npm - circle-ir - Versions diffs - 4.11.0 → 4.13.0 - Mend

circle-ir 4.11.0 → 4.13.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (40) hide show

package/dist/analysis/passes/interprocedural-pass.js CHANGED Viewed

@@ -12,6 +12,7 @@
  *
  * Depends on: sink-filter, constant-propagation, taint-propagation
  */
+import { CSharpCredit } from './csharp-sanitizer-credit.js';
 import { analyzeInterprocedural, findTaintBridges } from '../interprocedural.js';
 import { attachSourceLineCode } from '../taint-matcher.js';
 import { shouldGateInterproceduralParam } from '../entry-point-detection.js';
@@ -53,6 +54,9 @@ export class InterproceduralPass {
             }
         }
         const language = graph.ir.meta.language;
+        const csCredit = language === 'csharp' && typeof ctx.code === 'string'
+            ? new CSharpCredit(ctx.code, graph.ir.types.flatMap(t => t.methods))
+            : null;
         // --- Scenario A: sources AND sinks present --------------------------------
         if (sinks.length > 0) {
             const interProc = analyzeInterprocedural(graph, sources, sinks, sanitizers, {
@@ -88,6 +92,13 @@ export class InterproceduralPass {
                             continue;
                         if (sanitizerMethodNames.has(method.name))
                             continue;
+                        // cognium-dev#518 / #286 A: a tainted argument reaches a sink in
+                        // the callee only if the parameter, or something derived from it,
+                        // is what the sink receives.
+                        if (language === 'csharp' && typeof ctx.code === 'string' &&
+                            !csharpParamReachesSink(ctx.code, method, edge.taintedArgs, sink, csCredit)) {
+                            continue;
+                        }
                         for (const source of sources) {
                             if (source.line > edge.callLine)
                                 continue;
@@ -275,7 +286,85 @@ export class InterproceduralPass {
                 return !sanitizedSinkKeys.has(`${s.line}:${s.type}`);
             });
         }
+        // cognium-dev#518: the escape fallback has no sink type, so the typed C#
+        // credit in SinkFilterPass never sees it. A value that was encoded,
+        // validated or sent to a constant host is not an unvalidated escape.
+        if (csCredit) {
+            const credited = new Set();
+            filteredAdditionalFlows = filteredAdditionalFlows.filter(f => {
+                if (f.sink_type !== 'external_taint_escape' || !csCredit.creditedOnLine(f.sink_line))
+                    return true;
+                credited.add(f.sink_line);
+                return false;
+            });
+            filteredAdditionalSinks = filteredAdditionalSinks.filter(s => !(s.type === 'external_taint_escape' && credited.has(s.line)));
+        }
         return { additionalSinks: filteredAdditionalSinks, additionalFlows: filteredAdditionalFlows, interprocedural };
     }
 }
+/**
+ * Does a tainted argument passed to a C# callee reach `sink` inside it?
+ *
+ * Scenario A used to emit a flow for every sink in a method that received a
+ * tainted argument, whatever the sink was given. That flagged a parameterised
+ * query (`cmd.Parameters.AddWithValue("@name", name); cmd.ExecuteNonQuery();`)
+ * and a constructor with constant arguments in a method that escapes its
+ * parameter before using it.
+ *
+ * Reads the callee top to bottom up to the sink. A name is derived from the
+ * parameter when it is assigned an expression that mentions a derived name, or
+ * is an object written through a property or a mutating call with one
+ * (`cmd.CommandText = … + name`, `sb.Append(name)`). A nested member such as
+ * `cmd.Parameters.AddWithValue(…)` binds a value and does not taint `cmd`.
+ * The sink is reached when its statement mentions a derived name that is not
+ * sanitized or guarded there.
+ */
+function csharpParamReachesSink(code, method, taintedArgs, sink, credit) {
+    // CRLF files leave `\r` on every line, which `.` and `$` will not cross.
+    const lines = code.split(/\r?\n/);
+    const params = taintedArgs.length > 0
+        ? method.parameters.filter(p => taintedArgs.includes(p.position))
+        : method.parameters;
+    if (params.length === 0)
+        return true;
+    const derived = new Set(params.map(p => p.name));
+    // A name inside a string literal is text, not a use: `"… WHERE name = @name"`
+    // does not mention the parameter `name`. Interpolation holes are real uses.
