circle-ir 4.14.2 → 4.15.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/analysis/const-table-lookup.d.ts +29 -0
- package/dist/analysis/const-table-lookup.d.ts.map +1 -0
- package/dist/analysis/const-table-lookup.js +145 -0
- package/dist/analysis/const-table-lookup.js.map +1 -0
- package/dist/analysis/findings.d.ts.map +1 -1
- package/dist/analysis/findings.js +15 -4
- package/dist/analysis/findings.js.map +1 -1
- package/dist/analysis/go-strings-replacer.d.ts +21 -0
- package/dist/analysis/go-strings-replacer.d.ts.map +1 -0
- package/dist/analysis/go-strings-replacer.js +145 -0
- package/dist/analysis/go-strings-replacer.js.map +1 -0
- package/dist/analysis/interprocedural.d.ts.map +1 -1
- package/dist/analysis/interprocedural.js +53 -0
- package/dist/analysis/interprocedural.js.map +1 -1
- package/dist/analysis/java-canonical-prefix.d.ts +42 -0
- package/dist/analysis/java-canonical-prefix.d.ts.map +1 -0
- package/dist/analysis/java-canonical-prefix.js +145 -0
- package/dist/analysis/java-canonical-prefix.js.map +1 -0
- package/dist/analysis/java-crlf-strip.d.ts +30 -0
- package/dist/analysis/java-crlf-strip.d.ts.map +1 -0
- package/dist/analysis/java-crlf-strip.js +195 -0
- package/dist/analysis/java-crlf-strip.js.map +1 -0
- package/dist/analysis/passes/cleartext-credential-transport-pass.d.ts +2 -0
- package/dist/analysis/passes/cleartext-credential-transport-pass.d.ts.map +1 -1
- package/dist/analysis/passes/cleartext-credential-transport-pass.js +64 -12
- package/dist/analysis/passes/cleartext-credential-transport-pass.js.map +1 -1
- package/dist/analysis/passes/cross-file-pass.d.ts.map +1 -1
- package/dist/analysis/passes/cross-file-pass.js +43 -0
- package/dist/analysis/passes/cross-file-pass.js.map +1 -1
- package/dist/analysis/passes/csharp-sanitizer-credit.d.ts.map +1 -1
- package/dist/analysis/passes/csharp-sanitizer-credit.js +18 -0
- package/dist/analysis/passes/csharp-sanitizer-credit.js.map +1 -1
- package/dist/analysis/passes/interprocedural-pass.d.ts +28 -0
- package/dist/analysis/passes/interprocedural-pass.d.ts.map +1 -1
- package/dist/analysis/passes/interprocedural-pass.js +20 -1
- package/dist/analysis/passes/interprocedural-pass.js.map +1 -1
- package/dist/analysis/passes/language-sources-pass.d.ts +41 -2
- package/dist/analysis/passes/language-sources-pass.d.ts.map +1 -1
- package/dist/analysis/passes/language-sources-pass.js +842 -10
- package/dist/analysis/passes/language-sources-pass.js.map +1 -1
- package/dist/analysis/passes/param-source-flow-gate-pass.d.ts +8 -0
- package/dist/analysis/passes/param-source-flow-gate-pass.d.ts.map +1 -1
- package/dist/analysis/passes/param-source-flow-gate-pass.js +162 -6
- package/dist/analysis/passes/param-source-flow-gate-pass.js.map +1 -1
- package/dist/analysis/passes/sink-filter-pass.d.ts.map +1 -1
- package/dist/analysis/passes/sink-filter-pass.js +207 -1
- package/dist/analysis/passes/sink-filter-pass.js.map +1 -1
- package/dist/analysis/passes/taint-propagation-pass.d.ts.map +1 -1
- package/dist/analysis/passes/taint-propagation-pass.js +257 -2
- package/dist/analysis/passes/taint-propagation-pass.js.map +1 -1
- package/dist/analysis/scalar-derivation.d.ts +25 -0
- package/dist/analysis/scalar-derivation.d.ts.map +1 -0
- package/dist/analysis/scalar-derivation.js +196 -0
- package/dist/analysis/scalar-derivation.js.map +1 -0
- package/dist/analysis/taint-matcher.d.ts.map +1 -1
- package/dist/analysis/taint-matcher.js +167 -6
- package/dist/analysis/taint-matcher.js.map +1 -1
- package/dist/analysis/taint-propagation.d.ts.map +1 -1
- package/dist/analysis/taint-propagation.js +149 -19
- package/dist/analysis/taint-propagation.js.map +1 -1
- package/dist/analyzer.d.ts.map +1 -1
- package/dist/analyzer.js +7 -0
- package/dist/analyzer.js.map +1 -1
- package/dist/browser/circle-ir.js +3140 -1186
- package/dist/core/circle-ir-core.cjs +485 -27
- package/dist/core/circle-ir-core.js +485 -27
- package/dist/core/extractors/dfg.js +240 -6
- package/dist/core/extractors/dfg.js.map +1 -1
- package/dist/graph/code-graph.d.ts +9 -0
- package/dist/graph/code-graph.d.ts.map +1 -1
- package/dist/graph/code-graph.js +11 -0
- package/dist/graph/code-graph.js.map +1 -1
- package/dist/resolution/cross-file.d.ts +7 -0
- package/dist/resolution/cross-file.d.ts.map +1 -1
- package/dist/resolution/cross-file.js +10 -1
- package/dist/resolution/cross-file.js.map +1 -1
- package/dist/wasm/web-tree-sitter.wasm +0 -0
- package/package.json +3 -3
|
@@ -0,0 +1,29 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Constant-table lookup taint barrier (#667).
|
|
3
|
+
*
|
|
4
|
+
* `const handler = REGISTRY[req.query.mod]` selects one of the values the
|
|
5
|
+
* program itself wrote into `REGISTRY`. The request picks the key; it does not
|
|
6
|
+
* supply the value. When `REGISTRY` is a top-level `const` object or array
|
|
7
|
+
* literal that the file never writes to, the lookup result carries no request
|
|
8
|
+
* data, so it is neither a source nor a taint-carrying def.
|
|
9
|
+
*
|
|
10
|
+
* Proof comes from the file text alone, and anything short of it keeps the
|
|
11
|
+
* taint: a table declared with `let`, a table whose literal mentions a request
|
|
12
|
+
* object, a table the file assigns into, mutates or passes to `Object.assign`,
|
|
13
|
+
* and a lookup that is only part of the initializer (`T[k] || k`).
|
|
14
|
+
*/
|
|
15
|
+
import type { DFGDef } from '../types/index.js';
|
|
16
|
+
/**
|
|
17
|
+
* Names of top-level `const` tables — object or array literals, optionally
|
|
18
|
+
* wrapped in `Object.freeze(...)` — whose literal text references no request
|
|
19
|
+
* object and which the file never writes to.
|
|
20
|
+
*/
|
|
21
|
+
export declare function constLookupTables(code: string, language: string): Set<string>;
|
|
22
|
+
/**
|
|
23
|
+
* True when `rhs` is exactly `TABLE[<key>]` (optionally `TABLE?.[<key>]`) for
|
|
24
|
+
* a table in `tables`.
|
|
25
|
+
*/
|
|
26
|
+
export declare function isConstTableLookup(rhs: string, tables: ReadonlySet<string>): boolean;
|
|
27
|
+
/** DFG def ids of locals initialised by a whole constant-table lookup. */
|
|
28
|
+
export declare function constTableLookupDefIds(defs: readonly DFGDef[], code: string, language: string): Set<number>;
|
|
29
|
+
//# sourceMappingURL=const-table-lookup.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"const-table-lookup.d.ts","sourceRoot":"","sources":["../../src/analysis/const-table-lookup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAmChD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAsB7E;AA6BD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAOpF;AAED,0EAA0E;AAC1E,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAc3G"}
|
|
@@ -0,0 +1,145 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Constant-table lookup taint barrier (#667).
|
|
3
|
+
*
|
|
4
|
+
* `const handler = REGISTRY[req.query.mod]` selects one of the values the
|
|
5
|
+
* program itself wrote into `REGISTRY`. The request picks the key; it does not
|
|
6
|
+
* supply the value. When `REGISTRY` is a top-level `const` object or array
|
|
7
|
+
* literal that the file never writes to, the lookup result carries no request
|
|
8
|
+
* data, so it is neither a source nor a taint-carrying def.
|
|
9
|
+
*
|
|
10
|
+
* Proof comes from the file text alone, and anything short of it keeps the
|
|
11
|
+
* taint: a table declared with `let`, a table whose literal mentions a request
|
|
12
|
+
* object, a table the file assigns into, mutates or passes to `Object.assign`,
|
|
13
|
+
* and a lookup that is only part of the initializer (`T[k] || k`).
|
|
14
|
+
*/
|
|
15
|
+
const REQUEST_REF_RE = /\b(?:req|request|ctx|event|process|params|query|body|location|document|window)\b/;
|
|
16
|
+
function isJs(language) {
|
|
17
|
+
return language === 'javascript' || language === 'typescript';
|
|
18
|
+
}
|
|
19
|
+
/** Index just past the bracket closing the one at `open`, or -1. Skips string literals. */
|
|
20
|
+
function closeOf(text, open) {
|
|
21
|
+
const pairs = { '{': '}', '[': ']', '(': ')' };
|
|
22
|
+
const stack = [];
|
|
23
|
+
for (let i = open; i < text.length; i++) {
|
|
24
|
+
const c = text[i];
|
|
25
|
+
if (c === '"' || c === "'" || c === '`') {
|
|
26
|
+
let j = i + 1;
|
|
27
|
+
for (; j < text.length && text[j] !== c; j++)
|
|
28
|
+
if (text[j] === '\\')
|
|
29
|
+
j++;
|
|
30
|
+
i = j;
|
|
31
|
+
continue;
|
|
32
|
+
}
|
|
33
|
+
if (c === '/' && text[i + 1] === '/') {
|
|
34
|
+
const nl = text.indexOf('\n', i);
|
|
35
|
+
if (nl < 0)
|
|
36
|
+
return -1;
|
|
37
|
+
i = nl;
|
|
38
|
+
continue;
|
|
39
|
+
}
|
|
40
|
+
if (pairs[c]) {
|
|
41
|
+
stack.push(pairs[c]);
|
|
42
|
+
continue;
|
|
43
|
+
}
|
|
44
|
+
if (c === '}' || c === ']' || c === ')') {
|
|
45
|
+
if (stack.pop() !== c)
|
|
46
|
+
return -1;
|
|
47
|
+
if (stack.length === 0)
|
|
48
|
+
return i + 1;
|
|
49
|
+
}
|
|
50
|
+
}
|
|
51
|
+
return -1;
|
|
52
|
+
}
|
|
53
|
+
/**
|
|
54
|
+
* Names of top-level `const` tables — object or array literals, optionally
|
|
55
|
+
* wrapped in `Object.freeze(...)` — whose literal text references no request
|
|
56
|
+
* object and which the file never writes to.
