circle-ir 3.98.0 → 3.100.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/analysis/passes/info-disclosure-stacktrace-pass.d.ts.map +1 -1
- package/dist/analysis/passes/info-disclosure-stacktrace-pass.js +72 -12
- package/dist/analysis/passes/info-disclosure-stacktrace-pass.js.map +1 -1
- package/dist/analysis/passes/sink-filter-pass.d.ts.map +1 -1
- package/dist/analysis/passes/sink-filter-pass.js +146 -2
- package/dist/analysis/passes/sink-filter-pass.js.map +1 -1
- package/dist/browser/circle-ir.js +132 -9
- package/package.json +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"info-disclosure-stacktrace-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/info-disclosure-stacktrace-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClE;
|
|
1
|
+
{"version":3,"file":"info-disclosure-stacktrace-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/info-disclosure-stacktrace-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClE;AAyLD,qBAAa,4BAA6B,YAAW,YAAY,CAAC,8BAA8B,CAAC;IAC/F,QAAQ,CAAC,IAAI,gCAAgC;IAC7C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,8BAA8B;IAwDrD,OAAO,CAAC,WAAW;CAsBpB"}
|
|
@@ -41,27 +41,75 @@ const RESPONSE_SEND_METHODS = new Set([
|
|
|
41
41
|
'println', 'print', 'getWriter',
|
|
42
42
|
'Fprintln', 'Fprintf', 'Fprint',
|
|
43
43
|
]);
|
|
44
|
-
/** Expression heuristics for "this is an exception value".
|
|
44
|
+
/** Expression heuristics for "this is an exception value".
|
|
45
|
+
*
|
|
46
|
+
* #133 — `.message` / `.getMessage()` are intentionally NOT matched. They
|
|
47
|
+
* return a single-line developer-controlled human description (e.g.
|
|
48
|
+
* `new Error('Validation failed')`), not a stack trace. The rule's
|
|
49
|
+
* canonical CWE-209 scope is stack-trace disclosure; `.stack`,
|
|
50
|
+
* `.toString()`, `.getStackTrace()`, full error object, and
|
|
51
|
+
* `traceback.format_exc()` remain in scope.
|
|
52
|
+
*/
|
|
45
53
|
function isExceptionExpression(expr) {
|
|
46
54
|
if (!expr)
|
|
47
55
|
return false;
|
|
48
56
|
const e = expr.trim();
|
|
49
|
-
// err.stack |
|
|
50
|
-
//
|
|
51
|
-
return (/\b(err|error|exc|exception|e|t|throwable)\.(stack|
|
|
57
|
+
// err.stack | e.toString() | e.getStackTrace() | e.getLocalizedMessage() | e.getCause()
|
|
58
|
+
// traceback.format_exc() | debug.Stack() | str(e) | String(e)
|
|
59
|
+
return (/\b(err|error|exc|exception|e|t|throwable)\.(stack|toString\(|getStackTrace\(|getLocalizedMessage\(|getCause\()/i.test(e) ||
|
|
52
60
|
/\btraceback\.(format_exc|format_exception|print_exc)\b/i.test(e) ||
|
|
53
61
|
/\bdebug\.Stack\(\)/.test(e) ||
|
|
54
62
|
/\bstr\(\s*(err|error|exc|exception|e)\s*\)/i.test(e) ||
|
|
55
63
|
/\bString\(\s*(err|error|exc|exception|e)\s*\)/i.test(e));
|
|
56
64
|
}
|
|
57
|
-
/**
|
|
65
|
+
/** #133 — Python file-handle open patterns:
|
|
66
|
+
* with open(...) as f:
|
|
67
|
+
* f = open(...)
|
|
68
|
+
*/
|
|
69
|
+
const PY_FILE_HANDLE_OPEN_RE = /^\s*(?:with\s+open\s*\([^)]*\)\s+as\s+(\w+)\s*:|(\w+)\s*=\s*open\s*\()/;
|
|
70
|
+
/**
|
|
71
|
+
* #133 — True if `receiver` was produced by `open(...)` within the prior
|
|
72
|
+
* 10 source lines. Used to suppress Python file-handle writes
|
|
73
|
+
* (`f.write(API_KEY)`) which are not response leaks. Bounded backward
|
|
74
|
+
* scan; conservative-bias when not resolvable.
|
|
75
|
+
*/
|
|
76
|
+
function isPythonFileHandle(receiver, callLine, sourceLines) {
|
|
77
|
+
if (!receiver || !/^[A-Za-z_]\w*$/.test(receiver))
|
|
78
|
+
return false;
|
|
79
|
+
const start = Math.max(0, callLine - 11);
|
|
80
|
+
for (let i = callLine - 2; i >= start; i--) {
|
|
81
|
+
const ln = sourceLines[i] ?? '';
|
|
82
|
+
const m = ln.match(PY_FILE_HANDLE_OPEN_RE);
|
|
83
|
+
if (!m)
|
|
84
|
+
continue;
|
|
85
|
+
const name = m[1] ?? m[2];
|
|
86
|
+
if (name === receiver)
|
|
87
|
+
return true;
|
|
88
|
+
}
|
|
89
|
+
return false;
|
|
90
|
+
}
|
|
91
|
+
/** True if an argument carries an exception-like value.
|
|
92
|
+
*
|
|
93
|
+
* #133 — When `arg.variable` matches an exception name (`err`, `error`,
|
|
94
|
+
* …) the parser may have extracted it from a containing object literal
|
|
95
|
+
* (e.g. `res.json({ ok: false, error: err.message })` → `variable="err"`).
|
|
96
|
+
* In that case we must defer to `isExceptionExpression` on the full
|
|
97
|
+
* expression text, NOT short-circuit to true on the bare variable
|
|
98
|
+
* match. Only treat as a leak when the expression IS the bare variable
|
|
99
|
+
* (e.g. `res.json(err)`) or is a stack-trace property access on it.
|
|
100
|
+
*/
|
|
58
101
|
function argIsException(arg) {
|
|
59
102
|
if (!arg)
|
|
60
103
|
return false;
|
|
104
|
+
const expr = (arg.expression ?? '').trim();
|
|
61
105
|
if (arg.variable && /^(err|error|exc|exception|e|t|throwable)$/i.test(arg.variable)) {
|
|
62
|
-
|
|
106
|
+
// Bare exception variable: `res.json(err)`.
|
|
107
|
+
if (!expr || expr === arg.variable)
|
|
108
|
+
return true;
|
|
109
|
+
// Containing expression — defer to isExceptionExpression for shape check.
|
|
110
|
+
return isExceptionExpression(expr);
|
|
63
111
|
}
|
|
64
|
-
return isExceptionExpression(
|
|
112
|
+
return isExceptionExpression(expr);
|
|
65
113
|
}
|
|
66
114
|
/** Detect Java: e.printStackTrace(out) where out is a response writer. */
|
|
67
115
|
function detectJavaPrintStackTrace(call) {
|
|
@@ -85,13 +133,23 @@ function detectJavaPrintStackTrace(call) {
|
|
|
85
133
|
return null;
|
|
86
134
|
}
|
|
87
135
|
/** Detect calls of the shape `response.send(err.stack)` / `.json(err)`. */
|
|
88
|
-
function detectResponseLeakCall(call) {
|
|
136
|
+
function detectResponseLeakCall(call, language, sourceLines) {
|
|
89
137
|
const method = call.method_name ?? '';
|
|
90
138
|
const receiver = call.receiver ?? '';
|
|
91
139
|
if (!RESPONSE_SEND_METHODS.has(method))
|
|
92
140
|
return null;
|
|
93
141
|
if (LOGGER_RECEIVER_RE.test(receiver))
|
|
94
142
|
return null;
|
|
143
|
+
// #133 — Python file-handle write is not a response leak. When the
|
|
144
|
+
// receiver was produced by `open(...)` within the prior 10 lines,
|
|
145
|
+
// skip. Independent of receiver-name overlap; cannot regress real
|
|
146
|
+
// response leaks (response writers are never produced by `open(...)`).
|
|
147
|
+
if (language === 'python' &&
|
|
148
|
+
(method === 'write' || method === 'writelines') &&
|
|
149
|
+
sourceLines &&
|
|
150
|
+
isPythonFileHandle(receiver, call.location.line, sourceLines)) {
|
|
151
|
+
return null;
|
|
152
|
+
}
|
|
95
153
|
// Accept either a bare known receiver name, or one whose tail is a known name
|
|
96
154
|
// (e.g. `ctx.response`, `event.res`, `response.status(500)` chained returns).
|
|
97
155
|
const recTail = receiver.split('.').pop() ?? receiver;
|
|
@@ -143,6 +201,8 @@ export class InfoDisclosureStacktracePass {
|
|
|
143
201
|
const { graph, language } = ctx;
|
|
144
202
|
const file = graph.ir.meta.file;
|
|
145
203
|
const findings = [];
|
|
204
|
+
// #133 — split lines once for downstream file-handle backward scan.