+    const codeOf = (text) => text
+        .replace(/\$@?"(?:[^"\\]|\\.)*"/g, lit => ' ' + [...lit.matchAll(/\{([^}]*)\}/g)].map(x => x[1]).join(' ') + ' ')
+        .replace(/@?"(?:[^"\\]|\\.)*"/g, ' ')
+        .replace(/'(?:[^'\\]|\\.)'/g, ' ');
+    const mentionsDerived = (text) => {
+        const bare = codeOf(text);
+        return [...derived].filter(v => new RegExp(`(?<![\\w.])${v}(?![\\w])`).test(bare));
+    };
+    const assignRe = /^\s*(?:var\s+|[A-Za-z_][\w.<>[\]?]*\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*(.+)$/;
+    const objectWriteRe = /^\s*([A-Za-z_]\w*)\s*\.\s*[A-Za-z_]\w*\s*(?:\+?=(?!=)|\()(.*)$/;
+    for (let i = method.startLine + 1; i < sink.line; i++) {
+        const text = lines[i - 1] ?? '';
+        const assign = assignRe.exec(text);
+        if (assign) {
+            if (mentionsDerived(assign[2]).length > 0)
+                derived.add(assign[1]);
+            else if (!params.some(p => p.name === assign[1]))
+                derived.delete(assign[1]);
+            continue;
+        }
+        const write = objectWriteRe.exec(text);
+        if (write && mentionsDerived(write[2]).length > 0)
+            derived.add(write[1]);
+    }
+    // The sink statement, joined when it wraps over several lines.
+    let statement = lines[sink.line - 1] ?? '';
+    for (let i = sink.line; i < lines.length && i < sink.line + 6 && !/[;{}]\s*$/.test(statement.trimEnd()); i++) {
+        statement += ' ' + (lines[i] ?? '').trim();
+    }
+    const reaching = mentionsDerived(statement);
+    if (reaching.length === 0)
+        return false;
+    if (!credit)
+        return true;
+    const safe = new Set([...credit.sanitizedVarsAt(sink.type, sink.line), ...credit.guardedVarsAt(sink.type, sink.line)]);
+    return reaching.some(v => !safe.has(v));
+}
 //# sourceMappingURL=interprocedural-pass.js.map

package/dist/analysis/passes/interprocedural-pass.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"interprocedural-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/interprocedural-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAOH,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAgC5D,MAAM,OAAO,mBAAmB;IACrB,IAAI,GAAG,iBAAiB,CAAC;IACzB,QAAQ,GAAG,UAAmB,CAAC;IAEvB,oBAAoB,CAAU;IAE/C,YAAY,OAAgC;QAC1C,IAAI,CAAC,oBAAoB,GAAG,OAAO,EAAE,oBAAoB,IAAI,IAAI,CAAC;IACpE,CAAC;IAED,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;QAEtB,MAAM,SAAS,GAAK,GAAG,CAAC,SAAS,CAA2B,sBAAsB,CAAC,CAAC;QACpF,MAAM,UAAU,GAAI,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC;QACnE,MAAM,SAAS,GAAK,GAAG,CAAC,SAAS,CAA6B,mBAAmB,CAAC,CAAC;QAEnF,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC;QAElD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,wEAAwE;YACxE,0EAA0E;YAC1E,mEAAmE;YACnE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,CAAC;QAED,MAAM,eAAe,GAAgB,EAAE,CAAC;QACxC,MAAM,eAAe,GAAoB,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,eAAgD,CAAC;QAErD,yEAAyE;QACzE,4EAA4E;QAC5E,uEAAuE;QACvE,2EAA2E;QAC3E,iEAAiE;QACjE,4EAA4E;QAC5E,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkD,CAAC;QAClF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACxC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBACxC,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrD,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;QAExC,6EAA6E;QAC7E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE;gBAC1E,gBAAgB,EAAE,SAAS,CAAC,OAAO;aACpC,CAAC,CAAC;YAEH,gFAAgF;YAChF,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,eAAe,EAAE,CAAC;gBAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,uBAAuB;oBAAE,SAAS;gBACpD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC3C,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,wDAAwD;YACxD,IAAI,SAAS,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;gBAC/C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;oBAC7B,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;wBACrC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;wBAC9C,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBAC1D,CAAC;gBACH,CAAC;gBAED,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,eAAe,EAAE,CAAC;oBAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,uBAAuB;wBAAE,SAAS;oBAEpD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;wBACvC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;4BAAE,SAAS;wBAE/D,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;wBAC5D,IAAI,CAAC,MAAM;4BAAE,SAAS;wBACtB,IAAI,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,OAAO;4BAAE,SAAS;wBACzE,IAAI,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;4BAAE,SAAS;wBAEpD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;4