|
|
57
|
+
*/
|
|
58
|
+
export function constLookupTables(code, language) {
|
|
59
|
+
const out = new Set();
|
|
60
|
+
if (!isJs(language))
|
|
61
|
+
return out;
|
|
62
|
+
const declRe = /^const\s+([A-Za-z_$][\w$]*)\s*(?::[^=\n]+)?=\s*(Object\.freeze\(\s*)?([{[])/gm;
|
|
63
|
+
for (const m of code.matchAll(declRe)) {
|
|
64
|
+
const name = m[1];
|
|
65
|
+
const open = m.index + m[0].length - 1;
|
|
66
|
+
const close = closeOf(code, open);
|
|
67
|
+
if (close < 0)
|
|
68
|
+
continue;
|
|
69
|
+
if (REQUEST_REF_RE.test(code.slice(open, close)))
|
|
70
|
+
continue;
|
|
71
|
+
const esc = name.replace(/\$/g, '\\$');
|
|
72
|
+
const write = new RegExp(`\\b${esc}\\s*(?:\\[[^\\]]*\\]|\\.[\\w$]+)\\s*(?:=(?!=)|\\+=|\\|\\|=|\\?\\?=)` +
|
|
73
|
+
`|\\b${esc}\\s*\\.\\s*(?:push|unshift|splice|set|fill|copyWithin|reverse|sort)\\s*\\(` +
|
|
74
|
+
`|Object\\.(?:assign|defineProperty|defineProperties|setPrototypeOf)\\s*\\(\\s*${esc}\\b` +
|
|
75
|
+
`|\\bdelete\\s+${esc}\\b`);
|
|
76
|
+
if (write.test(code))
|
|
77
|
+
continue;
|
|
78
|
+
if (!onlyReadByLookup(code, name, m.index + m[0].indexOf(name, 5)))
|
|
79
|
+
continue;
|
|
80
|
+
out.add(name);
|
|
81
|
+
}
|
|
82
|
+
return out;
|
|
83
|
+
}
|
|
84
|
+
/** Writes or mutations through an element read: `[k] = v`, `[k].x = v`, `[k].push(v)`. */
|
|
85
|
+
const WRITE_THROUGH_RE = new RegExp(String.raw `^(?:\s*(?:\?\.\s*)?(?:\.\s*[\w$]+|\[[^\]]*\]))*\s*` +
|
|
86
|
+
String.raw `(?:=(?!=)|[-+*/%&|^]=|\+\+|--|\?\?=|\|\|=|&&=|\.\s*(?:push|unshift|splice|set|add|delete|clear|fill|copyWithin|reverse|sort)\s*\()`);
|
|
87
|
+
/**
|
|
88
|
+
* True when every use of `name` outside its declaration is a plain element
|
|
89
|
+
* read `name[k]` / `name?.[k]` that is not written or mutated through
|
|
90
|
+
* (`name[k] = v`, `name[k].x = v`, `name[k].push(v)`). Any other use — an
|
|
91
|
+
* alias (`const t = name`), a nested write (`name.items.push(v)`), a helper
|
|
92
|
+
* taking the table (`_.set(name, …)`) — may change the table's contents.
|
|
93
|
+
*/
|
|
94
|
+
function onlyReadByLookup(code, name, declAt) {
|
|
95
|
+
const esc = name.replace(/\$/g, '\\$');
|
|
96
|
+
for (const m of code.matchAll(new RegExp(`(?<![\\w$.])${esc}(?![\\w$])`, 'g'))) {
|
|
97
|
+
if (m.index === declAt)
|
|
98
|
+
continue;
|
|
99
|
+
const rest = code.slice(m.index + name.length);
|
|
100
|
+
const open = /^\s*(?:\?\.)?\s*\[/.exec(rest);
|
|
101
|
+
if (!open)
|
|
102
|
+
return false;
|
|
103
|
+
const close = closeOf(rest, open[0].length - 1);
|
|
104
|
+
if (close < 0)
|
|
105
|
+
return false;
|
|
106
|
+
if (WRITE_THROUGH_RE.test(rest.slice(close)))
|
|
107
|
+
return false;
|
|
108
|
+
}
|
|
109
|
+
return true;
|
|
110
|
+
}
|
|
111
|
+
/**
|
|
112
|
+
* True when `rhs` is exactly `TABLE[<key>]` (optionally `TABLE?.[<key>]`) for
|
|
113
|
+
* a table in `tables`.
|
|
114
|
+
*/
|
|
115
|
+
export function isConstTableLookup(rhs, tables) {
|
|
116
|
+
if (tables.size === 0)
|
|
117
|
+
return false;
|
|
118
|
+
const e = rhs.replace(/\s*\/\/.*$/, '').trim().replace(/;$/, '').trim();
|
|
119
|
+
const m = /^([A-Za-z_$][\w$]*)\s*(?:\?\.)?\s*\[/.exec(e);
|
|
120
|
+
if (!m || !tables.has(m[1]))
|
|
121
|
+
return false;
|
|
122
|
+
const close = closeOf(e, m[0].length - 1);
|
|
123
|
+
return close === e.length;
|
|
124
|
+
}
|
|
125
|
+
/** DFG def ids of locals initialised by a whole constant-table lookup. */
|
|
126
|
+
export function constTableLookupDefIds(defs, code, language) {
|
|
127
|
+
const out = new Set();
|
|
128
|
+
const tables = constLookupTables(code, language);
|
|
129
|
+
if (tables.size === 0)
|
|
130
|
+
return out;
|
|
131
|
+
const lines = code.split('\n');
|
|
132
|
+
for (const def of defs) {
|
|
133
|
+
if (def.kind !== 'local')
|
|
134
|
+
continue;
|
|
135
|
+
const text = lines[def.line - 1];
|
|
136
|
+
if (text === undefined)
|
|
137
|
+
continue;
|
|
138
|
+
const esc = def.variable.replace(/\$/g, '\\$');
|
|
139
|
+
const m = new RegExp(`^\\s*(?:(?:const|let|var)\\s+)?${esc}\\s*(?::[^=]+)?=(?!=)\\s*(.+)$`).exec(text);
|
|
140
|
+
if (m && isConstTableLookup(m[1], tables))
|
|
141
|
+
out.add(def.id);
|
|
142
|
+
}
|
|
143
|
+
return out;
|
|
144
|
+
}
|
|
145
|
+
//# sourceMappingURL=const-table-lookup.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"const-table-lookup.js","sourceRoot":"","sources":["../../src/analysis/const-table-lookup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,MAAM,cAAc,GAAG,kFAAkF,CAAC;AAE1G,SAAS,IAAI,CAAC,QAAgB;IAC5B,OAAO,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,CAAC;AAChE,CAAC;AAED,2FAA2F;AAC3F,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY;IACzC,MAAM,KAAK,GAA2B,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACvE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE;gBAAE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,CAAC,EAAE,CAAC;YACxE,CAAC,GAAG,CAAC,CAAC;YACN,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACjC,IAAI,EAAE,GAAG,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC;YACtB,CAAC,GAAG,EAAE,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,IAAI,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC;YACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,QAAgB;IAC9D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,GAAG,CAAC;IAChC,MAAM,MAAM,GAAG,+EAA+E,CAAC;IAC/F,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACnB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS;QACxB,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,MAAM,CACtB,MAAM,GAAG,qEAAqE;YAC9E,OAAO,GAAG,4EAA4E;YACtF,iFAAiF,GAAG,KAAK;YACzF,iBAAiB,GAAG,KAAK,CAC1B,CAAC;QACF,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/B,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAAE,SAAS;QAC9E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0FAA0F;AAC1F,MAAM,gBAAgB,GAAG,IAAI,MAAM,CACjC,MAAM,CAAC,GAAG,CAAA,oDAAoD;IAC9D,MAAM,CAAC,GAAG,CAAA,oIAAoI,CAC/I,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,IAAY,EAAE,MAAc;IAClE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,eAAe,GAAG,YAAY,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAC/E,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;YAAE,SAAS;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAChD,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC7D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,MAA2B;IACzE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,MAAM,CAAC,GAAG,sCAAsC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1C,OAAO,KAAK,KAAK,CAAC,CAAC,MAAM,CAAC;AAC5B,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,sBAAsB,CAAC,IAAuB,EAAE,IAAY,EAAE,QAAgB;IAC5F,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,kCAAkC,GAAG,gCAAgC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvG,IAAI,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"findings.d.ts","sourceRoot":"","sources":["../../src/analysis/findings.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,SAAS,EACT,cAAc,EACd,GAAG,EAIH,OAAO,EAEP,QAAQ,EACR,QAAQ,EACR,aAAa,EACd,MAAM,mBAAmB,CAAC;AAW3B;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EAAE,EACtB,KAAK,EAAE,SAAS,EAAE,EAClB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,EACjB,UAAU,GAAE,cAAc,EAAO,EACjC,KAAK,GAAE,QAAQ,EAAO,EACtB,QAAQ,CAAC,EAAE,aAAa,EAAE,GACzB,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"findings.d.ts","sourceRoot":"","sources":["../../src/analysis/findings.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,SAAS,EACT,cAAc,EACd,GAAG,EAIH,OAAO,EAEP,QAAQ,EACR,QAAQ,EACR,aAAa,EACd,MAAM,mBAAmB,CAAC;AAW3B;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EAAE,EACtB,KAAK,EAAE,SAAS,EAAE,EAClB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,EACjB,UAAU,GAAE,cAAc,EAAO,EACjC,KAAK,GAAE,QAAQ,EAAO,EACtB,QAAQ,CAAC,EAAE,aAAa,EAAE,GACzB,OAAO,EAAE,CA4ZX;AAiCD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAiFlF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,EAC7C,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAaT"}
|
|
@@ -194,10 +194,21 @@ export function generateFindings(sources, sinks, dfg, fileName, sourceCode, lang
|
|
|
194
194
|
// Measured on Juliet C#, 1,658 such pairings — 1,338 of them
|
|
195
195
|
// path_traversal, and every one findings-only with no flow behind it.
