses.has('excessive-allocation'))
-        pipeline.add(new ExcessiveAllocationPass());
-    if (!disabledPasses.has('missing-stream'))
-        pipeline.add(new MissingStreamPass());
-    if (!disabledPasses.has('god-class'))
-        pipeline.add(new GodClassPass());
-    if (!disabledPasses.has('naming-convention'))
-        pipeline.add(new NamingConventionPass(passOpts.namingConvention));
-    if (!disabledPasses.has('security-headers'))
-        pipeline.add(new SecurityHeadersPass(passOpts.securityHeaders));
-    // Run the pipeline
-    const { results, findings } = pipeline.run(graph, code, language, config);
-    const sinkFilter = results.get('sink-filter');
-    const interProc = results.get('interprocedural');
-    const taint = {
-        sources: sinkFilter.sources,
-        sinks: [...sinkFilter.sinks, ...interProc.additionalSinks],
-        sanitizers: sinkFilter.sanitizers,
-        flows: interProc.additionalFlows,
-        interprocedural: interProc.interprocedural,
-    };
-    const unresolved = detectUnresolved(calls, types, dfg);
-    const enriched = buildEnriched(types, calls, taint.sources, taint.sinks);
-    // Compute software metrics (CK suite, Halstead, composite scores)
-    const metricValues = new MetricRunner().run({ meta, types, calls, cfg, dfg, taint, imports, exports, unresolved, enriched }, code, language);
-    logger.debug('Analysis complete', {
-        filePath,
-        finalSources: taint.sources.length,
-        finalSinks: taint.sinks.length,
-        flows: taint.flows?.length ?? 0,
-        unresolvedItems: unresolved.length,
-    });
-    return {
-        meta, types, calls, cfg, dfg, taint, imports, exports, unresolved, enriched,
-        findings: findings.length > 0 ? findings : undefined,
-        metrics: { file: filePath, metrics: metricValues },
-    };
+    try {
+        logger.trace('Parsed AST', { rootNodeType: tree.rootNode.type });
+        // Collect all node types in a single traversal for better performance
+        const nodeCache = collectAllNodes(tree.rootNode, getNodeTypesForLanguage(language));
+        // Extract all IR components
+        const meta = extractMeta(code, tree, filePath, language);
+        const types = extractTypes(tree, nodeCache, language);
+        const calls = extractCalls(tree, nodeCache, language);
+        const imports = extractImports(tree, language);
+        const exports = extractExports(types);
+        const cfg = buildCFG(tree, language);
+        const dfg = buildDFG(tree, nodeCache, language);
+        // Build CodeGraph once — shared across all passes.
+        // Taint is empty at construction time; sources/sinks/sanitizers are populated by passes.
+        const graph = new CodeGraph({
+            meta, types, calls, cfg, dfg,
+            taint: { sources: [], sinks: [], sanitizers: [] },
+            imports, exports, unresolved: [], enriched: {},
+        });
+        const config = options.taintConfig ?? getDefaultConfig();
+        // Build the analysis pipeline with configurable pass options
+        const disabledPasses = new Set(options.disabledPasses ?? []);
+        const passOpts = options.passOptions ?? {};
+        const pipeline = new AnalysisPipeline();
+        // Core taint analysis passes (always enabled)
+        pipeline.add(new TaintMatcherPass());
+        pipeline.add(new ConstantPropagationPass(tree));
+        pipeline.add(new LanguageSourcesPass());
+        pipeline.add(new SinkFilterPass());
+        pipeline.add(new TaintPropagationPass());
+        pipeline.add(new InterproceduralPass());
+        // Secret scanner runs after LanguageSourcesPass so the legacy Bash
+        // `hardcoded-credential` findings are already in the dedup buffer.
