circle-ir 4.14.2 → 4.15.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (78) hide show
  1. package/dist/analysis/const-table-lookup.d.ts +29 -0
  2. package/dist/analysis/const-table-lookup.d.ts.map +1 -0
  3. package/dist/analysis/const-table-lookup.js +145 -0
  4. package/dist/analysis/const-table-lookup.js.map +1 -0
  5. package/dist/analysis/findings.d.ts.map +1 -1
  6. package/dist/analysis/findings.js +15 -4
  7. package/dist/analysis/findings.js.map +1 -1
  8. package/dist/analysis/go-strings-replacer.d.ts +21 -0
  9. package/dist/analysis/go-strings-replacer.d.ts.map +1 -0
  10. package/dist/analysis/go-strings-replacer.js +145 -0
  11. package/dist/analysis/go-strings-replacer.js.map +1 -0
  12. package/dist/analysis/interprocedural.d.ts.map +1 -1
  13. package/dist/analysis/interprocedural.js +53 -0
  14. package/dist/analysis/interprocedural.js.map +1 -1
  15. package/dist/analysis/java-canonical-prefix.d.ts +42 -0
  16. package/dist/analysis/java-canonical-prefix.d.ts.map +1 -0
  17. package/dist/analysis/java-canonical-prefix.js +145 -0
  18. package/dist/analysis/java-canonical-prefix.js.map +1 -0
  19. package/dist/analysis/java-crlf-strip.d.ts +30 -0
  20. package/dist/analysis/java-crlf-strip.d.ts.map +1 -0
  21. package/dist/analysis/java-crlf-strip.js +195 -0
  22. package/dist/analysis/java-crlf-strip.js.map +1 -0
  23. package/dist/analysis/passes/cleartext-credential-transport-pass.d.ts +2 -0
  24. package/dist/analysis/passes/cleartext-credential-transport-pass.d.ts.map +1 -1
  25. package/dist/analysis/passes/cleartext-credential-transport-pass.js +64 -12
  26. package/dist/analysis/passes/cleartext-credential-transport-pass.js.map +1 -1
  27. package/dist/analysis/passes/cross-file-pass.d.ts.map +1 -1
  28. package/dist/analysis/passes/cross-file-pass.js +43 -0
  29. package/dist/analysis/passes/cross-file-pass.js.map +1 -1
  30. package/dist/analysis/passes/csharp-sanitizer-credit.d.ts.map +1 -1
  31. package/dist/analysis/passes/csharp-sanitizer-credit.js +18 -0
  32. package/dist/analysis/passes/csharp-sanitizer-credit.js.map +1 -1
  33. package/dist/analysis/passes/interprocedural-pass.d.ts +28 -0
  34. package/dist/analysis/passes/interprocedural-pass.d.ts.map +1 -1
  35. package/dist/analysis/passes/interprocedural-pass.js +20 -1
  36. package/dist/analysis/passes/interprocedural-pass.js.map +1 -1
  37. package/dist/analysis/passes/language-sources-pass.d.ts +41 -2
  38. package/dist/analysis/passes/language-sources-pass.d.ts.map +1 -1
  39. package/dist/analysis/passes/language-sources-pass.js +842 -10
  40. package/dist/analysis/passes/language-sources-pass.js.map +1 -1
  41. package/dist/analysis/passes/param-source-flow-gate-pass.d.ts +8 -0
  42. package/dist/analysis/passes/param-source-flow-gate-pass.d.ts.map +1 -1
  43. package/dist/analysis/passes/param-source-flow-gate-pass.js +162 -6
  44. package/dist/analysis/passes/param-source-flow-gate-pass.js.map +1 -1
  45. package/dist/analysis/passes/sink-filter-pass.d.ts.map +1 -1
  46. package/dist/analysis/passes/sink-filter-pass.js +207 -1
  47. package/dist/analysis/passes/sink-filter-pass.js.map +1 -1
  48. package/dist/analysis/passes/taint-propagation-pass.d.ts.map +1 -1
  49. package/dist/analysis/passes/taint-propagation-pass.js +257 -2
  50. package/dist/analysis/passes/taint-propagation-pass.js.map +1 -1
  51. package/dist/analysis/scalar-derivation.d.ts +25 -0
  52. package/dist/analysis/scalar-derivation.d.ts.map +1 -0
  53. package/dist/analysis/scalar-derivation.js +196 -0
  54. package/dist/analysis/scalar-derivation.js.map +1 -0
  55. package/dist/analysis/taint-matcher.d.ts.map +1 -1
  56. package/dist/analysis/taint-matcher.js +167 -6
  57. package/dist/analysis/taint-matcher.js.map +1 -1
  58. package/dist/analysis/taint-propagation.d.ts.map +1 -1
  59. package/dist/analysis/taint-propagation.js +149 -19
  60. package/dist/analysis/taint-propagation.js.map +1 -1
  61. package/dist/analyzer.d.ts.map +1 -1
  62. package/dist/analyzer.js +7 -0
  63. package/dist/analyzer.js.map +1 -1
  64. package/dist/browser/circle-ir.js +3140 -1186
  65. package/dist/core/circle-ir-core.cjs +485 -27
  66. package/dist/core/circle-ir-core.js +485 -27
  67. package/dist/core/extractors/dfg.js +240 -6
  68. package/dist/core/extractors/dfg.js.map +1 -1
  69. package/dist/graph/code-graph.d.ts +9 -0
  70. package/dist/graph/code-graph.d.ts.map +1 -1
  71. package/dist/graph/code-graph.js +11 -0
  72. package/dist/graph/code-graph.js.map +1 -1
  73. package/dist/resolution/cross-file.d.ts +7 -0
  74. package/dist/resolution/cross-file.d.ts.map +1 -1
  75. package/dist/resolution/cross-file.js +10 -1
  76. package/dist/resolution/cross-file.js.map +1 -1
  77. package/dist/wasm/web-tree-sitter.wasm +0 -0
  78. package/package.json +3 -3
@@ -0,0 +1,29 @@
1
+ /**
2
+ * Constant-table lookup taint barrier (#667).
3
+ *
4
+ * `const handler = REGISTRY[req.query.mod]` selects one of the values the
5
+ * program itself wrote into `REGISTRY`. The request picks the key; it does not
6
+ * supply the value. When `REGISTRY` is a top-level `const` object or array
7
+ * literal that the file never writes to, the lookup result carries no request
8
+ * data, so it is neither a source nor a taint-carrying def.
9
+ *
10
+ * Proof comes from the file text alone, and anything short of it keeps the
11
+ * taint: a table declared with `let`, a table whose literal mentions a request
12
+ * object, a table the file assigns into, mutates or passes to `Object.assign`,
13
+ * and a lookup that is only part of the initializer (`T[k] || k`).
14
+ */
15
+ import type { DFGDef } from '../types/index.js';
16
+ /**
17
+ * Names of top-level `const` tables — object or array literals, optionally
18
+ * wrapped in `Object.freeze(...)` — whose literal text references no request
19
+ * object and which the file never writes to.
20
+ */
21
+ export declare function constLookupTables(code: string, language: string): Set<string>;
22
+ /**
23
+ * True when `rhs` is exactly `TABLE[<key>]` (optionally `TABLE?.[<key>]`) for
24
+ * a table in `tables`.
25
+ */
26
+ export declare function isConstTableLookup(rhs: string, tables: ReadonlySet<string>): boolean;
27
+ /** DFG def ids of locals initialised by a whole constant-table lookup. */
28
+ export declare function constTableLookupDefIds(defs: readonly DFGDef[], code: string, language: string): Set<number>;
29
+ //# sourceMappingURL=const-table-lookup.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"const-table-lookup.d.ts","sourceRoot":"","sources":["../../src/analysis/const-table-lookup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAmChD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAsB7E;AA6BD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAOpF;AAED,0EAA0E;AAC1E,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAc3G"}
@@ -0,0 +1,145 @@
1
+ /**
2
+ * Constant-table lookup taint barrier (#667).
3
+ *
4
+ * `const handler = REGISTRY[req.query.mod]` selects one of the values the
5
+ * program itself wrote into `REGISTRY`. The request picks the key; it does not
6
+ * supply the value. When `REGISTRY` is a top-level `const` object or array
7
+ * literal that the file never writes to, the lookup result carries no request
8
+ * data, so it is neither a source nor a taint-carrying def.
9
+ *
10
+ * Proof comes from the file text alone, and anything short of it keeps the
11
+ * taint: a table declared with `let`, a table whose literal mentions a request
12
+ * object, a table the file assigns into, mutates or passes to `Object.assign`,
13
+ * and a lookup that is only part of the initializer (`T[k] || k`).
14
+ */
15
+ const REQUEST_REF_RE = /\b(?:req|request|ctx|event|process|params|query|body|location|document|window)\b/;
16
+ function isJs(language) {
17
+ return language === 'javascript' || language === 'typescript';
18
+ }
19
+ /** Index just past the bracket closing the one at `open`, or -1. Skips string literals. */
20
+ function closeOf(text, open) {
21
+ const pairs = { '{': '}', '[': ']', '(': ')' };
22
+ const stack = [];
23
+ for (let i = open; i < text.length; i++) {
24
+ const c = text[i];
25
+ if (c === '"' || c === "'" || c === '`') {
26
+ let j = i + 1;
27
+ for (; j < text.length && text[j] !== c; j++)
28
+ if (text[j] === '\\')
29
+ j++;
30
+ i = j;
31
+ continue;
32
+ }
33
+ if (c === '/' && text[i + 1] === '/') {
34
+ const nl = text.indexOf('\n', i);
35
+ if (nl < 0)
36
+ return -1;
37
+ i = nl;
38
+ continue;
39
+ }
40
+ if (pairs[c]) {
41
+ stack.push(pairs[c]);
42
+ continue;
43
+ }
44
+ if (c === '}' || c === ']' || c === ')') {
45
+ if (stack.pop() !== c)
46
+ return -1;
47
+ if (stack.length === 0)
48
+ return i + 1;
49
+ }
50
+ }
51
+ return -1;
52
+ }
53
+ /**
54
+ * Names of top-level `const` tables — object or array literals, optionally
55
+ * wrapped in `Object.freeze(...)` — whose literal text references no request
56
+ * object and which the file never writes to.
