circle-ir 4.14.2 → 4.15.0

package/dist/analysis/passes/language-sources-pass.js

@@ -15,6 +15,10 @@
  */
 import { DOM_ASSIGNMENT_SINK_METHODS, isProvablyLiteralExpression, } from '../literal-expression.js';
 import { attachSourceLineCode } from '../taint-matcher.js';
+import { javaReplaceCrLfCoverage } from '../java-crlf-strip.js';
+import { javaCallArgument, javaCanonicalBaseLacksSeparator } from '../java-canonical-prefix.js';
+import { findGoStringsReplacerSanitizers } from '../go-strings-replacer.js';
+import { constLookupTables, isConstTableLookup } from '../const-table-lookup.js';
 // ---------------------------------------------------------------------------
 // Pattern tables (moved from analyzer.ts)
 // ---------------------------------------------------------------------------
@@ -285,13 +289,19 @@ export class LanguageSourcesPass {
             additionalSanitizers.push(...findGoMapAllowlistGuardSanitizers(code));
             additionalSanitizers.push(...findGoHtmlTemplateImportSanitizers(code));
             additionalSanitizers.push(...findGoPathContainmentGuardSanitizers(code));
+            // #348 / #293: strings.NewReplacer CR/LF strip and < > entity escape.
+            additionalSanitizers.push(...findGoStringsReplacerSanitizers(code));
             // Sprint 78 (#190): Go ECB-mode weak-crypto detection.
             const goMisconfigFindings = findGoPatternFindings(code, graph.ir.meta.file);
             for (const finding of goMisconfigFindings) {
                 ctx.addFinding(finding);
             }
             // Sprint 81 (#189): Go xss — fmt.Fprint(f|ln) to http.ResponseWriter.
-            for (const finding of findGoXssFindings(code, graph.ir.meta.file)) {
+            // #568: an arg that is an int/bool measure local carries no payload.
+            const scalarVarsAt = (line) => new Set(graph.usesAtLine(line)
+                .filter(u => u.def_id != null && graph.taintBarrierDefIds.has(u.def_id))
+                .map(u => u.variable));
+            for (const finding of findGoXssFindings(code, graph.ir.meta.file, scalarVarsAt)) {
                 ctx.addFinding(finding);
             }
             // Sprint 82 (#189): Go open_redirect — Header().Set("Location", taint).
@@ -523,6 +533,28 @@ export class LanguageSourcesPass {
             // cognium-dev#269: `!file.getCanonicalPath().startsWith(base)` reject
             // guard (the java.io.File OWASP-recommended containment defence).
             additionalSanitizers.push(...findJavaCanonicalPathStartsWithGuardSanitizers(code));
+            // cognium-dev#293: `if (!Set.of("a", "b").contains(key)) throw` allow-list guard.
+            additionalSanitizers.push(...findJavaLiteralAllowlistGuardSanitizers(code));
+            // cognium-dev#668: `!<literal set>.contains(cls)` reject guard before reflection.
+            additionalSanitizers.push(...findJavaReflectionAllowlistGuardSanitizers(code, types));
+            // cognium-dev#566: a Spring @RestController / @ResponseBody / ResponseEntity
+            // handler's returned String is the response body. TaintPropagationPass
+            // links each synthesised sink to its source.
+            {
+                const tm = ctx.getResult('taint-matcher');
+                const xssSan = tm.sanitizers.filter(sa => sa.sanitizes.includes('xss')).map(sa => sa.line);
+                for (const r of findJavaSpringReturnXSSSinks(code, types, tm.sources, xssSan)) {
+                    if (additionalSinks.some(s => s.line === r.sinkLine && s.type === 'xss'))
+                        continue;
+                    additionalSinks.push({
+                        type: 'xss',
+                        cwe: 'CWE-79',
+                        line: r.sinkLine,
+                        location: `Spring handler returns HTML with request input at line ${r.sinkLine}`,
+                        confidence: 0.9,
+                    });
+                }
+            }
             additionalSanitizers.push(...findJavaInlineCrlfStripLogSanitizers(code));
             // cognium-dev#293: the same strip, but living in a user-defined helper.
             additionalSanitizers.push(...findCrlfWrapperFunctionSanitizers(code, 'java'));
@@ -1968,6 +2000,9 @@ function findJavaScriptAssignmentSources(sourceCode, language) {
     const patterns = isRouteHandler
         ? [...JS_TAINTED_PATTERNS, { pattern: /\bparams\s*[.[]/, type: 'http_path' }]
         : JS_TAINTED_PATTERNS;
+    // #667: `REGISTRY[req.query.mod]` on a constant table yields a value the
+    // program wrote, not request data.
+    const lookupTables = constLookupTables(sourceCode, language);
     for (let lineNum = 0; lineNum < lines.length; lineNum++) {
         const line = lines[lineNum];
         const lineNumber = lineNum + 1;
@@ -1975,6 +2010,8 @@ function findJavaScriptAssignmentSources(sourceCode, language) {
         if (!assignmentMatch)
             continue;
         const [, varName, rhs] = assignmentMatch;
+        if (isConstTableLookup(rhs, lookupTables))
+            continue;
         for (const { pattern, type } of patterns) {
             if (pattern.test(rhs)) {
                 const alreadyExists = sources.some(s => s.line === lineNumber && s.type === type);
@@ -2004,6 +2041,174 @@ function findJavaScriptAssignmentSources(sourceCode, language) {
     // event-name allowlist to avoid firing on unrelated `.on('drain', cb)`
     // / `.on('close', cb)` etc. that carry non-user-input.
     sources.push(...findJavaScriptCallbackParamSources(sourceCode));
+    if (language === 'javascript') {
+        sources.push(...findExpressDestructuredRequestSources(sourceCode));
+        sources.push(...findGraphqlResolverArgSources(sourceCode));
+    }
+    return sources;
+}
+/** Index just past the `}` matching the `{` at `open`, or -1. */
+function matchBrace(text, open) {
+    let depth = 0;
+    for (let i = open; i < text.length; i++) {
+        const ch = text[i];
+        if (ch === '{')
+            depth++;
+        else if (ch === '}') {
+            depth--;
+            if (depth === 0)
+                return i + 1;
+        }
+    }
+    return -1;
+}
+const EXPRESS_REQUEST_KEYS = {
+    query: 'http_param',
+    params: 'http_param',
+    body: 'http_body',
+    headers: 'http_header',
+    cookies: 'http_cookie',
+};
+/**
+ * cognium-dev#587 — Express handler whose first parameter destructures the
+ * request: `app.get(path, ({ query }, res) => …)`, `({ query: q }, res)`,
+ * `({ query: { id } }, res)`. Seeds the bound names of the allowlisted request
+ * keys only. Gated on a receiver bound to `express()` / `express.Router()` /
+ * `Router()` in the same file, so an arbitrary `({ query }) => …` callback is
+ * not a source.