+        if (!disabledPasses.has('scan-secrets'))
+            pipeline.add(new ScanSecretsPass());
+        // Optional passes — can be disabled via disabledPasses
+        if (!disabledPasses.has('dead-code'))
+            pipeline.add(new DeadCodePass());
+        if (!disabledPasses.has('missing-await'))
+            pipeline.add(new MissingAwaitPass());
+        if (!disabledPasses.has('n-plus-one'))
+            pipeline.add(new NPlusOnePass());
+        if (!disabledPasses.has('missing-public-doc'))
+            pipeline.add(new MissingPublicDocPass());
+        if (!disabledPasses.has('todo-in-prod'))
+            pipeline.add(new TodoInProdPass());
+        if (!disabledPasses.has('string-concat-loop'))
+            pipeline.add(new StringConcatLoopPass());
+        if (!disabledPasses.has('sync-io-async'))
+            pipeline.add(new SyncIoAsyncPass());
+        if (!disabledPasses.has('unchecked-return'))
+            pipeline.add(new UncheckedReturnPass());
+        if (!disabledPasses.has('null-deref'))
+            pipeline.add(new NullDerefPass());
+        if (!disabledPasses.has('resource-leak'))
+            pipeline.add(new ResourceLeakPass());
+        if (!disabledPasses.has('variable-shadowing'))
+            pipeline.add(new VariableShadowingPass());
+        if (!disabledPasses.has('leaked-global'))
+            pipeline.add(new LeakedGlobalPass());
+        if (!disabledPasses.has('unused-variable'))
+            pipeline.add(new UnusedVariablePass());
+        if (!disabledPasses.has('dependency-fan-out'))
+            pipeline.add(new DependencyFanOutPass(passOpts.dependencyFanOut));
+        if (!disabledPasses.has('stale-doc-ref'))
+            pipeline.add(new StaleDocRefPass());
+        if (!disabledPasses.has('infinite-loop'))
+            pipeline.add(new InfiniteLoopPass());
+        if (!disabledPasses.has('deep-inheritance'))
+            pipeline.add(new DeepInheritancePass());
+        if (!disabledPasses.has('redundant-loop-computation'))
+            pipeline.add(new RedundantLoopPass());
+        if (!disabledPasses.has('unbounded-collection'))
+            pipeline.add(new UnboundedCollectionPass(passOpts.unboundedCollection));
+        if (!disabledPasses.has('serial-await'))
+            pipeline.add(new SerialAwaitPass());
+        if (!disabledPasses.has('react-inline-jsx'))
+            pipeline.add(new ReactInlineJsxPass());
+        if (!disabledPasses.has('swallowed-exception'))
+            pipeline.add(new SwallowedExceptionPass());
+        if (!disabledPasses.has('broad-catch'))
+            pipeline.add(new BroadCatchPass());
+        if (!disabledPasses.has('unhandled-exception'))
+            pipeline.add(new UnhandledExceptionPass());
+        if (!disabledPasses.has('double-close'))
+            pipeline.add(new DoubleClosePass());
+        if (!disabledPasses.has('use-after-close'))
+            pipeline.add(new UseAfterClosePass());
+        if (!disabledPasses.has('cleanup-verify'))
+            pipeline.add(new CleanupVerifyPass());
+        if (!disabledPasses.has('missing-override'))
+            pipeline.add(new MissingOverridePass());
+        if (!disabledPasses.has('unused-interface-method'))
+            pipeline.add(new UnusedInterfaceMethodPass());
+        if (!disabledPasses.has('blocking-main-thread'))
+            pipeline.add(new BlockingMainThreadPass());
+        if (!disabledPasses.has('excessive-allocation'))
+            pipeline.add(new ExcessiveAllocationPass());
+        if (!disabledPasses.has('missing-stream'))
+            pipeline.add(new MissingStreamPass());
+        if (!disabledPasses.has('god-class'))
+            pipeline.add(new GodClassPass());
+        if (!disabledPasses.has('naming-convention'))
+            pipeline.add(new NamingConventionPass(passOpts.namingConvention));
+        if (!disabledPasses.has('security-headers'))
+            pipeline.add(new SecurityHeadersPass(passOpts.securityHeaders));
+        // Run the pipeline
+        const { results, findings } = pipeline.run(graph, code, language, config);
+        const sinkFilter = results.get('sink-filter');
+        const interProc = results.get('interprocedural');
+        const taint = {
+            sources: sinkFilter.sources,
+            sinks: [...sinkFilter.sinks, ...interProc.additionalSinks],
+            sanitizers: sinkFilter.sanitizers,
+            flows: interProc.additionalFlows,
+            interprocedural: interProc.interprocedural,
+        };
+        const unresolved = detectUnresolved(calls, types, dfg);
+        const enriched = buildEnriched(types, calls, taint.sources, taint.sinks);
+        // Compute software metrics (CK suite, Halstead, composite scores)
