circle-ir 4.14.0 → 4.14.2

package/dist/browser/circle-ir.js

@@ -8034,6 +8034,17 @@ function extractGoCallInfo(node) {
       if (operand.type === "identifier") {
         const resolved = resolveGoLocalReceiverType(opText, node);
         receiver = resolved !== null ? resolved : opText;
+      } else if (operand.type === "selector_expression" && methodName === "Get") {
+        const fieldNode = operand.childForFieldName("field");
+        const inner = operand.childForFieldName("operand");
+        const fieldName = fieldNode ? getNodeText(fieldNode) : "";
+        const innerName = inner && inner.type === "identifier" ? getNodeText(inner) : null;
+        const innerType = innerName !== null ? resolveGoLocalReceiverType(innerName, node) : null;
+        if (innerType === "Request" && (fieldName === "PostForm" || fieldName === "Form")) {
+          receiver = fieldName === "PostForm" ? "RequestPostForm" : "RequestForm";
+        } else {
+          receiver = opText;
+        }
       } else {
         receiver = opText;
       }
@@ -10196,6 +10207,36 @@ function extractFieldDefs(body2, startId) {
 function extractJSParameterDefs(params, startId) {
   const defs = [];
   let id = startId;
+  const addPatternDefs = (patternNode, line) => {
+    if (patternNode.type === "identifier" || patternNode.type === "shorthand_property_identifier_pattern") {
+      defs.push({
+        id: id++,
+        variable: getNodeText(patternNode),
+        line,
+        kind: "param"
+      });
+      return;
+    }
+    if (patternNode.type === "rest_pattern" || patternNode.type === "rest_element") {
+      const nameNode = patternNode.namedChildCount > 0 ? patternNode.namedChild(0) : null;
+      if (!nameNode) return;
+      addPatternDefs(nameNode, line);
+      return;
+    }
+    if (patternNode.type === "assignment_pattern") {
+      const leftNode = patternNode.childForFieldName("left");
+      if (leftNode) addPatternDefs(leftNode, line);
+      return;
+    }
+    if (patternNode.type === "object_pattern" || patternNode.type === "array_pattern") {
+      const destructDefs = extractDestructuringDefs(patternNode, id);
+      for (const def of destructDefs) {
+        def.kind = "param";
+        defs.push(def);
+        id++;
+      }
+    }
+  };
   for (let i2 = 0; i2 < params.childCount; i2++) {
     const param = params.child(i2);
     if (!param) continue;
@@ -10243,14 +10284,7 @@ function extractJSParameterDefs(params, startId) {
       }
     } else if (param.type === "required_parameter" || param.type === "optional_parameter") {
       const patternNode = param.childForFieldName("pattern");
-      if (patternNode && patternNode.type === "identifier") {
-        defs.push({
-          id: id++,
-          variable: getNodeText(patternNode),
-          line: param.startPosition.row + 1,
-          kind: "param"
-        });
-      }
+      if (patternNode) addPatternDefs(patternNode, param.startPosition.row + 1);
     }
   }
   return defs;
@@ -13006,8 +13040,15 @@ var DEFAULT_SINKS = [
   { method: "setExpireTimeSeconds", class: "StaticFilesConfiguration", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
   { method: "configureJarCase", class: "StaticFilesConfiguration", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "toString", class: "StringUtils", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
-  // Wildfly/Undertow servlet resource manager
-  { method: "getResource", class: "ServletResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
+  // Wildfly/Undertow servlet resource manager.
+  // ResourceManager / PathResourceManager / FileResourceManager /
+  // ClassPathResourceManager are the interface and implementations WildFly
+  // calls through (cognium-dev#622, CVE-2018-1047). Class-qualified only.