57
+ */
58
+ export function constLookupTables(code, language) {
59
+ const out = new Set();
60
+ if (!isJs(language))
61
+ return out;
62
+ const declRe = /^const\s+([A-Za-z_$][\w$]*)\s*(?::[^=\n]+)?=\s*(Object\.freeze\(\s*)?([{[])/gm;
63
+ for (const m of code.matchAll(declRe)) {
64
+ const name = m[1];
65
+ const open = m.index + m[0].length - 1;
66
+ const close = closeOf(code, open);
67
+ if (close < 0)
68
+ continue;
69
+ if (REQUEST_REF_RE.test(code.slice(open, close)))
70
+ continue;
71
+ const esc = name.replace(/\$/g, '\\$');
72
+ const write = new RegExp(`\\b${esc}\\s*(?:\\[[^\\]]*\\]|\\.[\\w$]+)\\s*(?:=(?!=)|\\+=|\\|\\|=|\\?\\?=)` +
73
+ `|\\b${esc}\\s*\\.\\s*(?:push|unshift|splice|set|fill|copyWithin|reverse|sort)\\s*\\(` +
74
+ `|Object\\.(?:assign|defineProperty|defineProperties|setPrototypeOf)\\s*\\(\\s*${esc}\\b` +
75
+ `|\\bdelete\\s+${esc}\\b`);
76
+ if (write.test(code))
77
+ continue;
78
+ if (!onlyReadByLookup(code, name, m.index + m[0].indexOf(name, 5)))
79
+ continue;
80
+ out.add(name);
81
+ }
82
+ return out;
83
+ }
84
+ /** Writes or mutations through an element read: `[k] = v`, `[k].x = v`, `[k].push(v)`. */
85
+ const WRITE_THROUGH_RE = new RegExp(String.raw `^(?:\s*(?:\?\.\s*)?(?:\.\s*[\w$]+|\[[^\]]*\]))*\s*` +
86
+ String.raw `(?:=(?!=)|[-+*/%&|^]=|\+\+|--|\?\?=|\|\|=|&&=|\.\s*(?:push|unshift|splice|set|add|delete|clear|fill|copyWithin|reverse|sort)\s*\()`);
87
+ /**
88
+ * True when every use of `name` outside its declaration is a plain element
89
+ * read `name[k]` / `name?.[k]` that is not written or mutated through
90
+ * (`name[k] = v`, `name[k].x = v`, `name[k].push(v)`). Any other use — an
91
+ * alias (`const t = name`), a nested write (`name.items.push(v)`), a helper
92
+ * taking the table (`_.set(name, …)`) — may change the table's contents.
93
+ */
94
+ function onlyReadByLookup(code, name, declAt) {
95
+ const esc = name.replace(/\$/g, '\\$');
96
+ for (const m of code.matchAll(new RegExp(`(?<![\\w$.])${esc}(?![\\w$])`, 'g'))) {
97
+ if (m.index === declAt)
98
+ continue;
99
+ const rest = code.slice(m.index + name.length);
100
+ const open = /^\s*(?:\?\.)?\s*\[/.exec(rest);
101
+ if (!open)
102
+ return false;
103
+ const close = closeOf(rest, open[0].length - 1);
104
+ if (close < 0)
105
+ return false;
106
+ if (WRITE_THROUGH_RE.test(rest.slice(close)))
107
+ return false;
108
+ }
109
+ return true;
110
+ }
111
+ /**
112
+ * True when `rhs` is exactly `TABLE[<key>]` (optionally `TABLE?.[<key>]`) for
113
+ * a table in `tables`.
114
+ */
115
+ export function isConstTableLookup(rhs, tables) {
116
+ if (tables.size === 0)
117
+ return false;
118
+ const e = rhs.replace(/\s*\/\/.*$/, '').trim().replace(/;$/, '').trim();
119
+ const m = /^([A-Za-z_$][\w$]*)\s*(?:\?\.)?\s*\[/.exec(e);
120
+ if (!m || !tables.has(m[1]))
121
+ return false;
122
+ const close = closeOf(e, m[0].length - 1);
123
+ return close === e.length;
124
+ }
125
+ /** DFG def ids of locals initialised by a whole constant-table lookup. */
126
+ export function constTableLookupDefIds(defs, code, language) {
127
+ const out = new Set();
128
+ const tables = constLookupTables(code, language);
129
+ if (tables.size === 0)
130
+ return out;
131
+ const lines = code.split('\n');
132
+ for (const def of defs) {
133
+ if (def.kind !== 'local')
134
+ continue;
135
+ const text = lines[def.line - 1];
136
+ if (text === undefined)
137
+ continue;
138
+ const esc = def.variable.replace(/\$/g, '\\$');
139
+ const m = new RegExp(`^\\s*(?:(?:const|let|var)\\s+)?${esc}\\s*(?::[^=]+)?=(?!=)\\s*(.+)$`).exec(text);
140
+ if (m && isConstTableLookup(m[1], tables))
141
+ out.add(def.id);
142
+ }
143
+ return out;
144
+ }
145
+ //# sourceMappingURL=const-table-lookup.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"const-table-lookup.js","sourceRoot":"","sources":["../../src/analysis/const-table-lookup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,MAAM,cAAc,GAAG,kFAAkF,CAAC;AAE1G,SAAS,IAAI,CAAC,QAAgB;IAC5B,OAAO,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,CAAC;AAChE,CAAC;AAED,2FAA2F;AAC3F,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY;IACzC,MAAM,KAAK,GAA2B,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACvE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE;gBAAE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,CAAC,EAAE,CAAC;YACxE,CAAC,GAAG,CAAC,CAAC;YACN,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACjC,IAAI,EAAE,GAAG,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC;YACtB,CAAC,GAAG,EAAE,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IAC9D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,GAAG,CAAC;IAChC,MAAM,MAAM,GAAG,+EAA+E,CAAC;IAC/F,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACnB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS;QACxB,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,MAAM,CACtB,MAAM,GAAG,qEAAqE;YAC9E,OAAO,GAAG,4EAA4E;YACtF,iFAAiF,GAAG,KAAK;YACzF,iBAAiB,GAAG,KAAK,CAC1B,CAAC;QACF,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/B,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAAE,SAAS;QAC9E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0FAA0F;AAC1F,MAAM,gBAAgB,GAAG,IAAI,MAAM,CACjC,MAAM,CAAC,GAAG,CAAA,oDAAoD;IAC9D,MAAM,CAAC,GAAG,CAAA,oIAAoI,CAC/I,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,IAAY,EAAE,MAAc;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,eAAe,GAAG,YAAY,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAC/E,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;YAAE,SAAS;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAChD,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,MAA2B;IACzE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,MAAM,CAAC,GAAG,sCAAsC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1C,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC;AAC5B,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,sBAAsB,CAAC,IAAuB,EAAE,IAAY,EAAE,QAAgB;IAC5F,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,kCAAkC,GAAG,gCAAgC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvG,IAAI,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
@@ -1 +1 @@
1
- {"version":3,"file":"findings.d.ts","sourceRoot":"","sources":["../../src/analysis/findings.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,SAAS,EACT,cAAc,EACd,GAAG,EAIH,OAAO,EAEP,QAAQ,EACR,QAAQ,EACR,aAAa,EACd,MAAM,mBAAmB,CAAC;AAW3B;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EAAE,EACtB,KAAK,EAAE,SAAS,EAAE,EAClB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,EACjB,UAAU,GAAE,cAAc,EAAO,EACjC,KAAK,GAAE,QAAQ,EAAO,EACtB,QAAQ,CAAC,EAAE,aAAa,EAAE,GACzB,OAAO,EAAE,CAiZX;AAiCD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAiFlF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,EAC7C,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAaT"}
1
+ {"version":3,"file":"findings.d.ts","sourceRoot":"","sources":["../../src/analysis/findings.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,SAAS,EACT,cAAc,EACd,GAAG,EAIH,OAAO,EAEP,QAAQ,EACR,QAAQ,EACR,aAAa,EACd,MAAM,mBAAmB,CAAC;AAW3B;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EAAE,EACtB,KAAK,EAAE,SAAS,EAAE,EAClB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,EACjB,UAAU,GAAE,cAAc,EAAO,EACjC,KAAK,GAAE,QAAQ,EAAO,EACtB,QAAQ,CAAC,EAAE,aAAa,EAAE,GACzB,OAAO,EAAE,CA4ZX;AAiCD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAiFlF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,EAC7C,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAaT"}
@@ -194,10 +194,21 @@ export function generateFindings(sources, sinks, dfg, fileName, sourceCode, lang
194
194
  // Measured on Juliet C#, 1,658 such pairings — 1,338 of them
195
195
  // path_traversal, and every one findings-only with no flow behind it.
