circle-ir 4.14.2 → 4.16.0

package/dist/analysis/passes/taint-propagation-pass.js

@@ -10,12 +10,16 @@
  *
  * Depends on: sink-filter, constant-propagation
  */
-import { identifierOutsideSanitizerCalls, propagateTaint } from '../taint-propagation.js';
+import { findJavaSpringReturnXSSSinks } from './language-sources-pass.js';
+import { expressionFullyWrappedBySanitizer, identifierOutsideSanitizerCalls, identifierOutsideSanitizerCallsInText, propagateTaint } from '../taint-propagation.js';
 import { isFalsePositive, isCorrelatedPredicateFP } from '../constant-propagation.js';
-import { buildJavaTaintedVars, buildPythonTaintedVars, buildRustTaintedVars, findPythonTrustBoundaryViolations, findPythonReturnXSSSinks } from './language-sources-pass.js';
+import { buildJavaTaintedVars, buildPythonTaintedVars, buildRustTaintedVars, findPythonTrustBoundaryViolations, findPythonReturnXSSSinks, findJavaWikiPluginReturnXSSSinks } from './language-sources-pass.js';
+import { parseJavaArrayAccessExpression } from '../java-array-element-keys.js';
 import { canSourceReachSink, sourceSemanticsAllowed } from '../findings.js';
 import { walkBackwardDefs } from '../dfg-walk.js';
 import { sanitizerCoversSink } from '../sanitizer-index.js';
+import { HTML_CONTEXT_ENCODER_METHODS } from '../constant-propagation/patterns.js';
+import { javaCanonicalStartsWithAllBare } from '../java-canonical-prefix.js';
 /**
  * cognium-dev#328 — the const-prop per-step veto, with two scoped exemptions.
  *
@@ -40,7 +44,352 @@ import { sanitizerCoversSink } from '../sanitizer-index.js';
  * code, resolved constant) are unaffected.
  */
 const CONTAINER_READ_SOURCES = new Set(['plugin_param', 'config_param']);
-function makeConstPropVeto(constProp, graph, sources, code, language) {
+/** Method name enclosing `line`, from IR type ranges; null when unknown. */
+function methodAtLine(graph, line) {
+    for (const t of graph.ir.types ?? []) {
+        for (const m of t.methods) {
+            if (line >= m.start_line && line <= m.end_line)
+                return m.name;
+        }
+    }
+    return null;
+}
+/** #589: method-call sanitizer that is a context-specific HTML / markup encoder. */
+function isHtmlContextEncoderSanitizer(san) {
+    if (san.type === 'derived_html_encoder')
+        return true; // same-file wrapper of an HTML encoder (#589)
+    if (san.type !== 'method_call' || !san.method)
+        return false;
+    const tail = san.method.replace(/\(\)$/, '').split('.').pop() ?? '';
+    return HTML_CONTEXT_ENCODER_METHODS.has(tail);
+}
+/**
+ * #589: true when some def-use chain from `startDefId` back to the flow's
+ * source reaches it without passing through a def that a covering sanitizer
+ * cleans. A def is covered when a sanitizer for `sinkType` sits on its line
+ * (at or after the source line) and none of its predecessor variables
+ * appears on that line outside the sanitizer call. Every def on the walk is
+ * tested, so a join one or more assignments before the sink is still seen.
+ * Unknown defs, chains that reach the source line raw, chains that end in a
+ * def with no predecessor, and an exhausted budget all count as uncovered.
+ */
+function hasUncoveredChain(startDefId, sinkType, sourceLine, graph, sanitizersByLine, codeLines) {
+    const visited = new Set();
+    let budget = 256;
+    const covered = (defId, line) => {
+        if (line < sourceLine)
+            return false;
+        const sans = (sanitizersByLine.get(line) ?? []).filter(s => sanitizerCoversSink(s, sinkType));
+        if (sans.length === 0)
+            return false;
+        const preds = graph.chainsByToDef.get(defId) ?? [];
+        if (preds.length === 0)
+            return true;
+        const def = graph.defById.get(defId);
+        const text = codeLines?.[line - 1];
+        let rhs = text;
+        if (text && def) {
+            const v = def.variable.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+            const m = new RegExp(`(?:^|[^\\w$.])${v}\\s*=(?!=)`).exec(text);
+            if (m)
+                rhs = text.slice(m.index + m[0].length);
+        }
+        for (const chain of preds) {
+            const predVar = graph.defById.get(chain.from_def)?.variable ?? chain.via;
+            const outside = rhs ? identifierOutsideSanitizerCallsInText(predVar, rhs, sans, sinkType) : null;
+            // No sanitizer call found in the text: fall back to the single-chain
+            // credit (one predecessor that the sanitizer line consumes).
+            if (outside === null) {
+                if (preds.length > 1)
+                    return false;
+                continue;
+            }
+            if (outside)
+                return false;
+        }
+        return true;
+    };
+    const stack = [startDefId];
+    while (stack.length > 0) {
+        if (--budget < 0)
+            return true;
+        const id = stack.pop();
+        if (visited.has(id))
+            continue;
+        visited.add(id);
+        const def = graph.defById.get(id);
+        if (!def)
+            return true;
+        if (covered(id, def.line))
+            continue;
+        if (def.line <= sourceLine)
+            return true;
+        const preds = graph.chainsByToDef.get(id) ?? [];
+        if (preds.length === 0)
+            return true;
+        for (const chain of preds)
+            stack.push(chain.from_def);
+    }
+    return false;
+}
+/**
+ * #515 — find the real source a Python derived variable actually references.
+ * Reads the derivation's right-hand side at its origin line (f-string braces
+ * kept, plain quotes and trailing `#…` comments dropped), picks the real
+ * source variables named there (earliest line wins when several), and follows
+ * names that are themselves derived — including a later assignment of a name
+ * that was also a real source. Returns undefined when nothing can be
+ * resolved, so the caller keeps its earliest-source fallback.
+ */
+/** Drop a trailing `#…` comment, leaving `#` inside string literals alone. */
+function stripPythonTrailingComment(text) {
+    let i = 0;
+    while (i < text.length) {
+        const ch = text[i];
+        if (ch === '"' || ch === "'") {
+            const triple = text.startsWith(ch.repeat(3), i);
+            const delim = triple ? ch.repeat(3) : ch;
+            i += delim.length;
+            while (i < text.length && !text.startsWith(delim, i)) {
+                if (text[i] === '\\') {
+                    i += 2;
+                    continue;
+                }
+                i++;
+            }
+            i += delim.length;
+            continue;
+        }
+        if (ch === '#')
+            return text.slice(0, i);
+        i++;
+    }
+    return text;
+}
+/**
+ * Keep only the f-string interpolation expression: cut before a top-level
+ * `!conversion` or `:format_spec` (Python replacement_field grammar). A `!`
+ * followed by `=` is the `!=` operator and is not a cut point. Depth
+ * tracks `()[]{}`; string literals are skipped so a `:` inside a subscript
+ * key does not truncate the expression.
+ */
+function pythonFStringNestedFields(body) {
+    // Format-spec / conversion tails only: a `{` here always opens a nested
+    // replacement field (Python 3.12+). Do NOT treat `{{` / `}}` as literal-brace
+    // escapes — `f"{label:{{fmt}}}"` parses as a nested FormattedValue whose
+    // expression is the set `{fmt}`. The top-level f-string skip stays in
+    // braceExprs so a literal `f"{{fmt}}"` still does not credit `fmt`. Each
+    // nested `{…}` is itself an expression (and may carry its own conversion /
+    // format-spec), so recurse through pythonFStringExprOnly.
+    let acc = '';
+    for (let j = 0; j < body.length;) {
+        if (body[j] === '{') {
+            j++;
+            let depth = 1;
+            let inner = '';
+            while (j < body.length && depth > 0) {
+                if (body[j] === '{')
+                    depth++;
+                else if (body[j] === '}') {
+                    depth--;
+                    if (depth === 0)
+                        break;
+                }
+                inner += body[j];
+                j++;
+            }
+            j++;
+            acc += ' ' + pythonFStringExprOnly(inner) + ' ';
+            continue;
+        }
+        j++;
+    }
+    return acc;
+}
+/**
+ * Keep the expression part of an f-string replacement field; drop literal
+ * conversion / format-spec text, but retain nested `{…}` fields from the
+ * discarded tail (format specs may contain nested replacement fields).
+ */
+function pythonFStringExprOnly(inner) {
+    let depth = 0;
+    let i = 0;
+    while (i < inner.length) {
+        const ch = inner[i];
+        if (ch === '"' || ch === "'") {
+            const triple = inner.startsWith(ch.repeat(3), i);
+            const delim = triple ? ch.repeat(3) : ch;
+            i += delim.length;
+            while (i < inner.length && !inner.startsWith(delim, i)) {
+                if (inner[i] === '\\') {
+                    i += 2;
+                    continue;
+                }
+                i++;
+            }
+            i += delim.length;
+            continue;
+        }
+        if (ch === '(' || ch === '[' || ch === '{') {
+            depth++;
+            i++;
+            continue;
+        }
+        if (ch === ')' || ch === ']' || ch === '}') {
+            depth--;
+            i++;
+            continue;
+        }
+        if (depth === 0 && ch === '!') {
+            // `!=` is the comparison operator, not a `!conversion`; keep scanning.
