circle-ir 4.13.2 → 4.14.1

package/dist/browser/circle-ir.js

@@ -6184,6 +6184,13 @@ function csharpBareName(node) {
   }
   return getNodeText(node);
 }
+function csharpCreatedSimpleType(creation) {
+  const typeNode = creation.childForFieldName("type");
+  if (!typeNode) return null;
+  const bare = csharpBareName(typeNode).replace(/<[^>]*>/g, "");
+  const simple = bare.split(".").pop()?.trim() ?? "";
+  return simple && simple !== "var" ? simple : null;
+}
 function extractCSharpCalls(tree, cache) {
   const calls = [];
   const typeMap = buildCSharpReceiverTypeMap(tree, cache);
@@ -6192,11 +6199,15 @@ function extractCSharpCalls(tree, cache) {
     const fn = inv.childForFieldName("function");
     let methodName = "unknown";
     let receiver = null;
+    let receiverTypeFromCreation = null;
     if (fn?.type === "member_access_expression") {
       const nameNode = fn.childForFieldName("name");
       const exprNode = fn.childForFieldName("expression");
       methodName = nameNode ? csharpBareName(nameNode) : "unknown";
       receiver = exprNode ? getNodeText(exprNode) : null;
+      if (exprNode?.type === "object_creation_expression") {
+        receiverTypeFromCreation = csharpCreatedSimpleType(exprNode);
+      }
     } else if (fn) {
       methodName = csharpBareName(fn);
     }
@@ -6214,7 +6225,7 @@ function extractCSharpCalls(tree, cache) {
     calls.push({
       method_name: methodName,
       receiver,
-      receiver_type: receiver ? typeMap.get(receiver) ?? null : null,
+      receiver_type: receiverTypeFromCreation ?? (receiver ? typeMap.get(receiver) ?? null : null),
       receiver_type_fqn: null,
       arguments: args2,
       location: { line: inv.startPosition.row + 1, column: inv.startPosition.column },
@@ -10185,6 +10196,36 @@ function extractFieldDefs(body2, startId) {
 function extractJSParameterDefs(params, startId) {
   const defs = [];
   let id = startId;
+  const addPatternDefs = (patternNode, line) => {
+    if (patternNode.type === "identifier" || patternNode.type === "shorthand_property_identifier_pattern") {
+      defs.push({
+        id: id++,
+        variable: getNodeText(patternNode),
+        line,
+        kind: "param"
+      });
+      return;
+    }
+    if (patternNode.type === "rest_pattern" || patternNode.type === "rest_element") {
+      const nameNode = patternNode.namedChildCount > 0 ? patternNode.namedChild(0) : null;
+      if (!nameNode) return;
+      addPatternDefs(nameNode, line);
+      return;
+    }
+    if (patternNode.type === "assignment_pattern") {
+      const leftNode = patternNode.childForFieldName("left");
+      if (leftNode) addPatternDefs(leftNode, line);
+      return;
+    }
+    if (patternNode.type === "object_pattern" || patternNode.type === "array_pattern") {
+      const destructDefs = extractDestructuringDefs(patternNode, id);
+      for (const def of destructDefs) {
+        def.kind = "param";
+        defs.push(def);
+        id++;
+      }
+    }
+  };
   for (let i2 = 0; i2 < params.childCount; i2++) {
     const param = params.child(i2);
     if (!param) continue;
@@ -10232,14 +10273,7 @@ function extractJSParameterDefs(params, startId) {
       }
     } else if (param.type === "required_parameter" || param.type === "optional_parameter") {
       const patternNode = param.childForFieldName("pattern");
-      if (patternNode && patternNode.type === "identifier") {
-        defs.push({
-          id: id++,
-          variable: getNodeText(patternNode),
-          line: param.startPosition.row + 1,
-          kind: "param"
-        });
-      }
+      if (patternNode) addPatternDefs(patternNode, param.startPosition.row + 1);
     }
   }
   return defs;
@@ -11995,6 +12029,9 @@ var DEFAULT_SOURCES = [
   // entry.getName() returns a path that may contain ../ — flowing into File()/FileOutputStream()
   // is a classic Zip-Slip vulnerability.
   { method: "getName", class: "ZipEntry", type: "file_input", severity: "high", return_tainted: true },
+  // JarEntry extends ZipEntry. A declared JarEntry does not match the ZipEntry
+  // row, and a receiver not named `entry` misses the name heuristic. cognium-dev#620.