+ */
+function findExpressDestructuredRequestSources(sourceCode) {
+    const sources = [];
+    const receivers = new Set();
+    for (const m of sourceCode.matchAll(/\b(?:const|let|var)\s+(\w+)\s*=\s*(?:express\s*\(\s*\)|express\s*\.\s*Router\s*\(\s*\)|Router\s*\(\s*\))/g)) {
+        receivers.add(m[1]);
+    }
+    if (receivers.size === 0)
+        return sources;
+    const REG_RE = /\b(\w+)\s*\.\s*(?:get|post|put|patch|delete|all)\s*\(\s*(['"`])[^'"`]*\2\s*,\s*(?:async\s+)?(?:function\s*\w*\s*)?\(\s*\{/g;
+    for (const m of sourceCode.matchAll(REG_RE)) {
+        if (!receivers.has(m[1]))
+            continue;
+        const open = m.index + m[0].length - 1;
+        const close = matchBrace(sourceCode, open);
+        if (close < 0)
+            continue;
+        // The pattern must be followed by another parameter or `)`, i.e. it is
+        // the handler's first parameter.
+        if (!/^\s*[,)]/.test(sourceCode.slice(close)))
+            continue;
+        const line = sourceCode.slice(0, m.index + m[0].length).split('\n').length;
+        const inner = sourceCode.slice(open + 1, close - 1);
+        // Split top-level entries.
+        const entries = [];
+        let depth = 0;
+        let start = 0;
+        for (let i = 0; i < inner.length; i++) {
+            if (inner[i] === '{')
+                depth++;
+            else if (inner[i] === '}')
+                depth--;
+            else if (inner[i] === ',' && depth === 0) {
+                entries.push(inner.slice(start, i));
+                start = i + 1;
+            }
+        }
+        entries.push(inner.slice(start));
+        for (const raw of entries) {
+            const entry = raw.trim();
+            const km = entry.match(/^(\w+)\s*(?::\s*([\s\S]+))?$/);
+            if (!km)
+                continue;
+            const type = EXPRESS_REQUEST_KEYS[km[1]];
+            if (!type)
+                continue;
+            const target = (km[2] ?? km[1]).replace(/=[\s\S]*$/, '').trim();
+            const names = target.startsWith('{')
+                ? [...target.slice(1, -1).matchAll(/(?:^|,)\s*(?:\w+\s*:\s*)?(\w+)/g)].map(x => x[1])
+                : /^\w+$/.test(target) ? [target] : [];
+            for (const name of names) {
+                sources.push({
+                    type,
+                    location: `Express handler destructured request '${km[1]}' -> '${name}' at line ${line}`,
+                    severity: 'high',
+                    line,
+                    confidence: 0.95,
+                    variable: name,
+                });
+            }
+        }
+    }
+    return sources;
+}
+/**
+ * cognium-dev#586 — GraphQL resolver-map arguments. The second parameter of a
+ * function under `Query` / `Mutation` / `Subscription` in the object passed as
+ * `resolvers` to `new ApolloServer({…})` / `makeExecutableSchema({…})` (inline,
+ * or a same-file `const resolvers = {…}`) is client-supplied. Parameter 0
+ * (`parent`) and 2 (`context`) are never seeded.
+ */
+function findGraphqlResolverArgSources(sourceCode) {
+    const sources = [];
+    const ctor = /(?:new\s+ApolloServer|makeExecutableSchema)\s*\(\s*\{/g;
+    const maps = [];
+    for (const m of sourceCode.matchAll(ctor)) {
+        const open = m.index + m[0].length - 1;
+        const close = matchBrace(sourceCode, open);
+        if (close < 0)
+            continue;
+        const opts = sourceCode.slice(open, close);
+        const inline = opts.match(/\bresolvers\s*:\s*\{/);
+        if (inline) {
+            maps.push(open + inline.index + inline[0].length - 1);
+            continue;
+        }
+        const named = opts.match(/\bresolvers\s*(?::\s*(\w+))?\s*[,}]/);
+        if (!named)
+            continue;
+        const ident = named[1] ?? 'resolvers';
+        const decl = new RegExp(`\\b(?:const|let|var)\\s+${ident}\\s*=\\s*\\{`).exec(sourceCode);
+        if (decl)
+            maps.push(decl.index + decl[0].length - 1);
+    }
+    const FN_RE = /(?:^|[\s,{])(\w+)\s*(?::\s*(?:async\s+)?(?:function\s*\w*\s*)?\(|\()\s*\w+\s*,\s*(\w+)\s*[,)]/g;
+    for (const open of maps) {
+        const close = matchBrace(sourceCode, open);
+        if (close < 0)
+            continue;
+        const body = sourceCode.slice(open, close);
+        for (const t of body.matchAll(/\b(Query|Mutation|Subscription)\s*:\s*\{/g)) {
+            const tOpen = open + t.index + t[0].length - 1;
+            const tClose = matchBrace(sourceCode, tOpen);
+            if (tClose < 0)
+                continue;
+            // Only direct members of the type object (depth 1).