+            let j = i + 1;
+            while (j < inner.length && (inner[j] === ' ' || inner[j] === '\t'))
+                j++;
+            if (inner[j] === '=') {
+                i = j + 1;
+                continue;
+            }
+            const expr = inner.slice(0, i);
+            const nested = pythonFStringNestedFields(inner.slice(i + 1));
+            return nested ? expr + nested : expr;
+        }
+        if (depth === 0 && ch === ':') {
+            const expr = inner.slice(0, i);
+            const nested = pythonFStringNestedFields(inner.slice(i + 1));
+            return nested ? expr + nested : expr;
+        }
+        i++;
+    }
+    return inner;
+}
+function resolvePythonDerivedAnchor(varName, derived, realSourceByVar, codeLines, visiting) {
+    if (visiting.has(varName))
+        return undefined;
+    visiting.add(varName);
+    const originLine = derived.get(varName);
+    if (originLine === undefined)
+        return undefined;
+    const text = codeLines[originLine - 1];
+    if (!text)
+        return undefined;
+    const eq = text.search(/(?<![=!<>+\-*/%&|^:])=(?!=)/);
+    if (eq < 0)
+        return undefined;
+    // Drop a real trailing `#…` comment first (outside strings only), then lift
+    // f-string `{…}` names. Format specs / conversion flags are cut inside
+    // braceExprs so a `#` in `{width:#04x}` cannot eat later names, and `!s`
+    // cannot become a scanned identifier; nested `{…}` fields in the format
+    // spec (e.g. `{label:{fmt}}`) are kept.
+    const rhs = maskStringLiteralsForTokenScan(stripPythonTrailingComment(text.slice(eq + 1)));
+    let best;
+    for (const m of rhs.matchAll(/[A-Za-z_][A-Za-z0-9_]*/g)) {
+        const id = m[0];
+        if (id === varName)
+            continue;
+        const real = realSourceByVar.get(id);
+        const derivedLine = derived.get(id);
+        // A later assignment of the same name (recorded in `derived` after the
+        // real source line) is the value that flows — resolve it first. Fall
+        // back to the real source when that derivation does not resolve (e.g.
+        // `fmt = request.form.get("fmt")`, whose RHS names no source variable).
+        let cand;
+        if (derivedLine !== undefined && (!real || derivedLine > real.line)) {
+            cand = resolvePythonDerivedAnchor(id, derived, realSourceByVar, codeLines, visiting);
+        }
+        if (!cand)
+            cand = real;
+        if (cand && (!best || cand.line < best.line))
+            best = cand;
+    }
+    return best;
+}
+/** Drop a trailing `//…` comment, leaving `//` inside string literals alone. */
+function stripJavaTrailingComment(text) {
+    let i = 0;
+    while (i < text.length) {
+        const ch = text[i];
+        if (ch === '"') {
+            i++;
+            while (i < text.length && text[i] !== '"') {
+                if (text[i] === '\\') {
+                    i += 2;
+                    continue;
+                }
+                i++;
+            }
+            if (i < text.length)
+                i++;
+            continue;
+        }
+        if (ch === '/' && text[i + 1] === '/')
+            return text.slice(0, i);
+        i++;
+    }
+    return text;
+}
+/**
+ * #515 (Java/C#) — like `resolvePythonDerivedAnchor`, pick the real source
+ * named on the derivation's right-hand side (following derived chains).
+ */
+function resolveJavaDerivedAnchor(varName, derived, realSourceByVar, codeLines, visiting) {
+    if (visiting.has(varName))
+        return undefined;
+    visiting.add(varName);
+    const originLine = derived.get(varName);
+    if (originLine === undefined)
+        return undefined;
+    const text = codeLines[originLine - 1];
+    if (!text)
+        return undefined;
+    const eq = text.search(/(?<![=!<>+\-*/%&|^:])=(?!=)/);
+    if (eq < 0)
+        return undefined;
+    const rhs = maskStringLiteralsForTokenScan(stripJavaTrailingComment(text.slice(eq + 1)));
+    let best;
+    for (const m of rhs.matchAll(/[A-Za-z_][A-Za-z0-9_]*/g)) {
+        const id = m[0];
+        if (id === varName)
+            continue;
+        const real = realSourceByVar.get(id);
+        const derivedLine = derived.get(id);
+        let cand;
+        if (derivedLine !== undefined && (!real || derivedLine > real.line)) {
+            cand = resolveJavaDerivedAnchor(id, derived, realSourceByVar, codeLines, visiting);
+        }
+        if (!cand)
+            cand = real;
+        if (cand && (!best || cand.line < best.line))
+            best = cand;
+    }
+    return best;
+}
+/**
+ * cognium-dev#624 — expression-scan flows through `lhs = seed.receiverCall()`
+ * (e.g. `label = page.getName()`) are vetoed as `variable_not_tainted` because
+ * const-prop never seeds those derived names. Argument-style derivations
+ * (`shown = encodeForPage(nick)`) must keep the veto so sanitizer credit holds.
+ */
+function javaReceiverChainDerivedVar(code, localVar, seedVar) {
+    if (!seedVar || localVar === seedVar)
+        return false;
+    const esc = seedVar.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const receiverOnRhs = new RegExp(`(?:^|[^\\w.$])${esc}\\s*\\.`, 'u');
+    const declRe = /^\s*(?:public|private|protected|static|final|volatile|transient|\s)*\s*(?:[A-Za-z_][\w.]*(?:\s*<[^>]*>)?(?:\s*\[\s*\])*)\s+([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+    const assignRe = /^\s*([A-Za-z_]\w*)\s*=\s*(.+?);\s*$/;
+    for (const line of code.split('\n')) {
+        const trimmed = line.trimStart();
+        if (trimmed.startsWith('//') || trimmed.startsWith('*'))
+            continue;
+        const m = declRe.exec(line) ?? assignRe.exec(line);
+        if (!m || m[1] !== localVar)
+            continue;
+        const rhs = stripJavaTrailingComment(m[2]);
+        if (receiverOnRhs.test(rhs))
+            return true;
+    }
+    return false;
+}
+function makeConstPropVeto(constProp, graph, sources, code, language, sanitizers) {
     const lines = typeof code === 'string' ? code.split('\n') : [];
     const selfReassign = new Map();
     const escape = (v) => v.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
@@ -72,12 +421,40 @@ function makeConstPropVeto(constProp, graph, sources, code, language) {
         const use = (graph.usesByLine.get(line) ?? []).find(u => u.variable === v && u.def_id != null);
         return use ? graph.defById.get(use.def_id) : undefined;
     };
-    return (step, sourceLine, sinkLine) => {
-        const r = isFalsePositive(constProp, step.line, step.variable);
+    return (step, sourceLine, sinkLine, sinkType) => {
+        const method = methodAtLine(graph, step.line);
+        const scopedVar = method ? `${method}:${step.variable}` : step.variable;
+        // cognium-dev#751: Go locals are recorded method-scoped only (no unscoped
+        // alias) by handleGoAssignment, so Go looks up the scoped name. Other
+        // languages keep the unscoped lookup (#614).
+        const r = isFalsePositive(constProp, step.line, language === 'go' ? scopedVar : step.variable);
         if (!r.isFalsePositive)
             return false;
         if (r.reason !== 'variable_not_tainted')
             return true;
+        // #589: the step variable came from a context-specific encoder
+        // (`escapeHtml`, `encodeForHTML`, …), which does not clean `trust_boundary`
+        // (a `session.setAttribute` sink). It is "not tainted" only for the other
+        // sink types, so this flow is not vetoed.
+        // Uncovered entries are scoped (`method:var`). A bare `step.variable` looks
+        // up only that step's own method — never any sibling `*:name`.
+        if (sinkType !== undefined && constProp.sanitizedVarUncovered) {
+            const unc = constProp.sanitizedVarUncovered;
+            if (step.variable.includes(':')) {
+                if (unc.get(step.variable)?.has(sinkType))
+                    return false;
+            }
+            else {
+                const method = methodAtLine(graph, step.line);
+                if (method) {
+                    if (unc.get(`${method}:${step.variable}`)?.has(sinkType))
+                        return false;
+                }
+                else if (unc.get(step.variable)?.has(sinkType)) {
+                    return false;
+                }
+            }
+        }
         // cognium-dev#579: const-prop has no C# source model, so its tainted set is
         // empty for C# and "not tainted" there means "never looked", not "clean".
         // It still records a plain reassignment (`s = q;`) as a tracked symbol,
@@ -85,6 +462,43 @@ function makeConstPropVeto(constProp, graph, sources, code, language) {
         // code and resolved constants (the reasons above) still apply.
         if (language === 'csharp')
             return false;
+        // cognium-dev#582: in JS/TS a use after an `if` / `else` / `switch` has the
+        // outer def and the block's def both reaching it (the DFG lists one use per
+        // reaching def). const-prop has no model of the block's assignment, so its
+        // "untainted" is only the outer def's value; when any reaching def is the
+        // source's own assignment the verdict is "never looked", not "clean".
+        // Keep the veto when that source assignment itself passes through a
+        // sanitizer (`n = escapeHtml(req.query.n)` in a branch): skipping would
+        // report xss while main and the straight-line form stay clean.