|
|
196
196
|
//
|
|
197
|
-
// Scoped to C
|
|
198
|
-
//
|
|
199
|
-
//
|
|
200
|
-
|
|
197
|
+
// Scoped to C# and, for Java, to request-derived sources (#387).
|
|
198
|
+
//
|
|
199
|
+
// Java's broader form was measured and rejected: on OWASP BenchmarkJava
|
|
200
|
+
// it also removed pairings whose "source" is a `file_input` / `db_input`
|
|
201
|
+
// read AFTER the sink (e.g. `is.read(b)` after the `Paths.get` it opened),
|
|
202
|
+
// and five `real=true` files (path_traversal, sql_injection) lost their
|
|
203
|
+
// only detection. Those pairings are coincidental, but they stand in for
|
|
204
|
+
// the SeparateClassRequest / helper-method flow the taint layer does not
|
|
205
|
+
// yet prove (#590), so removing them is a true-positive loss. A
|
|
206
|
+
// request-derived source (`http_*`) read after the sink can only reach it
|
|
207
|
+
// through a loop or a field, and both of those are flow-backed or
|
|
208
|
+
// exempted below, so that direction is safe to drop. Java
|
|
209
|
+
// `pref.setPath(request.getRequestURI())` after `new Cookie(n, v)` is the
|
|
210
|
+
// shape this removes.
|
|
211
|
+
if ((language === 'csharp' || (language === 'java' && source.type.startsWith('http_'))) &&
|
|
201
212
|
flowsKnown &&
|
|
202
213
|
source.line > sink.line &&
|
|
203
214
|
!isFlowBacked(sink.type, sink.line) &&
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"findings.js","sourceRoot":"","sources":["../../src/analysis/findings.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAgBH,OAAO,EACL,iBAAiB,IAAI,YAAY,EACjC,cAAc,EACd,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAsB,EACtB,KAAkB,EAClB,GAAQ,EACR,QAAgB,EAChB,UAAmB,EACnB,QAAiB,EACjB,UAAU,GAAqB,EAAE,EACjC,KAAK,GAAe,EAAE,EACtB,QAA0B;IAE1B,MAAM,KAAK,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,6EAA6E;IAC7E,uEAAuE;IACvE,iCAAiC;IACjC,0EAA0E;IAC1E,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,uEAAuE;IACvE,EAAE;IACF,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ;YAAE,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,QAAQ,KAAK,SAAS,CAAC;IAC1C,MAAM,YAAY,GAAG,CAAC,CAAS,EAAE,IAAY,EAAuB,EAAE,CACpE,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE/D,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,mEAAmE;IACnE,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,iEAAiE;IACjE,2EAA2E;IAC3E,sDAAsD;IACtD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC7D,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACjD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IACD,6EAA6E;IAC7E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAsB,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9C,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACzC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,QAAkB,EAAW,EAAE;QACnE,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,IAAI,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,eAAe,GAAG,CACtB,MAAmB,EACnB,IAAe,EACf,UAAsB,EACb,EAAE;QACX,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,gEAAgE;QAChE,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,wEAAwE;QACxE,0EAA0E;QAC1E,6EAA6E;QAC7E,2EAA2E;QAC3E,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YACxC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ;YACtD,CAAC,CAAC,SAAS,CAAC;QACd,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAClD,IAAI,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;gBAAE,SAAS;YAClD,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;gBAAE,SAAS;YAC9D,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YACnF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC9B,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,MAAM,CAAC,IAAI;oBAAE,SAAS;gBACvD,IAAI,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,IAAI,CAAC;YACnD,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,uEAAuE;IACvE,mEAAmE;IACnE,yEAAyE;IACzE,MAAM,YAAY,GAAG,CAAC,UAAU,IAAI,QAAQ,CAAC;QAC3C,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,yBAAyB,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC/E,CAAC,CAAC,OAAO,CAAC;IAEZ,4EAA4E;IAC5E,4EAA4E;IAC5E,+BAA+B;IAC/B,EAAE;IACF,sEAAsE;IACtE,sEAAsE;IACtE,EAAE;IACF,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,+CAA+C;IAC/C,EAAE;IACF,4EAA4E;IAC5E,sEAAsE;IACtE,yEAAyE;IACzE,4EAA4E;IAC5E,+BAA+B;IAC/B,MAAM,0BAA0B,GAAG,IAAI,GAAG,EAAU,CAAC;IACrD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC;QACxD,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,EAAE,CAAC,KAAK;gBAAE,SAAS;YACxB,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YAChE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YACjB,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,EAAE,CAAC,MAAM;gBAAE,SAAS;YACzB,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClD,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,iEAAiE;YACjE,wEAAwE;YACxE,oCAAoC;YACpC,IACE,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBACzC,IAAI,CAAC,MAAM,KAAK,SAAS;gBACzB,IAAI,CAAC,KAAK,KAAK,SAAS,EACxB,CAAC;gBACD,SAAS;YACX,CAAC;YACD,qDAAqD;YACrD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,SAAS;YACX,CAAC;YAED,qCAAqC;YACrC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAEpD,0EAA0E;YAC1E,mEAAmE;YACnE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,2DAA2D;YAC3D,EAAE;YACF,oEAAoE;YACpE,uEAAuE;YACvE,8CAA8C;YAC9C,EAAE;YACF,4EAA4E;YAC5E,oFAAoF;YACpF,EAAE;YACF,qEAAqE;YACrE,6DAA6D;YAC7D,sEAAsE;YACtE,EAAE;YACF,sEAAsE;YACtE,oEAAoE;YACpE,SAAS;YACT,IACE,QAAQ,KAAK,QAAQ;gBACrB,UAAU;gBACV,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI;gBACvB,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;gBACnC,MAAM,CAAC,IAAI,KAAK,uBAAuB;gBACvC,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EACrD,CAAC;gBACD,SAAS;YACX,CAAC;YAED,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,wEAAwE;YACxE,+DAA+D;YAC/D,EAAE;YACF,yEAAyE;YACzE,wEAAwE;YACxE,gEAAgE;YAChE,uDAAuD;YACvD,sEAAsE;YACtE,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,qEAAqE;YACrE,oEAAoE;YACpE,IACE,QAAQ,KAAK,QAAQ;gBACrB,UAAU;gBACV,sBAAsB,CAAC,IAAI,CAAC;gBAC5B,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EACnC,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,UAAU,CAAC,UAAU,IAAI,wBAAwB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC9F,uEAAuE;gBACvE,sEAAsE;gBACtE,gEAAgE;gBAChE,IAAI,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;oBAC9C,SAAS;gBACX,CAAC;gBACD,kEAAkE;gBAClE,8DAA8D;gBAC9D,uEAAuE;gBACvE,gEAAgE;gBAChE,+DAA+D;gBAC/D,wEAAwE;gBACxE,qEAAqE;gBACrE,wDAAwD;gBACxD,EAAE;gBACF,qEAAqE;gBACrE,oEAAoE;gBACpE,sEAAsE;gBACtE,qEAAqE;gBACrE,qDAAqD;gBACrD,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;gBACjE,MAAM,QAAQ,GAAG,YAAY,CAAC;oBAC5B,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,UAAU;iBACX,CAAC,CAAC;gBAEH,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,OAAO,SAAS,EAAE,EAAE;oBACxB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,QAAQ;oBACR,UAAU;oBACV,8DAA8D;oBAC9D,uDAAuD;oBACvD,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,MAAM,EAAE;wBACN,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,IAAI,EAAE,MAAM,CAAC,QAAQ;qBACtB;oBACD,IAAI,EAAE;wBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,IAAI,EAAE,IAAI,CAAC,QAAQ;qBACpB;oBACD,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;oBAC9D,WAAW,EAAE,UAAU,CAAC,UAAU,IAAI,UAAU,GAAG,GAAG;oBACtD,WAAW,EAAE,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC;oBAC1D,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;oBACtC,YAAY,EAAE;wBACZ,iBAAiB,EAAE,UAAU,CAAC,UAAU;wBACxC,WAAW,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;wBAC/C,YAAY,EAAE,KAAK;wBACnB,cAAc,EAAE,CAAC;wBACjB,eAAe,EAAE,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC;qBACtD;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,wBAAwB;IACxB,EAAE;IACF,oEAAoE;IACpE,yDAAyD;IACzD,EAAE;IACF,2EAA2E;IAC3E,sEAAsE;IACtE,EAAE;IACF,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,mDAAmD;IACnD,EAAE;IACF,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,uEAAuE;IACvE,8EAA8E;IAC9E,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,EAAE,CAAC,SAAS;YAAE,SAAS;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,0EAA0E;QAC1E,wEAAwE;QACxE,uEAAuE;QACvE,IACE,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YACzC,IAAI,CAAC,MAAM,KAAK,SAAS;YACzB,IAAI,CAAC,KAAK,KAAK,SAAS,EACxB,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,WAAW,CAAC;eACrD,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,WAAW,YAAY,EAAE,CAAC,WAAW,EAAE;gBAC7E,QAAQ,EAAE,MAAe,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC;QACpF,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAClG,qEAAqE;QACrE,MAAM,UAAU,GAAe;YAC7B,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,IAAe;YACrB,SAAS,EAAE,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;SAClE,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,OAAO,SAAS,EAAE,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,YAAY,CAAC;gBACrB,UAAU,EAAE,EAAE,CAAC,WAAW;gBAC1B,QAAQ,EAAE,EAAE,CAAC,SAAS;gBACtB,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,EAAE,CAAC,UAAU;aAC1B,CAAC;YACF,UAAU,EAAE,EAAE,CAAC,UAAU;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE;YAC1F,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,IAAgB,CAAC,CAAC,CAAC,SAAS;YACrD,WAAW,EAAE,EAAE,CAAC,UAAU,GAAG,GAAG;YAChC,WAAW,EAAE,mBAAmB,CAAC,GAAkB,EAAE,IAAI,EAAE,UAAU,CAAC;YACtE,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;YACtC,YAAY,EAAE;gBACZ,iBAAiB,EAAE,IAAI;gBACvB,uEAAuE;gBACvE,WAAW,EAAE,IAAI;gBACjB,YAAY,EAAE,KAAK;gBACnB,cAAc,EAAE,CAAC;gBACjB,eAAe,EAAE,sBAAsB,CAAC,GAAkB,EAAE,IAAI,CAAC;aAClE;YACD,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;IAChB,CAAC;IAED,oEAAoE;IACpE,mDAAmD;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,CAAC,CAAC,QAAQ,GAAG;gBACX,GAAG,CAAC,CAAC,QAAQ;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;aACxD,