circle-ir 4.14.2 → 4.15.0

package/dist/analysis/passes/param-source-flow-gate-pass.d.ts

@@ -27,6 +27,14 @@
  *    `@router.get(...)`, `@Get()`), Rust route attributes (`#[get("/<x>")]`)
  *    and Rust handlers returning a web response type (`HttpResponse`,
  *    `impl Responder`, `impl warp::Reply`, ...).
+ *  - A parameter that a real source in the same file feeds is kept
+ *    (cognium-dev #684): `function grep(t) {…}` called as
+ *    `grep(req.query.t)`, a class method called as `svc.run(req.body.c)`,
+ *    a class constructed with `new C(req.query.u)`, or a function handed to
+ *    an executor that runs it (`pool.submit(fn, q)`). A bare call never
+ *    feeds a class method and a call through a receiver never feeds a
+ *    module function. Arguments passed through a sanitizer do not count,
+ *    and `external_taint_escape` stays gated.
  *
  * Only flows are gated; the source list is untouched, so passes and
  * consumers that read `taint.sources` (cross-file resolution, co-occurrence

package/dist/analysis/passes/param-source-flow-gate-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"param-source-flow-gate-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/param-source-flow-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E,OAAO,KAAK,EAAE,UAAU,EAAiB,MAAM,sBAAsB,CAAC;AAEtE,MAAM,WAAW,yBAAyB;IACxC,8DAA8D;IAC9D,OAAO,EAAE,OAAO,CAAC;IACjB,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AA2CD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAOjG;AAED,qBAAa,uBAAwB,YAAW,YAAY,CAAC,yBAAyB,CAAC;IAIzE,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IAHlD,QAAQ,CAAC,IAAI,4BAA4B;IACzC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,YAA6B,qBAAqB,EAAE,OAAO,EAAI;IAE/D,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,yBAAyB,CA+C/C;CACF"}
+{"version":3,"file":"param-source-flow-gate-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/param-source-flow-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E,OAAO,KAAK,EAAE,UAAU,EAA8B,MAAM,sBAAsB,CAAC;AAEnF,MAAM,WAAW,yBAAyB;IACxC,8DAA8D;IAC9D,OAAO,EAAE,OAAO,CAAC;IACjB,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AA2CD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAOjG;AAkHD,qBAAa,uBAAwB,YAAW,YAAY,CAAC,yBAAyB,CAAC;IAIzE,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IAHlD,QAAQ,CAAC,IAAI,4BAA4B;IACzC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,YAA6B,qBAAqB,EAAE,OAAO,EAAI;IAE/D,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,yBAAyB,CAwF/C;CACF"}

package/dist/analysis/passes/param-source-flow-gate-pass.js

@@ -27,6 +27,14 @@
  *    `@router.get(...)`, `@Get()`), Rust route attributes (`#[get("/<x>")]`)
  *    and Rust handlers returning a web response type (`HttpResponse`,
  *    `impl Responder`, `impl warp::Reply`, ...).
+ *  - A parameter that a real source in the same file feeds is kept
+ *    (cognium-dev #684): `function grep(t) {…}` called as
+ *    `grep(req.query.t)`, a class method called as `svc.run(req.body.c)`,
+ *    a class constructed with `new C(req.query.u)`, or a function handed to
+ *    an executor that runs it (`pool.submit(fn, q)`). A bare call never
+ *    feeds a class method and a call through a receiver never feeds a
+ *    module function. Arguments passed through a sanitizer do not count,
+ *    and `external_taint_escape` stays gated.
  *
  * Only flows are gated; the source list is untouched, so passes and
  * consumers that read `taint.sources` (cross-file resolution, co-occurrence
@@ -80,6 +88,108 @@ export function isFrameworkHandler(method, language, lines) {
     }
     return false;
 }
+/** Sources that stand for a constructor-injected field or a getter over one (#78). */
+const FIELD_CARRIED_SOURCE = /constructor-injected field|returns tainted field/;
+/**
+ * Calls that invoke a function passed to them with the arguments that follow
+ * it, keyed by method name. The value is how many of those arguments are not
+ * forwarded (`setTimeout(fn, delay, a)` passes only `a`). Executor and
+ * scheduler shapes only: `pool.submit(fn, q)`,
+ * `loop.run_in_executor(None, fn, q)`, `asyncio.to_thread(fn, q)`,
+ * `loop.call_soon(fn, q)`, `setImmediate(fn, q)`, `process.nextTick(fn, q)`.