+            const typeBody = sourceCode.slice(tOpen + 1, tClose - 1);
+            let depth = 0;
+            const depthAt = [];
+            for (let i = 0; i < typeBody.length; i++) {
+                depthAt.push(depth);
+                const ch = typeBody[i];
+                if (ch === '{' || ch === '(')
+                    depth++;
+                else if (ch === '}' || ch === ')')
+                    depth--;
+            }
+            for (const f of typeBody.matchAll(FN_RE)) {
+                const at = f.index + f[0].indexOf(f[1]);
+                if (depthAt[at] !== 0)
+                    continue;
+                const line = sourceCode.slice(0, tOpen + 1 + at).split('\n').length;
+                sources.push({
+                    type: 'http_param',
+                    location: `GraphQL ${t[1]}.${f[1]} resolver args '${f[2]}' at line ${line}`,
+                    severity: 'high',
+                    line,
+                    confidence: 0.9,
+                    variable: f[2],
+                });
+            }
+        }
+    }
     return sources;
 }
 /**
@@ -2811,6 +3016,7 @@ export function buildJavaScriptTaintedVars(sourceCode, language) {
         return new Map();
     const tainted = new Map();
     const lines = sourceCode.split('\n');
+    const lookupTables = constLookupTables(sourceCode, language);
     // Seed with WebSocket `.on('message', cb)` callback-param names (#213
     // second slice). Same event allowlist as findJavaScriptCallbackParamSources.
     const CB_EVENT_RE = /\.on\s*\(\s*['"](?:message|text|binary)['"]\s*,\s*(?:async\s+)?(?:function\s*\*?\s*(?:\w+\s*)?\(\s*(\w+)|\(\s*(\w+)\s*(?:[,):]|$)|(\w+)\s*=>)/;
@@ -2834,6 +3040,8 @@ export function buildJavaScriptTaintedVars(sourceCode, language) {
         const [, lhs, rhs] = assignMatch;
         if (['if', 'while', 'for', 'return', 'true', 'false', 'null', 'undefined', 'case'].includes(lhs))
             continue;
+        if (isConstTableLookup(rhs, lookupTables))
+            continue; // #667
         const isDirectSource = JS_TAINTED_PATTERNS.some(p => p.pattern.test(rhs));
         const isTaintedPropagation = tainted.size > 0 && [...tainted.keys()].some(v => new RegExp(`\\b${v}\\b`).test(rhs));
         if (isDirectSource || isTaintedPropagation)
@@ -3825,9 +4033,11 @@ function findBashRealpathPrefixGuardSanitizers(code) {
 function findGoMapAllowlistGuardSanitizers(code) {
     const sanitizers = [];
     const lines = code.split('\n');
-    // `if !<mapName>[<key>] {`  — optional whitespace, optional `_ ,`
-    // ignored. Captures the map identifier in group 1.
-    const guardOpen = /^\s*if\s+!\s*([A-Za-z_][A-Za-z0-9_]*)\s*\[\s*[A-Za-z_][A-Za-z0-9_]*\s*\]\s*\{/;
+    // `if !<mapName>[<key>] {`, or that negated lookup as one `||` disjunct
+    // (`if err != nil || !<mapName>[u.Host] {`, #293): the block runs when any
+    // disjunct holds, so falling past it proves the key is in the map. The key
+    // may be a selector (`u.Host`). Captures the map identifier in group 1.
+    const guardOpen = /^\s*if\s+(?:[^{&|]+\|\|\s*)*!\s*([A-Za-z_][A-Za-z0-9_]*)\s*\[\s*[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)?\s*\]\s*(?:\|\|[^{&]+)?\{/;
     // Allow-list naming heuristic.
     const allowlistName = /^(?:[A-Z][A-Z0-9_]+|.*?(allowed|accepted|whitelist|permitted|valid|approved).*)$/i;
     for (let i = 0; i < lines.length; i++) {
@@ -3863,9 +4073,24 @@ function findGoMapAllowlistGuardSanitizers(code) {
         if (closeLine === -1 || !bodyHasTerminator)
             continue;
         // Emit per-line sanitizers for every line AFTER the guard's closing
-        // brace through end of file. `checkSanitized` is line-keyed so this
-        // suppresses the relevant sink types in the safe branch.
-        for (let l = closeLine + 2; l <= lines.length; l++) {
+        // brace to the end of the enclosing block (the function body, #293 —
+        // it used to run to the end of the file, crediting later functions).
+        // `checkSanitized` is line-keyed so this suppresses the relevant sink
+        // types in the safe branch.
+        let end = lines.length;
+        for (let j = closeLine + 1, d = 0; j < lines.length; j++) {
+            for (const ch of lines[j]) {
+                if (ch === '{')
+                    d++;
+                else if (ch === '}')
+                    d--;
+            }
+            if (d < 0) {
+                end = j + 1;
+                break;
+            }
+        }
+        for (let l = closeLine + 2; l <= end; l++) {
             sanitizers.push({
                 type: 'go_map_allowlist_guard',
                 method: 'if',
@@ -5677,6 +5902,11 @@ function findJavaCanonicalPathStartsWithGuardSanitizers(code) {
             continue;
         if (!guardRejects(lines, i, terminatorRe, 6))
             continue;
+        // cognium-dev#618: a string-prefix check against a canonical base with no
+        // trailing separator is the prefix-confusion bypass, not a guard.
+        const base = javaCallArgument(lines.slice(i).join('\n'), m.index + m[0].length - 1);
+        if (base !== null && javaCanonicalBaseLacksSeparator(lines, i, base))
+            continue;
         const guarded = new Set([m[1]]);
         const mentions = (t) => {
             for (const n of guarded)
@@ -5710,6 +5940,147 @@ function findJavaCanonicalPathStartsWithGuardSanitizers(code) {
     }
     return sanitizers;
 }
+/**
+ * Identifiers allowed in the initializer of a constant allowlist collection.
+ * Anything else (a method parameter, a request read, a config lookup) means
+ * the membership set is not a fixed set of literals.
+ */
+const JAVA_LITERAL_COLLECTION_IDENTS = new Set([
+    'new', 'String', 'Set', 'List', 'of', 'copyOf', 'Arrays', 'asList',
+    'HashSet', 'TreeSet', 'LinkedHashSet', 'ArrayList', 'LinkedList',
+    'Collections', 'unmodifiableSet', 'unmodifiableList',
+    'ImmutableSet', 'ImmutableList', 'java', 'util',
+]);
+/**
+ * cognium-dev#668 — Java reflection allowlist guard.
+ *
+ *   private static final Set<String> ALLOWED = Set.of("a.Csv", "a.Json");
+ *   if (!ALLOWED.contains(cls)) { throw new SecurityException("denied"); }
+ *   return Class.forName(cls).getDeclaredConstructor().newInstance();
+ *
+ * Past a rejecting `!<SET>.contains(<v>)` guard, `<v>` is one of the set's
+ * literals, so the class it names is chosen by the code, not the requester.
