circle-ir 4.14.2 → 4.16.0

package/dist/analysis/passes/param-source-flow-gate-pass.d.ts

@@ -27,6 +27,14 @@
  *    `@router.get(...)`, `@Get()`), Rust route attributes (`#[get("/<x>")]`)
  *    and Rust handlers returning a web response type (`HttpResponse`,
  *    `impl Responder`, `impl warp::Reply`, ...).
+ *  - A parameter that a real source in the same file feeds is kept
+ *    (cognium-dev #684): `function grep(t) {…}` called as
+ *    `grep(req.query.t)`, a class method called as `svc.run(req.body.c)`,
+ *    a class constructed with `new C(req.query.u)`, or a function handed to
+ *    an executor that runs it (`pool.submit(fn, q)`). A bare call never
+ *    feeds a class method and a call through a receiver never feeds a
+ *    module function. Arguments passed through a sanitizer do not count,
+ *    and `external_taint_escape` stays gated.
  *
  * Only flows are gated; the source list is untouched, so passes and
  * consumers that read `taint.sources` (cross-file resolution, co-occurrence

package/dist/analysis/passes/param-source-flow-gate-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"param-source-flow-gate-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/param-source-flow-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E,OAAO,KAAK,EAAE,UAAU,EAAiB,MAAM,sBAAsB,CAAC;AAEtE,MAAM,WAAW,yBAAyB;IACxC,8DAA8D;IAC9D,OAAO,EAAE,OAAO,CAAC;IACjB,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AA2CD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAOjG;AAED,qBAAa,uBAAwB,YAAW,YAAY,CAAC,yBAAyB,CAAC;IAIzE,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IAHlD,QAAQ,CAAC,IAAI,4BAA4B;IACzC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,YAA6B,qBAAqB,EAAE,OAAO,EAAI;IAE/D,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,yBAAyB,CA+C/C;CACF"}
+{"version":3,"file":"param-source-flow-gate-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/param-source-flow-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E,OAAO,KAAK,EAAE,UAAU,EAA8B,MAAM,sBAAsB,CAAC;AAEnF,MAAM,WAAW,yBAAyB;IACxC,8DAA8D;IAC9D,OAAO,EAAE,OAAO,CAAC;IACjB,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,8CAA8C;IAC9C,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AA2ED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAQjG;AA8HD,qBAAa,uBAAwB,YAAW,YAAY,CAAC,yBAAyB,CAAC;IAIzE,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IAHlD,QAAQ,CAAC,IAAI,4BAA4B;IACzC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,YAA6B,qBAAqB,EAAE,OAAO,EAAI;IAE/D,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,yBAAyB,CAwF/C;CACF"}