+  { method: "getResource", class: "ServletResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "ResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "PathResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "FileResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "ClassPathResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
   // Yamcs file system bucket
   { method: "deleteObject", class: "FileSystemBucket", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   // RocketMQ validators
@@ -15766,7 +15807,8 @@ function findSources(calls, types, patterns, sourceLines, language) {
       if (skipMethods.includes(method.name)) continue;
       for (const param of method.parameters) {
         const hasCSharpBindingAttr = language === "csharp" && param.annotations.some((a) => CSHARP_BINDING_ATTRS.has(a));
-        const isTaintable = hasCSharpBindingAttr ? true : param.type ? isInterproceduralTaintableType(param.type, language) : true;
+        const isDestructureBinding = param.name.startsWith("{") || param.name.startsWith("[");
+        const isTaintable = hasCSharpBindingAttr ? true : isDestructureBinding ? true : param.type ? isInterproceduralTaintableType(param.type, language) : true;
         if (isTaintable) {
           const paramLine = param.line ?? method.start_line;
           sources.push({
@@ -15996,7 +16038,8 @@ function isInterproceduralTaintableType(typeName, language) {
 }
 function isParameterizedQueryCall(call, pattern) {
   if (pattern.type !== "sql_injection") return false;
-  const queryPos = pattern.arg_positions.length > 0 ? Math.min(...pattern.arg_positions) : 0;
+  const positions = pattern.arg_positions ?? [];
+  const queryPos = positions.length > 0 ? Math.min(...positions) : 0;
   const queryArg = call.arguments.find((a) => a.position === queryPos);
   if (queryArg) {
     const queryText = queryArg.literal ?? queryArg.expression ?? "";
@@ -19255,6 +19298,9 @@ function buildSanitizersByLine(sanitizers) {
   }
   return out2;
 }
+function concatOutsideStrings(expression) {
+  return expression.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'/g, " ").includes("+");
+}
 function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanitizers, sanitizersArg) {
   let graph;
   let sources;
@@ -19286,6 +19332,7 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
   }
   const taintedVars = [];
   const flows = [];
+  const javaConcat = graph.ir.meta.language === "java";
   const reachableSinks = /* @__PURE__ */ new Map();
   const defsByLine = graph.defsByLine;
   const usesByLine = graph.usesByLine;
@@ -19322,23 +19369,40 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
             continue;
           }
         }
-        const candidateUses = arg.variable ? usesAtSink.filter((u) => u.variable === arg.variable) : usesAtSink;
+        const expr = typeof arg.expression === "string" ? arg.expression : "";
+        const compoundConcat = javaConcat && !!arg.variable && expr !== arg.variable && concatOutsideStrings(expr);
+        const candidateUses = arg.variable && !compoundConcat ? usesAtSink.filter((u) => u.variable === arg.variable) : usesAtSink;
         {
           for (const use of candidateUses) {
             if (use.def_id !== null) {
               if (allTaintedDefIds.has(use.def_id)) {
-                if (!arg.variable) {
+                if (!arg.variable || compoundConcat) {
                   if (typeof arg.expression !== "string" || arg.expression.length === 0) continue;
                   const re = new RegExp(`(?:^|[^A-Za-z0-9_$])${use.variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[^A-Za-z0-9_$]|$)`);
                   if (!re.test(arg.expression)) continue;
                 }
                 const taintInfo = taintByDefId.get(use.def_id);
                 if (taintInfo) {
+                  let sanMap = sanitizersByLine;
+                  if (identifierOutsideSanitizerCalls(
+                    use.variable,
+                    callsAtSink,
+                    sanitizersByLine.get(sink.line) ?? [],