+ * Positive evidence only: `<SET>` must be a `final` field or local of this
+ * file whose initializer is nothing but string literals inside the standard
+ * collection factories, and the guard must reject (throw / return). Credits
+ * `<v>` on later lines of the enclosing method until `<v>` is reassigned.
+ * Scoped to `code_injection` (reflective class loading); other sink types
+ * are untouched.
+ */
+function findJavaReflectionAllowlistGuardSanitizers(code, types) {
+    const sanitizers = [];
+    const lines = code.split('\n');
+    const guardRe = /\bif\s*\(\s*!\s*(?:this\s*\.\s*|[A-Z]\w*\s*\.\s*)?([A-Za-z_]\w*)\s*\.\s*contains\s*\(\s*([A-Za-z_]\w*)\s*\)\s*\)/;
+    const terminatorRe = /\b(throw|return)\b/;
+    // Factory / constructor tokens that prove the initializer is a collection of
+    // literals. A bare `final String ALLOWED = "…"` leaves no idents after string
+    // stripping (so `.every` would pass) and `String.contains` is substring — not
+    // an allowlist. Require at least one of these.
+    const LITERAL_COLLECTION_FACTORIES = new Set([
+        'of', 'copyOf', 'asList', 'HashSet', 'TreeSet', 'LinkedHashSet',
+        'ArrayList', 'LinkedList', 'unmodifiableSet', 'unmodifiableList',
+        'ImmutableSet', 'ImmutableList',
+    ]);
+    /**
+     * Nearest declaration of `name` at or above `fromLine` (0-based). A closer
+     * non-final binding (local, `var`, parameter) wins over an earlier `final`
+     * field; only a nearest `final` literal collection returns true.
+     */
+    const isLiteralCollection = (name, fromLine) => {
+        const finalDeclRe = new RegExp(`\\bfinal\\b[^=;(]*\\b${name}\\s*=(?!=)`);
+        // Type/var declaration or use as a parameter (`Type name` before `=` / `;` / `,` / `)`).
+        const anyDeclRe = new RegExp(`\\b(?:[A-Z][\\w.<>,\\[\\]?\\s]*|var)\\s+${name}\\s*[=;,)]`);
+        for (let i = fromLine; i >= 0; i--) {
+            const line = lines[i];
+            if (!anyDeclRe.test(line) && !finalDeclRe.test(line))
+                continue;
+            const dm = finalDeclRe.exec(line);
+            if (!dm)
+                return false; // nearer non-final binding — not a fixed allowlist
+            // Initializer up to the terminating `;` (may span a few lines).
+            let init = line.slice(dm.index + dm[0].length);
+            for (let j = i + 1; !init.includes(';') && j < Math.min(lines.length, i + 12); j++)
+                init += ' ' + lines[j];
+            if (!init.includes(';'))
+                return false;
+            init = init.slice(0, init.indexOf(';')).replace(/"(?:[^"\\]|\\.)*"/g, '""');
+            if (!init.includes('""'))
+                return false;
+            const idents = init.match(/[A-Za-z_]\w*/g) ?? [];
+            // Empty idents (string-only initializer) or no collection factory → not a set.
+            if (!idents.some(id => LITERAL_COLLECTION_FACTORIES.has(id)))
+                return false;
+            if (!idents.every(id => JAVA_LITERAL_COLLECTION_IDENTS.has(id)))
+                return false;
+            // A mutable collection that is written anywhere is not a fixed set.
+            const mutRe = new RegExp(`\\b${name}\\s*\\.\\s*(?:add|addAll|put|putAll|set|replaceAll)\\s*\\(`);
+            return !lines.some(l => mutRe.test(l));
+        }
+        return false;
+    };
+    for (let i = 0; i < lines.length; i++) {
+        const m = guardRe.exec(lines[i]);
+        if (!m)
+            continue;
+        const [, setName, guarded] = m;
+        if (!guardRejects(lines, i, terminatorRe, 6))
+            continue;
+        if (!isLiteralCollection(setName, i))
+            continue;
+        const method = types
+            .flatMap(t => t.methods)
+            .filter(mt => mt.start_line <= i + 1 && mt.end_line >= i + 1)
+            .sort((a, b) => (a.end_line - a.start_line) - (b.end_line - b.start_line))[0];
+        if (!method)
+            continue;
+        // The guard must sit in the method body's top-level block, so it dominates
+        // every later line (not inside an `if` branch, loop or lambda body).
+        const before = [...lines.slice(method.start_line - 1, i), lines[i].slice(0, m.index)]
+            .join('\n').replace(/"(?:[^"\\]|\\.)*"/g, '""');
+        const depth = (before.match(/\{/g) ?? []).length - (before.match(/\}/g) ?? []).length;
+        if (depth !== 1)
+            continue;
+        // Braceless `if`/`for`/`while`/`else` keeps brace-depth 1, so also reject a
+        // guard that is the body of a preceding braceless control statement — on the
+        // same line (`if (strict) if (!SET.contains(v))`) or the previous statement
+        // (`} else` / `else` / `if (x)` without `{`).
+        const samePrefix = lines[i].slice(0, m.index).replace(/\/\/.*$/, '').trim();
+        let prev = '';
+        for (let p = i - 1; p >= method.start_line - 1; p--) {
+            const t = lines[p].replace(/\/\/.*$/, '').trim();
+            if (!t)
+                continue;
+            prev = t;
+            break;
+        }
+        const openBraceless = (s) => {
+            // Allow a leading `}` so `} else` counts as braceless else.
+            const t = s.replace(/^\}+\s*/, '').trim();
+            return /^(?:else(?:\s+if\b)?|if|for|while)\b/.test(t) && !s.includes('{');
+        };
+        if (openBraceless(samePrefix) || (prev && openBraceless(prev)))
+            continue;
+        const refRe = new RegExp(`(?<![\\w.])${guarded}\\b`);
+        // Credit only lines where `<v>` is a whole call argument, `f(<v>)`, so a
+        // second tainted value on the same line (`forName(v + other)`) still reports.
