circle-ir 4.14.1 → 4.15.0

package/dist/core/circle-ir-core.js

@@ -8014,6 +8014,17 @@ function extractGoCallInfo(node) {
       if (operand.type === "identifier") {
         const resolved = resolveGoLocalReceiverType(opText, node);
         receiver = resolved !== null ? resolved : opText;
+      } else if (operand.type === "selector_expression" && methodName === "Get") {
+        const fieldNode = operand.childForFieldName("field");
+        const inner = operand.childForFieldName("operand");
+        const fieldName = fieldNode ? getNodeText(fieldNode) : "";
+        const innerName = inner && inner.type === "identifier" ? getNodeText(inner) : null;
+        const innerType = innerName !== null ? resolveGoLocalReceiverType(innerName, node) : null;
+        if (innerType === "Request" && (fieldName === "PostForm" || fieldName === "Form")) {
+          receiver = fieldName === "PostForm" ? "RequestPostForm" : "RequestForm";
+        } else {
+          receiver = opText;
+        }
       } else {
         receiver = opText;
       }
@@ -9830,6 +9841,7 @@ function processStatement2(stmt, startDefId, startUseId, scopeStack, isJavaScrip
             };
             defs.push(def);
             currentScope(scopeStack).set(name2, def.id);
+            markDeclared(currentScope(scopeStack), name2);
           } else if (isJavaScript) {
             const destructDefs = extractDestructuringDefs(nameNode, defId);
             for (const def of destructDefs) {
@@ -9876,21 +9888,31 @@ function processStatement2(stmt, startDefId, startUseId, scopeStack, isJavaScrip
         useId = condUses.nextId;
       }
       const consequence = stmt.childForFieldName("consequence");
+      const alternative = stmt.childForFieldName("alternative");
+      const topAlts = alternateDefs.get(currentScope(scopeStack));
+      const before = /* @__PURE__ */ new Map();
+      if (topAlts) for (const [name2, ids] of topAlts) before.set(name2, [...ids]);
+      let armA = null;
+      let armB = null;
       if (consequence) {
-        const result = processStatement2(consequence, defId, useId, scopeStack, isJavaScript);
+        const result = processArm(consequence, defId, useId, scopeStack, isJavaScript);
+        armA = result.popped;
         defs.push(...result.defs);
         uses.push(...result.uses);
         defId = result.nextDefId;
         useId = result.nextUseId;
       }
-      const alternative = stmt.childForFieldName("alternative");
       if (alternative) {
-        const result = processStatement2(alternative, defId, useId, scopeStack, isJavaScript);
+        const result = processArm(alternative, defId, useId, scopeStack, isJavaScript);
+        armB = result.popped;
         defs.push(...result.defs);
         uses.push(...result.uses);
         defId = result.nextDefId;
         useId = result.nextUseId;
       }
+      if (armA && armB) {
+        mergeIfElseDefs(armA, armB, before, scopeStack);
+      }
       break;
     }
     case "for_statement":
@@ -9961,7 +9983,7 @@ function processStatement2(stmt, startDefId, startUseId, scopeStack, isJavaScrip
       }
       const body2 = stmt.childForFieldName("body");
       if (body2) {
-        const result = processStatement2(body2, defId, useId, scopeStack, isJavaScript);
+        const result = processArm(body2, defId, useId, scopeStack, isJavaScript);
         defs.push(...result.defs);
         uses.push(...result.uses);
         defId = result.nextDefId;
@@ -9989,7 +10011,8 @@ function processStatement2(stmt, startDefId, startUseId, scopeStack, isJavaScrip
           defId = result.nextDefId;
           useId = result.nextUseId;
         }
-        scopeStack.pop();
+        const poppedSwitch = scopeStack.pop();
+        if (!isJavaScript) carryBranchDefsOut(poppedSwitch, scopeStack, false, true);
       }
       break;
     }
@@ -10001,7 +10024,10 @@ function processStatement2(stmt, startDefId, startUseId, scopeStack, isJavaScrip
       uses.push(...result.uses);
       defId = result.nextDefId;
       useId = result.nextUseId;
-      scopeStack.pop();
+      const popped = scopeStack.pop();
+      const alwaysRuns = stmt.parent?.type === "block" || stmt.parent?.type === "synchronized_statement";
+      lastPoppedBlock = popped;
+      if (!isJavaScript) carryBranchDefsOut(popped, scopeStack, alwaysRuns);
       break;
     }
     default: {
@@ -10043,6 +10069,7 @@ function processExpression(expr, startDefId, startUseId, scopeStack, isJavaScrip
       };
       defs.push(def);
       currentScope(scopeStack).set(name2, def.id);
+      alternateDefs.get(currentScope(scopeStack))?.delete(name2);
     } else if (left) {
       const leftUses = extractUses(left, useId, scopeStack, isJavaScript);
       uses.push(...leftUses.uses);
