circle-ir 4.12.0 → 4.13.1

package/dist/analysis/passes/taint-propagation-pass.js

@@ -40,7 +40,7 @@ import { sanitizerCoversSink } from '../sanitizer-index.js';
  * code, resolved constant) are unaffected.
  */
 const CONTAINER_READ_SOURCES = new Set(['plugin_param', 'config_param']);
-function makeConstPropVeto(constProp, graph, sources, code) {
+function makeConstPropVeto(constProp, graph, sources, code, language) {
     const lines = typeof code === 'string' ? code.split('\n') : [];
     const selfReassign = new Map();
     const escape = (v) => v.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
@@ -78,6 +78,13 @@ function makeConstPropVeto(constProp, graph, sources, code) {
             return false;
         if (r.reason !== 'variable_not_tainted')
             return true;
+        // cognium-dev#579: const-prop has no C# source model, so its tainted set is
+        // empty for C# and "not tainted" there means "never looked", not "clean".
+        // It still records a plain reassignment (`s = q;`) as a tracked symbol,
+        // which vetoed every C# flow through one while `var s = q;` passed. Dead
+        // code and resolved constants (the reasons above) still apply.
+        if (language === 'csharp')
+            return false;
         const lo = Math.min(sourceLine, sinkLine);
         // Walk the reaching-def chain back from this step, stepping through
         // self-derived reassignments only. Reaching defs are per method, so a
@@ -130,7 +137,7 @@ export class TaintPropagationPass {
         const propagationResult = propagateTaint(graph, sources, sinks, sanitizers);
         // cognium-dev#328 — scoped exemption from const-prop's `variable_not_tainted`
         // veto for self-derived reassignment (`x = f(x)`, `x += y`), the #287 shape.
-        const isVetoed = makeConstPropVeto(constProp, graph, sources, ctx.code);
+        const isVetoed = makeConstPropVeto(constProp, graph, sources, ctx.code, ctx.language);
         // Filter flows: eliminate dead-code paths and constant-propagation FPs
         const verifiedFlows = propagationResult.flows.filter(flow => {
             if (constProp.unreachableLines.has(flow.sink.line))
@@ -1027,7 +1034,7 @@ function detectCollectionFlows(calls, sources, sinks, taintedVars, unreachableLi
                             // detectExpressionScanFlows. Suppress when the variable is
                             // demonstrably rewritten to a literal between source and sink.
                             if (typeof code === 'string' &&
-                                isReassignedToLiteralBetween(code, varName, source.line, sink.line)) {
+                                isReassignedToLiteralBetween(code, varName, source.line, sink.line, unreachableLines)) {
                                 continue;
                             }
                             flows.push({
@@ -1076,7 +1083,7 @@ function detectCollectionFlows(calls, sources, sinks, taintedVars, unreachableLi
                                         continue;
                                     }
                                     if (typeof code === 'string' &&
-                                        isReassignedToLiteralBetween(code, collectionVar, source.line, sink.line)) {
+                                        isReassignedToLiteralBetween(code, collectionVar, source.line, sink.line, unreachableLines)) {
                                         continue;
                                     }
                                     flows.push({
@@ -1199,7 +1206,7 @@ function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines
                         const exists = flows.some(f => f.source_line === paramSource.line && f.sink_line === sink.line && f.sink_type === sink.type);
                         if (!exists) {
                             if (typeof code === 'string' &&
-                                isReassignedToLiteralBetween(code, arg.variable, paramSource.line, sink.line)) {
+                                isReassignedToLiteralBetween(code, arg.variable, paramSource.line, sink.line, unreachableLines)) {
                                 continue;
                             }
                             // Note: DFG-flow filter handles sanitizer-guard suppression
@@ -1290,6 +1297,117 @@ function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines
 // whole file on every call — O(lines) per call, O(n²) across a large file
 // (cognium-ai#305). Within a single analysis all calls pass the same `code`
 // reference, so a 1-slot cache collapses the repeated splits to one.
+/**
+ * C# alias expansion that respects method boundaries (cognium-dev#548).
+ *
+ * `buildJavaTaintedVars` is file-wide and keyed by name, so a local `data`
+ * tainted in one method tainted every `data` in the file. Here a derivation
+ * `lhs = …tainted…` only counts inside the method where the tainted name lives.