BAC7B,IAAI,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ;gCAAE,SAAS;4BAC1C,IAAI,MAAM,CAAC,IAAI,KAAK,uBAAuB,IAAI,MAAM,CAAC,UAAU,GAAG,GAAG;gCAAE,SAAS;4BACjF,gEAAgE;4BAChE,mEAAmE;4BACnE,iEAAiE;4BACjE,yDAAyD;4BACzD,gEAAgE;4BAChE,0DAA0D;4BAC1D,iCAAiC;4BACjC,8CAA8C;4BAC9C,4DAA4D;4BAC5D,uDAAuD;4BACvD,IACE,IAAI,CAAC,oBAAoB;gCACzB,MAAM,CAAC,IAAI,KAAK,uBAAuB;gCACvC,MAAM,CAAC,SAAS,EAChB,CAAC;gCACD,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gCACxD,IAAI,8BAA8B,CAChC,MAAM,CAAC,IAAI,EACX,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,IAAI,EACf;oCACE,QAAQ;oCACR,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK;oCACrB,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI;oCAC5B,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK;oCACrB,oBAAoB,EAAE,KAAK,CAAC,EAAE,CAAC,qBAAqB,IAAI,IAAI;iCAC7D,CACF,EAAE,CAAC;oCACF,SAAS;gCACX,CAAC;4BACH,CAAC;4BACD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC;gCAAE,SAAS;4BAEpG,eAAe,CAAC,IAAI,CAAC;gCACnB,WAAW,EAAE,MAAM,CAAC,IAAI;gCACxB,SAAS,EAAI,IAAI,CAAC,IAAI;gCACtB,WAAW,EAAE,MAAM,CAAC,IAAI;gCACxB,SAAS,EAAI,IAAI,CAAC,IAAI;gCACtB,IAAI,EAAE;oCACJ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAa,IAAI,EAAE,MAAM,CAAC,IAAI,EAAK,IAAI,EAAE,QAAiB,EAAE;oCACvF,EAAE,QAAQ,EAAE,WAAW,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAG,IAAI,EAAE,KAAiB,EAAE;oCACvF,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAe,IAAI,EAAE,IAAI,CAAC,IAAI,EAAO,IAAI,EAAE,MAAiB,EAAE;iCACxF;gCACD,UAAU,EAAE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI;gCACtD,SAAS,EAAE,KAAK;6BACjB,CAAC,CAAC;4BACH,MAAM,CAAC,gCAAgC;wBACzC,CAAC;wBACD,MAAM,CAAC,mCAAmC;oBAC5C,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;YACjD,eAAe,GAAG;gBAChB,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;gBACrD,aAAa,EAAE,YAAY;gBAC3B,YAAY,EAAE,SAAS,CAAC,SAAS;qBAC9B,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;qBAC/D,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACZ,MAAM,EAAS,IAAI,CAAC,YAAY;oBAChC,MAAM,EAAS,IAAI,CAAC,YAAY;oBAChC,SAAS,EAAM,IAAI,CAAC,QAAQ;oBAC5B,YAAY,EAAG,IAAI,CAAC,WAAW;oBAC/B,aAAa,EAAE,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;iBAC/D,CAAC,CAAC;aACN,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,uEAAuE;YACvE,wEAAwE;YACxE,8EAA8E;YAC9E,6EAA6E;YAC7E,gFAAgF;YAChF,4EAA4E;YAC5E,yEAAyE;YACzE,6EAA6E;YAC7E,4EAA4E;YAC5E,sEAAsE;YACtE,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB;gBACjC,CAAC,CAAC,IAAI,KAAK,uBAAuB,CACrC,CAAC;YACF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC;YAC/D,CAAC;YACD,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,UAAU,EAAE;gBAC/E,gBAAgB,EAAE,SAAS,CAAC,OAAO;aACpC,CAAC,CAAC;YAEH,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,eAAe,EAAE,CAAC;gBAC7C,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/C,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,IAAI,SAAS,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,IAAI,SAAS,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9E,MAAM,YAAY,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBACjD,eAAe,GAAG;oBAChB,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;oBACrD,aAAa,EAAE,YAAY;oBAC3B,YAAY,EAAE,SAAS,CAAC,SAAS;yBAC9B,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;yBAC/D,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;wBACZ,MAAM,EAAS,IAAI,CAAC,YAAY;wBAChC,MAAM,EAAS,IAAI,CAAC,YAAY;wBAChC,SAAS,EAAM,IAAI,CAAC,QAAQ;wBAC5B,YAAY,EAAG,IAAI,CAAC,WAAW;wBAC/B,aAAa,EAAE,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;qBAC/D,CAAC,CAAC;iBACN,CAAC;YACJ,CAAC;YAED,8DAA8D;YAC9D,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;oBACnC,eAAe,CAAC,IAAI,CAAC;wBACnB,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;wBAC5B,SAAS,EAAI,IAAI,CAAC,IAAI;wBACtB,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;wBAC5B,SAAS,EAAI,IAAI,CAAC,IAAI;wBACtB,IAAI,EAAE;4BACJ,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE;4BACrE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAQ,IAAI,EAAE,MAAiB,EAAE;yBACtE;wBACD,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU;wBACnD,SAAS,EAAE,KAAK;qBACjB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,0EAA0E;QAC1E,oEAAoE;QACpE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,oBAAoB,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC;QAED,oEAAoE;QACpE,sEAAsE;QACtE,uEAAuE;QACvE,qEAAqE;QACrE,mEAAmE;QACnE,eAAe;QACf,IAAI,uBAAuB,GAAG,eAAe,CAAC;QAC9C,IAAI,uBAAuB,GAAI,eAAe,CAAC;QAC/C,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA6B,CAAC;YAC9D,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACjD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACd,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACtC,CAAC;YACD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