@@ -10126,6 +10153,10 @@ function extractUses(node, startId, scopeStack, isJavaScript) {
         line: n.startPosition.row + 1,
         def_id: reachingDef
       });
+      for (const alt of findAlternateDefs(name2, scopeStack)) {
+        if (alt === reachingDef) continue;
+        uses.push({ id: id++, variable: name2, line: n.startPosition.row + 1, def_id: alt });
+      }
     }
   });
   return { uses, nextId: id };
@@ -10378,6 +10409,134 @@ function extractDestructuringDefs(node, startId) {
 function currentScope(scopeStack) {
   return scopeStack[scopeStack.length - 1];
 }
+var lastPoppedBlock = null;
+function inAlwaysRunBlock(arm) {
+  let n = arm.parent;
+  while (n && (n.type === "if_statement" || n.type === "for_statement" || n.type === "enhanced_for_statement" || n.type === "while_statement" || n.type === "do_statement")) n = n.parent;
+  return !!n && n.type === "block" && !!n.parent && (n.parent.type === "block" || n.parent.type === "synchronized_statement");
+}
+function inNestedBlock(arm) {
+  let n = arm.parent;
+  while (n && (n.type === "if_statement" || n.type === "for_statement" || n.type === "enhanced_for_statement" || n.type === "while_statement" || n.type === "do_statement")) n = n.parent;
+  if (!n || n.type !== "block" || !n.parent) return false;
+  switch (n.parent.type) {
+    case "block":
+    case "synchronized_statement":
+    case "if_statement":
+    case "for_statement":
+    case "enhanced_for_statement":
+    case "while_statement":
+    case "do_statement":
+    case "try_statement":
+    case "try_with_resources_statement":
+    case "catch_clause":
+    case "finally_clause":
+    case "labeled_statement":
+      return true;
+    default:
+      return false;
+  }
+}
+function processArm(node, defId, useId, scopeStack, isJavaScript) {
+  const isBlock = node.type === "block" || node.type === "statement_block";
+  if (isJavaScript || (isBlock ? !inAlwaysRunBlock(node) : !inNestedBlock(node))) {
+    lastPoppedBlock = null;
+    const result2 = processStatement2(node, defId, useId, scopeStack, isJavaScript);
+    return { ...result2, popped: null };
+  }
+  if (isBlock) {
+    lastPoppedBlock = null;
+    const result2 = processStatement2(node, defId, useId, scopeStack, isJavaScript);
+    return { ...result2, popped: lastPoppedBlock };
+  }
+  scopeStack.push(/* @__PURE__ */ new Map());
+  const result = processStatement2(node, defId, useId, scopeStack, isJavaScript);
+  const popped = scopeStack.pop();
+  carryBranchDefsOut(popped, scopeStack, false);
+  return { ...result, popped };
+}
+function mergeIfElseDefs(armA, armB, before, scopeStack) {
+  const top = scopeStack[scopeStack.length - 1];
+  if (!top) return;
+  const alts = alternateDefs.get(top);
+  for (const [name2, idA] of armA) {
+    const idB = armB.get(name2);
+    if (idB === void 0) continue;
+    if (declaredNames.get(armA)?.has(name2) || declaredNames.get(armB)?.has(name2)) continue;
+    if (!scopeStack.some((scope) => scope.has(name2))) continue;
+    const prior = new Set(before.get(name2) ?? []);
+    const arms = (alts?.get(name2) ?? []).filter((id) => !prior.has(id) && id !== idB);
+    if (!arms.includes(idA)) arms.push(idA);
+    top.set(name2, idB);
+    let map = alts;
+    if (!map) {
+      map = /* @__PURE__ */ new Map();
+      alternateDefs.set(top, map);
+    }
+    map.set(name2, arms);
+  }
+}
+var declaredNames = /* @__PURE__ */ new WeakMap();
+var alternateDefs = /* @__PURE__ */ new WeakMap();
+function markDeclared(scope, name2) {
+  let set = declaredNames.get(scope);
+  if (!set) {
+    set = /* @__PURE__ */ new Set();
+    declaredNames.set(scope, set);
+  }
+  set.add(name2);
+  alternateDefs.get(scope)?.delete(name2);
+}
+function carryBranchDefsOut(popped, scopeStack, alwaysRuns = false, altsOnly = false) {
+  const declared = declaredNames.get(popped);
+  const poppedAlts = alternateDefs.get(popped);
+  const top = scopeStack[scopeStack.length - 1];
+  if (!top) return;
+  if (alwaysRuns) {
+    for (const [name2, id] of popped) {
+      if (declared?.has(name2)) continue;
+      if (!scopeStack.some((scope) => scope.has(name2))) continue;
+      top.set(name2, id);
+      let alts = alternateDefs.get(top);
+      if (!alts) {
+        alts = /* @__PURE__ */ new Map();
+        alternateDefs.set(top, alts);
+      }
+      alts.delete(name2);
+      const kept = poppedAlts?.get(name2);
+      if (kept && kept.length > 0) alts.set(name2, [...kept]);
+    }
+    if (poppedAlts) {
+      for (const [name2, ids] of poppedAlts) if (!popped.has(name2)) carry(name2, ids);
+    }
+    return;
+  }
+  function carry(name2, ids) {
+    if (declared?.has(name2)) return;
+    if (!scopeStack.some((scope) => scope.has(name2))) return;
