circle-ir 4.14.2 → 4.16.0

package/dist/analysis/passes/language-sources-pass.js

@@ -15,6 +15,11 @@
  */
 import { DOM_ASSIGNMENT_SINK_METHODS, isProvablyLiteralExpression, } from '../literal-expression.js';
 import { attachSourceLineCode } from '../taint-matcher.js';
+import { javaReplaceCrLfCoverage } from '../java-crlf-strip.js';
+import { javaCallArgument, javaCanonicalBaseLacksSeparator } from '../java-canonical-prefix.js';
+import { findGoStringsReplacerSanitizers } from '../go-strings-replacer.js';
+import { findRustLiteralEqualityGuardSanitizers } from '../rust-literal-guard.js';
+import { constLookupTables, isConstTableLookup } from '../const-table-lookup.js';
 // ---------------------------------------------------------------------------
 // Pattern tables (moved from analyzer.ts)
 // ---------------------------------------------------------------------------
@@ -218,6 +223,22 @@ export class LanguageSourcesPass {
                 });
             }
         }
+        // -- Java (#624): JSPWiki plugin `execute` return is HTML output ------------
+        if (language === 'java') {
+            const tm = ctx.getResult('taint-matcher');
+            const xssSan = tm.sanitizers.filter(sa => sa.sanitizes.includes('xss')).map(sa => ({ line: sa.line, method: sa.method }));
+            for (const r of findJavaWikiPluginReturnXSSSinks(code, types, graph.ir.imports, tm.sources, xssSan)) {
+                if (additionalSinks.some(s => s.line === r.sinkLine && s.type === 'xss'))
+                    continue;
+                additionalSinks.push({
+                    type: 'xss',
+                    cwe: 'CWE-79',
+                    line: r.sinkLine,
+                    location: `WikiPlugin.execute returns HTML with user input at line ${r.sinkLine}`,
+                    confidence: 0.9,
+                });
+            }
+        }
         // -- Python: assignment sources, trust-boundary sinks, return-XSS sinks --
         additionalSources.push(...findPythonAssignmentSources(code, language));
         const pyTaintedVars = language === 'python' ? buildPythonTaintedVars(code) : new Map();
@@ -285,13 +306,19 @@ export class LanguageSourcesPass {
             additionalSanitizers.push(...findGoMapAllowlistGuardSanitizers(code));
             additionalSanitizers.push(...findGoHtmlTemplateImportSanitizers(code));
             additionalSanitizers.push(...findGoPathContainmentGuardSanitizers(code));
+            // #348 / #293: strings.NewReplacer CR/LF strip and < > entity escape.
+            additionalSanitizers.push(...findGoStringsReplacerSanitizers(code));
             // Sprint 78 (#190): Go ECB-mode weak-crypto detection.
             const goMisconfigFindings = findGoPatternFindings(code, graph.ir.meta.file);
             for (const finding of goMisconfigFindings) {
                 ctx.addFinding(finding);
             }
             // Sprint 81 (#189): Go xss — fmt.Fprint(f|ln) to http.ResponseWriter.
-            for (const finding of findGoXssFindings(code, graph.ir.meta.file)) {
+            // #568: an arg that is an int/bool measure local carries no payload.
+            const scalarVarsAt = (line) => new Set(graph.usesAtLine(line)
+                .filter(u => u.def_id != null && graph.taintBarrierDefIds.has(u.def_id))
+                .map(u => u.variable));
+            for (const finding of findGoXssFindings(code, graph.ir.meta.file, scalarVarsAt)) {
                 ctx.addFinding(finding);
             }
             // Sprint 82 (#189): Go open_redirect — Header().Set("Location", taint).
@@ -332,6 +359,7 @@ export class LanguageSourcesPass {
             // recognition.
             additionalSanitizers.push(...findPythonRegexAllowlistWrapperSanitizers(code));
             additionalSanitizers.push(...findPythonSetMembershipXssGuardSanitizers(code));
+            additionalSanitizers.push(...findPythonLiteralMembershipGuardSanitizers(code));
             additionalSanitizers.push(...findPythonTraversalRejectGuardSanitizers(code));
             additionalSanitizers.push(...findPythonStringLiteralGuardSanitizers(code));
             additionalSanitizers.push(...findPythonDefaultSaxParserXxeSanitizers(code));
@@ -391,6 +419,8 @@ export class LanguageSourcesPass {
         if (language === 'rust') {
             additionalSanitizers.push(...findRustSetAllowlistGuardSanitizers(code));
             additionalSanitizers.push(...findRustCanonicalizeGuardSanitizers(code));
+            // cognium-dev#293: `if x != "a" && x != "b" { return Err(..) }` literal-equality guard.
+            additionalSanitizers.push(...findRustLiteralEqualityGuardSanitizers(code));
             // Sprint 77a (#216 Pattern X): argv-form Command::new(literal).arg(...)
             // sanitizer.
             additionalSanitizers.push(...findRustArgvCommandSanitizers(code));
@@ -523,6 +553,26 @@ export class LanguageSourcesPass {
             // cognium-dev#269: `!file.getCanonicalPath().startsWith(base)` reject
             // guard (the java.io.File OWASP-recommended containment defence).
             additionalSanitizers.push(...findJavaCanonicalPathStartsWithGuardSanitizers(code));
+            // cognium-dev#293: `if (!Set.of("a", "b").contains(key)) throw` allow-list guard.
+            additionalSanitizers.push(...findJavaLiteralAllowlistGuardSanitizers(code));
+            // cognium-dev#668: `!<literal set>.contains(cls)` reject guard before reflection.
+            additionalSanitizers.push(...findJavaReflectionAllowlistGuardSanitizers(code, types));
+            // cognium-dev#566: a Spring @RestController / @ResponseBody / ResponseEntity
+            // handler's returned String is the response body. TaintPropagationPass
+            // links each synthesised sink to its source.
+            {
+                const tm = ctx.getResult('taint-matcher');
+                const xssSan = tm.sanitizers.filter(sa => sa.sanitizes.includes('xss')).map(sa => sa.line);
+                for (const r of findJavaSpringReturnXSSSinks(code, types, tm.sources, xssSan)) {
+                    additionalSinks.push({
+                        type: 'xss',
+                        cwe: 'CWE-79',
+                        line: r.sinkLine,
+                        location: `Spring handler returns HTML with request input at line ${r.sinkLine}`,
+                        confidence: 0.9,
+                    });
+                }
+            }
             additionalSanitizers.push(...findJavaInlineCrlfStripLogSanitizers(code));
             // cognium-dev#293: the same strip, but living in a user-defined helper.
             additionalSanitizers.push(...findCrlfWrapperFunctionSanitizers(code, 'java'));
@@ -1578,6 +1628,50 @@ function findGoRequestBodySources(sourceCode, language) {
     }
     return sources;
 }
+/** cognium-dev#490 — split `a; b; c` on one line (no `{`), respecting string literals. */
+function splitCSharpDepth0Statements(line) {
+    if (line.includes('{'))
+        return [line];
+    const statements = [];
+    let start = 0;
+    let depth = 0;
+    let inStr = null;
+    let esc = false;
+    for (let i = 0; i < line.length; i++) {
+        const c = line[i];
+        if (inStr) {
+            if (esc) {
+                esc = false;
+                continue;
+            }
+            if (c === '\\') {
+                esc = true;
+                continue;
+            }
+            if (c === inStr)
+                inStr = null;
+            continue;
+        }
+        if (c === '"' || c === "'") {
+            inStr = c;
+            continue;
+        }
+        if (c === '(' || c === '[')
+            depth++;
+        else if (c === ')' || c === ']')
+            depth = Math.max(0, depth - 1);
+        else if (c === ';' && depth === 0) {
+            const part = line.slice(start, i + 1).trim();
+            if (part)
+                statements.push(part);
+            start = i + 1;
+        }
+    }
+    const tail = line.slice(start).trim();
+    if (tail)
+        statements.push(tail);
+    return statements.length > 1 ? statements : [line];
+}
 function findCSharpRequestSources(sourceCode, language) {
     if (language !== 'csharp')
         return [];
@@ -1600,6 +1694,13 @@ function findCSharpRequestSources(sourceCode, language) {
     // of defect as #350 (Java try-with-resources): a resource-declaration syntax
     // the scanner never looked at.
     const assignRe = /^\s*(?:await\s+)?(?:using\s*\(?\s*)?(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
+    // cognium-dev#638 — `arr[i] = req.QueryString["k"]` does not match `assignRe`
+    // (LHS is an indexer). Seed the array base so cross-file calls that pass
+    // `arr` carry taint into `string[]` / `object[]` callee parameters.
+    const arrayElementAssignRe = /^\s*([A-Za-z_]\w*)\s*\[[^\]]+\]\s*=\s*(.+?);?\s*$/;
+    // cognium-dev#638 step 3 — `box.value = req.QueryString["k"]` seeds the
+    // container local so cross-file calls that pass `box` carry taint.
+    const memberFieldAssignRe = /^\s*([A-Za-z_]\w*)\.([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
     // `Request.*` is the inherited controller member. A parameter typed
     // `HttpRequest` / `HttpRequestBase` is the same surface under whatever
     // name the method uses (`req` in Juliet) — cognium-dev#501.
@@ -1729,97 +1830,136 @@ function findCSharpRequestSources(sourceCode, language) {
     // when it is not the line's code.
     const embeddedAssignRe = /(?:^|[{;])\s*(?:await\s+)?(?:using\s*\(?\s*)?(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*([^;{}]+)/;
     for (let i = 0; i < lines.length; i++) {
-        const m = assignRe.exec(lines[i]);
-        // cognium-dev#502 — `assignRe` is anchored and greedy, so on a one-line
-        // block header that also contains the real assignment
-        //
-        //   using (StreamReader sr = new StreamReader(tcp.GetStream())) { data = sr.ReadLine(); }
-        //
-        // it captures `sr` with EVERYTHING after `=` as the right-hand side. That
-        // RHS contains `sr.ReadLine()`, so the line was classified as a read and
-        // bound to `sr` — the reader, not `data`. The embedded-assignment path
-        // handles exactly this shape and finds both `sr` and `data`, but it only
-        // ran when `assignRe` failed to match at all. Prefer it whenever the
-        // captured RHS crosses a block boundary. (#504 was the mirror of this:
-        // there `assignRe` did not match and the inner assignment was lost.)
-        const rhsCrossesBlock = m !== null && m[2].includes('{');
-        if (!m || rhsCrossesBlock) {
-            const stmt = lines[i];
-            if (stmt.includes('{') && !/^\s*(?:\/\/|\/\*|\*)/.test(stmt)) {
-                const emb = new RegExp(embeddedAssignRe.source, 'g');
-                let em;
-                let seeded = false;
-                while ((em = emb.exec(stmt)) !== null) {
-                    const varName = em[1];
-                    const rhs = em[2];
-                    const type = classify(rhs);
-                    if (!type)
-                        continue;
+        for (const stmt of splitCSharpDepth0Statements(lines[i])) {
+            const arrEl = arrayElementAssignRe.exec(stmt);
+            if (arrEl) {
+                const [, baseName, rhs] = arrEl;
+                const type = classify(rhs);
+                if (type && baseName) {
                     const lineNumber = i + 1;
-                    if (sources.some(s => s.line === lineNumber && s.variable === varName))
-                        continue;
-                    sources.push({
-                        type,
-                        location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''}`,
-                        // #502 — Java parity: a database row read is medium, I/O is high.
-                        severity: type === 'db_input' ? 'medium' : 'high',
-                        line: lineNumber,
-                        confidence: 1.0,
-                        variable: varName,
-                    });
-                    seeded = true;
+                    if (!sources.some(s => s.line === lineNumber && s.variable === baseName)) {
+                        sources.push({
+                            type,
+                            location: `${baseName}[…] = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''}`,
+                            severity: type === 'db_input' ? 'medium' : 'high',
+                            line: lineNumber,
+                            confidence: 1.0,
+                            variable: baseName,
+                        });
+                    }
+                    continue;
                 }
-                if (seeded)
+            }
+            const memEl = memberFieldAssignRe.exec(stmt);
+            if (memEl) {
+                const [, baseName, fieldName, rhs] = memEl;
+                const type = classify(rhs);
+                if (type && baseName) {
+                    const lineNumber = i + 1;
+                    if (!sources.some(s => s.line === lineNumber && s.variable === baseName)) {
+                        sources.push({
+                            type,
+                            location: `${baseName}.${fieldName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''}`,
+                            severity: type === 'db_input' ? 'medium' : 'high',
+                            line: lineNumber,
+                            confidence: 1.0,
+                            variable: baseName,
+                        });
+                    }
                     continue;
+                }
             }
-            if (!exprStmtCallRe.test(stmt) || nonCallKeywordRe.test(stmt))
+            const m = assignRe.exec(stmt);
+            // cognium-dev#502 — `assignRe` is anchored and greedy, so on a one-line
+            // block header that also contains the real assignment
+            //
+            //   using (StreamReader sr = new StreamReader(tcp.GetStream())) { data = sr.ReadLine(); }
+            //
+            // it captures `sr` with EVERYTHING after `=` as the right-hand side. That
+            // RHS contains `sr.ReadLine()`, so the line was classified as a read and
+            // bound to `sr` — the reader, not `data`. The embedded-assignment path
+            // handles exactly this shape and finds both `sr` and `data`, but it only
+            // ran when `assignRe` failed to match at all. Prefer it whenever the
+            // captured RHS crosses a block boundary. (#504 was the mirror of this:
+            // there `assignRe` did not match and the inner assignment was lost.)