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,CAAE,QAAQ,CAAC,QAAQ,EAAE,OAAiD,IAAI,EAAE,CAAC,CAAC;YAC9F,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3D,QAAQ,CAAC,QAAQ,GAAG,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;YACtD,MAAM,eAAe,GAAG,oBAAoB,CAC1C,QAAQ,CAAC,YAAY,CAAC,eAAe,EACrC,CAAC,CAAC,YAAY,CAAC,eAAe,CAC/B,CAAC;YACF,IAAI,CAAC,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACvC,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;gBACnC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;gBAC3B,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACvB,QAAQ,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;gBACrC,QAAQ,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;gBACvC,QAAQ,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;gBACrC,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;YACjC,CAAC;YACD,QAAQ,CAAC,YAAY,CAAC,eAAe,GAAG,eAAe,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7C,kCAAkC;IAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAClE,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,YAAY,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC;QAC5C,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAC7B,MAAmB,EACnB,IAAe;IAEf,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,IAAI,QAAQ,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC;IAC7C,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IAC5B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,CAAyC,EACzC,CAAyC;IAEzC,MAAM,IAAI,GAAG,CAAC,IAAI,QAAQ,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,IAAI,QAAQ,CAAC;IAC5B,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,QAAkB;IACvE,MAAM,mBAAmB,GAA+B;QACtD,yEAAyE;QACzE,yFAAyF;QACzF,8DAA8D;QAC9D,yEAAyE;QACzE,gFAAgF;QAChF,6CAA6C;QAC7C,kFAAkF;QAClF,kCAAkC;QAClC,2FAA2F;QAC3F,wEAAwE;QACxE,oEAAoE;QACpE,wEAAwE;QACxE,0EAA0E;QAC1E,iEAAiE;QACjE,wEAAwE;QACxE,0EAA0E;QAC1E,2DAA2D;QAC3D,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,yEAAyE;QACzE,iDAAiD;QACjD,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,oEAAoE;QACpE,oEAAoE;QACpE,wEAAwE;QACxE,yEAAyE;QACzE,mEAAmE;QACnE,0EAA0E;QAC1E,6EAA6E;QAC7E,wEAAwE;QACxE,2EAA2E;QAC3E,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,4EAA4E;QAC5E,qEAAqE;QACrE,8EAA8E;QAC9E,yEAAyE;QACzE,8EAA8E;QAC9E,6EAA6E;QAC7E,+EAA+E;QAC/E,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,qEAAqE;QACrE,kEAAkE;QAClE,UAAU,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAClU,SAAS,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAClQ,WAAW,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAC1M,WAAW,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAClM,qEAAqE;QACrE,uEAAuE;QACvE,6DAA6D;QAC7D,mEAAmE;QACnE,oEAAoE;QACpE,oEAAoE;QACpE,SAAS,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,MAAM,EAAE,qBAAqB,EAAE,eAAe,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,CAAC;QAC7K,UAAU,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAC3Q,wEAAwE;QACxE,+DAA+D;QAC/D,wEAAwE;QACxE,+EAA+E;QAC/E,4DAA4D;QAC5D,QAAQ,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,CAAC;QAClK,SAAS,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;QAClD,QAAQ,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,eAAe,CAAC,EAAE,yBAAyB;QAC9E,UAAU,EAAE,CAAC,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,CAAC;QAC/F,aAAa,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAC7I,YAAY,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,CAAC,EAAE,sBAAsB;QAC/I,qBAAqB,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK,EAAE,iBAAiB,CAAC,EAAE,0WAA0W;QACzrB,YAAY,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,CAAC,EAAE,2BAA2B;KAC/J,CAAC;IAEF,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA6C,EAC7C,QAAkB;IAElB,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC7B,sDAAsD;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACxB,+DAA+D;QAC/D,8DAA8D;QAC9D,8DAA8D;QAC9D,2CAA2C;QAC3C,OAAO,QAAQ,KAAK,gBAAgB,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,sBAAsB,CAAC,IAAe;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACnC,yEAAyE;IACzE,2DAA2D;IAC3D,6DAA6D;IAC7D,OAAO,IAAI,MAAM,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,aAAa,CAAC,MAAmB,EAAE,IAAe,EAAE,GAAQ;IACnE,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,wCAAwC;IACxC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACrC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,CACvD,CAAC;IAEF,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACnC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,CACnD,CAAC;IAEF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACxD,CAAC;IAED,8BAA8B;IAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAEhC,yDAAyD;IACzD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,qBAAqB,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YAC9E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,uBAAuB;gBACvB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;oBACzB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;oBAC/C,IAAI,GAAG,EAAE,CAAC;wBACR,IAAI,CAAC,IAAI,CAAC;4BACR,IAAI,EAAE,EAAE,EAAE,2BAA2B;4BACrC,MAAM,EAAE,EAAE;4BACV,IAAI,EAAE,GAAG,CAAC,IAAI;4BACd,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,QAAQ;4BAC7B,QAAQ,EAAE,GAAG,CAAC,QAAQ;yBACvB,CAAC,CAAC;wBACH,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;oBAC/B,CAAC;gBACH,CAAC;gBAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,6DAA6D;IAC7D,EAAE;IACF,6EAA6E;IAC7E,6EAA6E;IAC7E,sEAAsE;IACtE,yEAAyE;IACzE,EAAE;IACF,kEAAkE;IAClE,8BAA8B;IAC9B,2DAA2D;IAC3D,uDAAuD;IACvD,QAAQ;IACR,EAAE;IACF,4EAA4E;IAC5E,sEAAsE;IACtE,0EAA0E;IAC1E,yEAAyE;IACzE,qEAAqE;IACrE,EAAE;IACF,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,yDAAyD;IACzD,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,4BAA4B;QAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAExD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,KAAK,MAAM,CAAC,QAAQ;gBAAE,SAAS;YACrE,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,EAAE;oBACR,MAAM,EAAE,EAAE;oBACV,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,IAAI,EAAE,GAAG,CAAC,aAAa;oBACvB,QAAQ,EAAE,CAAC;iBACZ,CAAC,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,EAAE;oBACR,MAAM,EAAE,EAAE;oBACV,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,IAAI,EAAE,QAAQ,CAAC,GAAG;oBAClB,QAAQ,EAAE,CAAC;iBACZ,CAAC,CAAC;gBACH,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAC5B,SAAiB,EACjB,OAAsB,EACtB,MAAkB,EAClB,GAAQ,EACR,OAAO,GAAgB,IAAI,GAAG,EAAE,EAChC,IAAI,GAAa,EAAE;IAEnB,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,CAAC,GAAG,IAAI,EAAE,SAAS,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAErB,uCAAuC;IACvC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAEpE,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QAC7F,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAcD;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,KAAiB;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YAC/B,IAAI,CAAC,EAAE,IAAI;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAiB;IAC1C,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;gBAAE,SAAS;YACjF,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iEAAiE;AACjE,SAAS,iBAAiB,CAAC,IAAY,EAAE,MAAqB;IAC5D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS,EAAE,MAAqB;IAC/D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,SAAS,wBAAwB,CAC/B,MAAmB,EACnB,IAAe,EACf,YAAY,GAAkB,EAAE,EAChC,UAAU,GAAgB,IAAI,GAAG,EAAE;IAEnC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IACzD,2EAA2E;IAC3E,qEAAqE;IACrE,EAAE;IACF,6FAA6F;IAC7F,+FAA+F;IAC/F,EAAE;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,0DAA0D;IAC1D,IAAI,MAAM,CAAC,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC7D,IAAI,WAAW,IAAI,SAAS,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;YACpF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAGD;;GAEG;AACH,SAAS,mBAAmB,CAAC,MAAmB,EAAE,IAAe,EAAE,UAAsB;IACvF,IAAI,UAAU,GAAG,GAAG,CAAC,CAAC,kBAAkB;IAExC,+BAA+B;IAC/B,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,UAAU,IAAI,GAAG,CAAC;IACpB,CAAC;IAED,0CAA0C;IAC1C,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,6BAA6B;IAC7B,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IAE9D,kBAAkB;IAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,UAAU,IAAI,GAAG,CAAC;IACpB,CAAC;SAAM,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1B,UAAU,IAAI,IAAI,CAAC;IACrB,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,MAAmB,EAAE,IAAe,EAAE,UAAsB;IACvF,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE/C,IAAI,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO,GAAG,UAAU,6BAA6B,IAAI,QAAQ,QAAQ,+BAA+B,CAAC;IACvG,CAAC;IAED,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,GAAG,UAAU,aAAa,QAAQ,+BAA+B,CAAC;IAC3E,CAAC;IAED,OAAO,GAAG,UAAU,cAAc,QAAQ,oCAAoC,CAAC;AACjF,CAAC"}
|
|
1
|
+