+    let alts = alternateDefs.get(top);
+    if (!alts) {
+      alts = /* @__PURE__ */ new Map();
+      alternateDefs.set(top, alts);
+    }
+    const list = alts.get(name2) ?? [];
+    for (const id of ids) if (!list.includes(id)) list.push(id);
+    alts.set(name2, list);
+  }
+  if (!altsOnly) for (const [name2, id] of popped) carry(name2, [id]);
+  if (poppedAlts) for (const [name2, ids] of poppedAlts) carry(name2, ids);
+}
+function findAlternateDefs(name2, scopeStack) {
+  const out2 = [];
+  for (let i2 = scopeStack.length - 1; i2 >= 0; i2--) {
+    const alts = alternateDefs.get(scopeStack[i2])?.get(name2);
+    if (alts) {
+      for (const id of alts) if (!out2.includes(id)) out2.push(id);
+    }
+    if (scopeStack[i2].has(name2)) break;
+  }
+  return out2;
+}
 function findReachingDef(name2, scopeStack) {
   for (let i2 = scopeStack.length - 1; i2 >= 0; i2--) {
     const defId = scopeStack[i2].get(name2);
@@ -12382,8 +12541,15 @@ var DEFAULT_SINKS = [
   { method: "setExpireTimeSeconds", class: "StaticFilesConfiguration", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
   { method: "configureJarCase", class: "StaticFilesConfiguration", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   { method: "toString", class: "StringUtils", type: "path_traversal", cwe: "CWE-22", severity: "medium", arg_positions: [0] },
-  // Wildfly/Undertow servlet resource manager
-  { method: "getResource", class: "ServletResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
+  // Wildfly/Undertow servlet resource manager.
+  // ResourceManager / PathResourceManager / FileResourceManager /
+  // ClassPathResourceManager are the interface and implementations WildFly
+  // calls through (cognium-dev#622, CVE-2018-1047). Class-qualified only.
+  { method: "getResource", class: "ServletResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "ResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "PathResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "FileResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
+  { method: "getResource", class: "ClassPathResourceManager", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0], languages: ["java"] },
   // Yamcs file system bucket
   { method: "deleteObject", class: "FileSystemBucket", type: "path_traversal", cwe: "CWE-22", severity: "high", arg_positions: [0] },
   // RocketMQ validators
@@ -14727,6 +14893,157 @@ function getDefaultConfig() {
   };
 }
 
+// src/analysis/java-crlf-strip.ts
+function decodeJavaLiteral(raw) {
+  return raw.replace(/\\(?:u+([0-9a-fA-F]{4})|([0-3][0-7]{0,2}|[4-7][0-7]?)|([btnfrs"'\\]))/g, (_m, hex, oct, simple) => {
+    if (hex !== void 0) return String.fromCharCode(parseInt(hex, 16));
+    if (oct !== void 0) return String.fromCharCode(parseInt(oct, 8));
+    switch (simple) {
+      case "b":
+        return "\b";
+      case "t":
+        return "	";
+      case "n":
+        return "\n";
+      case "f":
+        return "\f";
+      case "r":
+        return "\r";
+      case "s":
+        return " ";
+      default:
+        return simple;
+    }
+  });
+}
+function readAtom(s, i2) {
+  const c = s[i2];
+  if (c === "\\" && i2 + 1 < s.length) {
+    const n = s[i2 + 1];
+    return { atom: n === "r" ? "cr" : n === "n" ? "lf" : "other", end: i2 + 2 };
+  }
+  return { atom: c === "\r" ? "cr" : c === "\n" ? "lf" : "other", end: i2 + 1 };
+}
+function quantifierAllowsOne(q) {
+  if (q === "") return true;
+  const m = /^(?:(\*)|(\+)|(\?)|\{(\d+)(?:(,)(\d*))?\})[+?]?$/.exec(q);
+  if (!m) return false;
+  if (m[1] || m[2] || m[3]) return true;
+  const min = Number(m[4]);
+  const max = m[5] ? m[6] === "" ? Infinity : Number(m[6]) : min;
+  return min <= 1 && max >= 1;
+}
+var NONE = { cr: false, lf: false };
+function alternativeCoverage(alt) {
+  if (alt === "") return NONE;
+  let cr = false;
+  let lf = false;
+  let i2;
+  if (alt[0] === "[") {
+    if (alt[1] === "^") return NONE;
+    i2 = 1;
+    let closed = false;
+    while (i2 < alt.length) {
+      if (alt[i2] === "]" && i2 > 1) {
+        closed = true;
+        i2++;
+        break;
+      }
+      if (alt[i2] === "[" || alt[i2] === "&" && alt[i2 + 1] === "&") return NONE;
+      const { atom, end } = readAtom(alt, i2);
+      if (atom === "cr") cr = true;
+      else if (atom === "lf") lf = true;
+      i2 = end;
+    }
+    if (!closed) return NONE;
+  } else {
+    const { atom, end } = readAtom(alt, 0);
+    if (atom === "other") return NONE;
+    cr = atom === "cr";
+    lf = atom === "lf";
+    i2 = end;
+  }
+  return quantifierAllowsOne(alt.slice(i2)) ? { cr, lf } : NONE;
+}
+function splitAlternatives(s) {
+  const alts = [];
+  let depth = 0;
+  let inClass = false;
+  let cur = "";
+  for (let i2 = 0; i2 < s.length; i2++) {
+    const c = s[i2];