+  { method: "getName", class: "JarEntry", type: "file_input", severity: "high", return_tainted: true },
   { method: "getName", class: "ZipArchiveEntry", type: "file_input", severity: "high", return_tainted: true },
   { method: "getName", class: "TarArchiveEntry", type: "file_input", severity: "high", return_tainted: true },
   { method: "getName", class: "ArchiveEntry", type: "file_input", severity: "high", return_tainted: true },
@@ -12751,8 +12788,10 @@ var DEFAULT_SINKS = [
   { method: "checkout", class: "SCM", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "retrieve", class: "LibraryAdder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "add", class: "LibraryAdder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
-  // Jenkins CPS Flow Execution (constructor)
-  { method: "CpsFlowExecution", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // Jenkins CPS compiles the script argument. That is code injection (CWE-94),
+  // the same class as GroovyShell.evaluate. Registered as command_injection it
+  // was dropped by the CWE-78 constructor allowlist (#129). cognium-dev#619.
+  { method: "CpsFlowExecution", class: "constructor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "CpsFlowDefinition", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "FlowExecution", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   // ActiveMQ control commands
@@ -15750,7 +15789,8 @@ function findSources(calls, types, patterns, sourceLines, language) {
       if (skipMethods.includes(method.name)) continue;
       for (const param of method.parameters) {
         const hasCSharpBindingAttr = language === "csharp" && param.annotations.some((a) => CSHARP_BINDING_ATTRS.has(a));
-        const isTaintable = hasCSharpBindingAttr ? true : param.type ? isInterproceduralTaintableType(param.type, language) : true;
+        const isDestructureBinding = param.name.startsWith("{") || param.name.startsWith("[");
+        const isTaintable = hasCSharpBindingAttr ? true : isDestructureBinding ? true : param.type ? isInterproceduralTaintableType(param.type, language) : true;
         if (isTaintable) {
           const paramLine = param.line ?? method.start_line;
           sources.push({
@@ -15980,12 +16020,14 @@ function isInterproceduralTaintableType(typeName, language) {
 }
 function isParameterizedQueryCall(call, pattern) {
   if (pattern.type !== "sql_injection") return false;
-  const queryArg = call.arguments.find((a) => a.position === 0);
+  const queryPos = pattern.arg_positions.length > 0 ? Math.min(...pattern.arg_positions) : 0;
+  const queryArg = call.arguments.find((a) => a.position === queryPos);
   if (queryArg) {
     const queryText = queryArg.literal ?? queryArg.expression ?? "";
     const hasPlaceholders = /(\?(?:\s|,|$|\))|\$\d+|:\w+|%s)/.test(queryText);
     const hasConcatenation = /\+\s*[^+]/.test(queryText) || queryText.includes("${");
-    if (hasPlaceholders && !hasConcatenation && call.arguments.length >= 2) {
+    const hasBoundArg = queryPos === 0 ? call.arguments.length >= 2 : call.arguments.some((a) => a.position > queryPos);
+    if (hasPlaceholders && !hasConcatenation && hasBoundArg) {
       return true;
     }
   }
@@ -16635,6 +16677,14 @@ function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   }
   return false;
 }
+function isArgumentlessJsResponseWriter(call, pattern, language) {
+  if (pattern.type !== "xss" || pattern.class !== "Response") return false;
+  if (language !== "javascript" && language !== "typescript") return false;
+  const positions = pattern.arg_positions;
+  if (!positions || positions.length === 0) return false;
+  const argc = call.arguments?.length ?? 0;
+  return positions.every((pos) => pos >= argc);
+}
 function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types) {
   const patternsForLanguage = language === void 0 ? patterns : patterns.filter((p) => sinkPatternAppliesTo(p, language));
   const sinkMap = /* @__PURE__ */ new Map();
@@ -16695,6 +16745,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
             continue;
           }
         }
+        if (isArgumentlessJsResponseWriter(call, pattern, language)) {
+          continue;
+        }