+        const wholeArgRe = new RegExp(`\\(\\s*${guarded}\\s*\\)`);
+        const reassignRe = new RegExp(`(?<![\\w.])${guarded}\\s*(?:=(?!=)|\\+=)`);
+        for (let l = i + 1; l < Math.min(method.end_line, lines.length); l++) {
+            const lt = lines[l];
+            if (reassignRe.test(lt))
+                break;
+            if (!refRe.test(lt) || !wholeArgRe.test(lt))
+                continue;
+            sanitizers.push({
+                type: 'java_reflection_allowlist_guard',
+                method: 'contains',
+                line: l + 1,
+                sanitizes: ['code_injection'],
+            });
+        }
+    }
+    return sanitizers;
+}
 /**
  * Does the `if (...)` guard on `lines[i]` actually **reject**?
  *
@@ -5785,6 +6156,212 @@ function guardRejects(lines, i, terminatorRe, window) {
  * form `if (x.StartsWith(root)) { … }` still reports, and a test pins that so
  * the gap stays visible rather than silently assumed.
  */
+/**
+ * cognium-dev#293 (Java cell): membership in a literal allow-list followed by
+ * a reject is a guard.
+ *
+ *   if (!Set.of("locale", "theme").contains(key)) throw new IllegalArgumentException();
+ *   req.getSession().setAttribute(key, value);       // was trust_boundary on `key`
+ *
+ * Past the guard, `key` is one of the listed string constants. The set must
+ * be written out as string literals: inline `Set.of` / `List.of` /
+ * `Arrays.asList`, or a `static final` constant of the same file initialised
+ * from one of them. A set built any other way (a parameter, a config read, a
+ * mutable collection) is not credited: its contents are unknown.
+ *
+ * Only the guarded variable is credited, from the guard to the end of the
+ * enclosing method or the variable's next reassignment, and only when the
+ * guard rejects (`guardRejects`).
+ */
+const JAVA_OPERAND_KEYWORDS = new Set([
+    'new', 'return', 'this', 'super', 'null', 'true', 'false', 'throw', 'if', 'else', 'instanceof',
+    'int', 'long', 'short', 'byte', 'char', 'boolean', 'double', 'float', 'var', 'final',
+]);
+/**
+ * True when `expr` is only `name`, string literals, `.length()` / `.size()`,
+ * and `+` (no other locals or value-producing calls).
+ */
+function javaExprOnlyGuardedAndLits(expr, name) {
+    let s = expr
+        .replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g, '')
+        .replace(/\.\s*(?:length|size)\s*\(\s*\)/g, '')
+        .replace(new RegExp(String.raw `\b${name}\b`, 'g'), '');
+    s = s.replace(/[+\s()]/g, '');
+    return s.length === 0;
+}
+/** Top-level comma-separated arguments of a call, respecting quotes and nesting. */
+function javaSplitCallArgs(argsText) {
+    const out = [];
+    let depth = 0;
+    let quote = null;
+    let start = 0;
+    for (let i = 0; i < argsText.length; i++) {
+        const c = argsText[i];
+        if (quote) {
+            if (c === '\\') {
+                i++;
+                continue;
+            }
+            if (c === quote)
+                quote = null;
+            continue;
+        }
+        if (c === '"' || c === "'") {
+            quote = c;
+            continue;
+        }
+        if (c === '(' || c === '[' || c === '{')
+            depth++;
+        else if (c === ')' || c === ']' || c === '}')
+            depth--;
+        else if (c === ',' && depth === 0) {
+            out.push(argsText.slice(start, i).trim());
+            start = i + 1;
+        }
+    }
+    const last = argsText.slice(start).trim();
+    if (last || out.length > 0)
+        out.push(last);
+    return out;
+}
+/**
+ * True when a call on `line` (other than length/size) has an argument that is
+ * not only string literals and the guarded variable — a raw operand.
+ */
+function javaCallHasRawArgument(line, name) {
+    const re = /\b([A-Za-z_]\w*)\s*\(/g;
+    let m;
+    while ((m = re.exec(line)) !== null) {
+        const method = m[1];
+        if (method === 'length' || method === 'size')
+            continue;
+        const open = m.index + m[0].length - 1;
+        let depth = 0;
+        let quote = null;
+        let end = -1;
+        for (let i = open; i < line.length; i++) {
+            const c = line[i];
+            if (quote) {
+                if (c === '\\') {
+                    i++;
+                    continue;
+                }
+                if (c === quote)
+                    quote = null;
+                continue;
+            }
+            if (c === '"' || c === "'") {
+                quote = c;
+                continue;
+            }
+            if (c === '(')
+                depth++;
+            else if (c === ')') {
+                depth--;
+                if (depth === 0) {
+                    end = i;
+                    break;
+                }
+            }
+        }
+        if (end < 0)
+            continue;
+        for (const arg of javaSplitCallArgs(line.slice(open + 1, end))) {
+            if (!arg)
+                continue;
+            if (!javaExprOnlyGuardedAndLits(arg, name))
+                return true;
+        }
+    }
+    return false;
+}
+/**
+ * True when `line` reads a lower-case identifier other than `name` as a value
+ * (not a receiver, call name, member, type, constant or the assigned local),
+ * or a call whose argument is not only string literals / `name` (a call-shaped
+ * raw operand such as `req.getParameter("level")` beside the guarded local).
+ */
+function otherLocalOperand(line, name) {
+    if (javaCallHasRawArgument(line, name))
+        return true;
+    const s = line
+        .replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g, '""')
+        .replace(/^\s*(?:[\w<>[\],.?]+\s+)?[A-Za-z_]\w*\s*=(?!=)/, ' ')
+        .replace(/\.\s*[A-Za-z_]\w*/g, ' ')
+        .replace(/\b[A-Za-z_]\w*(?=\s*[.(])/g, ' ');
+    return (s.match(/\b[a-z_]\w*\b/g) ?? []).some(id => id !== name && !JAVA_OPERAND_KEYWORDS.has(id));
+}
+function findJavaLiteralAllowlistGuardSanitizers(code) {
+    const sanitizers = [];
+    const lines = code.split('\n');
+    const literalList = String.raw `(?:Set|List)\s*\.\s*of|Arrays\s*\.\s*asList`;
+    const literalArgs = String.raw `\(\s*"(?:[^"\\]|\\.)*"(?:\s*,\s*"(?:[^"\\]|\\.)*")*\s*\)`;
+    // Constants declared from a literal list in this file.