+    if (c === "\\") {
+      cur += c + (s[i2 + 1] ?? "");
+      i2++;
+      continue;
+    }
+    if (inClass) {
+      if (c === "]") inClass = false;
+      cur += c;
+      continue;
+    }
+    if (c === "[") {
+      inClass = true;
+      cur += c;
+      continue;
+    }
+    if (c === "(") depth++;
+    else if (c === ")") depth--;
+    if (c === "|" && depth === 0) {
+      alts.push(cur);
+      cur = "";
+      continue;
+    }
+    cur += c;
+  }
+  alts.push(cur);
+  return alts;
+}
+function unwrapGroup(s) {
+  const open = /^\((?:\?:)?/.exec(s);
+  if (!open) return null;
+  let depth = 0;
+  let inClass = false;
+  for (let i2 = 0; i2 < s.length; i2++) {
+    const c = s[i2];
+    if (c === "\\") {
+      i2++;
+      continue;
+    }
+    if (inClass) {
+      if (c === "]") inClass = false;
+      continue;
+    }
+    if (c === "[") {
+      inClass = true;
+      continue;
+    }
+    if (c === "(") depth++;
+    else if (c === ")" && --depth === 0) {
+      return { body: s.slice(open[0].length, i2), quantifier: s.slice(i2 + 1) };
+    }
+  }
+  return null;
+}
+function javaReplaceCrLfCoverage(method, rawFrom) {
+  const value = decodeJavaLiteral(rawFrom);
+  if (method === "replace") return { cr: value === "\r", lf: value === "\n" };
+  let body2 = value;
+  const group = unwrapGroup(value);
+  if (group) {
+    if (!quantifierAllowsOne(group.quantifier)) return NONE;
+    body2 = group.body;
+  }
+  let cr = false;
+  let lf = false;
+  for (const alt of splitAlternatives(body2)) {
+    const c = alternativeCoverage(alt);
+    if (c.cr) cr = true;
+    if (c.lf) lf = true;
+  }
+  return { cr, lf };
+}
+
 // src/analysis/arg-type-resolver.ts
 function findEnclosingType(callInMethod, types) {
   if (!callInMethod) return null;
@@ -14827,7 +15144,7 @@ function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy,
   sinkPatterns = expandIndirectEvalAliases(sinkPatterns, sourceLines, language);
   const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines, types);
   const gatedSinks = language === "csharp" ? dropCSharpObjectCarriedWaypoints(sinks, calls) : sinks;
-  const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
+  const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines, language);
   return { sources, sinks: gatedSinks, sanitizers };
 }
 function sinkPatternAppliesTo(pattern, language) {
@@ -15254,7 +15571,8 @@ function isInterproceduralTaintableType(typeName, language) {
 }
 function isParameterizedQueryCall(call, pattern) {
   if (pattern.type !== "sql_injection") return false;
-  const queryPos = pattern.arg_positions.length > 0 ? Math.min(...pattern.arg_positions) : 0;
+  const positions = pattern.arg_positions ?? [];
+  const queryPos = positions.length > 0 ? Math.min(...positions) : 0;
   const queryArg = call.arguments.find((a) => a.position === queryPos);
   if (queryArg) {
     const queryText = queryArg.literal ?? queryArg.expression ?? "";
@@ -15845,6 +16163,25 @@ function isGoFprintToNonResponseWriter(call, pattern, language, sourceLines) {
   }
   return true;
 }
+var JAVA_OUTBOUND_STREAM_OWNERS = "HttpURLConnection|HttpsURLConnection|URLConnection|JarURLConnection|Socket|SSLSocket|Process";
+function isJavaOutboundOutputStreamWrite(call, pattern, language, sourceLines) {
+  if (language !== "java" || pattern.type !== "xss") return false;
+  const receiver = (call.receiver ?? "").replace(/\s+/g, "");
+  if (!receiver.endsWith(".getOutputStream()")) return false;
+  if (/\.openConnection\(\)\)?\.getOutputStream\(\)$/.test(receiver)) return true;
+  const m = receiver.match(/^\(?([A-Za-z_]\w*)\)?\.getOutputStream\(\)$/);
+  if (!m || !sourceLines) return false;
+  const declRe = new RegExp(
+    `\\b(?:[\\w.]+\\.)?(?:${JAVA_OUTBOUND_STREAM_OWNERS})\\s+${m[1]}\\s*[=;,)]`
+  );
+  const anyDeclRe = new RegExp(`\\b(?:[A-Z][\\w.<>,\\[\\]]*|var)\\s+${m[1]}\\s*[=;,)]`);
+  for (let i2 = call.location.line - 1; i2 >= 0; i2--) {
+    const line = (sourceLines[i2] ?? "").replace(/"(?:[^"\\]|\\.)*"/g, '""').replace(/\/\*[\s\S]*?\*\//g, "").replace(/\/\/.*$/, "");
+    if (declRe.test(line)) return true;
+    if (anyDeclRe.test(line)) return false;
+  }
+  return false;
+}
 function isSafeGoJsonUnmarshalCall(call, pattern, language, sourceLines) {
   if (language !== "go") return false;
   if (pattern.type !== "deserialization") return false;
@@ -15994,6 +16331,9 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
         if (isGoFprintToNonResponseWriter(call, pattern, language, sourceLines)) {
           continue;
         }
+        if (isJavaOutboundOutputStreamWrite(call, pattern, language, sourceLines)) {
+          continue;
+        }
         if (isSafeJinjaRenderCall(call, pattern, language, sourceLines)) {