package/dist/analysis/passes/param-source-flow-gate-pass.js

@@ -27,6 +27,14 @@
  *    `@router.get(...)`, `@Get()`), Rust route attributes (`#[get("/<x>")]`)
  *    and Rust handlers returning a web response type (`HttpResponse`,
  *    `impl Responder`, `impl warp::Reply`, ...).
+ *  - A parameter that a real source in the same file feeds is kept
+ *    (cognium-dev #684): `function grep(t) {…}` called as
+ *    `grep(req.query.t)`, a class method called as `svc.run(req.body.c)`,
+ *    a class constructed with `new C(req.query.u)`, or a function handed to
+ *    an executor that runs it (`pool.submit(fn, q)`). A bare call never
+ *    feeds a class method and a call through a receiver never feeds a
+ *    module function. Arguments passed through a sanitizer do not count,
+ *    and `external_taint_escape` stays gated.
  *
  * Only flows are gated; the source list is untouched, so passes and
  * consumers that read `taint.sources` (cross-file resolution, co-occurrence
@@ -69,9 +77,48 @@ function rustAttributesAbove(lines, startLine) {
     }
     return out;
 }
+/**
+ * Well-known framework entry-point signatures (cognium-dev #685). Bare
+ * handler-shaped functions are not entry points in general: only these shapes
+ * are, and only on the signature, never on a file or fixture name.
+ *
+ *  - JS/TS AWS Lambda: a module-level `handler(event, context[, callback])`
+ *    that the module exports (`export`, `exports.handler = handler`,
+ *    `module.exports = { handler }`, `export { handler }`).
+ *  - Python AWS Lambda: a module-level `lambda_handler(event, context)`.
+ *
+ * `handler(event)`, `handle(req)`, `(a, b)`, a class method, and an
+ * allow-listed name that the module does not export are not matched.
+ */
+function isLambdaEntryPoint(method, language, lines) {
+    const names = method.parameters.map(p => p.name);
+    const first = lines[method.start_line - 1] ?? '';
+    // Module level only: a method or nested function is indented.
+    if (/^\s/.test(first))
+        return false;
+    if (language === 'python') {
+        return method.name === 'lambda_handler' && names.length === 2 && names[0] === 'event' && names[1] === 'context';
+    }
+    if (language !== 'javascript' && language !== 'typescript')
+        return false;
+    if (method.name !== 'handler')
+        return false;
+    if (names.length < 2 || names.length > 3 || names[0] !== 'event' || names[1] !== 'context')
+        return false;
+    if (names.length === 3 && names[2] !== 'callback')
+        return false;
+    if (/^export\s+(?:default\s+)?(?:async\s+)?(?:function\b|(?:const|let|var)\s+handler\b)/.test(first))
+        return true;
+    const text = lines.join('\n');
+    return /(?:^|[^\w$.])(?:module\s*\.\s*)?exports\s*\.\s*handler\s*=\s*handler(?![\w$])/.test(text) ||
+        /(?:^|[^\w$.])module\s*\.\s*exports\s*=\s*\{(?:[^}]*[,\s])?handler\s*[,}]|\bmodule\s*\.\s*exports\s*=\s*\{[^}]*\bhandler\s*:\s*handler\b/.test(text) ||
+        /(?:^|\n)\s*export\s*\{[^}]*\bhandler\b[^}]*\}/.test(text);
+}
 export function isFrameworkHandler(method, language, lines) {
     if (method.annotations.some(a => ROUTE_ANNOTATION.test(a)))
         return true;
+    if (isLambdaEntryPoint(method, language, lines))
+        return true;
     if (language === 'rust') {
         if (rustAttributesAbove(lines, method.start_line).some(a => RUST_ROUTE_ATTR.test(a)))
             return true;
@@ -80,6 +127,121 @@ export function isFrameworkHandler(method, language, lines) {
     }
     return false;
 }
+/** React function components that render `dangerouslySetInnerHTML` from a prop (cognium-dev #686). */
+const REACT_COMPONENT_NAME = /^[A-Z][A-Za-z0-9]*$/;
+function isReactHtmlComponent(m, f, lines) {
+    if (f.sink_type !== 'xss')
+        return false;
+    const sinkLine = lines[f.sink_line - 1] ?? '';
+    if (!sinkLine.includes('dangerouslySetInnerHTML'))
+        return false;
+    if (m.parameters.length !== 1 || !REACT_COMPONENT_NAME.test(m.name))
+        return false;
+    const sig = lines[m.start_line - 1] ?? '';
+    return /\bfunction\s+[A-Z][A-Za-z0-9]*\s*\(\s*\{/.test(sig);
+}
+/** Sources that stand for a constructor-injected field or a getter over one (#78). */
+const FIELD_CARRIED_SOURCE = /constructor-injected field|returns tainted field/;
+/**
+ * Calls that invoke a function passed to them with the arguments that follow
+ * it, keyed by method name. The value is how many of those arguments are not
+ * forwarded (`setTimeout(fn, delay, a)` passes only `a`). Executor and
+ * scheduler shapes only: `pool.submit(fn, q)`,
+ * `loop.run_in_executor(None, fn, q)`, `asyncio.to_thread(fn, q)`,
+ * `loop.call_soon(fn, q)`, `setImmediate(fn, q)`, `process.nextTick(fn, q)`.
+ */
+const EXECUTOR_CALLEES = new Map([
+    ['submit', 0], ['run_in_executor', 0], ['to_thread', 0], ['run_sync', 0],
+    ['call_soon', 0], ['call_soon_threadsafe', 0], ['call_later', 0], ['call_at', 0],
+    ['setImmediate', 0], ['nextTick', 0], ['queueMicrotask', 0],
+    ['setTimeout', 1], ['setInterval', 1],
+]);
+/** `name` as a whole identifier (names may contain `$`). */
+function identifierRe(name) {
+    return new RegExp(`(?:^|[^\\w$.])${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![\\w$])`);
+}
+function realFedParams(ctx, sources) {
+    const out = { params: new Set(), classes: new Set() };
+    const { graph } = ctx;
+    const seeds = new Set();
+    const allMethods = graph.ir.types.flatMap(t => t.methods);
+    // Variables a real source binds directly (`q = request.args.get("q")`),
+    // with the method that binds them: a `name` bound in one handler says
+    // nothing about a `name` local to another function. The Python DFG does
+    // not model every function body, so the binding is the fallback evidence.
+    const boundVars = new Map();
+    // Source reads written inline as an argument (`sink(request.args.get("q"))`),
+    // by line: the read's text as the source location names it.
+    const inlineReads = new Map();
+    for (const s of sources) {
+        if (s.type === 'interprocedural_param')
+            continue;
+        for (const d of graph.defsAtLine(s.line))
+            seeds.add(d.id);
+        if (s.variable) {
+            const where = boundVars.get(s.variable) ?? new Set();
+            where.add(enclosingMethod(allMethods, s.line));
+            boundVars.set(s.variable, where);
+        }
+        const read = /^([\w$.]+?)(?:\(\))? in /.exec(s.location ?? '')?.[1];
+        if (read && read.includes('.'))
+            inlineReads.set(s.line, [...(inlineReads.get(s.line) ?? []), read]);
+    }
+    const tainted = graph.propagateTaintedDefIds(seeds);
+    // Sanitizer calls by line, as the bare method name (`shlex.quote()` -> `quote`).
+    const sanitizerNames = new Map();
+    if (ctx.hasResult('sink-filter')) {
+        for (const sa of ctx.getResult('sink-filter').sanitizers) {