+        const metricValues = new MetricRunner().run({ meta, types, calls, cfg, dfg, taint, imports, exports, unresolved, enriched }, code, language);
+        logger.debug('Analysis complete', {
+            filePath,
+            finalSources: taint.sources.length,
+            finalSinks: taint.sinks.length,
+            flows: taint.flows?.length ?? 0,
+            unresolvedItems: unresolved.length,
+        });
+        return {
+            meta, types, calls, cfg, dfg, taint, imports, exports, unresolved, enriched,
+            findings: findings.length > 0 ? findings : undefined,
+            metrics: { file: filePath, metrics: metricValues },
+        };
+    }
+    finally {
+        disposeTree(tree);
+    }
 }
 // ---------------------------------------------------------------------------
 // HTML preprocessor
@@ -396,64 +403,69 @@ async function analyzeHtmlFile(code, filePath, options) {
     logger.debug('Analyzing HTML file', { filePath, codeLength: code.length });
     // Parse HTML
     const tree = await parse(code, 'html');
-    const meta = extractMeta(code, tree, filePath, 'html');
-    // Extract script blocks and event handlers
-    const { scriptBlocks, eventHandlers } = extractHtmlContent(tree.rootNode);
-    logger.debug('HTML extraction', {
-        filePath,
-        inlineScripts: scriptBlocks.filter(b => b.kind === 'inline').length,
-        externalScripts: scriptBlocks.filter(b => b.kind === 'external-src').length,
-        eventHandlers: eventHandlers.length,
-    });
-    // Analyze each inline script block via standard JS pipeline
-    const scriptResults = [];
-    for (const block of scriptBlocks) {
-        if (block.kind !== 'inline' || !block.code.trim())
-            continue;
-        // Determine script language from type/lang attribute
-        const scriptLang = block.scriptType === 'ts' || block.scriptType === 'typescript' ||
-            block.scriptType === 'text/typescript'
-            ? 'typescript'
-            : 'javascript';
-        try {
-            const ir = await analyze(block.code, filePath, scriptLang, options);
-            scriptResults.push({ ir, lineOffset: block.lineOffset });
+    try {
+        const meta = extractMeta(code, tree, filePath, 'html');
+        // Extract script blocks and event handlers
+        const { scriptBlocks, eventHandlers } = extractHtmlContent(tree.rootNode);
+        logger.debug('HTML extraction', {
+            filePath,
+            inlineScripts: scriptBlocks.filter(b => b.kind === 'inline').length,
+            externalScripts: scriptBlocks.filter(b => b.kind === 'external-src').length,
+            eventHandlers: eventHandlers.length,
+        });
+        // Analyze each inline script block via standard JS pipeline
+        const scriptResults = [];
+        for (const block of scriptBlocks) {
+            if (block.kind !== 'inline' || !block.code.trim())
+                continue;
+            // Determine script language from type/lang attribute
+            const scriptLang = block.scriptType === 'ts' || block.scriptType === 'typescript' ||
+                block.scriptType === 'text/typescript'
+                ? 'typescript'
+                : 'javascript';
+            try {
+                const ir = await analyze(block.code, filePath, scriptLang, options);
+                scriptResults.push({ ir, lineOffset: block.lineOffset });
+            }
+            catch (e) {
+                logger.warn('Failed to analyze script block', {
+                    filePath,
+                    lineOffset: block.lineOffset,
+                    error: e instanceof Error ? e.message : String(e),
+                });
+            }
         }
-        catch (e) {
-            logger.warn('Failed to analyze script block', {
-                filePath,
-                lineOffset: block.lineOffset,
-                error: e instanceof Error ? e.message : String(e),
-            });
+        // Analyze inline event handlers (wrap in synthetic function)
+        for (const handler of eventHandlers) {
+            const wrappedCode = `function __${handler.eventName}_handler() { ${handler.code} }`;
+            try {
+                const ir = await analyze(wrappedCode, filePath, 'javascript', options);
+                scriptResults.push({ ir, lineOffset: handler.line });
+            }
+            catch (e) {
+                logger.warn('Failed to analyze event handler', {
+                    filePath,
+                    eventName: handler.eventName,
+                    line: handler.line,
+                    error: e instanceof Error ? e.message : String(e),
+                });
+            }
         }
+        // Run attribute-level security checks
+        const attributeFindings = runHtmlAttributeSecurityChecks(tree.rootNode, filePath);