+        if ((language === 'javascript' || language === 'typescript')) {
+            const reaching = (graph.usesByLine.get(step.line) ?? [])
+                .filter(u => u.variable === step.variable && u.def_id != null)
+                .map(u => graph.defById.get(u.def_id))
+                .filter((d) => !!d);
+            const sourceReaches = reaching.filter(d => d.line === sourceLine &&
+                sources.some(s => s.line === sourceLine && !CONTAINER_READ_SOURCES.has(s.type)));
+            if (reaching.length > 1 && sourceReaches.length > 0) {
+                const sansAtSource = (sanitizers ?? []).filter(s => s.line === sourceLine);
+                const srcText = lines[sourceLine - 1] ?? '';
+                const sourceSanitized = sourceReaches.some(d => {
+                    const relevant = sinkType
+                        ? sansAtSource.filter(s => sanitizerCoversSink(s, sinkType))
+                        : sansAtSource;
+                    if (relevant.length === 0)
+                        return false;
+                    const v = escape(d.variable);
+                    const dm = new RegExp(`(?:^|[^\\w$.])${v}\\s*=(?!=)(.*)$`).exec(srcText);
+                    if (!dm)
+                        return false;
+                    const wrapType = sinkType ?? relevant[0]?.sanitizes?.[0];
+                    if (!wrapType)
+                        return false;
+                    return expressionFullyWrappedBySanitizer(dm[1], relevant, wrapType);
+                });
+                if (!sourceSanitized)
+                    return false;
+            }
+        }
         const lo = Math.min(sourceLine, sinkLine);
         // Walk the reaching-def chain back from this step, stepping through
         // self-derived reassignments only. Reaching defs are per method, so a
@@ -106,8 +520,20 @@ function makeConstPropVeto(constProp, graph, sources, code, language) {
         // "untainted" can only mean it has no pattern for this source. Container
         // reads are excluded: const-prop tracks collection keys, and there its
         // verdict is informed (`bar = map.get("safeKey")` — 10 OWASP FP files).
-        if (d.line === sourceLine && sources.some(s => s.line === sourceLine && !CONTAINER_READ_SOURCES.has(s.type)))
+        if (d.line === sourceLine && sources.some(s => s.line === sourceLine && !CONTAINER_READ_SOURCES.has(s.type))) {
+            // cognium-dev#751: sink use after `uid := constantHelper(tainted)` must veto
+            // when the helper is in `constantReturningMethods`, even if the flow's
+            // source_line is the assignment line (rule E would otherwise keep it).
+            if (step.line === sinkLine && !constProp.tainted.has(scopedVar)) {
+                for (let ln = sourceLine; ln <= sinkLine; ln++) {
+                    const calleeMatch = (lines[ln - 1] ?? '').match(/:=\s*(\w+)\s*\(/);
+                    if (calleeMatch && constProp.constantReturningMethods?.has(calleeMatch[1])) {
+                        return true;
+                    }
+                }
+            }
             return false;
+        }
         // (A) the chain crossed at least one `x = f(x)` and ends inside the span.
         if (selfHops > 0 && d.line >= lo)
             return false;
@@ -123,6 +549,23 @@ export class TaintPropagationPass {
         const constProp = ctx.getResult('constant-propagation');
         const sinkFilter = ctx.getResult('sink-filter');
         const { sources, sinks, sanitizers } = sinkFilter;
+        // cognium-dev#624: seed receiver-chain derived locals (`label = page.getName()`)
+        // into const-prop's tainted set so DFG + expression-scan vetoes keep them.
+        // Per-source seeding + receiver filter avoids argument-style derivations
+        // (`shown = encodeForPage(nick)`) that must stay vetoed for sanitizer credit.
+        if (ctx.language === 'java' && typeof ctx.code === 'string') {
+            for (const s of sources) {
+                if (!s.variable)
+                    continue;
+                for (const [v] of buildJavaTaintedVars(ctx.code, new Set([s.variable]))) {
+                    if (v === s.variable)
+                        continue;
+                    if (javaReceiverChainDerivedVar(ctx.code, v, s.variable)) {
+                        constProp.tainted.add(v);
+                    }
+                }
+            }
+        }
         if (sinks.length === 0) {
             return { flows: [] };
         }
@@ -134,16 +577,16 @@ export class TaintPropagationPass {
             return { flows: [] };
         }
         // DFG-based taint propagation
-        const propagationResult = propagateTaint(graph, sources, sinks, sanitizers);
+        const propagationResult = propagateTaint(graph, sources, sinks, sanitizers, undefined, ctx.code);
         // cognium-dev#328 — scoped exemption from const-prop's `variable_not_tainted`
         // veto for self-derived reassignment (`x = f(x)`, `x += y`), the #287 shape.
-        const isVetoed = makeConstPropVeto(constProp, graph, sources, ctx.code, ctx.language);
+        const isVetoed = makeConstPropVeto(constProp, graph, sources, ctx.code, ctx.language, sanitizers);
         // Filter flows: eliminate dead-code paths and constant-propagation FPs
         const verifiedFlows = propagationResult.flows.filter(flow => {
             if (constProp.unreachableLines.has(flow.sink.line))
                 return false;
             for (const step of flow.path) {
-                if (isVetoed(step, flow.source.line, flow.sink.line))
+                if (isVetoed(step, flow.source.line, flow.sink.line, flow.sink.type))
                     return false;
             }
             if (isCorrelatedPredicateFP(constProp, flow))
@@ -186,6 +629,38 @@ export class TaintPropagationPass {
             flows.push(f);
             return true;
         };
+        // Supplement: Spring MVC return-as-body XSS flows — cognium-dev#566. The
+        // sink `LanguageSourcesPass` synthesises at the `return` has no method or
+        // argument, so no argument matcher reaches it; the detector already knows
+        // both ends, so the flow is emitted here (as for Python #368 below).
+        if (ctx.language === 'java' && typeof ctx.code === 'string') {
+            const xssSanitizerLines = sanitizers
+                .filter(sa => sa.sanitizes.includes('xss'))
+                .map(sa => sa.line);
+            for (const rx of findJavaSpringReturnXSSSinks(ctx.code, types, sources, xssSanitizerLines)) {
+                if (constProp.unreachableLines.has(rx.sinkLine))
+                    continue;
+                const sink = sinks.find(sk => sk.line === rx.sinkLine && sk.type === 'xss');
+                if (!sink)
+                    continue;
+                const atLine = sources.filter(sc => sc.line === rx.sourceLine);
+                const src = atLine.find(sc => sc.type !== 'interprocedural_param') ?? atLine[0];
+                if (!src)
+                    continue;
+                pushIfNew({
+                    source_line: src.line,
+                    sink_line: rx.sinkLine,
+                    source_type: src.type,
+                    sink_type: 'xss',
+                    path: [
+                        { variable: src.variable ?? 'response', line: src.line, type: 'source' },
+                        { variable: src.variable ?? 'response', line: rx.sinkLine, type: 'sink' },
+                    ],
+                    confidence: (src.confidence ?? 1) * (sink.confidence ?? 1),
+                    sanitized: false,
+                });
+            }
+        }
         // Supplement: Python trust-boundary (CWE-501) flows — cognium-dev#363.
         //
         // `LanguageSourcesPass` detects `session[<tainted>] = …` and synthesises a
@@ -293,6 +768,42 @@ export class TaintPropagationPass {
                 }
             }
         }
+        // Supplement: Java JSPWiki plugin return-XSS flows — cognium-dev#624. The
+        // sink synthesised by `LanguageSourcesPass` has no method or argument, so
+        // no argument matcher can reach it; link it to its source here, as for the
+        // Python return-XSS shape above. The helper already applies its own
+        // statement-level sanitizer check, so these flows skip the line-keyed
+        // def-chain credit below (a sanitizer elsewhere on a def line of the
+        // returned name does not cover it).
+        const wikiPluginFlowKeys = new Set();
+        if (ctx.language === 'java' && typeof ctx.code === 'string') {
+            const xssSanitizers = sanitizers
+                .filter(sa => sa.sanitizes.includes('xss'))
+                .map(sa => ({ line: sa.line, method: sa.method }));
+            for (const rx of findJavaWikiPluginReturnXSSSinks(ctx.code, types, graph.ir.imports, sources, xssSanitizers)) {
+                if (constProp.unreachableLines.has(rx.sinkLine))
+                    continue;
+                const sink = sinks.find(sk => sk.line === rx.sinkLine && sk.type === 'xss');
+                if (!sink)
+                    continue;
+                const src = sources.find(sc => sc.line === rx.sourceLine);
+                if (!src)
+                    continue;
+                wikiPluginFlowKeys.add(`${src.line}:${rx.sinkLine}`);
+                pushIfNew({
+                    source_line: src.line,
+                    sink_line: rx.sinkLine,
+                    source_type: src.type,
+                    sink_type: 'xss',
+                    path: [
+                        { variable: src.variable ?? 'response', line: src.line, type: 'source' },
+                        { variable: src.variable ?? 'response', line: rx.sinkLine, type: 'sink' },
+                    ],
+                    confidence: (src.confidence ?? 1) * (sink.confidence ?? 1),
+                    sanitized: false,
+                });
+            }
+        }
         // Supplement: array element flows
         // Sprint 82 (#189) — dedup keys on (source_line, sink_line, sink_type) so
         // distinct sink-types at the same call site (e.g. `res.redirect` registered
@@ -389,19 +900,47 @@ export class TaintPropagationPass {
         // explicitly marked sanitized by a guard (e.g. regex-allowlist).
         // Applied to ALL flow generators (DFG-built and the four supplements)
         // so the suppression is uniform regardless of which path emitted the flow.