+            const name = /([\w$]+)\(?\)?$/.exec(sa.method)?.[1];
+            if (name)
+                sanitizerNames.set(sa.line, [...(sanitizerNames.get(sa.line) ?? []), name]);
+        }
+    }
+    const classNames = new Set(graph.ir.types.map(t => t.name));
+    const functionNames = new Set(graph.ir.types.flatMap(t => t.methods.map(m => m.name)));
+    for (const call of graph.ir.calls) {
+        const line = call.location.line;
+        const uses = graph.usesAtLine(line).filter(u => u.def_id !== null && tainted.has(u.def_id));
+        const reads = inlineReads.get(line) ?? [];
+        const sanitizersHere = sanitizerNames.get(line) ?? [];
+        const callMethod = enclosingMethod(allMethods, line);
+        const isFed = (expr, variable) => 
+        // An argument passed through a sanitizer is not the raw request value.
+        !sanitizersHere.some(n => expr.includes(`${n}(`)) && ((!!variable && !!boundVars.get(variable)?.has(callMethod)) ||
+            reads.some(r => expr.includes(r)) ||
+            // The argument's own identifiers, not those of a sibling argument.
+            uses.some(u => identifierRe(u.variable).test(expr)));
+        // A local function handed over by reference to a call that runs it
+        // receives the arguments that follow it (`pool.submit(render, q)`,
+        // `loop.run_in_executor(None, f, q)`). Only callees known to invoke their
+        // function argument count: `print(banner, name)` or
+        // `audit.record(banner, name)` only pass `banner` along.
+        const skipAfterCallback = EXECUTOR_CALLEES.get(call.method_name);
+        let callbackName = null;
+        let callbackPos = -1;
+        for (const arg of call.arguments) {
+            const expr = typeof arg.expression === 'string' ? arg.expression.trim() : '';
+            if (skipAfterCallback !== undefined && callbackName === null && functionNames.has(expr)) {
+                callbackName = expr;
+                callbackPos = arg.position;
+                continue;
+            }
+            if (!isFed(expr, arg.variable))
+                continue;
+            // `res.send(req.query.m)` is a call on another object; it feeds a
+            // class method named `send`, never a module-level `function send`.
+            out.params.add(`${call.receiver ? 'm' : 'f'}:${call.method_name}:${arg.position}`);
+            if (classNames.has(call.method_name))
+                out.classes.add(call.method_name);
+            if (callbackName !== null) {
+                const pos = arg.position - callbackPos - 1 - (skipAfterCallback ?? 0);
+                if (pos >= 0)
+                    out.params.add(`f:${callbackName}:${pos}`);
+            }
+        }
+    }
+    return out;
+}
 export class ParamSourceFlowGatePass {
     keepParamSourcedFlows;
     name = 'param-source-flow-gate';
@@ -114,13 +276,59 @@ export class ParamSourceFlowGatePass {
         // the surviving flow may cite the parameter while the evidence is the
         // real source. Those flows are kept.
         const realSourceLines = new Set();
-        if (ctx.hasResult('sink-filter')) {
-            const sources = ctx.getResult('sink-filter').sources;
+        const sources = ctx.hasResult('sink-filter') ? ctx.getResult('sink-filter').sources : [];
+        for (const s of sources) {
+            if (s.type !== 'interprocedural_param')
+                realSourceLines.add(s.line);
+        }
+        // Computed on first need: most files have no parameter-only flow.
+        let fed;
+        const fedByRealSource = (f, m) => {
+            // The CWE-668 escape fallback names no concrete sink; a fed parameter
+            // does not make it more than a hint, so it stays gated.
+            if (f.sink_type === 'external_taint_escape')
+                return false;
+            fed ??= realFedParams(ctx, sources);
+            if (fed.params.size === 0)
+                return false;
+            const owner = ctx.graph.ir.types.find(t => t.methods.includes(m));
+            // A constructor is invoked through its class name (`new C(…)`, `C(…)`).
+            const isCtor = (m.name === 'constructor' || m.name === '__init__') && !!owner;
+            const callee = isCtor && owner ? owner.name : m.name;
+            // A module-level function or a constructor is called without a
+            // receiver; a class method is reached through one (`svc.run(x)`). Each
+            // matches its own call shape only: a bare `send(req.query.m)` does not
+            // run `Mailer.prototype.send`, and `res.send(…)` does not run a
+            // module-level `function send`.
+            const viaReceiver = !isCtor && !!owner && owner.name !== '<module>';
+            const feeds = (pos) => fed.params.has(`${viaReceiver ? 'm' : 'f'}:${callee}:${pos}`);
+            // When the flow's first step names a parameter, only that parameter
+            // counts: every parameter shares the signature line, and `f(a, b)`
+            // called as `f(req.query.a, 'x')` does not feed `b`.
+            const head = f.path[0]?.variable;
+            const named = m.parameters.findIndex(p => p.name === head);
+            if (named >= 0)
+                return feeds(named);
             for (const s of sources) {
-                if (s.type !== 'interprocedural_param')
-                    realSourceLines.add(s.line);
+                if (s.line !== f.source_line || s.type !== 'interprocedural_param')
+                    continue;
+                if (FIELD_CARRIED_SOURCE.test(s.location ?? '')) {
+                    if (owner && fed.classes.has(owner.name))
+                        return true;
+                    continue;
+                }
+                // The source names its parameter in `variable` (Java / C#) or in its
+                // location, `<type> <name> in <method>` (taint-matcher).
+                const pos = m.parameters.findIndex(p => s.variable
+                    ? p.name === s.variable
+                    : (s.location ?? '').endsWith(` ${p.name} in ${m.name}`));
+                if (pos < 0)
+                    continue;
+                if (feeds(pos))
+                    return true;
             }
-        }
+            return false;
+        };
         // In-place filter: `additionalFlows` is the list the analyzer assigns to
         // `taint.flows` after the pipeline.
         let w = 0;
@@ -128,7 +336,7 @@ export class ParamSourceFlowGatePass {
             let keep = true;
             if (f.source_type === 'interprocedural_param' && !realSourceLines.has(f.source_line)) {
                 const m = enclosingMethod(methods, f.source_line);
-                keep = m !== undefined && isHandler(m);
+                keep = m !== undefined && (isHandler(m) || fedByRealSource(f, m) || isReactHtmlComponent(m, f, lines));
             }
             if (keep)
                 flows[w++] = f;