{"version":3,"file":"findings.js","sourceRoot":"","sources":["../../src/analysis/findings.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAgBH,OAAO,EACL,iBAAiB,IAAI,YAAY,EACjC,cAAc,EACd,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAsB,EACtB,KAAkB,EAClB,GAAQ,EACR,QAAgB,EAChB,UAAmB,EACnB,QAAiB,EACjB,UAAU,GAAqB,EAAE,EACjC,KAAK,GAAe,EAAE,EACtB,QAA0B;IAE1B,MAAM,KAAK,GAAG,QAAQ,IAAI,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,6EAA6E;IAC7E,uEAAuE;IACvE,iCAAiC;IACjC,0EAA0E;IAC1E,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,uEAAuE;IACvE,EAAE;IACF,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,OAAO,EAAE,CAAC,SAAS,KAAK,QAAQ;YAAE,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,UAAU,GAAG,QAAQ,KAAK,SAAS,CAAC;IAC1C,MAAM,YAAY,GAAG,CAAC,CAAS,EAAE,IAAY,EAAuB,EAAE,CACpE,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE/D,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,mEAAmE;IACnE,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,iEAAiE;IACjE,2EAA2E;IAC3E,sDAAsD;IACtD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4B,CAAC;IAC7D,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACjD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IACD,6EAA6E;IAC7E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAsB,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9C,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACzC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,QAAkB,EAAW,EAAE;QACnE,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,IAAI,mBAAmB,CAAC,GAAG,EAAE,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,eAAe,GAAG,CACtB,MAAmB,EACnB,IAAe,EACf,UAAsB,EACb,EAAE;QACX,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1C,gEAAgE;QAChE,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,wEAAwE;QACxE,0EAA0E;QAC1E,6EAA6E;QAC7E,2EAA2E;QAC3E,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YACxC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ;YACtD,CAAC,CAAC,SAAS,CAAC;QACd,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAClD,IAAI,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;gBAAE,SAAS;YAClD,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;gBAAE,SAAS;YAC9D,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YACnF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC9B,IAAI,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,GAAG,MAAM,CAAC,IAAI;oBAAE,SAAS;gBACvD,IAAI,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;oBAAE,OAAO,IAAI,CAAC;YACnD,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,uEAAuE;IACvE,mEAAmE;IACnE,yEAAyE;IACzE,MAAM,YAAY,GAAG,CAAC,UAAU,IAAI,QAAQ,CAAC;QAC3C,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,yBAAyB,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC/E,CAAC,CAAC,OAAO,CAAC;IAEZ,4EAA4E;IAC5E,4EAA4E;IAC5E,+BAA+B;IAC/B,EAAE;IACF,sEAAsE;IACtE,sEAAsE;IACtE,EAAE;IACF,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,+CAA+C;IAC/C,EAAE;IACF,4EAA4E;IAC5E,sEAAsE;IACtE,yEAAyE;IACzE,4EAA4E;IAC5E,+BAA+B;IAC/B,MAAM,0BAA0B,GAAG,IAAI,GAAG,EAAU,CAAC;IACrD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC;QACxD,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,EAAE,CAAC,KAAK;gBAAE,SAAS;YACxB,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;YAChE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YACjB,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,EAAE,CAAC,MAAM;gBAAE,SAAS;YACzB,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClD,0BAA0B,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAED,iDAAiD;IACjD,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,iEAAiE;YACjE,wEAAwE;YACxE,oCAAoC;YACpC,IACE,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBACzC,IAAI,CAAC,MAAM,KAAK,SAAS;gBACzB,IAAI,CAAC,KAAK,KAAK,SAAS,EACxB,CAAC;gBACD,SAAS;YACX,CAAC;YACD,qDAAqD;YACrD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,SAAS;YACX,CAAC;YAED,qCAAqC;YACrC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAEpD,0EAA0E;YAC1E,mEAAmE;YACnE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,2DAA2D;YAC3D,EAAE;YACF,oEAAoE;YACpE,uEAAuE;YACvE,8CAA8C;YAC9C,EAAE;YACF,4EAA4E;YAC5E,oFAAoF;YACpF,EAAE;YACF,qEAAqE;YACrE,6DAA6D;YAC7D,sEAAsE;YACtE,EAAE;YACF,iEAAiE;YACjE,EAAE;YACF,wEAAwE;YACxE,yEAAyE;YACzE,2EAA2E;YAC3E,wEAAwE;YACxE,yEAAyE;YACzE,yEAAyE;YACzE,gEAAgE;YAChE,0EAA0E;YAC1E,kEAAkE;YAClE,0DAA0D;YAC1D,0EAA0E;YAC1E,sBAAsB;YACtB,IACE,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;gBACnF,UAAU;gBACV,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI;gBACvB,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;gBACnC,MAAM,CAAC,IAAI,KAAK,uBAAuB;gBACvC,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EACrD,CAAC;gBACD,SAAS;YACX,CAAC;YAED,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,wEAAwE;YACxE,+DAA+D;YAC/D,EAAE;YACF,yEAAyE;YACzE,wEAAwE;YACxE,gEAAgE;YAChE,uDAAuD;YACvD,sEAAsE;YACtE,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,qEAAqE;YACrE,oEAAoE;YACpE,IACE,QAAQ,KAAK,QAAQ;gBACrB,UAAU;gBACV,sBAAsB,CAAC,IAAI,CAAC;gBAC5B,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EACnC,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,UAAU,CAAC,UAAU,IAAI,wBAAwB,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC9F,uEAAuE;gBACvE,sEAAsE;gBACtE,gEAAgE;gBAChE,IAAI,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;oBAC9C,SAAS;gBACX,CAAC;gBACD,kEAAkE;gBAClE,8DAA8D;gBAC9D,uEAAuE;gBACvE,gEAAgE;gBAChE,+DAA+D;gBAC/D,wEAAwE;gBACxE,qEAAqE;gBACrE,wDAAwD;gBACxD,EAAE;gBACF,qEAAqE;gBACrE,oEAAoE;gBACpE,sEAAsE;gBACtE,qEAAqE;gBACrE,qDAAqD;gBACrD,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;gBACjE,MAAM,QAAQ,GAAG,YAAY,CAAC;oBAC5B,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,UAAU;iBACX,CAAC,CAAC;gBAEH,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,OAAO,SAAS,EAAE,EAAE;oBACxB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,QAAQ;oBACR,UAAU;oBACV,8DAA8D;oBAC9D,uDAAuD;oBACvD,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,MAAM,EAAE;wBACN,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,IAAI,EAAE,MAAM,CAAC,QAAQ;qBACtB;oBACD,IAAI,EAAE;wBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,IAAI,EAAE,IAAI,CAAC,QAAQ;qBACpB;oBACD,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;oBAC9D,WAAW,EAAE,UAAU,CAAC,UAAU,IAAI,UAAU,GAAG,GAAG;oBACtD,WAAW,EAAE,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC;oBAC1D,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;oBACtC,YAAY,EAAE;wBACZ,iBAAiB,EAAE,UAAU,CAAC,UAAU;wBACxC,WAAW,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;wBAC/C,YAAY,EAAE,KAAK;wBACnB,cAAc,EAAE,CAAC;wBACjB,eAAe,EAAE,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC;qBACtD;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,wBAAwB;IACxB,EAAE;IACF,oEAAoE;IACpE,yDAAyD;IACzD,EAAE;IACF,2EAA2E;IAC3E,sEAAsE;IACtE,EAAE;IACF,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,mDAAmD;IACnD,EAAE;IACF,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,uEAAuE;IACvE,8EAA8E;IAC9E,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,EAAE,CAAC,SAAS;YAAE,SAAS;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC;QACpF,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,0EAA0E;QAC1E,wEAAwE;QACxE,uEAAuE;QACvE,IACE,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YACzC,IAAI,CAAC,MAAM,KAAK,SAAS;YACzB,IAAI,CAAC,KAAK,KAAK,SAAS,EACxB,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,WAAW,CAAC;eACrD,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,WAAW,YAAY,EAAE,CAAC,WAAW,EAAE;gBAC7E,QAAQ,EAAE,MAAe,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC;QACpF,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAClG,qEAAqE;QACrE,MAAM,UAAU,GAAe;YAC7B,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,IAAe;YACrB,SAAS,EAAE,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;SAClE,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,OAAO,SAAS,EAAE,EAAE;YACxB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,YAAY,CAAC;gBACrB,UAAU,EAAE,EAAE,CAAC,WAAW;gBAC1B,QAAQ,EAAE,EAAE,CAAC,SAAS;gBACtB,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,EAAE,CAAC,UAAU;aAC1B,CAAC;YACF,UAAU,EAAE,EAAE,CAAC,UAAU;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE;YAC1F,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;YAC/E,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,IAAgB,CAAC,CAAC,CAAC,SAAS;YACrD,WAAW,EAAE,EAAE,CAAC,UAAU,GAAG,GAAG;YAChC,WAAW,EAAE,mBAAmB,CAAC,GAAkB,EAAE,IAAI,EAAE,UAAU,CAAC;YACtE,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;YACtC,YAAY,EAAE;gBACZ,iBAAiB,EAAE,IAAI;gBACvB,uEAAuE;gBACvE,WAAW,EAAE,IAAI;gBACjB,YAAY,EAAE,KAAK;gBACnB,cAAc,EAAE,CAAC;gBACjB,eAAe,EAAE,sBAAsB,CAAC,GAAkB,EAAE,IAAI,CAAC;aAClE;YACD,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC,CAAC;IAChB,CAAC;IAED,oEAAoE;IACpE,mDAAmD;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,CAAC,CAAC,QAAQ,GAAG;gBACX,GAAG,CAAC,CAAC,QAAQ;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;aACxD,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,CAAE,QAAQ,CAAC,QAAQ,EAAE,OAAiD,IAAI,EAAE,CAAC,CAAC;YAC9F,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3D,QAAQ,CAAC,QAAQ,GAAG,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;YACtD,MAAM,eAAe,GAAG,oBAAoB,CAC1C,QAAQ,CAAC,YAAY,CAAC,eAAe,EACrC,CAAC,CAAC,YAAY,CAAC,eAAe,CAC/B,CAAC;YACF,IAAI,CAAC,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACvC,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;gBACnC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;gBAC3B,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACvB,QAAQ,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;gBACrC,QAAQ,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;gBACvC,QAAQ,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;gBACrC,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;YACjC,CAAC;YACD,QAAQ,CAAC,YAAY,CAAC,eAAe,GAAG,eAAe,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7C,kCAAkC;IAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAClE,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,YAAY,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC;QAC5C,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAC7B,MAAmB,EACnB,IAAe;IAEf,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,IAAI,QAAQ,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC;IAC7C,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IAC5B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,CAAyC,EACzC,CAAyC;IAEzC,MAAM,IAAI,GAAG,CAAC,IAAI,QAAQ,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,IAAI,QAAQ,CAAC;IAC5B,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,QAAkB;IACvE,MAAM,mBAAmB,GAA+B;QACtD,yEAAyE;QACzE,yFAAyF;QACzF,8DAA8D;QAC9D,yEAAyE;QACzE,gFAAgF;QAChF,6CAA6C;QAC7C,kFAAkF;QAClF,kCAAkC;QAClC,2FAA2F;QAC3F,wEAAwE;QACxE,oEAAoE;QACpE,wEAAwE;QACxE,0EAA0E;QAC1E,iEAAiE;QACjE,wEAAwE;QACxE,0EAA0E;QAC1E,2DAA2D;QAC3D,2EAA2E;QAC3E,2EAA2E;QAC3