+            const rhsCrossesBlock = m !== null && m[2].includes('{');
+            if (!m || rhsCrossesBlock) {
+                if (stmt.includes('{') && !/^\s*(?:\/\/|\/\*|\*)/.test(stmt)) {
+                    const emb = new RegExp(embeddedAssignRe.source, 'g');
+                    let em;
+                    let seeded = false;
+                    while ((em = emb.exec(stmt)) !== null) {
+                        const varName = em[1];
+                        const rhs = em[2];
+                        const type = classify(rhs);
+                        if (!type)
+                            continue;
+                        const lineNumber = i + 1;
+                        if (sources.some(s => s.line === lineNumber && s.variable === varName))
+                            continue;
+                        sources.push({
+                            type,
+                            location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''}`,
+                            // #502 — Java parity: a database row read is medium, I/O is high.
+                            severity: type === 'db_input' ? 'medium' : 'high',
+                            line: lineNumber,
+                            confidence: 1.0,
+                            variable: varName,
+                        });
+                        seeded = true;
+                    }
+                    if (seeded)
+                        continue;
+                }
+                if (!exprStmtCallRe.test(stmt) || nonCallKeywordRe.test(stmt))
+                    continue;
+                const hit = inlineRead(stmt);
+                if (!hit)
+                    continue;
+                const { type, read } = hit;
+                const lineNumber = i + 1;
+                if (sources.some(s => s.line === lineNumber))
+                    continue;
+                // `variable` is the `<inline>` marker (the same one the inline
+                // colocation flow puts on its path steps), never a real name. It
+                // must be set, and must match nothing:
+                //   - with NO variable, `findInitialTaint` seeds every def on the
+                //     FOLLOWING line by adjacency, so `Log(file.FileName);` followed by
+                //     `var x = "/tmp/a";` tainted the constant `x`;
+                //   - with the read text itself (`file.FileName`) as the variable, the
+                //     colocation path treats it as an LHS binding and hands the pair
+                //     to the variable scan, which only looks at strictly later sinks —
+                //     so the same-line flow this exists for was lost.
+                // The marker reaches only a sink on this very statement.
+                const code = stmt.trim();
+                sources.push({
+                    type,
+                    location: `${read} in ${code.substring(0, 50)}${code.length > 50 ? '...' : ''}`,
+                    severity: type === 'db_input' ? 'medium' : 'high',
+                    line: lineNumber,
+                    confidence: 1.0,
+                    variable: '<inline>',
+                    code,
+                });
                 continue;
-            const hit = inlineRead(stmt);
-            if (!hit)
+            }
+            const [, varName, rhs] = m;
+            const type = classify(rhs);
+            if (!type)
                 continue;
-            const { type, read } = hit;
             const lineNumber = i + 1;
-            if (sources.some(s => s.line === lineNumber))
-                continue;
-            // `variable` is the `<inline>` marker (the same one the inline
-            // colocation flow puts on its path steps), never a real name. It
-            // must be set, and must match nothing:
-            //   - with NO variable, `findInitialTaint` seeds every def on the
-            //     FOLLOWING line by adjacency, so `Log(file.FileName);` followed by
-            //     `var x = "/tmp/a";` tainted the constant `x`;
-            //   - with the read text itself (`file.FileName`) as the variable, the
-            //     colocation path treats it as an LHS binding and hands the pair
-            //     to the variable scan, which only looks at strictly later sinks —
-            //     so the same-line flow this exists for was lost.
-            // The marker reaches only a sink on this very statement.
-            const code = stmt.trim();
+            if (sources.some(s => s.line === lineNumber && s.variable === varName))
+                continue;
             sources.push({
                 type,
-                location: `${read} in ${code.substring(0, 50)}${code.length > 50 ? '...' : ''}`,
+                location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''}`,
+                // #502 — Java parity: a database row read is medium, I/O is high.
                 severity: type === 'db_input' ? 'medium' : 'high',
                 line: lineNumber,
                 confidence: 1.0,
-                variable: '<inline>',
-                code,
+                variable: varName,
             });
-            continue;
         }
-        const [, varName, rhs] = m;
-        const type = classify(rhs);
-        if (!type)
-            continue;
-        const lineNumber = i + 1;
-        if (sources.some(s => s.line === lineNumber && s.variable === varName))
-            continue;
-        sources.push({
-            type,
-            location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''}`,
-            // #502 — Java parity: a database row read is medium, I/O is high.
-            severity: type === 'db_input' ? 'medium' : 'high',
-            line: lineNumber,
-            confidence: 1.0,
-            variable: varName,
-        });
     }
     return sources;
 }
@@ -1968,27 +2108,55 @@ function findJavaScriptAssignmentSources(sourceCode, language) {
     const patterns = isRouteHandler
         ? [...JS_TAINTED_PATTERNS, { pattern: /\bparams\s*[.[]/, type: 'http_path' }]
         : JS_TAINTED_PATTERNS;
+    // #667: `REGISTRY[req.query.mod]` on a constant table yields a value the
+    // program wrote, not request data.
+    const lookupTables = constLookupTables(sourceCode, language);
+    // cognium-dev#582: scan every assignment on the line. A one-line
+    // `if (c) t = "b"; else t = req.query.t` (or braced `var` arms) has the
+    // source on a later assignment; matching only the first and truncating its
+    // RHS dropped that source. After a control-flow header before an
+    // assignment, that assignment owns only its own statement so a condition's
+    // read is not bound to a body variable (`if (req.query.m) { t = "a"; } else
+    // if (req.query.n) { … }`).
+    // cognium-dev#490: a TypeScript declaration may carry a type annotation
+    // (`const q: string = req.query.q`); the binding is the name before the colon,
+    // not the annotation, so the source's own definition is found on the line.
+    const assignmentRe = /(?:(?:var|let|const)\s+(\w+)\s*:\s*[^=;]+?\s*=(?![>=])|(?:(?:var|let|const)\s+)?(\w+)\s*=)\s*/g;
+    const rhsOwnStmt = /^(?:"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|`(?:[^`\\]|\\.)*`|[^;}"'`])*/;
     for (let lineNum = 0; lineNum < lines.length; lineNum++) {
         const line = lines[lineNum];
         const lineNumber = lineNum + 1;
-        const assignmentMatch = line.match(/(?:(?:var|let|const)\s+)?(\w+)\s*=\s*(.+)/);
-        if (!assignmentMatch)
-            continue;
-        const [, varName, rhs] = assignmentMatch;
-        for (const { pattern, type } of patterns) {
-            if (pattern.test(rhs)) {
-                const alreadyExists = sources.some(s => s.line === lineNumber && s.type === type);
-                if (!alreadyExists) {
-                    sources.push({
-                        type,
-                        location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''}`,
-                        severity: 'high',
-                        line: lineNumber,
-                        confidence: 1.0,
-                        variable: varName,
-                    });
+        assignmentRe.lastIndex = 0;
+        for (const assignmentMatch of line.matchAll(assignmentRe)) {
+            const varName = assignmentMatch[1] ?? assignmentMatch[2];
+            if (!varName)
+                continue;
+            let rhs = line.slice((assignmentMatch.index ?? 0) + assignmentMatch[0].length);
+            if (/\b(?:if|while|switch|else)\b/.test(line.slice(0, assignmentMatch.index ?? 0))) {
+                rhs = rhsOwnStmt.exec(rhs)?.[0] ?? rhs;
+            }
+            else if (line.includes(';', (assignmentMatch.index ?? 0) + assignmentMatch[0].length)) {
+                // Same-line later statements: do not let a greedy RHS attribute their
+                // reads to this variable (`a = 1; b = req.query.t`).
+                rhs = rhsOwnStmt.exec(rhs)?.[0] ?? rhs;
+            }
+            if (isConstTableLookup(rhs, lookupTables))
+                continue;
+            for (const { pattern, type } of patterns) {
+                if (pattern.test(rhs)) {
+                    const alreadyExists = sources.some(s => s.line === lineNumber && s.type === type && s.variable === varName);
+                    if (!alreadyExists) {
+                        sources.push({
+                            type,
+                            location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''}`,
+                            severity: 'high',
+                            line: lineNumber,
+                            confidence: 1.0,
+                            variable: varName,
+                        });
+                    }
+                    break;
                 }
-                break;
             }
         }
     }
@@ -2004,6 +2172,355 @@ function findJavaScriptAssignmentSources(sourceCode, language) {
     // event-name allowlist to avoid firing on unrelated `.on('drain', cb)`
     // / `.on('close', cb)` etc. that carry non-user-input.
     sources.push(...findJavaScriptCallbackParamSources(sourceCode));
+    sources.push(...findExpressDestructuredRequestSources(sourceCode));
+    if (language === 'javascript' || language === 'typescript') {
+        sources.push(...findGraphqlResolverArgSources(sourceCode));
+    }
+    return sources;
+}
+/** Index just past the `}` matching the `{` at `open`, or -1. */
+function matchBrace(text, open) {
+    let depth = 0;
+    for (let i = open; i < text.length; i++) {
+        const ch = text[i];
+        if (ch === '{')
+            depth++;
+        else if (ch === '}') {
+            depth--;
+            if (depth === 0)
+                return i + 1;
+        }
+    }
+    return -1;
+}
+/**
+ * Index just past an optional TypeScript `: <type>` annotation starting at
+ * `from` (`}: Request<A, B>`), i.e. at the next top-level `,` or `)`. Returns
+ * `from` unchanged when no annotation follows.
+ */
+function skipTypeAnnotation(text, from) {
+    const m = /^\s*:/.exec(text.slice(from));
+    if (!m)
+        return from;
+    let depth = 0;
+    for (let i = from + m[0].length; i < text.length; i++) {
+        const ch = text[i];
+        if (ch === '<' || ch === '(' || ch === '[' || ch === '{')
+            depth++;
+        else if (ch === '>' || ch === ']' || ch === '}')
+            depth--;
+        else if (ch === ')') {
+            if (depth === 0)
+                return i;
+            depth--;
+        }
+        else if (ch === ',' && depth === 0)
+            return i;
+        else if (ch === '=' && text[i + 1] === '>' && depth === 0)
+            return from;
+        if (depth < 0)
+            return from;
+    }
+    return from;
+}
+const EXPRESS_REQUEST_KEYS = {
+    query: 'http_param',
+    params: 'http_param',
+    body: 'http_body',
+    headers: 'http_header',
+    cookies: 'http_cookie',
+};
+/**
+ * cognium-dev#587 — Express handler whose first parameter destructures the
+ * request: `app.get(path, ({ query }, res) => …)`, `({ query: q }, res)`,
+ * `({ query: { id } }, res)`. Seeds the bound names of the allowlisted request
+ * keys only. Gated on a receiver bound to `express()` / `express.Router()` /
+ * `Router()` in the same file, so an arbitrary `({ query }) => …` callback is
+ * not a source.
+ */
+function findExpressDestructuredRequestSources(sourceCode) {
+    const sources = [];
+    const receivers = new Set();
+    for (const m of sourceCode.matchAll(/\b(?:const|let|var)\s+(\w+)\s*(?::\s*[\w.]+\s*)?=\s*(?:express\s*\(\s*\)|express\s*\.\s*Router\s*\(\s*\)|Router\s*\(\s*\))/g)) {
+        receivers.add(m[1]);
+    }
+    if (receivers.size === 0)
+        return sources;
+    const REG_RE = /\b(\w+)\s*\.\s*(?:get|post|put|patch|delete|all)\s*\(\s*(['"`])[^'"`]*\2\s*,\s*(?:async\s+)?(?:function\s*\w*\s*)?\(\s*\{/g;
+    for (const m of sourceCode.matchAll(REG_RE)) {
+        if (!receivers.has(m[1]))
+            continue;
+        const open = m.index + m[0].length - 1;
+        const close = matchBrace(sourceCode, open);
+        if (close < 0)
+            continue;
+        // The pattern must be followed by another parameter or `)`, i.e. it is
+        // the handler's first parameter.
+        // A TypeScript `: Request` annotation after the pattern is skipped first.
+        if (!/^\s*[,)]/.test(sourceCode.slice(skipTypeAnnotation(sourceCode, close))))
+            continue;
+        const line = sourceCode.slice(0, m.index + m[0].length).split('\n').length;
+        const inner = sourceCode.slice(open + 1, close - 1);
+        // Split top-level entries.
+        const entries = [];
+        let depth = 0;
+        let start = 0;
+        for (let i = 0; i < inner.length; i++) {
+            if (inner[i] === '{')
+                depth++;
+            else if (inner[i] === '}')
+                depth--;
+            else if (inner[i] === ',' && depth === 0) {
+                entries.push(inner.slice(start, i));
+                start = i + 1;
+            }
+        }
+        entries.push(inner.slice(start));
+        for (const raw of entries) {
+            const entry = raw.trim();
+            const km = entry.match(/^(\w+)\s*(?::\s*([\s\S]+))?$/);
+            if (!km)
+                continue;
+            const type = EXPRESS_REQUEST_KEYS[km[1]];
+            if (!type)
+                continue;
+            const target = (km[2] ?? km[1]).replace(/=[\s\S]*$/, '').trim();
+            const names = target.startsWith('{')
+                ? [...target.slice(1, -1).matchAll(/(?:^|,)\s*(?:\w+\s*:\s*)?(\w+)/g)].map(x => x[1])
+                : /^\w+$/.test(target) ? [target] : [];
+            for (const name of names) {
+                sources.push({
+                    type,
+                    location: `Express handler destructured request '${km[1]}' -> '${name}' at line ${line}`,
+                    severity: 'high',
+                    line,
+                    confidence: 0.95,
+                    variable: name,
+                });
+            }
+        }
+    }
+    return sources;
+}
+/**
+ * The parameters of the call / function whose `(` is at `open`: each top-level,
+ * comma-separated entry with its offset into `text`. A comma inside `()`, `[]`,
+ * `{}` or a type's `<>` (the `>` of `=>` excluded) does not split. Returns null
+ * when the list does not close.