package/dist/analysis/passes/param-source-flow-gate-pass.js.map

@@ -1 +1 @@
-{"version":3,"file":"param-source-flow-gate-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/param-source-flow-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAgBH,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,gBAAgB,GACpB,mMAAmM,CAAC;AAEtM,gEAAgE;AAChE,MAAM,eAAe,GACnB,iGAAiG,CAAC;AAEpG,0DAA0D;AAC1D,MAAM,mBAAmB,GACvB,wEAAwE,CAAC;AAE3E,SAAS,eAAe,CAAC,OAAqB,EAAE,IAAY;IAC1D,IAAI,IAA4B,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU;gBAAE,IAAI,GAAG,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qEAAqE;AACrE,SAAS,mBAAmB,CAAC,KAAe,EAAE,SAAiB;IAC7D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7C,MAAM;IACR,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAkB,EAAE,QAAgB,EAAE,KAAe;IACtF,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,IAAI,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAClG,IAAI,MAAM,CAAC,WAAW,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,uBAAuB;IAIL,qBAAqB;IAHzC,IAAI,GAAG,wBAAwB,CAAC;IAChC,QAAQ,GAAG,UAAmB,CAAC;IAExC,YAA6B,qBAA8B;qCAA9B,qBAAqB;IAAY,CAAC;IAE/D,GAAG,CAAC,GAAgB;QAClB,MAAM,MAAM,GAA8B,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC;QAChG,IAAI,IAAI,CAAC,qBAAqB,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,MAAM,CAAC;QACpF,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC;YAAE,OAAO,MAAM,CAAC;QACrD,MAAM,KAAK,GAAoB,GAAG,CAAC,SAAS,CAA4B,iBAAiB,CAAC,CAAC,eAAe,CAAC;QAC3G,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QAEtC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;QACpD,MAAM,SAAS,GAAG,CAAC,CAAa,EAAW,EAAE;YAC3C,IAAI,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YAChG,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;QAEF,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,qCAAqC;QACrC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAC1C,IAAI,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC,OAAO,CAAC;YACvE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,IAAI,KAAK,uBAAuB;oBAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,oCAAoC;QACpC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,IAAI,GAAG,IAAI,CAAC;YAChB,IAAI,CAAC,CAAC,WAAW,KAAK,uBAAuB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrF,MAAM,CAAC,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;gBAClD,IAAI,GAAG,CAAC,KAAK,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,IAAI;gBAAE,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;iBACpB,CAAC;gBACJ,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACjB,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
+{"version":3,"file":"param-source-flow-gate-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/param-source-flow-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAgBH,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,gBAAgB,GACpB,mMAAmM,CAAC;AAEtM,gEAAgE;AAChE,MAAM,eAAe,GACnB,iGAAiG,CAAC;AAEpG,0DAA0D;AAC1D,MAAM,mBAAmB,GACvB,wEAAwE,CAAC;AAE3E,SAAS,eAAe,CAAC,OAAqB,EAAE,IAAY;IAC1D,IAAI,IAA4B,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC/C,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU;gBAAE,IAAI,GAAG,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qEAAqE;AACrE,SAAS,mBAAmB,CAAC,KAAe,EAAE,SAAiB;IAC7D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAClD,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7C,MAAM;IACR,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,kBAAkB,CAAC,MAAkB,EAAE,QAAgB,EAAE,KAAe;IAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,8DAA8D;IAC9D,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,IAAI,KAAK,gBAAgB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;IAClH,CAAC;IACD,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY;QAAE,OAAO,KAAK,CAAC;IACzE,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzG,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAChE,IAAI,oFAAoF,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClH,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,+EAA+E,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/F,yIAAyI,CAAC,IAAI,CAAC,IAAI,CAAC;QACpJ,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAkB,EAAE,QAAgB,EAAE,KAAe;IACtF,IAAI,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,IAAI,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAClG,IAAI,MAAM,CAAC,WAAW,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sGAAsG;AACtG,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAEnD,SAAS,oBAAoB,CAAC,CAAa,EAAE,CAAgB,EAAE,KAAe;IAC5E,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAClF,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,OAAO,0CAA0C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,sFAAsF;AACtF,MAAM,oBAAoB,GAAG,kDAAkD,CAAC;AAchF;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAgC,IAAI,GAAG,CAAC;IAC5D,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;IACxE,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;IAChF,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC3D,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;CACtC,CAAC,CAAC;AAEH,4DAA4D;AAC5D,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,IAAI,MAAM,CAAC,iBAAiB,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,aAAa,CAAC,GAAgB,EAAE,OAAsB;IAC7D,MAAM,GAAG,GAAkB,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IACrE,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,UAAU,GAAG,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1D,wEAAwE;IACxE,sEAAsE;IACtE,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAuC,CAAC;IACjE,8EAA8E;IAC9E,4DAA4D;IAC5D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAoB,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,IAAI,KAAK,uBAAuB;YAAE,SAAS;QACjD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,EAA0B,CAAC;YAC7E,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/C,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,IAAI,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpE,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACpD,iFAAiF;IACjF,MAAM,cAAc,GAAG,IAAI,GAAG,EAAoB,CAAC;IACnD,IAAI,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC,UAAU,EAAE,CAAC;YAC3E,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACpD,IAAI,IAAI;gBAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvF,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5F,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,cAAc,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,QAAmC,EAAW,EAAE;QAC3E,uEAAuE;QACvE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CACrD,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACjC,mEAAmE;YACnE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACvD,mEAAmE;QACnE,mEAAmE;QACnE,0EAA0E;QAC1E,oDAAoD;QACpD,yDAAyD;QACzD,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjE,IAAI,YAAY,GAAkB,IAAI,CAAC;QACvC,IAAI,WAAW,GAAG,CAAC,CAAC,CAAC;QACrB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,IAAI,iBAAiB,KAAK,SAAS,IAAI,YAAY,KAAK,IAAI,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxF,YAAY,GAAG,IAAI,CAAC;gBACpB,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC;gBAC3B,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACzC,kEAAkE;YAClE,mEAAmE;YACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnF,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;gBAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACxE,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,GAAG,WAAW,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,CAAC,CAAC;gBACtE,IAAI,GAAG,IAAI,CAAC;oBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,YAAY,IAAI,GAAG,EAAE,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,uBAAuB;IAIL,qBAAqB;IAHzC,IAAI,GAAG,wBAAwB,CAAC;IAChC,QAAQ,GAAG,UAAmB,CAAC;IAExC,YAA6B,qBAA8B;qCAA9B,qBAAqB;IAAY,CAAC;IAE/D,GAAG,CAAC,GAAgB;QAClB,MAAM,MAAM,GAA8B,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,iBAAiB,EAAE,EAAE,EAAE,CAAC;QAChG,IAAI,IAAI,CAAC,qBAAqB,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,MAAM,CAAC;QACpF,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC;YAAE,OAAO,MAAM,CAAC;QACrD,MAAM,KAAK,GAAoB,GAAG,CAAC,SAAS,CAA4B,iBAAiB,CAAC,CAAC,eAAe,CAAC;QAC3G,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC;QAEtC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;QACpD,MAAM,SAAS,GAAG,CAAC,CAAa,EAAW,EAAE;YAC3C,IAAI,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBAAC,CAAC,GAAG,kBAAkB,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAAC,CAAC;YAChG,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;QAEF,0EAA0E;QAC1E,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,qCAAqC;QACrC,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3G,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,IAAI,KAAK,uBAAuB;gBAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtE,CAAC;QAED,kEAAkE;QAClE,IAAI,GAA8B,CAAC;QACnC,MAAM,eAAe,GAAG,CAAC,CAAgB,EAAE,CAAa,EAAW,EAAE;YACnE,sEAAsE;YACtE,wDAAwD;YACxD,IAAI,CAAC,CAAC,SAAS,KAAK,uBAAuB;gBAAE,OAAO,KAAK,CAAC;YAC1D,GAAG,KAAK,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACpC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACxC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAClE,wEAAwE;YACxE,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;YAC9E,MAAM,MAAM,GAAG,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACrD,+DAA+D;YAC/D,uEAAuE;YACvE,uEAAuE;YACvE,gEAAgE;YAChE,gCAAgC;YAChC,MAAM,WAAW,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;YACpE,MAAM,KAAK,GAAG,CAAC,GAAW,EAAW,EAAE,CACrC,GAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;YACjE,oEAAoE;YACpE,mEAAmE;YACnE,qDAAqD;YACrD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;YACjC,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;YAC3D,IAAI,KAAK,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;YACpC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,uBAAuB;oBAAE,SAAS;gBAC7E,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;oBAChD,IAAI,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;wBAAE,OAAO,IAAI,CAAC;oBACtD,SAAS;gBACX,CAAC;gBACD,qEAAqE;gBACrE,yDAAyD;gBACzD,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ;oBAChD,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ;oBACvB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC5D,IAAI,GAAG,GAAG,CAAC;oBAAE,SAAS;gBACtB,IAAI,KAAK,CAAC,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC;YAC9B,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,yEAAyE;QACzE,oCAAoC;QACpC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,IAAI,GAAG,IAAI,CAAC;YAChB,IAAI,CAAC,CAAC,WAAW,KAAK,uBAAuB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;gBACrF,MAAM,CAAC,GAAG,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;gBAClD,IAAI,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,oBAAoB,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YACzG,CAAC;YACD,IAAI,IAAI;gBAAE,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;iBACpB,CAAC;gBACJ,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACjB,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/analysis/passes/plaintext-password-storage-pass.d.ts