+ */
+const EXECUTOR_CALLEES = new Map([
+    ['submit', 0], ['run_in_executor', 0], ['to_thread', 0], ['run_sync', 0],
+    ['call_soon', 0], ['call_soon_threadsafe', 0], ['call_later', 0], ['call_at', 0],
+    ['setImmediate', 0], ['nextTick', 0], ['queueMicrotask', 0],
+    ['setTimeout', 1], ['setInterval', 1],
+]);
+/** `name` as a whole identifier (names may contain `$`). */
+function identifierRe(name) {
+    return new RegExp(`(?:^|[^\\w$.])${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![\\w$])`);
+}
+function realFedParams(ctx, sources) {
+    const out = { params: new Set(), classes: new Set() };
+    const { graph } = ctx;
+    const seeds = new Set();
+    const allMethods = graph.ir.types.flatMap(t => t.methods);
+    // Variables a real source binds directly (`q = request.args.get("q")`),
+    // with the method that binds them: a `name` bound in one handler says
+    // nothing about a `name` local to another function. The Python DFG does
+    // not model every function body, so the binding is the fallback evidence.
+    const boundVars = new Map();
+    // Source reads written inline as an argument (`sink(request.args.get("q"))`),
+    // by line: the read's text as the source location names it.
+    const inlineReads = new Map();
+    for (const s of sources) {
+        if (s.type === 'interprocedural_param')
+            continue;
+        for (const d of graph.defsAtLine(s.line))
+            seeds.add(d.id);
+        if (s.variable) {
+            const where = boundVars.get(s.variable) ?? new Set();
+            where.add(enclosingMethod(allMethods, s.line));
+            boundVars.set(s.variable, where);
+        }
+        const read = /^([\w$.]+?)(?:\(\))? in /.exec(s.location ?? '')?.[1];
+        if (read && read.includes('.'))
+            inlineReads.set(s.line, [...(inlineReads.get(s.line) ?? []), read]);
+    }
+    const tainted = graph.propagateTaintedDefIds(seeds);
+    // Sanitizer calls by line, as the bare method name (`shlex.quote()` -> `quote`).
+    const sanitizerNames = new Map();
+    if (ctx.hasResult('sink-filter')) {
+        for (const sa of ctx.getResult('sink-filter').sanitizers) {
+            const name = /([\w$]+)\(?\)?$/.exec(sa.method)?.[1];
+            if (name)
+                sanitizerNames.set(sa.line, [...(sanitizerNames.get(sa.line) ?? []), name]);
+        }
+    }
+    const classNames = new Set(graph.ir.types.map(t => t.name));
+    const functionNames = new Set(graph.ir.types.flatMap(t => t.methods.map(m => m.name)));
+    for (const call of graph.ir.calls) {
+        const line = call.location.line;
+        const uses = graph.usesAtLine(line).filter(u => u.def_id !== null && tainted.has(u.def_id));
+        const reads = inlineReads.get(line) ?? [];
+        const sanitizersHere = sanitizerNames.get(line) ?? [];
+        const callMethod = enclosingMethod(allMethods, line);
+        const isFed = (expr, variable) => 
+        // An argument passed through a sanitizer is not the raw request value.
+        !sanitizersHere.some(n => expr.includes(`${n}(`)) && ((!!variable && !!boundVars.get(variable)?.has(callMethod)) ||
+            reads.some(r => expr.includes(r)) ||
+            // The argument's own identifiers, not those of a sibling argument.
+            uses.some(u => identifierRe(u.variable).test(expr)));
+        // A local function handed over by reference to a call that runs it
+        // receives the arguments that follow it (`pool.submit(render, q)`,
+        // `loop.run_in_executor(None, f, q)`). Only callees known to invoke their
+        // function argument count: `print(banner, name)` or
+        // `audit.record(banner, name)` only pass `banner` along.
+        const skipAfterCallback = EXECUTOR_CALLEES.get(call.method_name);
+        let callbackName = null;
+        let callbackPos = -1;
+        for (const arg of call.arguments) {
+            const expr = typeof arg.expression === 'string' ? arg.expression.trim() : '';
+            if (skipAfterCallback !== undefined && callbackName === null && functionNames.has(expr)) {
+                callbackName = expr;
+                callbackPos = arg.position;
+                continue;
+            }
+            if (!isFed(expr, arg.variable))
+                continue;
+            // `res.send(req.query.m)` is a call on another object; it feeds a
+            // class method named `send`, never a module-level `function send`.