|
|
205
|
+
const sourceLines = ctx.code.split('\n');
|
|
146
206
|
if (language === 'python') {
|
|
147
207
|
for (const f of detectPythonTracebackReturn(ctx)) {
|
|
148
208
|
findings.push({ line: f.line, api: f.api, language });
|
|
@@ -154,10 +214,10 @@ export class InfoDisclosureStacktracePass {
|
|
|
154
214
|
if (language === 'java') {
|
|
155
215
|
api = detectJavaPrintStackTrace(call);
|
|
156
216
|
if (!api)
|
|
157
|
-
api = detectResponseLeakCall(call);
|
|
217
|
+
api = detectResponseLeakCall(call, language, sourceLines);
|
|
158
218
|
}
|
|
159
219
|
else if (language === 'javascript' || language === 'typescript') {
|
|
160
|
-
api = detectResponseLeakCall(call);
|
|
220
|
+
api = detectResponseLeakCall(call, language, sourceLines);
|
|
161
221
|
}
|
|
162
222
|
else if (language === 'go') {
|
|
163
223
|
// http.Error(w, err.Error()+debug.Stack(), 500)
|
|
@@ -183,12 +243,12 @@ export class InfoDisclosureStacktracePass {
|
|
|
183
243
|
}
|
|
184
244
|
}
|
|
185
245
|
else {
|
|
186
|
-
api = detectResponseLeakCall(call);
|
|
246
|
+
api = detectResponseLeakCall(call, language, sourceLines);
|
|
187
247
|
}
|
|
188
248
|
}
|
|
189
249
|
else if (language === 'python') {
|
|
190
250
|
// Handle response leak shape too: e.g. `return jsonify(stack=...)`
|
|
191
|
-
api = detectResponseLeakCall(call);
|
|
251
|
+
api = detectResponseLeakCall(call, language, sourceLines);
|
|
192
252
|
}
|
|
193
253
|
if (!api)
|
|
194
254
|
continue;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"info-disclosure-stacktrace-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/info-disclosure-stacktrace-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AASH,0EAA0E;AAC1E,MAAM,oBAAoB,GAAG,kCAAkC,CAAC;AAEhE,yCAAyC;AACzC,MAAM,kBAAkB,GAAG,kDAAkD,CAAC;AAE9E,+DAA+D;AAC/D,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU;IACvD,SAAS,EAAE,OAAO,EAAE,WAAW;IAC/B,UAAU,EAAE,SAAS,EAAE,QAAQ;CAChC,CAAC,CAAC;AAEH
|
|
1
|
+
{"version":3,"file":"info-disclosure-stacktrace-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/info-disclosure-stacktrace-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AASH,0EAA0E;AAC1E,MAAM,oBAAoB,GAAG,kCAAkC,CAAC;AAEhE,yCAAyC;AACzC,MAAM,kBAAkB,GAAG,kDAAkD,CAAC;AAE9E,+DAA+D;AAC/D,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU;IACvD,SAAS,EAAE,OAAO,EAAE,WAAW;IAC/B,UAAU,EAAE,SAAS,EAAE,QAAQ;CAChC,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAAC,IAA+B;IAC5D,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,wFAAwF;IACxF,8DAA8D;IAC9D,OAAO,CACL,iHAAiH,CAAC,IAAI,CAAC,CAAC,CAAC;QACzH,yDAAyD,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5B,6CAA6C,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,gDAAgD,CAAC,IAAI,CAAC,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,sBAAsB,GAC1B,wEAAwE,CAAC;AAE3E;;;;;GAKG;AACH,SAAS,kBAAkB,CACzB,QAAgB,EAChB,QAAgB,EAChB,WAAqB;IAErB,IAAI,CAAC,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,EAAE,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,GAA6B;IACnD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,GAAG,CAAC,QAAQ,IAAI,4CAA4C,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpF,4CAA4C;QAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAChD,0EAA0E;QAC1E,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,0EAA0E;AAC1E,SAAS,yBAAyB,CAAC,IAAc;IAC/C,IAAI,IAAI,CAAC,WAAW,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IACxD,wDAAwD;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,+CAA+C,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,gDAAgD;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,IACE,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC;QACtC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;QAClC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,4BAA4B;QACpD,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5B,CAAC;QACD,OAAO,yCAAyC,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,SAAS,sBAAsB,CAC7B,IAAc,EACd,QAAiB,EACjB,WAAsB;IAEtB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IAErC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnD,mEAAmE;IACnE,kEAAkE;IAClE,kEAAkE;IAClE,uEAAuE;IACvE,IACE,QAAQ,KAAK,QAAQ;QACrB,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,YAAY,CAAC;QAC/C,WAAW;QACX,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,EAC7D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC;IACtD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;IACnD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/E,0EAA0E;QAC1E,wBAAwB;QACxB,IAAI,CAAC,4DAA4D,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,IAAI,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,OAAO,GAAG,QAAQ,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC;QAC1G,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0EAA0E;AAC1E,SAAS,2BAA2B,CAAC,GAAgB;IACnD,MAAM,GAAG,GAAyC,EAAE,CAAC;IACrD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1B,IACE,4CAA4C,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,0DAA0D,CAAC,IAAI,CAAC,EAAE,CAAC;YACnE,oDAAoD,CAAC,IAAI,CAAC,EAAE,CAAC,EAC7D,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,+BAA+B,EAAE,CAAC,CAAC;YAChE,SAAS;QACX,CAAC;QACD,mEAAmE;QACnE,sEAAsE;QACtE,IAAI,mEAAmE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACjF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,kEAAkE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpF,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,0BAA0B,EAAE,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,4BAA4B;IAC9B,IAAI,GAAG,4BAA4B,CAAC;IACpC,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,QAAQ,GAA+C,EAAE,CAAC;QAEhE,oEAAoE;QACpE,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEzC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,2BAA2B,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACtD,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACxD,CAAC;QACH,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClC,IAAI,GAAG,GAAkB,IAAI,CAAC;YAE9B,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACxB,GAAG,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC;gBACtC,IAAI,CAAC,GAAG;oBAAE,GAAG,GAAG,sBAAsB,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;YACtE,CAAC;iBAAM,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;gBAClE,GAAG,GAAG,sBAAsB,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;YAC5D,CAAC;iBAAM,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC7B,gDAAgD;gBAChD,uBAAuB;gBACvB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;gBACtC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;gBAChC,IAAI,GAAG,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;oBACzC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;oBAC1D,IAAI,cAAc,CAAC,IAAI,CAAC;wBAAE,GAAG,GAAG,4BAA4B,CAAC;gBAC/D,CAAC;qBAAM,IAAI,GAAG,KAAK,KAAK,IAAI,CAAC,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,CAAC,EAAE,CAAC;oBACnG,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;oBAC1D,IAAI,IAAI,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;wBAChG,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;4BAC/B,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC;gCAAE,SAAS;4BAC/B,IAAI,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;gCAAC,GAAG,GAAG,OAAO,MAAM,UAAU,CAAC;gCAAC,MAAM;4BAAC,CAAC;wBAClE,CAAC;oBACH,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,GAAG,GAAG,sBAAsB,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;gBAC5D,CAAC;YACH,CAAC;iBAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACjC,mEAAmE;gBACnE,GAAG,GAAG,sBAAsB,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;YAC5D,CAAC;YAED,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;YACvC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IAEO,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,GAAW;QACzD,OAAO;YACL,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;YAClC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,IAAI;YAClB,GAAG,EAAE,SAAS;YACd,QAAQ,EAAE,QAAiB;YAC3B,KAAK,EAAE,SAAkB;YACzB,OAAO,EACL,6CAA6C,GAAG,MAAM;gBACtD,yEAAyE;gBACzE,sEAAsE;YACxE,IAAI;YACJ,IAAI;YACJ,GAAG,EACD,qEAAqE;gBACrE,qEAAqE;gBACrE,wDAAwD;YAC1D,QAAQ,EAAE,EAAE,GAAG,EAAE;SAClB,CAAC;IACJ,CAAC;CACF"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sink-filter-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/sink-filter-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;
|
|
1
|
+
{"version":3,"file":"sink-filter-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/sink-filter-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAgH9E,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,sBAAsB;IACtB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AAED,qBAAa,cAAe,YAAW,YAAY,CAAC,gBAAgB,CAAC;IACnE,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,gBAAgB;CA+RxC;AAMD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,KAAK,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AA4I1G,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EACjC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,EACxB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,EACrB,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC3B,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC/B,QAAQ,CAAC,EAAE,MAAM,GAChB,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CA6E5B;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EACjC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,EAC3C,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,GACvB,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CA2C5B"}
|
|
@@ -37,6 +37,83 @@ const JS_XSS_SANITIZERS = [
|
|
|
37
37
|
/\btrustAsHtml\s*\(/, // Angular
|
|
38
38
|
/\bbypassSecurityTrust/, // Angular
|
|
39
39
|
];
|
|
40
|
+
// ---------------------------------------------------------------------------
|
|
41
|
+
// Stage 9 — Java code_injection (CWE-094) FP reduction allowlists.
|
|
42
|
+
// (cognium-dev #155, #156, #159, #160 — Sprint 42)
|
|
43
|
+
// ---------------------------------------------------------------------------
|
|
44
|
+
// #155 — non-script data parsers misclassified as code-injection sinks.
|
|
45
|
+
const DATA_PARSER_TYPES = new Set([
|
|
46
|
+
'Parser', // commonmark, airline, picocli, jcommander
|
|
47
|
+
'CommandLine', 'JCommander',
|
|
48
|
+
'DateParser', 'FastDateFormat', 'FastDatePrinter',
|
|
49
|
+
'ResultParser',
|
|
50
|
+
'DateFormat', 'SimpleDateFormat',
|
|
51
|
+
'NumberFormat', 'DecimalFormat',
|
|
52
|
+
'OptionParser', 'CmdLineParser',
|
|
53
|
+
]);
|
|
54
|
+
// #156 — compiled-template classes; risk lives at the compile step,
|
|
55
|
+
// not the render step.