+ * Taint crosses methods in exactly two ways, both real data flow:
+ *   - a class field: `dataBad = data;` in one method, `x = dataBad;` in another;
+ *   - a return value: `return data;` in `Source()`, `x = Source();` in a caller.
+ *
+ * Returns one entry per derived name. `carried` entries entered their method
+ * through a field read or a call, so their `line` (the derivation) is where
+ * the taint starts in that method; the others derive from a source in the
+ * same method.
+ */
+function csharpMethodScopedAliases(code, seeds, methods, fieldNames) {
+    const lines = code.split('\n');
+    const methodOf = (line) => {
+        let best = -1;
+        let span = Infinity;
+        methods.forEach((m, i) => {
+            if (line >= m.start_line && line <= m.end_line && m.end_line - m.start_line < span) {
+                best = i;
+                span = m.end_line - m.start_line;
+            }
+        });
+        return best;
+    };
+    const declRe = /^\s*(?:public|private|protected|internal|static|readonly|const|\s)*\s*(?:[A-Za-z_][\w.]*(?:\s*<[^>]*>)?(?:\s*\[\s*\])*\??)\s+([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+    const assignRe = /^\s*(?:this\s*\.\s*)?([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+    const returnRe = /^\s*return\s+(.+?);\s*$/;
+    const KEYWORDS = new Set(['return', 'throw', 'new', 'await', 'yield', 'else', 'case', 'using', 'var']);
+    const codeOf = (rhs) => rhs
+        .replace(/\$@?"(?:[^"\\]|\\.)*"/g, lit => ' ' + [...lit.matchAll(/\{([^}]*)\}/g)].map(x => x[1]).join(' ') + ' ')
+        .replace(/@?"(?:[^"\\]|\\.)*"/g, ' ')
+        .replace(/'(?:[^'\\]|\\.)'/g, ' ');
+    const local = new Map(); // method index -> tainted locals
+    const taintedFields = new Set();
+    const returnsTainted = new Set(); // method names
+    const localsOf = (m) => {
+        let set = local.get(m);
+        if (!set) {
+            set = new Set();
+            local.set(m, set);
+        }
+        return set;
+    };
+    for (const seed of seeds) {
+        const base = seed.variable.replace(/^this\./, '');
+        if (fieldNames.has(base))
+            taintedFields.add(base);
+        else
+            localsOf(methodOf(seed.line)).add(seed.variable);
+    }
+    const out = [];
+    let changed = true;
+    for (let guard = 0; changed && guard < lines.length + 2; guard++) {
+        changed = false;
+        for (let i = 0; i < lines.length; i++) {
+            let text = lines[i];
+            const trimmed = text.trimStart();
+            if (trimmed.startsWith('//') || trimmed.startsWith('*'))
+                continue;
+            // A statement wrapped over several lines (`string q = "…" + user +` /
+            // `"…" + pass;`) is one assignment: join it up to its `;` so the names
+            // on the continuation lines count (cognium-dev#513).
+            if (/^\s*(?:[\w.<>\[\]?]+\s+)?[A-Za-z_]\w*\s*=(?!=)/.test(text) && !/;\s*(?:\/\/.*)?$/.test(text)) {
+                for (let j = i + 1; j < lines.length && j <= i + 12; j++) {
+                    // trimEnd: a CRLF file leaves `\r` on each line, which `.` will not cross.