+        //
+        // #589: a variable produced by a context-specific encoder (`escapeHtml`,
+        // `encodeForHTML`, …) is not clean for `trust_boundary`
+        // (`session.setAttribute`), so that flow from the variable stays.
         const sanitizedNames = constProp.sanitizedVars;
+        const sanitizedUncovered = constProp.sanitizedVarUncovered;
         let finalFlows = sanitizedNames.size === 0 ? flows : flows.filter(f => {
             if (f.path.length === 0)
                 return true;
             const sourceVar = f.path[0].variable;
             if (!sourceVar)
                 return true;
-            if (sanitizedNames.has(sourceVar))
-                return false;
+            const coversFlow = (name) => {
+                return !(sanitizedUncovered?.get(name)?.has(f.sink_type));
+            };
+            // #589 review: when any `method:var` sanitizer exists, only that flow's
+            // own method can drop it — never a sibling's scoped name (one encoder in
+            // doPost must not clear xss in other()), and never the bare alias alone.
+            const suffix = `:${sourceVar}`;
+            let hasScopedSanitizer = false;
             for (const s of sanitizedNames) {
-                if (s.endsWith(`:${sourceVar}`))
+                if (s !== sourceVar && s.endsWith(suffix)) {
+                    hasScopedSanitizer = true;
+                    break;
+                }
+            }
+            if (hasScopedSanitizer) {
+                if (sourceVar.includes(':') && sanitizedNames.has(sourceVar) && coversFlow(sourceVar))
                     return false;
+                const method = methodAtLine(graph, f.sink_line) ?? methodAtLine(graph, f.source_line);
+                if (method) {
+                    const scoped = `${method}:${sourceVar}`;
+                    if (sanitizedNames.has(scoped) && coversFlow(scoped))
+                        return false;
+                }
+                // Scoped sanitizers exist for this name, but none proved to be this
+                // flow's method — keep the flow.
+                return true;
             }
+            if (sanitizedNames.has(sourceVar) && coversFlow(sourceVar))
+                return false;
             return true;
         });
         // Sprint 24 (cognium-dev #102) — uniform line-keyed sanitizer
@@ -421,6 +960,25 @@ export class TaintPropagationPass {
                 arr.push(san);
                 sanitizersByLine.set(san.line, arr);
             }
+            const codeLines = typeof ctx.code === 'string' ? ctx.code.split('\n') : undefined;
+            // True unless every def at `line` among `visited` is provably off this
+            // flow: not a variable on its path, and a complete backward walk from it
+            // never reaches `sourceLine`.
+            const sanitizedDefOnFlow = (visited, line, f) => {
+                let sawDef = false;
+                for (const id of visited) {
+                    const def = graph.defById.get(id);
+                    if (!def || def.line !== line)
+                        continue;
+                    sawDef = true;
+                    if (f.path.some(step => step.variable === def.variable))
+                        return true;
+                    const back = walkBackwardDefs(id, graph.chainsByToDef, graph.defById, { maxHops: 32 });
+                    if (back.hopCapReached || back.lines.has(f.source_line))
+                        return true;
+                }
+                return !sawDef;
+            };
             finalFlows = finalFlows.filter(f => {
                 // Two-tier filter:
                 //   - `external_taint_escape` (synthetic CWE-668 fallback): no
@@ -447,6 +1005,20 @@ export class TaintPropagationPass {
                     }
                     return true;
                 }
+                // #582: Python has no branch-aware def chain, so a literal in a sibling
+                // arm can hide the one def whose sanitizer the walk below would find.
+                // The flow's own source def is the whole answer when its right-hand side
+                // is wrapped, end to end, in a covering sanitizer.
+                if (ctx.language === 'python' && codeLines && f.path.length > 0) {
+                    const first = f.path[0];
+                    const defText = first.line === f.source_line ? codeLines[f.source_line - 1] : undefined;
+                    const sansAtSource = sanitizersByLine.get(f.source_line);
+                    if (defText && first.variable && sansAtSource && /^[A-Za-z_]\w*$/.test(first.variable)) {
+                        const dm = new RegExp(`^\\s*${first.variable}\\s*=(?!=)(.*)$`).exec(defText);
+                        if (dm && expressionFullyWrappedBySanitizer(dm[1], sansAtSource, f.sink_type))
+                            return false;
+                    }
+                }
                 const sansAtSink = sanitizersByLine.get(f.sink_line);
                 if (sansAtSink && sansAtSink.length > 0) {
                     for (const san of sansAtSink) {
@@ -475,6 +1047,8 @@ export class TaintPropagationPass {
                 // in taint-propagation.ts checkSanitized. Doesn't over-suppress
                 // bare `shlex.quote(host)` on unrelated non-sink lines because
                 // those calls don't create a def in the sink var's chain.
+                if (f.sink_type === 'xss' && wikiPluginFlowKeys.has(`${f.source_line}:${f.sink_line}`))
+                    return true;
                 const usesAtSink = graph.usesByLine.get(f.sink_line);
                 if (!usesAtSink || usesAtSink.length === 0)
                     return true;
@@ -483,12 +1057,29 @@ export class TaintPropagationPass {
                     : undefined;
                 if (!sinkVar)
                     return true;
+                // #589: an HTML encoder is credited only when every chain from the
+                // sink back to this flow's source passes through a covering
+                // sanitizer. Computed once per flow, over every reaching def of the
+                // sink variable, and only when an HTML encoder is the candidate.
+                let everyChainCovered;
+                const htmlEncoderCoversEveryChain = () => {
+                    if (everyChainCovered === undefined) {
+                        const starts = [];
+                        for (const u of usesAtSink) {
+                            if (u.variable === sinkVar && u.def_id !== null && u.def_id !== undefined)
+                                starts.push(u.def_id);
+                        }
+                        everyChainCovered = starts.length > 0 && starts.every(id => !hasUncoveredChain(id, f.sink_type, f.source_line, graph, sanitizersByLine, codeLines));
+                    }
+                    return everyChainCovered;
+                };
                 for (const use of usesAtSink) {
                     if (use.variable !== sinkVar)
                         continue;
                     if (use.def_id === null || use.def_id === undefined)
                         continue;
-                    const walk = walkBackwardDefs(use.def_id, graph.chainsByToDef, graph.defById, { maxHops: 32 });
+                    const sinkDefId = use.def_id;
+                    const walk = walkBackwardDefs(sinkDefId, graph.chainsByToDef, graph.defById, { maxHops: 32 });
                     for (const line of walk.lines) {
                         if (line === f.sink_line)
                             continue; // already checked above
@@ -507,10 +1098,21 @@ export class TaintPropagationPass {
                         const sansAtLine = sanitizersByLine.get(line);
                         if (!sansAtLine || sansAtLine.length === 0)
                             continue;
+                        // cognium-dev#348: the walk visits every contributor of the sink
+                        // value. In `clean = a.replaceAll(..); msg = clean + b; log(msg)`
+                        // the strip on `a` must not credit the flow from `b`. Skip a
+                        // sanitized def that does not derive from this flow's source.
+                        if (line > f.source_line && !sanitizedDefOnFlow(walk.visited, line, f))
+                            continue;
                         for (const san of sansAtLine) {
-                            if (sanitizerCoversSink(san, f.sink_type)) {
-                                return false;
-                            }
+                            if (!sanitizerCoversSink(san, f.sink_type))
+                                continue;
+                            // #589: a join anywhere between the sink and the encoder
+                            // (`mixed = shown + b`, then `copy = mixed`) must not let an
+                            // encoder on one operand drop unrestricted taint from another.
+                            if (isHtmlContextEncoderSanitizer(san) && !htmlEncoderCoversEveryChain())
+                                continue;
+                            return false;
                         }
                     }
                 }
@@ -665,6 +1267,28 @@ export class TaintPropagationPass {
                 });
             }
         }
+        // cognium-dev#475: DFG may keep a flow when a local (`v`) was rewritten to
+        // a literal before the sink even though the sink reads a copy (`cmd`) built
+        // earlier. Walk backward from the sink through assignments into the sink
+        // argument; for each upstream local, literal-kill only on lines strictly
+        // before the assignment that copied it into that chain (so `v = "safe"`
+        // after `new SqlCommand(... + v)` does not drop the finding). Unrelated
+        // locals and conditional / re-taint shapes stay sound.
+        if (ctx.language === 'csharp' && typeof ctx.code === 'string') {
+            const code = ctx.code;
+            finalFlows = finalFlows.filter(f => {
+                const deriveLine = csharpSinkDependencyKillVars(code, f);
+                const carriers = csharpFlowTaintCarriers(code, f);
+                for (const [v, beforeLine] of deriveLine) {
+                    if (!carriers.has(v))
+                        continue;
+                    if (csharpLastUnconditionalAssignIsLiteral(code, v, f.source_line, beforeLine, constProp.unreachableLines)) {
+                        return false;
+                    }
+                }
+                return true;
+            });
+        }
         return { flows: finalFlows };
     }
 }
@@ -829,6 +1453,10 @@ function isInJavaSanitizedMethod(code, types, sinkLine, sinkType) {
             return false;
         if (!/\.startsWith\s*\([^)]*getCanonicalPath/.test(body))
             return false;
+        // cognium-dev#618: `startsWith(parent.getCanonicalPath())` with no
+        // trailing separator is the prefix-confusion bypass, not a guard.
