circle-ir 4.14.2 → 4.16.0

package/dist/analysis/passes/sink-filter-pass.js

@@ -15,12 +15,13 @@
  *
  * Depends on: taint-matcher, constant-propagation, language-sources
  */
-import { CSHARP_SANITIZER_RES, CSharpCredit } from './csharp-sanitizer-credit.js';
+import { CSHARP_SANITIZER_RES, CSharpCredit, csharpSanitizersFor } from './csharp-sanitizer-credit.js';
 import { JS_TAINTED_PATTERNS } from './language-sources-pass.js';
 import { LIBRARY_API_SURFACE_TAG } from '../library-api-surface-downgrade.js';
 import { isNonExecutableSourceLine } from '../non-executable-lines.js';
 import { sanitizerCoversSink } from '../sanitizer-index.js';
 import { identifierOutsideSanitizerCalls } from '../taint-propagation.js';
+import { parseJavaArrayAccessExpression } from '../java-array-element-keys.js';
 import { resolveIdentifierType, resolveCallReturnType, isArgvContainerType, } from '../arg-type-resolver.js';
 /** Escape regex metacharacters for safe pattern building. */
 function escapeReSf(s) {
@@ -60,10 +61,8 @@ const JS_LOG_INJECTION_SANITIZERS = [
     /\bstripCRLF\s*\(/,
     /\bremoveNewlines\s*\(/,
     /\bsanitizeLogValue\s*\(/,
-    // Inline CRLF-stripping regex literal: .replace(/[\r\n]/g, '')
-    /\.replace\(\s*\/\[\s*\\r\s*\\n\s*\]\/[gimsu]*\s*,\s*['"`]['"`]\s*\)/,
-    // Inline CRLF sequence: .replace(/\r\n/g, '')
-    /\.replace\(\s*\/\\r\\n\/[gimsu]*\s*,\s*['"`]['"`]\s*\)/,
+    // Inline CRLF-stripping regex literal: .replace(/[\r\n]/g, '') — global required
+    /\.replace\(\s*\/\[\s*\\r\s*\\n\s*\]\/[gimsu]*g[gimsu]*\s*,\s*['"`]['"`]\s*\)/,
 ];
 // ---------------------------------------------------------------------------
 // Stage 17 — Python ldap_injection (CWE-90) regex-strip wrapper recognition.
@@ -291,6 +290,60 @@ function argvFirstLiteralIsShell(lineText) {
         .toLowerCase();
     return SHELL_PROGRAMS.has(base);
 }
+/**
+ * cognium-dev#626 — does a same-file call of the wrapper method that contains
+ * the sink pass a shell argv (`Arrays.asList("/bin/sh", "-c", ...)`,
+ * `List.of("bash", ...)`, `new String[]{"sh", ...}`) at the position of its
+ * parameter `paramName`?
+ *
+ * Reuses the #351 literal test (`argvFirstLiteralIsShell`) on the caller's
+ * argument text, so the criterion is the same one the inline form already
+ * obeys. The wrapper is the method (name and parameter list) of the declaring
+ * type that contains the sink line. A call counts only when it has no receiver
+ * or a `this` receiver, sits in that same type, and passes the same number of
+ * arguments, so a call on another object, another class's method of the same
+ * name or another overload is ignored, and so is a call inside a nested type
+ * that declares its own method of that name and arity (it calls that one, not
+ * the wrapper; `enclosing_type` is unset on the default path, so the nested
+ * type is found by its line range). A parameter that is not found answers
+ * `false` and today's suppression stands.
+ */
+function sameFileCallerPassesShellArgv(paramName, methodName, sinkLine, types, calls) {
+    if (!methodName)
+        return false;
+    for (const t of types) {
+        const m = t.methods.find(mm => mm.name === methodName && sinkLine >= mm.start_line && sinkLine <= mm.end_line);
+        if (!m)
+            continue;
+        const pos = m.parameters.findIndex(p => p.name === paramName);
+        if (pos < 0)
+            return false;
+        return calls.some(c => {
+            if (c.method_name !== methodName)
+                return false;
+            if (c.receiver != null && c.receiver !== 'this')
+                return false;
+            if (c.location.line < t.start_line || c.location.line > t.end_line)
+                return false;
+            if (c.arguments.length !== m.parameters.length)
+                return false;
+            // A call inside a nested type that declares its own `methodName` of the
+            // same arity calls that method, not this wrapper (the outer type's line
+            // span covers the nested one). A nested call with no such method still
+            // resolves to the outer wrapper and counts.