+                    text = text.trimEnd() + ' ' + lines[j].trim();
+                    if (/;\s*(?:\/\/.*)?$/.test(lines[j]))
+                        break;
+                }
+            }
+            const m = methodOf(i + 1);
+            const here = localsOf(m);
+            const ret = returnRe.exec(text);
+            if (ret && m !== -1 && !returnsTainted.has(methods[m].name)) {
+                const idents = codeOf(ret[1]).match(/[\p{L}\p{N}_]+/gu) ?? [];
+                if (idents.some(t => here.has(t) || taintedFields.has(t))) {
+                    returnsTainted.add(methods[m].name);
+                    changed = true;
+                }
+                continue;
+            }
+            const d = declRe.exec(text) ?? assignRe.exec(text);
+            if (!d)
+                continue;
+            const [, lhs, rhs] = d;
+            if (KEYWORDS.has(lhs))
+                continue;
+            const isField = fieldNames.has(lhs) && !declRe.test(text);
+            if (isField ? taintedFields.has(lhs) : here.has(lhs))
+                continue;
+            const rhsCode = codeOf(rhs);
+            const idents = rhsCode.match(/[\p{L}\p{N}_]+/gu) ?? [];
+            const viaLocal = idents.some(t => here.has(t));
+            const viaField = idents.some(t => taintedFields.has(t) && !here.has(t));
+            const viaCall = [...rhsCode.matchAll(/([\p{L}_][\p{L}\p{N}_]*)\s*\(/gu)].some(c => returnsTainted.has(c[1]));
+            if (!viaLocal && !viaField && !viaCall)
+                continue;
+            if (isField)
+                taintedFields.add(lhs);
+            else
+                here.add(lhs);
+            out.push({ variable: lhs, line: i + 1, carried: !viaLocal });
+            changed = true;
+        }
+    }
+    return out;
+}
 let _reassignSplitCode;
 let _reassignSplitLines;
 function splitLinesCached(code) {
@@ -1299,7 +1417,7 @@ function splitLinesCached(code) {
     _reassignSplitLines = code.split('\n');
     return _reassignSplitLines;
 }
-function isReassignedToLiteralBetween(code, variable, srcLine, sinkLine) {
+function isReassignedToLiteralBetween(code, variable, srcLine, sinkLine, unreachableLines) {
     if (!variable || sinkLine - srcLine < 2)
         return false;
     // Bare identifiers only — attribute paths like `obj.attr` are not
@@ -1340,56 +1458,145 @@ function isReassignedToLiteralBetween(code, variable, srcLine, sinkLine) {
         // A literal assigned in one case of a switch only overwrites the value
         // when no case gives the variable anything else. `case 'A': bar = param;`
         // next to `default: bar = "safe";` leaves `bar` tainted on the 'A' path.
-        if (switchAlsoAssignsNonLiteral(lines, i, variable, strLit))
+        if (siblingBranchAssignsNonLiteral(lines, i, variable, strLit, unreachableLines))
             continue;
         return true;
     }
     return false;
 }
-/**
- * True when line `idx` sits inside a `switch` block in which some line
- * assigns `variable` a value that is not a string literal. Brace counting on
- * raw text: good enough for the brace-delimited switch bodies of Java, JS/TS
- * and Go, and it answers false (keeping the literal as an overwrite) whenever
- * no enclosing switch is found.
- */
-function switchAlsoAssignsNonLiteral(lines, idx, variable, strLit) {
+/** The `{` that encloses position `(line, col)`, with the statement that opens it. */
+function enclosingBrace(lines, line, col) {
     let depth = 0;
-    let start = -1;
-    for (let i = idx; i >= 0; i--) {
-        const line = lines[i];
-        for (let c = line.length - 1; c >= 0; c--) {
-            if (line[c] === '}')
+    for (let i = line; i >= 0; i--) {
+        const text = lines[i];
+        for (let c = i === line ? Math.min(col, text.length) - 1 : text.length - 1; c >= 0; c--) {
+            if (text[c] === '}')
                 depth++;
-            else if (line[c] === '{')
+            else if (text[c] === '{') {
+                if (depth === 0) {
+                    // K&R: the statement precedes the brace on this line. Allman: the
+                    // brace stands alone and the statement is the line above it.
+                    let header = text.slice(0, c).trim();
+                    let headerLine = i;
+                    for (let h = i - 1; header === '' && h >= 0; h--) {
+                        header = lines[h].trim();
+                        headerLine = h;
+                    }
+                    return { line: i, col: c, header, headerLine };
+                }
                 depth--;
+            }
         }
-        if (depth < 0) {
-            if (/\bswitch\b/.test(line))
-                start = i;
-            break;
+    }
+    return null;
+}
+/** The `}` matching the `{` at `(line, col)`. */
+function matchingClose(lines, line, col) {
+    let depth = 0;
+    for (let i = line; i < lines.length; i++) {
+        const text = lines[i];
+        for (let c = i === line ? col : 0; c < text.length; c++) {
+            if (text[c] === '{')
+                depth++;
+            else if (text[c] === '}' && --depth === 0)
+                return { line: i, col: c };
         }
     }
-    if (start < 0)
+    return null;
+}
+/**
+ * True when line `idx` assigns `variable` in one arm of a `switch` or one
+ * branch of an `if`/`else` chain, and a sibling arm or branch assigns it a
+ * value that is not a string literal.
+ *
+ * A literal in one branch does not overwrite what a sibling branch assigned:
+ * `if (c) { data = input; } else { data = "foo"; }` leaves `data` tainted on
+ * one path, so the literal must not suppress the flow (cognium-dev#513, #582).