@@ -26,6 +26,12 @@
  * (see _credential-helpers `isHashFunctionCall`) and consumes the
  * credential identifier, suppress.
  *
+ * Python owner-only destinations (#672): a write whose file handle was obtained
+ * from `os.open(path, flags, <owner-only mode>)` (directly or via `os.fdopen` /
+ * `open(fd)`), or from a path/handle that an earlier `os.chmod` / `os.fchmod`
+ * restricted to the owner (no group/other bits), is not reported — the secret
+ * stays in a file only its owner can read.
+ *
  * This is intentionally lightweight (no full DFG); FP risk skewed toward
  * recall loss for cross-function hashing (controller → service.hash →
  * repo.store), which is acceptable for v1.

package/dist/analysis/passes/plaintext-password-storage-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plaintext-password-storage-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/plaintext-password-storage-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAc9E,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;CACJ;AAsED,qBAAa,4BACX,YAAW,YAAY,CAAC,8BAA8B,CAAC;IAEvD,QAAQ,CAAC,IAAI,gCAAgC;IAC7C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,8BAA8B,CAiEpD;CACF"}
+{"version":3,"file":"plaintext-password-storage-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/plaintext-password-storage-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAc9E,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;CACJ;AAyMD,qBAAa,4BACX,YAAW,YAAY,CAAC,8BAA8B,CAAC;IAEvD,QAAQ,CAAC,IAAI,gCAAgC;IAC7C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,8BAA8B,CAwEpD;CACF"}