+            const shadowed = types.some(u => u !== t &&
+                u.start_line >= t.start_line && u.end_line <= t.end_line &&
+                (u.start_line > t.start_line || u.end_line < t.end_line) &&
+                c.location.line >= u.start_line && c.location.line <= u.end_line &&
+                u.methods.some(um => um.name === methodName && um.parameters.length === c.arguments.length));
+            if (shadowed)
+                return false;
+            const expr = c.arguments[pos]?.expression;
+            return typeof expr === 'string' && argvFirstLiteralIsShell(`new ProcessBuilder(${expr}`);
+        });
+    }
+    return false;
+}
 // ---------------------------------------------------------------------------
 // Stage 12 — Java throw-statement FP suppression.
 // (cognium-dev #157 — Sprint 45)
@@ -464,6 +517,131 @@ const SERVER_SIGNAL_RE = /["']use server["']|\b(?:getServerSideProps|getStaticPr
 // interpolated, the destination host is not attacker-controlled. Matches a
 // backtick + scheme + a literal host run (no `${` before the first `/`).
 const FIXED_HOST_TEMPLATE_RE = /`https?:\/\/[^/${}\s`]+[/`]/;
+/** A bash URL word whose scheme and host are literal and closed by `/` (#495). */
+const BASH_FIXED_HOST_URL_RE = /^(?:https?|ftp):\/\/[A-Za-z0-9.-]+(?::\d+)?\//;
+/**
+ * True when the string literal that ended at `end` is the WHOLE initializer:
+ * the next code token is `;`, `,`, end of input, or (ASI) a token on a later
+ * line that cannot continue the expression. A same-line operator (`+`, `.`,
+ * `||` …) or a next-line `+` / `.` / `(` / `[` / template continuation means
+ * the literal is only the start of a larger expression, so it is not a
+ * constant. An optional TS `as const` / `as string` suffix is skipped (it may
+ * sit on the next line).
+ * (cognium-dev#680, #681)
+ */
+function literalEndsInitializer(code, end) {
+    let i = end;
+    let crossedNewline = false;
+    const asConst = /^\s+as\s+(?:const|string)\b/.exec(code.slice(i, i + 64));
+    if (asConst) {
+        i += asConst[0].length;
+        crossedNewline = asConst[0].includes('\n');
+    }
+    for (;;) {
+        while (i < code.length && /\s/.test(code[i])) {
+            if (code[i] === '\n')
+                crossedNewline = true;
+            i++;
+        }
+        if (code.startsWith('//', i)) {
+            const nl = code.indexOf('\n', i);
+            i = nl === -1 ? code.length : nl;
+        }
+        else if (code.startsWith('/*', i)) {
+            const close = code.indexOf('*/', i + 2);
+            if (close === -1)
+                return false;
+            if (code.slice(i, close).includes('\n'))
+                crossedNewline = true;
+            i = close + 2;
+        }
+        else
+            break;
+    }
+    if (i >= code.length)
+        return true;
+    const c = code[i];
+    if (c === ';' || c === ',')
+        return true;
+    // ASI: a following line that begins a new statement terminates the initializer.
+    // A line that starts with `as` / `satisfies` / `in` / `instanceof` continues it.
+    if (/^(?:as|satisfies|in|instanceof)(?![\w$])/.test(code.slice(i, i + 12)))
+        return false;
+    return crossedNewline && !/[-+*/%.?:|&<>=!~^(\[`]/.test(c);
+}
+/** Decode `\xNN` / `\uNNNN` / `\u{…}` JS string escapes; other escapes are kept verbatim. */
+function decodeJsHexEscapes(value) {
+    return value.replace(/\\(?:x([0-9a-fA-F]{2})|u([0-9a-fA-F]{4})|u\{([0-9a-fA-F]{1,6})\}|[\s\S])/g, (m, x, u4, ub) => {
+        const hex = x ?? u4 ?? ub;
+        if (hex === undefined)
+            return m;
+        const cp = parseInt(hex, 16);
+        return cp <= 0x10ffff ? String.fromCodePoint(cp) : m;
+    });
+}
+/**
+ * The value of `name` when it is bound exactly once in the file, by `const`,
+ * to a plain string literal (no interpolation) that is the whole initializer,
+ * and has no other `let` / `var` / `function` binding; otherwise null.