+ */
+function readParameterList(text, open) {
+    const params = [];
+    let depth = 0;
+    let start = open + 1;
+    for (let i = open; i < text.length; i++) {
+        const ch = text[i];
+        if (ch === '"' || ch === "'" || ch === '`') {
+            for (i++; i < text.length && text[i] !== ch; i++)
+                if (text[i] === '\\')
+                    i++;
+            continue;
+        }
+        if (ch === '(' || ch === '[' || ch === '{' || ch === '<')
+            depth++;
+        else if (ch === '>' && text[i - 1] !== '=')
+            depth--;
+        else if (ch === ')' || ch === ']' || ch === '}') {
+            depth--;
+            if (depth === 0) {
+                if (text.slice(start, i).trim() !== '')
+                    params.push({ text: text.slice(start, i), start });
+                return { params };
+            }
+        }
+        else if (ch === ',' && depth === 1) {
+            params.push({ text: text.slice(start, i), start });
+            start = i + 1;
+        }
+    }
+    return null;
+}
+/**
+ * The names a resolver's `args` parameter binds: the identifier itself
+ * (`args`, `args: Args`, `args?: Args`), or every name bound by an object
+ * pattern (`{ sku }`, `{ sku: s }`, `{ filter: { id } }`, `{ id = 1 }`,
+ * `{ ...rest }`), each with its offset into `param`. An array pattern or a
+ * computed key binds nothing here.
+ */
+function graphqlArgBindings(param) {
+    const trimmed = param.replace(/^\s+/, '');
+    const lead = param.length - trimmed.length;
+    const ident = /^(?:\.\.\.)?([A-Za-z_$][\w$]*)\s*\??\s*(?::[\s\S]*|=[\s\S]*)?$/.exec(trimmed);
+    if (ident)
+        return [{ name: ident[1], offset: lead + trimmed.indexOf(ident[1]) }];
+    if (!trimmed.startsWith('{'))
+        return [];
+    const close = matchBrace(trimmed, 0);
+    if (close < 0)
+        return [];
+    return objectPatternBindings(trimmed, 1, close - 1).map(b => ({ name: b.name, offset: lead + b.offset }));
+}
+/** Every name a destructured (non-`args`) parameter binds, for the ambiguity check above. */
+function graphqlPatternNames(param) {
+    const t = param.trim();
+    if (!t.startsWith('{'))
+        return [];
+    const close = matchBrace(t, 0);
+    if (close < 0)
+        return [];
+    return objectPatternBindings(t, 1, close - 1).map(b => b.name);
+}
+function objectPatternBindings(text, from, to) {
+    const out = [];
+    let depth = 0;
+    let start = from;
+    const entries = [];
+    for (let i = from; i < to; i++) {
+        const ch = text[i];
+        if (ch === '{' || ch === '[' || ch === '(')
+            depth++;
+        else if (ch === '}' || ch === ']' || ch === ')')
+            depth--;
+        else if (ch === ',' && depth === 0) {
+            entries.push([start, i]);
+            start = i + 1;
+        }
+    }
+    entries.push([start, to]);
+    for (const [a, b] of entries) {
+        const raw = text.slice(a, b);
+        const body = raw.trimStart();
+        const at = a + (raw.length - body.length);
+        if (body.trim() === '')
+            continue;
+        const rest = /^\.\.\.\s*([A-Za-z_$][\w$]*)\s*$/.exec(body.trimEnd());
+        if (rest) {
+            out.push({ name: rest[1], offset: at + body.indexOf(rest[1]) });
+            continue;
+        }
+        const keyed = /^(?:[A-Za-z_$][\w$]*|'[^']*'|"[^"]*")\s*:\s*/.exec(body);
+        if (keyed) {
+            const targetAt = at + keyed[0].length;
+            const target = body.slice(keyed[0].length);
+            if (target.startsWith('{')) {
+                const end = matchBrace(text, targetAt);
+                if (end > 0)
+                    out.push(...objectPatternBindings(text, targetAt + 1, end - 1));
+                continue;
+            }
+            const id = /^([A-Za-z_$][\w$]*)\s*(?:=[\s\S]*)?$/.exec(target.trimEnd());
+            if (id)
+                out.push({ name: id[1], offset: targetAt });
+            continue;
+        }
+        const short = /^([A-Za-z_$][\w$]*)\s*(?:=[\s\S]*)?$/.exec(body.trimEnd());
+        if (short)
+            out.push({ name: short[1], offset: at });
+    }
+    return out;
+}
+/**
+ * cognium-dev#586 — GraphQL resolver-map arguments. The second parameter of a
+ * function under `Query` / `Mutation` / `Subscription` in the object passed as
+ * `resolvers` to `new ApolloServer({…})` / `makeExecutableSchema({…})` (inline,
+ * or a same-file `const resolvers = {…}`, optionally type-annotated) is client-supplied. Parameter 0
+ * (`parent`) and 2 (`context`) are never seeded.
+ */
+function findGraphqlResolverArgSources(sourceCode) {
+    const sources = [];
+    const ctor = /(?:new\s+ApolloServer|makeExecutableSchema)\s*\(\s*\{/g;
+    const maps = [];
+    for (const m of sourceCode.matchAll(ctor)) {
+        const open = m.index + m[0].length - 1;
+        const close = matchBrace(sourceCode, open);
+        if (close < 0)
+            continue;
+        const opts = sourceCode.slice(open, close);
+        const inline = opts.match(/\bresolvers\s*:\s*\{/);
+        if (inline) {
+            maps.push(open + inline.index + inline[0].length - 1);
+            continue;
+        }
+        const named = opts.match(/\bresolvers\s*(?::\s*(\w+))?\s*[,}]/);
+        if (!named)
+            continue;
+        const ident = named[1] ?? 'resolvers';
+        // cognium-dev#752: an annotation between the name and `=` (`: Resolvers`,
+        // `: Resolvers<Context>`, `: gql.Resolvers<Ctx, Parent>`) does not hide the map.
+        const decl = new RegExp(`\\b(?:const|let|var)\\s+${ident}\\s*(?::\\s*[A-Za-z_$][\\w$]*(?:\\s*\\.\\s*[A-Za-z_$][\\w$]*)*` +
+            `(?:\\s*<[^<>=]*(?:<[^<>=]*>[^<>=]*)*>)?\\s*)?=\\s*\\{`).exec(sourceCode);
+        if (decl)
+            maps.push(decl.index + decl[0].length - 1);
+    }
+    // `name: (…) =>`, `name: async (…) =>`, `name: function (…)`, `name(…) {` and `async name(…)`.
+    // The parameter list is read whole, so a type annotation or a destructured
+    // pattern on any parameter does not hide the second one.
+    const FN_RE = /(?:^|[\s,{])(\w+)\s*(?::\s*(?:async\s+)?(?:function\s*\w*\s*)?\(|\()/g;
+    for (const open of maps) {
+        const close = matchBrace(sourceCode, open);
+        if (close < 0)
+            continue;
+        const body = sourceCode.slice(open, close);
+        for (const t of body.matchAll(/\b(Query|Mutation|Subscription)\s*:\s*\{/g)) {
+            const tOpen = open + t.index + t[0].length - 1;
+            const tClose = matchBrace(sourceCode, tOpen);
+            if (tClose < 0)
+                continue;
+            // Only direct members of the type object (depth 1).
+            const typeBody = sourceCode.slice(tOpen + 1, tClose - 1);
+            let depth = 0;
+            const depthAt = [];
+            for (let i = 0; i < typeBody.length; i++) {
+                depthAt.push(depth);
+                const ch = typeBody[i];
+                if (ch === '{' || ch === '(')
+                    depth++;
+                else if (ch === '}' || ch === ')')
+                    depth--;
+            }
+            const found = [];
+            // Names the resolvers in this type object bind from `parent` or `context`.
+            // A name shared with an `args` binding is ambiguous across functions, so
+            // it is not seeded.
+            const otherNames = new Set();
+            for (const f of typeBody.matchAll(FN_RE)) {
+                const at = f.index + f[0].indexOf(f[1]);
+                if (depthAt[at] !== 0)
+                    continue;
+                const parenAt = f.index + f[0].length - 1;
+                const list = readParameterList(typeBody, parenAt);
+                if (!list)
+                    continue;
+                list.params.forEach((param, idx) => {
+                    if (idx === 1)
+                        return;
+                    for (const b of graphqlPatternNames(param.text))
+                        otherNames.add(b);
+                });
+                // Only the second parameter (`args`) is client-supplied. `parent` and
+                // `context` are never seeded, destructured or not.
+                const second = list.params[1];
+                if (!second)
+                    continue;
+                const absStart = tOpen + 1 + second.start;
+                for (const b of graphqlArgBindings(second.text)) {
+                    const line = sourceCode.slice(0, absStart + b.offset).split('\n').length;
+                    found.push({ fn: f[1], b: { name: b.name, line } });
+                }
+            }
+            for (const { fn, b } of found) {
+                if (otherNames.has(b.name))
+                    continue;
+                sources.push({
+                    type: 'http_param',
+                    location: `GraphQL ${t[1]}.${fn} resolver args '${b.name}' at line ${b.line}`,
+                    severity: 'high',
+                    line: b.line,
+                    confidence: 0.9,
+                    variable: b.name,
+                });
+            }
+        }
+    }
     return sources;
 }
 /**
@@ -2627,6 +3144,480 @@ function isSafeJinjaReturnExpr(expr) {
     const trimmed = expr.trim();
     return JINJA_SAFE_RTS_RE.test(trimmed) || JINJA_SAFE_TEMPLATE_RE.test(trimmed);
 }
+/**
+ * The statements on one Java source line, split at each `;` that is outside a
+ * string / char literal and outside a comment. Comment text (`//` to the end of
+ * the line, inline or unterminated `/* ... *\/`) is dropped; literals are kept.
+ * `terminated` is false for a trailing piece with no `;` on this line.
+ */
+function javaLineStatements(line) {
+    const out = [];
+    let cur = '';
+    let inStr = null;
+    let escaped = false;
+    for (let i = 0; i < line.length; i++) {
+        const ch = line[i];
+        if (inStr) {
+            cur += ch;
+            if (escaped) {
+                escaped = false;
+                continue;
+            }
+            if (ch === '\\') {
+                escaped = true;
+                continue;
+            }
+            if (ch === inStr)
+                inStr = null;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            inStr = ch;
+            cur += ch;
+            continue;
+        }
+        if (ch === '/' && line[i + 1] === '/')
+            break;
+        if (ch === '/' && line[i + 1] === '*') {
+            const end = line.indexOf('*/', i + 2);
+            if (end < 0)
+                break;
+            cur += ' ';
+            i = end + 1;
+            continue;
+        }
+        if (ch === ';') {
+            out.push({ text: cur, terminated: true });
+            cur = '';
+            continue;
+        }
+        cur += ch;
+    }
+    if (cur.trim())
+        out.push({ text: cur, terminated: false });
+    return out;
+}
+/**
+ * `[modifiers] [Type] name = rhs` as ONE statement (no `;`; see
+ * `javaLineStatements`). `==` is not an assignment; `+=` and field targets
+ * (`a.b = x`) are not matched. Group 1 is the name, group 2 the right-hand side.
+ */
+const JAVA_STMT_ASSIGN = /^\s*(?:(?:final|public|private|protected|static|volatile|transient)\s+)*(?:[\p{L}_][\p{L}\p{N}_.]*(?:\s*<[^=]*>)?(?:\s*\[\s*\])*\s+)?([\p{L}_][\p{L}\p{N}_]*)\s*=(?!=)\s*([\s\S]*)$/u;
+/**
+ * Arguments of `receiver.append(...)` on one statement, including a chain of
+ * further `.append(...)` calls on the same expression. Stops at any other
+ * method (e.g. `.indexOf(...)`) or at the end of the statement. Nested calls
+ * inside an argument (e.g. `append(escape(who))`) stay inside that argument.
+ * String / char literal bodies are walked so a `)` inside a string does not
+ * close the argument.
+ */
+function javaAppendArgExprs(line) {
+    const start = /^\s*([\p{L}_][\p{L}\p{N}_]*)\s*\.\s*append\s*\(/u.exec(line);
+    if (!start)
+        return null;
+    const receiver = start[1];
+    const args = [];
+    let i = start[0].length;
+    const takeArg = () => {
+        let depth = 1;
+        let inStr = null;
+        let escaped = false;
+        const from = i;
+        for (; i < line.length; i++) {
+            const ch = line[i];
+            if (inStr) {
+                if (escaped) {
+                    escaped = false;
+                    continue;
+                }
+                if (ch === '\\') {
+                    escaped = true;
+                    continue;
+                }
+                if (ch === inStr)
+                    inStr = null;
+                continue;
+            }
+            if (ch === '"' || ch === "'") {
+                inStr = ch;
+                continue;
+            }
+            if (ch === '(') {
+                depth++;
+                continue;
+            }
+            if (ch === ')') {
+                depth--;
+                if (depth === 0) {
+                    const arg = line.slice(from, i);
+                    i++; // past ')'
+                    return arg;
+                }
+            }
+        }
+        return null;
+    };
+    while (true) {
+        const arg = takeArg();
+        if (arg === null)
+            return null;
+        args.push(arg);
+        // More chained .append(…)? Otherwise stop (other method, ';', end).
+        const rest = line.slice(i);
+        const next = /^\s*\.\s*append\s*\(/.exec(rest);
+        if (!next)
+            break;
+        i += next[0].length;
+    }
+    return { receiver, args };
+}
+/**
+ * The source call named by a source location (`req.getParameter() in execute`,
+ * `getParameter() in execute`) as a regex over `codeOnly` text: the receiver
+ * chain must match too (any spacing between its tokens), and a call with no
+ * receiver must not follow a `.`. `byName` is the method name alone, for a
+ * receiver whose text is not on the line as written. `method` / `receiver`
+ * are the unescaped names from the location. Null when the location names no
+ * call.