+                    sink.type
+                  )) {
+                    const stripped = new Map(sanitizersByLine);
+                    const kept = (sanitizersByLine.get(sink.line) ?? []).filter(
+                      (s) => !sanitizerCoversSink(s, sink.type)
+                    );
+                    if (kept.length === 0) stripped.delete(sink.line);
+                    else stripped.set(sink.line, kept);
+                    sanMap = stripped;
+                  }
                   const isSanitized = checkSanitized(
                     taintInfo.line,
                     sink.line,
                     sink.type,
-                    sanitizersByLine,
+                    sanMap,
                     {
                       startDefId: use.def_id,
                       chainsByToDef: graph.chainsByToDef,
@@ -19492,6 +19556,86 @@ var KNOWN_SINK_TYPES = /* @__PURE__ */ new Set([
   "crlf",
   "mass_assignment"
 ]);
+function readBalancedArg(text, openParen) {
+  let depth = 0;
+  let quote = null;
+  let escaped = false;
+  for (let i2 = openParen; i2 < text.length; i2++) {
+    const c = text[i2];
+    if (quote) {
+      if (escaped) {
+        escaped = false;
+        continue;
+      }
+      if (c === "\\") {
+        escaped = true;
+        continue;
+      }
+      if (c === quote) quote = null;
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      quote = c;
+      continue;
+    }
+    if (c === "(") depth++;
+    else if (c === ")") {
+      depth--;
+      if (depth === 0) return text.slice(openParen + 1, i2);
+    }
+  }
+  return null;
+}
+function sanitizerCallRefs(sanitizers, sinkType) {
+  const refs = [];
+  for (const san of sanitizers) {
+    if (!sanitizerCoversSink(san, sinkType)) continue;
+    const m = /(?:(\w+)\.)?(\w+)\(\)/.exec(san.method);
+    if (!m?.[2]) continue;
+    refs.push({ receiver: m[1], methodName: m[2] });
+  }
+  return refs;
+}
+function maskSanitizerCalls(expr, refs) {
+  let out2 = expr;
+  for (const ref of refs) {
+    const needles = ref.receiver ? [`${ref.receiver}.${ref.methodName}`, ref.methodName] : [ref.methodName];
+    for (const needle of needles) {
+      const re = new RegExp(`\\b${needle.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*\\(`);
+      for (let guard = 0; guard < 8; guard++) {
+        const m = re.exec(out2);
+        if (!m) break;
+        const open = m.index + m[0].length - 1;
+        const arg = readBalancedArg(out2, open);
+        if (arg === null) break;
+        out2 = out2.slice(0, m.index) + " " + out2.slice(open + arg.length + 2);
+      }
+    }
+  }
+  return out2;
+}
+function blankStringLiterals(expr) {
+  return expr.replace(/"(?:[^"\\]|\\.)*"/g, '""').replace(/'(?:[^'\\]|\\.)*'/g, "''");
+}
+function identifierOutsideSanitizerCalls(variable, calls, sanitizers, sinkType) {
+  if (!/^[A-Za-z_$][\w$]*$/.test(variable)) return false;
+  const refs = sanitizerCallRefs(sanitizers, sinkType);
+  if (refs.length === 0) return false;
+  const re = new RegExp(
+    `(?:^|[^A-Za-z0-9_$])${variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[^A-Za-z0-9_$]|$)`
+  );
+  for (const call of calls) {
+    if (refs.some((r) => r.methodName === call.method_name)) continue;
+    for (const arg of call.arguments) {
+      const expr = arg.expression ?? "";
+      if (!expr) continue;
+      const masked = maskSanitizerCalls(expr, refs);
+      if (masked === expr) continue;
+      if (re.test(blankStringLiterals(masked))) return true;
+    }
+  }
+  return false;
+}
 function checkSanitized(fromLine, toLine, sinkType, sanitizersByLine, ctx) {
   const isKnownSinkType = KNOWN_SINK_TYPES.has(sinkType);
   const sanitizersAtTarget = sanitizersByLine.get(toLine);
@@ -26397,6 +26541,25 @@ var GoPlugin = class extends BaseLanguagePlugin {
         confidence: 0.9,
         returnTainted: true
       },
+      // #492 — `r.PostForm.Get` / `r.Form.Get`. The extractor rewrites only
+      // those selectors on a declared `*http.Request` to these synthetic
+      // classes, so `url.Values.Get` stays unmatched.