package/dist/analysis/passes/plaintext-password-storage-pass.js

@@ -26,6 +26,12 @@
  * (see _credential-helpers `isHashFunctionCall`) and consumes the
  * credential identifier, suppress.
  *
+ * Python owner-only destinations (#672): a write whose file handle was obtained
+ * from `os.open(path, flags, <owner-only mode>)` (directly or via `os.fdopen` /
+ * `open(fd)`), or from a path/handle that an earlier `os.chmod` / `os.fchmod`
+ * restricted to the owner (no group/other bits), is not reported — the secret
+ * stays in a file only its owner can read.
+ *
  * This is intentionally lightweight (no full DFG); FP risk skewed toward
  * recall loss for cross-function hashing (controller → service.hash →
  * repo.store), which is acceptable for v1.
@@ -92,6 +98,154 @@ function isWriteStorageCall(call, language) {
     }
     return null;
 }
+/** Parse a Python integer literal (`0o600`, `0600`, `384`, `0x180`) or `stat.S_I*` mask; null when unknown. */
+function pyModeValue(expr) {
+    const t = (expr ?? '').trim();
+    if (!t)
+        return null;
+    if (/^0[oO][0-7]+$/.test(t))
+        return parseInt(t.slice(2), 8);
+    if (/^0[0-7]+$/.test(t))
+        return parseInt(t, 8);
+    if (/^0[xX][0-9a-fA-F]+$/.test(t))
+        return parseInt(t.slice(2), 16);
+    if (/^\d+$/.test(t))
+        return parseInt(t, 10);
+    // stat.S_IRUSR | stat.S_IWUSR — owner bits only; any group/other constant is not owner-only.
+    const parts = t.split('|').map((x) => x.trim().replace(/^stat\./, ''));
+    const USR = { S_IRUSR: 0o400, S_IWUSR: 0o200, S_IXUSR: 0o100, S_IRWXU: 0o700 };
+    let v = 0;
+    for (const p of parts) {
+        if (p in USR)
+            v |= USR[p];
+        else if (/^S_I(?:R|W|X|RWX)(?:GRP|OTH|G|O)$/.test(p))
+            v |= 0o077;
+        else
+            return null;
+    }
+    return v;
+}
+/** True when `mode` grants nothing to group or other (and is not empty). */
+const isOwnerOnlyMode = (mode) => mode !== null && mode > 0 && (mode & 0o077) === 0;
+/** The `mode` argument of an `os.open` / `os.chmod` / `os.fchmod` call, owner-only? */
+function callSetsOwnerOnlyMode(call) {
+    const recv = call.receiver ?? '';
+    if (recv !== 'os')
+        return false;
+    const pos = call.method_name === 'open' ? 2 : call.method_name === 'chmod' || call.method_name === 'fchmod' ? 1 : -1;
+    if (pos < 0)
+        return false;
+    const arg = call.arguments.find((a) => a.position === pos);
+    return isOwnerOnlyMode(pyModeValue(arg?.literal ?? arg?.expression));
+}
+const IDENT = /^[A-Za-z_]\w*$/;
+const firstArg = (c) => (c.arguments.find((a) => a.position === 0)?.expression ?? '').trim();
+/**
+ * Python: was the file handle that `write` is called on created/opened with
+ * owner-only permissions? Resolved from the handle's binding line
+ * (`with <expr> as h`, `h = <expr>`), the calls on that line, and — for a
+ * descriptor — the line that bound it.
+ */
+function pyWriteTargetsOwnerOnlyFile(call, scopeCalls, lines) {
+    const receiver = (call.receiver ?? '').trim();
+    const before = scopeCalls.filter((c) => c.location.line < call.location.line);
+    const callsOn = (line) => scopeCalls.filter((c) => c.location.line === line);
+    const bindingLine = (name, from) => {
+        const esc = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const re = new RegExp(`(?:\\bas\\s+${esc}\\b|^\\s*${esc}\\s*=(?!=))`);
+        // `with <expr> as name: name.write(...)` — binding and use on one line.
+        if (new RegExp(`\\bas\\s+${esc}\\s*:`).test(lines[from - 1] ?? ''))
+            return from;
+        for (let ln = from - 1; ln >= 1; ln--) {
+            if (re.test(lines[ln - 1] ?? ''))
+                return ln;
+        }
+        return null;
+    };
+    // Column range of the expression that initializes `name` on `line`:
+    // the `with` item before `as name` (items split at top-level commas), or the
+    // right-hand side of `name = ...`. Calls elsewhere on the line belong to
+    // other handles and must not be attributed to this one.
+    const initializerSpan = (name, line) => {
+        const text = lines[line - 1] ?? '';
+        const esc = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        const asM = new RegExp(`\\bas\\s+${esc}\\b`).exec(text);
+        if (asM) {
+            const kw = /\bwith\b/.exec(text);
+            let start = kw ? kw.index + kw[0].length : 0;
+            let depthN = 0;
+            for (let i = asM.index - 1; i >= start; i--) {
+                const ch = text[i];
+                if (ch === ')' || ch === ']' || ch === '}')
+                    depthN++;
+                else if (ch === '(' || ch === '[' || ch === '{') {
+                    if (depthN === 0) {
+                        start = i + 1;
+                        break;
+                    }
+                    depthN--;
+                }
+                else if (ch === ',' && depthN === 0) {
+                    start = i + 1;
+                    break;
+                }
+            }
+            return [start, asM.index];
+        }
+        const eq = new RegExp(`^\\s*${esc}\\s*=(?!=)`).exec(text);
+        if (eq)
+            return [eq[0].length, text.length];
+        return [0, text.length];
+    };
+    // Does the expression evaluated on `line` (within `span`) yield an owner-only file/descriptor?
+    const ownerOnlyAt = (line, depth, span = [0, Infinity]) => {
+        const here = callsOn(line).filter((c) => c.location.column >= span[0] && c.location.column < span[1]);
+        if (here.some((c) => c.method_name === 'open' && callSetsOwnerOnlyMode(c)))
+            return true;
+        for (const c of here) {
+            // os.fdopen(fd, ...) / open(fd, ...) — follow a bare descriptor variable.
+            if ((c.method_name === 'fdopen' && c.receiver === 'os') || (c.method_name === 'open' && !c.receiver)) {
+                const a0 = firstArg(c);
+                if (IDENT.test(a0) && depth < 3) {
+                    const bl = bindingLine(a0, line);
+                    if (bl !== null && ownerOnlyAt(bl, depth + 1, initializerSpan(a0, bl)))
+                        return true;
+                }
+                // open(path, ...) — the LAST chmod of that same path expression before
+                // this open decides; a later permissive chmod widens it again.
+                if (c.method_name === 'open' && a0) {
+                    const chmods = before.filter((p) => p.location.line < line && p.receiver === 'os' && p.method_name === 'chmod' && firstArg(p) === a0);
+                    const last = chmods.reduce((acc, p) => !acc || p.location.line > acc.location.line ||
+                        (p.location.line === acc.location.line && p.location.column > acc.location.column) ? p : acc, null);
+                    if (last && callSetsOwnerOnlyMode(last))
+                        return true;
+                }
+            }
+        }
+        return false;
+    };
+    // Receiver is an inline expression: `os.fdopen(os.open(...), "w").write(x)`.
+    if (!receiver || !IDENT.test(receiver))
+        return ownerOnlyAt(call.location.line, 0);
+    // os.fchmod(<handle>.fileno() | <fd>, owner-only) before the write.
+    const bl = bindingLine(receiver, call.location.line);
+    if (before.some((c) => c.method_name === 'fchmod' && callSetsOwnerOnlyMode(c) &&
+        new RegExp(`\\b${receiver}\\b`).test(firstArg(c))))
+        return true;
+    if (bl === null)
+        return false;
+    // os.fchmod(fd, owner-only) on the bare descriptor this handle wraps.
+    const hSpan = initializerSpan(receiver, bl);
+    const handleCalls = callsOn(bl).filter((c) => c.location.column >= hSpan[0] && c.location.column < hSpan[1]);
+    for (const c of handleCalls) {
+        if ((c.method_name === 'fdopen' && c.receiver === 'os') || (c.method_name === 'open' && !c.receiver)) {
+            const a0 = firstArg(c);
+            if (IDENT.test(a0) && before.some((p) => p.method_name === 'fchmod' && callSetsOwnerOnlyMode(p) && firstArg(p) === a0))
+                return true;
+        }
+    }
+    return ownerOnlyAt(bl, 0, hSpan);
+}
 export class PlaintextPasswordStoragePass {
     name = 'plaintext-password-storage';
     category = 'security';
@@ -99,6 +253,7 @@ export class PlaintextPasswordStoragePass {
         const { graph, language } = ctx;
         const file = graph.ir.meta.file;
         const findings = [];
+        const codeLines = language === 'python' ? ctx.code.split('\n') : [];
         // Group calls by in_method for cheap prior-hash lookup.
         const callsByScope = new Map();
         for (const call of graph.ir.calls) {
@@ -128,6 +283,11 @@ export class PlaintextPasswordStoragePass {
             const prior = scopeCalls.filter((c) => c.location.line < call.location.line);
             if (priorHashOf(identifier, prior))
                 continue;
+            // Python: the write lands in a file only its owner can read (#672).
+            if (language === 'python' && spec.api.startsWith('<file>.') &&
+                pyWriteTargetsOwnerOnlyFile(call, scopeCalls, codeLines)) {
+                continue;
+            }
             // Suppress if the credArg expression itself contains a hash call
             // inline: `f.write(bcrypt.hashpw(pw))`.
             if (/\b(?:hashpw|hash|sha\d+|md5|bcrypt|argon2|pbkdf2|digest)\b/i