|
|
56
|
+
const COMPILED_TEMPLATE_TYPES = new Set([
|
|
57
|
+
'Template', // Freemarker, Velocity
|
|
58
|
+
'JetTemplate', // Jetbrick
|
|
59
|
+
'ITemplate', // Rythm
|
|
60
|
+
'VelocityTemplate', 'BeetlTemplate',
|
|
61
|
+
]);
|
|
62
|
+
// #159 — reflection methods whose first arg, when literal /
|
|
63
|
+
// annotation-accessor / empty, makes the call statically resolvable.
|
|
64
|
+
const REFLECTION_LITERAL_METHODS = new Set([
|
|
65
|
+
'forName', 'loadClass',
|
|
66
|
+
'getMethod', 'getDeclaredMethod',
|
|
67
|
+
'getConstructor', 'getDeclaredConstructor',
|
|
68
|
+
'parseExpression',
|
|
69
|
+
'invoke', // no further args = no payload injection
|
|
70
|
+
]);
|
|
71
|
+
// Java declaration regex template; receiver name is interpolated.
|
|
72
|
+
// Receiver is pre-validated by /^[A-Za-z_]\w*$/ so regex metacharacter
|
|
73
|
+
// injection is impossible.
|
|
74
|
+
const JAVA_DECL_RE_TEMPLATE = '(?:\\b(?:final|public|private|protected|static)\\s+)*' +
|
|
75
|
+
'([A-Z]\\w*(?:\\.[A-Z]\\w*)?(?:<[^>]*>)?)\\s+RECV\\b\\s*[=;,)]';
|
|
76
|
+
function resolveJavaReceiverType(receiver, sinkLine, sourceLines) {
|
|
77
|
+
if (!receiver || !/^[A-Za-z_]\w*$/.test(receiver))
|
|
78
|
+
return null;
|
|
79
|
+
const start = Math.max(0, sinkLine - 31);
|
|
80
|
+
const declRe = new RegExp(JAVA_DECL_RE_TEMPLATE.replace('RECV', receiver));
|
|
81
|
+
for (let i = sinkLine - 2; i >= start; i--) {
|
|
82
|
+
const ln = sourceLines[i] ?? '';
|
|
83
|
+
const m = ln.match(declRe);
|
|
84
|
+
if (m) {
|
|
85
|
+
const raw = m[1].replace(/<[^>]*>/g, '').trim();
|
|
86
|
+
const parts = raw.split('.');
|
|
87
|
+
return parts[parts.length - 1] ?? null;
|
|
88
|
+
}
|
|
89
|
+
}
|
|
90
|
+
return null;
|
|
91
|
+
}
|
|
92
|
+
function isJavaLiteralOrAnnotationAccessor(expr) {
|
|
93
|
+
const e = expr.trim();
|
|
94
|
+
if (e === '')
|
|
95
|
+
return true; // no args
|
|
96
|
+
if (/^"(?:[^"\\]|\\.)*"$/.test(e))
|
|
97
|
+
return true; // string literal
|
|
98
|
+
if (/^[A-Za-z_]\w*\s*\.\s*(?:value|name|key)\s*\(\s*\)$/.test(e))
|
|
99
|
+
return true; // ann.value()
|
|
100
|
+
return false;
|
|
101
|
+
}
|
|
102
|
+
/**
|
|
103
|
+
* Extract the top-level argument list from a Java method call. Allows one
|
|
104
|
+
* level of nested parens so `ann.value()` is captured whole. Returns null
|
|
105
|
+
* when the call can't be located. Returns `[]` for empty arg lists.
|
|
106
|
+
*/
|
|
107
|
+
function extractJavaCallArgs(method, line) {
|
|
108
|
+
const re = new RegExp(`\\b${method}\\s*\\(([^()]*(?:\\([^()]*\\)[^()]*)*)\\)`);
|
|
109
|
+
const m = line.match(re);
|
|
110
|
+
if (!m)
|
|
111
|
+
return null;
|
|
112
|
+
const argsText = m[1].trim();
|
|
113
|
+
if (argsText === '')
|
|
114
|
+
return [];
|
|
115
|
+
return argsText.split(',').map(s => s.trim());
|
|
116
|
+
}
|
|
40
117
|
export class SinkFilterPass {
|
|
41
118
|
name = 'sink-filter';
|
|
42
119
|
category = 'security';
|
|
@@ -214,10 +291,11 @@ export class SinkFilterPass {
|
|
|
214
291
|
// Suppresses res.redirect(url) and res.setHeader(...) sinks when an
|
|
215
292
|
// allowlist/validation guard appears within 6 lines above the sink, OR
|
|
216
293
|
// when the sink call's tainted argument is a literal (CORS '*' etc).
|
|
217
|
-
// (cognium-dev #99)
|
|
294
|
+
// (cognium-dev #99, #132)
|
|
218
295
|
if (['javascript', 'typescript'].includes(language)) {
|
|
219
296
|
const sourceLines = ctx.code.split('\n');
|
|
220
|
-
|
|
297
|
+
// #132 — `has` covers Set/Map allowlist primitive: ALLOWED.has(url).
|
|
298
|
+
const guardPatterns = /\b(?:includes|startsWith|endsWith|indexOf|test|match|has)\s*\(/;
|
|
221
299
|
filtered = filtered.filter(sink => {
|
|
222
300
|
if (sink.type !== 'open_redirect' && sink.type !== 'crlf') {
|
|
223
301
|
return true;
|
|
@@ -241,6 +319,72 @@ export class SinkFilterPass {
|
|
|
241
319
|
if (setHeaderMatch) {
|
|
242
320
|
return false;
|
|
243
321
|
}
|
|
322
|
+
// 8d. Express/Koa `res.cookie(name, value, [opts])` is CRLF-safe by
|
|
323
|
+
// construction: the cookie helper serializes via `cookie.serialize()`
|
|
324
|
+
// which URL-encodes CR (%0D) / LF (%0A). The raw-header path
|
|
325
|
+
// `setHeader('Set-Cookie', tainted)` is still flagged via 8c-or-default.
|
|
326
|
+
// (cognium-dev #132)
|
|
327
|
+
if (sink.method === 'cookie' && sink.type === 'crlf') {
|
|
328
|
+
return false;
|
|
329
|
+
}
|
|
330
|
+
return true;
|
|
331
|
+
});
|
|
332
|
+
}
|
|
333
|
+
// Stage 9 — Java code_injection (CWE-094) FP reduction.
|
|
334
|
+
// (cognium-dev #155, #156, #159, #160 — Sprint 42)
|
|
335
|
+
//
|
|
336
|
+
// Conservative-bias default: any code_injection sink whose receiver
|
|
337
|
+
// type or arg shape doesn't match one of the four known-safe shapes
|
|
338
|
+
// below continues to fire. Recall on tainted Class.forName /
|
|
339
|
+
// SpEL / template-compile is unchanged.
|
|
340
|
+
if (language === 'java') {
|
|
341
|
+
const sourceLines = ctx.code.split('\n');
|
|
342
|
+
filtered = filtered.filter(sink => {
|
|
343
|
+
if (sink.type !== 'code_injection')
|
|
344
|
+
return true;
|
|
345
|
+
const sinkLineText = sourceLines[sink.line - 1] ?? '';
|
|
346
|
+
const receiverMatch = sinkLineText.match(/\b(\w+)\s*\.\s*(\w+)\s*\(/);
|
|
347
|
+
const receiver = receiverMatch?.[1];
|
|
348
|
+
const method = sink.method ?? receiverMatch?.[2];
|
|
349
|
+
// 9a — #155: non-script data parsers (commonmark, hutool, zxing,
|
|
350
|
+
// CLI arg parsers, SimpleDateFormat, DecimalFormat, …).
|
|
351
|
+
if (method === 'parse' && receiver) {
|
|
352
|
+
const recvType = resolveJavaReceiverType(receiver, sink.line, sourceLines);
|
|
353
|
+
if (recvType && DATA_PARSER_TYPES.has(recvType))
|
|
354
|
+
return false;
|
|
355
|
+
}
|
|
356
|
+
// 9b — #156: compiled-template render/process. Risk lives at the
|
|
357
|
+
// compile step, not the render step.
|
|
358
|
+
if ((method === 'render' || method === 'process' ||
|
|
359
|
+
method === 'merge' || method === 'renderTo') && receiver) {
|
|
360
|
+
const recvType = resolveJavaReceiverType(receiver, sink.line, sourceLines);
|
|
361
|
+
if (recvType && COMPILED_TEMPLATE_TYPES.has(recvType))
|
|
362
|
+
return false;
|
|
363
|
+
}
|
|
364
|
+
// 9c — #159: reflection / SpEL with literal / annotation-accessor
|
|
365
|
+
// first arg. Static-resolvable target is not code injection.
|
|
366
|
+
// Special case for `invoke`: `method.invoke(target)` with no
|
|
367
|
+
// further args has no payload (target is just the receiver).