196
196
  //
197
- // Scoped to C#: the same rule wants its own measurement per language,
198
- // and #508's Java gate is a standing reminder of what skipping that
199
- // costs.
200
- if (language === 'csharp' &&
197
+ // Scoped to C# and, for Java, to request-derived sources (#387).
198
+ //
199
+ // Java's broader form was measured and rejected: on OWASP BenchmarkJava
200
+ // it also removed pairings whose "source" is a `file_input` / `db_input`
201
+ // read AFTER the sink (e.g. `is.read(b)` after the `Paths.get` it opened),
202
+ // and five `real=true` files (path_traversal, sql_injection) lost their
203
+ // only detection. Those pairings are coincidental, but they stand in for
204
+ // the SeparateClassRequest / helper-method flow the taint layer does not
205
+ // yet prove (#590), so removing them is a true-positive loss. A
206
+ // request-derived source (`http_*`) read after the sink can only reach it
207
+ // through a loop or a field, and both of those are flow-backed or
208
+ // exempted below, so that direction is safe to drop. Java
209
+ // `pref.setPath(request.getRequestURI())` after `new Cookie(n, v)` is the
210
+ // shape this removes.
211
+ if ((language === 'csharp' || (language === 'java' && source.type.startsWith('http_'))) &&
201
212
  flowsKnown &&
202
213
  source.line > sink.line &&
203
214
  !isFlowBacked(sink.type, sink.line) &&
@@ -1 +1 @@
1
- {"version":3,"file":"findings.js","sourceRoot":"","sources":["../../src/analysis/findings.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAgBH,OAAO,EACL,iBAAiB,IAAI,YAAY,EACjC,cAAc,EACd,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAsB,EACtB,KAAkB,EAClB,GAAQ,EACR,QAAgB,EAChB,UAAmB,EACnB,QAAiB,EACjB,UAAU,GAAqB,EAAE,EACjC,KAAK,GAAe,EAAE,EACtB,QAA0B;IAE1B,MAAM,KAAK,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,6EAA6E;IAC7E,uEAAuE;IACvE,iCAAiC;IACjC,0EAA0E;IAC1E,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,uEAAuE;IACvE,EAAE;IACF,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ;YAAE,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,QAAQ,KAAK,SAAS,CAAC;IAC1C,MAAM,YAAY,GAAG,CAAC,CAAS,EAAE,IAAY,EAAuB,EAAE,CACpE,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE/D,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,mEAAmE;IACnE,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,iEAAiE;IACjE,2EAA2E;IAC3E,sDAAsD;IACtD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC7D,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACjD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IACD,6EAA6E;IAC7E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAsB,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9C,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACzC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,QAAkB,EAAW,EAAE;QACnE,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,IAAI,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,eAAe,GAAG,CACtB,MAAmB,EACnB,IAAe,EACf,UAAsB,EACb,EAAE;QACX,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,gEAAgE;QAChE,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,wEAAwE;QACxE,0EAA0E;QAC1E,6EAA6E;QAC7E,2EAA2E;QAC3E,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YACxC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ;YACtD,CAAC,CAAC,SAAS,CAAC;QACd,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAClD,IAAI,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;gBAAE,SAAS;YAClD,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;gBAAE,SAAS;YAC9D,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YACnF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC9B,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,MAAM,CAAC,IAAI;oBAAE,SAAS;gBACvD,IAAI,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,IAAI,CAAC;YACnD,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,uEAAuE;IACvE,mEAAmE;IACnE,yEAAyE;IACzE,MAAM,YAAY,GAAG,CAAC,UAAU,IAAI,QAAQ,CAAC;QAC3C,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,yBAAyB,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC/E,CAAC,CAAC,OAAO,CAAC;IAEZ,4EAA4E;IAC5E,4EAA4E;IAC5E,+BAA+B;IAC/B,EAAE;IACF,sEAAsE;IACtE,sEAAsE;IACtE,EAAE;IACF,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,+CAA+C;IAC/C,EAAE;IACF,4EAA4E;IAC5E,sEAAsE;IACtE,yEAAyE;IACzE,4EAA4E;IAC5E,+BAA+B;IAC/B,MAAM,0BAA0B,GAAG,IAAI,GAAG,EAAU,CAAC;IACrD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC;QACxD,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,EAAE,CAAC,KAAK;gBAAE,SAAS;YACxB,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YAChE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YACjB,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,EAAE,CAAC,MAAM;gBAAE,SAAS;YACzB,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClD,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,iEAAiE;YACjE,wEAAwE;YACxE,oCAAoC;YACpC,IACE,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBACzC,IAAI,CAAC,MAAM,KAAK,SAAS;gBACzB,IAAI,CAAC,KAAK,KAAK,SAAS,EACxB,CAAC;gBACD,SAAS;YACX,CAAC;YACD,qDAAqD;YACrD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,SAAS;YACX,CAAC;YAED,qCAAqC;YACrC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAEpD,0EAA0E;YAC1E,mEAAmE;YACnE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,2DAA2D;YAC3D,EAAE;YACF,oEAAoE;YACpE,uEAAuE;YACvE,8CAA8C;YAC9C,EAAE;YACF,4EAA4E;YAC5E,oFAAoF;YACpF,EAAE;YACF,qEAAqE;YACrE,6DAA6D;YAC7D,sEAAsE;YACtE,EAAE;YACF,sEAAsE;YACtE,oEAAoE;YACpE,SAAS;YACT,IACE,QAAQ,KAAK,QAAQ;gBACrB,UAAU;gBACV,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI;gBACvB,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;gBACnC,MAAM,CAAC,IAAI,KAAK,uBAAuB;gBACvC,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EACrD,CAAC;gBACD,SAAS;YACX,CAAC;YAED,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,wEAAwE;YACxE,+DAA+D;YAC/D,EAAE;YACF,yEAAyE;YACzE,wEAAwE;YACxE,gEAAgE;YAChE,uDAAuD;YACvD,sEAAsE;YACtE,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,qEAAqE;YACrE,oEAAoE;YACpE,IACE,QAAQ,KAAK,QAAQ;gBACrB,UAAU;gBACV,sBAAsB,CAAC,IAAI,CAAC;gBAC5B,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EACnC,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,UAAU,CAAC,UAAU,IAAI,wBAAwB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC9F,uEAAuE;gBACvE,sEAAsE;gBACtE,gEAAgE;gBAChE,IAAI,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;oBAC9C,SAAS;gBACX,CAAC;gBACD,kEAAkE;gBAClE,8DAA8D;gBAC9D,uEAAuE;gBACvE,gEAAgE;gBAChE,+DAA+D;gBAC/D,wEAAwE;gBACxE,qEAAqE;gBACrE,wDAAwD;gBACxD,EAAE;gBACF,qEAAqE;gBACrE,oEAAoE;gBACpE,sEAAsE;gBACtE,qEAAqE;gBACrE,qDAAqD;gBACrD,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;gBACjE,MAAM,QAAQ,GAAG,YAAY,CAAC;oBAC5B,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,UAAU;iBACX,CAAC,CAAC;gBAEH,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,OAAO,SAAS,EAAE,EAAE;oBACxB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,QAAQ;oBACR,UAAU;oBACV,8DAA8D;oBAC9D,uDAAuD;oBACvD,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,MAAM,EAAE;wBACN,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,IAAI,EAAE,MAAM,CAAC,QAAQ;qBACtB;oBACD,IAAI,EAAE;wBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,IAAI,EAAE,IAAI,CAAC,QAAQ;qBACpB;oBACD,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;oBAC9D,WAAW,EAAE,UAAU,CAAC,UAAU,IAAI,UAAU,GAAG,GAAG;oBACtD,WAAW,EAAE,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC;oBAC1D,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;oBACtC,YAAY,EAAE;wBACZ,iBAAiB,EAAE,UAAU,CAAC,UAAU;wBACxC,WAAW,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;wBAC/C,YAAY,EAAE,KAAK;wBACnB,cAAc,EAAE,CAAC;wBACjB,eAAe,EAAE,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC;qBACtD;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,wBAAwB;IACxB,EAAE;IACF,oEAAoE;IACpE,yDAAyD;IACzD,EAAE;IACF,2EAA2E;IAC3E,sEAAsE;IACtE,EAAE;IACF,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,mDAAmD;IACnD,EAAE;IACF,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,uEAAuE;IACvE,8EAA8E;IAC9E,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,EAAE,CAAC,SAAS;YAAE,SAAS;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,0EAA0E;QAC1E,wEAAwE;QACxE,uEAAuE;QACvE,IACE,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YACzC,IAAI,CAAC,MAAM,KAAK,SAAS;YACzB,IAAI,CAAC,KAAK,KAAK,SAAS,EACxB,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,WAAW,CAAC;eACrD,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,WAAW,YAAY,EAAE,CAAC,WAAW,EAAE;gBAC7E,QAAQ,EAAE,MAAe,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC;QACpF,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAClG,qEAAqE;QACrE,MAAM,UAAU,GAAe;YAC7B,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,IAAe;YACrB,SAAS,EAAE,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;SAClE,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,OAAO,SAAS,EAAE,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,YAAY,CAAC;gBACrB,UAAU,EAAE,EAAE,CAAC,WAAW;gBAC1B,QAAQ,EAAE,EAAE,CAAC,SAAS;gBACtB,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,EAAE,CAAC,UAAU;aAC1B,CAAC;YACF,UAAU,EAAE,EAAE,CAAC,UAAU;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE;YAC1F,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