+        // Merge everything
+        const result = mergeHtmlResults(meta, scriptResults, attributeFindings);
+        logger.debug('HTML analysis complete', {
+            filePath,
+            scriptBlocks: scriptResults.length,
+            attributeFindings: attributeFindings.length,
+            totalFindings: result.findings?.length ?? 0,
+        });
+        return result;
     }
-    // Analyze inline event handlers (wrap in synthetic function)
-    for (const handler of eventHandlers) {
-        const wrappedCode = `function __${handler.eventName}_handler() { ${handler.code} }`;
-        try {
-            const ir = await analyze(wrappedCode, filePath, 'javascript', options);
-            scriptResults.push({ ir, lineOffset: handler.line });
-        }
-        catch (e) {
-            logger.warn('Failed to analyze event handler', {
-                filePath,
-                eventName: handler.eventName,
-                line: handler.line,
-                error: e instanceof Error ? e.message : String(e),
-            });
-        }
+    finally {
+        disposeTree(tree);
     }
-    // Run attribute-level security checks
-    const attributeFindings = runHtmlAttributeSecurityChecks(tree.rootNode, filePath);
-    // Merge everything
-    const result = mergeHtmlResults(meta, scriptResults, attributeFindings);
-    logger.debug('HTML analysis complete', {
-        filePath,
-        scriptBlocks: scriptResults.length,
-        attributeFindings: attributeFindings.length,
-        totalFindings: result.findings?.length ?? 0,
-    });
-    return result;
 }
 // ---------------------------------------------------------------------------
 // Simplified API response format
@@ -469,75 +481,80 @@ export async function analyzeForAPI(code, filePath, language, options = {}) {
     const parseStart = performance.now();
     const tree = await parse(code, language);
     const parseTime = performance.now() - parseStart;
-    const analysisStart = performance.now();
-    const nodeCache = collectAllNodes(tree.rootNode, getNodeTypesForLanguage(language));
-    const types = extractTypes(tree, nodeCache, language);
-    const calls = extractCalls(tree, nodeCache, language);
-    // Run constant propagation
-    const constPropResult = analyzeConstantPropagation(tree, code);
-    const config = options.taintConfig ?? getDefaultConfig();
-    const taint = analyzeTaint(calls, types, config);
-    // Filter sinks in dead code
-    let filteredSinks = taint.sinks.filter(sink => !constPropResult.unreachableLines.has(sink.line));
-    // Filter sinks whose arguments are proven clean (string literals, constants, etc.)
-    filteredSinks = filterCleanVariableSinks(filteredSinks, calls, constPropResult.tainted, constPropResult.symbols, undefined, constPropResult.sanitizedVars, constPropResult.synchronizedLines);
-    // Filter sinks wrapped by sanitizers on the same line
-    filteredSinks = filterSanitizedSinks(filteredSinks, taint.sanitizers ?? [], calls);
-    // Python: reduce XPath false-positives using forward taint propagation +
-    // apostrophe-guard sanitizer detection.
-    let pythonTaintedVars = new Map();
-    if (language === 'python') {
-        pythonTaintedVars = buildPythonTaintedVars(code);
-        const pythonSanitizedVars = buildPythonSanitizedVars(code, pythonTaintedVars);
-        const sourceLines = code.split('\n');
-        filteredSinks = filteredSinks.filter(sink => {
-            if (sink.type !== 'xpath_injection')
+    try {
+        const analysisStart = performance.now();
+        const nodeCache = collectAllNodes(tree.rootNode, getNodeTypesForLanguage(language));
+        const types = extractTypes(tree, nodeCache, language);
+        const calls = extractCalls(tree, nodeCache, language);
+        // Run constant propagation
+        const constPropResult = analyzeConstantPropagation(tree, code);
+        const config = options.taintConfig ?? getDefaultConfig();
+        const taint = analyzeTaint(calls, types, config, undefined, language);
+        // Filter sinks in dead code
+        let filteredSinks = taint.sinks.filter(sink => !constPropResult.unreachableLines.has(sink.line));
+        // Filter sinks whose arguments are proven clean (string literals, constants, etc.)
+        filteredSinks = filterCleanVariableSinks(filteredSinks, calls, constPropResult.tainted, constPropResult.symbols, undefined, constPropResult.sanitizedVars, constPropResult.synchronizedLines);
+        // Filter sinks wrapped by sanitizers on the same line
+        filteredSinks = filterSanitizedSinks(filteredSinks, taint.sanitizers ?? [], calls);
+        // Python: reduce XPath false-positives using forward taint propagation +
+        // apostrophe-guard sanitizer detection.