|
|
368
|
+
if (method && REFLECTION_LITERAL_METHODS.has(method)) {
|
|
369
|
+
const args = extractJavaCallArgs(method, sinkLineText);
|
|
370
|
+
if (args !== null) {
|
|
371
|
+
if (method === 'invoke') {
|
|
372
|
+
if (args.length <= 1)
|
|
373
|
+
return false;
|
|
374
|
+
}
|
|
375
|
+
else {
|
|
376
|
+
const firstArg = args[0] ?? '';
|
|
377
|
+
if (isJavaLiteralOrAnnotationAccessor(firstArg))
|
|
378
|
+
return false;
|
|
379
|
+
}
|
|
380
|
+
}
|
|
381
|
+
}
|
|
382
|
+
// 9d — #160: no-arg Constructor#newInstance(). Empty arg list
|
|
383
|
+
// means the constructor was statically resolved.
|
|
384
|
+
if (method === 'newInstance' &&
|
|
385
|
+
/\.\s*newInstance\s*\(\s*\)/.test(sinkLineText)) {
|
|
386
|
+
return false;
|
|
387
|
+
}
|
|
244
388
|
return true;
|
|
245
389
|
});
|
|
246
390
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"sink-filter-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/sink-filter-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAOH,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE;;;GAGG;AACH,MAAM,iBAAiB,GAAG;IACxB,4BAA4B;IAC5B,qBAAqB;IACrB,iBAAiB;IACjB,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,YAAY,EAAe,cAAc;IACzC,gBAAgB,EAAW,sBAAsB;IACjD,0BAA0B;IAC1B,gCAAgC;IAChC,2BAA2B;IAC3B,kBAAkB;IAClB,uBAAuB;IACvB,oBAAoB,EAAO,UAAU;IACrC,uBAAuB,EAAI,UAAU;CACtC,CAAC;AAUF,MAAM,OAAO,cAAc;IAChB,IAAI,GAAG,aAAa,CAAC;IACrB,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAChC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;QAEhC,MAAM,YAAY,GAAG,GAAG,CAAC,SAAS,CAAqB,eAAe,CAAC,CAAC;QACxE,MAAM,SAAS,GAAM,GAAG,CAAC,SAAS,CAA2B,sBAAsB,CAAC,CAAC;QACrF,MAAM,WAAW,GAAI,GAAG,CAAC,SAAS,CAAwB,kBAAkB,CAAC,CAAC;QAE9E,qDAAqD;QACrD,MAAM,OAAO,GAAkB,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAE3F,qFAAqF;QACrF,MAAM,KAAK,GAAgB,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACnD,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,eAAe,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QACD,MAAM,UAAU,GAAqB;YACnC,GAAG,YAAY,CAAC,UAAU;YAC1B,GAAG,CAAC,WAAW,CAAC,oBAAoB,IAAI,EAAE,CAAC;SAC5C,CAAC;QAEF,sBAAsB;QACtB,IAAI,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAEhF,iCAAiC;QACjC,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,oBAAoB,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QAErG,4BAA4B;QAC5B,QAAQ,GAAG,wBAAwB,CACjC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,EACrD,GAAG,EAAE,SAAS,CAAC,aAAa,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,CACpE,CAAC;QAEF,4BAA4B;QAC5B,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAE7D,sCAAsC;QACtC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,WAAW,CAAC;YACvD,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,wEAAwE;YACxE,0DAA0D;YAC1D,yEAAyE;YACzE,mEAAmE;YACnE,sEAAsE;YACtE,8BAA8B;YAC9B,2CAA2C;YAC3C,sEAAsE;YACtE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;YACvC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;oBACjD,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YACD,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;gBAChC,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;oBAAE,OAAO,IAAI,CAAC;gBACjD,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACtD,MAAM,gBAAgB,GAAG,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC1D,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAC5C,CAAC;gBACF,kEAAkE;gBAClE,6DAA6D;gBAC7D,MAAM,YAAY,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC9C,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CACzB,CAAC;gBACF,IAAI,YAAY;oBAAE,OAAO,IAAI,CAAC;gBAC9B,IAAI,CAAC,gBAAgB;oBAAE,OAAO,KAAK,CAAC;gBACpC,IAAI,eAAe,CAAC,GAAG,CAAC,gBAAgB,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACxD,IAAI,IAAI,MAAM,CAAC,0CAA0C,gBAAgB,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACjH,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;QAED,2CAA2C;QAC3C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;QACpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC3D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC;QAED,iDAAiD;QACjD,oFAAoF;QACpF,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;gBAChC,IAAI,IAAI,CAAC,MAAM,KAAK,cAAc;oBAAE,OAAO,IAAI,CAAC;gBAChD,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACrD,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,cAAc,CAAC,CAAC;gBAC/E,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;oBAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;oBACnC,IAAI,CAAC,QAAQ;wBAAE,SAAS;oBACxB,wEAAwE;oBACxE,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,IAAI,CACnC,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,yBAAyB,CAAC,QAAQ,CAAC,UAAU,CAAC;wBACzF,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;wBACxD,CAAC,CAAC,IAAI,CACT,CAAC;oBACF,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;wBACrB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;wBAC7C,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ;4BAAE,OAAO,IAAI,CAAC;wBAClF,OAAO,KAAK,CAAC,CAAC,mDAAmD;oBACnE,CAAC;oBACD,+DAA+D;oBAC/D,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,MAAM,EAAE,aAAa,EAAE,GAAG,WAAW,CAAC;YACtC,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAEzC,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;gBAChC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;oBAAE,OAAO,IAAI,CAAC;gBACrC,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBAEtD,gEAAgE;gBAChE,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAEpE,8FAA8F;gBAC9F,kFAAkF;gBAClF,MAAM,eAAe,GAAG,YAAY,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBACnF,IAAI,eAAe,EAAE,CAAC;oBACpB,0CAA0C;oBAC1C,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC/D,oCAAoC;oBACpC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;wBAAE,OAAO,KAAK,CAAC;oBACxC,oCAAoC;oBACpC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;wBAAE,OAAO,KAAK,CAAC;oBACxC,yCAAyC;oBACzC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;wBAAE,OAAO,KAAK,CAAC;oBAC/D,eAAe;oBACf,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI;wBAAE,OAAO,KAAK,CAAC;gBACjE,CAAC;gBAED,2FAA2F;gBAC3F,kFAAkF;gBAClF,6EAA6E;gBAC7E,IAAI,yBAAyB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;oBACjD,MAAM,aAAa,GAAG,4DAA4D,CAAC;oBACnF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;oBAC7C,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;wBAC/C,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;wBAClC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;4BACvD,OAAO,KAAK,CAAC;wBACf,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,6EAA6E;gBAC7E,IAAI,aAAa,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;oBAC3B,IAAI,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;wBAAE,OAAO,IAAI,CAAC;oBAClG,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;wBAAE,OAAO,IAAI,CAAC;oBAC7E,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,oFAAoF;gBACpF,gFAAgF;gBAChF,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAE7E,iEAAiE;gBACjE,IAAI,eAAe,EAAE,CAAC;oBACpB,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBACpE,+DAA+D;oBAC/D,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBAC7C,IAAI,UAAU,EAAE,CAAC;wBACf,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;wBAC9B,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;wBAClD,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ;4BAAE,OAAO,KAAK,CAAC;oBAC/D,CAAC;gBACH,CAAC;gBAED,qEAAqE;gBACrE,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;QAED,6EAA6E;QAC7E,oEAAoE;QACpE,uEAAuE;QACvE,qEAAqE;QACrE,oBAAoB;QACpB,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,MAAM,aAAa,GAAG,4DAA4D,CAAC;YACnF,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;gBAChC,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAC1D,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACtD,6EAA6E;gBAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;gBAC7C,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC/C,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBAClC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvD,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;gBACD,mEAAmE;gBACnE,IAAI,4CAA4C,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;oBACpE,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,uEAAuE;gBACvE,uEAAuE;gBACvE,MAAM,cAAc,GAAG,YAAY,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBAC/F,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IAClD,CAAC;CACF;AAUD;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IAEzB,SAAS,IAAI,KAAa,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpD,SAAS,OAAO,KAAa,OAAO,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzD,SAAS,MAAM,KAAW,OAAO,GAAG,GAAG,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG;QAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAE1E,SAAS,WAAW;QAClB,MAAM,EAAE,CAAC;QACT,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;QAC9C,OAAO,GAAG,GAAG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAE,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAChF,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACrC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChC,CAAC;IAED,SAAS,WAAW;QAClB,MAAM,EAAE,CAAC;QACT,IAAI,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,EAAE,CAAC,CAAC,MAAM;YACjB,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;YACxB,MAAM,EAAE,CAAC;YACT,IAAI,IAAI,EAAE,KAAK,GAAG;gBAAE,OAAO,EAAE,CAAC;YAC9B,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,WAAW,EAAE,CAAC;IACvB,CAAC;IAED,SAAS,SAAS;QAChB,IAAI,IAAI,GAAG,WAAW,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/B,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC;YAClB,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;gBAAE,MAAM;YACpC,OAAO,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;YAC5B,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAChC,IAAI,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;YACvE,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,SAAS;QAChB,IAAI,IAAI,GAAG,SAAS,EAAE,CAAC;QACvB,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/B,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC;YAClB,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;gBAAE,MAAM;YACpC,OAAO,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;YAC1B,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAChC,IAAI,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,CAAC;IACT,OAAO,GAAG,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY,EAAE,OAAgB;IAC9D,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;QAClC,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,KAAK,EAAE,GAAG,CAAC,CAAC;YAC/C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACjD,iFAAiF;IACjF,6EAA6E;IAC7E,iFAAiF;IACjF,sFAAsF;IACtF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAAC,CAAC,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACrC,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,CAAC,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACjD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,gDAAgD;AAChE,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAiC,EACjC,KAAwB,EACxB,oBAA8C,EAC9C,OAAgB;IAEhB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACzB,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACrD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACjC,MAAM,gBAAgB,GAAG,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBAC3E,IAAI,gBAAgB,EAAE,CAAC;oBACrB,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;oBACtC,IAAI,QAAQ,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;oBACnC,QAAQ,GAAG,wBAAwB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;oBACvD,MAAM,cAAc,GAAG,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBAC3D,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;wBACjC,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;wBAC1E,IAAI,CAAC,SAAS;4BAAE,OAAO,KAAK,CAAC;oBAC/B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAiC,EACjC,KAAwB,EACxB,WAAwB,EACxB,OAAgB,EAChB,GAAqB,EACrB,aAA2B,EAC3B,iBAA+B,EAC/B,QAAiB;IAEjB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,GAAG,EAAE,CAAC;QACR,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;gBAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACzB,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,qBAAqB,GAAG,iBAAiB,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC;QAEzE,uFAAuF;QACvF,yFAAyF;QACzF,6FAA6F;QAC7F,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM;YAC/B,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,MAAM,CAAC;YACxD,CAAC,CAAC,WAAW,CAAC;QAEhB,sFAAsF;QACtF,uFAAuF;QACvF,kFAAkF;QAClF,gFAAgF;QAChF,wDAAwD;QACxD,MAAM,iBAAiB,GAAG,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,OAAO,CAAC;QAEtE,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,IAAI,eAAe,GAAG,IAAI,CAAC;YAC3B,IAAI,iBAAiB,GAAG,CAAC,CAAC;YAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;YAElC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACjC,mFAAmF;gBACnF,sFAAsF;gBACtF,mFAAmF;gBACnF,oFAAoF;gBACpF,gFAAgF;gBAChF,IAAI,iBAAiB,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBAClI,iBAAiB,EAAE,CAAC;gBAEpB,yFAAyF;gBACzF,oFAAoF;gBACpF,uFAAuF;gBACvF,wFAAwF;gBACxF,IAAI,QAAQ,KAAK,MAAM,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI;oBAAE,SAAS;gBAEjH,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC;oBAC7B,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;oBAErE,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;wBAAC,eAAe,GAAG,KAAK,CAAC;wBAAC,SAAS;oBAAC,CAAC;oBAC7F,IAAI,aAAa,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC;wBAAE,SAAS;oBAC5E,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;wBAAC,eAAe,GAAG,KAAK,CAAC;wBAAC,SAAS;oBAAC,CAAC;oBAEnG,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBACpE,IAAI,WAAW,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS;wBAAE,SAAS;oBAE5D,eAAe,GAAG,KAAK,CAAC;gBAC1B,CAAC;qBAAM,CAAC;oBACN,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI;wBAAE,SAAS;oBAClC,IAAI,GAAG,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,yBAAyB,CAAC,GAAG,CAAC,UAAU,CAAC;wBAAE,SAAS;oBAC3F,eAAe,GAAG,KAAK,CAAC;gBAC1B,CAAC;YACH,CAAC;YAED,IAAI,eAAe,IAAI,iBAAiB,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;QAC7D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAiC,EACjC,UAA2C,EAC3C,KAAwB;IAExB,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEzD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC9D,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACtD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACzB,MAAM,cAAc,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEhE,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAoC,CAAC,EAAE,CAAC;gBACtE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACnD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;oBAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;wBACjC,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;wBAClC,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;wBACjE,IAAI,cAAc,EAAE,CAAC;4BACnB,MAAM,aAAa,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;4BACxC,MAAM,YAAY,GAAI,cAAc,CAAC,CAAC,CAAC,CAAC;4BACxC,IAAI,YAAY,EAAE,CAAC;gCACjB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,YAAY,IAAI,aAAa,GAAG,CAAC;oCAAE,OAAO,KAAK,CAAC;4BACvE,CAAC;iCAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,aAAa,GAAG,CAAC,EAAE,CAAC;gCAC9C,OAAO,KAAK,CAAC;4BACf,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}
|
|
1
|
+
{"version":3,"file":"sink-filter-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/sink-filter-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAOH,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE;;;GAGG;AACH,MAAM,iBAAiB,GAAG;IACxB,4BAA4B;IAC5B,qBAAqB;IACrB,iBAAiB;IACjB,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,YAAY,EAAe,cAAc;IACzC,gBAAgB,EAAW,sBAAsB;IACjD,0BAA0B;IAC1B,gCAAgC;IAChC,2BAA2B;IAC3B,kBAAkB;IAClB,uBAAuB;IACvB,oBAAoB,EAAO,UAAU;IACrC,uBAAuB,EAAI,UAAU;CACtC,CAAC;AAEF,8EAA8E;AAC9E,mEAAmE;AACnE,mDAAmD;AACnD,8EAA8E;AAE9E,wEAAwE;AACxE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS;IACxC,QAAQ,EAAkB,2CAA2C;IACrE,aAAa,EAAE,YAAY;IAC3B,YAAY,EAAE,gBAAgB,EAAE,iBAAiB;IACjD,cAAc;IACd,YAAY,EAAE,kBAAkB;IAChC,cAAc,EAAE,eAAe;IAC/B,cAAc,EAAE,eAAe;CAChC,CAAC,CAAC;AAEH,oEAAoE;AACpE,uBAAuB;AACvB,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAS;IAC9C,UAAU,EAAgB,uBAAuB;IACjD,aAAa,EAAa,WAAW;IACrC,WAAW,EAAe,QAAQ;IAClC,kBAAkB,EAAE,eAAe;CACpC,CAAC,CAAC;AAEH,4DAA4D;AAC5D,qEAAqE;AACrE,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAS;IACjD,SAAS,EAAE,WAAW;IACtB,WAAW,EAAE,mBAAmB;IAChC,gBAAgB,EAAE,wBAAwB;IAC1C,iBAAiB;IACjB,QAAQ,EAAkB,yCAAyC;CACpE,CAAC,CAAC;AAEH,kEAAkE;AAClE,uEAAuE;AACvE,2BAA2B;AAC3B,MAAM,qBAAqB,GACzB,uDAAuD;IACvD,+DAA+D,CAAC;AAElE,SAAS,uBAAuB,CAC9B,QAAgB,EAChB,QAAgB,EAChB,WAAqB;IAErB,IAAI,CAAC,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,EAAE,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,qBAAqB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC3E,KAAK,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,EAAE,CAAC;YACN,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7B,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iCAAiC,CAAC,IAAY;IACrD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,CAAuC,UAAU;IAC3E,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAkB,iBAAiB;IAClF,IAAI,oDAAoD,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,cAAc;IAC7F,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,MAAc,EAAE,IAAY;IACvD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,MAAM,MAAM,2CAA2C,CAAC,CAAC;IAC/E,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC/B,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAChD,CAAC;AAUD,MAAM,OAAO,cAAc;IAChB,IAAI,GAAG,aAAa,CAAC;IACrB,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAChC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;QAEhC,MAAM,YAAY,GAAG,GAAG,CAAC,SAAS,CAAqB,eAAe,CAAC,CAAC;QACxE,MAAM,SAAS,GAAM,GAAG,CAAC,SAAS,CAA2B,sBAAsB,CAAC,CAAC;QACrF,MAAM,WAAW,GAAI,GAAG,CAAC,SAAS,CAAwB,kBAAkB,CAAC,CAAC;QAE9E,qDAAqD;QACrD,MAAM,OAAO,GAAkB,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAE3F,qFAAqF;QACrF,MAAM,KAAK,GAAgB,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACnD,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,eAAe,EAAE,CAAC;YAC5C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QACD,MAAM,UAAU,GAAqB;YACnC,GAAG,YAAY,CAAC,UAAU;YAC1B,GAAG,CAAC,WAAW,CAAC,oBAAoB,IAAI,EAAE,CAAC;SAC5C,CAAC;QAEF,sBAAsB;QACtB,IAAI,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAEhF,iCAAiC;QACjC,QAAQ,GAAG,qBAAqB,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,oBAAoB,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QAErG,4BAA4B;QAC5B,QAAQ,GAAG,wBAAwB,CACjC,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,EACrD,GAAG,EAAE,SAAS,CAAC,aAAa,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,CACpE,CAAC;QAEF,4BAA4B;QAC5B,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAE7D,sCAAsC;QACtC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,EAAE,aAAa,EAAE,eAAe,EAAE,GAAG,WAAW,CAAC;YACvD,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,wEAAwE;YACxE,0DAA0D;YAC1D,yEAAyE;YACzE,mEAAmE;YACnE,sEAAsE;YACtE,8BAA8B;YAC9B,2CAA2C;YAC3C,sEAAsE;YACtE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;YACvC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;oBACjD,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;gBAC/B,CAAC;YACH,CAAC;YACD,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;gBAChC,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;oBAAE,OAAO,IAAI,CAAC;gBACjD,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACtD,MAAM,gBAAgB,GAAG,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC1D,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAC5C,CAAC;gBACF,kEAAkE;gBAClE,6DAA6D;gBAC7D,MAAM,YAAY,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC9C,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CACzB,CAAC;gBACF,IAAI,YAAY;oBAAE,OAAO,IAAI,CAAC;gBAC9B,IAAI,CAAC,gBAAgB;oBAAE,OAAO,KAAK,CAAC;gBACpC,IAAI,eAAe,CAAC,GAAG,CAAC,gBAAgB,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACxD,IAAI,IAAI,MAAM,CAAC,0CAA0C,gBAAgB,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACjH,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;QAED,2CAA2C;QAC3C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;QACpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAC3D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChD,CAAC;QAED,iDAAiD;QACjD,oFAAoF;QACpF,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;gBAChC,IAAI,IAAI,CAAC,MAAM,KAAK,cAAc;oBAAE,OAAO,IAAI,CAAC;gBAChD,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACrD,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,cAAc,CAAC,CAAC;gBAC/E,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;oBAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;oBACnC,IAAI,CAAC,QAAQ;wBAAE,SAAS;oBACxB,wEAAwE;oBACxE,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,IAAI,CACnC,QAAQ,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,yBAAyB,CAAC,QAAQ,CAAC,UAAU,CAAC;wBACzF,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;wBACxD,CAAC,CAAC,IAAI,CACT,CAAC;oBACF,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;wBACrB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;wBAC7C,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,QAAQ;4BAAE,OAAO,IAAI,CAAC;wBAClF,OAAO,KAAK,CAAC,CAAC,mDAAmD;oBACnE,CAAC;oBACD,+DAA+D;oBAC/D,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,MAAM,EAAE,aAAa,EAAE,GAAG,WAAW,CAAC;YACtC,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAEzC,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;gBAChC,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;oBAAE,OAAO,IAAI,CAAC;gBACrC,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBAEtD,gEAAgE;gBAChE,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;gBAEpE,8FAA8F;gBAC9F,kFAAkF;gBAClF,MAAM,eAAe,GAAG,YAAY,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBACnF,IAAI,eAAe,EAAE,CAAC;oBACpB,0CAA0C;oBAC1C,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC/D,oCAAoC;oBACpC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;wBAAE,OAAO,KAAK,CAAC;oBACxC,oCAAoC;oBACpC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;wBAAE,OAAO,KAAK,CAAC;oBACxC,yCAAyC;oBACzC,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;wBAAE,OAAO,KAAK,CAAC;oBAC/D,eAAe;oBACf,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI;wBAAE,OAAO,KAAK,CAAC;gBACjE,CAAC;gBAED,2FAA2F;gBAC3F,kFAAkF;gBAClF,6EAA6E;gBAC7E,IAAI,yBAAyB,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;oBACjD,MAAM,aAAa,GAAG,4DAA4D,CAAC;oBACnF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;oBAC7C,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;wBAC/C,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;wBAClC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;4BACvD,OAAO,KAAK,CAAC;wBACf,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,6EAA6E;gBAC7E,IAAI,aAAa,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;oBAC3B,IAAI,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;wBAAE,OAAO,IAAI,CAAC;oBAClG,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;wBAAE,OAAO,IAAI,CAAC;oBAC7E,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,oFAAoF;gBACpF,gFAAgF;gBAChF,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAE7E,iEAAiE;gBACjE,IAAI,eAAe,EAAE,CAAC;oBACpB,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBACpE,+DAA+D;oBAC/D,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;oBAC7C,IAAI,UAAU,EAAE,CAAC;wBACf,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;wBAC9B,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;wBAClD,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ;4BAAE,OAAO,KAAK,CAAC;oBAC/D,CAAC;gBACH,CAAC;gBAED,qEAAqE;gBACrE,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;QAED,6EAA6E;QAC7E,oEAAoE;QACpE,uEAAuE;QACvE,qEAAqE;QACrE,0BAA0B;QAC1B,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,qEAAqE;YACrE,MAAM,aAAa,GAAG,gEAAgE,CAAC;YACvF,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;gBAChC,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAC1D,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACtD,6EAA6E;gBAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;gBAC7C,KAAK,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC/C,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBAClC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvD,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;gBACD,mEAAmE;gBACnE,IAAI,4CAA4C,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;oBACpE,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,uEAAuE;gBACvE,uEAAuE;gBACvE,MAAM,cAAc,GAAG,YAAY,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBAC/F,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,oEAAoE;gBACpE,sEAAsE;gBACtE,6DAA6D;gBAC7D,yEAAyE;gBACzE,qBAAqB;gBACrB,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBACrD,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;QAED,wDAAwD;QACxD,mDAAmD;QACnD,EAAE;QACF,oEAAoE;QACpE,oEAAoE;QACpE,6DAA6D;QAC7D,wCAAwC;QACxC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;gBAChC,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;oBAAE,OAAO,IAAI,CAAC;gBAChD,MAAM,YAAY,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACtD,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;gBACtE,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;gBACpC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC;gBAEjD,iEAAiE;gBACjE,wDAAwD;gBACxD,IAAI,MAAM,KAAK,OAAO,IAAI,QAAQ,EAAE,CAAC;oBACnC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;oBAC3E,IAAI,QAAQ,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC;wBAAE,OAAO,KAAK,CAAC;gBAChE,CAAC;gBAED,iEAAiE;gBACjE,qCAAqC;gBACrC,IACE,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS;oBAC3C,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,UAAU,CAAC,IAAI,QAAQ,EACzD,CAAC;oBACD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;oBAC3E,IAAI,QAAQ,IAAI,uBAAuB,CAAC,GAAG,CAAC,QAAQ,CAAC;wBAAE,OAAO,KAAK,CAAC;gBACtE,CAAC;gBAED,kEAAkE;gBAClE,6DAA6D;gBAC7D,6DAA6D;gBAC7D,6DAA6D;gBAC7D,IAAI,MAAM,IAAI,0BAA0B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACrD,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;oBACvD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;wBAClB,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;4BACxB,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;gCAAE,OAAO,KAAK,CAAC;wBACrC,CAAC;6BAAM,CAAC;4BACN,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;4BAC/B,IAAI,iCAAiC,CAAC,QAAQ,CAAC;gCAAE,OAAO,KAAK,CAAC;wBAChE,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,8DAA8D;gBAC9D,iDAAiD;gBACjD,IAAI,MAAM,KAAK,aAAa;oBACxB,4BAA4B,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;oBACpD,OAAO,KAAK,CAAC;gBACf,CAAC;gBAED,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IAClD,CAAC;CACF;AAUD;;;;GAIG;AACH,SAAS,cAAc,CAAC,KAAa;IACnC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IAEzB,SAAS,IAAI,KAAa,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpD,SAAS,OAAO,KAAa,OAAO,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACzD,SAAS,MAAM,KAAW,OAAO,GAAG,GAAG,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG;QAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAE1E,SAAS,WAAW;QAClB,MAAM,EAAE,CAAC;QACT,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;QAC9C,OAAO,GAAG,GAAG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAE,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAChF,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACrC,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChC,CAAC;IAED,SAAS,WAAW;QAClB,MAAM,EAAE,CAAC;QACT,IAAI,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACnB,OAAO,EAAE,CAAC,CAAC,MAAM;YACjB,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;YACxB,MAAM,EAAE,CAAC;YACT,IAAI,IAAI,EAAE,KAAK,GAAG;gBAAE,OAAO,EAAE,CAAC;YAC9B,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,WAAW,EAAE,CAAC;IACvB,CAAC;IAED,SAAS,SAAS;QAChB,IAAI,IAAI,GAAG,WAAW,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/B,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC;YAClB,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;gBAAE,MAAM;YACpC,OAAO,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;YAC5B,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAChC,IAAI,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;YACvE,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,SAAS;QAChB,IAAI,IAAI,GAAG,SAAS,EAAE,CAAC;QACvB,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/B,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,CAAC;YACT,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC;YAClB,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;gBAAE,MAAM;YACpC,OAAO,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;YAC1B,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAChC,IAAI,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,CAAC;IACT,OAAO,GAAG,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY,EAAE,OAAgB;IAC9D,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;QAClC,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,IAAI,KAAK,EAAE,GAAG,CAAC,CAAC;YAC/C,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACjD,iFAAiF;IACjF,6EAA6E;IAC7E,iFAAiF;IACjF,sFAAsF;IACtF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAAC,CAAC,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACrC,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,CAAC,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACjD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,gDAAgD;AAChE,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAiC,EACjC,KAAwB,EACxB,oBAA8C,EAC9C,OAAgB;IAEhB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACzB,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACrD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACjC,MAAM,gBAAgB,GAAG,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBAC3E,IAAI,gBAAgB,EAAE,CAAC;oBACrB,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;oBACtC,IAAI,QAAQ,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;oBACnC,QAAQ,GAAG,wBAAwB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;oBACvD,MAAM,cAAc,GAAG,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBAC3D,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;wBACjC,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;wBAC1E,IAAI,CAAC,SAAS;4BAAE,OAAO,KAAK,CAAC;oBAC/B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAiC,EACjC,KAAwB,EACxB,WAAwB,EACxB,OAAgB,EAChB,GAAqB,EACrB,aAA2B,EAC3B,iBAA+B,EAC/B,QAAiB;IAEjB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,GAAG,EAAE,CAAC;QACR,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;gBAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACzB,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACrD,MAAM,qBAAqB,GAAG,iBAAiB,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC;QAEzE,uFAAuF;QACvF,yFAAyF;QACzF,6FAA6F;QAC7F,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM;YAC/B,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,MAAM,CAAC;YACxD,CAAC,CAAC,WAAW,CAAC;QAEhB,sFAAsF;QACtF,uFAAuF;QACvF,kFAAkF;QAClF,gFAAgF;QAChF,wDAAwD;QACxD,MAAM,iBAAiB,GAAG,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,OAAO,CAAC;QAEtE,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,IAAI,eAAe,GAAG,IAAI,CAAC;YAC3B,IAAI,iBAAiB,GAAG,CAAC,CAAC;YAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;YAElC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACjC,mFAAmF;gBACnF,sFAAsF;gBACtF,mFAAmF;gBACnF,oFAAoF;gBACpF,gFAAgF;gBAChF,IAAI,iBAAiB,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBAClI,iBAAiB,EAAE,CAAC;gBAEpB,yFAAyF;gBACzF,oFAAoF;gBACpF,uFAAuF;gBACvF,wFAAwF;gBACxF,IAAI,QAAQ,KAAK,MAAM,IAAI,GAAG,CAAC,UAAU,KAAK,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI;oBAAE,SAAS;gBAEjH,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnD,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC;oBAC7B,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;oBAErE,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;wBAAC,eAAe,GAAG,KAAK,CAAC;wBAAC,SAAS;oBAAC,CAAC;oBAC7F,IAAI,aAAa,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,aAAa,EAAE,GAAG,CAAC,OAAO,CAAC;wBAAE,SAAS;oBAC5E,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;wBAAC,eAAe,GAAG,KAAK,CAAC;wBAAC,SAAS;oBAAC,CAAC;oBAEnG,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBACpE,IAAI,WAAW,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS;wBAAE,SAAS;oBAE5D,eAAe,GAAG,KAAK,CAAC;gBAC1B,CAAC;qBAAM,CAAC;oBACN,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI;wBAAE,SAAS;oBAClC,IAAI,GAAG,CAAC,UAAU,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,yBAAyB,CAAC,GAAG,CAAC,UAAU,CAAC;wBAAE,SAAS;oBAC3F,eAAe,GAAG,KAAK,CAAC;gBAC1B,CAAC;YACH,CAAC;YAED,IAAI,eAAe,IAAI,iBAAiB,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;QAC7D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAiC,EACjC,UAA2C,EAC3C,KAAwB;IAExB,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEzD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC9D,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACtD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwB,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACzB,MAAM,cAAc,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEhE,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAoC,CAAC,EAAE,CAAC;gBACtE,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACnD,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;oBAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;wBACjC,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;wBAClC,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;wBACjE,IAAI,cAAc,EAAE,CAAC;4BACnB,MAAM,aAAa,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;4BACxC,MAAM,YAAY,GAAI,cAAc,CAAC,CAAC,CAAC,CAAC;4BACxC,IAAI,YAAY,EAAE,CAAC;gCACjB,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,YAAY,IAAI,aAAa,GAAG,CAAC;oCAAE,OAAO,KAAK,CAAC;4BACvE,CAAC;iCAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,aAAa,GAAG,CAAC,EAAE,CAAC;gCAC9C,OAAO,KAAK,CAAC;4BACf,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}
|
|
@@ -24344,6 +24344,74 @@ var JS_XSS_SANITIZERS = [
|
|
|
24344
24344
|
/\bbypassSecurityTrust/
|
|
24345
24345
|
// Angular
|
|
24346
24346
|
];
|
|
24347
|
+
var DATA_PARSER_TYPES = /* @__PURE__ */ new Set([
|
|
24348
|
+
"Parser",
|
|
24349
|
+
// commonmark, airline, picocli, jcommander
|
|
24350
|
+
"CommandLine",
|
|
24351
|
+
"JCommander",
|
|
24352
|
+
"DateParser",
|
|
24353
|
+
"FastDateFormat",
|
|
24354
|
+
"FastDatePrinter",
|
|
24355
|
+
"ResultParser",
|
|
24356
|
+
"DateFormat",
|
|
24357
|
+
"SimpleDateFormat",
|
|
24358
|
+
"NumberFormat",
|
|
24359
|
+
"DecimalFormat",
|
|
24360
|
+
"OptionParser",
|
|
24361
|
+
"CmdLineParser"
|
|
24362
|
+
]);
|
|
24363
|
+
var COMPILED_TEMPLATE_TYPES = /* @__PURE__ */ new Set([
|
|
24364
|
+
"Template",
|
|
24365
|
+
// Freemarker, Velocity
|
|
24366
|
+
"JetTemplate",
|
|
24367
|
+
// Jetbrick
|
|
24368
|
+
"ITemplate",
|
|
24369
|
+
// Rythm
|
|
24370
|
+
"VelocityTemplate",
|
|
24371
|
+
"BeetlTemplate"
|
|
24372
|
+
]);
|
|
24373
|
+
var REFLECTION_LITERAL_METHODS = /* @__PURE__ */ new Set([
|
|
24374
|
+
"forName",
|
|
24375
|
+
"loadClass",
|
|
24376
|
+
"getMethod",
|
|
24377
|
+
"getDeclaredMethod",
|
|
24378
|
+
"getConstructor",
|
|
24379
|
+
"getDeclaredConstructor",
|
|
24380
|
+
"parseExpression",
|
|
24381
|
+
"invoke"
|
|
24382
|
+
// no further args = no payload injection
|
|
24383
|
+
]);
|
|
24384
|
+
var JAVA_DECL_RE_TEMPLATE = "(?:\\b(?:final|public|private|protected|static)\\s+)*([A-Z]\\w*(?:\\.[A-Z]\\w*)?(?:<[^>]*>)?)\\s+RECV\\b\\s*[=;,)]";
|
|
24385
|
+
function resolveJavaReceiverType(receiver, sinkLine, sourceLines) {
|
|
24386
|
+
if (!receiver || !/^[A-Za-z_]\w*$/.test(receiver)) return null;
|
|
24387
|
+
const start2 = Math.max(0, sinkLine - 31);
|
|
24388
|
+
const declRe = new RegExp(JAVA_DECL_RE_TEMPLATE.replace("RECV", receiver));
|
|
24389
|
+
for (let i2 = sinkLine - 2; i2 >= start2; i2--) {
|
|
24390
|
+
const ln = sourceLines[i2] ?? "";