+      {
+        method: "Get",
+        class: "RequestPostForm",
+        type: "http_body",
+        severity: "high",
+        confidence: 0.9,
+        returnTainted: true
+      },
+      {
+        method: "Get",
+        class: "RequestForm",
+        type: "http_param",
+        severity: "high",
+        confidence: 0.9,
+        returnTainted: true
+      },
       // Gin framework
       // NOTE: `Context.Query` (http_param) and `Context.Param` (http_path) are
       // registered identically in DEFAULT_SOURCES; the duplicates here emitted
@@ -28071,6 +28234,7 @@ var LanguageSourcesPass = class {
     additionalSources.push(...findGoMultipartUploadSources(code, language));
     additionalSources.push(...findGoGrpcRequestSources(code, language));
     additionalSources.push(...findGoRequestBodySources(code, language));
+    additionalSources.push(...findGoFormIndexSources(code, language));
     const jsDOMSinks = findJavaScriptDOMSinks(code, language);
     for (const s of jsDOMSinks) {
       const alreadyExists = additionalSinks.some((x) => x.line === s.line && x.cwe === s.cwe);
@@ -28908,6 +29072,42 @@ function findGoGrpcRequestSources(sourceCode, language) {
   }
   return sources;
 }
+function findGoFormIndexSources(sourceCode, language) {
+  if (language !== "go") return [];
+  if (!/\.(?:PostForm|Form|MultipartForm)\b/.test(sourceCode)) return [];
+  const lines = sourceCode.split("\n");
+  const reqNames = /* @__PURE__ */ new Set();
+  const paramRe = /([A-Za-z_]\w*)\s+\*http\.Request\b/g;
+  for (const line of lines) {
+    let m;
+    paramRe.lastIndex = 0;
+    while ((m = paramRe.exec(line)) !== null) reqNames.add(m[1]);
+  }
+  if (reqNames.size === 0) return [];
+  const alt = [...reqNames].map((n) => n.replace(/\$/g, "\\$")).join("|");
+  const indexRe = new RegExp(
+    `^\\s*(?:var\\s+)?([A-Za-z_]\\w*)\\s*(?:,\\s*\\w+\\s*)?:?=\\s*(?:${alt})\\s*\\.\\s*(?:(PostForm|Form)|MultipartForm\\s*\\.\\s*Value)\\s*\\[`
+  );
+  const sources = [];
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (/^\s*\/\//.test(line)) continue;
+    const m = indexRe.exec(line);
+    if (!m) continue;
+    const variable = m[1];
+    if (variable === "_" || variable === "") continue;
+    const kind = m[2];
+    sources.push({
+      type: kind === "Form" ? "http_param" : "http_body",
+      location: "HTTP request form index",
+      severity: "high",
+      line: i2 + 1,
+      confidence: 0.9,
+      variable
+    });
+  }
+  return sources;
+}
 function findGoRequestBodySources(sourceCode, language) {
   if (language !== "go") return [];
   if (!sourceCode.includes(".Body")) return [];
@@ -36330,7 +36530,7 @@ var SinkFilterPass = class {
       constProp.synchronizedLines,
       language
     );
-    filtered = filterSanitizedSinks(filtered, sanitizers, calls);
+    filtered = filterSanitizedSinks(filtered, sanitizers, calls, sources);
     if (language === "python") {
       const { pyTaintedVars, pySanitizedVars } = langSources;
       const sourceLines = ctx.code.split("\n");
@@ -36391,7 +36591,16 @@ var SinkFilterPass = class {
       filtered = filtered.filter((sink) => {
         if (sink.type !== "xss") return true;
         const sinkLineText = sourceLines[sink.line - 1] ?? "";
-        if (JS_XSS_SANITIZERS.some((p) => p.test(sinkLineText))) return false;
+        if (JS_XSS_SANITIZERS.some((p) => p.test(sinkLineText))) {
+          const callsAtSink = callsByLine.get(sink.line) ?? [];
+          const covering = sanitizers.filter(
+            (s) => s.line === sink.line && sanitizerCoversSink(s, sink.type)
+          );
+          const rawOperand = sources.some(
+            (s) => !!s.variable && identifierOutsideSanitizerCalls(s.variable, callsAtSink, covering, sink.type)
+          );
+          if (!rawOperand) return false;
+        }