+ * (cognium-dev#681)
+ */
+function constStringLiteralValue(code, name) {
+    const esc = name.replace(/\$/g, '\\$');
+    const decl = new RegExp(`(?:^|[^\\w$.])const\\s+${esc}\\s*(?::\\s*string\\s*)?=\\s*(?:'((?:\\\\.|[^'\\\\\\n])*)'|"((?:\\\\.|[^"\\\\\\n])*)"|\`([^\`$\\\\]*)\`)`, 'g');
+    const decls = [...code.matchAll(decl)];
+    if (decls.length !== 1)
+        return null;
+    if (!literalEndsInitializer(code, decls[0].index + decls[0][0].length))
+        return null;
+    const anyBinding = new RegExp(`(?:^|[^\\w$.])(?:const|let|var|function)\\s+${esc}\\b`, 'g');
+    if ([...code.matchAll(anyBinding)].length !== 1)
+        return null;
+    return decodeJsHexEscapes(decls[0][1] ?? decls[0][2] ?? decls[0][3] ?? '');
+}
+/**
+ * The body of the template literal that is the first argument of the
+ * `new RegExp(` on `line` (1-indexed), or null. The literal may start on a
+ * following line, after whitespace or comments, as a formatter wraps a long
+ * constructor call; the `new RegExp(` itself must be on the sink line.
+ * (cognium-dev#717)
+ */
+function regExpTemplateArgument(code, lines, line) {
+    const text = lines[line - 1] ?? '';
+    let offset = 0;
+    for (let i = 0; i < line - 1; i++)
+        offset += lines[i].length + 1;
+    const argument = /^(?:\s|\/\/[^\n]*(?:\n|$)|\/\*[\s\S]*?\*\/)*`((?:\\.|[^`\\])*)`(?=\s*[,)])/;
+    for (const start of text.matchAll(/new\s+RegExp\s*\(/g)) {
+        // The literal must be the whole first argument: `` `…` + text `` is not constant.
+        const m = argument.exec(code.slice(offset + start.index + start[0].length));
+        if (m)
+            return m[1];
+    }
+    return null;
+}
+/** A group that holds an unbounded quantifier and is itself quantified: `(a+)+`, `(x*)*`, `(\w{2,})+`, `(a+){2,}`. */
+const NESTED_QUANTIFIER_RE = /\([^()]*(?:[+*]|\{\d+,\d*\})[^()]*\)\s*[+*{]/;
+/** A template literal that starts with `${IDENT}/` (cognium-dev#680). */
+const CONST_BASE_TEMPLATE_RE = /`\$\{\s*([A-Za-z_$][\w$]*)\s*\}\//g;
+/**
+ * True when `name` is bound exactly once in the file, by `const`, to a string
+ * literal http(s) origin with a literal host, and is never reassigned.
+ */
+function isConstLiteralOrigin(code, name) {
+    const esc = name.replace(/\$/g, '\\$');
+    const decl = new RegExp(`(?:^|[^\\w$.])(const|let|var)\\s+${esc}\\s*(?::\\s*string\\s*)?=\\s*(['"\`])(https?://[^/'"\`\\s$]+(?:/[^'"\`$]*)?)\\2`, 'gm');
+    const decls = [...code.matchAll(decl)];
+    if (decls.length !== 1 || decls[0][1] !== 'const')
+        return false;
+    if (!literalEndsInitializer(code, decls[0].index + decls[0][0].length))
+        return false;
+    const anyBinding = new RegExp(`(?:^|[^\\w$.])(?:const|let|var)\\s+${esc}\\b`, 'g');
+    if ([...code.matchAll(anyBinding)].length !== 1)
+        return false;
+    const reassign = new RegExp(`(?:^|[^\\w$.])${esc}\\s*(?:[-+]?=)(?!=)`, 'g');
+    const rest = code.slice(0, decls[0].index) + code.slice(decls[0].index + decls[0][0].length);
+    return !reassign.test(rest);
+}
 /**
  * Returns the 1-indexed line numbers that a Java `if (x.contains("..")) throw/
  * return` reject-guard makes path-traversal-safe (cognium-dev#269). A line is
@@ -604,8 +782,10 @@ function jsSsrfHostGuardedLines(code) {
     return covered;
 }
 /**
- * Is this `plugin_param` source a map read of a key that was never written, on
- * a map whose entire contents we can see? (cognium-dev#328 prerequisite.)
+ * Is this `plugin_param` source a map read that provably yields `null` or a
+ * string literal — a key that was never written, or any key of a literal-only
+ * map (#584) — on a map whose entire contents we can see? (cognium-dev#328
+ * prerequisite.)
  *
  * Sound only when the map's provenance is fully known, so all three hold:
  *
@@ -616,10 +796,11 @@ function jsSsrfHostGuardedLines(code) {
  *  (b) the receiver never escapes — it is not passed as an argument to any
  *      call. `helper(m)` could `put` into it out of sight, so once it escapes
  *      the contents are no longer knowable from this file.