+            out.params.add(`${call.receiver ? 'm' : 'f'}:${call.method_name}:${arg.position}`);
+            if (classNames.has(call.method_name))
+                out.classes.add(call.method_name);
+            if (callbackName !== null) {
+                const pos = arg.position - callbackPos - 1 - (skipAfterCallback ?? 0);
+                if (pos >= 0)
+                    out.params.add(`f:${callbackName}:${pos}`);
+            }
+        }
+    }
+    return out;
+}
 export class ParamSourceFlowGatePass {
     keepParamSourcedFlows;
     name = 'param-source-flow-gate';
@@ -114,13 +224,59 @@ export class ParamSourceFlowGatePass {
         // the surviving flow may cite the parameter while the evidence is the
         // real source. Those flows are kept.
         const realSourceLines = new Set();
-        if (ctx.hasResult('sink-filter')) {
-            const sources = ctx.getResult('sink-filter').sources;
+        const sources = ctx.hasResult('sink-filter') ? ctx.getResult('sink-filter').sources : [];
+        for (const s of sources) {
+            if (s.type !== 'interprocedural_param')
+                realSourceLines.add(s.line);
+        }
+        // Computed on first need: most files have no parameter-only flow.
+        let fed;
+        const fedByRealSource = (f, m) => {
+            // The CWE-668 escape fallback names no concrete sink; a fed parameter
+            // does not make it more than a hint, so it stays gated.
+            if (f.sink_type === 'external_taint_escape')
+                return false;
+            fed ??= realFedParams(ctx, sources);
+            if (fed.params.size === 0)
+                return false;
+            const owner = ctx.graph.ir.types.find(t => t.methods.includes(m));
+            // A constructor is invoked through its class name (`new C(…)`, `C(…)`).
+            const isCtor = (m.name === 'constructor' || m.name === '__init__') && !!owner;
+            const callee = isCtor && owner ? owner.name : m.name;
+            // A module-level function or a constructor is called without a
+            // receiver; a class method is reached through one (`svc.run(x)`). Each
+            // matches its own call shape only: a bare `send(req.query.m)` does not
+            // run `Mailer.prototype.send`, and `res.send(…)` does not run a
+            // module-level `function send`.
+            const viaReceiver = !isCtor && !!owner && owner.name !== '<module>';
+            const feeds = (pos) => fed.params.has(`${viaReceiver ? 'm' : 'f'}:${callee}:${pos}`);
+            // When the flow's first step names a parameter, only that parameter
+            // counts: every parameter shares the signature line, and `f(a, b)`
+            // called as `f(req.query.a, 'x')` does not feed `b`.
+            const head = f.path[0]?.variable;
+            const named = m.parameters.findIndex(p => p.name === head);
+            if (named >= 0)
+                return feeds(named);
             for (const s of sources) {
-                if (s.type !== 'interprocedural_param')
-                    realSourceLines.add(s.line);
+                if (s.line !== f.source_line || s.type !== 'interprocedural_param')
+                    continue;
+                if (FIELD_CARRIED_SOURCE.test(s.location ?? '')) {
+                    if (owner && fed.classes.has(owner.name))
+                        return true;
+                    continue;
+                }
+                // The source names its parameter in `variable` (Java / C#) or in its
+                // location, `<type> <name> in <method>` (taint-matcher).
+                const pos = m.parameters.findIndex(p => s.variable
+                    ? p.name === s.variable
+                    : (s.location ?? '').endsWith(` ${p.name} in ${m.name}`));
+                if (pos < 0)
+                    continue;
+                if (feeds(pos))
+                    return true;
             }
-        }
+            return false;
+        };
         // In-place filter: `additionalFlows` is the list the analyzer assigns to
         // `taint.flows` after the pipeline.