+    const constants = new Set();
+    const constRe = new RegExp(String.raw `\bstatic\s+final\s+[\w<>,.\s]+?\s([A-Za-z_]\w*)\s*=\s*(?:${literalList})\s*${literalArgs}\s*;`);
+    for (const l of lines) {
+        const m = constRe.exec(l);
+        if (m)
+            constants.add(m[1]);
+    }
+    const guardRe = new RegExp(String.raw `\bif\s*\(\s*!\s*(?:(?:${literalList})\s*${literalArgs}|([A-Za-z_]\w*))\s*\.\s*contains\s*\(\s*([A-Za-z_]\w*)\s*\)\s*\)`);
+    const terminatorRe = /\b(throw|return)\b/;
+    for (let i = 0; i < lines.length; i++) {
+        const m = guardRe.exec(lines[i]);
+        if (!m)
+            continue;
+        if (m[1] !== undefined && !constants.has(m[1]))
+            continue;
+        if (!guardRejects(lines, i, terminatorRe, 6))
+            continue;
+        const name = m[2];
+        const mention = new RegExp(String.raw `(?<![\w.])${name}\b`);
+        const reassign = new RegExp(String.raw `^\s*(?:[\w.<>[\]]+\s+)?${name}\s*=(?!=)`);
+        // Skip the guard's own block, then credit to the end of the enclosing method.
+        let start = i + 1;
+        if (/\{\s*$/.test(lines[i])) {
+            for (let d = 0, j = i; j < lines.length; j++) {
+                for (const ch of lines[j]) {
+                    if (ch === '{')
+                        d++;
+                    else if (ch === '}')
+                        d--;
+                }
+                if (d <= 0) {
+                    start = j + 1;
+                    break;
+                }
+            }
+        }
+        for (let j = start, d = 0; j < lines.length; j++) {
+            for (const ch of lines[j]) {
+                if (ch === '{')
+                    d++;
+                else if (ch === '}')
+                    d--;
+            }
+            if (d < 0)
+                break;
+            if (reassign.test(lines[j]))
+                break;
+            if (!mention.test(lines[j]))
+                continue;
+            // The credit is line-keyed: a line that also carries another local
+            // (`"... n='" + who + "' ORDER BY " + col`) would clean `who` too.
+            if (otherLocalOperand(lines[j], name))
+                continue;
+            sanitizers.push({
+                type: 'java_literal_allowlist_guard',
+                method: 'guard',
+                line: j + 1,
+                sanitizes: ['trust_boundary', 'sql_injection', 'command_injection', 'path_traversal', 'ssrf',
+                    'ldap_injection', 'xpath_injection', 'log_injection', 'xss', 'open_redirect',
+                    'external_taint_escape'],
+            });
+        }
+    }
+    return sanitizers;
+}
 /**
  * cognium-dev#272 — a validating predicate followed by an EARLY RETURN is a
  * guard, and the value reaching the sink afterwards is already validated.
@@ -6052,6 +6629,19 @@ function findJavaPathGetFileNameSanitizers(code) {
  * strips CRLF. In Java that means an explicit `String`/`CharSequence` return
  * type, which keeps `void` log-and-forget methods out.
  */
+/** True when the Java text strips both `\r` and `\n` via replace / replaceAll (cognium-dev#605). */
+function javaBodyStripsCrAndLf(body) {
+    let cr = false;
+    let lf = false;
+    for (const m of body.matchAll(/\.\s*(replace|replaceAll)\s*\(\s*(?:"((?:\\.|[^"\\])*)"|'(\\.|[^'\\])')/g)) {
+        const cov = javaReplaceCrLfCoverage(m[1], m[2] ?? m[3] ?? '');
+        if (cov.cr)
+            cr = true;
+        if (cov.lf)
+            lf = true;
+    }
+    return cr && lf;
+}
 function findCrlfWrapperFunctionSanitizers(code, language) {
     const sanitizers = [];
     const lines = code.split('\n');
@@ -6068,8 +6658,25 @@ function findCrlfWrapperFunctionSanitizers(code, language) {
         const m = declRe.exec(lines[i]);
         if (!m)
             continue;
-        const body = lines.slice(i, Math.min(lines.length, i + bodyWindow)).join('\n');
-        if (stripRe.test(body))
+        if (language !== 'java') {
+            const body = lines.slice(i, Math.min(lines.length, i + bodyWindow)).join('\n');
+            if (stripRe.test(body))
+                wrappers.add(m[1]);
+            continue;
+        }
+        // Java: stop at the next declaration so one helper's body does not
+        // credit the helper above it, and require the strip to cover BOTH CR and
+        // LF. An LF-only `replace("\n", "")` leaves CR, which still forges a
+        // log line (cognium-dev#605).
+        let end = Math.min(lines.length, i + bodyWindow);
+        for (let j = i + 1; j < end; j++) {
+            if (declRe.test(lines[j])) {
+                end = j;
+                break;
+            }
+        }
+        const body = lines.slice(i, end).join('\n');
+        if (javaBodyStripsCrAndLf(body))
             wrappers.add(m[1]);
     }
     if (wrappers.size === 0)
@@ -7160,8 +7767,13 @@ export function findJsPatternFindings(code, file) {
  *      the args is wrapped in a recognized HTML escaper
  *      (`html.EscapeString` / `template.HTMLEscapeString` /
  *      `template.HTMLEscaper`).
+ *
+ * A write whose every argument is a local holding an int or bool measure of
+ * a value (`scalarVarsAt(line)`, #568 — `fmt.Fprintf(w, "%d", n)` with
+ * `n := len(...)`) is skipped. Any other argument, including request reads
+ * the taint engine has no source for (`r.URL.Path`), still reports.