+ * A sibling assignment on a line constant propagation proved unreachable does
+ * not count, which keeps `if (false) { x = input; } else { x = "safe"; }` clean.
+ *
+ * Works on raw text by brace matching, for brace-delimited bodies in either
+ * brace style. It answers false, keeping the literal as an overwrite, when
+ * the line is not inside such a construct or a branch has no braces.
+ */
+function siblingBranchAssignsNonLiteral(lines, idx, variable, strLit, unreachableLines) {
+    let block = enclosingBrace(lines, idx, 0);
+    // A braced `case 6: { … }` arm: step out to the switch body.
+    if (block && /^(?:case\b.*|default\s*):$/.test(block.header)) {
+        block = enclosingBrace(lines, block.line, block.col);
+    }
+    if (!block)
         return false;
-    const assign = new RegExp(`(?:^|[^\\w.$])${variable}\\s*(?::?=)(?!=)\\s*(.*?)\\s*;?\\s*(?:break\\s*;?)?\\s*$`);
-    const literalOnly = new RegExp(`^${strLit}$`);
-    depth = 0;
-    for (let i = start; i < lines.length; i++) {
-        const line = lines[i];
-        if (i > start || line.includes('{')) {
-            const m = assign.exec(line);
-            if (m && m[1] && !literalOnly.test(m[1]))
-                return true;
+    let first = block.headerLine;
+    let last;
+    const end = matchingClose(lines, block.line, block.col);
+    if (!end)
+        return false;
+    last = end.line;
+    if (/\bswitch\b/.test(block.header)) {
+        // the whole switch body
+    }
+    else if (/^(?:\}\s*)?else\b/.test(block.header) || /^(?:\}\s*)?(?:else\s+)?if\s*\(/.test(block.header)) {
+        // Walk up through `else` / `else if` to the opening `if`.
+        let cur = block;
+        for (let guard = 0; guard < 64 && /^(?:\}\s*)?else\b/.test(cur.header); guard++) {
+            // The previous branch closes on the header line (`} else {`) or on the
+            // last non-blank line above it.
+            let closeLine = cur.headerLine;
+            let closeCol = lines[closeLine].indexOf('}');
+            if (closeCol === -1 || closeCol > lines[closeLine].search(/\belse\b/)) {
+                closeLine--;
+                while (closeLine >= 0 && lines[closeLine].trim() === '')
+                    closeLine--;
+                if (closeLine < 0 || !lines[closeLine].trimEnd().endsWith('}'))
+                    return false;
+                closeCol = lines[closeLine].lastIndexOf('}');
+            }
+            const prev = enclosingBrace(lines, closeLine, closeCol);
+            if (!prev)
+                return false;
+            cur = prev;
+            first = prev.headerLine;
         }
-        for (const ch of line) {
-            if (ch === '{')
-                depth++;
-            else if (ch === '}')
-                depth--;
+        // Walk down through following `else` branches.
+        let close = end;
+        for (let guard = 0; guard < 64; guard++) {
+            let l = close.line;
+            let rest = lines[l].slice(close.col + 1).trim();
+            while (rest === '' && l + 1 < lines.length) {
+                l++;
+                rest = lines[l].trim();
+            }
+            if (!/^else\b/.test(rest))
+                break;
+            let openLine = l;
+            let openCol = lines[l].indexOf('{', l === close.line ? close.col + 1 : 0);
+            if (openCol === -1) {
+                openLine = l + 1;
+                while (openLine < lines.length && lines[openLine].trim() === '')
+                    openLine++;
+                if (openLine >= lines.length || !lines[openLine].trimStart().startsWith('{'))
+                    break;
+                openCol = lines[openLine].indexOf('{');
+            }
+            const next = matchingClose(lines, openLine, openCol);
+            if (!next)
+                break;
+            close = next;
+            last = next.line;
         }
-        if (i > start && depth <= 0)
-            break;
+    }
+    else {
+        return false;
+    }
+    const assign = new RegExp(`(?:^|[^\\w.$])${variable}\\s*(?::?=)(?!=)\\s*(.*?)\\s*;?\\s*(?:break\\s*;?)?\\s*$`);
+    const literalOnly = new RegExp(`^${strLit}$`);
+    for (let i = first; i <= last; i++) {
+        if (i === idx || unreachableLines?.has(i + 1))
+            continue;
+        const m = assign.exec(lines[i]);
+        if (m && m[1] && !literalOnly.test(m[1]))
+            return true;
     }
     return false;
 }
@@ -1600,6 +1807,26 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
     // is every Juliet C# file.
     const csFnRanges = methodRanges(['csharp']);
     const csFnStart = (line) => enclosingStart(csFnRanges, line);
+    // cognium-dev#548 — names declared as class fields. A field is the one kind
+    // of variable whose value legitimately crosses from one method to another, so
+    // the per-method gate below must not apply to it.