+        if (javaCanonicalStartsWithAllBare(body))
+            return false;
         if (!/\bthrow\s+new\b/.test(body))
             return false;
         return true;
@@ -992,8 +1620,118 @@ function detectGoPackageGlobalFlows(code, _calls, sources, sinks, unreachableLin
     }
     return flows;
 }
+/**
+ * #614 — is `varName` tainted in the sink's own method?
+ *
+ * The const-prop result carries scoped names (`method:var`) and, for backward
+ * compatibility, an unscoped alias of each. The unscoped alias says only that
+ * SOME method tainted a local of that name. When any scoped entry for the name
+ * exists, membership is decided by the sink's own scoped name, so a same-named
+ * local in a safe sibling method (the Juliet `bad()` / `good*()` layout) is not
+ * treated as tainted. A name with no scoped entry (a field, a parameter) keeps
+ * the unscoped match. A field use (`this.name` / bare field read) is shared by
+ * every method of its class (SecuriBench Inter4); a local that merely shares a
+ * field's name is not.
+ */
+/**
+ * True when `methodName` declares a local (or param) named `varName`. With
+ * overloads, the declaration that encloses `atLine` is the one checked (the
+ * first declaration of that name is only a fallback when no line is known or
+ * none encloses it).
+ */
+function methodHasLocalDecl(code, methodName, varName, atLine) {
+    if (!code || !methodName)
+        return false;
+    // Find `methodName(...) [throws ...] {` then scan the body for a local decl.
+    const esc = methodName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const v = varName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const methodRe = new RegExp('(?:^|[\\s;{}])' + esc + '\\s*\\([^;{]*\\)\\s*(?:throws\\s+[^{]+)?\\{', 'gm');
+    const lineAt = (offset) => {
+        let n = 1;
+        for (let k = 0; k < offset; k++)
+            if (code.charCodeAt(k) === 10)
+                n++;
+        return n;
+    };
+    let chosen = null;
+    let first = null;
+    for (let m = methodRe.exec(code); m; m = methodRe.exec(code)) {
+        const bodyStart = m.index + m[0].length;
+        let i = bodyStart;
+        let depth = 1;
+        while (i < code.length && depth > 0) {
+            const c = code[i++];
+            if (c === '{')
+                depth++;
+            else if (c === '}')
+                depth--;
+        }
+        const cand = { header: m[0], bodyStart, bodyEnd: i - 1 };
+        if (!first)
+            first = cand;
+        if (atLine === undefined)
+            break;
+        if (atLine >= lineAt(m.index) && atLine <= lineAt(cand.bodyEnd)) {
+            chosen = cand;
+            break;
+        }
+    }
+    const hit = chosen ?? first;
+    if (!hit)
+        return false;
+    const body = code.slice(hit.bodyStart, hit.bodyEnd);
+    // Parameter named varName counts as shadowing the field.
+    if (new RegExp('[(,]\\s*(?:final\\s+)?[\\w.<>,\\[\\]\\s]+\\s+' + v + '\\s*[,)]').test(hit.header))
+        return true;
+    const declRe = new RegExp('(?:^|[;{}])\\s*(?:(?:final|volatile)\\s+)?(?:[A-Za-z_][\\w.<>,\\[\\]\\s]*?)\\s+' + v + '\\s*(?:=|;|,)', 'm');
+    return declRe.test(body);
+}
+/**
+ * True when `expression` reads this class's own field `varName`: `this.name`,
+ * `self.name`, or `Enclosing.name` (static access through an enclosing type).
+ * Another object's member (`item.name`, `file.name`) is not this class's field.
+ */
+function isFieldUseExpression(expression, varName, enclosingTypeNames) {
+    if (!expression)
+        return false;
+    const e = expression.trim();
+    if (e === `this.${varName}` || e === `self.${varName}`)
+        return true;
+    const m = new RegExp('^([A-Za-z_]\\w*)\\.' + varName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&') + '$').exec(e);
+    return !!m && enclosingTypeNames.has(m[1]);
+}
+/** Names of the types whose range encloses `line` (outer and nested). */
+function enclosingTypeNamesAt(types, line) {
+    const names = new Set();
+    for (const t of types ?? []) {
+        if (line >= t.start_line && line <= t.end_line)
+            names.add(t.name);
+    }
+    return names;
+}
+function isTaintedInMethod(taintedVars, varName, scopedName, fieldNames, isFieldUse) {
+    if (taintedVars.has(scopedName))
+        return true;
+    if (!taintedVars.has(varName))
+        return false;
+    if (scopedName === varName)
+        return true;
+    // Field exception only when THIS use is a field, not when any field has the name.
+    if (isFieldUse && fieldNames.has(varName))
+        return true;
+    const suffix = `:${varName}`;
+    for (const t of taintedVars) {
+        if (t.endsWith(suffix))
+            return false;
+    }
+    return true;
+}
 function detectCollectionFlows(calls, sources, sinks, taintedVars, unreachableLines, code, types) {
     const flows = [];
+    const fieldNames = new Set();
+    for (const t of types ?? [])
+        for (const f of t.fields ?? [])
+            fieldNames.add(f.name);
     const callsByLine = new Map();
     for (const call of calls) {
         const existing = callsByLine.get(call.location.line) ?? [];
@@ -1014,7 +1752,16 @@ function detectCollectionFlows(calls, sources, sinks, taintedVars, unreachableLi
                 if (arg.variable) {
                     const varName = arg.variable;
                     const scopedName = call.in_method ? `${call.in_method}:${varName}` : varName;
-                    if (taintedVars.has(varName) || taintedVars.has(scopedName)) {
+                    // Bare `name` that is a field read (no local of that name in this
+                    // method) still counts as a field use — Inter4-style. A shadowing
+                    // local declaration in the method does not.
+                    const expr = arg.expression ?? '';
+                    const explicitField = isFieldUseExpression(expr, varName, enclosingTypeNamesAt(types, call.location.line));
+                    const bareFieldRead = fieldNames.has(varName)
+                        && expr === varName
+                        && !methodHasLocalDecl(code, call.in_method, varName, call.location.line);
+                    const isFieldUse = explicitField || bareFieldRead;
+                    if (isTaintedInMethod(taintedVars, varName, scopedName, fieldNames, isFieldUse)) {
                         // Sprint 13 #70 — pick a source in the same method scope as the
                         // sink, not blanket sources[0]. The varName-based match is
                         // primary; method-scope is the tiebreaker; sources[0] is the
@@ -1132,23 +1879,22 @@ function detectArrayElementFlows(calls, sources, sinks, taintedArrayElements, un
                     !sink.argPositions.includes(arg.position)) {
                     continue;
                 }
-                const arrayAccessMatch = arg.expression?.match(/^(\w+)\[(\d+|[^[\]]+)\]$/);
-                if (arrayAccessMatch) {
-                    const arrayName = arrayAccessMatch[1];
-                    const indexStr = arrayAccessMatch[2];
+                const arrayAccess = parseJavaArrayAccessExpression(arg.expression);
+                if (arrayAccess) {
+                    const { base, arrayName, indexKey, displayVar } = arrayAccess;
                     const taintedIndices = taintedArrayElements.get(arrayName);
                     if (taintedIndices) {
-                        const isTainted = taintedIndices.has(indexStr) || taintedIndices.has('*');
+                        const isTainted = taintedIndices.has(indexKey) || taintedIndices.has('*');
                         if (isTainted) {
                             // Sprint 13 #70 — method-scoped source picker (see detectCollectionFlows).
-                            const source = pickScopedSource(sources, sink.line, call.in_method ?? null, types, arrayName);
+                            const source = pickScopedSource(sources, sink.line, call.in_method ?? null, types, base);
                             if (source) {
                                 flows.push({
                                     source_line: source.line, sink_line: sink.line,
                                     source_type: source.type, sink_type: sink.type,
                                     path: [
-                                        { variable: arrayName, line: source.line, type: 'source' },
-                                        { variable: `${arrayName}[${indexStr}]`, line: sink.line, type: 'sink' },
+                                        { variable: base, line: source.line, type: 'source' },
+                                        { variable: displayVar, line: sink.line, type: 'sink' },
                                     ],
                                     confidence: 0.85, sanitized: false,
                                 });
@@ -1161,6 +1907,20 @@ function detectArrayElementFlows(calls, sources, sinks, taintedArrayElements, un
     }
     return flows;
 }
+/** Parameter names referenced as identifiers inside a compound sink argument (#685). */
+function compoundArgParamNames(expression, paramNames) {
+    const stripped = expression.replace(/(['"`])(?:\\.|(?!\1).)*\1/g, (m) => ' '.repeat(m.length));
+    const matched = [];
+    for (const raw of paramNames) {
+        const name = raw.startsWith('*') ? raw.slice(1) : raw;
+        if (!/^[\w$]+$/.test(name))
+            continue;
+        const re = new RegExp(`(?<![\\w$.])${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![\\w$])`);
+        if (re.test(stripped))
+            matched.push(name);
+    }
+    return matched;
+}
 function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines, tainted, code) {
     const flows = [];
     const paramSourcesByMethod = new Map();
@@ -1199,14 +1959,17 @@ function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines
             if (!methodParamSources)
                 continue;
             for (const arg of call.arguments) {
-                if (arg.variable) {
-                    // Skip arguments that are not in the sink's dangerous positions.
-                    // E.g., execSync(cmd, { cwd: path }) — only arg 0 is a command injection sink.