         let w = 0;
@@ -128,7 +284,7 @@ export class ParamSourceFlowGatePass {
             let keep = true;
             if (f.source_type === 'interprocedural_param' && !realSourceLines.has(f.source_line)) {
                 const m = enclosingMethod(methods, f.source_line);
-                keep = m !== undefined && isHandler(m);
+                keep = m !== undefined && (isHandler(m) || fedByRealSource(f, m));
             }
             if (keep)
                 flows[w++] = f;

package/dist/analysis/passes/param-source-flow-gate-pass.js.map

@@ -1 +1 @@
-{"version":3,"file":"param-source-flow-gate-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/param-source-flow-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAgBH,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,gBAAgB,GACpB,mMAAmM,CAAC;AAEtM,gEAAgE;AAChE,MAAM,eAAe,GACnB,iGAAiG,CAAC;AAEpG,0DAA0D;AAC1D,MAAM,mBAAmB,GACvB,wEAAwE,CAAC;AAE3E,SAAS,eAAe,CAAC,OAAqB,EAAE,IAAY;IAC1D,IAAI,IAA4B,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU;gBAAE,IAAI,GAAG,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qEAAqE;AACrE,SAAS,mBAAmB,CAAC,KAAe,EAAE,SAAiB;IAC7D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7C,MAAM;IACR,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAkB,EAAE,QAAgB,EAAE,KAAe;IACtF,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,IAAI,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAClG,IAAI,MAAM,CAAC,WAAW,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,uBAAuB;IAIL,qBAAqB;IAHzC,IAAI,GAAG,wBAAwB,CAAC;IAChC,QAAQ,GAAG,UAAmB,CAAC;IAExC,YAA6B,qBAA8B;qCAA9B,qBAAqB;IAAY,CAAC;IAE/D,GAAG,CAAC,GAAgB;QAClB,MAAM,MAAM,GAA8B,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC;QAChG,IAAI,IAAI,CAAC,qBAAqB,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,MAAM,CAAC;QACpF,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC;YAAE,OAAO,MAAM,CAAC;QACrD,MAAM,KAAK,GAAoB,GAAG,CAAC,SAAS,CAA4B,iBAAiB,CAAC,CAAC,eAAe,CAAC;QAC3G,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QAEtC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;QACpD,MAAM,SAAS,GAAG,CAAC,CAAa,EAAW,EAAE;YAC3C,IAAI,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YAChG,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;QAEF,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,qCAAqC;QACrC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAC1C,IAAI,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC,OAAO,CAAC;YACvE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,IAAI,KAAK,uBAAuB;oBAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,oCAAoC;QACpC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,IAAI,GAAG,IAAI,CAAC;YAChB,IAAI,CAAC,CAAC,WAAW,KAAK,uBAAuB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrF,MAAM,CAAC,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;gBAClD,IAAI,GAAG,CAAC,KAAK,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,IAAI;gBAAE,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;iBACpB,CAAC;gBACJ,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACjB,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
+{"version":3,"file":"param-source-flow-gate-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/param-source-flow-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAgBH,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,gBAAgB,GACpB,mMAAmM,CAAC;AAEtM,gEAAgE;AAChE,MAAM,eAAe,GACnB,iGAAiG,CAAC;AAEpG,0DAA0D;AAC1D,MAAM,mBAAmB,GACvB,wEAAwE,CAAC;AAE3E,SAAS,eAAe,CAAC,OAAqB,EAAE,IAAY;IAC1D,IAAI,IAA4B,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU;gBAAE,IAAI,GAAG,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qEAAqE;AACrE,SAAS,mBAAmB,CAAC,KAAe,EAAE,SAAiB;IAC7D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7C,MAAM;IACR,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAkB,EAAE,QAAgB,EAAE,KAAe;IACtF,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,IAAI,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAClG,IAAI,MAAM,CAAC,WAAW,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sFAAsF;AACtF,MAAM,oBAAoB,GAAG,kDAAkD,CAAC;AAchF;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAgC,IAAI,GAAG,CAAC;IAC5D,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;IACxE,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;IAChF,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC3D,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;CACtC,CAAC,CAAC;AAEH,4DAA4D;AAC5D,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,MAAM,CAAC,iBAAiB,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,aAAa,CAAC,GAAgB,EAAE,OAAsB;IAC7D,MAAM,GAAG,GAAkB,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IACrE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,UAAU,GAAG,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1D,wEAAwE;IACxE,sEAAsE;IACtE,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAuC,CAAC;IACjE,8EAA8E;IAC9E,4DAA4D;IAC5D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAoB,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,IAAI,KAAK,uBAAuB;YAAE,SAAS;QACjD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,EAA0B,CAAC;YAC7E,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/C,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,IAAI,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACpD,iFAAiF;IACjF,MAAM,cAAc,GAAG,IAAI,GAAG,EAAoB,CAAC;IACnD,IAAI,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC,UAAU,EAAE,CAAC;YAC3E,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACpD,IAAI,IAAI;gBAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5F,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,cAAc,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,QAAmC,EAAW,EAAE;QAC3E,uEAAuE;QACvE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CACrD,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACjC,mEAAmE;YACnE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvD,mEAAmE;QACnE,mEAAmE;QACnE,0EAA0E;QAC1E,oDAAoD;QACpD,yDAAyD;QACzD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjE,IAAI,YAAY,GAAkB,IAAI,CAAC;QACvC,IAAI,WAAW,GAAG,CAAC,CAAC,CAAC;QACrB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,IAAI,iBAAiB,KAAK,SAAS,IAAI,YAAY,KAAK,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxF,YAAY,GAAG,IAAI,CAAC;gBACpB,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC;gBAC3B,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACzC,kEAAkE;YAClE,mEAAmE;YACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnF,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;gBAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACxE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,GAAG,WAAW,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,CAAC,CAAC;gBACtE,IAAI,GAAG,IAAI,CAAC;oBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,YAAY,IAAI,GAAG,EAAE,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,uBAAuB;IAIL,qBAAqB;IAHzC,IAAI,GAAG,wBAAwB,CAAC;IAChC,QAAQ,GAAG,UAAmB,CAAC;IAExC,YAA6B,qBAA8B;qCAA9B,qBAAqB;IAAY,CAAC;IAE/D,GAAG,CAAC,GAAgB;QAClB,MAAM,MAAM,GAA8B,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC;QAChG,IAAI,IAAI,CAAC,qBAAqB,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,MAAM,CAAC;QACpF,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC;YAAE,OAAO,MAAM,CAAC;QACrD,MAAM,KAAK,GAAoB,GAAG,CAAC,SAAS,CAA4B,iBAAiB,CAAC,CAAC,eAAe,CAAC;QAC3G,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QAEtC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;QACpD,MAAM,SAAS,GAAG,CAAC,CAAa,EAAW,EAAE;YAC3C,IAAI,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YAChG,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;QAEF,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,qCAAqC;QACrC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3G,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,IAAI,KAAK,uBAAuB;gBAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtE,CAAC;QAED,kEAAkE;QAClE,IAAI,GAA8B,CAAC;QACnC,MAAM,eAAe,GAAG,CAAC,CAAgB,EAAE,CAAa,EAAW,EAAE;YACnE,sEAAsE;YACtE,wDAAwD;YACxD,IAAI,CAAC,CAAC,SAAS,KAAK,uBAAuB;gBAAE,OAAO,KAAK,CAAC;YAC1D,GAAG,KAAK,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACpC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAClE,wEAAwE;YACxE,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;YAC9E,MAAM,MAAM,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrD,+DAA+D;YAC/D,uEAAuE;YACvE,uEAAuE;YACvE,gEAAgE;YAChE,gCAAgC;YAChC,MAAM,WAAW,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;YACpE,MAAM,KAAK,GAAG,CAAC,GAAW,EAAW,EAAE,CACrC,GAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;YACjE,oEAAoE;YACpE,mEAAmE;YACnE,qDAAqD;YACrD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;YACjC,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAC3D,IAAI,KAAK,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,uBAAuB;oBAAE,SAAS;gBAC7E,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;oBAChD,IAAI,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;wBAAE,OAAO,IAAI,CAAC;oBACtD,SAAS;gBACX,CAAC;gBACD,qEAAqE;gBACrE,yDAAyD;gBACzD,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ;oBAChD,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ;oBACvB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC5D,IAAI,GAAG,GAAG,CAAC;oBAAE,SAAS;gBACtB,IAAI,KAAK,CAAC,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC;YAC9B,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,yEAAyE;QACzE,oCAAoC;QACpC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,IAAI,GAAG,IAAI,CAAC;YAChB,IAAI,CAAC,CAAC,WAAW,KAAK,uBAAuB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrF,MAAM,CAAC,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;gBAClD,IAAI,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACpE,CAAC;YACD,IAAI,IAAI;gBAAE,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;iBACpB,CAAC;gBACJ,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACjB,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/analysis/passes/sink-filter-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sink-filter-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/sink-filter-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,MAAM,sBAAsB,CAAC;AACzG,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA89B9E,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,sBAAsB;IACtB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AA6BD,qBAAa,cAAe,YAAW,YAAY,CAAC,gBAAgB,CAAC;IACnE,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,gBAAgB,CAo0CtC;CACF;AAkRD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,KAAK,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AA+J1G,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EACjC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,EACxB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,EACrB,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC3B,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC/B,QAAQ,CAAC,EAAE,MAAM,GAChB,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CA2F5B;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EACjC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,EAC3C,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,EACxB,OAAO,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,GACrC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAuD5B"}
+{"version":3,"file":"sink-filter-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/sink-filter-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAkC,MAAM,sBAAsB,CAAC;AACnH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAmlC9E,MAAM,WAAW,gBAAgB;IAC/B,wDAAwD;IACxD,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,sBAAsB;IACtB,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,UAAU,EAAE,cAAc,EAAE,CAAC;CAC9B;AA6BD,qBAAa,cAAe,YAAW,YAAY,CAAC,gBAAgB,CAAC;IACnE,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,gBAAgB,CAq4CtC;CACF;AAkRD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAErD,KAAK,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AA+J1G,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EACjC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,EACxB,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,OAAO,EAAE,OAAO,EAChB,GAAG,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,EACrB,aAAa,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC3B,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,EAC/B,QAAQ,CAAC,EAAE,MAAM,GAChB,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CA2F5B;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EACjC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,EAC3C,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,EACxB,OAAO,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,GACrC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAuD5B"}

package/dist/analysis/passes/sink-filter-pass.js

@@ -464,6 +464,110 @@ const SERVER_SIGNAL_RE = /["']use server["']|\b(?:getServerSideProps|getStaticPr
 // interpolated, the destination host is not attacker-controlled. Matches a
 // backtick + scheme + a literal host run (no `${` before the first `/`).