           continue;
         }
@@ -16401,6 +16741,13 @@ function receiverMightBeClassImpl(receiver, className) {
   if (receiver === className) {
     return true;
   }
+  const inlineRequire = receiver.match(/^require\(\s*['"`](?:node:)?([\w./-]+)['"`]\s*\)$/);
+  if (inlineRequire && inlineRequire[1] === className) {
+    return true;
+  }
+  if (className === "ClassLoader" && /(?:^|\.)(?:getContextClassLoader|getClassLoader|getSystemClassLoader)\(\s*\)$/.test(receiver.replace(/\s+/g, ""))) {
+    return true;
+  }
   if (receiver.endsWith(")")) {
     const ctorMatch = receiver.match(/^(\w+)\(/);
     if (ctorMatch) {
@@ -16689,8 +17036,9 @@ function calculateSinkConfidence(call, pattern) {
   }
   return Math.min(confidence, 1);
 }
-function findSanitizers(calls, types, patterns, sourceLines) {
+function findSanitizers(calls, types, patterns, sourceLines, language) {
   const sanitizers = [];
+  const javaReplace = (call) => language === "java" && sourceLines && (call.method_name === "replace" || call.method_name === "replaceAll") ? javaReplaceChainCredit(javaChainTextAt(sourceLines, call.location.line, call.location.column)) : null;
   const sanitizerMethods = /* @__PURE__ */ new Set();
   for (const type of types) {
     for (const method of type.methods) {
@@ -16715,10 +17063,15 @@ function findSanitizers(calls, types, patterns, sourceLines) {
       if (inside.length !== 1) continue;
       const innerCall = inside[0];
       let matched;
-      for (const pattern of patterns) {
-        if (matchesSanitizerPattern(innerCall, pattern)) {
-          matched = pattern;
-          break;
+      const replaceCredit = javaReplace(innerCall);
+      if (replaceCredit) {
+        matched = replaceCredit.length > 0 ? { method: innerCall.method_name, removes: replaceCredit } : void 0;
+      } else {
+        for (const pattern of patterns) {
+          if (matchesSanitizerPattern(innerCall, pattern)) {
+            matched = pattern;
+            break;
+          }
         }
       }
       if (!matched || !matched.removes || matched.removes.length === 0) continue;
@@ -16770,6 +17123,18 @@ function findSanitizers(calls, types, patterns, sourceLines) {
       });
       continue;
     }
+    const replaceCredit = javaReplace(call);
+    if (replaceCredit) {
+      if (replaceCredit.length > 0) {
+        sanitizers.push({
+          type: "method_call",
+          method: formatSanitizerMethod(call),
+          line: call.location.line,
+          sanitizes: replaceCredit
+        });
+      }
+      continue;
+    }
     for (const pattern of patterns) {
       if (matchesSanitizerPattern(call, pattern)) {
         sanitizers.push({
@@ -16799,6 +17164,52 @@ function findSanitizers(calls, types, patterns, sourceLines) {
   }
   return sanitizers;
 }
+var JAVA_LIT = String.raw`(?:"((?:\\.|[^"\\])*)"|'((?:\\.|[^'\\])*)')`;
+var JAVA_REPLACE_ARGS_RE = new RegExp(String.raw`\.(replace|replaceAll)\(\s*${JAVA_LIT}\s*,\s*${JAVA_LIT}\s*\)`, "g");
+function javaChainTextAt(sourceLines, line, column) {
+  const text = [(sourceLines[line - 1] ?? "").slice(column), ...sourceLines.slice(line, line + 7)].join("\n");
+  let depth = 0;
+  let i2 = 0;
+  for (; i2 < text.length; i2++) {
+    const c = text[i2];
+    if (c === '"' || c === "'") {
+      for (i2++; i2 < text.length && text[i2] !== c; i2++) if (text[i2] === "\\") i2++;
+      continue;
+    }
+    if (c === "(" || c === "[") {
+      depth++;
+      continue;
+    }
+    if (c === ")" || c === "]") {
+      if (depth === 0) break;
+      depth--;
+      continue;
+    }
+    if (depth === 0 && !/[\w$.\s]/.test(c)) break;
+  }
+  return text.slice(0, i2);
+}
+function javaReplaceChainCredit(chainText) {
+  let cr = false;
+  let lf = false;
+  let lt = false;
+  let gt = false;
+  for (const m of chainText.matchAll(JAVA_REPLACE_ARGS_RE)) {
+    const kind = m[1];
+    const rawFrom = m[2] ?? m[3] ?? "";
+    const from = rawFrom.replace(/\\\\/g, "\\");
+    const to = m[4] ?? m[5] ?? "";
+    const cov = javaReplaceCrLfCoverage(kind, rawFrom);
+    if (cov.cr) cr = true;
+    if (cov.lf) lf = true;
+    if (from === "<" && to.startsWith("&")) lt = true;
+    if (from === ">" && to.startsWith("&")) gt = true;
+  }
+  const out2 = [];
+  if (cr && lf) out2.push("log_injection");
+  if (lt && gt) out2.push("xss");
+  return out2;
+}
 function matchesSanitizerPattern(call, pattern) {
   if (pattern.method) {
     if (call.method_name !== pattern.method) {
@@ -16839,6 +17250,15 @@ function formatSanitizerMethod(call) {
 // src/graph/code-graph.ts
 var CodeGraph = class {
   ir;
+  /**
+   * Defs whose value cannot carry the content of the values they read, so
+   * taint does not flow into them. Set by `analyze()`; empty for a bare graph.