+ */
+function javaSourceCallRe(location) {
+    const callee = /^([\s\S]*?)\(\)(?:\s+in\s+[^()]*)?$/u.exec((location ?? '').trim())?.[1]?.trim();
+    if (!callee)
+        return null;
+    const cm = /^(?:([\s\S]*?)\s*\.\s*)?([\p{L}_$][\p{L}\p{N}_$]*)$/u.exec(callee);
+    if (!cm)
+        return null;
+    const esc = (t) => t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const methodName = cm[2];
+    const method = esc(methodName);
+    const byName = new RegExp(`(?<![\\p{L}\\p{N}_$])${method}\\s*\\(`, 'u');
+    if (!cm[1]) {
+        return {
+            exact: new RegExp(`(?<![\\p{L}\\p{N}_$.])(?<!\\.\\s+)${method}\\s*\\(`, 'u'),
+            byName, method: methodName, receiver: null,
+        };
+    }
+    // Receiver text as written in the location, with literal bodies blanked like the
+    // statement text it is matched against.
+    const recv = cm[1]
+        .replace(/"(?:[^"\\]|\\.)*"/g, ' ')
+        .replace(/'(?:[^'\\]|\\.)'/g, ' ');
+    const toks = recv.match(/[\p{L}\p{N}_$]+|\S/gu);
+    if (!toks)
+        return null;
+    return {
+        exact: new RegExp(`(?<![\\p{L}\\p{N}_$.])(?<!\\.\\s+)${toks.map(esc).join('\\s*')}\\s*\\.\\s*${method}\\s*\\(`, 'u'),
+        byName, method: methodName, receiver: toks.join(''),
+    };
+}
+/** Keywords that must not be treated as a Java type name in a declaration. */
+const JAVA_NON_TYPE_NAMES = new Set([
+    'return', 'if', 'else', 'while', 'for', 'switch', 'case', 'new', 'throw', 'try',
+    'catch', 'class', 'interface', 'package', 'import', 'assert', 'synchronized',
+    'do', 'break', 'continue', 'finally', 'default', 'this', 'super', 'true',
+    'false', 'null', 'instanceof', 'extends', 'implements', 'throws', 'enum',
+]);
+/**
+ * Simple type name → last segment of an FQN, generics stripped
+ * (`javax.servlet.http.HttpServletRequest` → `HttpServletRequest`).
+ */
+function javaSimpleTypeName(type) {
+    return type.replace(/\s+/g, '').replace(/<.*$/, '').replace(/^.*\./, '');
+}
+/**
+ * Locals and parameters declared in `[startLine, endLine]` (1-based), mapped to
+ * their simple type name. Used so a line that lost a second request-source to
+ * per-line dedup can still seed every receiver of that source class.
+ */
+function javaMethodVarTypes(lines, startLine, endLine) {
+    const out = new Map();
+    // Optional modifiers, then Type (FQN / simple, optional generics), then name,
+    // then `=` `,` `;` or `)` (parameter list). Strings / comments blanked first.
+    const decl = /(?:(?:public|private|protected|static|final|volatile|transient)\s+)*(?<![\p{L}\p{N}_$.])((?:[\p{L}_$][\p{L}\p{N}_$]*\s*\.\s*)*[\p{L}_$][\p{L}\p{N}_$]*)\s*(?:<[^;{}()=]*>)?\s+([\p{L}_$][\p{L}\p{N}_$]*)\s*(?:=|,|;|\))/gu;
+    for (let i = startLine - 1; i < endLine && i < lines.length; i++) {
+        const text = (lines[i] ?? '')
+            .replace(/"(?:[^"\\]|\\.)*"/g, ' ')
+            .replace(/'(?:[^'\\]|\\.)'/g, ' ')
+            .replace(/\/\*.*?\*\//g, ' ')
+            .replace(/\/\/.*$/, '');
+        decl.lastIndex = 0;
+        for (let m = decl.exec(text); m; m = decl.exec(text)) {
+            const simple = javaSimpleTypeName(m[1]);
+            if (!simple || JAVA_NON_TYPE_NAMES.has(simple))
+                continue;
+            out.set(m[2], simple);
+        }
+    }
+    return out;
+}
+/**
+ * Call matcher for a source location that accepts every receiver declared with
+ * the same simple type as the location's stored receiver (not only that
+ * receiver). Falls back to `exact` when the stored receiver's type is unknown.
+ * When the location names no receiver, returns `exact` (method-only form).
+ */
+function javaSameClassCallRe(srcRes, varTypes) {
+    if (!srcRes.receiver)
+        return srcRes.exact;
+    const esc = (t) => t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    // Location receiver may be a chain (`this.req`); the declared name is the
+    // last identifier.
+    const recvId = /[\p{L}_$][\p{L}\p{N}_$]*$/u.exec(srcRes.receiver)?.[0] ?? srcRes.receiver;
+    const names = new Set([recvId]);
+    const ty = varTypes.get(recvId);
+    if (ty) {
+        for (const [n, t] of varTypes)
+            if (t === ty)
+                names.add(n);
+    }
+    const alts = [...names].map(esc).join('|');
+    return new RegExp(`(?<![\\p{L}\\p{N}_$.])(?<!\\.\\s+)(?:${alts})\\s*\\.\\s*${esc(srcRes.method)}\\s*\\(`, 'u');
+}
+/**
+ * `expr` (already `codeOnly`) with every call to the named method blanked out,
+ * from its name through its closing `)` (or the end of `expr` when the call
+ * does not close there). `found` is true when at least one call was blanked.
+ */
+function blankJavaCalls(expr, method) {
+    const re = new RegExp(`(?<![\\p{L}\\p{N}_$])${method.replace(/[$]/g, '\\$&')}\\s*\\(`, 'gu');
+    let text = expr;
+    let found = false;
+    for (let m = re.exec(text); m; m = re.exec(text)) {
+        let depth = 1;
+        let k = m.index + m[0].length;
+        for (; k < text.length && depth > 0; k++) {
+            if (text[k] === '(')
+                depth++;
+            else if (text[k] === ')')
+                depth--;
+        }
+        text = `${text.slice(0, m.index)} 0 ${text.slice(k)}`;
+        re.lastIndex = m.index + 3;
+        found = true;
+    }
+    return { text, found };
+}
+/**
+ * cognium-dev#624 (minimal slice) — JSPWiki plugin output is rendered as HTML.
+ *
+ * The `String` returned from `execute(...)` of a class that implements
+ * `org.apache.wiki.api.plugin.WikiPlugin` (or the older `...plugin.Plugin`) is
+ * written into the page unescaped, so a request- or markup-derived value that
+ * reaches the return is reflected XSS. The rule keys on the interface (from the
+ * import or a fully-qualified `implements`), never on the method name: another
+ * class's `execute(...)` is untouched.
+ *
+ * Mirrors `findPythonReturnXSSSinks` (#368): one sink per tainted `return`, and
+ * `TaintPropagationPass` links it to a source. `StringBuilder.append` is
+ * deliberately not an xss sink on its own (#268) — a builder only matters here
+ * when it reaches the return. An xss-covering sanitizer between the source and
+ * the return suppresses the site.
+ */
+export function findJavaWikiPluginReturnXSSSinks(code, types, imports, sources, xssSanitizers) {
+    if (sources.length === 0)
+        return [];
+    const PKG = 'org.apache.wiki.api.plugin';
+    // Each simple name counts only when that name was imported (a wildcard of the
+    // plugin package accepts both): importing `WikiPlugin` does not make an
+    // `implements Plugin` (some other interface) a wiki plugin, nor the reverse.
+    const importedSimple = new Set();
+    let wildcardImported = false;
+    for (const i of imports) {
+        if (i.from_package !== PKG)
+            continue;
+        if (i.is_wildcard)
+            wildcardImported = true;
+        else if (i.imported_name === 'WikiPlugin' || i.imported_name === 'Plugin')
+            importedSimple.add(i.imported_name);
+    }
+    const isPluginIface = (name) => {
+        const bare = name.replace(/<.*$/, '').trim();
+        if (bare === `${PKG}.WikiPlugin` || bare === `${PKG}.Plugin`)
+            return true;
+        return (bare === 'WikiPlugin' || bare === 'Plugin') && (wildcardImported || importedSimple.has(bare));
+    };
+    const lines = code.split('\n');
+    // Code positions only: string / char literal bodies blanked, then inline `/* */` and
+    // trailing `//` comments dropped (after the literals, so a `"http://…"` is not cut).
+    const codeOnly = (expr) => expr
+        .replace(/"(?:[^"\\]|\\.)*"/g, ' ')
+        .replace(/'(?:[^'\\]|\\.)'/g, ' ')
+        .replace(/\/\*.*?\*\//g, ' ')
+        .replace(/\/\/.*$/, '');
+    const refs = (expr, name) => new RegExp(`(?<![\\p{L}\\p{N}_.])${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![\\p{L}\\p{N}_])`, 'u').test(expr);
+    const out = [];
+    for (const t of types) {
+        if (!t.implements.some(isPluginIface))
+            continue;
+        for (const m of t.methods) {
+            if (m.name !== 'execute' || m.return_type !== 'String')
+                continue;
+            const inMethod = sources.filter(sc => sc.line >= m.start_line && sc.line <= m.end_line);
+            if (inMethod.length === 0)
+                continue;
+            // Sources that name a variable (the carriers are walked per return below).
+            const perSource = inMethod
+                .filter((sc) => !!sc.variable)
+                .map(sc => ({ sc }));
+            if (perSource.length === 0)
+                continue;
+            for (let i = m.start_line - 1; i < m.end_line; i++) {
+                const rm = /^\s*return\s+(.+?);\s*$/.exec(lines[i] ?? '');
+                if (!rm)
+                    continue;
+                const sinkLine = i + 1;
+                let best = null;
+                for (const { sc } of perSource) {
+                    if (sc.line > sinkLine)
+                        continue;
+                    // Carriers: the names the source's value reaches before the return, with
+                    // the line each became tainted. Walked one statement at a time, in order,
+                    // from the source's own statement: a name is live only after the statement
+                    // that gives it a tainted value (the source call, or an already-live
+                    // carrier), so a statement earlier on the same line sees nothing. Only
+                    // names inside a statement's append(...) arguments (chained .append and
+                    // nested calls included) taint its receiver, only its `+=` right-hand
+                    // side taints its target, and only its `=` right-hand side taints the
+                    // assigned name. A name in another method or statement does not.
+                    const carriers = new Map();
+                    const refsCarrier = (expr) => {
+                        const c = codeOnly(expr);
+                        return [...carriers.keys()].some(v => refs(c, v));
+                    };
+                    // Where the source enters on its line. Call sources are deduped to one
+                    // per line, so the surviving location names only one receiver
+                    // ("req.getParameter() in execute"). Accept every call whose receiver
+                    // shares that source class (another HttpServletRequest on the line),
+                    // not only the stored receiver — otherwise a second request call never
+                    // seeds its value. `prefs.getParameter` stays out: different class.
+                    // `byName` (method alone) must not run when the line has another
+                    // same-named call: that reintroduces the method-name FP. A parameter /
+                    // annotation source (no call) is live from its own assignment on the
+                    // line, or from the start of the line.
+                    const srcStmts = javaLineStatements(lines[sc.line - 1] ?? '');
+                    const srcRes = javaSourceCallRe(sc.location);
+                    const varTypes = javaMethodVarTypes(lines, m.start_line, m.end_line);
+                    let callRe = null;
+                    if (srcRes) {
+                        const hasExact = srcStmts.some(st => srcRes.exact.test(codeOnly(st.text)));
+                        const byNameHits = srcStmts.filter(st => srcRes.byName.test(codeOnly(st.text))).length;
+                        if (hasExact)
+                            callRe = javaSameClassCallRe(srcRes, varTypes);
+                        else if (byNameHits === 1)
+                            callRe = srcRes.byName;
+                        else
+                            callRe = srcRes.receiver ? javaSameClassCallRe(srcRes, varTypes) : null;
+                    }
+                    const callsSource = (expr) => !!callRe && callRe.test(codeOnly(expr));
+                    const seeded = srcStmts.some(st => callsSource(st.text));
+                    // xss sanitizer calls on the source line: a value that reaches a
+                    // statement only inside one of them is not tainted by it. A sanitizer
+                    // that cannot be found in the line's text covers the whole line.
+                    const srcLineSan = sc.line < sinkLine
+                        ? xssSanitizers.filter(sa => sa.line === sc.line).map(sa => ({
+                            method: /([\p{L}_$][\p{L}\p{N}_$]*)\s*(?:\(\))?\s*$/u.exec(sa.method ?? '')?.[1],
+                        }))
+                        : [];
+                    const sanMethods = srcLineSan.map(sa => sa.method).filter((x) => !!x);
+                    const srcLineSanFound = srcLineSan.length > 0 && srcLineSan.every(sa => !!sa.method && srcStmts.some(st => blankJavaCalls(codeOnly(st.text), sa.method).found));
+                    const unsanitized = (expr) => {
+                        let text = codeOnly(expr);
+                        if (srcLineSanFound)
+                            for (const sm of sanMethods)
+                                text = blankJavaCalls(text, sm).text;
+                        return text;
+                    };
+                    // Unseeded: index of the statement after which `sc.variable` is live.
+                    let liveAfter = -1;
+                    if (!seeded)
+                        liveAfter = srcStmts.findIndex(st => JAVA_STMT_ASSIGN.exec(st.text)?.[1] === sc.variable);
+                    // A source on the return line itself is checked against the return as is.
+                    if ((!seeded && liveAfter < 0) || sc.line === sinkLine)
+                        carriers.set(sc.variable, sc.line);
+                    for (let j = sc.line - 1; j < i; j++) {
+                        const onSrcLine = j === sc.line - 1;
+                        const stmts = onSrcLine ? srcStmts : javaLineStatements(lines[j] ?? '');
+                        for (let k = 0; k < stmts.length; k++) {
+                            const st = stmts[k];
+                            const raw = (expr) => refsCarrier(expr) || (onSrcLine && seeded && callsSource(expr));
+                            const tainted = (expr) => (onSrcLine ? raw(unsanitized(expr)) : raw(expr));
+                            const as = JAVA_STMT_ASSIGN.exec(st.text);
+                            // A name reassigned on the source line from a sanitized value only
+                            // (`who = escapeHtml4(who)`) no longer carries the source.