package/dist/analysis/passes/plaintext-password-storage-pass.js.map

@@ -1 +1 @@
-{"version":3,"file":"plaintext-password-storage-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/plaintext-password-storage-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH,OAAO,EACL,sBAAsB,EACtB,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAkBlC,SAAS,kBAAkB,CACzB,IAAc,EACd,QAAgB;IAEhB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAEzC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,qEAAqE;QACrE,sDAAsD;QACtD,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAClD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,MAAM,CAAC;YACxE,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,QAAQ,IAAI,MAAM,EAAE,EAAE,CAAC;QACtD,CAAC;QACD,IAAI,SAAS,KAAK,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;YAC3F,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,EAAE,CAAC;QAChD,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC3D,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACjD,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,eAAe;gBACpD,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,gBAAgB,CAAC,EAAE,CAAC;YAC7D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,MAAM,EAAE,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,SAAS,KAAK,cAAc,IAAI,SAAS,KAAK,gBAAgB,CAAC;YAChE,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,QAAQ,UAAU,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,SAAS,KAAK,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;YAC3F,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,EAAE,CAAC;QAChD,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,aAAa,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,EAAE,CAAC;QAChD,CAAC;QACD,oDAAoD;QACpD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,kEAAkE;YAClE,MAAM,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC1C,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1E,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,QAAQ,QAAQ,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,IAAI,MAAM,KAAK,WAAW;gBAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;QACzE,CAAC;QACD,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1D,IAAI,MAAM,KAAK,WAAW;gBAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC;QAC7E,CAAC;QACD,IAAI,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACnD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,4BAA4B;IAG9B,IAAI,GAAG,4BAA4B,CAAC;IACpC,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,QAAQ,GAA+C,EAAE,CAAC;QAEhE,wDAAwD;QACxD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAsB,CAAC;QACnD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC;YACxC,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACf,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,SAAS;YAEpB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC;YACxE,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;gBAAE,SAAS;YAE/C,0CAA0C;YAC1C,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACpD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;YAC5C,IAAI,CAAC,UAAU;gBAAE,SAAS;YAE1B,mEAAmE;YACnE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC;YACxC,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC7E,IAAI,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC;gBAAE,SAAS;YAE7C,iEAAiE;YACjE,wCAAwC;YACxC,IAAI,6DAA6D;iBAC1D,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;gBACtC,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;YAE7D,GAAG,CAAC,UAAU,CAAC;gBACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;gBAClC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,SAAS;gBAChB,OAAO,EACL,gBAAgB,UAAU,iCAAiC,IAAI,CAAC,GAAG,MAAM;oBACzE,uEAAuE;gBACzE,IAAI;gBACJ,IAAI;gBACJ,GAAG,EACD,kEAAkE;oBAClE,sCAAsC;gBACxC,QAAQ,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;CACF"}
+{"version":3,"file":"plaintext-password-storage-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/plaintext-password-storage-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAIH,OAAO,EACL,sBAAsB,EACtB,WAAW,GACZ,MAAM,0BAA0B,CAAC;AAkBlC,SAAS,kBAAkB,CACzB,IAAc,EACd,QAAgB;IAEhB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAEzC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,qEAAqE;QACrE,sDAAsD;QACtD,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAClD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC;QACjD,CAAC;QACD,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,MAAM,CAAC;YACxE,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,CAAC,EAAE,CAAC;YAC9C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,QAAQ,IAAI,MAAM,EAAE,EAAE,CAAC;QACtD,CAAC;QACD,IAAI,SAAS,KAAK,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;YAC3F,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,EAAE,CAAC;QAChD,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC3D,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACjD,CAAC,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,eAAe;gBACpD,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,gBAAgB,CAAC,EAAE,CAAC;YAC7D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,MAAM,EAAE,EAAE,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,SAAS,KAAK,cAAc,IAAI,SAAS,KAAK,gBAAgB,CAAC;YAChE,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,QAAQ,UAAU,EAAE,CAAC;QACpD,CAAC;QACD,IAAI,SAAS,KAAK,OAAO,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;YAC3F,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,EAAE,CAAC;QAChD,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,aAAa,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,MAAM,EAAE,EAAE,CAAC;QAChD,CAAC;QACD,oDAAoD;QACpD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,kEAAkE;YAClE,MAAM,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC1C,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1E,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,QAAQ,QAAQ,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,IAAI,MAAM,KAAK,WAAW;gBAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;QACzE,CAAC;QACD,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1D,IAAI,MAAM,KAAK,WAAW;gBAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC;QAC7E,CAAC;QACD,IAAI,MAAM,KAAK,aAAa,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACnD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC;QACjD,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+GAA+G;AAC/G,SAAS,WAAW,CAAC,IAA+B;IAClD,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5D,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/C,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,6FAA6F;IAC7F,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,GAAG,GAA2B,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACvG,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG;YAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAE,CAAC;aACtB,IAAI,mCAAmC,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,CAAC,IAAI,KAAK,CAAC;;YAC5D,OAAO,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,4EAA4E;AAC5E,MAAM,eAAe,GAAG,CAAC,IAAmB,EAAW,EAAE,CACvD,IAAI,KAAK,IAAI,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;AAEpD,uFAAuF;AACvF,SAAS,qBAAqB,CAAC,IAAc;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACjC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,KAAK,OAAO,IAAI,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrH,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC;IAC3D,OAAO,eAAe,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAC/B,MAAM,QAAQ,GAAG,CAAC,CAAW,EAAU,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAE/G;;;;;GAKG;AACH,SAAS,2BAA2B,CAAC,IAAc,EAAE,UAAsB,EAAE,KAAe;IAC1F,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACrF,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,IAAY,EAAiB,EAAE;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,eAAe,GAAG,YAAY,GAAG,aAAa,CAAC,CAAC;QACtE,wEAAwE;QACxE,IAAI,IAAI,MAAM,CAAC,YAAY,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QAChF,KAAK,IAAI,EAAE,GAAG,IAAI,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC;YACtC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBAAE,OAAO,EAAE,CAAC;QAC9C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,oEAAoE;IACpE,6EAA6E;IAC7E,yEAAyE;IACzE,wDAAwD;IACxD,MAAM,eAAe,GAAG,CAAC,IAAY,EAAE,IAAY,EAAoB,EAAE;QACvE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,KAAK,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;gBACpB,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;oBAAE,MAAM,EAAE,CAAC;qBAChD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;oBAChD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;wBAAC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;wBAAC,MAAM;oBAAC,CAAC;oBAC3C,MAAM,EAAE,CAAC;gBACX,CAAC;qBAAM,IAAI,EAAE,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;oBAAC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;oBAAC,MAAM;gBAAC,CAAC;YAClE,CAAC;YACD,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,QAAQ,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,EAAE;YAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC;IAEF,+FAA+F;IAC/F,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,IAAI,GAAqB,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAW,EAAE;QACnG,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACtG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,qBAAqB,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACxF,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,0EAA0E;YAC1E,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrG,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACvB,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;oBAChC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;oBACjC,IAAI,EAAE,KAAK,IAAI,IAAI,WAAW,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,EAAE,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACtF,CAAC;gBACD,uEAAuE;gBACvE,+DAA+D;gBAC/D,IAAI,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC;oBACnC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,CAAC,WAAW,KAAK,OAAO,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;oBACtI,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAkB,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CACrD,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI;wBAC3C,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;oBACtG,IAAI,IAAI,IAAI,qBAAqB,CAAC,IAAI,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACvD,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,6EAA6E;IAC7E,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAElF,oEAAoE;IACpE,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,qBAAqB,CAAC,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,MAAM,QAAQ,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9B,sEAAsE;IACtE,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7G,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrG,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,qBAAqB,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;QACtI,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,OAAO,4BAA4B;IAG9B,IAAI,GAAG,4BAA4B,CAAC;IACpC,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,QAAQ,GAA+C,EAAE,CAAC;QAChE,MAAM,SAAS,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEpE,wDAAwD;QACxD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAsB,CAAC;QACnD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC;YACxC,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACf,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,SAAS;YAEpB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC;YACxE,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;gBAAE,SAAS;YAE/C,0CAA0C;YAC1C,MAAM,SAAS,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YACpD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC;YAC5C,IAAI,CAAC,UAAU;gBAAE,SAAS;YAE1B,mEAAmE;YACnE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC;YACxC,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC7E,IAAI,WAAW,CAAC,UAAU,EAAE,KAAK,CAAC;gBAAE,SAAS;YAE7C,oEAAoE;YACpE,IAAI,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;gBACvD,2BAA2B,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC7D,SAAS;YACX,CAAC;YAED,iEAAiE;YACjE,wCAAwC;YACxC,IAAI,6DAA6D;iBAC1D,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC;gBACtC,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;YAE7D,GAAG,CAAC,UAAU,CAAC;gBACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;gBAClC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,SAAS;gBAChB,OAAO,EACL,gBAAgB,UAAU,iCAAiC,IAAI,CAAC,GAAG,MAAM;oBACzE,uEAAuE;gBACzE,IAAI;gBACJ,IAAI;gBACJ,GAAG,EACD,kEAAkE;oBAClE,sCAAsC;gBACxC,QAAQ,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE;aAClD,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;CACF"}