         const assignmentMatch = sinkLineText.match(/\.(?:innerHTML|outerHTML)\s*=\s*(.+)/);
         if (assignmentMatch) {
           const rhs = assignmentMatch[1].trim().replace(/;$/, "").trim();
@@ -37344,6 +37553,20 @@ function evaluateSimpleExpression(expr, symbols) {
   if (result !== null && !isNaN(result)) return String(Math.floor(result));
   return expr;
 }
+var ARGUMENT_IDENT_SKIP = /* @__PURE__ */ new Set(["new", "true", "false", "null", "this", "super"]);
+function isStringConcat(expression) {
+  return expression.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'/g, " ").includes("+");
+}
+function argumentIdentifiers(expression) {
+  const stripped = expression.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'/g, " ");
+  const found = stripped.match(/[A-Za-z_$][A-Za-z0-9_$]*/g) ?? [];
+  const out2 = [];
+  for (const id of found) {
+    if (ARGUMENT_IDENT_SKIP.has(id)) continue;
+    if (!out2.includes(id)) out2.push(id);
+  }
+  return out2;
+}
 function isStringLiteralExpression(expr) {
   const trimmed = expr.trim();
   if (trimmed.length < 2) return false;
@@ -37415,20 +37638,27 @@ function filterCleanVariableSinks(sinks, calls, taintedVars, symbols, dfg, sanit
         dangerousArgCount++;
         if (language === "bash" && arg.expression === call.method_name && !arg.variable && arg.literal == null) continue;
         if (arg.variable && !arg.expression?.includes("[")) {
-          const varName = arg.variable;
-          const scopedName = methodName ? `${methodName}:${varName}` : varName;
-          if (fieldNames.has(varName) && !isInSynchronizedBlock) {
-            allArgsAreClean = false;
-            continue;
-          }
-          if (sanitizedVars?.has(scopedName) || sanitizedVars?.has(varName)) continue;
-          if (taintedVars.has(scopedName) || taintedVars.has(varName)) {
-            allArgsAreClean = false;
-            continue;
+          const expr = arg.expression ?? "";
+          const concatNames = language === "java" && isStringConcat(expr) ? argumentIdentifiers(expr) : [];
+          const names = concatNames.length > 0 ? concatNames : [arg.variable];
+          let argClean = true;
+          for (const varName of names) {
+            const scopedName = methodName ? `${methodName}:${varName}` : varName;
+            if (fieldNames.has(varName) && !isInSynchronizedBlock) {
+              argClean = false;
+              break;
+            }
+            if (sanitizedVars?.has(scopedName) || sanitizedVars?.has(varName)) continue;
+            if (taintedVars.has(scopedName) || taintedVars.has(varName)) {
+              argClean = false;
+              break;
+            }
+            const symbolValue = symbols.get(scopedName) ?? symbols.get(varName);
+            if (symbolValue && symbolValue.type !== "unknown") continue;
+            argClean = false;
+            break;
           }
-          const symbolValue = symbols.get(scopedName) ?? symbols.get(varName);
-          if (symbolValue && symbolValue.type !== "unknown") continue;
-          allArgsAreClean = false;
+          if (!argClean) allArgsAreClean = false;
         } else {
           if (arg.literal != null) continue;
           if (arg.expression && !arg.variable && isStringLiteralExpression(arg.expression)) continue;
@@ -37440,8 +37670,12 @@ function filterCleanVariableSinks(sinks, calls, taintedVars, symbols, dfg, sanit
     return true;
   });
 }
-function filterSanitizedSinks(sinks, sanitizers, calls) {
+function filterSanitizedSinks(sinks, sanitizers, calls, sources) {
   if (!sanitizers || sanitizers.length === 0) return sinks;
+  const sourceVars = [];
+  for (const source of sources ?? []) {
+    if (source.variable && /^[A-Za-z_$][\w$]*$/.test(source.variable)) sourceVars.push(source.variable);
+  }
   const sanitizersByLine = /* @__PURE__ */ new Map();