+                            if (as && onSrcLine && srcLineSanFound && carriers.has(as[1]) && raw(as[2]) && !tainted(as[2]))
+                                carriers.delete(as[1]);
+                            else if (as && !carriers.has(as[1]) && tainted(as[2]))
+                                carriers.set(as[1], j + 1);
+                            const ap = javaAppendArgExprs(st.text);
+                            if (ap && !carriers.has(ap.receiver) && ap.args.some(a => tainted(a)))
+                                carriers.set(ap.receiver, j + 1);
+                            const cm = st.terminated ? /^\s*([\p{L}_][\p{L}\p{N}_]*)\s*\+=\s*(.+?)\s*$/u.exec(st.text) : null;
+                            if (cm && !carriers.has(cm[1]) && tainted(cm[2]))
+                                carriers.set(cm[1], j + 1);
+                            if (onSrcLine && !seeded && k === liveAfter && !carriers.has(sc.variable))
+                                carriers.set(sc.variable, sc.line);
+                        }
+                    }
+                    if (!refsCarrier(rm[1]))
+                        continue;
+                    // An xss-covering sanitizer only counts for this source when it is on a
+                    // later line that names one of its carriers. One on the source's own
+                    // line already took effect in the walk above (only the value inside
+                    // its argument is clean); one there that is not found in the line's
+                    // text, or a source on the return line, still covers the line.
+                    const sanitized = xssSanitizers.some(({ line: l }) => l >= sc.line && l <= sinkLine &&
+                        (l === sc.line ? !srcLineSanFound : refsCarrier(lines[l - 1] ?? '')));
+                    if (sanitized)
+                        continue;
+                    if (!best || sc.line > best.line)
+                        best = { line: sc.line };
+                }
+                if (best)
+                    out.push({ sinkLine, sourceLine: best.line });
+            }
+        }
+    }
+    return out;
+}
+const JSPWIKI_TAG_PKG = 'org.apache.wiki.tags';
+const JSPWIKI_TAG_SUPER_NAMES = ['WikiTagBase', 'WikiBodyTag', 'WikiLinkTag'];
+/**
+ * cognium-dev#624 (WikiTag slice) — JSPWiki tag handlers inherit `protected
+ * WikiContext m_wikiContext` from `WikiTagBase`. The configured
+ * `WikiContext.getPage` source is class-scoped, so `m_wikiContext.getPage()`
+ * misses unless the enclosing type extends a JSPWiki tag base (import-gated,
+ * never from the field name alone).
+ */
+export function javaWikiTagInheritedContextReceiver(receiver, className, call, types, imports) {
+    if (className !== 'WikiContext' || receiver !== 'm_wikiContext')
+        return false;
+    const line = call.location.line;
+    const enclosing = types.find(t => line >= t.start_line && line <= t.end_line &&
+        (!call.in_method || t.methods.some(m => m.name === call.in_method && line >= m.start_line && line <= m.end_line)));
+    if (!enclosing?.extends)
+        return false;
+    const importedSimple = new Set();
+    let wildcardImported = false;
+    for (const i of imports) {
+        if (i.from_package !== JSPWIKI_TAG_PKG)
+            continue;
+        if (i.is_wildcard)
+            wildcardImported = true;
+        else if (JSPWIKI_TAG_SUPER_NAMES.includes(i.imported_name)) {
+            importedSimple.add(i.imported_name);
+        }
+    }
+    const isTagSuper = (name) => {
+        const bare = name.replace(/<.*$/, '').trim();
+        if (bare === `${JSPWIKI_TAG_PKG}.WikiTagBase` ||
+            bare === `${JSPWIKI_TAG_PKG}.WikiBodyTag` ||
+            bare === `${JSPWIKI_TAG_PKG}.WikiLinkTag`)
+            return true;
+        return JSPWIKI_TAG_SUPER_NAMES.includes(bare) &&
+            (wildcardImported || importedSimple.has(bare));
+    };
+    return isTagSuper(enclosing.extends);
+}
 export function findPythonReturnXSSSinks(sourceCode, taintedVars) {
     if (taintedVars.size === 0)
         return [];
@@ -2811,6 +3802,7 @@ export function buildJavaScriptTaintedVars(sourceCode, language) {
         return new Map();
     const tainted = new Map();
     const lines = sourceCode.split('\n');
+    const lookupTables = constLookupTables(sourceCode, language);
     // Seed with WebSocket `.on('message', cb)` callback-param names (#213
     // second slice). Same event allowlist as findJavaScriptCallbackParamSources.
     const CB_EVENT_RE = /\.on\s*\(\s*['"](?:message|text|binary)['"]\s*,\s*(?:async\s+)?(?:function\s*\*?\s*(?:\w+\s*)?\(\s*(\w+)|\(\s*(\w+)\s*(?:[,):]|$)|(\w+)\s*=>)/;
@@ -2834,6 +3826,8 @@ export function buildJavaScriptTaintedVars(sourceCode, language) {
         const [, lhs, rhs] = assignMatch;
         if (['if', 'while', 'for', 'return', 'true', 'false', 'null', 'undefined', 'case'].includes(lhs))
             continue;
+        if (isConstTableLookup(rhs, lookupTables))
+            continue; // #667
         const isDirectSource = JS_TAINTED_PATTERNS.some(p => p.pattern.test(rhs));
         const isTaintedPropagation = tainted.size > 0 && [...tainted.keys()].some(v => new RegExp(`\\b${v}\\b`).test(rhs));
         if (isDirectSource || isTaintedPropagation)
@@ -2891,6 +3885,43 @@ export function buildRustTaintedVars(sourceCode, seedVars) {
     }
     return derived;
 }
+/**
+ * Join an assignment / declaration whose call argument list wraps over several
+ * lines into one line (`label = String.format("%s.tar",\n    picked);`), or null
+ * when line `i` does not start such a statement. The statement must start with
+ * `[Type] name =`, leave a parenthesis open on its first line, and close it and
+ * end in `;` within a few lines, with no `{`, `}`, lambda arrow or second `;`
+ * on the way (a lambda, anonymous class, switch expression or block is not a
+ * plain wrapped value).
+ */
+function joinWrappedJavaStatement(lines, i) {
+    const strip = (l) => l.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)'/g, '""').replace(/\/\/.*$/, '');
+    const first = strip(lines[i]);
+    if (!/^\s*(?:(?:final\s+)?[A-Za-z_][\w.]*(?:\s*<[^>]*>)?(?:\s*\[\s*\])*\s+)?[A-Za-z_]\w*\s*=(?!=)/.test(first))
+        return null;
+    if (/[;{}]|->/.test(first))
+        return null;
+    const depthOf = (t) => (t.match(/\(/g)?.length ?? 0) - (t.match(/\)/g)?.length ?? 0);
+    let depth = depthOf(first);
+    if (depth <= 0)
+        return null;
+    let text = lines[i].replace(/\/\/.*$/, '');
+    for (let j = i + 1; j < lines.length && j <= i + 12; j++) {
+        const next = strip(lines[j]);
+        if (/[{}]|->/.test(next))
+            return null;
+        const semi = next.indexOf(';');
+        if (semi >= 0 && next.slice(semi + 1).trim() !== '')
+            return null;
+        depth += depthOf(next);
+        if (depth < 0)
+            return null;
+        text += ' ' + lines[j].replace(/\/\/.*$/, '').trim();
+        if (semi >= 0)
+            return depth === 0 && text.trimEnd().endsWith(';') ? text : null;
+    }
+    return null;
+}
 /**
  * cognium-dev #220 — Java derived-taint expansion.
  *
@@ -2955,8 +3986,46 @@ export function buildJavaTaintedVars(sourceCode, seedVars) {
             const trimmed = line.trimStart();
             if (trimmed.startsWith('//') || trimmed.startsWith('*'))
                 continue;
-            const declMatch = declRe.exec(line);
-            const assignMatch = !declMatch ? assignRe.exec(line) : null;
+            // cognium-dev#476: non-assignment statements (must run before the #753
+            // wrap-join early-continue, which would skip them).
+            const arrayCopyRe = /\bSystem\.arraycopy\s*\(\s*([A-Za-z_]\w*)\s*,\s*[^,]+\s*,\s*([A-Za-z_]\w*)\s*,/;
+            const acMatch = arrayCopyRe.exec(line);
+            if (acMatch) {
+                const srcArr = acMatch[1];
+                const dstArr = acMatch[2];
+                if (knownTainted.has(srcArr) && !knownTainted.has(dstArr)) {
+                    derived.set(dstArr, i + 1);
+                    knownTainted.add(dstArr);
+                    changed = true;
+                }
+                continue;
+            }
+            const listAddRe = /^\s*([A-Za-z_]\w*)\.add\s*\(\s*([A-Za-z_]\w*)\s*\)\s*;?\s*$/;
+            const addMatch = listAddRe.exec(line.trimEnd());
+            if (addMatch) {
+                const listVar = addMatch[1];
+                const elem = addMatch[2];
+                if (knownTainted.has(elem) && !knownTainted.has(listVar)) {
+                    derived.set(listVar, i + 1);
+                    knownTainted.add(listVar);
+                    changed = true;
+                }
+                continue;
+            }
+            let statement = line;
+            let declMatch = declRe.exec(statement);
+            let assignMatch = !declMatch ? assignRe.exec(statement) : null;
+            if (!declMatch && !assignMatch) {
+                // cognium-dev#753: `label = String.format("%s.tar",\n  picked);` — a
+                // statement whose call argument list wraps over several lines reads like
+                // the same statement on one line.
+                const joined = joinWrappedJavaStatement(lines, i);
+                if (joined === null)
+                    continue;
+                statement = joined;
+                declMatch = declRe.exec(statement);
+                assignMatch = !declMatch ? assignRe.exec(statement) : null;
+            }
             const m = declMatch ?? assignMatch;
             if (!m)
                 continue;
@@ -3825,9 +4894,11 @@ function findBashRealpathPrefixGuardSanitizers(code) {
 function findGoMapAllowlistGuardSanitizers(code) {
     const sanitizers = [];
     const lines = code.split('\n');
-    // `if !<mapName>[<key>] {`  — optional whitespace, optional `_ ,`
-    // ignored. Captures the map identifier in group 1.
-    const guardOpen = /^\s*if\s+!\s*([A-Za-z_][A-Za-z0-9_]*)\s*\[\s*[A-Za-z_][A-Za-z0-9_]*\s*\]\s*\{/;
+    // `if !<mapName>[<key>] {`, or that negated lookup as one `||` disjunct
+    // (`if err != nil || !<mapName>[u.Host] {`, #293): the block runs when any
+    // disjunct holds, so falling past it proves the key is in the map. The key
+    // may be a selector (`u.Host`). Captures the map identifier in group 1.
+    const guardOpen = /^\s*if\s+(?:[^{&|]+\|\|\s*)*!\s*([A-Za-z_][A-Za-z0-9_]*)\s*\[\s*[A-Za-z_][A-Za-z0-9_]*(?:\.[A-Za-z_][A-Za-z0-9_]*)?\s*\]\s*(?:\|\|[^{&]+)?\{/;
     // Allow-list naming heuristic.
     const allowlistName = /^(?:[A-Z][A-Z0-9_]+|.*?(allowed|accepted|whitelist|permitted|valid|approved).*)$/i;
     for (let i = 0; i < lines.length; i++) {
@@ -3863,9 +4934,24 @@ function findGoMapAllowlistGuardSanitizers(code) {
         if (closeLine === -1 || !bodyHasTerminator)
             continue;
         // Emit per-line sanitizers for every line AFTER the guard's closing
-        // brace through end of file. `checkSanitized` is line-keyed so this
-        // suppresses the relevant sink types in the safe branch.
-        for (let l = closeLine + 2; l <= lines.length; l++) {
+        // brace to the end of the enclosing block (the function body, #293 —
+        // it used to run to the end of the file, crediting later functions).
+        // `checkSanitized` is line-keyed so this suppresses the relevant sink
+        // types in the safe branch.
+        let end = lines.length;
+        for (let j = closeLine + 1, d = 0; j < lines.length; j++) {
+            for (const ch of lines[j]) {
+                if (ch === '{')
+                    d++;
+                else if (ch === '}')
+                    d--;
+            }
+            if (d < 0) {
+                end = j + 1;
+                break;
+            }
+        }
+        for (let l = closeLine + 2; l <= end; l++) {
             sanitizers.push({
                 type: 'go_map_allowlist_guard',
                 method: 'if',
@@ -4235,59 +5321,249 @@ function findPythonRegexAllowlistWrapperSanitizers(code) {
             const line = lines[i];
             if (!bareCallRe.test(line))
                 continue;
-            // Skip calls inside the wrapper's own body.
-            if (i > w.defLine) {
-                const lineIndent = line.length - line.trimStart().length;
-                if (lineIndent > w.defIndent) {
-                    let stillInside = true;
-                    for (let k = w.defLine + 1; k < i; k++) {
-                        const kline = lines[k];
-                        if (kline.trim() === '')
-                            continue;
-                        const kindent = kline.length - kline.trimStart().length;
-                        if (kindent <= w.defIndent) {
-                            stillInside = false;
-                            break;
-                        }
-                    }
-                    if (stillInside)
-                        continue;
-                }
+            // Skip calls inside the wrapper's own body.
+            if (i > w.defLine) {
+                const lineIndent = line.length - line.trimStart().length;
+                if (lineIndent > w.defIndent) {
+                    let stillInside = true;
+                    for (let k = w.defLine + 1; k < i; k++) {
+                        const kline = lines[k];
+                        if (kline.trim() === '')
+                            continue;
+                        const kindent = kline.length - kline.trimStart().length;
+                        if (kindent <= w.defIndent) {
+                            stillInside = false;
+                            break;
+                        }
+                    }
+                    if (stillInside)
+                        continue;
+                }
+            }
+            // Emit a sanitizer at the call line itself (covers ETE on a
+            // single-line `NAME(req.args.get(...))` shape).