,IAAgB,CAAC,CAAC,CAAC,SAAS;YACrD,WAAW,EAAE,EAAE,CAAC,UAAU,GAAG,GAAG;YAChC,WAAW,EAAE,mBAAmB,CAAC,GAAkB,EAAE,IAAI,EAAE,UAAU,CAAC;YACtE,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;YACtC,YAAY,EAAE;gBACZ,iBAAiB,EAAE,IAAI;gBACvB,uEAAuE;gBACvE,WAAW,EAAE,IAAI;gBACjB,YAAY,EAAE,KAAK;gBACnB,cAAc,EAAE,CAAC;gBACjB,eAAe,EAAE,sBAAsB,CAAC,GAAkB,EAAE,IAAI,CAAC;aAClE;YACD,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;IAChB,CAAC;IAED,oEAAoE;IACpE,mDAAmD;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,CAAC,CAAC,QAAQ,GAAG;gBACX,GAAG,CAAC,CAAC,QAAQ;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;aACxD,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,CAAE,QAAQ,CAAC,QAAQ,EAAE,OAAiD,IAAI,EAAE,CAAC,CAAC;YAC9F,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3D,QAAQ,CAAC,QAAQ,GAAG,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;YACtD,MAAM,eAAe,GAAG,oBAAoB,CAC1C,QAAQ,CAAC,YAAY,CAAC,eAAe,EACrC,CAAC,CAAC,YAAY,CAAC,eAAe,CAC/B,CAAC;YACF,IAAI,CAAC,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACvC,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;gBACnC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;gBAC3B,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACvB,QAAQ,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;gBACrC,QAAQ,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;gBACvC,QAAQ,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;gBACrC,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;YACjC,CAAC;YACD,QAAQ,CAAC,YAAY,CAAC,eAAe,GAAG,eAAe,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7C,kCAAkC;IAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAClE,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,YAAY,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC;QAC5C,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAC7B,MAAmB,EACnB,IAAe;IAEf,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,IAAI,QAAQ,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC;IAC7C,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IAC5B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,CAAyC,EACzC,CAAyC;IAEzC,MAAM,IAAI,GAAG,CAAC,IAAI,QAAQ,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,IAAI,QAAQ,CAAC;IAC5B,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,QAAkB;IACvE,MAAM,mBAAmB,GAA+B;QACtD,yEAAyE;QACzE,yFAAyF;QACzF,8DAA8D;QAC9D,yEAAyE;QACzE,gFAAgF;QAChF,6CAA6C;QAC7C,kFAAkF;QAClF,kCAAkC;QAClC,2FAA2F;QAC3F,wEAAwE;QACxE,oEAAoE;QACpE,wEAAwE;QACxE,0EAA0E;QAC1E,iEAAiE;QACjE,wEAAwE;QACxE,0EAA0E;QAC1E,2DAA2D;QAC3D,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,yEAAyE;QACzE,iDAAiD;QACjD,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,oEAAoE;QACpE,oEAAoE;QACpE,wEAAwE;QACxE,yEAAyE;QACzE,mEAAmE;QACnE,0EAA0E;QAC1E,6EAA6E;QAC7E,wEAAwE;QACxE,2EAA2E;QAC3E,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,4EAA4E;QAC5E,qEAAqE;QACrE,8EAA8E;QAC9E,yEAAyE;QACzE,8EAA8E;QAC9E,6EAA6E;QAC7E,+EAA+E;QAC/E,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,qEAAqE;QACrE,kEAAkE;QAClE,UAAU,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAClU,SAAS,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAClQ,WAAW,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAC1M,WAAW,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAClM,qEAAqE;QACrE,uEAAuE;QACvE,6DAA6D;QAC7D,mEAAmE;QACnE,oEAAoE;QACpE,oEAAoE;QACpE,SAAS,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,MAAM,EAAE,qBAAqB,EAAE,eAAe,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,CAAC;QAC7K,UAAU,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAC3Q,wEAAwE;QACxE,+DAA+D;QAC/D,wEAAwE;QACxE,+EAA+E;QAC/E,4DAA4D;QAC5D,QAAQ,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,CAAC;QAClK,SAAS,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;QAClD,QAAQ,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,eAAe,CAAC,EAAE,yBAAyB;QAC9E,UAAU,EAAE,CAAC,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,CAAC;QAC/F,aAAa,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAC7I,YAAY,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,CAAC,EAAE,sBAAsB;QAC/I,qBAAqB,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK,EAAE,iBAAiB,CAAC,EAAE,0WAA0W;QACzrB,YAAY,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,CAAC,EAAE,2BAA2B;KAC/J,CAAC;IAEF,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA6C,EAC7C,QAAkB;IAElB,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC7B,sDAAsD;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACxB,+DAA+D;QAC/D,8DAA8D;QAC9D,8DAA8D;QAC9D,2CAA2C;QAC3C,OAAO,QAAQ,KAAK,gBAAgB,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,sBAAsB,CAAC,IAAe;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACnC,yEAAyE;IACzE,2DAA2D;IAC3D,6DAA6D;IAC7D,OAAO,IAAI,MAAM,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,aAAa,CAAC,MAAmB,EAAE,IAAe,EAAE,GAAQ;IACnE,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,wCAAwC;IACxC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACrC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,CACvD,CAAC;IAEF,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACnC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,CACnD,CAAC;IAEF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACxD,CAAC;IAED,8BAA8B;IAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAEhC,yDAAyD;IACzD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,qBAAqB,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YAC9E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,uBAAuB;gBACvB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;oBACzB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;oBAC/C,IAAI,GAAG,EAAE,CAAC;wBACR,IAAI,CAAC,IAAI,CAAC;4BACR,IAAI,EAAE,EAAE,EAAE,2BAA2B;4BACrC,MAAM,EAAE,EAAE;4BACV,IAAI,EAAE,GAAG,CAAC,IAAI;4BACd,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,QAAQ;4BAC7B,QAAQ,EAAE,GAAG,CAAC,QAAQ;yBACvB,CAAC,CAAC;wBACH,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;oBAC/B,CAAC;gBACH,CAAC;gBAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,6DAA6D;IAC7D,EAAE;IACF,6EAA6E;IAC7E,6EAA6E;IAC7E,sEAAsE;IACtE,yEAAyE;IACzE,EAAE;IACF,kEAAkE;IAClE,8BAA8B;IAC9B,2DAA2D;IAC3D,uDAAuD;IACvD,QAAQ;IACR,EAAE;IACF,4EAA4E;IAC5E,sEAAsE;IACtE,0EAA0E;IAC1E,yEAAyE;IACzE,qEAAqE;IACrE,EAAE;IACF,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,yDAAyD;IACzD,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,4BAA4B;QAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAExD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,KAAK,MAAM,CAAC,QAAQ;gBAAE,SAAS;YACrE,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,EAAE;oBACR,MAAM,EAAE,EAAE;oBACV,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,IAAI,EAAE,GAAG,CAAC,aAAa;oBACvB,QAAQ,EAAE,CAAC;iBACZ,CAAC,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,EAAE;oBACR,MAAM,EAAE,EAAE;oBACV,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,IAAI,EAAE,QAAQ,CAAC,GAAG;oBAClB,QAAQ,EAAE,CAAC;iBACZ,CAAC,CAAC;gBACH,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAC5B,SAAiB,EACjB,OAAsB,EACtB,MAAkB,EAClB,GAAQ,EACR,OAAO,GAAgB,IAAI,GAAG,EAAE,EAChC,IAAI,GAAa,EAAE;IAEnB,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,CAAC,GAAG,IAAI,EAAE,SAAS,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAErB,uCAAuC;IACvC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAEpE,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QAC7F,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAcD;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,KAAiB;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YAC/B,IAAI,CAAC,EAAE,IAAI;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAiB;IAC1C,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;gBAAE,SAAS;YACjF,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iEAAiE;AACjE,SAAS,iBAAiB,CAAC,IAAY,EAAE,MAAqB;IAC5D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS,EAAE,MAAqB;IAC/D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,SAAS,wBAAwB,CAC/B,MAAmB,EACnB,IAAe,EACf,YAAY,GAAkB,EAAE,EAChC,UAAU,GAAgB,IAAI,GAAG,EAAE;IAEnC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IACzD,2EAA2E;IAC3E,qEAAqE;IACrE,EAAE;IACF,6FAA6F;IAC7F,+FAA+F;IAC/F,EAAE;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,0DAA0D;IAC1D,IAAI,MAAM,CAAC,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC7D,IAAI,WAAW,IAAI,SAAS,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;YACpF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAGD;;GAEG;AACH,SAAS,mBAAmB,CAAC,MAAmB,EAAE,IAAe,EAAE,UAAsB;IACvF,IAAI,UAAU,GAAG,GAAG,CAAC,CAAC,kBAAkB;IAExC,+BAA+B;IAC/B,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,UAAU,IAAI,GAAG,CAAC;IACpB,CAAC;IAED,0CAA0C;IAC1C,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,6BAA6B;IAC7B,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IAE9D,kBAAkB;IAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,UAAU,IAAI,GAAG,CAAC;IACpB,CAAC;SAAM,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1B,UAAU,IAAI,IAAI,CAAC;IACrB,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,MAAmB,EAAE,IAAe,EAAE,UAAsB;IACvF,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE/C,IAAI,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO,GAAG,UAAU,6BAA6B,IAAI,QAAQ,QAAQ,+BAA+B,CAAC;IACvG,CAAC;IAED,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,GAAG,UAAU,aAAa,QAAQ,+BAA+B,CAAC;IAC3E,CAAC;IAED,OAAO,GAAG,UAAU,cAAc,QAAQ,oCAAoC,CAAC;AACjF,CAAC"}