+   *   - an int or bool measure or test (`len(x)`, `x.length`,
+   *     `re.MatchString(x)`) (#568)
+   *   - a lookup in a constant table the file never writes (`T[req.query.k]`)
+   *     (#667)
+   */
+  taintBarrierDefIds = /* @__PURE__ */ new Set();
   constructor(ir) {
     this.ir = ir;
   }
@@ -17093,6 +17513,7 @@ var CodeGraph = class {
       for (const [fromDef, chains] of this.chainsByFromDef) {
         if (!result.has(fromDef)) continue;
         for (const chain of chains) {
+          if (this.taintBarrierDefIds.has(chain.to_def)) continue;
           if (!result.has(chain.to_def)) {
             result.add(chain.to_def);
             changed = true;
@@ -17178,6 +17599,10 @@ function buildSanitizersByLine(sanitizers) {
   }
   return out2;
 }
+function templateInterpolationCount(expression) {
+  if (!expression.trimStart().startsWith("`")) return 0;
+  return (expression.match(/\$\{/g) ?? []).length;
+}
 function concatOutsideStrings(expression) {
   return expression.replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'/g, " ").includes("+");
 }
@@ -17213,31 +17638,38 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
   const taintedVars = [];
   const flows = [];
   const javaConcat = graph.ir.meta.language === "java";
+  const jsLike = graph.ir.meta.language === "javascript" || graph.ir.meta.language === "typescript";
   const reachableSinks = /* @__PURE__ */ new Map();
   const defsByLine = graph.defsByLine;
   const usesByLine = graph.usesByLine;
   const callsByLine = graph.callsByLine;
   const sanitizersByLine = sanitizers.length > 0 ? buildSanitizersByLine(sanitizers) : graph.sanitizersByLine;
   const defById = graph.defById;
-  const rawInitialTaint = findInitialTaint(sources, callsByLine, defsByLine);
-  const initialTaint = rawInitialTaint.filter((tv) => {
+  const rawInitialTaint = findInitialTaint(sources, callsByLine, defsByLine, graph.chainsByFromDef, jsLike);
+  const filteredInitialTaint = rawInitialTaint.filter((tv) => {
     if (tv.line === tv.sourceLine) return true;
+    if (graph.taintBarrierDefIds.has(tv.defId)) return false;
     const sanCheck = checkSanitized(tv.sourceLine, tv.line, tv.sourceType, sanitizersByLine);
     return !sanCheck.sanitized;
   });
+  const initialTaint = [
+    ...filteredInitialTaint.filter((tv) => tv.sourceType !== "interprocedural_param"),
+    ...filteredInitialTaint.filter((tv) => tv.sourceType === "interprocedural_param")
+  ];
   taintedVars.push(...initialTaint);
   const propagatedTaint = propagateThroughChains(
     initialTaint,
     graph.chainsByFromDef,
     defById,
-    sanitizersByLine
+    sanitizersByLine,
+    graph.taintBarrierDefIds
   );
   taintedVars.push(...propagatedTaint);
   const allTaintedDefIds = /* @__PURE__ */ new Set();
   const taintByDefId = /* @__PURE__ */ new Map();
   for (const tv of taintedVars) {
     allTaintedDefIds.add(tv.defId);
-    taintByDefId.set(tv.defId, tv);
+    if (!yieldsToRealSource(taintByDefId.get(tv.defId), tv)) taintByDefId.set(tv.defId, tv);
   }
   for (const sink of sinks) {
     const usesAtSink = usesByLine.get(sink.line) ?? [];
@@ -17250,7 +17682,7 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
           }
         }
         const expr = typeof arg.expression === "string" ? arg.expression : "";
-        const compoundConcat = javaConcat && !!arg.variable && expr !== arg.variable && concatOutsideStrings(expr);
+        const compoundConcat = !!arg.variable && expr !== arg.variable && (javaConcat && concatOutsideStrings(expr) || jsLike && templateInterpolationCount(expr) > 1);
         const candidateUses = arg.variable && !compoundConcat ? usesAtSink.filter((u) => u.variable === arg.variable) : usesAtSink;
         {
           for (const use of candidateUses) {
@@ -17263,11 +17695,26 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
                 }
                 const taintInfo = taintByDefId.get(use.def_id);
                 if (taintInfo) {
+                  let sanMap = sanitizersByLine;
+                  if (identifierOutsideSanitizerCalls(
+                    use.variable,
+                    callsAtSink,
+                    sanitizersByLine.get(sink.line) ?? [],