 const FIXED_HOST_TEMPLATE_RE = /`https?:\/\/[^/${}\s`]+[/`]/;
+/** A bash URL word whose scheme and host are literal and closed by `/` (#495). */
+const BASH_FIXED_HOST_URL_RE = /^(?:https?|ftp):\/\/[A-Za-z0-9.-]+(?::\d+)?\//;
+/**
+ * True when the string literal that ended at `end` is the WHOLE initializer:
+ * the next code token is `;`, `,`, end of input, or (ASI) a token on a later
+ * line that cannot continue the expression. A same-line operator (`+`, `.`,
+ * `||` …) or a next-line `+` / `.` / `(` / `[` / template continuation means
+ * the literal is only the start of a larger expression, so it is not a
+ * constant. An optional TS `as const` / `as string` suffix is skipped (it may
+ * sit on the next line).
+ * (cognium-dev#680, #681)
+ */
+function literalEndsInitializer(code, end) {
+    let i = end;
+    let crossedNewline = false;
+    const asConst = /^\s+as\s+(?:const|string)\b/.exec(code.slice(i, i + 64));
+    if (asConst) {
+        i += asConst[0].length;
+        crossedNewline = asConst[0].includes('\n');
+    }
+    for (;;) {
+        while (i < code.length && /\s/.test(code[i])) {
+            if (code[i] === '\n')
+                crossedNewline = true;
+            i++;
+        }
+        if (code.startsWith('//', i)) {
+            const nl = code.indexOf('\n', i);
+            i = nl === -1 ? code.length : nl;
+        }
+        else if (code.startsWith('/*', i)) {
+            const close = code.indexOf('*/', i + 2);
+            if (close === -1)
+                return false;
+            if (code.slice(i, close).includes('\n'))
+                crossedNewline = true;
+            i = close + 2;
+        }
+        else
+            break;
+    }
+    if (i >= code.length)
+        return true;
+    const c = code[i];
+    if (c === ';' || c === ',')
+        return true;
+    // ASI: a following line that begins a new statement terminates the initializer.
+    // A line that starts with `as` / `satisfies` / `in` / `instanceof` continues it.
+    if (/^(?:as|satisfies|in|instanceof)(?![\w$])/.test(code.slice(i, i + 12)))
+        return false;
+    return crossedNewline && !/[-+*/%.?:|&<>=!~^(\[`]/.test(c);
+}
+/** Decode `\xNN` / `\uNNNN` / `\u{…}` JS string escapes; other escapes are kept verbatim. */
+function decodeJsHexEscapes(value) {
+    return value.replace(/\\(?:x([0-9a-fA-F]{2})|u([0-9a-fA-F]{4})|u\{([0-9a-fA-F]{1,6})\}|[\s\S])/g, (m, x, u4, ub) => {
+        const hex = x ?? u4 ?? ub;
+        if (hex === undefined)
+            return m;
+        const cp = parseInt(hex, 16);
+        return cp <= 0x10ffff ? String.fromCodePoint(cp) : m;
+    });
+}
+/**
+ * The value of `name` when it is bound exactly once in the file, by `const`,
+ * to a plain string literal (no interpolation) that is the whole initializer,
+ * and has no other `let` / `var` / `function` binding; otherwise null.