   for (const san of sanitizers) {
     const existing = sanitizersByLine.get(san.line) ?? [];
@@ -37457,22 +37691,25 @@ function filterSanitizedSinks(sinks, sanitizers, calls) {
   return sinks.filter((sink) => {
     const lineSanitizers = sanitizersByLine.get(sink.line);
     if (!lineSanitizers || lineSanitizers.length === 0) return true;
-    for (const san of lineSanitizers) {
-      if (sanitizerCoversSink(san, sink.type)) {
-        const lineCalls = callsByLine.get(sink.line) ?? [];
-        for (const call of lineCalls) {
-          for (const arg of call.arguments) {
-            const expr = arg.expression || "";
-            const sanMethodMatch = san.method.match(/(?:(\w+)\.)?(\w+)\(\)/);
-            if (sanMethodMatch) {
-              const sanMethodName = sanMethodMatch[2];
-              const sanClassName = sanMethodMatch[1];
-              if (sanClassName) {
-                if (expr.includes(`${sanClassName}.${sanMethodName}(`)) return false;
-              } else if (expr.includes(`${sanMethodName}(`)) {
-                return false;
-              }
-            }
+    const lineCalls = callsByLine.get(sink.line) ?? [];
+    const covering = lineSanitizers.filter((san) => sanitizerCoversSink(san, sink.type));
+    if (covering.length === 0) return true;
+    for (const variable of sourceVars) {
+      if (identifierOutsideSanitizerCalls(variable, lineCalls, covering, sink.type)) return true;
+    }
+    for (const san of covering) {
+      const sanMethodMatch = san.method.match(/(?:(\w+)\.)?(\w+)\(\)/);
+      if (!sanMethodMatch) continue;
+      const sanMethodName = sanMethodMatch[2];
+      const sanClassName = sanMethodMatch[1];
+      for (const call of lineCalls) {
+        if (call.method_name === sanMethodName) continue;
+        for (const arg of call.arguments) {
+          const expr = arg.expression || "";
+          if (sanClassName) {
+            if (expr.includes(`${sanClassName}.${sanMethodName}(`)) return false;
+          } else if (expr.includes(`${sanMethodName}(`)) {
+            return false;
           }
         }
       }
@@ -38828,9 +39065,13 @@ var TaintPropagationPass = class {
         const sansAtSink = sanitizersByLine.get(f.sink_line);
         if (sansAtSink && sansAtSink.length > 0) {
           for (const san of sansAtSink) {
-            if (sanitizerCoversSink(san, f.sink_type)) {
-              return false;
+            if (!sanitizerCoversSink(san, f.sink_type)) continue;
+            const sinkVar2 = f.path.length > 0 ? f.path[f.path.length - 1].variable : void 0;
+            const callsAtSink = graph.callsByLine.get(f.sink_line) ?? [];
+            if (sinkVar2 && identifierOutsideSanitizerCalls(sinkVar2, callsAtSink, sansAtSink, f.sink_type)) {
+              continue;
             }
+            return false;
           }
         }
         const usesAtSink = graph.usesByLine.get(f.sink_line);
@@ -40417,10 +40658,14 @@ var InterproceduralPass = class {
         }
         const sansAtSink = sanitizersByLine.get(f.sink_line);
         if (!sansAtSink || sansAtSink.length === 0) return true;
+        const callsAtSink = graph.callsByLine.get(f.sink_line) ?? [];
+        const sinkVar = f.path.length > 0 ? f.path[f.path.length - 1]?.variable : void 0;
         for (const san of sansAtSink) {
-          if (sanitizerCoversSink(san, f.sink_type)) {
-            return false;
+          if (!sanitizerCoversSink(san, f.sink_type)) continue;
+          if (sinkVar && identifierOutsideSanitizerCalls(sinkVar, callsAtSink, sansAtSink, f.sink_type)) {
+            continue;
           }
+          return false;
         }
         return true;
       });
@@ -44369,6 +44614,14 @@ var PROVIDER_PATTERNS = [
     level: "error",
     fix: "Revoke the GitHub refresh token and store secrets outside source control."