+            sanitizers.push({
+                type: 'python_regex_allowlist_wrapper',
+                method: w.name,
+                line: i + 1,
+                sanitizes: [...wrapperKinds],
+            });
+            // If the call result is assigned to a variable, track it and
+            // emit sanitizers on every later line in the same function
+            // block that mentions that variable name. End the scan when
+            // we leave the call's enclosing block.
+            const am = assignedCallRe.exec(line);
+            if (!am)
+                continue;
+            const callIndent = am[1].length;
+            const validated = am[2];
+            const validatedRe = new RegExp(`\\b${validated}\\b`);
+            for (let j = i + 1; j < lines.length; j++) {
+                const jline = lines[j];
+                if (jline.trim() === '')
+                    continue;
+                const jindent = jline.length - jline.trimStart().length;
+                if (jindent < callIndent)
+                    break;
+                if (validatedRe.test(jline)) {
+                    sanitizers.push({
+                        type: 'python_regex_allowlist_wrapper',
+                        method: w.name,
+                        line: j + 1,
+                        sanitizes: [...wrapperKinds],
+                    });
+                }
+            }
+        }
+    }
+    return sanitizers;
+}
+function isPythonQuotedStringLiteral(token) {
+    const t = token.trim();
+    return (/^"(?:[^"\\]|\\.)*"$/.test(t) ||
+        /^'(?:[^'\\]|\\.)*'$/.test(t));
+}
+function pythonRhsIsLiteralStringCollection(rhs) {
+    let s = rhs.trim();
+    if (/^frozenset\s*\(/.test(s) && s.endsWith(')')) {
+        s = s.slice(s.indexOf('(') + 1, -1).trim();
+    }
+    const splitElems = (inner) => {
+        const parts = [];
+        let depth = 0;
+        let quote = null;
+        let start = 0;
+        for (let i = 0; i < inner.length; i++) {
+            const c = inner[i];
+            if (quote) {
+                if (c === '\\') {
+                    i++;
+                    continue;
+                }
+                if (c === quote)
+                    quote = null;
+                continue;
+            }
+            if (c === '"' || c === "'") {
+                quote = c;
+                continue;
+            }
+            if (c === '(' || c === '[' || c === '{')
+                depth++;
+            else if (c === ')' || c === ']' || c === '}')
+                depth--;
+            else if (c === ',' && depth === 0) {
+                parts.push(inner.slice(start, i).trim());
+                start = i + 1;
+            }
+        }
+        const last = inner.slice(start).trim();
+        if (last || parts.length > 0)
+            parts.push(last);
+        return parts.filter(Boolean);
+    };
+    if (s.startsWith('{') && s.endsWith('}')) {
+        const inner = s.slice(1, -1).trim();
+        if (!inner)
+            return true;
+        return splitElems(inner).every(isPythonQuotedStringLiteral);
+    }
+    if (s.startsWith('[') && s.endsWith(']')) {
+        const inner = s.slice(1, -1).trim();
+        if (!inner)
+            return false;
+        return splitElems(inner).every(isPythonQuotedStringLiteral);
+    }
+    if (s.startsWith('(') && s.endsWith(')')) {
+        const inner = s.slice(1, -1).trim();
+        if (!inner || !inner.includes(','))
+            return false;
+        return splitElems(inner).every(isPythonQuotedStringLiteral);
+    }
+    return false;
+}
+function collectPythonLiteralMembershipCollections(code) {
+    const names = new Set();
+    const lines = code.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        const indent = raw.length - raw.trimStart().length;
+        if (indent !== 0)
+            continue;
+        const am = /^([A-Za-z_]\w*)\s*=\s*(.+)$/.exec(trimmed);
+        if (!am)
+            continue;
+        const name = am[1];
+        if (!pythonRhsIsLiteralStringCollection(am[2]))
+            continue;
+        if (new RegExp(String.raw `\b${name}\s*(?:\.add\s*\(|\.update\s*\(|\|=)|\b${name}\s*\[[^\]]+\]\s*=`).test(code)) {
+            continue;
+        }
+        names.add(name);
+    }
+    return names;
+}
+function pythonEnclosingDefEndLine(lines, fromLine) {
+    let defLine = -1;
+    let defIndent = -1;
+    for (let k = fromLine; k >= 0; k--) {
+        const dm = /^(\s*)def\s+/.exec(lines[k]);
+        if (dm) {
+            defLine = k;
+            defIndent = dm[1].length;
+            break;
+        }
+    }
+    if (defLine < 0)
+        return lines.length;
+    for (let j = defLine + 1; j < lines.length; j++) {
+        const line = lines[j];
+        if (line.trim() === '')
+            continue;
+        const indent = line.length - line.trimStart().length;
+        if (indent <= defIndent && /^\s*(?:def\s+|@|class\s+)/.test(line)) {
+            return j;
+        }
+    }
+    return lines.length;
+}
+/**
+ * Python literal set/list/tuple membership guard (cognium-dev #563).
+ *
+ *   if theme not in THEMES:
+ *       abort(400)
+ *   session["theme"] = theme
+ *
+ * Past the guard, `theme` is one of the module-level string literals in
+ * `THEMES`. The collection must be a literal of string constants that the
+ * file never mutates.
+ */
+function findPythonLiteralMembershipGuardSanitizers(code) {
+    const sanitizers = [];
+    const lines = code.split('\n');
+    const literalCollections = collectPythonLiteralMembershipCollections(code);
+    if (literalCollections.size === 0)
+        return sanitizers;
+    const guardOpen = /^(\s*)if\s+([A-Za-z_][A-Za-z0-9_]*)\s+not\s+in\s+([A-Za-z_][A-Za-z0-9_]*)\s*:\s*$/;
+    const terminator = /\b(return|raise|abort\s*\(|sys\.exit\s*\()/;
+    for (let i = 0; i < lines.length; i++) {
+        const m = guardOpen.exec(lines[i]);
+        if (!m)
+            continue;
+        const guardIndent = m[1].length;
+        const guardedVar = m[2];
+        const collectionName = m[3];
+        if (!literalCollections.has(collectionName))
+            continue;
+        let bodyHasTerminator = false;
+        let blockEnd = -1;
+        const maxScan = Math.min(lines.length, i + 26);
+        for (let j = i + 1; j < maxScan; j++) {
+            const line = lines[j];
+            if (line.trim() === '')
+                continue;
+            const indent = line.length - line.trimStart().length;
+            if (indent <= guardIndent) {
+                blockEnd = j - 1;
+                break;
             }
-            // Emit a sanitizer at the call line itself (covers ETE on a
-            // single-line `NAME(req.args.get(...))` shape).
+            if (terminator.test(line))
+                bodyHasTerminator = true;
+        }
+        if (blockEnd === -1)
+            blockEnd = Math.min(lines.length - 1, i + 25);
+        if (!bodyHasTerminator)
+            continue;
+        const varRe = new RegExp(String.raw `\b${guardedVar}\b`);
+        const reassign = new RegExp(String.raw `^\s*${guardedVar}\s*=(?!=)`);
+        const funcEnd = pythonEnclosingDefEndLine(lines, i);
+        for (let l = blockEnd + 2; l <= funcEnd; l++) {
+            const lineText = lines[l - 1];
+            if (!lineText || !varRe.test(lineText))
+                continue;
+            if (reassign.test(lineText))
+                break;
             sanitizers.push({
-                type: 'python_regex_allowlist_wrapper',
-                method: w.name,
-                line: i + 1,
-                sanitizes: [...wrapperKinds],
+                type: 'python_literal_membership_guard',
+                method: 'if',
+                line: l,
+                sanitizes: [
+                    'trust_boundary',
+                    'sql_injection',
+                    'command_injection',
+                    'path_traversal',
+                    'ssrf',
+                    'ldap_injection',
+                    'xpath_injection',
+                    'log_injection',
+                    'xss',
+                    'open_redirect',
+                    'external_taint_escape',
+                ],
             });
-            // If the call result is assigned to a variable, track it and
-            // emit sanitizers on every later line in the same function
-            // block that mentions that variable name. End the scan when
-            // we leave the call's enclosing block.
-            const am = assignedCallRe.exec(line);
-            if (!am)
-                continue;
-            const callIndent = am[1].length;
-            const validated = am[2];
-            const validatedRe = new RegExp(`\\b${validated}\\b`);
-            for (let j = i + 1; j < lines.length; j++) {
-                const jline = lines[j];
-                if (jline.trim() === '')
-                    continue;
-                const jindent = jline.length - jline.trimStart().length;
-                if (jindent < callIndent)
-                    break;
-                if (validatedRe.test(jline)) {
-                    sanitizers.push({
-                        type: 'python_regex_allowlist_wrapper',
-                        method: w.name,
-                        line: j + 1,
-                        sanitizes: [...wrapperKinds],
-                    });
-                }
-            }
         }
     }
     return sanitizers;
@@ -5677,6 +6953,11 @@ function findJavaCanonicalPathStartsWithGuardSanitizers(code) {
             continue;
         if (!guardRejects(lines, i, terminatorRe, 6))
             continue;
+        // cognium-dev#618: a string-prefix check against a canonical base with no
+        // trailing separator is the prefix-confusion bypass, not a guard.
+        const base = javaCallArgument(lines.slice(i).join('\n'), m.index + m[0].length - 1);
+        if (base !== null && javaCanonicalBaseLacksSeparator(lines, i, base))
+            continue;
         const guarded = new Set([m[1]]);
         const mentions = (t) => {
             for (const n of guarded)
@@ -5710,6 +6991,147 @@ function findJavaCanonicalPathStartsWithGuardSanitizers(code) {
     }
     return sanitizers;
 }
+/**
+ * Identifiers allowed in the initializer of a constant allowlist collection.
+ * Anything else (a method parameter, a request read, a config lookup) means
+ * the membership set is not a fixed set of literals.
+ */
+const JAVA_LITERAL_COLLECTION_IDENTS = new Set([
+    'new', 'String', 'Set', 'List', 'of', 'copyOf', 'Arrays', 'asList',
+    'HashSet', 'TreeSet', 'LinkedHashSet', 'ArrayList', 'LinkedList',
+    'Collections', 'unmodifiableSet', 'unmodifiableList',
+    'ImmutableSet', 'ImmutableList', 'java', 'util',
+]);
+/**
+ * cognium-dev#668 — Java reflection allowlist guard.
+ *
+ *   private static final Set<String> ALLOWED = Set.of("a.Csv", "a.Json");
+ *   if (!ALLOWED.contains(cls)) { throw new SecurityException("denied"); }
+ *   return Class.forName(cls).getDeclaredConstructor().newInstance();
+ *
+ * Past a rejecting `!<SET>.contains(<v>)` guard, `<v>` is one of the set's
+ * literals, so the class it names is chosen by the code, not the requester.
+ * Positive evidence only: `<SET>` must be a `final` field or local of this
+ * file whose initializer is nothing but string literals inside the standard
+ * collection factories, and the guard must reject (throw / return). Credits
+ * `<v>` on later lines of the enclosing method until `<v>` is reassigned.
+ * Scoped to `code_injection` (reflective class loading); other sink types
+ * are untouched.
+ */
+function findJavaReflectionAllowlistGuardSanitizers(code, types) {
+    const sanitizers = [];
+    const lines = code.split('\n');
+    const guardRe = /\bif\s*\(\s*!\s*(?:this\s*\.\s*|[A-Z]\w*\s*\.\s*)?([A-Za-z_]\w*)\s*\.\s*contains\s*\(\s*([A-Za-z_]\w*)\s*\)\s*\)/;
+    const terminatorRe = /\b(throw|return)\b/;
+    // Factory / constructor tokens that prove the initializer is a collection of
+    // literals. A bare `final String ALLOWED = "…"` leaves no idents after string
+    // stripping (so `.every` would pass) and `String.contains` is substring — not
+    // an allowlist. Require at least one of these.
+    const LITERAL_COLLECTION_FACTORIES = new Set([
+        'of', 'copyOf', 'asList', 'HashSet', 'TreeSet', 'LinkedHashSet',
+        'ArrayList', 'LinkedList', 'unmodifiableSet', 'unmodifiableList',
+        'ImmutableSet', 'ImmutableList',
+    ]);
+    /**
+     * Nearest declaration of `name` at or above `fromLine` (0-based). A closer
+     * non-final binding (local, `var`, parameter) wins over an earlier `final`
+     * field; only a nearest `final` literal collection returns true.
+     */
+    const isLiteralCollection = (name, fromLine) => {
+        const finalDeclRe = new RegExp(`\\bfinal\\b[^=;(]*\\b${name}\\s*=(?!=)`);
+        // Type/var declaration or use as a parameter (`Type name` before `=` / `;` / `,` / `)`).
+        const anyDeclRe = new RegExp(`\\b(?:[A-Z][\\w.<>,\\[\\]?\\s]*|var)\\s+${name}\\s*[=;,)]`);
+        for (let i = fromLine; i >= 0; i--) {
+            const line = lines[i];
+            if (!anyDeclRe.test(line) && !finalDeclRe.test(line))
+                continue;
+            const dm = finalDeclRe.exec(line);
+            if (!dm)
+                return false; // nearer non-final binding — not a fixed allowlist
+            // Initializer up to the terminating `;` (may span a few lines).
+            let init = line.slice(dm.index + dm[0].length);
+            for (let j = i + 1; !init.includes(';') && j < Math.min(lines.length, i + 12); j++)
+                init += ' ' + lines[j];
+            if (!init.includes(';'))
+                return false;
+            init = init.slice(0, init.indexOf(';')).replace(/"(?:[^"\\]|\\.)*"/g, '""');
+            if (!init.includes('""'))
+                return false;
+            const idents = init.match(/[A-Za-z_]\w*/g) ?? [];
+            // Empty idents (string-only initializer) or no collection factory → not a set.