;YAC5C,uBAAuB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;gBACnD,kDAAkD;gBAClD,iEAAiE;gBACjE,qDAAqD;gBACrD,iEAAiE;gBACjE,8DAA8D;gBAC9D,IAAI,CAAC,CAAC,SAAS,KAAK,uBAAuB,EAAE,CAAC;oBAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;oBAChD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;oBAChD,KAAK,IAAI,IAAI,GAAG,EAAE,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;wBACvC,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBAC9C,IAAI,CAAC,UAAU;4BAAE,SAAS;wBAC1B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;4BAC7B,IAAI,mBAAmB,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;gCAC1C,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;gCACvD,OAAO,KAAK,CAAC;4BACf,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACrD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACxD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;oBAC7B,IAAI,mBAAmB,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;wBAC1C,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;YACH,kEAAkE;YAClE,gEAAgE;YAChE,uDAAuD;YACvD,uBAAuB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;gBACnD,IAAI,CAAC,CAAC,IAAI,KAAK,uBAAuB;oBAAE,OAAO,IAAI,CAAC;gBACpD,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,eAAe,EAAE,uBAAuB,EAAE,eAAe,EAAE,CAAC;IACjH,CAAC;CACF"}
1	+ {"version":3,"file":"interprocedural-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/interprocedural-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAI5D,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAgC5D,MAAM,OAAO,mBAAmB;IACrB,IAAI,GAAG,iBAAiB,CAAC;IACzB,QAAQ,GAAG,UAAmB,CAAC;IAEvB,oBAAoB,CAAU;IAE/C,YAAY,OAAgC;QAC1C,IAAI,CAAC,oBAAoB,GAAG,OAAO,EAAE,oBAAoB,IAAI,IAAI,CAAC;IACpE,CAAC;IAED,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;QAEtB,MAAM,SAAS,GAAK,GAAG,CAAC,SAAS,CAA2B,sBAAsB,CAAC,CAAC;QACpF,MAAM,UAAU,GAAI,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC;QACnE,MAAM,SAAS,GAAK,GAAG,CAAC,SAAS,CAA6B,mBAAmB,CAAC,CAAC;QAEnF,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC;QAElD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,wEAAwE;YACxE,0EAA0E;YAC1E,mEAAmE;YACnE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,CAAC;QAED,MAAM,eAAe,GAAgB,EAAE,CAAC;QACxC,MAAM,eAAe,GAAoB,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9D,IAAI,eAAgD,CAAC;QAErD,yEAAyE;QACzE,4EAA4E;QAC5E,uEAAuE;QACvE,2EAA2E;QAC3E,iEAAiE;QACjE,4EAA4E;QAC5E,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkD,CAAC;QAClF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACxC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBACxC,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrD,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;QAExC,MAAM,QAAQ,GAAG,QAAQ,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;YACpE,CAAC,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACpE,CAAC,CAAC,IAAI,CAAC;QAET,6EAA6E;QAC7E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE;gBAC1E,gBAAgB,EAAE,SAAS,CAAC,OAAO;aACpC,CAAC,CAAC;YAEH,gFAAgF;YAChF,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,eAAe,EAAE,CAAC;gBAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,uBAAuB;oBAAE,SAAS;gBACpD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC3C,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,wDAAwD;YACxD,IAAI,SAAS,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;gBAC/C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;oBAC7B,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;wBACrC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;wBAC9C,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBAC1D,CAAC;gBACH,CAAC;gBAED,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,eAAe,EAAE,CAAC;oBAC7C,IAAI,IAAI,CAAC,IAAI,KAAK,uBAAuB;wBAAE,SAAS;oBAEpD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;wBACvC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;4BAAE,SAAS;wBAE/D,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;wBAC5D,IAAI,CAAC,MAAM;4BAAE,SAAS;wBACtB,IAAI,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,OAAO;4BAAE,SAAS;wBACzE,IAAI,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;4BAAE,SAAS;wBACpD,iEAAiE;wBACjE,kEAAkE;wBAClE,6BAA6B;wBAC7B,IAAI,QAAQ,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;4BACrD,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;4BAChF,SAAS;wBACX,CAAC;wBAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;4BAC7B,IAAI,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ;gCAAE,SAAS;4BAC1C,IAAI,MAAM,CAAC,IAAI,KAAK,uBAAuB,IAAI,MAAM,CAAC,UAAU,GAAG,GAAG;gCAAE,SAAS;4BACjF,gEAAgE;4BAChE,mEAAmE;4BACnE,iEAAiE;4BACjE,yDAAyD;4BACzD,gEAAgE;4BAChE,0DAA0D;4BAC1D,iCAAiC;4BACjC,8CAA8C;4BAC9C,4DAA4D;4BAC5D,uDAAuD;