- *  (c) the read key is a string literal with **no** `put` of that same literal
- *      anywhere in the file. A matching `put` keeps the source regardless of
- *      whether the stored value looks tainted — this gate only removes reads
- *      that provably yield `null`, never reads whose value it judged clean.
+ *  (c) the read key is a string literal. A matching `put` of that literal no
+ *      longer keeps the source automatically: when every put value is itself a
+ *      string literal (`isLiteralOnlyLocalMap`), the read is still dropped as
+ *      non-tainted (#584). This gate only removes reads that provably yield
+ *      `null` or a literal-only local map, never reads whose value is uncertain.
  *
  * Deliberately narrow: `plugin_param` only, literal keys only, and any
  * uncertainty leaves the source untouched. Non-literal keys (`m.get(k)`) are
@@ -650,12 +831,183 @@ function isUnwrittenLocalMapKeyRead(code, source) {
         if (escapeRe.test(stripped))
             return false;
     }
-    // (c2) was this literal key ever written?
+    // (c2) was this literal key ever written? If so, drop only a literal-only map.
     const putRe = new RegExp(`\\b${recv}\\s*\\.\\s*put\\s*\\(\\s*"${key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}"`);
     if (lines.some(l => putRe.test(l)))
+        return isLiteralOnlyLocalMap(lines, recv);
+    return true;
+}
+/**
+ * cognium-dev#584 (slice) — the map's whole contents are string literals.
+ *
+ * Every mutation of `recv` in the file is a `put(<key>, "<string literal>")`:
+ * no `put` of a non-literal value under any key (so no key-shuffle can place a
+ * tainted value under the key being read), and no bulk or computing mutator
+ * (`putAll`, `putIfAbsent`, `compute*`, `merge`, `replace*`) that could store
+ * a value out of sight. Combined with (a) local construction and (b) no escape
+ * in the caller, a read of such a map yields a literal and is not a source.
+ */
+function isLiteralOnlyLocalMap(lines, recv) {
+    const anyPut = new RegExp(`\\b${recv}\\s*\\.\\s*put\\s*\\(`, 'g');
+    const literalPut = new RegExp(`\\b${recv}\\s*\\.\\s*put\\s*\\(\\s*(?:"(?:[^"\\\\]|\\\\.)*"|[A-Za-z_][\\w.]*)\\s*,\\s*"(?:[^"\\\\]|\\\\.)*"\\s*\\)`, 'g');
+    const otherMutator = new RegExp(`\\b${recv}\\s*\\.\\s*(?:putAll|putIfAbsent|compute|computeIfAbsent|computeIfPresent|merge|replace|replaceAll|entrySet|values)\\s*\\(`);
+    let puts = 0;
+    let literalPuts = 0;
+    for (const l of lines) {
+        if (otherMutator.test(l))
+            return false;
+        puts += (l.match(anyPut) ?? []).length;
+        literalPuts += (l.match(literalPut) ?? []).length;
+    }
+    return puts > 0 && puts === literalPuts;
+}
+/**
+ * Is this C# `Content(...)` call the controller helper writing an HTML body
+ * (cognium-dev#580)?
+ *
+ *   - The helper is inherited (`ControllerBase.Content`, `PageModel.Content`),
+ *     so it is called unqualified or on `this` / `base`. `note.Content(q)` is
+ *     some other type's method.
+ *   - The content type is argument 1. A literal or `MediaTypeNames` constant
+ *     that is not HTML or a script-capable XML type serves the body as data. A computed content type is unknown and keeps the sink, as does the
+ *     one-argument overload.
+ */
+function csharpContentServesHtml(call) {
+    if (call.receiver !== null && call.receiver !== 'this' && call.receiver !== 'base')
         return false;
+    const contentType = call.arguments.find(a => a.position === 1)?.expression.trim();
+    if (contentType === undefined)
+        return true;
+    const literal = /^@?"([^"]*)"$/.exec(contentType);
+    // XML types (`text/xml`, `application/xml`, `image/svg+xml`, any `+xml`)
+    // render XHTML / SVG markup and run its scripts, so they count as HTML.
+    if (literal)
+        return /^\s*(?:text\/html|text\/xml|application\/xml|[\w.-]+\/[\w.-]+\+xml)\b/i.test(literal[1]);
+    const named = /^(?:System\s*\.\s*Net\s*\.\s*Mime\s*\.\s*)?MediaTypeNames\s*\.\s*(Text|Application)\s*\.\s*(\w+)$/.exec(contentType);
+    if (named)
+        return named[2] === 'Html' || named[2] === 'Xml';
     return true;
 }
+/**
+ * True when an unqualified / `this.` / `base.` call to `Content` sits in a type
+ * that can inherit the MVC helper (cognium-dev#580). The C# extractor does not
+ * record base lists, so they are read from the declaration text.