+                    sink.type
+                  )) {
+                    const stripped = new Map(sanitizersByLine);
+                    const kept = (sanitizersByLine.get(sink.line) ?? []).filter(
+                      (s) => !sanitizerCoversSink(s, sink.type)
+                    );
+                    if (kept.length === 0) stripped.delete(sink.line);
+                    else stripped.set(sink.line, kept);
+                    sanMap = stripped;
+                  }
                   const isSanitized = checkSanitized(
                     taintInfo.line,
                     sink.line,
                     sink.type,
-                    sanitizersByLine,
+                    sanMap,
                     {
                       startDefId: use.def_id,
                       chainsByToDef: graph.chainsByToDef,
@@ -17308,12 +17755,46 @@ function propagateTaint(graphOrDfg, callsOrSources, sourcesOrSinks, sinksOrSanit
   }
   return { taintedVars, flows: deduped, reachableSinks };
 }
-function findInitialTaint(sources, callsByLine, defsByLine) {
+var PARAM_SCOPED_SOURCE_RE = /^(?:GraphQL \w+\.\w+ resolver args|Express handler destructured request) /;
+function isCompleteConditionHeader(code) {
+  if (!code) return false;
+  const m = /^(?:\}\s*)?(?:else\s+)?(?:if|while)\s*\(/.exec(code);
+  if (!m) return false;
+  const text = code.slice(m[0].length - 1).replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|`(?:[^`\\]|\\.)*`/g, '""');
+  let depth = 0;
+  for (const ch of text) {
+    if (ch === "(") depth++;
+    else if (ch === ")" && --depth === 0) return true;
+  }
+  return false;
+}
+function hasSecondStatement(code) {
+  if (!code || /^for\b/.test(code)) return false;
+  const text = code.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|`(?:[^`\\]|\\.)*`/g, '""');
+  return /;\s*(?!\/\/|\/\*|#|\}|\)|$)\S/.test(text);
+}
+function findInitialTaint(sources, callsByLine, defsByLine, chainsByFromDef, jsLike = false) {
   const tainted = [];
   for (const source of sources) {
     const defsOnLine = defsByLine.get(source.line) ?? [];
+    let seedable = null;
+    if (source.variable && hasSecondStatement(source.code)) {
+      const own = defsOnLine.filter((d) => d.variable === source.variable);
+      if (own.length > 0) {
+        seedable = new Set(own.map((d) => d.id));
+        for (const d of own) {
+          for (const c of chainsByFromDef.get(d.id) ?? []) {
+            if (defsOnLine.some((o) => o.id === c.to_def)) seedable.add(c.to_def);
+          }
+        }
+      }
+    }
     for (const def of defsOnLine) {
-      if (source.type === "interprocedural_param" && source.variable && def.kind === "param" && def.variable !== source.variable) {
+      if (seedable && !seedable.has(def.id)) continue;
+      if ((source.type === "interprocedural_param" || PARAM_SCOPED_SOURCE_RE.test(source.location ?? "")) && source.variable && def.kind === "param" && def.variable !== source.variable) {
+        continue;
+      }
+      if (source.type === "interprocedural_param" && def.kind !== "param") {
         continue;
       }
       tainted.push({
@@ -17325,7 +17806,8 @@ function findInitialTaint(sources, callsByLine, defsByLine) {
         confidence: source.confidence
       });
     }
-    const defsNextLine = defsByLine.get(source.line + 1) ?? [];
+    const closesOwnStatement = jsLike && defsOnLine.length > 0 && /;\s*(?:\/\/.*)?$/.test(source.code ?? "");
+    const defsNextLine = isCompleteConditionHeader(source.code) ? [] : (defsByLine.get(source.line + 1) ?? []).filter((d) => !(closesOwnStatement && d.kind === "local"));
     for (const def of defsNextLine) {
       const callsOnSourceLine = callsByLine.get(source.line) ?? [];
       if (callsOnSourceLine.length > 0) {
@@ -17359,12 +17841,15 @@ function findInitialTaint(sources, callsByLine, defsByLine) {
   }
   return tainted;
 }
-function propagateThroughChains(initialTaint, chainsByFromDef, defById, sanitizersByLine) {
+function yieldsToRealSource(existing, next) {
+  return existing !== void 0 && next.sourceType === "interprocedural_param" && existing.sourceType !== "interprocedural_param";
+}