   },
+  // Fine-grained PATs: `github_pat_` + 22 chars + `_` + 59 chars. (#553)
+  {
+    name: "GitHub fine-grained personal access token",
+    regex: /\bgithub_pat_[A-Za-z0-9]{22}_[A-Za-z0-9]{59}\b/,
+    severity: "critical",
+    level: "error",
+    fix: "Revoke the fine-grained personal access token at https://github.com/settings/tokens and store secrets outside source control."
+  },
   // GitLab personal / project / group access tokens use the `glpat-` prefix.
   // Length is not fixed (legacy bodies are about 20 characters; routable
   // tokens are longer), so the floor is 20 and there is no max. (#577)
@@ -44397,12 +44650,14 @@ var PROVIDER_PATTERNS = [
     level: "error",
     fix: "Rotate the Stripe restricted key in the Stripe Dashboard and load it from a secrets manager."
   },
+  // Publishable keys are meant to be embedded in a client. Keep the finding
+  // so the key is still visible, but at informational severity. (#552)
   {
     name: "Stripe live publishable key",
     regex: /\bpk_live_[A-Za-z0-9]{24,}\b/,
-    severity: "high",
-    level: "warning",
-    fix: "Publishable keys are not secret but should still not be checked in to back-end source files; verify front-end vs back-end context."
+    severity: "low",
+    level: "note",
+    fix: "Publishable keys are not secret. Prefer loading them from configuration rather than a backend source file."
   },
   // Test-mode secret and restricted keys still authorize the test account.
   // Same length floor as the live forms. Severity is high, not critical (#576).
@@ -44427,6 +44682,17 @@ var PROVIDER_PATTERNS = [
     level: "error",
     fix: "Revoke the OpenAI key at https://platform.openai.com/api-keys and load from environment."
   },
+  // Project keys (`sk-proj-`) are a different prefix from the legacy 48-char
+  // secret. OpenAI does not publish one length, so the body floor is 48 and
+  // there is no max and no entropy gate. The hyphen after `proj` keeps this
+  // from matching the legacy pattern. (#551)
+  {
+    name: "OpenAI project API key",
+    regex: /\bsk-proj-[A-Za-z0-9_-]{48,}\b/,
+    severity: "critical",
+    level: "error",
+    fix: "Revoke the OpenAI project key at https://platform.openai.com/api-keys and load from environment."
+  },
   {
     name: "Anthropic API key",
     regex: /\bsk-ant-[A-Za-z0-9_-]{90,}\b/,
@@ -44719,7 +44985,7 @@ var ScanSecretsPass = class {
       for (const pattern of PROVIDER_PATTERNS) {
         const m = pattern.regex.exec(lineText);
         if (!m) continue;
-        if ((pattern.name === "Stripe live restricted key" || pattern.name === "Stripe test secret key" || pattern.name === "Stripe test restricted key" || pattern.name === "GitLab personal access token") && PLACEHOLDER_RE.test(m[0])) {
+        if ((pattern.name === "Stripe live restricted key" || pattern.name === "Stripe test secret key" || pattern.name === "Stripe test restricted key" || pattern.name === "GitLab personal access token" || pattern.name === "OpenAI project API key" || pattern.name === "GitHub fine-grained personal access token") && PLACEHOLDER_RE.test(m[0])) {
           continue;
         }
         if (pattern.name === "PEM private key" && !pemHasInlineBody(lines, i2)) {
@@ -45151,8 +45417,6 @@ var PY_SET_COOKIE_RECEIVERS = /* @__PURE__ */ new Set([