+ *   - a base named `Controller`, `ControllerBase` or `PageModel`: the helper;
+ *   - a `partial` class: the base may be in another part, so treat as unknown and keep;
+ *   - no base list, or only `I`-prefixed interface names: nothing is inherited,
+ *     so `Content(...)` is the type's own method;
+ *   - any other base: unknown, kept, unless the type declares its own `Content`
+ *     name, which hides an inherited one.
+ * Non-class IR kinds (and a missing owner) keep the sink. A controller that
+ * declares its own `Content` overload keeps the helper call.
+ */
+function csharpContentCallInheritsHelper(call, types, sourceLines) {
+    const line = call.location.line;
+    let owner;
+    for (const t of types) {
+        if (line < t.start_line || line > t.end_line)
+            continue;
+        if (!owner || t.end_line - t.start_line < owner.end_line - owner.start_line)
+            owner = t;
+    }
+    if (!owner || owner.kind !== 'class')
+        return true;
+    const header = sourceLines.slice(owner.start_line - 1, owner.start_line + 4).join(' ');
+    const decl = new RegExp(`\\bclass\\s+${owner.name}\\b(?:\\s*<[^>]*>)?\\s*(?::\\s*([^{]*?))?\\s*(?:where\\b[^{]*)?\\{`).exec(header);
+    if (!decl)
+        return true;
+    const bases = (decl[1] ?? '').split(',').map(b => b.trim().replace(/<.*$/, '').split('.').pop() ?? '').filter(Boolean);
+    if (bases.some(b => b === 'Controller' || b === 'ControllerBase' || b === 'PageModel'))
+        return true;
+    // Partial types may declare their base in another part of the type — unknown, keep.
+    const classAt = header.search(/\bclass\b/);
+    if (classAt >= 0 && /\bpartial\b/.test(header.slice(0, classAt)))
+        return true;
+    if (bases.every(b => /^I[A-Z]/.test(b)))
+        return false;
+    return !owner.methods.some(m => m.name === 'Content');
+}
+/**
+ * Does this Rust `.body(x)` call write a response whose builder chain declared
+ * a literal non-HTML content type (cognium-dev#478)? actix-web does not add a
+ * `Content-Type` of its own for `.body(...)`, so only an explicit
+ * `.content_type(<literal>)` earlier in the same chain proves the body is data:
+ *
+ *   - a string literal `type/subtype` that is not HTML, XHTML or a
+ *     script-capable XML type (`text/xml`, `application/xml`, any `+xml`);
+ *   - `ContentType::plaintext()` / `json()` / `octet_stream()` /
+ *     `form_url_encoded()` and the matching `mime::` constants.
+ *
+ * No content type, a computed one, `ContentType::html()` and every XML type
+ * keep the sink. When the chain sets the type more than once the last wins.
+ * Only a call made at the top level of the chain counts, so a nested
+ * `content_type(...)` inside an argument is never read as the response type.
+ */
+function rustBodyDeclaresNonHtmlType(call) {
+    const recv = call.receiver;
+    if (!recv)
+        return false;
+    let arg;
+    let depth = 0;
+    let quote = false;
+    for (let i = 0; i < recv.length; i++) {
+        const ch = recv[i];
+        if (quote) {
+            if (ch === '\\')
+                i++;
+            else if (ch === '"')
+                quote = false;
+            continue;
+        }
+        if (ch === '"') {
+            quote = true;
+            continue;
+        }
+        if (ch === '(' || ch === '[' || ch === '{') {
+            depth++;
+            continue;
+        }
+        if (ch === ')' || ch === ']' || ch === '}') {
+            depth--;
+            continue;
+        }
+        if (depth === 0 && recv.startsWith('.content_type(', i)) {
+            const start = i + '.content_type('.length;
+            let d = 1;
+            let q = false;
+            let j = start;
+            for (; j < recv.length && d > 0; j++) {
+                const c = recv[j];
+                if (q) {
+                    if (c === '\\')
+                        j++;
+                    else if (c === '"')
+                        q = false;
+                }
+                else if (c === '"')
+                    q = true;
+                else if (c === '(')
+                    d++;
+                else if (c === ')')
+                    d--;
+            }
+            arg = d === 0 ? recv.slice(start, j - 1).trim() : undefined;
+            i = j - 1;
+        }
+    }
+    if (arg === undefined)
+        return false;
+    const literal = /^"([^"]*)"$/.exec(arg);
+    if (literal) {
+        const type = literal[1];
+        if (!/^\s*[\w.-]+\/[\w.+-]+/.test(type))