1
+ {"version":3,"file":"findings.js","sourceRoot":"","sources":["../../src/analysis/findings.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAgBH,OAAO,EACL,iBAAiB,IAAI,YAAY,EACjC,cAAc,EACd,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAsB,EACtB,KAAkB,EAClB,GAAQ,EACR,QAAgB,EAChB,UAAmB,EACnB,QAAiB,EACjB,UAAU,GAAqB,EAAE,EACjC,KAAK,GAAe,EAAE,EACtB,QAA0B;IAE1B,MAAM,KAAK,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,6EAA6E;IAC7E,uEAAuE;IACvE,iCAAiC;IACjC,0EAA0E;IAC1E,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,uEAAuE;IACvE,EAAE;IACF,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ;YAAE,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,QAAQ,KAAK,SAAS,CAAC;IAC1C,MAAM,YAAY,GAAG,CAAC,CAAS,EAAE,IAAY,EAAuB,EAAE,CACpE,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE/D,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,mEAAmE;IACnE,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,iEAAiE;IACjE,2EAA2E;IAC3E,sDAAsD;IACtD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC7D,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACjD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IACD,6EAA6E;IAC7E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAsB,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9C,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACzC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,QAAkB,EAAW,EAAE;QACnE,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,IAAI,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,eAAe,GAAG,CACtB,MAAmB,EACnB,IAAe,EACf,UAAsB,EACb,EAAE;QACX,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,gEAAgE;QAChE,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,wEAAwE;QACxE,0EAA0E;QAC1E,6EAA6E;QAC7E,2EAA2E;QAC3E,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YACxC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ;YACtD,CAAC,CAAC,SAAS,CAAC;QACd,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAClD,IAAI,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;gBAAE,SAAS;YAClD,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;gBAAE,SAAS;YAC9D,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YACnF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC9B,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,MAAM,CAAC,IAAI;oBAAE,SAAS;gBACvD,IAAI,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,IAAI,CAAC;YACnD,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,uEAAuE;IACvE,mEAAmE;IACnE,yEAAyE;IACzE,MAAM,YAAY,GAAG,CAAC,UAAU,IAAI,QAAQ,CAAC;QAC3C,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,yBAAyB,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC/E,CAAC,CAAC,OAAO,CAAC;IAEZ,4EAA4E;IAC5E,4EAA4E;IAC5E,+BAA+B;IAC/B,EAAE;IACF,sEAAsE;IACtE,sEAAsE;IACtE,EAAE;IACF,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,+CAA+C;IAC/C,EAAE;IACF,4EAA4E;IAC5E,sEAAsE;IACtE,yEAAyE;IACzE,4EAA4E;IAC5E,+BAA+B;IAC/B,MAAM,0BAA0B,GAAG,IAAI,GAAG,EAAU,CAAC;IACrD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC;QACxD,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,EAAE,CAAC,KAAK;gBAAE,SAAS;YACxB,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YAChE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YACjB,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,EAAE,CAAC,MAAM;gBAAE,SAAS;YACzB,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClD,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,iEAAiE;YACjE,wEAAwE;YACxE,oCAAoC;YACpC,IACE,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBACzC,IAAI,CAAC,MAAM,KAAK,SAAS;gBACzB,IAAI,CAAC,KAAK,KAAK,SAAS,EACxB,CAAC;gBACD,SAAS;YACX,CAAC;YACD,qDAAqD;YACrD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,SAAS;YACX,CAAC;YAED,qCAAqC;YACrC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAEpD,0EAA0E;YAC1E,mEAAmE;YACnE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,2DAA2D;YAC3D,EAAE;YACF,oEAAoE;YACpE,uEAAuE;YACvE,8CAA8C;YAC9C,EAAE;YACF,4EAA4E;YAC5E,oFAAoF;YACpF,EAAE;YACF,qEAAqE;YACrE,6DAA6D;YAC7D,sEAAsE;YACtE,EAAE;YACF,iEAAiE;YACjE,EAAE;YACF,wEAAwE;YACxE,yEAAyE;YACzE,2EAA2E;YAC3E,wEAAwE;YACxE,yEAAyE;YACzE,yEAAyE;YACzE,gEAAgE;YAChE,0EAA0E;YAC1E,kEAAkE;YAClE,0DAA0D;YAC1D,0EAA0E;YAC1E,sBAAsB;YACtB,IACE,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;gBACnF,UAAU;gBACV,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI;gBACvB,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;gBACnC,MAAM,CAAC,IAAI,KAAK,uBAAuB;gBACvC,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EACrD,CAAC;gBACD,SAAS;YACX,CAAC;YAED,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,wEAAwE;YACxE,+DAA+D;YAC/D,EAAE;YACF,yEAAyE;YACzE,wEAAwE;YACxE,gEAAgE;YAChE,uDAAuD;YACvD,sEAAsE;YACtE,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,qEAAqE;YACrE,oEAAoE;YACpE,IACE,QAAQ,KAAK,QAAQ;gBACrB,UAAU;gBACV,sBAAsB,CAAC,IAAI,CAAC;gBAC5B,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EACnC,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,UAAU,CAAC,UAAU,IAAI,wBAAwB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC9F,uEAAuE;gBACvE,sEAAsE;gBACtE,gEAAgE;gBAChE,IAAI,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;oBAC9C,SAAS;gBACX,CAAC;gBACD,kEAAkE;gBAClE,8DAA8D;gBAC9D,uEAAuE;gBACvE,gEAAgE;gBAChE,+DAA+D;gBAC/D,wEAAwE;gBACxE,qEAAqE;gBACrE,wDAAwD;gBACxD,EAAE;gBACF,qEAAqE;gBACrE,oEAAoE;gBACpE,sEAAsE;gBACtE,qEAAqE;gBACrE,qDAAqD;gBACrD,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;gBACjE,MAAM,QAAQ,GAAG,YAAY,CAAC;oBAC5B,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,UAAU;iBACX,CAAC,CAAC;gBAEH,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,OAAO,SAAS,EAAE,EAAE;oBACxB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,QAAQ;oBACR,UAAU;oBACV,8DAA8D;oBAC9D,uDAAuD;oBACvD,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,MAAM,EAAE;wBACN,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,IAAI,EAAE,MAAM,CAAC,QAAQ;qBACtB;oBACD,IAAI,EAAE;wBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,IAAI,EAAE,IAAI,CAAC,QAAQ;qBACpB;oBACD,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;oBAC9D,WAAW,EAAE,UAAU,CAAC,UAAU,IAAI,UAAU,GAAG,GAAG;oBACtD,WAAW,EAAE,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC;oBAC1D,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;oBACtC,YAAY,EAAE;wBACZ,iBAAiB,EAAE,UAAU,CAAC,UAAU;wBACxC,WAAW,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;wBAC/C,YAAY,EAAE,KAAK;wBACnB,cAAc,EAAE,CAAC;wBACjB,eAAe,EAAE,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC;qBACtD;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,wBAAwB;IACxB,EAAE;IACF,oEAAoE;IACpE,yDAAyD;IACzD,EAAE;IACF,2EAA2E;IAC3E,sEAAsE;IACtE,EAAE;IACF,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,mDAAmD;IACnD,EAAE;IACF,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,uEAAuE;IACvE,8EAA8E;IAC9E,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,EAAE,CAAC,SAAS;YAAE,SAAS;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,0EAA0E;QAC1E,wEAAwE;QACxE,uEAAuE;QACvE,IACE,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YACzC,IAAI,CAAC,MAAM,KAAK,SAAS;YACzB,IAAI,CAAC,KAAK,KAAK,SAAS,EACxB,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,WAAW,CAAC;eACrD,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,WAAW,YAAY,EAAE,CAAC,WAAW,EAAE;gBAC7E,QAAQ,EAAE,MAAe,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC;QACpF,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAClG,qEAAqE;QACrE,MAAM,UAAU,GAAe;YAC7B,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,IAAe;YACrB,SAAS,EAAE,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;SAClE,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,OAAO,SAAS,EAAE,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,YAAY,CAAC;gBACrB,UAAU,EAAE,EAAE,CAAC,WAAW;gBAC1B,QAAQ,EAAE,EAAE,CAAC,SAAS;gBACtB,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,EAAE,CAAC,UAAU;aAC1B,CAAC;YACF,UAAU,EAAE,EAAE,CAAC,UAAU;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE;YAC1F,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,IAAgB,CAAC,CAAC,CAAC,SAAS;YACrD,WAAW,EAAE,EAAE,CAAC,UAAU,GAAG,GAAG;YAChC,WAAW,EAAE,mBAAmB,CAAC,GAAkB,EAAE,IAAI,EAAE,UAAU,CAAC;YACtE,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;YACtC,YAAY,EAAE;gBACZ,iBAAiB,EAAE,IAAI;gBACvB,uEAAuE;gBACvE,WAAW,EAAE,IAAI;gBACjB,YAAY,EAAE,KAAK;gBACnB,cAAc,EAAE,CAAC;gBACjB,eAAe,EAAE,sBAAsB,CAAC,GAAkB,EAAE,IAAI,CAAC;aAClE;YACD,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;IAChB,CAAC;IAED,oEAAoE;IACpE,mDAAmD;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,CAAC,CAAC,QAAQ,GAAG;gBACX,GAAG,CAAC,CAAC,QAAQ;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;aACxD,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,CAAE,QAAQ,CAAC,QAAQ,EAAE,OAAiD,IAAI,EAAE,CAAC,CAAC;YAC9F,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3D,QAAQ,CAAC,QAAQ,GAAG,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;YACtD,MAAM,eAAe,GAAG,oBAAoB,CAC1C,QAAQ,CAAC,YAAY,CAAC,eAAe,EACrC,CAAC,CAAC,YAAY,CAAC,eAAe,CAC/B,CAAC;YACF,IAAI,CAAC,