4BACvD,IACE,IAAI,CAAC,oBAAoB;gCACzB,MAAM,CAAC,IAAI,KAAK,uBAAuB;gCACvC,MAAM,CAAC,SAAS,EAChB,CAAC;gCACD,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gCACxD,IAAI,8BAA8B,CAChC,MAAM,CAAC,IAAI,EACX,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,IAAI,EACf;oCACE,QAAQ;oCACR,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK;oCACrB,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI;oCAC5B,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK;oCACrB,oBAAoB,EAAE,KAAK,CAAC,EAAE,CAAC,qBAAqB,IAAI,IAAI;iCAC7D,CACF,EAAE,CAAC;oCACF,SAAS;gCACX,CAAC;4BACH,CAAC;4BACD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,IAAI,CAAC;gCAAE,SAAS;4BAEpG,eAAe,CAAC,IAAI,CAAC;gCACnB,WAAW,EAAE,MAAM,CAAC,IAAI;gCACxB,SAAS,EAAI,IAAI,CAAC,IAAI;gCACtB,WAAW,EAAE,MAAM,CAAC,IAAI;gCACxB,SAAS,EAAI,IAAI,CAAC,IAAI;gCACtB,IAAI,EAAE;oCACJ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAa,IAAI,EAAE,MAAM,CAAC,IAAI,EAAK,IAAI,EAAE,QAAiB,EAAE;oCACvF,EAAE,QAAQ,EAAE,WAAW,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAG,IAAI,EAAE,KAAiB,EAAE;oCACvF,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAe,IAAI,EAAE,IAAI,CAAC,IAAI,EAAO,IAAI,EAAE,MAAiB,EAAE;iCACxF;gCACD,UAAU,EAAE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI;gCACtD,SAAS,EAAE,KAAK;6BACjB,CAAC,CAAC;4BACH,MAAM,CAAC,gCAAgC;wBACzC,CAAC;wBACD,MAAM,CAAC,mCAAmC;oBAC5C,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;YACjD,eAAe,GAAG;gBAChB,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;gBACrD,aAAa,EAAE,YAAY;gBAC3B,YAAY,EAAE,SAAS,CAAC,SAAS;qBAC9B,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;qBAC/D,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACZ,MAAM,EAAS,IAAI,CAAC,YAAY;oBAChC,MAAM,EAAS,IAAI,CAAC,YAAY;oBAChC,SAAS,EAAM,IAAI,CAAC,QAAQ;oBAC5B,YAAY,EAAG,IAAI,CAAC,WAAW;oBAC/B,aAAa,EAAE,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;iBAC/D,CAAC,CAAC;aACN,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,uEAAuE;YACvE,wEAAwE;YACxE,8EAA8E;YAC9E,6EAA6E;YAC7E,gFAAgF;YAChF,4EAA4E;YAC5E,yEAAyE;YACzE,6EAA6E;YAC7E,4EAA4E;YAC5E,sEAAsE;YACtE,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CACpC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB;gBACjC,CAAC,CAAC,IAAI,KAAK,uBAAuB,CACrC,CAAC;YACF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACjC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC;YAC/D,CAAC;YACD,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,EAAE,UAAU,EAAE;gBAC/E,gBAAgB,EAAE,SAAS,CAAC,OAAO;aACpC,CAAC,CAAC;YAEH,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,eAAe,EAAE,CAAC;gBAC7C,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC/C,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,IAAI,SAAS,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,IAAI,SAAS,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9E,MAAM,YAAY,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBACjD,eAAe,GAAG;oBAChB,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC;oBACrD,aAAa,EAAE,YAAY;oBAC3B,YAAY,EAAE,SAAS,CAAC,SAAS;yBAC9B,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;yBAC/D,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;wBACZ,MAAM,EAAS,IAAI,CAAC,YAAY;wBAChC,MAAM,EAAS,IAAI,CAAC,YAAY;wBAChC,SAAS,EAAM,IAAI,CAAC,QAAQ;wBAC5B,YAAY,EAAG,IAAI,CAAC,WAAW;wBAC/B,aAAa,EAAE,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;qBAC/D,CAAC,CAAC;iBACN,CAAC;YACJ,CAAC;YAED,8DAA8D;YAC9D,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrD,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;oBACnC,eAAe,CAAC,IAAI,CAAC;wBACnB,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;wBAC5B,SAAS,EAAI,IAAI,CAAC,IAAI;wBACtB,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;wBAC5B,SAAS,EAAI,IAAI,CAAC,IAAI;wBACtB,IAAI,EAAE;4BACJ,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE;4BACrE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAQ,IAAI,EAAE,MAAiB,EAAE;yBACtE;wBACD,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU;wBACnD,SAAS,EAAE,KAAK;qBACjB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,0EAA0E;QAC1E,oEAAoE;QACpE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,oBAAoB,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC;QAED,oEAAoE;QACpE,sEAAsE;QACtE,uEAAuE;QACvE,qEAAqE;QACrE,mEAAmE;QACnE,eAAe;QACf,IAAI,uBAAuB,GAAG,eAAe,CAAC;QAC9C,IAAI,uBAAuB,GAAI,eAAe,CAAC;QAC/C,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA6B,CAAC;YAC9D,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACjD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACd,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACtC,CAAC;YACD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;YAC5C,uBAAuB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;gBACnD,kDAAkD;gBAClD,iEAAiE;gBACjE,qDAAqD;gBACrD,iEAAiE;gBACjE,8DAA8D;gBAC9D,IAAI,CAAC,CAAC,SAAS,KAAK,uBAAuB,EAAE,CAAC;oBAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;oBAChD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;oBAChD,KAAK,IAAI,IAAI,GAAG,EAAE,EAAE,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;wBACvC,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBAC9C,IAAI,CAAC,UAAU;4BAAE,SAAS;wBAC1B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;4BAC7B,IAAI,mBAAmB,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;gCAC1C,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;gCACvD,OAAO,KAAK,CAAC;4BACf,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBACrD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACxD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;oBAC7B,IAAI,mBAAmB,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;wBAC1C,OAAO,KAAK,CAAC;oBACf,CAAC;gBACH,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;YACH,kEAAkE;YAClE,gEAAgE;YAChE,uDAAuD;YACvD,uBAAuB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;gBACnD,IAAI,CAAC,CAAC,IAAI,KAAK,uBAAuB;oBAAE,OAAO,IAAI,CAAC;gBACpD,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,CAAC,CAAC,CAAC;QACL,CAAC;QAED,yEAAyE;QACzE,oEAAoE;QACpE,qEAAqE;QACrE,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;YACnC,uBAAuB,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;gBAC3D,IAAI,CAAC,CAAC,SAAS,KAAK,uBAAuB,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;oBAAE,OAAO,IAAI,CAAC;gBAClG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC1B,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,CAAC;YACH,uBAAuB,GAAG,uBAAuB,CAAC,MAAM,CACtD,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,uBAAuB,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CACnE,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,eAAe,EAAE,uBAAuB,EAAE,eAAe,EAAE,CAAC;IACjH,CAAC;CACF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,sBAAsB,CAC7B,IAAY,EACZ,MAAoF,EACpF,WAAqB,EACrB,IAAoC,EACpC,MAA2B;IAE3B,yEAAyE;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC;QACnC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;IACtB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,8EAA8E;IAC9E,4EAA4E;IAC5E,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CACtC,IAAI;SACD,OAAO,CAAC,wBAAwB,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;SAChH,OAAO,CAAC,sBAAsB,EAAE,GAAG,CAAC;SACpC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IACvC,MAAM,eAAe,GAAG,CAAC,IAAY,EAAY,EAAE;QACjD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,yEAAyE,CAAC;IAC3F,MAAM,aAAa,GAAG,gEAAgE,CAAC;IACvF,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;iBAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5E,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,KAAK,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,+DAA+D;IAC/D,IAAI,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7G,SAAS,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC"}

package/dist/analysis/passes/language-sources-pass.d.ts CHANGED Viewed

@@ -242,8 +242,13 @@ export declare function findGoXssFindings(code: string, file: string): SastFindi
  * Conservative: only fires when the receiver token matches a parameter
  * named with the `HttpServletResponse` type AND no recognized HTML
  * encoder wraps the argument.
+ *
+ * Lines in `taintSinkLines` are skipped: the taint matcher resolved the
+ * write as an xss sink there, so taint propagation decides whether user
+ * input reaches it. Firing on shape alone at those lines flagged every
+ * write of a constant or an encoded value.
  */
-export declare function findJavaResponseWriterXssFindings(code: string, file: string): SastFinding[];
+export declare function findJavaResponseWriterXssFindings(code: string, file: string, taintSinkLines?: ReadonlySet<number>): SastFinding[];
 /**
  * Vue xss — `template: '<...v-html="<var>"...>'` directive binding to a
  * variable that is sourced from a tainted location (URLSearchParams,