+            return false;
+        return !/^\s*(?:text\/html|application\/xhtml\+xml|text\/xml|application\/xml|[\w.-]+\/[\w.-]+\+xml)\b/i.test(type);
+    }
+    if (/^(?:(?:actix_web\s*::\s*)?(?:http\s*::\s*header\s*::\s*)?)ContentType\s*::\s*(?:plaintext|json|octet_stream|form_url_encoded)\s*\(\s*\)$/.test(arg))
+        return true;
+    return /^(?:::)?mime\s*::\s*(?:TEXT_PLAIN|TEXT_PLAIN_UTF_8|APPLICATION_JSON|APPLICATION_OCTET_STREAM)$/.test(arg);
+}
 /**
  * Compute, per sink type, the set of C# variables whose value has passed through
  * a sanitizer for that type (cognium-dev C#/.NET Phase-1). Seeds from
@@ -669,6 +1021,7 @@ function csharpSanitizedVarsByType(code) {
     const lines = code.split('\n');
     const byType = new Map();
     const assignRe = /^\s*(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
+    const sanitizers = csharpSanitizersFor(code);
     for (const { type } of CSHARP_SANITIZER_RES) {
         if (!byType.has(type))
             byType.set(type, new Set());
@@ -679,7 +1032,7 @@ function csharpSanitizedVarsByType(code) {
         if (!m)
             continue;
         const [, lhs, rhs] = m;
-        for (const { re, type } of CSHARP_SANITIZER_RES) {
+        for (const { re, type } of sanitizers) {
             if (re.test(rhs))
                 byType.get(type).add(lhs);
         }
@@ -1039,13 +1392,26 @@ export class SinkFilterPass {
         // That is SecuriBench Micro `Collections6:47`, an `/* OK */` line. The
         // false positive is currently masked by the const-prop veto in #328, so
         // this gate is behaviour-neutral today; its purpose is to make lifting that
-        // veto safe, which is the sequencing chosen on #328.
+        // veto safe, which is the sequencing chosen on #328. #584 widened it: a read
+        // of a key that WAS put is also dropped when every value put on that local,
+        // non-escaping map is a string literal (`isLiteralOnlyLocalMap`).
         const sources = ctx.code
             ? executableSources.filter(s => !isUnwrittenLocalMapKeyRead(ctx.code, s))
             : executableSources;
         // Build merged sinks, deduplicating JS DOM sinks that may overlap with config sinks.
         const sinks = [...taintMatcher.sinks];
         for (const s of langSources.additionalSinks) {
+            const springReturn = s.type === 'xss' &&
+                typeof s.location === 'string' &&
+                s.location.startsWith('Spring handler returns HTML');
+            if (springReturn) {
+                const i = sinks.findIndex(x => x.line === s.line && x.type === 'xss');
+                if (i >= 0)
+                    sinks[i] = s;
+                else if (!sinks.some(x => x.line === s.line && x.cwe === s.cwe && x.type === s.type))
+                    sinks.push(s);
+                continue;
+            }
             if (!sinks.some(x => x.line === s.line && x.cwe === s.cwe && x.type === s.type)) {
                 sinks.push(s);
             }
@@ -1059,7 +1425,7 @@ export class SinkFilterPass {
         // Stage 2 — clean array elements
         filtered = filterCleanArraySinks(filtered, calls, constProp.taintedArrayElements, constProp.symbols);
         // Stage 3 — clean variables
-        filtered = filterCleanVariableSinks(filtered, calls, constProp.tainted, constProp.symbols, dfg, constProp.sanitizedVars, constProp.synchronizedLines, language);
+        filtered = filterCleanVariableSinks(filtered, calls, constProp.tainted, constProp.symbols, dfg, constProp.sanitizedVars, constProp.synchronizedLines, language, constProp.sanitizedVarUncovered);
         // Stage 4 — sanitized sinks. A sanitizer on one operand does not drop
         // the sink while another source operand is still raw (#641).
         filtered = filterSanitizedSinks(filtered, sanitizers, calls, sources);
@@ -1582,8 +1948,12 @@ export class SinkFilterPass {
                 // Bare identifier — parameter/field lookup.
                 if (varName !== '' && argExpr === varName && !/[(.]/.test(argExpr)) {
                     const t = resolveIdentifierType(varName, ctorCall.in_method, irTypes);
-                    if (isArgvContainerType(t))
+                    // cognium-dev#626: a `List<String>` PARAMETER is argv-form only while no
+                    // same-file caller hands it a shell argv (`/bin/sh -c <script>`): then
+                    // the tainted element is the script, so the suppression proves nothing.