         if ((pattern.type === "command_injection" || pattern.type === "sql_injection") && call.method_name === "exec" && (language === "javascript" || language === "typescript") && isRegexReceiver(call.receiver, sourceLines)) {
           continue;
         }
@@ -19226,6 +19279,9 @@ function buildSanitizersByLine(sanitizers) {
   }
   return out2;
 }
+function concatOutsideStrings(expression) {
+  return expression.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'/g, " ").includes("+");
+}
 function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanitizers, sanitizersArg) {
   let graph;
   let sources;
@@ -19257,6 +19313,7 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
   }
   const taintedVars = [];
   const flows = [];
+  const javaConcat = graph.ir.meta.language === "java";
   const reachableSinks = /* @__PURE__ */ new Map();
   const defsByLine = graph.defsByLine;
   const usesByLine = graph.usesByLine;
@@ -19293,12 +19350,14 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
             continue;
           }
         }
-        const candidateUses = arg.variable ? usesAtSink.filter((u) => u.variable === arg.variable) : usesAtSink;
+        const expr = typeof arg.expression === "string" ? arg.expression : "";
+        const compoundConcat = javaConcat && !!arg.variable && expr !== arg.variable && concatOutsideStrings(expr);
+        const candidateUses = arg.variable && !compoundConcat ? usesAtSink.filter((u) => u.variable === arg.variable) : usesAtSink;
         {
           for (const use of candidateUses) {
             if (use.def_id !== null) {
               if (allTaintedDefIds.has(use.def_id)) {
-                if (!arg.variable) {
+                if (!arg.variable || compoundConcat) {
                   if (typeof arg.expression !== "string" || arg.expression.length === 0) continue;
                   const re = new RegExp(`(?:^|[^A-Za-z0-9_$])${use.variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[^A-Za-z0-9_$]|$)`);
                   if (!re.test(arg.expression)) continue;
@@ -19961,6 +20020,8 @@ function analyzeInterprocedural(graphOrTypes, callsOrSources, dfgOrSinks, source
     "QueryRowContext",
     "Exec",
     "ExecContext",
+    "Prepare",
+    "PrepareContext",
     // Go html/template escape helpers — explicit safe utilities.
     // Belt-and-suspenders with the sanitizer config so external_taint_escape
     // is suppressed regardless of class-prefix matching. (cognium-dev #102 FP-27)
@@ -26230,6 +26291,16 @@ var VuePlugin = class extends BaseLanguagePlugin {
 };
 
 // src/languages/plugins/go.ts
+function sqlSinks(cls, methods) {
+  return methods.map(([method, argPositions]) => ({
+    method,
+    class: cls,
+    type: "sql_injection",
+    cwe: "CWE-89",
+    severity: "critical",
+    argPositions
+  }));
+}
 var GoPlugin = class extends BaseLanguagePlugin {
   id = "go";
   name = "Go";
@@ -26451,6 +26522,35 @@ var GoPlugin = class extends BaseLanguagePlugin {
         severity: "critical",
         argPositions: [0]
       },
+      // database/sql context and transaction forms (#583). The query is
+      // argument 0 for the plain forms and argument 1 for the *Context
+      // forms (argument 0 is the context). Conn is the same shape as DB.
+      ...sqlSinks("DB", [
+        ["QueryContext", [1]],
+        ["QueryRowContext", [1]],
+        ["ExecContext", [1]],
+        ["Prepare", [0]],
+        ["PrepareContext", [1]]
+      ]),
+      ...sqlSinks("Tx", [
+        ["Exec", [0]],
+        ["QueryRow", [0]],
+        ["QueryContext", [1]],
+        ["QueryRowContext", [1]],
+        ["ExecContext", [1]],
+        ["Prepare", [0]],
+        ["PrepareContext", [1]]
+      ]),
+      ...sqlSinks("Conn", [
+        ["Query", [0]],
+        ["QueryRow", [0]],
+        ["Exec", [0]],
+        ["QueryContext", [1]],
+        ["QueryRowContext", [1]],
+        ["ExecContext", [1]],
+        ["Prepare", [0]],
+        ["PrepareContext", [1]]
+      ]),
       // Command Injection — argPositions intentionally empty so all variadic
       // positions are scanned. `exec.Command("sh", "-c", taintedCmd)` puts the
       // injection at arg[2]; `exec.Command(taintedName, args...)` puts it at
@@ -37274,6 +37374,20 @@ function evaluateSimpleExpression(expr, symbols) {