+ * (cognium-dev#681)
+ */
+function constStringLiteralValue(code, name) {
+    const esc = name.replace(/\$/g, '\\$');
+    const decl = new RegExp(`(?:^|[^\\w$.])const\\s+${esc}\\s*(?::\\s*string\\s*)?=\\s*(?:'((?:\\\\.|[^'\\\\\\n])*)'|"((?:\\\\.|[^"\\\\\\n])*)"|\`([^\`$\\\\]*)\`)`, 'g');
+    const decls = [...code.matchAll(decl)];
+    if (decls.length !== 1)
+        return null;
+    if (!literalEndsInitializer(code, decls[0].index + decls[0][0].length))
+        return null;
+    const anyBinding = new RegExp(`(?:^|[^\\w$.])(?:const|let|var|function)\\s+${esc}\\b`, 'g');
+    if ([...code.matchAll(anyBinding)].length !== 1)
+        return null;
+    return decodeJsHexEscapes(decls[0][1] ?? decls[0][2] ?? decls[0][3] ?? '');
+}
+/** A group that holds an unbounded quantifier and is itself quantified: `(a+)+`, `(x*)*`, `(\w{2,})+`, `(a+){2,}`. */
+const NESTED_QUANTIFIER_RE = /\([^()]*(?:[+*]|\{\d+,\d*\})[^()]*\)\s*[+*{]/;
+/** A template literal that starts with `${IDENT}/` (cognium-dev#680). */
+const CONST_BASE_TEMPLATE_RE = /`\$\{\s*([A-Za-z_$][\w$]*)\s*\}\//g;
+/**
+ * True when `name` is bound exactly once in the file, by `const`, to a string
+ * literal http(s) origin with a literal host, and is never reassigned.
+ */
+function isConstLiteralOrigin(code, name) {
+    const esc = name.replace(/\$/g, '\\$');
+    const decl = new RegExp(`(?:^|[^\\w$.])(const|let|var)\\s+${esc}\\s*(?::\\s*string\\s*)?=\\s*(['"\`])(https?://[^/'"\`\\s$]+(?:/[^'"\`$]*)?)\\2`, 'gm');
+    const decls = [...code.matchAll(decl)];
+    if (decls.length !== 1 || decls[0][1] !== 'const')
+        return false;
+    if (!literalEndsInitializer(code, decls[0].index + decls[0][0].length))
+        return false;
+    const anyBinding = new RegExp(`(?:^|[^\\w$.])(?:const|let|var)\\s+${esc}\\b`, 'g');
+    if ([...code.matchAll(anyBinding)].length !== 1)
+        return false;
+    const reassign = new RegExp(`(?:^|[^\\w$.])${esc}\\s*(?:[-+]?=)(?!=)`, 'g');
+    const rest = code.slice(0, decls[0].index) + code.slice(decls[0].index + decls[0][0].length);
+    return !reassign.test(rest);
+}
 /**
  * Returns the 1-indexed line numbers that a Java `if (x.contains("..")) throw/
  * return` reject-guard makes path-traversal-safe (cognium-dev#269). A line is
@@ -656,6 +760,33 @@ function isUnwrittenLocalMapKeyRead(code, source) {
         return false;
     return true;
 }
+/**
+ * Is this C# `Content(...)` call the controller helper writing an HTML body
+ * (cognium-dev#580)?
+ *
+ *   - The helper is inherited (`ControllerBase.Content`, `PageModel.Content`),
+ *     so it is called unqualified or on `this` / `base`. `note.Content(q)` is
+ *     some other type's method.
+ *   - The content type is argument 1. A literal or `MediaTypeNames` constant
+ *     that is not HTML or a script-capable XML type serves the body as data. A computed content type is unknown and keeps the sink, as does the
+ *     one-argument overload.
+ */
+function csharpContentServesHtml(call) {
+    if (call.receiver !== null && call.receiver !== 'this' && call.receiver !== 'base')
+        return false;
+    const contentType = call.arguments.find(a => a.position === 1)?.expression.trim();
+    if (contentType === undefined)
+        return true;
+    const literal = /^@?"([^"]*)"$/.exec(contentType);
+    // XML types (`text/xml`, `application/xml`, `image/svg+xml`, any `+xml`)
+    // render XHTML / SVG markup and run its scripts, so they count as HTML.
+    if (literal)
+        return /^\s*(?:text\/html|text\/xml|application\/xml|[\w.-]+\/[\w.-]+\+xml)\b/i.test(literal[1]);
+    const named = /^(?:System\s*\.\s*Net\s*\.\s*Mime\s*\.\s*)?MediaTypeNames\s*\.\s*(Text|Application)\s*\.\s*(\w+)$/.exec(contentType);
+    if (named)
+        return named[2] === 'Html' || named[2] === 'Xml';
+    return true;
+}
 /**
  * Compute, per sink type, the set of C# variables whose value has passed through
  * a sanitizer for that type (cognium-dev C#/.NET Phase-1). Seeds from
@@ -2042,7 +2173,51 @@ export class SinkFilterPass {
                 if (sink.type !== 'ssrf')
                     return true;
                 const sinkLineText = sourceLines[sink.line - 1] ?? '';
-                return !FIXED_HOST_TEMPLATE_RE.test(sinkLineText);
+                if (FIXED_HOST_TEMPLATE_RE.test(sinkLineText))
+                    return false;
+                // `${API_BASE}/path` where API_BASE is bound once by `const` to a
+                // literal origin: the authority is constant and closed by `/` (#680).