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACvC,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;gBACnC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;gBAC3B,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACvB,QAAQ,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;gBACrC,QAAQ,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;gBACvC,QAAQ,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;gBACrC,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;YACjC,CAAC;YACD,QAAQ,CAAC,YAAY,CAAC,eAAe,GAAG,eAAe,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7C,kCAAkC;IAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAClE,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,YAAY,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC;QAC5C,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAC7B,MAAmB,EACnB,IAAe;IAEf,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,IAAI,QAAQ,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC;IAC7C,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IAC5B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,CAAyC,EACzC,CAAyC;IAEzC,MAAM,IAAI,GAAG,CAAC,IAAI,QAAQ,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,IAAI,QAAQ,CAAC;IAC5B,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,QAAkB;IACvE,MAAM,mBAAmB,GAA+B;QACtD,yEAAyE;QACzE,yFAAyF;QACzF,8DAA8D;QAC9D,yEAAyE;QACzE,gFAAgF;QAChF,6CAA6C;QAC7C,kFAAkF;QAClF,kCAAkC;QAClC,2FAA2F;QAC3F,wEAAwE;QACxE,oEAAoE;QACpE,wEAAwE;QACxE,0EAA0E;QAC1E,iEAAiE;QACjE,wEAAwE;QACxE,0EAA0E;QAC1E,2DAA2D;QAC3D,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,yEAAyE;QACzE,iDAAiD;QACjD,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,oEAAoE;QACpE,oEAAoE;QACpE,wEAAwE;QACxE,yEAAyE;QACzE,mEAAmE;QACnE,0EAA0E;QAC1E,6EAA6E;QAC7E,wEAAwE;QACxE,2EAA2E;QAC3E,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,4EAA4E;QAC5E,qEAAqE;QACrE,8EAA8E;QAC9E,yEAAyE;QACzE,8EAA8E;QAC9E,6EAA6E;QAC7E,+EAA+E;QAC/E,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,qEAAqE;QACrE,kEAAkE;QAClE,UAAU,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAClU,SAAS,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAClQ,WAAW,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAC1M,WAAW,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAClM,qEAAqE;QACrE,uEAAuE;QACvE,6DAA6D;QAC7D,mEAAmE;QACnE,oEAAoE;QACpE,oEAAoE;QACpE,SAAS,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,MAAM,EAAE,qBAAqB,EAAE,eAAe,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,CAAC;QAC7K,UAAU,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAC3Q,wEAAwE;QACxE,+DAA+D;QAC/D,wEAAwE;QACxE,+EAA+E;QAC/E,4DAA4D;QAC5D,QAAQ,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,CAAC;QAClK,SAAS,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;QAClD,QAAQ,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,eAAe,CAAC,EAAE,yBAAyB;QAC9E,UAAU,EAAE,CAAC,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,CAAC;QAC/F,aAAa,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAC7I,YAAY,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,CAAC,EAAE,sBAAsB;QAC/I,qBAAqB,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK,EAAE,iBAAiB,CAAC,EAAE,0WAA0W;QACzrB,YAAY,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,CAAC,EAAE,2BAA2B;KAC/J,CAAC;IAEF,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA6C,EAC7C,QAAkB;IAElB,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC7B,sDAAsD;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACxB,+DAA+D;QAC/D,8DAA8D;QAC9D,8DAA8D;QAC9D,2CAA2C;QAC3C,OAAO,QAAQ,KAAK,gBAAgB,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,sBAAsB,CAAC,IAAe;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACnC,yEAAyE;IACzE,2DAA2D;IAC3D,6DAA6D;IAC7D,OAAO,IAAI,MAAM,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,aAAa,CAAC,MAAmB,EAAE,IAAe,EAAE,GAAQ;IACnE,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,wCAAwC;IACxC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACrC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,CACvD,CAAC;IAEF,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACnC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,CACnD,CAAC;IAEF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACxD,CAAC;IAED,8BAA8B;IAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAEhC,yDAAyD;IACzD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,qBAAqB,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YAC9E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,uBAAuB;gBACvB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;oBACzB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;oBAC/C,IAAI,GAAG,EAAE,CAAC;wBACR,IAAI,CAAC,IAAI,CAAC;4BACR,IAAI,EAAE,EAAE,EAAE,2BAA2B;4BACrC,MAAM,EAAE,EAAE;4BACV,IAAI,EAAE,GAAG,CAAC,IAAI;4BACd,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,QAAQ;4BAC7B,QAAQ,EAAE,GAAG,CAAC,QAAQ;yBACvB,CAAC,CAAC;wBACH,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;oBAC/B,CAAC;gBACH,CAAC;gBAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,6DAA6D;IAC7D,EAAE;IACF,6EAA6E;IAC7E,6EAA6E;IAC7E,sEAAsE;IACtE,yEAAyE;IACzE,EAAE;IACF,kEAAkE;IAClE,8BAA8B;IAC9B,2DAA2D;IAC3D,uDAAuD;IACvD,QAAQ;IACR,EAAE;IACF,4EAA4E;IAC5E,sEAAsE;IACtE,0EAA0E;IAC1E,yEAAyE;IACzE,qEAAqE;IACrE,EAAE;IACF,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,yDAAyD;IACzD,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,4BAA4B;QAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAExD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,KAAK,MAAM,CAAC,QAAQ;gBAAE,SAAS;YACrE,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,EAAE;oBACR,MAAM,EAAE,EAAE;oBACV,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,IAAI,EAAE,GAAG,CAAC,aAAa;oBACvB,QAAQ,EAAE,CAAC;iBACZ,CAAC,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,EAAE;oBACR,MAAM,EAAE,EAAE;oBACV,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,IAAI,EAAE,QAAQ,CAAC,GAAG;oBAClB,QAAQ,EAAE,CAAC;iBACZ,CAAC,CAAC;gBACH,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAC5B,SAAiB,EACjB,OAAsB,EACtB,MAAkB,EAClB,GAAQ,EACR,OAAO,GAAgB,IAAI,GAAG,EAAE,EAChC,IAAI,GAAa,EAAE;IAEnB,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,CAAC,GAAG,IAAI,EAAE,SAAS,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAErB,uCAAuC;IACvC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAEpE,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QAC7F,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAcD;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,KAAiB;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YAC/B,IAAI,CAAC,EAAE,IAAI;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAiB;IAC1C,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;gBAAE,SAAS;YACjF,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iEAAiE;AACjE,SAAS,iBAAiB,CAAC,IAAY,EAAE,MAAqB;IAC5D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS,EAAE,MAAqB;IAC/D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,SAAS,wBAAwB,CAC/B,MAAmB,EACnB,IAAe,EACf,YAAY,GAAkB,EAAE,EAChC,UAAU,GAAgB,IAAI,GAAG,EAAE;IAEnC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IACzD,2EAA2E;IAC3E,qEAAqE;IACrE,EAAE;IACF,6FAA6F;IAC7F,+FAA+F;IAC/F,EAAE;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,0DAA0D;IAC1D,IAAI,MAAM,CAAC,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC7D,IAAI,WAAW,IAAI,SAAS,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;YACpF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAGD;;GAEG;AACH,SAAS,mBAAmB,CAAC,MAAmB,EAAE,IAAe,EAAE,UAAsB;IACvF,IAAI,UAAU,GAAG,GAAG,CAAC,CAAC,kBAAkB;IAExC,+BAA+B;IAC/B,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,UAAU,IAAI,GAAG,CAAC;IACpB,CAAC;IAED,0CAA0C;IAC1C,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,6BAA6B;IAC7B,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IAE9D,kBAAkB;IAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,UAAU,IAAI,GAAG,CAAC;IACpB,CAAC;SAAM,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1B,UAAU,IAAI,IAAI,CAAC;IACrB,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,MAAmB,EAAE,IAAe,EAAE,UAAsB;IACvF,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE/C,IAAI,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO,GAAG,UAAU,6BAA6B,IAAI,QAAQ,QAAQ,+BAA+B,CAAC;IACvG,CAAC;IAED,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,GAAG,UAAU,aAAa,QAAQ,+BAA+B,CAAC;IAC3E,CAAC;IAED,OAAO,GAAG,UAAU,cAAc,QAAQ,oCAAoC,CAAC;AACjF,CAAC"}
@@ -0,0 +1,21 @@
1
+ /**
2
+ * Go `strings.NewReplacer(old1, new1, old2, new2, …).Replace(x)` sanitizer
3
+ * credit (cognium-dev#348, #293).
4
+ *
5
+ * The credit is argument-aware, like the Java replace credit:
6
+ * - `log_injection` when both "\r" and "\n" are replaced, each by a string
7
+ * that contains neither CR nor LF;
8
+ * - `xss` when both "<" and ">" are replaced by strings that contain
9
+ * neither.
10
+ * A replacer that maps only some of those characters earns nothing.
11
+ *
12
+ * A replacer is recognised inline (`strings.NewReplacer(...).Replace(x)`)
13
+ * and through a variable it is bound to (`var flat = strings.NewReplacer(...)`
14
+ * at package scope or `flat := strings.NewReplacer(...)` in a function), on
15
+ * every line that calls `<name>.Replace(`.