   if (result !== null && !isNaN(result)) return String(Math.floor(result));
   return expr;
 }
+var ARGUMENT_IDENT_SKIP = /* @__PURE__ */ new Set(["new", "true", "false", "null", "this", "super"]);
+function isStringConcat(expression) {
+  return expression.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'/g, " ").includes("+");
+}
+function argumentIdentifiers(expression) {
+  const stripped = expression.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'/g, " ");
+  const found = stripped.match(/[A-Za-z_$][A-Za-z0-9_$]*/g) ?? [];
+  const out2 = [];
+  for (const id of found) {
+    if (ARGUMENT_IDENT_SKIP.has(id)) continue;
+    if (!out2.includes(id)) out2.push(id);
+  }
+  return out2;
+}
 function isStringLiteralExpression(expr) {
   const trimmed = expr.trim();
   if (trimmed.length < 2) return false;
@@ -37345,20 +37459,27 @@ function filterCleanVariableSinks(sinks, calls, taintedVars, symbols, dfg, sanit
         dangerousArgCount++;
         if (language === "bash" && arg.expression === call.method_name && !arg.variable && arg.literal == null) continue;
         if (arg.variable && !arg.expression?.includes("[")) {
-          const varName = arg.variable;
-          const scopedName = methodName ? `${methodName}:${varName}` : varName;
-          if (fieldNames.has(varName) && !isInSynchronizedBlock) {
-            allArgsAreClean = false;
-            continue;
-          }
-          if (sanitizedVars?.has(scopedName) || sanitizedVars?.has(varName)) continue;
-          if (taintedVars.has(scopedName) || taintedVars.has(varName)) {
-            allArgsAreClean = false;
-            continue;
+          const expr = arg.expression ?? "";
+          const concatNames = language === "java" && isStringConcat(expr) ? argumentIdentifiers(expr) : [];
+          const names = concatNames.length > 0 ? concatNames : [arg.variable];
+          let argClean = true;
+          for (const varName of names) {
+            const scopedName = methodName ? `${methodName}:${varName}` : varName;
+            if (fieldNames.has(varName) && !isInSynchronizedBlock) {
+              argClean = false;
+              break;
+            }
+            if (sanitizedVars?.has(scopedName) || sanitizedVars?.has(varName)) continue;
+            if (taintedVars.has(scopedName) || taintedVars.has(varName)) {
+              argClean = false;
+              break;
+            }
+            const symbolValue = symbols.get(scopedName) ?? symbols.get(varName);
+            if (symbolValue && symbolValue.type !== "unknown") continue;
+            argClean = false;
+            break;
           }
-          const symbolValue = symbols.get(scopedName) ?? symbols.get(varName);
-          if (symbolValue && symbolValue.type !== "unknown") continue;
-          allArgsAreClean = false;
+          if (!argClean) allArgsAreClean = false;
         } else {
           if (arg.literal != null) continue;
           if (arg.expression && !arg.variable && isStringLiteralExpression(arg.expression)) continue;
@@ -44259,7 +44380,7 @@ function isGeneratedFile(file) {
 var PROVIDER_PATTERNS = [
   {
     name: "AWS access key",
-    regex: /\bAKIA[0-9A-Z]{16}\b/,
+    regex: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/,
     severity: "critical",
     level: "error",
     fix: "Rotate the AWS access key immediately and move it to an environment variable or AWS Secrets Manager."
@@ -44334,6 +44455,22 @@ var PROVIDER_PATTERNS = [
     level: "warning",
     fix: "Publishable keys are not secret but should still not be checked in to back-end source files; verify front-end vs back-end context."
   },
+  // Test-mode secret and restricted keys still authorize the test account.
+  // Same length floor as the live forms. Severity is high, not critical (#576).
+  {
+    name: "Stripe test secret key",
+    regex: /\bsk_test_[A-Za-z0-9]{24,}\b/,
+    severity: "high",
+    level: "warning",
+    fix: "Rotate the Stripe test secret key in the Stripe Dashboard and load it from a secrets manager."
+  },
+  {
+    name: "Stripe test restricted key",
+    regex: /\brk_test_[A-Za-z0-9]{24,}\b/,
+    severity: "high",
+    level: "warning",
+    fix: "Rotate the Stripe test restricted key in the Stripe Dashboard and load it from a secrets manager."