package/dist/analysis/passes/language-sources-pass.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"language-sources-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/language-sources-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,WAAW,EAAO,MAAM,sBAAsB,CAAC;AAC3H,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAyB9E,eAAO,MAAM,mBAAmB;;UACK,YAAY;;;UAEb,WAAW;;;UACR,aAAa;;;UACb,aAAa;;;UACjB,WAAW;;;UAGR,YAAY;;;UAQX,WAAW;;;UACV,UAAU;;;UAIC,WAAW;IA8D7D,CAAC;AAwDF,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAMD,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB,~~CAqgB3C~~;CACF;AAunDD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmO9E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAwC5G;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBjD;AAuBD,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAsB7B;AAoKD,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CA8BpG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmCrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAqFrB;AAyTD,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAsKvF;AAy/FD,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,WAAW,EAAE,CAcf;AAoLD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+HnF;AAMD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA2BjF;AAOD;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgCf;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Bf;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Bf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoCf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwEf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgDf;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA6Bf;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+C3E;AAED~~;;;;;;;;;;GAUG~~;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,~~GACX~~,WAAW,EAAE,~~CAoFf~~;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Gf;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoDf;AAED;;;;;;;;GAQG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiGf;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqDf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wCAAwC,CACtD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Df;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,8CAA8C,CAC5D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA4Df;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6CAA6C,CAC3D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAmFf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwKf;AAaD;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Gf;AAED;;;;;;;;GAQG;AACH,wBAAgB,uCAAuC,CACrD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqHf;AAED;;;;;;;GAOG;AACH,wBAAgB,qDAAqD,CACnE,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAuGf;AAED;;;;;;;;;GASG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAkKf;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiHf;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA+Ef;AAED;;;;;;GAMG;AACH,wBAAgB,gDAAgD,CAC9D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAyEf;AAwCD;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAmGf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAsHf;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAClD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoEf;AAED;;;;GAIG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA8Ff;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgGf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2If;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA+Kf;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Jf;AAED;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwFf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Ef;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAyEf;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAsDf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA6Ef;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiFf"}
1	+ {"version":3,"file":"language-sources-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/language-sources-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,WAAW,EAAO,MAAM,sBAAsB,CAAC;AAC3H,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAyB9E,eAAO,MAAM,mBAAmB;;UACK,YAAY;;;UAEb,WAAW;;;UACR,aAAa;;;UACb,aAAa;;;UACjB,WAAW;;;UAGR,YAAY;;;UAQX,WAAW;;;UACV,UAAU;;;UAIC,WAAW;IA8D7D,CAAC;AAwDF,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAMD,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB,CA6gB3C;CACF;AAunDD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmO9E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAwC5G;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBjD;AAuBD,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAsB7B;AAoKD,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CA8BpG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmCrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAqFrB;AAyTD,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAsKvF;AAy/FD,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,WAAW,EAAE,CAcf;AAoLD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+HnF;AAMD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA2BjF;AAOD;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgCf;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Bf;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