16
+ */
17
+ import type { SinkType, TaintSanitizer } from '../types/index.js';
18
+ /** Sink types a NewReplacer with these pairs neutralises. */
19
+ export declare function goReplacerCoverage(pairs: Array<[string, string]>): SinkType[];
20
+ export declare function findGoStringsReplacerSanitizers(code: string): TaintSanitizer[];
21
+ //# sourceMappingURL=go-strings-replacer.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"go-strings-replacer.d.ts","sourceRoot":"","sources":["../../src/analysis/go-strings-replacer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AA2BlE,6DAA6D;AAC7D,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,EAAE,CAO7E;AA0CD,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,CAkD9E"}
@@ -0,0 +1,145 @@
1
+ /** Decode one Go string literal (interpreted "…" or raw `…`); null when not a literal. */
2
+ function decodeGoLiteral(lit) {
3
+ if (lit.length >= 2 && lit.startsWith('`') && lit.endsWith('`'))
4
+ return lit.slice(1, -1);
5
+ if (lit.length < 2 || !lit.startsWith('"') || !lit.endsWith('"'))
6
+ return null;
7
+ return lit.slice(1, -1).replace(/\\(?:x([0-9a-fA-F]{2})|u([0-9a-fA-F]{4})|([abfnrtv\\"']))/g, (_m, hex, uni, c) => {
8
+ if (hex !== undefined)
9
+ return String.fromCharCode(parseInt(hex, 16));
10
+ if (uni !== undefined)
11
+ return String.fromCharCode(parseInt(uni, 16));
12
+ const map = { a: '\x07', b: '\b', f: '\f', n: '\n', r: '\r', t: '\t', v: '\v' };
13
+ return map[c] ?? c;
14
+ });
15
+ }
16
+ /** Split the argument list of a NewReplacer call into its literal operands; null if any is not a literal. */
17
+ function replacerPairs(args) {
18
+ const lits = args.match(/"(?:[^"\\]|\\.)*"|`[^`]*`/g) ?? [];
19
+ // Every comma-separated operand must be a literal.
20
+ const rest = args.replace(/"(?:[^"\\]|\\.)*"|`[^`]*`/g, '').replace(/[\s,]/g, '');
21
+ if (rest !== '' || lits.length === 0 || lits.length % 2 !== 0)
22
+ return null;
23
+ const decoded = lits.map(decodeGoLiteral);
24
+ if (decoded.some(d => d === null))
25
+ return null;
26
+ const pairs = [];
27
+ for (let i = 0; i < decoded.length; i += 2)
28
+ pairs.push([decoded[i], decoded[i + 1]]);
29
+ return pairs;
30
+ }
31
+ /** Sink types a NewReplacer with these pairs neutralises. */
32
+ export function goReplacerCoverage(pairs) {
33
+ const maps = (ch, banned) => pairs.some(([o, n]) => o === ch && !banned.test(n));
34
+ const out = [];
35
+ if (maps('\r', /[\r\n]/) && maps('\n', /[\r\n]/))
36
+ out.push('log_injection');
37
+ if (maps('<', /[<>]/) && maps('>', /[<>]/))
38
+ out.push('xss');
39
+ return out;
40
+ }
41
+ const NEW_REPLACER = /\bstrings\s*\.\s*NewReplacer\s*\(/g;
42
+ /** The balanced argument text of the call whose `(` is at `open`. */
43
+ function callArgs(text, open) {
44
+ let depth = 0;
45
+ let quote = null;
46
+ for (let i = open; i < text.length; i++) {
47
+ const c = text[i];
48
+ if (quote) {
49
+ if (c === '\\' && quote === '"')
50
+ i++;
51
+ else if (c === quote)
52
+ quote = null;
53
+ continue;
54
+ }
55
+ if (c === '"' || c === '`')
56
+ quote = c;
57
+ else if (c === '(')
58
+ depth++;
59
+ else if (c === ')' && --depth === 0)
60
+ return { args: text.slice(open + 1, i), end: i };
61
+ }
62
+ return null;
63
+ }
64
+ /**
65
+ * True when `lineText` is an assignment whose right-hand side holds an operand
66
+ * outside every `….Replace(…)` call (`msg := flat.Replace(a) + " " + b`). The
67
+ * credit is line-keyed, so it would also clean `b`; such a line earns none.
68
+ */
69
+ function assignmentHasRawOperand(lineText) {
70
+ const m = /^\s*(?:var\s+)?[A-Za-z_][\w\s,]*?:?=(?!=)(.*)$/.exec(lineText);
71
+ if (!m)
72
+ return false;
73
+ let rhs = m[1];
74
+ for (const re of [/\bstrings\s*\.\s*NewReplacer\s*\(/, /(?:\b[A-Za-z_]\w*\s*)?\.\s*Replace\s*\(/]) {
75
+ for (let r = re.exec(rhs); r; r = re.exec(rhs)) {
76
+ const call = callArgs(rhs, r.index + r[0].length - 1);
77
+ if (!call)
78
+ return true;
79
+ rhs = rhs.slice(0, r.index) + rhs.slice(call.end + 1);
80
+ }
81
+ }
82
+ rhs = rhs.replace(/"(?:[^"\\]|\\.)*"|`[^`]*`/g, '""');
83
+ return /\b[A-Za-z_]\w*\b(?!\s*[.(])/.test(rhs.replace(/\.\s*[A-Za-z_]\w*/g, ''));
84
+ }
85
+ export function findGoStringsReplacerSanitizers(code) {
86
+ const out = [];
87
+ const lineStarts = [0];
88
+ for (let i = 0; i < code.length; i++)
89
+ if (code[i] === '\n')
90
+ lineStarts.push(i + 1);
91
+ const lineAt = (idx) => {
92
+ let lo = 0, hi = lineStarts.length - 1;
93
+ while (lo < hi) {
94
+ const mid = (lo + hi + 1) >> 1;
95
+ if (lineStarts[mid] <= idx)
96
+ lo = mid;
97
+ else
98
+ hi = mid - 1;
99
+ }
100
+ return lo + 1;
101
+ };
102
+ // `method` names the call that does the replacing, so a sink-line credit
103
+ // covers only that call's operand (#641).
104
+ const lines = code.split('\n');
105
+ const emit = (line, sanitizes, method) => {
106
+ if (assignmentHasRawOperand(lines[line - 1] ?? ''))
107
+ return;
108
+ out.push({ type: 'go_strings_replacer', method, line, sanitizes });
109
+ };
110
+ const bound = new Map();
111
+ NEW_REPLACER.lastIndex = 0;
112
+ let m;
113
+ while ((m = NEW_REPLACER.exec(code)) !== null) {
114
+ const call = callArgs(code, m.index + m[0].length - 1);
115
+ if (!call)
116
+ continue;
117
+ const pairs = replacerPairs(call.args);
118
+ const covers = pairs ? goReplacerCoverage(pairs) : [];
119
+ const after = code.slice(call.end + 1);
120
+ if (/^\s*\.\s*Replace\s*\(/.test(after)) {
121
+ if (covers.length > 0)
122
+ emit(lineAt(m.index), covers, 'Replace()');
123
+ continue;
124
+ }
125
+ // Bound to a name: `name = strings.NewReplacer(` / `name := ...`.
126
+ const before = code.slice(code.lastIndexOf('\n', m.index) + 1, m.index);
127
+ const b = /(?:^|[\s(])([A-Za-z_]\w*)\s*:?=\s*$/.exec(before);
128
+ if (!b)
129
+ continue;
130
+ const name = b[1];
131
+ // A name rebound to a replacer that covers less loses the credit.