-                    if (sink.argPositions && sink.argPositions.length > 0 &&
-                        !sink.argPositions.includes(arg.position)) {
-                        continue;
-                    }
-                    const paramSource = methodParamSources.get(arg.variable);
+                if (sink.argPositions && sink.argPositions.length > 0 &&
+                    !sink.argPositions.includes(arg.position)) {
+                    continue;
+                }
+                const varNames = arg.variable
+                    ? [arg.variable]
+                    : (arg.expression
+                        ? compoundArgParamNames(arg.expression, methodParamSources.keys())
+                        : []);
+                for (const varName of varNames) {
+                    const paramSource = methodParamSources.get(varName);
                     if (paramSource) {
                         // Sprint 82 (#189) — sink-type-aware dedup so a sink registered
                         // under multiple types at the same call site (e.g. `redirect` as
@@ -1214,7 +1977,7 @@ function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines
                         const exists = flows.some(f => f.source_line === paramSource.line && f.sink_line === sink.line && f.sink_type === sink.type);
                         if (!exists) {
                             if (typeof code === 'string' &&
-                                isReassignedToLiteralBetween(code, arg.variable, paramSource.line, sink.line, unreachableLines)) {
+                                isReassignedToLiteralBetween(code, varName, paramSource.line, sink.line, unreachableLines)) {
                                 continue;
                             }
                             // Note: DFG-flow filter handles sanitizer-guard suppression
@@ -1223,8 +1986,8 @@ function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines
                                 source_line: paramSource.line, sink_line: sink.line,
                                 source_type: paramSource.type, sink_type: sink.type,
                                 path: [
-                                    { variable: arg.variable, line: paramSource.line, type: 'source' },
-                                    { variable: arg.variable, line: sink.line, type: 'sink' },
+                                    { variable: varName, line: paramSource.line, type: 'source' },
+                                    { variable: varName, line: sink.line, type: 'sink' },
                                 ],
                                 confidence: 0.75, sanitized: false,
                             });
@@ -1390,7 +2153,18 @@ function csharpMethodScopedAliases(code, seeds, methods, fieldNames) {
                 }
                 continue;
             }
-            const d = declRe.exec(text) ?? assignRe.exec(text);
+            let d = declRe.exec(text) ?? assignRe.exec(text);
+            if (!d && text.includes('{')) {
+                const inner = text.slice(text.indexOf('{') + 1, text.lastIndexOf('}'));
+                for (const stmt of inner.split(';')) {
+                    const trimmedStmt = stmt.trim();
+                    if (!trimmedStmt)
+                        continue;
+                    d = declRe.exec(`${trimmedStmt};`) ?? assignRe.exec(`${trimmedStmt};`);
+                    if (d)
+                        break;
+                }
+            }
             if (!d)
                 continue;
             const [, lhs, rhs] = d;
@@ -1425,6 +2199,211 @@ function splitLinesCached(code) {
     _reassignSplitLines = code.split('\n');
     return _reassignSplitLines;
 }
+const CSHARP_ID_KW = new Set([
+    'if', 'else', 'for', 'foreach', 'while', 'do', 'switch', 'case', 'default', 'break',
+    'return', 'new', 'var', 'string', 'int', 'bool', 'void', 'static', 'public', 'class',
+    'using', 'lock', 'try', 'catch', 'finally', 'throw', 'null', 'true', 'false',
+]);
+function csharpStripStringLiterals(text) {
+    return text
+        .replace(/\$@?"(?:[^"\\]|\\.)*"/g, ' ')
+        .replace(/@?"(?:[^"\\]|\\.)*"/g, ' ')
+        .replace(/'(?:[^'\\]|\\.)'/g, ' ')
+        .replace(/`(?:[^`\\]|\\.)*`/g, ' ');
+}
+function csharpIdentifiersInExpr(text) {
+    const ids = csharpStripStringLiterals(text).match(/\b[A-Za-z_][\w]*\b/g) ?? [];
+    return ids.filter(id => !CSHARP_ID_KW.has(id));
+}
+const CSHARP_ASSIGN_RE = /^\s*(?:(?:var|string|String|[\w.<>\[\]?]+\s+)?([A-Za-z_]\w*)|([A-Za-z_]\w*))\s*=\s*(.+)$/;
+/**
+ * Variables that carry THIS C# flow's taint (path locals plus forward/backward
+ * derivation). Pure-literal helpers (`table = "users"` next to tainted `input`)
+ * are excluded so their literal assignments cannot drop the flow (#475).
+ */
+function csharpFlowTaintCarriers(code, flow) {
+    const carriers = new Set();
+    for (const step of flow.path) {
+        if (step.variable)
+            carriers.add(step.variable);
+    }
+    if (carriers.size === 0)
+        return carriers;
+    const lines = splitLinesCached(code);
+    const lo = Math.max(0, flow.source_line - 1);
+    const hi = Math.min(lines.length, flow.sink_line);
+    const stripLits = (rhs) => csharpStripStringLiterals(rhs);
+    const assigns = [];
+    for (let i = lo; i < hi; i++) {
+        const line = lines[i] ?? '';
+        if (/^\s*if\b/.test(line))
+            continue;
+        for (const seg of line.split(';')) {
+            const t = seg.trim();
+            if (!t)
+                continue;
+            const m = CSHARP_ASSIGN_RE.exec(t);
+            if (!m)
+                continue;
+            const lhs = m[1] ?? m[2];
+            const rhs = m[3];
+            if (!lhs)
+                continue;
+            const rhsCode = stripLits(rhs);
+            const literal = rhsCode.replace(/\s+/g, '') === '';
+            const rhsIdents = rhsCode.match(/\b[A-Za-z_][\w]*\b/g) ?? [];
+            assigns.push({ lhs, rhsIdents, literal });
+        }
+    }
+    const hadNonLiteral = new Set();
+    for (const a of assigns) {
+        if (!a.literal)
+            hadNonLiteral.add(a.lhs);
+    }
+    let changed = true;
+    for (let guard = 0; changed && guard < assigns.length + 2; guard++) {
+        changed = false;
+        for (const a of assigns) {
+            if (!carriers.has(a.lhs) && a.rhsIdents.some(id => carriers.has(id))) {
+                carriers.add(a.lhs);
+                changed = true;
+            }
+            if (carriers.has(a.lhs)) {
+                for (const id of a.rhsIdents) {
+                    if (!carriers.has(id) && hadNonLiteral.has(id)) {
+                        carriers.add(id);
+                        changed = true;
+                    }
+                }
+            }
+        }
+    }
+    return carriers;
+}
+/**
+ * For each upstream local, the 1-based line of the assignment that copied it
+ * into the sink dependency chain (closest to the sink). A literal reset of
+ * `v` after `var q = ... + v` must not kill a flow that only reads `q` (#475).
+ */
+function csharpSinkDependencyKillVars(code, flow) {
+    const lines = splitLinesCached(code);
+    const sinkIdx = flow.sink_line - 1;
+    const deriveLine = new Map();
+    if (sinkIdx < 0 || sinkIdx >= lines.length)
+        return deriveLine;
+    const need = new Set(csharpIdentifiersInExpr(lines[sinkIdx] ?? ''));
+    for (let i = sinkIdx - 1; i >= flow.source_line - 1; i--) {
+        const line = lines[i] ?? '';
+        for (const seg of line.split(';')) {
+            const t = seg.trim();
+            if (!t)
+                continue;
+            const m = CSHARP_ASSIGN_RE.exec(t);
+            if (!m)
+                continue;
+            const lhs = m[1] ?? m[2];
+            if (!lhs || !need.has(lhs))
+                continue;
+            for (const id of csharpIdentifiersInExpr(m[3])) {
+                if (!deriveLine.has(id))
+                    deriveLine.set(id, i + 1);
+                need.add(id);
+            }
+        }
+    }
+    return deriveLine;
+}
+function csharpLastUnconditionalAssignIsLiteral(code, variable, srcLine, 
+/** Scan assignments on lines strictly before this 1-based line. */
+beforeLine, unreachableLines) {
+    if (!variable || !/^[A-Za-z_][\w]*$/.test(variable))
+        return false;
+    if (beforeLine - srcLine < 1)
+        return false;
+    const lines = splitLinesCached(code);
+    const reLit = new RegExp('^(?:(?:var|string|String)\\s+)?' + variable + '\\s*(?<![+\\-*/%&|^])=\\s*(?:"(?:[^"\\\\]|\\\\.)*"|\'(?:[^\'\\\\]|\\\\.)*\'|`(?:[^`\\\\]|\\\\.)*`)\\s*$');
+    const rePlain = new RegExp('^(?:(?:var|string|String)\\s+)?' + variable + '\\s*(?<![+\\-*/%&|^])=\\s*(.+)\\s*$');
+    const reCompound = new RegExp('^(?:(?:var|string|String)\\s+)?' + variable + '\\s*[+\\-*/%&|^]=\\s*(.+)\\s*$');
+    const reRefOut = new RegExp('\\b(?:ref|out)\\s+' + variable + '\\b');
+    let last = null;
+    const lo = Math.max(0, srcLine);
+    const hi = Math.min(lines.length, beforeLine - 1);
+    for (let i = lo; i < hi; i++) {
+        if (unreachableLines?.has(i + 1))
+            continue;
+        const line = lines[i];
+        if (!line)
+            continue;
+        if (/^\s*if\b/.test(line))
+            continue;
+        for (const seg of line.split(';')) {
+            const t = seg.trim();
+            if (!t)
+                continue;
+            if (reCompound.test(t)) {
+                last = 'other';
+                continue;
+            }
+            if (reRefOut.test(csharpStripStringLiterals(t))) {
+                last = 'other';
+                continue;
+            }
+            if (!rePlain.test(t))
+                continue;
+            if (csharpAssignInConditionalBlock(lines, i))
+                continue;
+            if (reLit.test(t)) {
+                last = 'literal';
+            }
+            else {
+                last = 'other';
+            }
+        }
+    }
+    return last === 'literal';
+}
+/** True when `header` opens a non-bare control-flow block (not a method/type body). */
+function csharpBlockHeaderIsConditional(header) {
+    const h = header.trim();
+    if (!h || h === '{')
+        return false;
+    if (/^(?:case\b.*|default\s*):$/.test(h))
+        return true;
+    if (/\bswitch\b/.test(h))
+        return true;
+    if (/^(?:\}\s*)?(?:else\s+)?if\s*\(/.test(h))
+        return true;
+    if (/^(?:\}\s*)?else\b/.test(h))
+        return true;
+    if (/\b(?:for|foreach|while|do|using|lock|try|catch|finally)\b/.test(h))
+        return true;
+    return false;
+}
+/**
+ * True when line `idx` sits in a control-flow block. Walks outward through
+ * enclosing braces so an Allman `for` / `while` header above a lone `{` line
+ * is recognised (#475).