 ]);
 var PY_SECURE_TRUE_RE = /\bsecure\s*=\s*True\b/;
 var PY_HTTPONLY_TRUE_RE = /\bhttponly\s*=\s*True\b/i;
-var JAVA_SET_SECURE_TRUE_RE = /\.setSecure\s*\(\s*true\s*\)/;
-var JAVA_SET_HTTPONLY_TRUE_RE = /\.setHttpOnly\s*\(\s*true\s*\)/;
 var GO_SECURE_TRUE_RE = /\bSecure\s*:\s*true\b/;
 var GO_HTTPONLY_TRUE_RE = /\bHttpOnly\s*:\s*true\b/;
 var RUST_SET_COOKIE_MACRO_RE = /(format!|write!|writeln!)\s*\(([^()]*Set-Cookie[^()]*)\)/gis;
@@ -45181,10 +45445,8 @@ var InsecureCookiePass = class {
         this.emit(ctx, file, det, "python");
       }
     } else if (language === "java") {
-      const hasSetSecureTrue = JAVA_SET_SECURE_TRUE_RE.test(code);
-      const hasSetHttpOnlyTrue = JAVA_SET_HTTPONLY_TRUE_RE.test(code);
       for (const call of graph.ir.calls) {
-        const det = this.detectJavaCookieCtor(call, hasSetSecureTrue, hasSetHttpOnlyTrue);
+        const det = this.detectJavaCookieCtor(call, code);
         if (!det) continue;
         insecureCookies.push(det);
         this.emit(ctx, file, det, "java");
@@ -45263,15 +45525,28 @@ var InsecureCookiePass = class {
     };
   }
   // ---------------- Java ----------------
-  detectJavaCookieCtor(call, hasSetSecureTrue, hasSetHttpOnlyTrue) {
+  /**
+   * True when this cookie construction is followed by `var.setX(true)`.
+   * The variable is the name assigned on the constructor line. An
+   * unassigned `new Cookie(...)` only looks at that statement, so another
+   * cookie's setter cannot cover it.
+   */
+  javaCookieSetterTrue(code, call, setter) {
+    const line = code.split("\n")[(call.location.line ?? 1) - 1] ?? "";
+    const assign = /\b([A-Za-z_]\w*)\s*=\s*new\s+(?:[\w.]+\.)?Cookie\b/.exec(line);
+    const varName = assign?.[1];
+    const re = varName ? new RegExp(`\\b${varName}\\.${setter}\\s*\\(\\s*true\\s*\\)`) : new RegExp(`\\.${setter}\\s*\\(\\s*true\\s*\\)`);
+    return re.test(varName ? code : line);
+  }
+  detectJavaCookieCtor(call, code) {
     const method = call.method_name ?? "";
     const isCookieCtor = method === "Cookie" || method.endsWith(".Cookie");
     if (!isCookieCtor) return null;
     const looksLikeCtor = call.is_constructor || !call.receiver && (call.receiver_type === "Cookie" || (call.receiver_type ?? "").endsWith(".Cookie")) || (call.resolution?.target ?? "").endsWith(".<init>");
     if (!looksLikeCtor) return null;
     if (call.arguments.length < 2) return null;
-    const missingSecure = !hasSetSecureTrue;
-    const missingHttpOnly = !hasSetHttpOnlyTrue;
+    const missingSecure = !this.javaCookieSetterTrue(code, call, "setSecure");
+    const missingHttpOnly = !this.javaCookieSetterTrue(code, call, "setHttpOnly");
     if (!missingSecure && !missingHttpOnly) return null;
     return {
       line: call.location.line,
@@ -49885,7 +50160,7 @@ async function analyzeForAPI(code, filePath, language, options = {}) {
       constPropResult.sanitizedVars,
       constPropResult.synchronizedLines
     );
-    filteredSinks = filterSanitizedSinks(filteredSinks, taint.sanitizers ?? [], calls);
+    filteredSinks = filterSanitizedSinks(filteredSinks, taint.sanitizers ?? [], calls, taint.sources);
     let pythonTaintedVars = /* @__PURE__ */ new Map();
     if (language === "python") {
       pythonTaintedVars = buildPythonTaintedVars(code);