132
+ const prev = bound.get(name);
133
+ bound.set(name, prev ? prev.filter(t => covers.includes(t)) : covers);
134
+ }
135
+ for (const [name, covers] of bound) {
136
+ if (covers.length === 0)
137
+ continue;
138
+ const use = new RegExp(`(?<![\\w.])${name}\\s*\\.\\s*Replace\\s*\\(`, 'g');
139
+ let u;
140
+ while ((u = use.exec(code)) !== null)
141
+ emit(lineAt(u.index), covers, `${name}.Replace()`);
142
+ }
143
+ return out;
144
+ }
145
+ //# sourceMappingURL=go-strings-replacer.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"go-strings-replacer.js","sourceRoot":"","sources":["../../src/analysis/go-strings-replacer.ts"],"names":[],"mappings":"AAkBA,0FAA0F;AAC1F,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzF,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,4DAA4D,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QAChH,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QACrE,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QACrE,MAAM,GAAG,GAA2B,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;QACxG,OAAO,GAAG,CAAC,CAAW,CAAC,IAAK,CAAY,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6GAA6G;AAC7G,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,IAAI,EAAE,CAAC;IAC5D,mDAAmD;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAClF,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAW,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAW,CAAC,CAAC,CAAC;IACzG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,kBAAkB,CAAC,KAA8B;IAC/D,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,MAAc,EAAW,EAAE,CACnD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5E,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,YAAY,GAAG,oCAAoC,CAAC;AAE1D,qEAAqE;AACrE,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY;IAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC;iBAChC,IAAI,CAAC,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;YACnC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,GAAG,CAAC,CAAC;aACjC,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aACvB,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,MAAM,CAAC,GAAG,gDAAgD,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1E,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,CAAC,mCAAmC,EAAE,yCAAyC,CAAC,EAAE,CAAC;QAClG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACtD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,4BAA4B,EAAE,IAAI,CAAC,CAAC;IACtD,OAAO,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,IAAY;IAC1D,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC;IACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,CAAC,GAAW,EAAU,EAAE;QACrC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QACvC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,UAAU,CAAC,GAAG,CAAE,IAAI,GAAG;gBAAE,EAAE,GAAG,GAAG,CAAC;;gBAAM,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,EAAE,GAAG,CAAC,CAAC;IAChB,CAAC,CAAC;IACF,yEAAyE;IACzE,0CAA0C;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,SAAqB,EAAE,MAAc,EAAQ,EAAE;QACzE,IAAI,uBAAuB,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO;QAC3D,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,YAAY,CAAC,SAAS,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACvC,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QACD,kEAAkE;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,qCAAqC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACnB,kEAAkE;QAClE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAClC,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,cAAc,IAAI,2BAA2B,EAAE,GAAG,CAAC,CAAC;QAC3E,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
@@ -1 +1 @@
1
- {"version":3,"file":"interprocedural.d.ts","sourceRoot":"","sources":["../../src/analysis/interprocedural.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,QAAQ,EACR,QAAQ,EAER,GAAG,EAGH,WAAW,EACX,SAAS,EACT,cAAc,EAGf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,wCAAwC;IACxC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gCAAgC;IAChC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,wFAAwF;IACxF,uBAAuB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrC,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,eAAe,EAAE,SAAS,EAAE,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,oGAAoG;IACpG,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAChC;AA4HD,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,SAAS,GAAG,QAAQ,EAAE,EACpC,cAAc,EAAE,QAAQ,EAAE,GAAG,WAAW,EAAE,EAC1C,UAAU,EAAE,GAAG,GAAG,SAAS,EAAE,EAC7B,mBAAmB,EAAE,WAAW,EAAE,GAAG,cAAc,EAAE,EACrD,cAAc,CAAC,EAAE,SAAS,EAAE,GAAG,sBAAsB,EACrD,aAAa,CAAC,EAAE,cAAc,EAAE,EAChC,UAAU,GAAE,sBAA2B,GACtC,qBAAqB,CA2VvB;AAqTD;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,qBAAqB,GAAG;IACxE,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;CAC/B,CAOA;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAcnF;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAclG;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAezF;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAaxE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,GAAE,MAAU,GACnB,MAAM,EAAE,EAAE,CAmDZ"}
1
+ {"version":3,"file":"interprocedural.d.ts","sourceRoot":"","sources":["../../src/analysis/interprocedural.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,QAAQ,EACR,QAAQ,EAER,GAAG,EAGH,WAAW,EACX,SAAS,EACT,cAAc,EAGf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,wCAAwC;IACxC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gCAAgC;IAChC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,wFAAwF;IACxF,uBAAuB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrC,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,eAAe,EAAE,SAAS,EAAE,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,oGAAoG;IACpG,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAChC;AAsKD,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,SAAS,GAAG,QAAQ,EAAE,EACpC,cAAc,EAAE,QAAQ,EAAE,GAAG,WAAW,EAAE,EAC1C,UAAU,EAAE,GAAG,GAAG,SAAS,EAAE,EAC7B,mBAAmB,EAAE,WAAW,EAAE,GAAG,cAAc,EAAE,EACrD,cAAc,CAAC,EAAE,SAAS,EAAE,GAAG,sBAAsB,EACrD,aAAa,CAAC,EAAE,cAAc,EAAE,EAChC,UAAU,GAAE,sBAA2B,GACtC,qBAAqB,CAmWvB;AAqTD;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,qBAAqB,GAAG;IACxE,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;CAC/B,CAOA;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAcnF;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAclG;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAezF;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAaxE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,GAAE,MAAU,GACnB,MAAM,EAAE,EAAE,CAmDZ"}
@@ -104,6 +104,10 @@ const CSHARP_NON_ESCAPE_METHODS = new Set([
104
104
  // claim needing its own change.
105
105
  'Add', 'AddLast', 'AddFirst', 'AddRange', 'TryAdd', 'Insert', 'Push',
106
106
  'Enqueue',
107
+ // Collection lookups (cognium-dev#665). Using a value as a key into an
108
+ // in-memory map hands nothing out of the program; it is the allowlist
109
+ // shape (`if (!Catalog.TryGetValue(sku, out var price)) return …`).
110
+ 'TryGetValue', 'ContainsKey', 'ContainsValue', 'GetValueOrDefault',
107
111
  // Encoders (cognium-dev#518). Encoding a value hands back a string; nothing
108
112
  // has left the program at `Uri.EscapeDataString(input)`.
109
113
  'EscapeDataString', 'EscapeUriString', 'UrlEncode', 'UrlPathEncode',
@@ -116,8 +120,49 @@ function isCSharpNonEscapeCall(call) {
116
120
  return true;
117
121
  if (CSHARP_NON_ESCAPE_METHODS.has(name))
118
122
  return true;
123
+ // The inherited controller helper `Content(body, contentType)` writes the
124
+ // response body; the `Content` xss sink judges it by its content type
125
+ // (cognium-dev#580), so a plain-text or JSON body is not an escape either.
126
+ if (name === 'Content' && (call.receiver === null || call.receiver === 'this' || call.receiver === 'base'))
127
+ return true;
119
128
  return false;
120
129
  }
130
+ // Java (#468, slice): JDK exception / error types. Constructing one wraps the
131
+ // value into an object that has not left the program, the counterpart of the
132
+ // error-construction rows in the Go (#455) and C# (#474) gates. Loggers,
133
+ // formatters, StringBuilder and project-defined exception classes are NOT
134
+ // gated here: an unknown callee still escapes.
135
+ const JAVA_LANG_EXCEPTION_TYPES = new Set([
136
+ 'Exception', 'RuntimeException', 'IllegalArgumentException',
137
+ 'IllegalStateException', 'UnsupportedOperationException',
138
+ 'NullPointerException', 'IndexOutOfBoundsException', 'NumberFormatException',
139
+ 'Error', 'AssertionError',
140
+ ]);
141
+ function isJavaNonEscapeCall(call, declaredTypeNames) {
142
+ // Only a constructor call `new X(...)`: no receiver, and the resolved target
143
+ // is `X.<init>` (the extractor does not set `is_constructor` for Java).
144
+ if (call.receiver)
145
+ return false;
146
+ const isCtor = call.is_constructor === true ||
147
+ (call.resolution?.target ?? '').endsWith('.<init>');
148
+ if (!isCtor)
149
+ return false;
150
+ const written = call.method_name;
151
+ const simple = written.split('.').pop() ?? written;
152
+ // Fully-qualified spelling: only `java.lang.<X>`; anything else is a project
153
+ // or library class.
154
+ if (written.includes('.')) {
155
+ return written.startsWith('java.lang.') &&
156
+ (JAVA_LANG_EXCEPTION_TYPES.has(simple) || /(Exception|Error)$/.test(simple));
157
+ }
158
+ // An explicit import of the same simple name from another package, or a class
159
+ // declared in this file, shadows the java.lang type.
160
+ if (call.receiver_type_fqn && !call.receiver_type_fqn.startsWith('java.lang.'))
161
+ return false;
162
+ if (declaredTypeNames.has(simple))
163
+ return false;
164
+ return JAVA_LANG_EXCEPTION_TYPES.has(simple);
165
+ }
121
166
  function isGoNonEscapeCall(call) {
122
167
  const name = call.method_name;
123
168
  const recv = (call.receiver ?? '').split('.').pop() ?? '';
@@ -163,6 +208,7 @@ export function analyzeInterprocedural(graphOrTypes, callsOrSources, dfgOrSinks,
163
208
  }
164
209
  const types = graph.ir.types;
165
210
  const calls = graph.ir.calls;
211
+ const declaredTypeNames = new Set(types.map(t => t.name));
166
212
  // Build method nodes from type information
167
213
  const methodNodes = buildMethodNodes(types);
168
214
  // Build call graph edges with receiver type resolution
@@ -230,6 +276,9 @@ export function analyzeInterprocedural(graphOrTypes, callsOrSources, dfgOrSinks,
230
276
  'text', 'textContent', 'innerText', 'createTextNode',
231
277
  'addClass', 'removeClass', 'toggleClass',
232
278
  'parseInt', 'parseFloat', 'Number', 'String', 'Boolean',
279
+ // Pure serializers (JSON.stringify, qs/querystring.stringify) return a
280
+ // string to the caller; the value has not left the program (#670).
281
+ 'stringify',
233
282
  // I/O stream wrappers — pure decorators that wrap a stream, not security sinks
234
283
  // e.g. new InputStreamReader(proc.getInputStream()) is safe; the underlying stream is the source
235
284
  'InputStreamReader', 'OutputStreamWriter',
@@ -329,6 +378,10 @@ export function analyzeInterprocedural(graphOrTypes, callsOrSources, dfgOrSinks,
329
378
  if (graph.ir.meta.language === 'csharp' && isCSharpNonEscapeCall(call)) {
330
379
  continue;
331
380
  }
381
+ // Java — JDK exception construction (#468, minimal slice).
382
+ if (graph.ir.meta.language === 'java' && isJavaNonEscapeCall(call, declaredTypeNames)) {
383
+ continue;
384
+ }
332
385
  const bashSafeBuiltins = new Set([
333
386
  'echo', 'printf', 'test', '[', '[[', 'true', 'false', ':',
334
387
  'declare', 'local', 'export', 'readonly', 'typeset',