+                    if (isArgvContainerType(t) && !sameFileCallerPassesShellArgv(varName, ctorCall.in_method, ctorCall.location.line, irTypes, irCalls)) {
                         return false;
+                    }
                 }
                 // Method call — return-type lookup. `variable` field carries the
                 // callee name for call-expression args.
@@ -2042,7 +2412,51 @@ export class SinkFilterPass {
                 if (sink.type !== 'ssrf')
                     return true;
                 const sinkLineText = sourceLines[sink.line - 1] ?? '';
-                return !FIXED_HOST_TEMPLATE_RE.test(sinkLineText);
+                if (FIXED_HOST_TEMPLATE_RE.test(sinkLineText))
+                    return false;
+                // `${API_BASE}/path` where API_BASE is bound once by `const` to a
+                // literal origin: the authority is constant and closed by `/` (#680).
+                for (const m of sinkLineText.matchAll(CONST_BASE_TEMPLATE_RE)) {
+                    if (isConstLiteralOrigin(ctx.code, m[1]))
+                        return false;
+                }
+                return true;
+            });
+        }
+        // Stage 15k — JS/TS redos: `new RegExp(`…${CONST}…`)` whose every
+        // interpolation is a module `const` bound to a string literal has a
+        // constant pattern; a tainted subject alone is not ReDoS. (cognium-dev#681)
+        if (['javascript', 'typescript'].includes(language)) {
+            const sourceLines = ctx.code.split('\n');
+            filtered = filtered.filter(sink => {
+                if (sink.type !== 'redos')
+                    return true;
+                const tpl = regExpTemplateArgument(ctx.code, sourceLines, sink.line);
+                if (tpl === null)
+                    return true;
+                let pattern = tpl;
+                let interpolations = 0;
+                let allConst = true;
+                // Replace each `${ NAME }` as written (whitespace inside the braces
+                // included) by the const's literal value.
+                pattern = pattern.replace(/\$\{([^}]*)\}/g, (_full, raw) => {
+                    interpolations++;
+                    const name = raw.trim();
+                    if (!/^[A-Za-z_$][\w$]*$/.test(name)) {
+                        allConst = false;
+                        return '';
+                    }
+                    const value = constStringLiteralValue(ctx.code, name);
+                    if (value === null) {
+                        allConst = false;
+                        return '';
+                    }
+                    return value;
+                });
+                if (interpolations === 0 || !allConst)
+                    return true;
+                // A constant pattern can still backtrack on a tainted subject.
+                return NESTED_QUANTIFIER_RE.test(pattern);
             });
         }
         // Stage 15f — JS/TS ssrf: anchored host allow-list reject-guard.
@@ -2118,6 +2532,50 @@ export class SinkFilterPass {
                 return !covered || credit.rawTaintReaches(sink.type, sink.line, sanitizedVars, csSeeds);
             });
         }
+        // Stage 15k' — C# `Content(body, contentType)` serves HTML only when the
+        // content type is HTML (cognium-dev#580). The `Content` xss sink stays when
+        // at least one `Content` call on its line is the controller helper with an
+        // HTML or unknown content type.
+        if (language === 'csharp') {
+            const csContentLines = ctx.code.split('\n');
+            filtered = filtered.filter(sink => {
+                if (sink.type !== 'xss' || sink.method !== 'Content')
+                    return true;
+                const contentCalls = callsByLine.get(sink.line)?.filter(c => c.method_name === 'Content') ?? [];
+                // The call must also sit in a type that can inherit the MVC helper (#580).
+                return contentCalls.length === 0 || contentCalls.some(c => csharpContentCallInheritsHelper(c, ctx.graph.ir.types, csContentLines) && csharpContentServesHtml(c));
+            });
+        }
+        // Stage 15k'' — Rust `.body(x)` with a literal non-HTML content type is
+        // data, not markup (cognium-dev#478). The xss sink stays unless every
+        // `body` call on its line sits on a chain that declared such a type.
+        if (language === 'rust') {
+            filtered = filtered.filter(sink => {
+                if (sink.type !== 'xss' || sink.method !== 'body')
+                    return true;
+                const bodyCalls = callsByLine.get(sink.line)?.filter(c => c.method_name === 'body') ?? [];
+                return bodyCalls.length === 0 || !bodyCalls.every(rustBodyDeclaresNonHtmlType);
+            });
+        }
+        // Stage 15m — bash ssrf: fixed-host URL word (cognium-dev#495, #669).
+        // The bash analogue of Stage 15i: `curl -- "https://api.example.com/${p}"`
+        // can only reach the literal host, whatever `$p` holds. Every word on the
+        // line that expands a variable must be such a URL; a word like `"$url"`,
+        // `"https://${host}/x"` or `"https://api.example.com${p}"` (no `/` to
+        // close the authority, so `$p` may be `@evil.com`) keeps the sink.