E,sEAAsE;QACtE,yEAAyE;QACzE,iDAAiD;QACjD,uEAAuE;QACvE,2EAA2E;QAC3E,oEAAoE;QACpE,oEAAoE;QACpE,oEAAoE;QACpE,wEAAwE;QACxE,yEAAyE;QACzE,mEAAmE;QACnE,0EAA0E;QAC1E,6EAA6E;QAC7E,wEAAwE;QACxE,2EAA2E;QAC3E,sEAAsE;QACtE,qEAAqE;QACrE,sEAAsE;QACtE,4EAA4E;QAC5E,qEAAqE;QACrE,8EAA8E;QAC9E,yEAAyE;QACzE,8EAA8E;QAC9E,6EAA6E;QAC7E,+EAA+E;QAC/E,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,4EAA4E;QAC5E,qEAAqE;QACrE,kEAAkE;QAClE,UAAU,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAClU,SAAS,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAClQ,WAAW,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAC1M,WAAW,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAClM,qEAAqE;QACrE,uEAAuE;QACvE,6DAA6D;QAC7D,mEAAmE;QACnE,oEAAoE;QACpE,oEAAoE;QACpE,SAAS,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,MAAM,EAAE,qBAAqB,EAAE,eAAe,EAAE,gBAAgB,EAAE,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,CAAC;QAC7K,UAAU,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAC3Q,wEAAwE;QACxE,+DAA+D;QAC/D,wEAAwE;QACxE,+EAA+E;QAC/E,4DAA4D;QAC5D,QAAQ,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,CAAC;QAClK,SAAS,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;QAClD,QAAQ,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,eAAe,CAAC,EAAE,yBAAyB;QAC9E,UAAU,EAAE,CAAC,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,CAAC;QAC/F,aAAa,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,CAAC;QAC7I,YAAY,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,CAAC,EAAE,sBAAsB;QAC/I,qBAAqB,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,EAAE,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,KAAK,EAAE,iBAAiB,CAAC,EAAE,0WAA0W;QACzrB,YAAY,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,eAAe,CAAC,EAAE,2BAA2B;KAC/J,CAAC;IAEF,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA6C,EAC7C,QAAkB;IAElB,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC7B,sDAAsD;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACxB,+DAA+D;QAC/D,8DAA8D;QAC9D,8DAA8D;QAC9D,2CAA2C;QAC3C,OAAO,QAAQ,KAAK,gBAAgB,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;GAEG;AACH;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,sBAAsB,CAAC,IAAe;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACnC,yEAAyE;IACzE,2DAA2D;IAC3D,6DAA6D;IAC7D,OAAO,IAAI,MAAM,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,aAAa,CAAC,MAAmB,EAAE,IAAe,EAAE,GAAQ;IACnE,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,wCAAwC;IACxC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACrC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,CACvD,CAAC;IAEF,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACnC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,CACnD,CAAC;IAEF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACxD,CAAC;IAED,8BAA8B;IAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAEhC,yDAAyD;IACzD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,qBAAqB,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YAC9E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,uBAAuB;gBACvB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;oBACzB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;oBAC/C,IAAI,GAAG,EAAE,CAAC;wBACR,IAAI,CAAC,IAAI,CAAC;4BACR,IAAI,EAAE,EAAE,EAAE,2BAA2B;4BACrC,MAAM,EAAE,EAAE;4BACV,IAAI,EAAE,GAAG,CAAC,IAAI;4BACd,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,QAAQ;4BAC7B,QAAQ,EAAE,GAAG,CAAC,QAAQ;yBACvB,CAAC,CAAC;wBACH,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;oBAC/B,CAAC;gBACH,CAAC;gBAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,6DAA6D;IAC7D,EAAE;IACF,6EAA6E;IAC7E,6EAA6E;IAC7E,sEAAsE;IACtE,yEAAyE;IACzE,EAAE;IACF,kEAAkE;IAClE,8BAA8B;IAC9B,2DAA2D;IAC3D,uDAAuD;IACvD,QAAQ;IACR,EAAE;IACF,4EAA4E;IAC5E,sEAAsE;IACtE,0EAA0E;IAC1E,yEAAyE;IACzE,qEAAqE;IACrE,EAAE;IACF,yEAAyE;IACzE,4EAA4E;IAC5E,wEAAwE;IACxE,yDAAyD;IACzD,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,4BAA4B;QAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAExD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,KAAK,MAAM,CAAC,QAAQ;gBAAE,SAAS;YACrE,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,EAAE;oBACR,MAAM,EAAE,EAAE;oBACV,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,IAAI,EAAE,GAAG,CAAC,aAAa;oBACvB,QAAQ,EAAE,CAAC;iBACZ,CAAC,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,EAAE;oBACR,MAAM,EAAE,EAAE;oBACV,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,IAAI,EAAE,QAAQ,CAAC,GAAG;oBAClB,QAAQ,EAAE,CAAC;iBACZ,CAAC,CAAC;gBACH,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAC5B,SAAiB,EACjB,OAAsB,EACtB,MAAkB,EAClB,GAAQ,EACR,OAAO,GAAgB,IAAI,GAAG,EAAE,EAChC,IAAI,GAAa,EAAE;IAEnB,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,CAAC,GAAG,IAAI,EAAE,SAAS,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAErB,uCAAuC;IACvC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAEpE,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QAC7F,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAcD;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,KAAiB;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YAC/B,IAAI,CAAC,EAAE,IAAI;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAiB;IAC1C,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YAChC,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;gBAAE,SAAS;YACjF,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iEAAiE;AACjE,SAAS,iBAAiB,CAAC,IAAY,EAAE,MAAqB;IAC5D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS,EAAE,MAAqB;IAC/D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,SAAS,wBAAwB,CAC/B,MAAmB,EACnB,IAAe,EACf,YAAY,GAAkB,EAAE,EAChC,UAAU,GAAgB,IAAI,GAAG,EAAE;IAEnC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IACzD,2EAA2E;IAC3E,qEAAqE;IACrE,EAAE;IACF,6FAA6F;IAC7F,+FAA+F;IAC/F,EAAE;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,0DAA0D;IAC1D,IAAI,MAAM,CAAC,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAC7D,IAAI,WAAW,IAAI,SAAS,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;YACpF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAGD;;GAEG;AACH,SAAS,mBAAmB,CAAC,MAAmB,EAAE,IAAe,EAAE,UAAsB;IACvF,IAAI,UAAU,GAAG,GAAG,CAAC,CAAC,kBAAkB;IAExC,+BAA+B;IAC/B,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,UAAU,IAAI,GAAG,CAAC;IACpB,CAAC;IAED,0CAA0C;IAC1C,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,6BAA6B;IAC7B,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IAE9D,kBAAkB;IAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,UAAU,IAAI,GAAG,CAAC;IACpB,CAAC;SAAM,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1B,UAAU,IAAI,IAAI,CAAC;IACrB,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,MAAmB,EAAE,IAAe,EAAE,UAAsB;IACvF,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE/C,IAAI,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO,GAAG,UAAU,6BAA6B,IAAI,QAAQ,QAAQ,+BAA+B,CAAC;IACvG,CAAC;IAED,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,GAAG,UAAU,aAAa,QAAQ,+BAA+B,CAAC;IAC3E,CAAC;IAED,OAAO,GAAG,UAAU,cAAc,QAAQ,oCAAoC,CAAC;AACjF,CAAC"}
|
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Go `strings.NewReplacer(old1, new1, old2, new2, …).Replace(x)` sanitizer
|
|
3
|
+
* credit (cognium-dev#348, #293).
|
|
4
|
+
*
|
|
5
|
+
* The credit is argument-aware, like the Java replace credit:
|
|
6
|
+
* - `log_injection` when both "\r" and "\n" are replaced, each by a string
|
|
7
|
+
* that contains neither CR nor LF;
|
|
8
|
+
* - `xss` when both "<" and ">" are replaced by strings that contain
|
|
9
|
+
* neither.
|
|
10
|
+
* A replacer that maps only some of those characters earns nothing.
|
|
11
|
+
*
|
|
12
|
+
* A replacer is recognised inline (`strings.NewReplacer(...).Replace(x)`)
|
|
13
|
+
* and through a variable it is bound to (`var flat = strings.NewReplacer(...)`
|
|
14
|
+
* at package scope or `flat := strings.NewReplacer(...)` in a function), on
|
|
15
|
+
* every line that calls `<name>.Replace(`.
|
|
16
|
+
*/
|
|
17
|
+
import type { SinkType, TaintSanitizer } from '../types/index.js';
|
|
18
|
+
/** Sink types a NewReplacer with these pairs neutralises. */
|
|
19
|
+
export declare function goReplacerCoverage(pairs: Array<[string, string]>): SinkType[];
|
|
20
|
+
export declare function findGoStringsReplacerSanitizers(code: string): TaintSanitizer[];
|
|
21
|
+
//# sourceMappingURL=go-strings-replacer.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"go-strings-replacer.d.ts","sourceRoot":"","sources":["../../src/analysis/go-strings-replacer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AA2BlE,6DAA6D;AAC7D,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,EAAE,CAO7E;AA0CD,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,EAAE,CAkD9E"}
|
|
@@ -0,0 +1,145 @@
|
|
|
1
|
+
/** Decode one Go string literal (interpreted "…" or raw `…`); null when not a literal. */
|
|
2
|
+
function decodeGoLiteral(lit) {
|
|
3
|
+
if (lit.length >= 2 && lit.startsWith('`') && lit.endsWith('`'))
|
|
4
|
+
return lit.slice(1, -1);
|
|
5
|
+
if (lit.length < 2 || !lit.startsWith('"') || !lit.endsWith('"'))
|
|
6
|
+
return null;
|
|
7
|
+
return lit.slice(1, -1).replace(/\\(?:x([0-9a-fA-F]{2})|u([0-9a-fA-F]{4})|([abfnrtv\\"']))/g, (_m, hex, uni, c) => {
|
|
8
|
+
if (hex !== undefined)
|
|
9
|
+
return String.fromCharCode(parseInt(hex, 16));
|
|
10
|
+
if (uni !== undefined)
|
|
11
|
+
return String.fromCharCode(parseInt(uni, 16));
|
|
12
|
+
const map = { a: '\x07', b: '\b', f: '\f', n: '\n', r: '\r', t: '\t', v: '\v' };
|
|
13
|
+
return map[c] ?? c;
|
|
14
|
+
});
|
|
15
|
+
}
|
|
16
|
+
/** Split the argument list of a NewReplacer call into its literal operands; null if any is not a literal. */
|
|
17
|
+
function replacerPairs(args) {
|
|
18
|
+
const lits = args.match(/"(?:[^"\\]|\\.)*"|`[^`]*`/g) ?? [];
|
|
19
|
+
// Every comma-separated operand must be a literal.