  */
-export function findGoXssFindings(code, file) {
+export function findGoXssFindings(code, file, scalarVarsAt = () => new Set()) {
     const out = [];
     const lines = code.split('\n');
     const rwNames = new Set();
@@ -7192,6 +7804,11 @@ export function findGoXssFindings(code, file) {
         // Require at least one identifier in tail outside string literals.
         if (!/[A-Za-z_]\w*/.test(tail.replace(/"[^"]*"|`[^`]*`/g, '')))
             continue;
+        const idents = tail.replace(/"(?:[^"\\]|\\.)*"|`[^`]*`/g, '')
+            .match(/[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*/g) ?? [];
+        const scalars = scalarVarsAt(i + 1);
+        if (idents.length > 0 && idents.every(id => scalars.has(id)))
+            continue;
         out.push({
             id: `xss-${file}-${i + 1}`,
             pass: 'language-sources',
@@ -10556,4 +11173,219 @@ export function findJsTemplateInjectionSstiFindings(code, file) {
     }
     return findings;
 }
+// ---------------------------------------------------------------------------
+// cognium-dev#566 — Spring MVC return-as-body XSS (Java)
+// ---------------------------------------------------------------------------
+const SPRING_MAPPING_ANN = /^(?:Get|Post|Put|Delete|Patch|Request)Mapping\b/;
+const SPRING_WEB_PARAM_ANN = /^(?:RequestParam|PathVariable|RequestHeader|CookieValue|MatrixVariable)\b/;
+const SPRING_NON_TEXT_PARAM_TYPE = /^(?:int|long|short|byte|double|float|boolean|char|Integer|Long|Short|Byte|Double|Float|Boolean|Character|BigDecimal|BigInteger|UUID|LocalDate|LocalDateTime|LocalTime|Instant|OffsetDateTime|ZonedDateTime|Date)$/;
+/**
+ * Value of `produces = …` on a `@*Mapping` annotation, or null when absent.
+ * Only the produces value is considered — a path like `/widgets.html` must not
+ * look like an HTML media type.
+ */
+function springProducesValue(annotations) {
+    for (const a of annotations) {
+        if (!/^\w+Mapping\b/.test(a) || !/\bproduces\s*=/.test(a))
+            continue;
+        const m = /\bproduces\s*=\s*(?:\{([^}]*)\}|([^,)]+))/.exec(a);
+        if (!m)
+            continue;
+        return (m[1] ?? m[2] ?? '').trim();
+    }
+    return null;
+}
+/** True when a produces value names a non-HTML media type. */
+function springProducesValueIsNonHtml(value) {
+    return !/html/i.test(value);
+}
+/** Markup or string concatenation around a value (the Python return-XSS gate, #368). */
+function javaExprLooksLikeHtml(expr) {
+    return /"[^"]*<[^"]*"/.test(expr) || /"\s*\+/.test(expr) || /\+\s*"/.test(expr);
+}
+/** Parentheses outside string literals never close below depth 0 and end at 0. */
+function javaParensBalanced(expr) {
+    let depth = 0;
+    for (const ch of expr.replace(/"(?:[^"\\]|\\.)*"/g, '""')) {
+        if (ch === '(')
+            depth++;
+        else if (ch === ')' && --depth < 0)
+            return false;
+    }
+    return depth === 0;
+}
+/**
+ * cognium-dev#566 — the value a Spring MVC handler returns is the response
+ * body when the class is `@RestController` (or `@ResponseBody` sits on the
+ * class or the method), and always when the handler returns a
+ * `ResponseEntity`. A `String` body is written with the negotiated content
+ * type, so a browser request gets it as `text/html`: request data
+ * concatenated into markup there is reflected XSS.
+ *
+ * Positive evidence only:
+ *   - the method carries a `@*Mapping` annotation;
+ *   - it returns `String` under a body-writing controller, or
+ *     `ResponseEntity<String>` via `ResponseEntity.ok(x)` /
+ *     `new ResponseEntity<>(x, …)` (the builder `.body(x)` form is left to
+ *     SinkFilterPass Stage 15c's text/html content-type rule);
+ *   - the returned expression references a request-bound parameter
+ *     (`@RequestParam`, `@PathVariable`, `@RequestHeader`, `@CookieValue`,
+ *     `@MatrixVariable`, a `String` `@RequestBody`) or an in-method source,
+ *     directly or through a local assigned from it, and looks like HTML
+ *     (markup or string concatenation, directly or in that local's assignment).
+ *
+ * Not a sink: a plain `@Controller` returning a `String` (a view name),
+ * `produces = ` a non-HTML media type on the method or class mapping, a
+ * non-`String` return (serialised as JSON), a returned value that does not
+ * look like markup, and any handler with an xss-covering sanitizer between
+ * its start and the return.
+ */
+export function findJavaSpringReturnXSSSinks(code, types, sources, xssSanitizerLines) {
+    const out = [];
+    const lines = code.split('\n');
+    const esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const stripStrings = (s) => s.replace(/"(?:[^"\\]|\\.)*"/g, '""');
+    const refers = (expr, name) => new RegExp(`(?<![\\w.])${esc(name)}\\b`).test(stripStrings(expr));
+    for (const t of types) {
+        const ann = t.annotations ?? [];
+        const isRest = ann.some(a => /^RestController\b/.test(a));
+        if (!isRest && !ann.some(a => /^Controller\b/.test(a)))
+            continue;
+        const classProduces = springProducesValue(ann);
+        const classBody = isRest || ann.some(a => /^ResponseBody\b/.test(a));
+        for (const m of t.methods) {
+            if (!m.annotations.some(a => SPRING_MAPPING_ANN.test(a)))
+                continue;
+            // Method-level produces overrides class-level; only non-HTML suppresses.
+            const methodProduces = springProducesValue(m.annotations);
+            const produces = methodProduces ?? classProduces;
+            if (produces != null && springProducesValueIsNonHtml(produces))
+                continue;
+            const rt = (m.return_type ?? '').replace(/\s+/g, '');
+            const entity = rt === 'ResponseEntity<String>';
+            const body = rt === 'String' && (classBody || m.annotations.some(a => /^ResponseBody\b/.test(a)));
+            if (!entity && !body)
+                continue;
+            // Seeds: request-bound parameters, then in-method sources with a variable.
+            const seeds = new Map();
+            for (const p of m.parameters) {
+                // Spring converts to the declared type first: a number, boolean,
+                // UUID or date cannot carry markup.