+            if (!idents.some(id => LITERAL_COLLECTION_FACTORIES.has(id)))
+                return false;
+            if (!idents.every(id => JAVA_LITERAL_COLLECTION_IDENTS.has(id)))
+                return false;
+            // A mutable collection that is written anywhere is not a fixed set.
+            const mutRe = new RegExp(`\\b${name}\\s*\\.\\s*(?:add|addAll|put|putAll|set|replaceAll)\\s*\\(`);
+            return !lines.some(l => mutRe.test(l));
+        }
+        return false;
+    };
+    for (let i = 0; i < lines.length; i++) {
+        const m = guardRe.exec(lines[i]);
+        if (!m)
+            continue;
+        const [, setName, guarded] = m;
+        if (!guardRejects(lines, i, terminatorRe, 6))
+            continue;
+        if (!isLiteralCollection(setName, i))
+            continue;
+        const method = types
+            .flatMap(t => t.methods)
+            .filter(mt => mt.start_line <= i + 1 && mt.end_line >= i + 1)
+            .sort((a, b) => (a.end_line - a.start_line) - (b.end_line - b.start_line))[0];
+        if (!method)
+            continue;
+        // The guard must sit in the method body's top-level block, so it dominates
+        // every later line (not inside an `if` branch, loop or lambda body).
+        const before = [...lines.slice(method.start_line - 1, i), lines[i].slice(0, m.index)]
+            .join('\n').replace(/"(?:[^"\\]|\\.)*"/g, '""');
+        const depth = (before.match(/\{/g) ?? []).length - (before.match(/\}/g) ?? []).length;
+        if (depth !== 1)
+            continue;
+        // Braceless `if`/`for`/`while`/`else` keeps brace-depth 1, so also reject a
+        // guard that is the body of a preceding braceless control statement — on the
+        // same line (`if (strict) if (!SET.contains(v))`) or the previous statement
+        // (`} else` / `else` / `if (x)` without `{`).
+        const samePrefix = lines[i].slice(0, m.index).replace(/\/\/.*$/, '').trim();
+        let prev = '';
+        for (let p = i - 1; p >= method.start_line - 1; p--) {
+            const t = lines[p].replace(/\/\/.*$/, '').trim();
+            if (!t)
+                continue;
+            prev = t;
+            break;
+        }
+        const openBraceless = (s) => {
+            // Allow a leading `}` so `} else` counts as braceless else.
+            const t = s.replace(/^\}+\s*/, '').trim();
+            return /^(?:else(?:\s+if\b)?|if|for|while)\b/.test(t) && !s.includes('{');
+        };
+        if (openBraceless(samePrefix) || (prev && openBraceless(prev)))
+            continue;
+        const refRe = new RegExp(`(?<![\\w.])${guarded}\\b`);
+        // Credit only lines where `<v>` is a whole call argument, `f(<v>)`, so a
+        // second tainted value on the same line (`forName(v + other)`) still reports.
+        const wholeArgRe = new RegExp(`\\(\\s*${guarded}\\s*\\)`);
+        const reassignRe = new RegExp(`(?<![\\w.])${guarded}\\s*(?:=(?!=)|\\+=)`);
+        for (let l = i + 1; l < Math.min(method.end_line, lines.length); l++) {
+            const lt = lines[l];
+            if (reassignRe.test(lt))
+                break;
+            if (!refRe.test(lt) || !wholeArgRe.test(lt))
+                continue;
+            sanitizers.push({
+                type: 'java_reflection_allowlist_guard',
+                method: 'contains',
+                line: l + 1,
+                sanitizes: ['code_injection'],
+            });
+        }
+    }
+    return sanitizers;
+}
 /**
  * Does the `if (...)` guard on `lines[i]` actually **reject**?
  *
@@ -5785,6 +7207,212 @@ function guardRejects(lines, i, terminatorRe, window) {
  * form `if (x.StartsWith(root)) { … }` still reports, and a test pins that so
  * the gap stays visible rather than silently assumed.
  */
+/**
+ * cognium-dev#293 (Java cell): membership in a literal allow-list followed by
+ * a reject is a guard.
+ *
+ *   if (!Set.of("locale", "theme").contains(key)) throw new IllegalArgumentException();
+ *   req.getSession().setAttribute(key, value);       // was trust_boundary on `key`
+ *
+ * Past the guard, `key` is one of the listed string constants. The set must
+ * be written out as string literals: inline `Set.of` / `List.of` /
+ * `Arrays.asList`, or a `static final` constant of the same file initialised
+ * from one of them. A set built any other way (a parameter, a config read, a
+ * mutable collection) is not credited: its contents are unknown.
+ *
+ * Only the guarded variable is credited, from the guard to the end of the
+ * enclosing method or the variable's next reassignment, and only when the
+ * guard rejects (`guardRejects`).
+ */
+const JAVA_OPERAND_KEYWORDS = new Set([
+    'new', 'return', 'this', 'super', 'null', 'true', 'false', 'throw', 'if', 'else', 'instanceof',
+    'int', 'long', 'short', 'byte', 'char', 'boolean', 'double', 'float', 'var', 'final',
+]);
+/**
+ * True when `expr` is only `name`, string literals, `.length()` / `.size()`,
+ * and `+` (no other locals or value-producing calls).
+ */
+function javaExprOnlyGuardedAndLits(expr, name) {
+    let s = expr
+        .replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g, '')
+        .replace(/\.\s*(?:length|size)\s*\(\s*\)/g, '')
+        .replace(new RegExp(String.raw `\b${name}\b`, 'g'), '');
+    s = s.replace(/[+\s()]/g, '');
+    return s.length === 0;
+}
+/** Top-level comma-separated arguments of a call, respecting quotes and nesting. */
+function javaSplitCallArgs(argsText) {
+    const out = [];
+    let depth = 0;
+    let quote = null;
+    let start = 0;
+    for (let i = 0; i < argsText.length; i++) {
+        const c = argsText[i];
+        if (quote) {
+            if (c === '\\') {
+                i++;
+                continue;
+            }
+            if (c === quote)
+                quote = null;
+            continue;
+        }
+        if (c === '"' || c === "'") {
+            quote = c;
+            continue;
+        }
+        if (c === '(' || c === '[' || c === '{')
+            depth++;
+        else if (c === ')' || c === ']' || c === '}')
+            depth--;
+        else if (c === ',' && depth === 0) {
+            out.push(argsText.slice(start, i).trim());
+            start = i + 1;
+        }
+    }
+    const last = argsText.slice(start).trim();
+    if (last || out.length > 0)
+        out.push(last);
+    return out;
+}
+/**
+ * True when a call on `line` (other than length/size) has an argument that is
+ * not only string literals and the guarded variable — a raw operand.
+ */
+function javaCallHasRawArgument(line, name) {
+    const re = /\b([A-Za-z_]\w*)\s*\(/g;
+    let m;
+    while ((m = re.exec(line)) !== null) {
+        const method = m[1];
+        if (method === 'length' || method === 'size')
+            continue;
+        const open = m.index + m[0].length - 1;
+        let depth = 0;
+        let quote = null;
+        let end = -1;
+        for (let i = open; i < line.length; i++) {
+            const c = line[i];
+            if (quote) {
+                if (c === '\\') {
+                    i++;
+                    continue;
+                }
+                if (c === quote)
+                    quote = null;
+                continue;
+            }
+            if (c === '"' || c === "'") {
+                quote = c;
+                continue;
+            }
+            if (c === '(')
+                depth++;
+            else if (c === ')') {
+                depth--;
+                if (depth === 0) {
+                    end = i;
+                    break;
+                }
+            }
+        }
+        if (end < 0)
+            continue;
+        for (const arg of javaSplitCallArgs(line.slice(open + 1, end))) {
+            if (!arg)
+                continue;
+            if (!javaExprOnlyGuardedAndLits(arg, name))
+                return true;
+        }
+    }
+    return false;
+}
+/**
+ * True when `line` reads a lower-case identifier other than `name` as a value
+ * (not a receiver, call name, member, type, constant or the assigned local),
+ * or a call whose argument is not only string literals / `name` (a call-shaped
+ * raw operand such as `req.getParameter("level")` beside the guarded local).
+ */
+function otherLocalOperand(line, name) {
+    if (javaCallHasRawArgument(line, name))
+        return true;
+    const s = line
+        .replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g, '""')
+        .replace(/^\s*(?:[\w<>[\],.?]+\s+)?[A-Za-z_]\w*\s*=(?!=)/, ' ')
+        .replace(/\.\s*[A-Za-z_]\w*/g, ' ')
+        .replace(/\b[A-Za-z_]\w*(?=\s*[.(])/g, ' ');
+    return (s.match(/\b[a-z_]\w*\b/g) ?? []).some(id => id !== name && !JAVA_OPERAND_KEYWORDS.has(id));
+}
+function findJavaLiteralAllowlistGuardSanitizers(code) {
+    const sanitizers = [];
+    const lines = code.split('\n');
+    const literalList = String.raw `(?:Set|List)\s*\.\s*of|Arrays\s*\.\s*asList`;
+    const literalArgs = String.raw `\(\s*"(?:[^"\\]|\\.)*"(?:\s*,\s*"(?:[^"\\]|\\.)*")*\s*\)`;
+    // Constants declared from a literal list in this file.
+    const constants = new Set();
+    const constRe = new RegExp(String.raw `\bstatic\s+final\s+[\w<>,.\s]+?\s([A-Za-z_]\w*)\s*=\s*(?:${literalList})\s*${literalArgs}\s*;`);
+    for (const l of lines) {
+        const m = constRe.exec(l);
+        if (m)
+            constants.add(m[1]);
+    }
+    const guardRe = new RegExp(String.raw `\bif\s*\(\s*!\s*(?:(?:${literalList})\s*${literalArgs}|([A-Za-z_]\w*))\s*\.\s*contains\s*\(\s*([A-Za-z_]\w*)\s*\)\s*\)`);
+    const terminatorRe = /\b(throw|return)\b/;
+    for (let i = 0; i < lines.length; i++) {
+        const m = guardRe.exec(lines[i]);
+        if (!m)
+            continue;
+        if (m[1] !== undefined && !constants.has(m[1]))
+            continue;
+        if (!guardRejects(lines, i, terminatorRe, 6))
+            continue;
+        const name = m[2];
+        const mention = new RegExp(String.raw `(?<![\w.])${name}\b`);
+        const reassign = new RegExp(String.raw `^\s*(?:[\w.<>[\]]+\s+)?${name}\s*=(?!=)`);
+        // Skip the guard's own block, then credit to the end of the enclosing method.
+        let start = i + 1;
+        if (/\{\s*$/.test(lines[i])) {
+            for (let d = 0, j = i; j < lines.length; j++) {
+                for (const ch of lines[j]) {
+                    if (ch === '{')
+                        d++;
+                    else if (ch === '}')
+                        d--;
+                }
+                if (d <= 0) {
+                    start = j + 1;
+                    break;
+                }
+            }
+        }
+        for (let j = start, d = 0; j < lines.length; j++) {
+            for (const ch of lines[j]) {
+                if (ch === '{')
+                    d++;
+                else if (ch === '}')
+                    d--;
+            }
+            if (d < 0)
+                break;
+            if (reassign.test(lines[j]))
+                break;
+            if (!mention.test(lines[j]))
+                continue;
+            // The credit is line-keyed: a line that also carries another local
+            // (`"... n='" + who + "' ORDER BY " + col`) would clean `who` too.
+            if (otherLocalOperand(lines[j], name))
+                continue;
+            sanitizers.push({
+                type: 'java_literal_allowlist_guard',
+                method: 'guard',
+                line: j + 1,
+                sanitizes: ['trust_boundary', 'sql_injection', 'command_injection', 'path_traversal', 'ssrf',
+                    'ldap_injection', 'xpath_injection', 'log_injection', 'xss', 'open_redirect',
+                    'external_taint_escape'],
+            });
+        }
+    }
+    return sanitizers;
+}
 /**
  * cognium-dev#272 — a validating predicate followed by an EARLY RETURN is a
  * guard, and the value reaching the sink afterwards is already validated.
@@ -6052,6 +7680,19 @@ function findJavaPathGetFileNameSanitizers(code) {
  * strips CRLF. In Java that means an explicit `String`/`CharSequence` return
  * type, which keeps `void` log-and-forget methods out.
  */
+/** True when the Java text strips both `\r` and `\n` via replace / replaceAll (cognium-dev#605). */
+function javaBodyStripsCrAndLf(body) {
+    let cr = false;
+    let lf = false;
+    for (const m of body.matchAll(/\.\s*(replace|replaceAll)\s*\(\s*(?:"((?:\\.|[^"\\])*)"|'(\\.|[^'\\])')/g)) {
+        const cov = javaReplaceCrLfCoverage(m[1], m[2] ?? m[3] ?? '');
+        if (cov.cr)
+            cr = true;
+        if (cov.lf)
+            lf = true;
+    }
+    return cr && lf;
+}
 function findCrlfWrapperFunctionSanitizers(code, language) {
     const sanitizers = [];
     const lines = code.split('\n');
@@ -6068,8 +7709,25 @@ function findCrlfWrapperFunctionSanitizers(code, language) {
         const m = declRe.exec(lines[i]);
         if (!m)
             continue;
-        const body = lines.slice(i, Math.min(lines.length, i + bodyWindow)).join('\n');
-        if (stripRe.test(body))
+        if (language !== 'java') {
+            const body = lines.slice(i, Math.min(lines.length, i + bodyWindow)).join('\n');
+            if (stripRe.test(body))
+                wrappers.add(m[1]);
+            continue;
+        }
+        // Java: stop at the next declaration so one helper's body does not
+        // credit the helper above it, and require the strip to cover BOTH CR and
+        // LF. An LF-only `replace("\n", "")` leaves CR, which still forges a
+        // log line (cognium-dev#605).