|
|
20
|
+
const rest = args.replace(/"(?:[^"\\]|\\.)*"|`[^`]*`/g, '').replace(/[\s,]/g, '');
|
|
21
|
+
if (rest !== '' || lits.length === 0 || lits.length % 2 !== 0)
|
|
22
|
+
return null;
|
|
23
|
+
const decoded = lits.map(decodeGoLiteral);
|
|
24
|
+
if (decoded.some(d => d === null))
|
|
25
|
+
return null;
|
|
26
|
+
const pairs = [];
|
|
27
|
+
for (let i = 0; i < decoded.length; i += 2)
|
|
28
|
+
pairs.push([decoded[i], decoded[i + 1]]);
|
|
29
|
+
return pairs;
|
|
30
|
+
}
|
|
31
|
+
/** Sink types a NewReplacer with these pairs neutralises. */
|
|
32
|
+
export function goReplacerCoverage(pairs) {
|
|
33
|
+
const maps = (ch, banned) => pairs.some(([o, n]) => o === ch && !banned.test(n));
|
|
34
|
+
const out = [];
|
|
35
|
+
if (maps('\r', /[\r\n]/) && maps('\n', /[\r\n]/))
|
|
36
|
+
out.push('log_injection');
|
|
37
|
+
if (maps('<', /[<>]/) && maps('>', /[<>]/))
|
|
38
|
+
out.push('xss');
|
|
39
|
+
return out;
|
|
40
|
+
}
|
|
41
|
+
const NEW_REPLACER = /\bstrings\s*\.\s*NewReplacer\s*\(/g;
|
|
42
|
+
/** The balanced argument text of the call whose `(` is at `open`. */
|
|
43
|
+
function callArgs(text, open) {
|
|
44
|
+
let depth = 0;
|
|
45
|
+
let quote = null;
|
|
46
|
+
for (let i = open; i < text.length; i++) {
|
|
47
|
+
const c = text[i];
|
|
48
|
+
if (quote) {
|
|
49
|
+
if (c === '\\' && quote === '"')
|
|
50
|
+
i++;
|
|
51
|
+
else if (c === quote)
|
|
52
|
+
quote = null;
|
|
53
|
+
continue;
|
|
54
|
+
}
|
|
55
|
+
if (c === '"' || c === '`')
|
|
56
|
+
quote = c;
|
|
57
|
+
else if (c === '(')
|
|
58
|
+
depth++;
|
|
59
|
+
else if (c === ')' && --depth === 0)
|
|
60
|
+
return { args: text.slice(open + 1, i), end: i };
|
|
61
|
+
}
|
|
62
|
+
return null;
|
|
63
|
+
}
|
|
64
|
+
/**
|
|
65
|
+
* True when `lineText` is an assignment whose right-hand side holds an operand
|
|
66
|
+
* outside every `….Replace(…)` call (`msg := flat.Replace(a) + " " + b`). The
|
|
67
|
+
* credit is line-keyed, so it would also clean `b`; such a line earns none.
|
|
68
|
+
*/
|
|
69
|
+
function assignmentHasRawOperand(lineText) {
|
|
70
|
+
const m = /^\s*(?:var\s+)?[A-Za-z_][\w\s,]*?:?=(?!=)(.*)$/.exec(lineText);
|
|
71
|
+
if (!m)
|
|
72
|
+
return false;
|
|
73
|
+
let rhs = m[1];
|
|
74
|
+
for (const re of [/\bstrings\s*\.\s*NewReplacer\s*\(/, /(?:\b[A-Za-z_]\w*\s*)?\.\s*Replace\s*\(/]) {
|
|
75
|
+
for (let r = re.exec(rhs); r; r = re.exec(rhs)) {
|
|
76
|
+
const call = callArgs(rhs, r.index + r[0].length - 1);
|
|
77
|
+
if (!call)
|
|
78
|
+
return true;
|
|
79
|
+
rhs = rhs.slice(0, r.index) + rhs.slice(call.end + 1);
|
|
80
|
+
}
|
|
81
|
+
}
|
|
82
|
+
rhs = rhs.replace(/"(?:[^"\\]|\\.)*"|`[^`]*`/g, '""');
|
|
83
|
+
return /\b[A-Za-z_]\w*\b(?!\s*[.(])/.test(rhs.replace(/\.\s*[A-Za-z_]\w*/g, ''));
|
|
84
|
+
}
|
|
85
|
+
export function findGoStringsReplacerSanitizers(code) {
|
|
86
|
+
const out = [];
|
|
87
|
+
const lineStarts = [0];
|
|
88
|
+
for (let i = 0; i < code.length; i++)
|
|
89
|
+
if (code[i] === '\n')
|
|
90
|
+
lineStarts.push(i + 1);
|
|
91
|
+
const lineAt = (idx) => {
|
|
92
|
+
let lo = 0, hi = lineStarts.length - 1;
|
|
93
|
+
while (lo < hi) {
|
|
94
|
+
const mid = (lo + hi + 1) >> 1;
|
|
95
|
+
if (lineStarts[mid] <= idx)
|
|
96
|
+
lo = mid;
|
|
97
|
+
else
|
|
98
|
+
hi = mid - 1;
|
|
99
|
+
}
|
|
100
|
+
return lo + 1;
|
|
101
|
+
};
|
|
102
|
+
// `method` names the call that does the replacing, so a sink-line credit
|
|
103
|
+
// covers only that call's operand (#641).
|
|
104
|
+
const lines = code.split('\n');
|
|
105
|
+
const emit = (line, sanitizes, method) => {
|
|
106
|
+
if (assignmentHasRawOperand(lines[line - 1] ?? ''))
|
|
107
|
+
return;
|
|
108
|
+
out.push({ type: 'go_strings_replacer', method, line, sanitizes });
|
|
109
|
+
};
|
|
110
|
+
const bound = new Map();
|
|
111
|
+
NEW_REPLACER.lastIndex = 0;
|
|
112
|
+
let m;
|
|
113
|
+
while ((m = NEW_REPLACER.exec(code)) !== null) {
|
|
114
|
+
const call = callArgs(code, m.index + m[0].length - 1);
|
|
115
|
+
if (!call)
|
|
116
|
+
continue;
|
|
117
|
+
const pairs = replacerPairs(call.args);
|
|
118
|
+
const covers = pairs ? goReplacerCoverage(pairs) : [];
|
|
119
|
+
const after = code.slice(call.end + 1);
|
|
120
|
+
if (/^\s*\.\s*Replace\s*\(/.test(after)) {
|
|
121
|
+
if (covers.length > 0)
|
|
122
|
+
emit(lineAt(m.index), covers, 'Replace()');
|
|
123
|
+
continue;
|
|
124
|
+
}
|
|
125
|
+
// Bound to a name: `name = strings.NewReplacer(` / `name := ...`.
|
|
126
|
+
const before = code.slice(code.lastIndexOf('\n', m.index) + 1, m.index);
|
|
127
|
+
const b = /(?:^|[\s(])([A-Za-z_]\w*)\s*:?=\s*$/.exec(before);
|
|
128
|
+
if (!b)
|
|
129
|
+
continue;
|
|
130
|
+
const name = b[1];
|
|
131
|
+
// A name rebound to a replacer that covers less loses the credit.