package/dist/analysis/passes/scan-secrets-pass.d.ts

@@ -8,7 +8,7 @@
  *
  *   1. Provider-specific regex patterns. ~18 high-confidence prefixes /
  *      shapes (AWS AKIA, GitHub `ghp_`/`gho_`/`ghs_`/`ghu_`/`ghr_`,
- *      GitLab `glpat-`, Stripe `sk_live_`/`rk_live_`/`pk_live_`/`sk_test_`/`rk_test_`, OpenAI `sk-`,
+ *      GitLab `glpat-`, Stripe `sk_live_`/`rk_live_`/`pk_live_`/`pk_test_`/`sk_test_`/`rk_test_`, OpenAI `sk-`,
  *      Anthropic `sk-ant-`, Slack `xox[baprs]-`, Google `AIza`, JWT `eyJ..eyJ..`,
  *      PEM private keys, npm `npm_`). Each match emits a finding with
  *      `rule_id: 'hardcoded-credential'` (matches the legacy Bash

package/dist/analysis/passes/scan-secrets-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scan-secrets-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/scan-secrets-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AA+nB9E,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,eAAgB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IACzE,QAAQ,CAAC,IAAI,kBAAkB;IAC/B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB,CA+N3C;IAED,mEAAmE;IACnE,OAAO,CAAC,WAAW;IAanB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,iBAAiB;CAO1B"}
+{"version":3,"file":"scan-secrets-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/scan-secrets-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqoB9E,MAAM,WAAW,qBAAqB;IACpC,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,eAAgB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IACzE,QAAQ,CAAC,IAAI,kBAAkB;IAC/B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB,CA+N3C;IAED,mEAAmE;IACnE,OAAO,CAAC,WAAW;IAanB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,iBAAiB;CAO1B"}

package/dist/analysis/passes/scan-secrets-pass.js

@@ -8,7 +8,7 @@
  *
  *   1. Provider-specific regex patterns. ~18 high-confidence prefixes /
  *      shapes (AWS AKIA, GitHub `ghp_`/`gho_`/`ghs_`/`ghu_`/`ghr_`,
- *      GitLab `glpat-`, Stripe `sk_live_`/`rk_live_`/`pk_live_`/`sk_test_`/`rk_test_`, OpenAI `sk-`,
+ *      GitLab `glpat-`, Stripe `sk_live_`/`rk_live_`/`pk_live_`/`pk_test_`/`sk_test_`/`rk_test_`, OpenAI `sk-`,
  *      Anthropic `sk-ant-`, Slack `xox[baprs]-`, Google `AIza`, JWT `eyJ..eyJ..`,
  *      PEM private keys, npm `npm_`). Each match emits a finding with
  *      `rule_id: 'hardcoded-credential'` (matches the legacy Bash
@@ -162,6 +162,12 @@ const PROVIDER_PATTERNS = [
         severity: 'low', level: 'note',
         fix: 'Publishable keys are not secret. Prefer loading them from configuration rather than a backend source file.',
     },
+    {
+        name: 'Stripe test publishable key',
+        regex: /\bpk_test_[A-Za-z0-9]{24,}\b/,
+        severity: 'low', level: 'note',
+        fix: 'Publishable keys are not secret. Prefer loading them from configuration rather than a backend source file.',
+    },
     // Test-mode secret and restricted keys still authorize the test account.
     // Same length floor as the live forms. Severity is high, not critical (#576).
     {