+                for (const m of sinkLineText.matchAll(CONST_BASE_TEMPLATE_RE)) {
+                    if (isConstLiteralOrigin(ctx.code, m[1]))
+                        return false;
+                }
+                return true;
+            });
+        }
+        // Stage 15k — JS/TS redos: `new RegExp(`…${CONST}…`)` whose every
+        // interpolation is a module `const` bound to a string literal has a
+        // constant pattern; a tainted subject alone is not ReDoS. (cognium-dev#681)
+        if (['javascript', 'typescript'].includes(language)) {
+            const sourceLines = ctx.code.split('\n');
+            filtered = filtered.filter(sink => {
+                if (sink.type !== 'redos')
+                    return true;
+                const m = (sourceLines[sink.line - 1] ?? '').match(/new\s+RegExp\s*\(\s*`((?:\\.|[^`\\])*)`/);
+                if (!m)
+                    return true;
+                let pattern = m[1];
+                let interpolations = 0;
+                let allConst = true;
+                // Replace each `${ NAME }` as written (whitespace inside the braces
+                // included) by the const's literal value.
+                pattern = pattern.replace(/\$\{([^}]*)\}/g, (_full, raw) => {
+                    interpolations++;
+                    const name = raw.trim();
+                    if (!/^[A-Za-z_$][\w$]*$/.test(name)) {
+                        allConst = false;
+                        return '';
+                    }
+                    const value = constStringLiteralValue(ctx.code, name);
+                    if (value === null) {
+                        allConst = false;
+                        return '';
+                    }
+                    return value;
+                });
+                if (interpolations === 0 || !allConst)
+                    return true;
+                // A constant pattern can still backtrack on a tainted subject.
+                return NESTED_QUANTIFIER_RE.test(pattern);
             });
         }
         // Stage 15f — JS/TS ssrf: anchored host allow-list reject-guard.
@@ -2118,6 +2293,37 @@ export class SinkFilterPass {
                 return !covered || credit.rawTaintReaches(sink.type, sink.line, sanitizedVars, csSeeds);
             });
         }
+        // Stage 15k' — C# `Content(body, contentType)` serves HTML only when the
+        // content type is HTML (cognium-dev#580). The `Content` xss sink stays when
+        // at least one `Content` call on its line is the controller helper with an
+        // HTML or unknown content type.
+        if (language === 'csharp') {
+            filtered = filtered.filter(sink => {
+                if (sink.type !== 'xss' || sink.method !== 'Content')
+                    return true;
+                const contentCalls = callsByLine.get(sink.line)?.filter(c => c.method_name === 'Content') ?? [];
+                return contentCalls.length === 0 || contentCalls.some(csharpContentServesHtml);
+            });
+        }
+        // Stage 15m — bash ssrf: fixed-host URL word (cognium-dev#495, #669).
+        // The bash analogue of Stage 15i: `curl -- "https://api.example.com/${p}"`
+        // can only reach the literal host, whatever `$p` holds. Every word on the
+        // line that expands a variable must be such a URL; a word like `"$url"`,
+        // `"https://${host}/x"` or `"https://api.example.com${p}"` (no `/` to
+        // close the authority, so `$p` may be `@evil.com`) keeps the sink.
+        if (language === 'bash') {
+            const sourceLines = ctx.code.split('\n');
+            filtered = filtered.filter(sink => {
+                if (sink.type !== 'ssrf')
+                    return true;
+                const words = (sourceLines[sink.line - 1] ?? '').match(/"[^"]*"|'[^']*'|[^\s"']+/g) ?? [];
+                const expanding = words.filter(w => !w.startsWith("'") && w.includes('$'));
+                // Unquoted (`https://h/$p`), the expansion is word-split, so `$p`
+                // can add a second URL or a flag: only a double-quoted word counts.
+                return expanding.length === 0 ||
+                    !expanding.every(w => w.startsWith('"') && BASH_FIXED_HOST_URL_RE.test(w.slice(1, -1)));
+            });
+        }
         // Stage 15l — C# ssrf: HttpClient with a constant BaseAddress and a
         // relative request path. (cognium-dev#286 D)
         //