|
|
24391
|
+
const m = ln.match(declRe);
|
|
24392
|
+
if (m) {
|
|
24393
|
+
const raw = m[1].replace(/<[^>]*>/g, "").trim();
|
|
24394
|
+
const parts2 = raw.split(".");
|
|
24395
|
+
return parts2[parts2.length - 1] ?? null;
|
|
24396
|
+
}
|
|
24397
|
+
}
|
|
24398
|
+
return null;
|
|
24399
|
+
}
|
|
24400
|
+
function isJavaLiteralOrAnnotationAccessor(expr) {
|
|
24401
|
+
const e = expr.trim();
|
|
24402
|
+
if (e === "") return true;
|
|
24403
|
+
if (/^"(?:[^"\\]|\\.)*"$/.test(e)) return true;
|
|
24404
|
+
if (/^[A-Za-z_]\w*\s*\.\s*(?:value|name|key)\s*\(\s*\)$/.test(e)) return true;
|
|
24405
|
+
return false;
|
|
24406
|
+
}
|
|
24407
|
+
function extractJavaCallArgs(method, line) {
|
|
24408
|
+
const re = new RegExp(`\\b${method}\\s*\\(([^()]*(?:\\([^()]*\\)[^()]*)*)\\)`);
|
|
24409
|
+
const m = line.match(re);
|
|
24410
|
+
if (!m) return null;
|
|
24411
|
+
const argsText = m[1].trim();
|
|
24412
|
+
if (argsText === "") return [];
|
|
24413
|
+
return argsText.split(",").map((s) => s.trim());
|
|
24414
|
+
}
|
|
24347
24415
|
var SinkFilterPass = class {
|
|
24348
24416
|
name = "sink-filter";
|
|
24349
24417
|
category = "security";
|
|
@@ -24472,7 +24540,7 @@ var SinkFilterPass = class {
|
|
|
24472
24540
|
}
|
|
24473
24541
|
if (["javascript", "typescript"].includes(language)) {
|
|
24474
24542
|
const sourceLines = ctx.code.split("\n");
|
|
24475
|
-
const guardPatterns = /\b(?:includes|startsWith|endsWith|indexOf|test|match)\s*\(/;
|
|
24543
|
+
const guardPatterns = /\b(?:includes|startsWith|endsWith|indexOf|test|match|has)\s*\(/;
|
|
24476
24544
|
filtered = filtered.filter((sink) => {
|
|
24477
24545
|
if (sink.type !== "open_redirect" && sink.type !== "crlf") {
|
|
24478
24546
|
return true;
|
|
@@ -24492,6 +24560,42 @@ var SinkFilterPass = class {
|
|
|
24492
24560
|
if (setHeaderMatch) {
|
|
24493
24561
|
return false;
|
|
24494
24562
|
}
|
|
24563
|
+
if (sink.method === "cookie" && sink.type === "crlf") {
|
|
24564
|
+
return false;
|
|
24565
|
+
}
|
|
24566
|
+
return true;
|
|
24567
|
+
});
|
|
24568
|
+
}
|
|
24569
|
+
if (language === "java") {
|
|
24570
|
+
const sourceLines = ctx.code.split("\n");
|
|
24571
|
+
filtered = filtered.filter((sink) => {
|
|
24572
|
+
if (sink.type !== "code_injection") return true;
|
|
24573
|
+
const sinkLineText = sourceLines[sink.line - 1] ?? "";
|
|
24574
|
+
const receiverMatch = sinkLineText.match(/\b(\w+)\s*\.\s*(\w+)\s*\(/);
|
|
24575
|
+
const receiver = receiverMatch?.[1];
|
|
24576
|
+
const method = sink.method ?? receiverMatch?.[2];
|
|
24577
|
+
if (method === "parse" && receiver) {
|
|
24578
|
+
const recvType = resolveJavaReceiverType(receiver, sink.line, sourceLines);
|
|
24579
|
+
if (recvType && DATA_PARSER_TYPES.has(recvType)) return false;
|
|
24580
|
+
}
|
|
24581
|
+
if ((method === "render" || method === "process" || method === "merge" || method === "renderTo") && receiver) {
|
|
24582
|
+
const recvType = resolveJavaReceiverType(receiver, sink.line, sourceLines);
|
|
24583
|
+
if (recvType && COMPILED_TEMPLATE_TYPES.has(recvType)) return false;
|
|
24584
|
+
}
|
|
24585
|
+
if (method && REFLECTION_LITERAL_METHODS.has(method)) {
|
|
24586
|
+
const args2 = extractJavaCallArgs(method, sinkLineText);
|
|
24587
|
+
if (args2 !== null) {
|
|
24588
|
+
if (method === "invoke") {
|
|
24589
|
+
if (args2.length <= 1) return false;
|
|
24590
|
+
} else {
|
|
24591
|
+
const firstArg = args2[0] ?? "";
|
|
24592
|
+
if (isJavaLiteralOrAnnotationAccessor(firstArg)) return false;
|
|
24593
|
+
}
|
|
24594
|
+
}
|
|
24595
|
+
}
|
|
24596
|
+
if (method === "newInstance" && /\.\s*newInstance\s*\(\s*\)/.test(sinkLineText)) {
|
|
24597
|
+
return false;
|
|
24598
|
+
}
|
|
24495
24599
|
return true;
|
|
24496
24600
|
});
|
|
24497
24601
|
}
|
|
@@ -31306,14 +31410,29 @@ var RESPONSE_SEND_METHODS = /* @__PURE__ */ new Set([
|
|
|
31306
31410
|
function isExceptionExpression(expr) {
|
|
31307
31411
|
if (!expr) return false;
|
|
31308
31412
|
const e = expr.trim();
|
|
31309
|
-
return /\b(err|error|exc|exception|e|t|throwable)\.(stack|
|
|
31413
|
+
return /\b(err|error|exc|exception|e|t|throwable)\.(stack|toString\(|getStackTrace\(|getLocalizedMessage\(|getCause\()/i.test(e) || /\btraceback\.(format_exc|format_exception|print_exc)\b/i.test(e) || /\bdebug\.Stack\(\)/.test(e) || /\bstr\(\s*(err|error|exc|exception|e)\s*\)/i.test(e) || /\bString\(\s*(err|error|exc|exception|e)\s*\)/i.test(e);
|
|
31414
|
+
}
|
|
31415
|
+
var PY_FILE_HANDLE_OPEN_RE = /^\s*(?:with\s+open\s*\([^)]*\)\s+as\s+(\w+)\s*:|(\w+)\s*=\s*open\s*\()/;
|
|
31416
|
+
function isPythonFileHandle(receiver, callLine, sourceLines) {
|
|
31417
|
+
if (!receiver || !/^[A-Za-z_]\w*$/.test(receiver)) return false;
|
|
31418
|
+
const start2 = Math.max(0, callLine - 11);
|
|
31419
|
+
for (let i2 = callLine - 2; i2 >= start2; i2--) {
|
|
31420
|
+
const ln = sourceLines[i2] ?? "";
|
|
31421
|
+
const m = ln.match(PY_FILE_HANDLE_OPEN_RE);
|
|
31422
|
+
if (!m) continue;
|
|
31423
|
+
const name2 = m[1] ?? m[2];
|
|
31424
|
+
if (name2 === receiver) return true;
|
|
31425
|
+
}
|
|
31426
|
+
return false;
|
|
31310
31427
|
}
|
|
31311
31428
|
function argIsException(arg) {
|
|
31312
31429
|
if (!arg) return false;
|
|
31430
|
+
const expr = (arg.expression ?? "").trim();
|
|
31313
31431
|
if (arg.variable && /^(err|error|exc|exception|e|t|throwable)$/i.test(arg.variable)) {
|
|
31314
|
-
return true;
|
|
31432
|
+
if (!expr || expr === arg.variable) return true;
|
|
31433
|
+
return isExceptionExpression(expr);
|
|
31315
31434
|
}
|
|
31316
|
-
return isExceptionExpression(
|
|
31435
|
+
return isExceptionExpression(expr);
|
|
31317
31436
|
}
|
|
31318
31437
|
function detectJavaPrintStackTrace(call) {
|
|
31319
31438
|
if (call.method_name !== "printStackTrace") return null;
|
|
@@ -31328,11 +31447,14 @@ function detectJavaPrintStackTrace(call) {
|
|
|
31328
31447
|
}
|
|
31329
31448
|
return null;
|
|
31330
31449
|
}
|
|
31331
|
-
function detectResponseLeakCall(call) {
|
|
31450
|
+
function detectResponseLeakCall(call, language, sourceLines) {
|
|
31332
31451
|
const method = call.method_name ?? "";
|
|
31333
31452
|
const receiver = call.receiver ?? "";
|
|
31334
31453
|
if (!RESPONSE_SEND_METHODS.has(method)) return null;
|
|
31335
31454
|
if (LOGGER_RECEIVER_RE.test(receiver)) return null;
|
|
31455
|
+
if (language === "python" && (method === "write" || method === "writelines") && sourceLines && isPythonFileHandle(receiver, call.location.line, sourceLines)) {
|
|
31456
|
+
return null;
|
|
31457
|
+
}
|
|
31336
31458
|
const recTail = receiver.split(".").pop() ?? receiver;
|
|
31337
31459
|
const recHead = receiver.split(".")[0] ?? receiver;
|
|
31338
31460
|
if (!RESPONSE_RECEIVER_RE.test(recTail) && !RESPONSE_RECEIVER_RE.test(recHead)) {
|
|
@@ -31374,6 +31496,7 @@ var InfoDisclosureStacktracePass = class {
|
|
|
31374
31496
|
const { graph, language } = ctx;
|
|
31375
31497
|
const file = graph.ir.meta.file;
|
|
31376
31498
|
const findings = [];
|
|
31499
|
+
const sourceLines = ctx.code.split("\n");
|
|
31377
31500
|
if (language === "python") {
|
|
31378
31501
|
for (const f of detectPythonTracebackReturn(ctx)) {
|
|
31379
31502
|
findings.push({ line: f.line, api: f.api, language });
|
|
@@ -31384,9 +31507,9 @@ var InfoDisclosureStacktracePass = class {
|
|
|
31384
31507
|
let api = null;
|
|
31385
31508
|
if (language === "java") {
|
|
31386
31509
|
api = detectJavaPrintStackTrace(call);
|
|
31387
|
-
if (!api) api = detectResponseLeakCall(call);
|
|
31510
|
+
if (!api) api = detectResponseLeakCall(call, language, sourceLines);
|
|
31388
31511
|
} else if (language === "javascript" || language === "typescript") {
|
|
31389
|
-
api = detectResponseLeakCall(call);
|
|
31512
|
+
api = detectResponseLeakCall(call, language, sourceLines);
|
|
31390
31513
|
} else if (language === "go") {
|
|
31391
31514
|
const method = call.method_name ?? "";
|
|
31392
31515
|
const rec = call.receiver ?? "";
|
|
@@ -31405,10 +31528,10 @@ var InfoDisclosureStacktracePass = class {
|
|
|
31405
31528
|
}
|
|
31406
31529
|
}
|
|
31407
31530
|
} else {
|
|
31408
|
-
api = detectResponseLeakCall(call);
|
|
31531
|
+
api = detectResponseLeakCall(call, language, sourceLines);
|
|
31409
31532
|
}
|
|
31410
31533
|
} else if (language === "python") {
|
|
31411
|
-
api = detectResponseLeakCall(call);
|
|
31534
|
+
api = detectResponseLeakCall(call, language, sourceLines);
|
|
31412
31535
|
}
|
|
31413
31536
|
if (!api) continue;
|
|
31414
31537
|
const line = call.location.line;
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "circle-ir",
|
|
3
|
-
"version": "3.
|
|
3
|
+
"version": "3.100.0",
|
|
4
4
|
"description": "High-performance Static Application Security Testing (SAST) library for detecting security vulnerabilities through taint analysis",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "dist/index.js",
|