+ */
+function csharpAssignInConditionalBlock(lines, idx) {
+    let at = idx;
+    for (let guard = 0; guard < 16; guard++) {
+        const block = enclosingBrace(lines, at, 0);
+        if (!block)
+            return false;
+        let header = block.header.trim();
+        if (!header || header === '{') {
+            const prev = block.headerLine > 0 ? (lines[block.headerLine - 1] ?? '').trim() : '';
+            if (prev)
+                header = prev;
+        }
+        if (csharpBlockHeaderIsConditional(header))
+            return true;
+        if (block.headerLine <= 0)
+            return false;
+        at = block.headerLine - 1;
+    }
+    return false;
+}
 function isReassignedToLiteralBetween(code, variable, srcLine, sinkLine, unreachableLines) {
     if (!variable || sinkLine - srcLine < 2)
         return false;
@@ -1455,17 +2434,33 @@ function isReassignedToLiteralBetween(code, variable, srcLine, sinkLine, unreach
     //     The fall-through `break;` is optional. Used by cognium-dev #101
     //     to suppress the switch→constant FP corpus.
     const reSwitchCase = new RegExp(`^\\s*(?:case\\b.*?|default\\s*):\\s*${variable}\\s*=\\s*${strLit}\\s*;?\\s*(?:break\\s*;?)?\\s*$`);
+    const lineHasNakedLiteralReassign = (line) => {
+        if (reNaked.test(line) || reSwitchCase.test(line))
+            return true;
+        // cognium-dev#475: `var v = input; v = "const";` on one line — only the
+        // trailing statement is a literal kill, not the whole physical line.
+        for (const seg of line.split(';')) {
+            const t = seg.trim();
+            if (!t)
+                continue;
+            if (reNaked.test(t) || reSwitchCase.test(t))
+                return true;
+        }
+        return false;
+    };
     for (let i = lo; i < hi; i++) {
         const line = lines[i];
         if (!line)
             continue;
         if (reGuarded.test(line))
             return true;
-        if (!reNaked.test(line) && !reSwitchCase.test(line))
+        if (!lineHasNakedLiteralReassign(line))
             continue;
         // A literal assigned in one case of a switch only overwrites the value
         // when no case gives the variable anything else. `case 'A': bar = param;`
         // next to `default: bar = "safe";` leaves `bar` tainted on the 'A' path.
+        if (javaCatchLiteralHasTaintedTryArm(lines, i, variable, strLit, unreachableLines))
+            continue;
         if (siblingBranchAssignsNonLiteral(lines, i, variable, strLit, unreachableLines))
             continue;
         return true;
@@ -1512,6 +2507,46 @@ function matchingClose(lines, line, col) {
     }
     return null;
 }
+/**
+ * True when line `idx` is a literal assignment in a `catch` block and the
+ * paired `try` assigns `variable` a non-literal value (cognium-dev#753).
+ */
+function javaCatchLiteralHasTaintedTryArm(lines, idx, variable, strLit, unreachableLines) {
+    const block = enclosingBrace(lines, idx, 0);
+    if (!block || !/\bcatch\b/.test(block.header))
+        return false;
+    let h = block.headerLine;
+    while (h >= 0 && !/\btry\b/.test(lines[h]))
+        h--;
+    if (h < 0)
+        return false;
+    const tryIdx = lines[h].search(/\btry\b/);
+    let openLine = h;
+    let openCol = lines[h].indexOf('{', tryIdx);
+    if (openCol < 0) {
+        openLine = h + 1;
+        while (openLine < lines.length && lines[openLine].trim() === '')
+            openLine++;
+        if (openLine >= lines.length)
+            return false;
+        openCol = lines[openLine].indexOf('{');
+        if (openCol < 0)
+            return false;
+    }
+    const tryEnd = matchingClose(lines, openLine, openCol);
+    if (!tryEnd)
+        return false;
+    const assignTry = new RegExp(`(?:^|[^\\w.$])${variable}\\s*(?::?=)(?!=)\\s*(.*?)\\s*;?\\s*$`);
+    const literalOnly = new RegExp(`^${strLit}$`);
+    for (let i = openLine; i <= tryEnd.line; i++) {
+        if (unreachableLines?.has(i + 1))
+            continue;
+        const m = assignTry.exec(lines[i]);
+        if (m && m[1] && !literalOnly.test(m[1]))
+            return true;
+    }
+    return false;
+}
 /**
  * True when line `idx` assigns `variable` in one arm of a `switch` or one
  * branch of an `if`/`else` chain, and a sibling arm or branch assigns it a
@@ -1534,7 +2569,7 @@ function siblingBranchAssignsNonLiteral(lines, idx, variable, strLit, unreachabl
         block = enclosingBrace(lines, block.line, block.col);
     }
     if (!block)
-        return false;
+        return pythonSiblingBranchAssignsNonLiteral(lines, idx, variable, strLit, unreachableLines);
     let first = block.headerLine;
     let last;
     const end = matchingClose(lines, block.line, block.col);
@@ -1594,14 +2629,103 @@ function siblingBranchAssignsNonLiteral(lines, idx, variable, strLit, unreachabl
             last = next.line;
         }
     }
+    else if (/\bcatch\b/.test(block.header)) {
+        return javaCatchLiteralHasTaintedTryArm(lines, idx, variable, strLit, unreachableLines);
+    }
     else {
         return false;
     }
     const assign = new RegExp(`(?:^|[^\\w.$])${variable}\\s*(?::?=)(?!=)\\s*(.*?)\\s*;?\\s*(?:break\\s*;?)?\\s*$`);
     const literalOnly = new RegExp(`^${strLit}$`);
+    // For an if/else chain the literal's own arm is skipped: an earlier
+    // assignment in that same arm (`if (a) { if (b) x = input; x = "safe"; }`) is
+    // overwritten by the literal, it is not a sibling branch. A switch body shares
+    // one brace, so every line of it stays a sibling.
+    const isSwitch = /\bswitch\b/.test(block.header);
+    const ownStart = block.line;
+    const ownEnd = end.line;
     for (let i = first; i <= last; i++) {
         if (i === idx || unreachableLines?.has(i + 1))
             continue;
+        if (!isSwitch && i > ownStart && i < ownEnd)
+            continue;
+        const m = assign.exec(lines[i]);
+        if (m && m[1] && !literalOnly.test(m[1]))
+            return true;
+    }
+    return false;
+}
+const PY_ARM_OPEN = /^(?:(?:if|elif)\b.*|else\s*):\s*(?:#.*)?$/;
+/**
+ * The indentation-delimited counterpart of `siblingBranchAssignsNonLiteral`.
+ * The arms of one `if` / `elif` / `else` chain are the header lines at one
+ * indentation plus the more deeply indented lines under each. True when line
+ * `idx` sits directly in one arm of such a chain and another arm assigns
+ * `variable` a value that is not a string literal (cognium-dev#582). Answers
+ * false, keeping the literal as an overwrite, for anything else: a
+ * straight-line assignment, a `for` / `while` / `try` / `def` body, or a header
+ * that is not part of an `if` chain.
+ */
+function pythonSiblingBranchAssignsNonLiteral(lines, idx, variable, strLit, unreachableLines) {
+    const indentOf = (t) => t.length - t.trimStart().length;
+    const skippable = (t) => t.trim() === '' || t.trimStart().startsWith('#');
+    const own = lines[idx];
+    if (own === undefined)
+        return false;
+    const bodyIndent = indentOf(own);
+    if (bodyIndent === 0)
+        return false;
+    // The header of the arm that holds the literal: the nearest line above with less indentation.
+    let h = idx - 1;
+    while (h >= 0 && (skippable(lines[h]) || indentOf(lines[h]) >= bodyIndent))
+        h--;
+    if (h < 0 || !PY_ARM_OPEN.test(lines[h].trim()))
+        return false;
+    const armIndent = indentOf(lines[h]);
+    // The last line of the arm whose header is at `header`.