|
|
132
|
+
const prev = bound.get(name);
|
|
133
|
+
bound.set(name, prev ? prev.filter(t => covers.includes(t)) : covers);
|
|
134
|
+
}
|
|
135
|
+
for (const [name, covers] of bound) {
|
|
136
|
+
if (covers.length === 0)
|
|
137
|
+
continue;
|
|
138
|
+
const use = new RegExp(`(?<![\\w.])${name}\\s*\\.\\s*Replace\\s*\\(`, 'g');
|
|
139
|
+
let u;
|
|
140
|
+
while ((u = use.exec(code)) !== null)
|
|
141
|
+
emit(lineAt(u.index), covers, `${name}.Replace()`);
|
|
142
|
+
}
|
|
143
|
+
return out;
|
|
144
|
+
}
|
|
145
|
+
//# sourceMappingURL=go-strings-replacer.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"go-strings-replacer.js","sourceRoot":"","sources":["../../src/analysis/go-strings-replacer.ts"],"names":[],"mappings":"AAkBA,0FAA0F;AAC1F,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzF,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,4DAA4D,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE;QAChH,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QACrE,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QACrE,MAAM,GAAG,GAA2B,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;QACxG,OAAO,GAAG,CAAC,CAAW,CAAC,IAAK,CAAY,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6GAA6G;AAC7G,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,IAAI,EAAE,CAAC;IAC5D,mDAAmD;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAClF,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAW,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAW,CAAC,CAAC,CAAC;IACzG,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,kBAAkB,CAAC,KAA8B;IAC/D,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,MAAc,EAAW,EAAE,CACnD,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5E,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,YAAY,GAAG,oCAAoC,CAAC;AAE1D,qEAAqE;AACrE,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY;IAC1C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,KAAK,GAAG;gBAAE,CAAC,EAAE,CAAC;iBAChC,IAAI,CAAC,KAAK,KAAK;gBAAE,KAAK,GAAG,IAAI,CAAC;YACnC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,GAAG,CAAC,CAAC;aACjC,IAAI,CAAC,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aACvB,IAAI,CAAC,KAAK,GAAG,IAAI,EAAE,KAAK,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACxF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,MAAM,CAAC,GAAG,gDAAgD,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1E,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,CAAC,mCAAmC,EAAE,yCAAyC,CAAC,EAAE,CAAC;QAClG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACtD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC;YACvB,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,4BAA4B,EAAE,IAAI,CAAC,CAAC;IACtD,OAAO,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC;AACnF,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,IAAY;IAC1D,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC;IACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,CAAC,GAAW,EAAU,EAAE;QACrC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QACvC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,UAAU,CAAC,GAAG,CAAE,IAAI,GAAG;gBAAE,EAAE,GAAG,GAAG,CAAC;;gBAAM,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,EAAE,GAAG,CAAC,CAAC;IAChB,CAAC,CAAC;IACF,yEAAyE;IACzE,0CAA0C;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,SAAqB,EAAE,MAAc,EAAQ,EAAE;QACzE,IAAI,uBAAuB,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO;QAC3D,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,YAAY,CAAC,SAAS,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACvC,IAAI,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;YAClE,SAAS;QACX,CAAC;QACD,kEAAkE;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACxE,MAAM,CAAC,GAAG,qCAAqC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACnB,kEAAkE;QAClE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAClC,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,cAAc,IAAI,2BAA2B,EAAE,GAAG,CAAC,CAAC;QAC3E,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI;YAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"interprocedural.d.ts","sourceRoot":"","sources":["../../src/analysis/interprocedural.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,QAAQ,EACR,QAAQ,EAER,GAAG,EAGH,WAAW,EACX,SAAS,EACT,cAAc,EAGf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,wCAAwC;IACxC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gCAAgC;IAChC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,wFAAwF;IACxF,uBAAuB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrC,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,eAAe,EAAE,SAAS,EAAE,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,oGAAoG;IACpG,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAChC;
|
|
1
|
+
{"version":3,"file":"interprocedural.d.ts","sourceRoot":"","sources":["../../src/analysis/interprocedural.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,QAAQ,EACR,QAAQ,EAER,GAAG,EAGH,WAAW,EACX,SAAS,EACT,cAAc,EAGf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,wCAAwC;IACxC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,gCAAgC;IAChC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,cAAc,EAAE,OAAO,CAAC;IACxB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,wFAAwF;IACxF,uBAAuB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrC,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,cAAc,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,eAAe,EAAE,SAAS,EAAE,CAAC;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,oGAAoG;IACpG,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CAChC;AAsKD,wBAAgB,sBAAsB,CACpC,YAAY,EAAE,SAAS,GAAG,QAAQ,EAAE,EACpC,cAAc,EAAE,QAAQ,EAAE,GAAG,WAAW,EAAE,EAC1C,UAAU,EAAE,GAAG,GAAG,SAAS,EAAE,EAC7B,mBAAmB,EAAE,WAAW,EAAE,GAAG,cAAc,EAAE,EACrD,cAAc,CAAC,EAAE,SAAS,EAAE,GAAG,sBAAsB,EACrD,aAAa,CAAC,EAAE,cAAc,EAAE,EAChC,UAAU,GAAE,sBAA2B,GACtC,qBAAqB,CAmWvB;AAqTD;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,qBAAqB,GAAG;IACxE,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;CAC/B,CAOA;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAcnF;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAclG;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAezF;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,EAAE,CAaxE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,GAAE,MAAU,GACnB,MAAM,EAAE,EAAE,CAmDZ"}
|
|
@@ -104,6 +104,10 @@ const CSHARP_NON_ESCAPE_METHODS = new Set([
|
|
|
104
104
|
// claim needing its own change.
|
|
105
105
|
'Add', 'AddLast', 'AddFirst', 'AddRange', 'TryAdd', 'Insert', 'Push',
|
|
106
106
|
'Enqueue',
|
|
107
|
+
// Collection lookups (cognium-dev#665). Using a value as a key into an
|
|
108
|
+
// in-memory map hands nothing out of the program; it is the allowlist
|
|
109
|
+
// shape (`if (!Catalog.TryGetValue(sku, out var price)) return …`).
|
|
110
|
+
'TryGetValue', 'ContainsKey', 'ContainsValue', 'GetValueOrDefault',
|
|
107
111
|
// Encoders (cognium-dev#518). Encoding a value hands back a string; nothing
|
|
108
112
|
// has left the program at `Uri.EscapeDataString(input)`.
|
|
109
113
|
'EscapeDataString', 'EscapeUriString', 'UrlEncode', 'UrlPathEncode',
|
|
@@ -116,8 +120,49 @@ function isCSharpNonEscapeCall(call) {
|
|
|
116
120
|
return true;
|
|
117
121
|
if (CSHARP_NON_ESCAPE_METHODS.has(name))
|
|
118
122
|
return true;
|
|
123
|
+
// The inherited controller helper `Content(body, contentType)` writes the
|
|
124
|
+
// response body; the `Content` xss sink judges it by its content type
|
|
125
|
+
// (cognium-dev#580), so a plain-text or JSON body is not an escape either.
|
|
126
|
+
if (name === 'Content' && (call.receiver === null || call.receiver === 'this' || call.receiver === 'base'))
|
|
127
|
+
return true;
|
|
119
128
|
return false;
|
|
120
129
|
}
|
|
130
|
+
// Java (#468, slice): JDK exception / error types. Constructing one wraps the
|
|
131
|
+
// value into an object that has not left the program, the counterpart of the
|
|
132
|
+
// error-construction rows in the Go (#455) and C# (#474) gates. Loggers,
|
|
133
|
+
// formatters, StringBuilder and project-defined exception classes are NOT
|
|
134
|
+
// gated here: an unknown callee still escapes.
|
|
135
|
+
const JAVA_LANG_EXCEPTION_TYPES = new Set([
|
|
136
|
+
'Exception', 'RuntimeException', 'IllegalArgumentException',
|
|
137
|
+
'IllegalStateException', 'UnsupportedOperationException',
|
|
138
|
+
'NullPointerException', 'IndexOutOfBoundsException', 'NumberFormatException',
|
|
139
|
+
'Error', 'AssertionError',
|
|
140
|
+
]);
|
|
141
|
+
function isJavaNonEscapeCall(call, declaredTypeNames) {
|
|
142
|
+
// Only a constructor call `new X(...)`: no receiver, and the resolved target
|
|
143
|
+
// is `X.<init>` (the extractor does not set `is_constructor` for Java).
|
|
144
|
+
if (call.receiver)
|
|
145
|
+
return false;
|
|
146
|
+
const isCtor = call.is_constructor === true ||
|
|
147
|
+
(call.resolution?.target ?? '').endsWith('.<init>');
|
|
148
|
+
if (!isCtor)
|
|
149
|
+
return false;
|
|
150
|
+
const written = call.method_name;
|
|
151
|
+
const simple = written.split('.').pop() ?? written;
|
|
152
|
+
// Fully-qualified spelling: only `java.lang.<X>`; anything else is a project
|
|
153
|
+
// or library class.
|
|
154
|
+
if (written.includes('.')) {
|
|
155
|
+
return written.startsWith('java.lang.') &&
|
|
156
|
+
(JAVA_LANG_EXCEPTION_TYPES.has(simple) || /(Exception|Error)$/.test(simple));
|
|
157
|
+
}
|
|
158
|
+
// An explicit import of the same simple name from another package, or a class
|
|
159
|
+
// declared in this file, shadows the java.lang type.
|
|
160
|
+
if (call.receiver_type_fqn && !call.receiver_type_fqn.startsWith('java.lang.'))
|
|
161
|
+
return false;
|
|
162
|
+
if (declaredTypeNames.has(simple))
|
|
163
|
+
return false;
|
|
164
|
+
return JAVA_LANG_EXCEPTION_TYPES.has(simple);
|
|
165
|
+
}
|
|
121
166
|
function isGoNonEscapeCall(call) {
|
|
122
167
|
const name = call.method_name;
|
|
123
168
|
const recv = (call.receiver ?? '').split('.').pop() ?? '';
|
|
@@ -163,6 +208,7 @@ export function analyzeInterprocedural(graphOrTypes, callsOrSources, dfgOrSinks,
|
|
|
163
208
|
}
|
|
164
209
|
const types = graph.ir.types;
|
|
165
210
|
const calls = graph.ir.calls;
|
|
211
|
+
const declaredTypeNames = new Set(types.map(t => t.name));
|
|
166
212
|
// Build method nodes from type information
|
|
167
213
|
const methodNodes = buildMethodNodes(types);
|
|
168
214
|
// Build call graph edges with receiver type resolution
|
|
@@ -230,6 +276,9 @@ export function analyzeInterprocedural(graphOrTypes, callsOrSources, dfgOrSinks,
|
|
|
230
276
|
'text', 'textContent', 'innerText', 'createTextNode',
|
|
231
277
|
'addClass', 'removeClass', 'toggleClass',
|
|
232
278
|
'parseInt', 'parseFloat', 'Number', 'String', 'Boolean',
|
|
279
|
+
// Pure serializers (JSON.stringify, qs/querystring.stringify) return a
|
|
280
|
+
// string to the caller; the value has not left the program (#670).
|
|
281
|
+
'stringify',
|
|
233
282
|
// I/O stream wrappers — pure decorators that wrap a stream, not security sinks
|
|
234
283
|
// e.g. new InputStreamReader(proc.getInputStream()) is safe; the underlying stream is the source
|
|
235
284
|
'InputStreamReader', 'OutputStreamWriter',
|
|
@@ -329,6 +378,10 @@ export function analyzeInterprocedural(graphOrTypes, callsOrSources, dfgOrSinks,
|
|
|
329
378
|
if (graph.ir.meta.language === 'csharp' && isCSharpNonEscapeCall(call)) {
|
|
330
379
|
continue;
|
|
331
380
|
}
|
|
381
|
+
// Java — JDK exception construction (#468, minimal slice).
|
|
382
|
+
if (graph.ir.meta.language === 'java' && isJavaNonEscapeCall(call, declaredTypeNames)) {
|
|
383
|
+
continue;
|
|
384
|
+
}
|
|
332
385
|
const bashSafeBuiltins = new Set([
|
|
333
386
|
'echo', 'printf', 'test', '[', '[[', 'true', 'false', ':',
|
|
334
387
|
'declare', 'local', 'export', 'readonly', 'typeset',
|