+    const csFieldNames = new Set();
+    if (language === 'csharp') {
+        for (const t of types ?? [])
+            for (const f of t.fields ?? [])
+                csFieldNames.add(f.name);
+    }
+    /** True when a C# source and a later line can only be linked by a reused local name. */
+    const csDifferentMethod = (variable, sourceLine, otherLine) => {
+        if (csFnRanges.length === 0)
+            return false;
+        const a = csFnStart(sourceLine);
+        const b = csFnStart(otherLine);
+        if (a === -1 || b === -1 || a === b)
+            return false;
+        const base = variable.replace(/^this\./, '').split('.')[0];
+        return !csFieldNames.has(base);
+    };
     // Variable-name scan path: only consider sources that carry an explicit
     // variable name. The colocation path below (cognium-dev #83) runs even
     // when this set is empty, so we no longer early-return.
@@ -2000,7 +2227,39 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
     // the array literal defeats the sink-arg colocation heuristic. Seeds
     // with real source variables (HTTP source `arg` or the now-populated
     // interprocedural_param parameter name) and iterates to a fixpoint.
-    if ((language === 'java' || language === 'csharp') && typeof code === 'string' && sourcesWithVar.length > 0) {
+    if (language === 'csharp' && typeof code === 'string' && sourcesWithVar.length > 0 && csFnRanges.length > 0) {
+        // cognium-dev#548: derive aliases per method. A name tainted in one method
+        // says nothing about the same name in another; taint reaches another
+        // method only through a field or a return value.
+        const csMethods = (types ?? []).flatMap(t => t.methods);
+        const seeds = sourcesWithVar.map(sv => ({ variable: sv.variable, line: sv.line }));
+        const methodStartOf = (line) => csFnStart(line);
+        const aliases = csharpMethodScopedAliases(code, seeds, csMethods, csFieldNames);
+        const fileAnchor = sourcesWithVar.reduce((a, sv) => (sv.line < a.line ? sv : a), sourcesWithVar[0]);
+        const have = new Set(sourcesWithVar.map(sv => `${sv.variable}@${methodStartOf(sv.line)}`));
+        for (const alias of aliases) {
+            const fn = methodStartOf(alias.line);
+            const isField = csFieldNames.has(alias.variable);
+            const key = `${alias.variable}@${isField ? 'field' : fn}`;
+            if (have.has(key))
+                continue;
+            have.add(key);
+            // A same-method derivation reports the source it derives from. A carried
+            // one starts where the value enters this method (the field read or the
+            // call), which also keeps it ahead of a sink in a method declared
+            // earlier in the file than the method holding the source.
+            const inMethod = sourcesWithVar.filter(sv => methodStartOf(sv.line) === fn && sv.line <= alias.line);
+            const from = !alias.carried && inMethod.length > 0
+                ? inMethod.reduce((a, sv) => (sv.line < a.line ? sv : a), inMethod[0])
+                : fileAnchor;
+            sourcesWithVar.push({
+                ...from,
+                variable: alias.variable,
+                ...(alias.carried || inMethod.length === 0 ? { line: alias.line } : {}),
+            });
+        }
+    }
+    else if ((language === 'java' || language === 'csharp') && typeof code === 'string' && sourcesWithVar.length > 0) {
         const seedVars = new Set(sourcesWithVar.map(s => s.variable));
         const derived = buildJavaTaintedVars(code, seedVars);
         if (derived.size > 0) {
@@ -2065,23 +2324,31 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
     if (language === 'csharp' && typeof code === 'string' && sourcesWithVar.length > 0) {
         const lines = code.split('\n');
         const ctRe = /(\w+)\s*\.\s*CommandText\s*\+?=\s*(.+)/;
-        const anchor = sourcesWithVar.reduce((a, s) => (s.line < a.line ? s : a), sourcesWithVar[0]);
+        // cognium-dev#548: seed per method, from sources in that method. The seed
+        // used to be made once per file and matched by name, so `cmd.CommandText =
+        // … + data` in `Bad()` tainted `cmd.ExecuteScalar()` in `GoodG2B()`, whose
+        // own `data` is a constant: all 27 Juliet CWE-89 false positives. Once per
+        // file also meant a second vulnerable method reusing the name got no seed.