+  },
   {
     name: "OpenAI API key",
     regex: /\bsk-[A-Za-z0-9]{48}\b/,
@@ -44633,7 +44770,7 @@ var ScanSecretsPass = class {
       for (const pattern of PROVIDER_PATTERNS) {
         const m = pattern.regex.exec(lineText);
         if (!m) continue;
-        if ((pattern.name === "Stripe live restricted key" || pattern.name === "GitLab personal access token") && PLACEHOLDER_RE.test(m[0])) {
+        if ((pattern.name === "Stripe live restricted key" || pattern.name === "Stripe test secret key" || pattern.name === "Stripe test restricted key" || pattern.name === "GitLab personal access token") && PLACEHOLDER_RE.test(m[0])) {
           continue;
         }
         if (pattern.name === "PEM private key" && !pemHasInlineBody(lines, i2)) {
@@ -49402,6 +49539,22 @@ function longestLineLength(code) {
   return max;
 }
 var MAX_ANALYZABLE_LINE_LENGTH = 1e4;
+function neutralizeOverlongLines(code) {
+  if (longestLineLength(code) <= MAX_ANALYZABLE_LINE_LENGTH) {
+    return { code, dropped: 0 };
+  }
+  let out2 = "";
+  let start2 = 0;
+  let dropped = 0;
+  for (let i2 = 0; i2 <= code.length; i2++) {
+    if (i2 !== code.length && code.charCodeAt(i2) !== 10) continue;
+    if (i2 - start2 > MAX_ANALYZABLE_LINE_LENGTH) dropped++;
+    else if (i2 > start2) out2 += code.slice(start2, i2);
+    if (i2 < code.length) out2 += "\n";
+    start2 = i2 + 1;
+  }
+  return { code: out2, dropped };
+}
 async function analyze(code, filePath, language, options = {}) {
   if (!initialized) {
     await initAnalyzer(options);
@@ -49420,6 +49573,15 @@ async function analyze(code, filePath, language, options = {}) {
       parseGrammar = "tsx";
     }
   }
+  const neutralized = neutralizeOverlongLines(code);
+  if (neutralized.dropped > 0) {
+    logger.warn("Neutralized over-long lines before analysis", {
+      filePath,
+      language,
+      droppedLines: neutralized.dropped
+    });
+    code = neutralized.code;
+  }
   logger.debug("Analyzing file", { filePath, language, parseGrammar, codeLength: code.length });
   const phaseTimingEnabled = globalThis.__circleIrPassTiming === true;
   const phaseStart = () => phaseTimingEnabled ? Date.now() : 0;

package/dist/core/circle-ir-core.cjs

@@ -6230,6 +6230,13 @@ function csharpBareName(node) {
   }
   return getNodeText(node);
 }
+function csharpCreatedSimpleType(creation) {
+  const typeNode = creation.childForFieldName("type");
+  if (!typeNode) return null;
+  const bare = csharpBareName(typeNode).replace(/<[^>]*>/g, "");
+  const simple = bare.split(".").pop()?.trim() ?? "";
+  return simple && simple !== "var" ? simple : null;
+}
 function extractCSharpCalls(tree, cache) {
   const calls = [];
   const typeMap = buildCSharpReceiverTypeMap(tree, cache);
@@ -6238,11 +6245,15 @@ function extractCSharpCalls(tree, cache) {
     const fn = inv.childForFieldName("function");
     let methodName = "unknown";
     let receiver = null;
+    let receiverTypeFromCreation = null;
     if (fn?.type === "member_access_expression") {
       const nameNode = fn.childForFieldName("name");
       const exprNode = fn.childForFieldName("expression");
       methodName = nameNode ? csharpBareName(nameNode) : "unknown";
       receiver = exprNode ? getNodeText(exprNode) : null;
+      if (exprNode?.type === "object_creation_expression") {
+        receiverTypeFromCreation = csharpCreatedSimpleType(exprNode);
+      }
     } else if (fn) {
       methodName = csharpBareName(fn);
     }
@@ -6260,7 +6271,7 @@ function extractCSharpCalls(tree, cache) {
     calls.push({
       method_name: methodName,
       receiver,
-      receiver_type: receiver ? typeMap.get(receiver) ?? null : null,