+        if (language === 'bash') {
+            const sourceLines = ctx.code.split('\n');
+            filtered = filtered.filter(sink => {
+                if (sink.type !== 'ssrf')
+                    return true;
+                const words = (sourceLines[sink.line - 1] ?? '').match(/"[^"]*"|'[^']*'|[^\s"']+/g) ?? [];
+                const expanding = words.filter(w => !w.startsWith("'") && w.includes('$'));
+                // Unquoted (`https://h/$p`), the expansion is word-split, so `$p`
+                // can add a second URL or a flag: only a double-quoted word counts.
+                return expanding.length === 0 ||
+                    !expanding.every(w => w.startsWith('"') && BASH_FIXED_HOST_URL_RE.test(w.slice(1, -1)));
+            });
+        }
         // Stage 15l — C# ssrf: HttpClient with a constant BaseAddress and a
         // relative request path. (cognium-dev#286 D)
         //
@@ -2779,14 +3237,13 @@ function filterCleanArraySinks(sinks, calls, taintedArrayElements, symbols) {
         const callsAtSink = callsByLine.get(sink.line) ?? [];
         for (const call of callsAtSink) {
             for (const arg of call.arguments) {
-                const arrayAccessMatch = arg.expression?.match(/^(\w+)\[(\d+|[^[\]]+)\]$/);
-                if (arrayAccessMatch) {
-                    const arrayName = arrayAccessMatch[1];
-                    let indexStr = arrayAccessMatch[2];
-                    indexStr = evaluateSimpleExpression(indexStr, symbols);
-                    const taintedIndices = taintedArrayElements.get(arrayName);
+                const arrayAccess = parseJavaArrayAccessExpression(arg.expression);
+                if (arrayAccess) {
+                    let indexKey = arrayAccess.indexKey;
+                    indexKey = evaluateSimpleExpression(indexKey, symbols);
+                    const taintedIndices = taintedArrayElements.get(arrayAccess.arrayName);
                     if (taintedIndices !== undefined) {
-                        const isTainted = taintedIndices.has(indexStr) || taintedIndices.has('*');
+                        const isTainted = taintedIndices.has(indexKey) || taintedIndices.has('*');
                         if (!isTainted)
                             return false;
                     }
@@ -2796,7 +3253,7 @@ function filterCleanArraySinks(sinks, calls, taintedArrayElements, symbols) {
         return true;
     });
 }
-export function filterCleanVariableSinks(sinks, calls, taintedVars, symbols, dfg, sanitizedVars, synchronizedLines, language) {
+export function filterCleanVariableSinks(sinks, calls, taintedVars, symbols, dfg, sanitizedVars, synchronizedLines, language, sanitizedVarUncovered) {
     const fieldNames = new Set();
     if (dfg) {
         for (const def of dfg.defs) {
@@ -2862,8 +3319,33 @@ export function filterCleanVariableSinks(sinks, calls, taintedVars, symbols, dfg
                             argClean = false;
                             break;
                         }
-                        if (sanitizedVars?.has(scopedName) || sanitizedVars?.has(varName))
-                            continue;
+                        // #589 review: when any `method:var` sanitizer exists, decide from
+                        // the scoped name only — do not treat a sibling method's encoder
+                        // (or its unscoped alias) as sanitizing this method's local.
+                        const suffix = `:${varName}`;
+                        let hasScopedSanitizer = false;
+                        if (sanitizedVars) {
+                            for (const s of sanitizedVars) {
+                                if (s !== varName && s.endsWith(suffix)) {
+                                    hasScopedSanitizer = true;
+                                    break;
+                                }
+                            }
+                        }
+                        const isSanitizedHere = sanitizedVars?.has(scopedName)
+                            || (!hasScopedSanitizer && !!sanitizedVars?.has(varName));
+                        if (isSanitizedHere) {
+                            // #589: a context-specific encoder (`escapeHtml`, `encodeForHTML`, …)
+                            // does not clean `trust_boundary`; that sink on the same
+                            // variable stays.
+                            const uncovered = hasScopedSanitizer
+                                ? sanitizedVarUncovered?.get(scopedName)
+                                : (sanitizedVarUncovered?.get(scopedName) ?? sanitizedVarUncovered?.get(varName));
+                            if (!uncovered || !uncovered.has(sink.type))
+                                continue;
+                            argClean = false;
+                            break;
+                        }
                         if (taintedVars.has(scopedName) || taintedVars.has(varName)) {
                             argClean = false;
                             break;