+        let end = Math.min(lines.length, i + bodyWindow);
+        for (let j = i + 1; j < end; j++) {
+            if (declRe.test(lines[j])) {
+                end = j;
+                break;
+            }
+        }
+        const body = lines.slice(i, end).join('\n');
+        if (javaBodyStripsCrAndLf(body))
             wrappers.add(m[1]);
     }
     if (wrappers.size === 0)
@@ -7160,8 +8818,13 @@ export function findJsPatternFindings(code, file) {
  *      the args is wrapped in a recognized HTML escaper
  *      (`html.EscapeString` / `template.HTMLEscapeString` /
  *      `template.HTMLEscaper`).
+ *
+ * A write whose every argument is a local holding an int or bool measure of
+ * a value (`scalarVarsAt(line)`, #568 — `fmt.Fprintf(w, "%d", n)` with
+ * `n := len(...)`) is skipped. Any other argument, including request reads
+ * the taint engine has no source for (`r.URL.Path`), still reports.
  */
-export function findGoXssFindings(code, file) {
+export function findGoXssFindings(code, file, scalarVarsAt = () => new Set()) {
     const out = [];
     const lines = code.split('\n');
     const rwNames = new Set();
@@ -7192,6 +8855,11 @@ export function findGoXssFindings(code, file) {
         // Require at least one identifier in tail outside string literals.
         if (!/[A-Za-z_]\w*/.test(tail.replace(/"[^"]*"|`[^`]*`/g, '')))
             continue;
+        const idents = tail.replace(/"(?:[^"\\]|\\.)*"|`[^`]*`/g, '')
+            .match(/[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*/g) ?? [];
+        const scalars = scalarVarsAt(i + 1);
+        if (idents.length > 0 && idents.every(id => scalars.has(id)))
+            continue;
         out.push({
             id: `xss-${file}-${i + 1}`,
             pass: 'language-sources',
@@ -10556,4 +12224,225 @@ export function findJsTemplateInjectionSstiFindings(code, file) {
     }
     return findings;
 }
+// ---------------------------------------------------------------------------
+// cognium-dev#566 — Spring MVC return-as-body XSS (Java)
+// ---------------------------------------------------------------------------
+const SPRING_MAPPING_ANN = /^(?:Get|Post|Put|Delete|Patch|Request)Mapping\b/;
+const SPRING_WEB_PARAM_ANN = /^(?:RequestParam|PathVariable|RequestHeader|CookieValue|MatrixVariable)\b/;
+const SPRING_NON_TEXT_PARAM_TYPE = /^(?:int|long|short|byte|double|float|boolean|char|Integer|Long|Short|Byte|Double|Float|Boolean|Character|BigDecimal|BigInteger|UUID|LocalDate|LocalDateTime|LocalTime|Instant|OffsetDateTime|ZonedDateTime|Date)$/;
+/**
+ * Value of `produces = …` on a `@*Mapping` annotation, or null when absent.
+ * Only the produces value is considered — a path like `/widgets.html` must not
+ * look like an HTML media type.
+ */
+function springProducesValue(annotations) {
+    for (const a of annotations) {
+        if (!/^\w+Mapping\b/.test(a) || !/\bproduces\s*=/.test(a))
+            continue;
+        const m = /\bproduces\s*=\s*(?:\{([^}]*)\}|([^,)]+))/.exec(a);
+        if (!m)
+            continue;
+        return (m[1] ?? m[2] ?? '').trim();
+    }
+    return null;
+}
+/** True when a produces value names a non-HTML media type. */
+function springProducesValueIsNonHtml(value) {
+    return !/html/i.test(value);
+}
+/** Markup or string concatenation around a value (the Python return-XSS gate, #368). */
+function javaExprLooksLikeHtml(expr) {
+    return /"[^"]*<[^"]*"/.test(expr) || /"\s*\+/.test(expr) || /\+\s*"/.test(expr);
+}
+/** Parentheses outside string literals never close below depth 0 and end at 0. */
+function javaParensBalanced(expr) {
+    let depth = 0;
+    for (const ch of expr.replace(/"(?:[^"\\]|\\.)*"/g, '""')) {
+        if (ch === '(')
+            depth++;
+        else if (ch === ')' && --depth < 0)
+            return false;
+    }
+    return depth === 0;
+}
+/**
+ * cognium-dev#566 — the value a Spring MVC handler returns is the response
+ * body when the class is `@RestController` (or `@ResponseBody` sits on the
+ * class or the method), and always when the handler returns a
+ * `ResponseEntity`. A `String` body is written with the negotiated content
+ * type, so a browser request gets it as `text/html`: request data
+ * concatenated into markup there is reflected XSS.
+ *
+ * Positive evidence only:
+ *   - the method carries a `@*Mapping` annotation;
+ *   - it returns `String` under a body-writing controller, or
+ *     `ResponseEntity<String>` via `ResponseEntity.ok(x)` /
+ *     `new ResponseEntity<>(x, …)`, or `ResponseEntity.ok().body(x)` /
+ *     `ResponseEntity.status(...).body(x)` on a body-writing controller);
+ *   - the returned expression references a request-bound parameter
+ *     (`@RequestParam`, `@PathVariable`, `@RequestHeader`, `@CookieValue`,
+ *     `@MatrixVariable`, a `String` `@RequestBody`) or an in-method source,
+ *     directly or through a local assigned from it, and looks like HTML
+ *     (markup or string concatenation, directly or in that local's assignment).
+ *
+ * Not a sink: a plain `@Controller` returning a `String` (a view name),
+ * `produces = ` a non-HTML media type on the method or class mapping, a
+ * non-`String` return (serialised as JSON), a returned value that does not
+ * look like markup, and any handler with an xss-covering sanitizer between
+ * its start and the return.
+ */
+export function findJavaSpringReturnXSSSinks(code, types, sources, xssSanitizerLines) {
+    const out = [];
+    const lines = code.split('\n');
+    const esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const stripStrings = (s) => s.replace(/"(?:[^"\\]|\\.)*"/g, '""');
+    const refers = (expr, name) => new RegExp(`(?<![\\w.])${esc(name)}\\b`).test(stripStrings(expr));
+    for (const t of types) {
+        const ann = t.annotations ?? [];
+        const isRest = ann.some(a => /^RestController\b/.test(a));
+        if (!isRest && !ann.some(a => /^Controller\b/.test(a)))
+            continue;
+        const classProduces = springProducesValue(ann);
+        const classBody = isRest || ann.some(a => /^ResponseBody\b/.test(a));
+        for (const m of t.methods) {
+            if (!m.annotations.some(a => SPRING_MAPPING_ANN.test(a)))
+                continue;
+            // Method-level produces overrides class-level; only non-HTML suppresses.
+            const methodProduces = springProducesValue(m.annotations);
+            const produces = methodProduces ?? classProduces;
+            if (produces != null && springProducesValueIsNonHtml(produces))
+                continue;
+            const rt = (m.return_type ?? '').replace(/\s+/g, '');
+            const entity = rt === 'ResponseEntity<String>';
+            const body = rt === 'String' && (classBody || m.annotations.some(a => /^ResponseBody\b/.test(a)));
+            if (!entity && !body)
+                continue;
+            // Seeds: request-bound parameters, then in-method sources with a variable.
+            const seeds = new Map();
+            for (const p of m.parameters) {
+                // Spring converts to the declared type first: a number, boolean,
+                // UUID or date cannot carry markup.
+                if (SPRING_NON_TEXT_PARAM_TYPE.test((p.type ?? '').replace(/^(?:[\w]+\.)+/, '')))
+                    continue;
+                const bound = p.annotations.some(a => SPRING_WEB_PARAM_ANN.test(a))
+                    || (p.annotations.some(a => /^RequestBody\b/.test(a)) && p.type === 'String');
+                if (bound)
+                    seeds.set(p.name, p.line ?? m.start_line);
+            }
+            for (const s of sources) {
+                // A plain parameter of the handler is not request data by itself.
+                if (s.type === 'interprocedural_param')
+                    continue;
+                if (!s.variable || !/^[A-Za-z_]\w*$/.test(s.variable))
+                    continue;
+                if (s.line > m.start_line && s.line <= m.end_line && !seeds.has(s.variable))
+                    seeds.set(s.variable, s.line);
+            }
+            if (seeds.size === 0)
+                continue;
+            // Locals assigned from a seed (method body only), each tied to its seed's line.
+            const bodyText = lines.slice(m.start_line - 1, m.end_line).join('\n');
+            const carriers = new Map();
+            for (const [n, l] of seeds)
+                carriers.set(n, { sourceLine: l, assignLine: l });
+            const derived = [...buildJavaTaintedVars(bodyText, new Set(seeds.keys()))].sort((a, b) => a[1] - b[1]);
+            for (const [n, rel] of derived) {
+                if (carriers.has(n))
+                    continue;
+                const assignLine = m.start_line + rel - 1;
+                const from = [...carriers].find(([c]) => refers(lines[assignLine - 1] ?? '', c));
+                carriers.set(n, { sourceLine: from ? from[1].sourceLine : m.start_line, assignLine });
+            }
+            for (let i = m.start_line - 1; i < Math.min(m.end_line, lines.length); i++) {
+                if (!/^\s*return\b/.test(lines[i] ?? ''))
+                    continue;
+                let stmt = lines[i];
+                for (let j = i + 1; !stmt.includes(';') && j < Math.min(m.end_line, lines.length); j++)
+                    stmt += ' ' + lines[j];
+                stmt = stmt.replace(/^\s*return\b/, '').replace(/;[^;]*$/, '');
+                const sinkLine = i + 1;
+                let expr = stmt;
+                if (entity) {
+                    // `ResponseEntity.ok(x)` / `new ResponseEntity<>(x, status)` /
+                    // `ResponseEntity.ok().body(x)` / `ResponseEntity.status(...).body(x)`.
+                    const em = /^\s*ResponseEntity\s*\.\s*ok\s*\(\s*\)\s*\.\s*body\s*\(([\s\S]+)\)\s*$/.exec(stmt)
+                        ?? /^\s*ResponseEntity\s*\.\s*status\s*\(([\s\S]+)\)\s*\.\s*body\s*\(([\s\S]+)\)\s*$/.exec(stmt)
+                        ?? /^\s*ResponseEntity\s*\.\s*ok\s*\(([\s\S]+)\)\s*$/.exec(stmt)
+                        ?? /^\s*new\s+ResponseEntity\s*(?:<[^>]*>)?\s*\(([\s\S]+),[^,()]*\)\s*$/.exec(stmt);
+                    if (!em)
+                        continue;
+                    const payload = em.length === 3 ? em[2] : em[1];
+                    if (!payload || !javaParensBalanced(payload))
+                        continue;
+                    if (em.length === 3 && !javaParensBalanced(em[1]))
+                        continue;
+                    expr = payload;
+                }
+                const hit = [...carriers].find(([c, info]) => info.assignLine <= sinkLine && refers(expr, c));
+                if (!hit)
+                    continue;
+                const [name, info] = hit;
+                let htmlish = javaExprLooksLikeHtml(expr);
+                if (!htmlish && new RegExp(`^\\s*${esc(name)}\\s*$`).test(expr) && info.assignLine !== info.sourceLine) {
+                    htmlish = javaExprLooksLikeHtml(lines[info.assignLine - 1] ?? '');
+                }
+                if (!htmlish)
+                    continue;
+                // Suppress only when an xss sanitizer's operand is the returned carrier
+                // (or the carrier local was assigned from that sanitizer). Escaping a
+                // different variable must not clear a return of another carrier.
+                const xssEscapeOpRe = /\b(?:Encode\.(?:forHtml|forHtmlAttribute|forHtmlContent|forJavaScript)|StringEscapeUtils\.escape(?:Html3|Html4|EcmaScript|Xml)|HtmlUtils\.htmlEscape(?:Decimal|Hex)?|Escaper\.escapeHtml|HtmlEscapers\.(?:escapeHtml|htmlEscaper)|Encoder\.encodeForHTML(?:Attribute)?|Jsoup\.clean)\s*\(\s*([A-Za-z_]\w*)/;
+                const sanitizerCoversCarrier = xssSanitizerLines.some(l => {
+                    if (l < m.start_line || l > sinkLine)
+                        return false;
+                    const line = lines[l - 1] ?? '';
+                    const ops = [];
+                    let sm;
+                    const re = new RegExp(xssEscapeOpRe.source, 'g');
+                    while ((sm = re.exec(line)) !== null)
+                        ops.push(sm[1]);
+                    // Unparsed shapes (e.g. static-import `htmlEscape(title)`) do not suppress.
+                    if (ops.length === 0)
+                        return false;
+                    // Operand is the returned carrier.
+                    if (ops.some(op => op === name))
+                        return true;
+                    // Carrier assigned from the sanitizer call itself (`body = HtmlUtils.htmlEscape(x)`),
+                    // not a concat that merely mentions a sanitizer on the assignment line.
+                    if (l === info.assignLine) {
+                        const stripped = line.replace(/"(?:[^"\\]|\\.)*"/g, '""').trim();
+                        const am = new RegExp(`\\b${esc(name)}\\s*=\\s*(.+)$`).exec(stripped);
+                        if (!am)
+                            return false;
+                        const rhs = am[1].replace(/;\s*$/, '').trim();
+                        const call = xssEscapeOpRe.exec(rhs);
+                        if (!call || call.index !== 0)
+                            return false;
+                        // Whole RHS is one sanitizer invocation (no concatenation outside the call).
+                        let depth = 0;
+                        let ended = -1;
+                        for (let k = call.index; k < rhs.length; k++) {
+                            const ch = rhs[k];
+                            if (ch === '(')
+                                depth++;
+                            else if (ch === ')') {
+                                depth--;
+                                if (depth === 0) {
+                                    ended = k;
+                                    break;
+                                }
+                            }
+                        }
+                        return ended >= 0 && rhs.slice(ended + 1).trim() === '';
+                    }
+                    return false;
+                });
+                if (sanitizerCoversCarrier)
+                    continue;
+                out.push({ sinkLine, sourceLine: info.sourceLine });
+            }
+        }
+    }
+    return out;
+}
 //# sourceMappingURL=language-sources-pass.js.map