+                if (SPRING_NON_TEXT_PARAM_TYPE.test((p.type ?? '').replace(/^(?:[\w]+\.)+/, '')))
+                    continue;
+                const bound = p.annotations.some(a => SPRING_WEB_PARAM_ANN.test(a))
+                    || (p.annotations.some(a => /^RequestBody\b/.test(a)) && p.type === 'String');
+                if (bound)
+                    seeds.set(p.name, p.line ?? m.start_line);
+            }
+            for (const s of sources) {
+                // A plain parameter of the handler is not request data by itself.
+                if (s.type === 'interprocedural_param')
+                    continue;
+                if (!s.variable || !/^[A-Za-z_]\w*$/.test(s.variable))
+                    continue;
+                if (s.line > m.start_line && s.line <= m.end_line && !seeds.has(s.variable))
+                    seeds.set(s.variable, s.line);
+            }
+            if (seeds.size === 0)
+                continue;
+            // Locals assigned from a seed (method body only), each tied to its seed's line.
+            const bodyText = lines.slice(m.start_line - 1, m.end_line).join('\n');
+            const carriers = new Map();
+            for (const [n, l] of seeds)
+                carriers.set(n, { sourceLine: l, assignLine: l });
+            const derived = [...buildJavaTaintedVars(bodyText, new Set(seeds.keys()))].sort((a, b) => a[1] - b[1]);
+            for (const [n, rel] of derived) {
+                if (carriers.has(n))
+                    continue;
+                const assignLine = m.start_line + rel - 1;
+                const from = [...carriers].find(([c]) => refers(lines[assignLine - 1] ?? '', c));
+                carriers.set(n, { sourceLine: from ? from[1].sourceLine : m.start_line, assignLine });
+            }
+            for (let i = m.start_line - 1; i < Math.min(m.end_line, lines.length); i++) {
+                if (!/^\s*return\b/.test(lines[i] ?? ''))
+                    continue;
+                let stmt = lines[i];
+                for (let j = i + 1; !stmt.includes(';') && j < Math.min(m.end_line, lines.length); j++)
+                    stmt += ' ' + lines[j];
+                stmt = stmt.replace(/^\s*return\b/, '').replace(/;[^;]*$/, '');
+                const sinkLine = i + 1;
+                let expr = stmt;
+                if (entity) {
+                    // `ResponseEntity.ok(x)` / `new ResponseEntity<>(x, status)` only. The
+                    // builder `.body(x)` form stays with SinkFilterPass Stage 15c, which
+                    // keeps it only next to an explicit text/html signal.
+                    const em = /^\s*ResponseEntity\s*\.\s*ok\s*\(([\s\S]+)\)\s*$/.exec(stmt)
+                        ?? /^\s*new\s+ResponseEntity\s*(?:<[^>]*>)?\s*\(([\s\S]+),[^,()]*\)\s*$/.exec(stmt);
+                    if (!em || !javaParensBalanced(em[1]))
+                        continue;
+                    expr = em[1];
+                }
+                const hit = [...carriers].find(([c, info]) => info.assignLine <= sinkLine && refers(expr, c));
+                if (!hit)
+                    continue;
+                const [name, info] = hit;
+                let htmlish = javaExprLooksLikeHtml(expr);
+                if (!htmlish && new RegExp(`^\\s*${esc(name)}\\s*$`).test(expr) && info.assignLine !== info.sourceLine) {
+                    htmlish = javaExprLooksLikeHtml(lines[info.assignLine - 1] ?? '');
+                }
+                if (!htmlish)
+                    continue;
+                // Suppress only when an xss sanitizer's operand is the returned carrier
+                // (or the carrier local was assigned from that sanitizer). Escaping a
+                // different variable must not clear a return of another carrier.
+                const xssEscapeOpRe = /\b(?:Encode\.(?:forHtml|forHtmlAttribute|forHtmlContent|forJavaScript)|StringEscapeUtils\.escape(?:Html3|Html4|EcmaScript|Xml)|HtmlUtils\.htmlEscape(?:Decimal|Hex)?|Escaper\.escapeHtml|HtmlEscapers\.(?:escapeHtml|htmlEscaper)|Encoder\.encodeForHTML(?:Attribute)?|Jsoup\.clean)\s*\(\s*([A-Za-z_]\w*)/;
+                const sanitizerCoversCarrier = xssSanitizerLines.some(l => {
+                    if (l < m.start_line || l > sinkLine)
+                        return false;
+                    const line = lines[l - 1] ?? '';
+                    const ops = [];
+                    let sm;
+                    const re = new RegExp(xssEscapeOpRe.source, 'g');
+                    while ((sm = re.exec(line)) !== null)
+                        ops.push(sm[1]);
+                    // Unparsed shapes (e.g. static-import `htmlEscape(title)`) do not suppress.
+                    if (ops.length === 0)
+                        return false;
+                    // Operand is the returned carrier.
+                    if (ops.some(op => op === name))
+                        return true;
+                    // Carrier assigned from the sanitizer call itself (`body = HtmlUtils.htmlEscape(x)`),
+                    // not a concat that merely mentions a sanitizer on the assignment line.
+                    if (l === info.assignLine) {
+                        const stripped = line.replace(/"(?:[^"\\]|\\.)*"/g, '""').trim();
+                        const am = new RegExp(`\\b${esc(name)}\\s*=\\s*(.+)$`).exec(stripped);
+                        if (!am)
+                            return false;
+                        const rhs = am[1].replace(/;\s*$/, '').trim();
+                        const call = xssEscapeOpRe.exec(rhs);
+                        if (!call || call.index !== 0)
+                            return false;
+                        // Whole RHS is one sanitizer invocation (no concatenation outside the call).
+                        let depth = 0;
+                        let ended = -1;
+                        for (let k = call.index; k < rhs.length; k++) {
+                            const ch = rhs[k];
+                            if (ch === '(')
+                                depth++;
+                            else if (ch === ')') {
+                                depth--;
+                                if (depth === 0) {
+                                    ended = k;
+                                    break;
+                                }
+                            }
+                        }
+                        return ended >= 0 && rhs.slice(ended + 1).trim() === '';
+                    }
+                    return false;
+                });
+                if (sanitizerCoversCarrier)
+                    continue;
+                out.push({ sinkLine, sourceLine: info.sourceLine });
+            }
+        }
+    }
+    return out;
+}
 //# sourceMappingURL=language-sources-pass.js.map