+      receiver_type: receiverTypeFromCreation ?? (receiver ? typeMap.get(receiver) ?? null : null),
       receiver_type_fqn: null,
       arguments: args2,
       location: { line: inv.startPosition.row + 1, column: inv.startPosition.column },
@@ -10231,6 +10242,36 @@ function extractFieldDefs(body2, startId) {
 function extractJSParameterDefs(params, startId) {
   const defs = [];
   let id = startId;
+  const addPatternDefs = (patternNode, line) => {
+    if (patternNode.type === "identifier" || patternNode.type === "shorthand_property_identifier_pattern") {
+      defs.push({
+        id: id++,
+        variable: getNodeText(patternNode),
+        line,
+        kind: "param"
+      });
+      return;
+    }
+    if (patternNode.type === "rest_pattern" || patternNode.type === "rest_element") {
+      const nameNode = patternNode.namedChildCount > 0 ? patternNode.namedChild(0) : null;
+      if (!nameNode) return;
+      addPatternDefs(nameNode, line);
+      return;
+    }
+    if (patternNode.type === "assignment_pattern") {
+      const leftNode = patternNode.childForFieldName("left");
+      if (leftNode) addPatternDefs(leftNode, line);
+      return;
+    }
+    if (patternNode.type === "object_pattern" || patternNode.type === "array_pattern") {
+      const destructDefs = extractDestructuringDefs(patternNode, id);
+      for (const def of destructDefs) {
+        def.kind = "param";
+        defs.push(def);
+        id++;
+      }
+    }
+  };
   for (let i2 = 0; i2 < params.childCount; i2++) {
     const param = params.child(i2);
     if (!param) continue;
@@ -10278,14 +10319,7 @@ function extractJSParameterDefs(params, startId) {
       }
     } else if (param.type === "required_parameter" || param.type === "optional_parameter") {
       const patternNode = param.childForFieldName("pattern");
-      if (patternNode && patternNode.type === "identifier") {
-        defs.push({
-          id: id++,
-          variable: getNodeText(patternNode),
-          line: param.startPosition.row + 1,
-          kind: "param"
-        });
-      }
+      if (patternNode) addPatternDefs(patternNode, param.startPosition.row + 1);
     }
   }
   return defs;
@@ -11414,6 +11448,9 @@ var DEFAULT_SOURCES = [
   // entry.getName() returns a path that may contain ../ — flowing into File()/FileOutputStream()
   // is a classic Zip-Slip vulnerability.
   { method: "getName", class: "ZipEntry", type: "file_input", severity: "high", return_tainted: true },
+  // JarEntry extends ZipEntry. A declared JarEntry does not match the ZipEntry
+  // row, and a receiver not named `entry` misses the name heuristic. cognium-dev#620.
+  { method: "getName", class: "JarEntry", type: "file_input", severity: "high", return_tainted: true },
   { method: "getName", class: "ZipArchiveEntry", type: "file_input", severity: "high", return_tainted: true },
   { method: "getName", class: "TarArchiveEntry", type: "file_input", severity: "high", return_tainted: true },
   { method: "getName", class: "ArchiveEntry", type: "file_input", severity: "high", return_tainted: true },
@@ -12170,8 +12207,10 @@ var DEFAULT_SINKS = [
   { method: "checkout", class: "SCM", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "retrieve", class: "LibraryAdder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "add", class: "LibraryAdder", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
-  // Jenkins CPS Flow Execution (constructor)
-  { method: "CpsFlowExecution", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
+  // Jenkins CPS compiles the script argument. That is code injection (CWE-94),
+  // the same class as GroovyShell.evaluate. Registered as command_injection it
+  // was dropped by the CWE-78 constructor allowlist (#129). cognium-dev#619.