+        const seeded = new Set();
         let added = true;
         let guard = 0;
         while (added && guard < lines.length + 2) {
             added = false;
             guard++;
-            const known = new Set(sourcesWithVar.map(s => s.variable));
             for (let i = 0; i < lines.length; i++) {
                 const m = ctRe.exec(lines[i]);
                 if (!m)
                     continue;
                 const [, obj, rhs] = m;
-                if (known.has(obj))
+                const key = `${obj}@${csFnStart(i + 1)}`;
+                if (seeded.has(key))
                     continue;
-                if (!argsReferenceTaintedVar(rhs, sourcesWithVar))
+                const reachable = sourcesWithVar.filter(sv => sv.line <= i + 1 && !csDifferentMethod(sv.variable, sv.line, i + 1));
+                if (reachable.length === 0 || !argsReferenceTaintedVar(rhs, reachable))
                     continue;
-                sourcesWithVar.push({ ...anchor, variable: obj, line: i + 1 });
+                const from = reachable.reduce((a, sv) => (sv.line < a.line ? sv : a), reachable[0]);
+                sourcesWithVar.push({ ...from, variable: obj, line: i + 1 });
+                seeded.add(key);
                 added = true;
             }
         }
@@ -2123,18 +2390,21 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
             // way would be a guess.
             const appendRe = /([\p{L}_][\p{L}\p{N}_]*)\s*\.\s*(?:Append|AppendLine|AppendFormat|Insert)\s*\(([\s\S]*)/u;
             const anchor = sourcesWithVar.reduce((a, s) => (s.line < a.line ? s : a), sourcesWithVar[0]);
+            const builderSeeded = new Set();
             let added = true;
             let guard = 0;
             while (added && guard < lines.length + 2) {
                 added = false;
                 guard++;
-                const known = new Set(sourcesWithVar.map(s => s.variable));
                 for (let i = 0; i < lines.length; i++) {
                     const m = appendRe.exec(lines[i]);
                     if (!m)
                         continue;
                     const [, obj, args] = m;
-                    if (!builders.has(obj) || known.has(obj))
+                    // Keyed per method (#548): one seed per file skipped a second
+                    // method that appends tainted text to a builder of the same name.
+                    const seedKey = `${obj}@${csFnStart(i + 1)}`;
+                    if (!builders.has(obj) || builderSeeded.has(seedKey))
                         continue;
                     // Same-method gate. `sourcesWithVar` is file-wide, so without this a
                     // source named `data` in one method taints a builder appended to in
@@ -2146,6 +2416,7 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
                     if (reachable.length > 0 && argsReferenceTaintedVar(args, reachable)) {
                         sourcesWithVar.push({ ...anchor, variable: obj, line: i + 1 });
                         builderSeeds.add(`${obj}@${i + 1}`);
+                        builderSeeded.add(seedKey);
                         added = true;
                     }
                 }
@@ -2291,6 +2562,12 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
                         if (srcFn !== sinkFn)
                             continue;
                     }
+                    // cognium-dev#548: the same gate for every C# source. Two locals of
+                    // the same name in different methods are different variables; a
+                    // value that really crosses methods does so through a field
+                    // (exempt), a parameter or a return, never through a name match.
+                    if (csDifferentMethod(source.variable, source.line, sink.line))
+                        continue;
                     // Simple-identifier sources are already confirmed present by the
                     // token index; only complex (attribute-path) sources need the
                     // word-boundary regex to confirm they actually occur in the arg.
@@ -2327,7 +2604,7 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
                     // `if var not in ALLOWLIST: var = "lit"`), the original taint
                     // no longer reaches the sink — suppress the flow.
                     if (typeof code === 'string' &&
-                        isReassignedToLiteralBetween(code, source.variable, source.line, sink.line)) {
+                        isReassignedToLiteralBetween(code, source.variable, source.line, sink.line, unreachableLines)) {
                         break;
                     }
                     // Note: DFG-flow filter handles sanitizer-guard suppression