+function propagateThroughChains(initialTaint, chainsByFromDef, defById, sanitizersByLine, taintBarrierDefIds) {
   const propagated = [];
   const taintedDefIds = new Set(initialTaint.map((t) => t.defId));
   const taintInfoByDefId = /* @__PURE__ */ new Map();
   for (const t of initialTaint) {
-    taintInfoByDefId.set(t.defId, t);
+    if (!yieldsToRealSource(taintInfoByDefId.get(t.defId), t)) taintInfoByDefId.set(t.defId, t);
   }
   const queue = [...initialTaint.map((t) => t.defId)];
   const visited = new Set(queue);
@@ -17375,6 +17860,7 @@ function propagateThroughChains(initialTaint, chainsByFromDef, defById, sanitize
     const outgoingChains = chainsByFromDef.get(currentDefId) ?? [];
     for (const chain of outgoingChains) {
       if (visited.has(chain.to_def)) continue;
+      if (taintBarrierDefIds.has(chain.to_def)) continue;
       const targetDef = defById.get(chain.to_def);
       if (!targetDef) continue;
       const sanitizeCheck = checkSanitized(
@@ -17421,6 +17907,92 @@ var KNOWN_SINK_TYPES = /* @__PURE__ */ new Set([
   "crlf",
   "mass_assignment"
 ]);
+function readBalancedArg(text, openParen) {
+  let depth = 0;
+  let quote = null;
+  let escaped = false;
+  for (let i2 = openParen; i2 < text.length; i2++) {
+    const c = text[i2];
+    if (quote) {
+      if (escaped) {
+        escaped = false;
+        continue;
+      }
+      if (c === "\\") {
+        escaped = true;
+        continue;
+      }
+      if (c === quote) quote = null;
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      quote = c;
+      continue;
+    }
+    if (c === "(") depth++;
+    else if (c === ")") {
+      depth--;
+      if (depth === 0) return text.slice(openParen + 1, i2);
+    }
+  }
+  return null;
+}
+function sanitizerCallRefs(sanitizers, sinkType) {
+  const refs = [];
+  for (const san of sanitizers) {
+    if (!sanitizerCoversSink(san, sinkType)) continue;
+    const m = /(?:(\w+)\.)?(\w+)\(\)/.exec(san.method);
+    if (!m?.[2]) continue;
+    refs.push({ receiver: m[1], methodName: m[2] });
+  }
+  return refs;
+}
+function maskSanitizerCalls(expr, refs) {
+  let out2 = expr;
+  for (const ref of refs) {
+    const needles = ref.receiver ? [`${ref.receiver}.${ref.methodName}`, ref.methodName] : [ref.methodName];
+    for (const needle of needles) {
+      const re = new RegExp(`\\b${needle.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*\\(`);
+      for (let guard = 0; guard < 8; guard++) {
+        const m = re.exec(out2);
+        if (!m) break;
+        const open = m.index + m[0].length - 1;
+        const arg = readBalancedArg(out2, open);
+        if (arg === null) break;
+        out2 = out2.slice(0, m.index) + " " + out2.slice(open + arg.length + 2);
+      }
+    }
+  }
+  return out2;
+}
+function maskLengthOf(expr) {
+  return expr.replace(/\b(?:len|strlen|count)\s*\(\s*[\w$.]+\s*\)/g, " 0 ").replace(/[\w$.]+\s*\.\s*(?:length|size|count)\s*(?:\(\s*\))?(?![\w$(])/g, " 0 ");
+}
+function blankStringLiterals(expr) {
+  return expr.replace(/"(?:[^"\\]|\\.)*"/g, '""').replace(/'(?:[^'\\]|\\.)*'/g, "''");
+}
+function identifierOutsideSanitizerCalls(variable, calls, sanitizers, sinkType) {
+  if (!/^[A-Za-z_$][\w$]*$/.test(variable)) return false;
+  const refs = sanitizerCallRefs(sanitizers, sinkType);
+  if (refs.length === 0) return false;
+  const re = new RegExp(
+    `(?:^|[^A-Za-z0-9_$])${variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?:[^A-Za-z0-9_$]|$)`
+  );
+  for (const call of calls) {
+    if (refs.some((r) => r.methodName === call.method_name)) continue;
+    const masked = call.arguments.map((arg) => {
+      const expr = arg.expression ?? "";
+      return { expr, masked: expr ? maskSanitizerCalls(expr, refs) : expr };
+    });
+    if (!masked.some((m) => m.masked !== m.expr)) continue;
+    for (const m of masked) {
+      if (!m.masked) continue;
+      const text = m.masked === m.expr ? maskLengthOf(m.masked) : m.masked;
+      if (re.test(blankStringLiterals(text))) return true;
+    }
+  }
+  return false;
+}
 function checkSanitized(fromLine, toLine, sinkType, sanitizersByLine, ctx) {
   const isKnownSinkType = KNOWN_SINK_TYPES.has(sinkType);
   const sanitizersAtTarget = sanitizersByLine.get(toLine);