+        let pythonTaintedVars = new Map();
+        if (language === 'python') {
+            pythonTaintedVars = buildPythonTaintedVars(code);
+            const pythonSanitizedVars = buildPythonSanitizedVars(code, pythonTaintedVars);
+            const sourceLines = code.split('\n');
+            filteredSinks = filteredSinks.filter(sink => {
+                if (sink.type !== 'xpath_injection')
+                    return true;
+                const sinkLineText = sourceLines[sink.line - 1] ?? '';
+                const taintedVarOnLine = [...pythonTaintedVars.keys()].find(v => new RegExp(`\\b${v}\\b`).test(sinkLineText));
+                if (!taintedVarOnLine)
+                    return false;
+                if (pythonSanitizedVars.has(taintedVarOnLine))
+                    return false;
+                if (new RegExp(`\\.xpath\\s*\\([^)]*\\b\\w+\\s*=\\s*\\b${taintedVarOnLine}\\b`).test(sinkLineText))
+                    return false;
                 return true;
-            const sinkLineText = sourceLines[sink.line - 1] ?? '';
-            const taintedVarOnLine = [...pythonTaintedVars.keys()].find(v => new RegExp(`\\b${v}\\b`).test(sinkLineText));
-            if (!taintedVarOnLine)
-                return false;
-            if (pythonSanitizedVars.has(taintedVarOnLine))
-                return false;
-            if (new RegExp(`\\.xpath\\s*\\([^)]*\\b\\w+\\s*=\\s*\\b${taintedVarOnLine}\\b`).test(sinkLineText))
-                return false;
-            return true;
-        });
-    }
-    // Generate vulnerabilities from source-sink pairs
-    const vulnerabilities = findVulnerabilities(taint.sources, filteredSinks, calls, constPropResult);
-    // Python: detect trust boundary violations (flask.session[key] = taintedVal)
-    if (language === 'python') {
-        const trustViolations = findPythonTrustBoundaryViolations(code, pythonTaintedVars);
-        for (const v of trustViolations) {
-            const alreadyReported = vulnerabilities.some(existing => existing.sink.line === v.sinkLine && existing.type === 'trust_boundary');
-            if (!alreadyReported) {
-                vulnerabilities.push({
-                    type: 'trust_boundary',
-                    cwe: 'CWE-501',
-                    severity: 'medium',
-                    source: { line: v.sourceLine, type: 'http_param' },
-                    sink: { line: v.sinkLine, type: 'trust_boundary' },
-                    confidence: 0.85,
-                });
+            });
+        }
+        // Generate vulnerabilities from source-sink pairs
+        const vulnerabilities = findVulnerabilities(taint.sources, filteredSinks, calls, constPropResult);
+        // Python: detect trust boundary violations (flask.session[key] = taintedVal)
+        if (language === 'python') {
+            const trustViolations = findPythonTrustBoundaryViolations(code, pythonTaintedVars);
+            for (const v of trustViolations) {
+                const alreadyReported = vulnerabilities.some(existing => existing.sink.line === v.sinkLine && existing.type === 'trust_boundary');
+                if (!alreadyReported) {
+                    vulnerabilities.push({
+                        type: 'trust_boundary',
+                        cwe: 'CWE-501',
+                        severity: 'medium',
+                        source: { line: v.sourceLine, type: 'http_param' },
+                        sink: { line: v.sinkLine, type: 'trust_boundary' },
+                        confidence: 0.85,
+                    });
+                }
             }
         }
+        const analysisTime = performance.now() - analysisStart;
+        const totalTime = performance.now() - startTime;
+        return {
+            success: true,
+            analysis: {
+                sources: taint.sources,
+                sinks: filteredSinks,
+                vulnerabilities,
+            },
+            meta: {
+                parseTimeMs: Math.round(parseTime),
+                analysisTimeMs: Math.round(analysisTime),
+                totalTimeMs: Math.round(totalTime),
+            },
+        };
+    }
+    finally {
+        disposeTree(tree);
     }
-    const analysisTime = performance.now() - analysisStart;
-    const totalTime = performance.now() - startTime;
-    return {
-        success: true,
-        analysis: {
-            sources: taint.sources,
-            sinks: filteredSinks,
-            vulnerabilities,
-        },
-        meta: {
-            parseTimeMs: Math.round(parseTime),
-            analysisTimeMs: Math.round(analysisTime),
-            totalTimeMs: Math.round(totalTime),
-        },
-    };
 }
 // ---------------------------------------------------------------------------
 // Vulnerability matching (used by analyzeForAPI)