+  { method: "CpsFlowExecution", class: "constructor", type: "code_injection", cwe: "CWE-94", severity: "critical", arg_positions: [0] },
   { method: "CpsFlowDefinition", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   { method: "FlowExecution", class: "constructor", type: "command_injection", cwe: "CWE-78", severity: "critical", arg_positions: [0] },
   // ActiveMQ control commands
@@ -15050,7 +15089,8 @@ function findSources(calls, types, patterns, sourceLines, language) {
       if (skipMethods.includes(method.name)) continue;
       for (const param of method.parameters) {
         const hasCSharpBindingAttr = language === "csharp" && param.annotations.some((a) => CSHARP_BINDING_ATTRS.has(a));
-        const isTaintable = hasCSharpBindingAttr ? true : param.type ? isInterproceduralTaintableType(param.type, language) : true;
+        const isDestructureBinding = param.name.startsWith("{") || param.name.startsWith("[");
+        const isTaintable = hasCSharpBindingAttr ? true : isDestructureBinding ? true : param.type ? isInterproceduralTaintableType(param.type, language) : true;
         if (isTaintable) {
           const paramLine = param.line ?? method.start_line;
           sources.push({
@@ -15280,12 +15320,14 @@ function isInterproceduralTaintableType(typeName, language) {
 }
 function isParameterizedQueryCall(call, pattern) {
   if (pattern.type !== "sql_injection") return false;
-  const queryArg = call.arguments.find((a) => a.position === 0);
+  const queryPos = pattern.arg_positions.length > 0 ? Math.min(...pattern.arg_positions) : 0;
+  const queryArg = call.arguments.find((a) => a.position === queryPos);
   if (queryArg) {
     const queryText = queryArg.literal ?? queryArg.expression ?? "";
     const hasPlaceholders = /(\?(?:\s|,|$|\))|\$\d+|:\w+|%s)/.test(queryText);
     const hasConcatenation = /\+\s*[^+]/.test(queryText) || queryText.includes("${");
-    if (hasPlaceholders && !hasConcatenation && call.arguments.length >= 2) {
+    const hasBoundArg = queryPos === 0 ? call.arguments.length >= 2 : call.arguments.some((a) => a.position > queryPos);
+    if (hasPlaceholders && !hasConcatenation && hasBoundArg) {
       return true;
     }
   }
@@ -15935,6 +15977,14 @@ function isSafeJinjaRenderCall(call, pattern, language, sourceLines) {
   }
   return false;
 }
+function isArgumentlessJsResponseWriter(call, pattern, language) {
+  if (pattern.type !== "xss" || pattern.class !== "Response") return false;
+  if (language !== "javascript" && language !== "typescript") return false;
+  const positions = pattern.arg_positions;
+  if (!positions || positions.length === 0) return false;
+  const argc = call.arguments?.length ?? 0;
+  return positions.every((pos) => pos >= argc);
+}
 function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types) {
   const patternsForLanguage = language === void 0 ? patterns : patterns.filter((p) => sinkPatternAppliesTo(p, language));
   const sinkMap = /* @__PURE__ */ new Map();
@@ -15995,6 +16045,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
             continue;
           }
         }
+        if (isArgumentlessJsResponseWriter(call, pattern, language)) {
+          continue;
+        }
         if ((pattern.type === "command_injection" || pattern.type === "sql_injection") && call.method_name === "exec" && (language === "javascript" || language === "typescript") && isRegexReceiver(call.receiver, sourceLines)) {
           continue;
         }
@@ -17191,6 +17244,9 @@ function buildSanitizersByLine(sanitizers) {
   }
   return out2;
 }
+function concatOutsideStrings(expression) {
+  return expression.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'/g, " ").includes("+");
+}
 function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanitizers, sanitizersArg) {
   let graph;
   let sources;
@@ -17222,6 +17278,7 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
   }
   const taintedVars = [];
   const flows = [];
+  const javaConcat = graph.ir.meta.language === "java";
   const reachableSinks = /* @__PURE__ */ new Map();
   const defsByLine = graph.defsByLine;
   const usesByLine = graph.usesByLine;
@@ -17258,12 +17315,14 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
             continue;
           }
         }
-        const candidateUses = arg.variable ? usesAtSink.filter((u) => u.variable === arg.variable) : usesAtSink;
+        const expr = typeof arg.expression === "string" ? arg.expression : "";
+        const compoundConcat = javaConcat && !!arg.variable && expr !== arg.variable && concatOutsideStrings(expr);
+        const candidateUses = arg.variable && !compoundConcat ? usesAtSink.filter((u) => u.variable === arg.variable) : usesAtSink;
         {
           for (const use of candidateUses) {
             if (use.def_id !== null) {
               if (allTaintedDefIds.has(use.def_id)) {
-                if (!arg.variable) {
+                if (!arg.variable || compoundConcat) {
                   if (typeof arg.expression !== "string" || arg.expression.length === 0) continue;
                   const re = new RegExp(`(?:^|[^A-Za-z0-9_$])${use.variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[^A-Za-z0-9_$]|$)`);
                   if (!re.test(arg.expression)) continue;