Bf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoCf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwEf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgDf;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA6Bf;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+C3E;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,cAAc,GAAE,WAAW,CAAC,MAAM,CAAa,GAC9C,WAAW,EAAE,CAqFf;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Gf;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoDf;AAED;;;;;;;;GAQG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiGf;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqDf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wCAAwC,CACtD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Df;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,8CAA8C,CAC5D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA4Df;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6CAA6C,CAC3D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAmFf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwKf;AAaD;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Gf;AAED;;;;;;;;GAQG;AACH,wBAAgB,uCAAuC,CACrD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqHf;AAED;;;;;;;GAOG;AACH,wBAAgB,qDAAqD,CACnE,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAuGf;AAED;;;;;;;;;GASG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAkKf;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiHf;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA+Ef;AAED;;;;;;GAMG;AACH,wBAAgB,gDAAgD,CAC9D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAyEf;AAwCD;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAmGf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAsHf;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAClD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoEf;AAED;;;;GAIG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA8Ff;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgGf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2If;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA+Kf;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Jf;AAED;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwFf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Ef;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAyEf;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAsDf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA6Ef;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiFf"}

package/dist/analysis/passes/language-sources-pass.js CHANGED Viewed

@@ -536,7 +536,13 @@ export class LanguageSourcesPass {
             // Sprint 81 (#189): Java xss — HttpServletResponse.getWriter().{print,
             // println,write} receiver-chain that the configured PrintWriter sink
             // doesn't resolve.
-            for (const finding of findJavaResponseWriterXssFindings(code, graph.ir.meta.file)) {
+            // A write the taint matcher already recognized as an xss sink is the
+            // taint engine's to judge: it reports a flow when one exists, and its
+            // silence there is a verdict, not a gap.
+            const xssSinkLines = new Set(ctx.getResult('taint-matcher').sinks
+                .filter(s => s.type === 'xss')
+                .map(s => s.line));
+            for (const finding of findJavaResponseWriterXssFindings(code, graph.ir.meta.file, xssSinkLines)) {
                 ctx.addFinding(finding);
             }
             // Sprint 84 (#189): Java nosql_injection — MongoCollection find / insert /
@@ -7162,8 +7168,13 @@ export function findGoXssFindings(code, file) {
  * Conservative: only fires when the receiver token matches a parameter
  * named with the `HttpServletResponse` type AND no recognized HTML
  * encoder wraps the argument.
+ *
+ * Lines in `taintSinkLines` are skipped: the taint matcher resolved the
+ * write as an xss sink there, so taint propagation decides whether user
+ * input reaches it. Firing on shape alone at those lines flagged every
+ * write of a constant or an encoded value.
  */
-export function findJavaResponseWriterXssFindings(code, file) {
+export function findJavaResponseWriterXssFindings(code, file, taintSinkLines = new Set()) {
     const out = [];
     const lines = code.split('\n');
     const respNames = new Set();
@@ -7202,6 +7213,8 @@ export function findJavaResponseWriterXssFindings(code, file) {
         const m = trimmed.match(chainRe);
         if (!m)
             continue;
+        if (taintSinkLines.has(i + 1))
+            continue;
         const recv = m[1];
         if (!respNames.has(recv))
             continue;