+    const armEnd = (header) => {
+        let lastBody = header;
+        for (let e = header + 1; e < lines.length; e++) {
+            if (skippable(lines[e]))
+                continue;
+            if (indentOf(lines[e]) <= armIndent)
+                break;
+            lastBody = e;
+        }
+        return lastBody;
+    };
+    // Walk up through `elif` / `else` to the opening `if`.
+    let first = h;
+    while (/^(?:elif\b|else\s*:)/.test(lines[first].trim())) {
+        let p = first - 1;
+        while (p >= 0 && (skippable(lines[p]) || indentOf(lines[p]) > armIndent))
+            p--;
+        if (p < 0 || indentOf(lines[p]) !== armIndent || !PY_ARM_OPEN.test(lines[p].trim()))
+            return false;
+        first = p;
+    }
+    if (!/^if\b/.test(lines[first].trim()))
+        return false;
+    // Walk down through the following `elif` / `else` arms.
+    const ownEnd = armEnd(h);
+    let last = ownEnd;
+    for (let guard = 0; guard < 64; guard++) {
+        let n = last + 1;
+        while (n < lines.length && skippable(lines[n]))
+            n++;
+        if (n >= lines.length || indentOf(lines[n]) !== armIndent)
+            break;
+        if (!/^(?:elif\b|else\s*:)/.test(lines[n].trim()) || !PY_ARM_OPEN.test(lines[n].trim()))
+            break;
+        last = armEnd(n);
+    }
+    const assign = new RegExp(`(?:^|[^\\w.$])${variable}\\s*(?::?=)(?!=)\\s*(.*?)\\s*;?\\s*$`);
+    const literalOnly = new RegExp(`^${strLit}$`);
+    for (let i = first; i <= last; i++) {
+        if (i === idx || unreachableLines?.has(i + 1))
+            continue;
+        if (i >= h && i <= ownEnd)
+            continue; // the literal's own arm is not a sibling
         const m = assign.exec(lines[i]);
         if (m && m[1] && !literalOnly.test(m[1]))
             return true;
@@ -1692,7 +2816,7 @@ export function maskStringLiteralsForTokenScan(expr) {
                     j++;
                 }
                 j++;
-                acc += ' ' + maskStringLiteralsForTokenScan(inner) + ' ';
+                acc += ' ' + maskStringLiteralsForTokenScan(pythonFStringExprOnly(inner)) + ' ';
                 continue;
             }
             j++;
@@ -1815,6 +2939,8 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
     // is every Juliet C# file.
     const csFnRanges = methodRanges(['csharp']);
     const csFnStart = (line) => enclosingStart(csFnRanges, line);
+    const jsFnRanges = methodRanges(['javascript', 'typescript']);
+    const jsFnStart = (line) => enclosingStart(jsFnRanges, line);
     // cognium-dev#548 — names declared as class fields. A field is the one kind
     // of variable whose value legitimately crosses from one method to another, so
     // the per-method gate below must not apply to it.
@@ -1885,6 +3011,15 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
                         anchor = s;
                 }
             }
+            // #515: real (non-derived) sources by variable name, earliest first, and
+            // the file's lines for reading each derivation's right-hand side.
+            const realSourceByVar = new Map();
+            for (const s of sourcesWithVar) {
+                const prev = realSourceByVar.get(s.variable);
+                if (!prev || s.line < prev.line)
+                    realSourceByVar.set(s.variable, s);
+            }
+            const codeLines = code.split('\n');
             for (const [varName, originLine] of derived) {
                 if (!varName || existingVars.has(varName))
                     continue;
@@ -1894,8 +3029,12 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
                 // `http_param` type — the for-loop / bare-inline patterns we want
                 // to recover here are all web-request-derived in practice.
                 if (hasRealSource && anchor) {
+                    // #515: anchor to the real source this derivation actually
+                    // references (through earlier derived vars); the earliest-source
+                    // anchor stays the fallback when none can be found.
+                    const referenced = resolvePythonDerivedAnchor(varName, derived, realSourceByVar, codeLines, new Set());
                     sourcesWithVar.push({
-                        ...anchor,
+                        ...(referenced ?? anchor),
                         variable: varName,
                     });
                 }
@@ -2245,6 +3384,9 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
         const aliases = csharpMethodScopedAliases(code, seeds, csMethods, csFieldNames);
         const fileAnchor = sourcesWithVar.reduce((a, sv) => (sv.line < a.line ? sv : a), sourcesWithVar[0]);
         const have = new Set(sourcesWithVar.map(sv => `${sv.variable}@${methodStartOf(sv.line)}`));
+        const seedVars = new Set(sourcesWithVar.map(s => s.variable));
+        const derivedForAnchor = buildJavaTaintedVars(code, seedVars);
+        const codeLinesForAnchor = code.split('\n');
         for (const alias of aliases) {
             const fn = methodStartOf(alias.line);
             const isField = csFieldNames.has(alias.variable);
@@ -2257,14 +3399,34 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
             // call), which also keeps it ahead of a sink in a method declared
             // earlier in the file than the method holding the source.
             const inMethod = sourcesWithVar.filter(sv => methodStartOf(sv.line) === fn && sv.line <= alias.line);
-            const from = !alias.carried && inMethod.length > 0
+            let from = !alias.carried && inMethod.length > 0
                 ? inMethod.reduce((a, sv) => (sv.line < a.line ? sv : a), inMethod[0])
                 : fileAnchor;
-            sourcesWithVar.push({
+            // cognium-dev#515: same RHS anchor as Java — do not credit an earlier decoy read.
+            if (!alias.carried && derivedForAnchor.size > 0) {
+                const methodRealSourceByVar = new Map();
+                for (const s of sourcesWithVar) {
+                    if (methodStartOf(s.line) !== fn)
+                        continue;
+                    const prev = methodRealSourceByVar.get(s.variable);
+                    if (!prev || s.line < prev.line)
+                        methodRealSourceByVar.set(s.variable, s);
+                }
+                const referenced = resolveJavaDerivedAnchor(alias.variable, derivedForAnchor, methodRealSourceByVar, codeLinesForAnchor, new Set());
+                if (referenced)
+                    from = referenced;
+            }
+            const aliasEntry = {
                 ...from,
                 variable: alias.variable,
                 ...(alias.carried || inMethod.length === 0 ? { line: alias.line } : {}),
-            });
+            };
+            // cognium-dev#327: field aliases must not keep the writing method's
+            // `in_method` tag — readers in other methods need to see the taint.
+            if (isField) {
+                delete aliasEntry.in_method;
+            }
+            sourcesWithVar.push(aliasEntry);
         }
     }
     else if ((language === 'java' || language === 'csharp') && typeof code === 'string' && sourcesWithVar.length > 0) {
@@ -2295,29 +3457,73 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
                 }
                 return null;
             };
+            const typeAt = (line) => {
+                for (const t of types ?? []) {
+                    if (line >= t.start_line && line <= t.end_line)
+                        return t;
+                }
+                return undefined;
+            };
+            const isDeclaredField = (line, name) => {
+                const t = typeAt(line);
+                return t?.fields?.some(f => f.name === name) ?? false;
+            };
             const existingVars = new Set(sourcesWithVar.map(s => s.variable));
+            const codeLines = code.split('\n');
+            const realSourceByVar = new Map();
+            for (const s of sourcesWithVar) {
+                const prev = realSourceByVar.get(s.variable);
+                if (!prev || s.line < prev.line)
+                    realSourceByVar.set(s.variable, s);
+            }
             for (const [varName, derivedLine] of derived) {
                 if (!varName || existingVars.has(varName))
                     continue;
                 const owner = methodAt(derivedLine);
+                const fieldAlias = isDeclaredField(derivedLine, varName);
                 let scopedAnchor = anchor;
                 if (owner) {
                     let best;
+                    const methodRealSourceByVar = new Map();
                     for (const s of sourcesWithVar) {
                         const sOwner = s.in_method ?? methodAt(s.line);
                         if (sOwner !== owner)
                             continue;
+                        const prev = methodRealSourceByVar.get(s.variable);
+                        if (!prev || s.line < prev.line)
+                            methodRealSourceByVar.set(s.variable, s);
                         if (!best || s.line < best.line)
                             best = s;
                     }
-                    if (best)
+                    const referenced = resolveJavaDerivedAnchor(varName, derived, methodRealSourceByVar, codeLines, new Set());
+                    if (referenced)
+                        scopedAnchor = referenced;
+                    else if (best)
                         scopedAnchor = best;
                 }
-                sourcesWithVar.push({
-                    ...scopedAnchor,
-                    variable: varName,
-                    ...(owner ? { in_method: owner } : {}),
-                });
+                // Keep scopedAnchor.line for in_method / preceding-source matching
+                // (#614). Pass derivedLine only for literal-kill (#753), so a safe
+                // sibling method's earlier sink cannot pick up this alias by line.
+                // cognium-dev#327: a declared field written from a method parameter
+                // must not inherit the writing method as `in_method` — same exemption
+                // as request sources on fields (4.12.0), so readers in other methods
+                // can see the taint.
+                if (fieldAlias) {
+                    const { in_method: _drop, ...rest } = scopedAnchor;
+                    sourcesWithVar.push({
+                        ...rest,
+                        variable: varName,
+                        literal_kill_line: derivedLine,
+                    });
+                }
+                else {
+                    sourcesWithVar.push({
+                        ...scopedAnchor,
+                        variable: varName,
+                        literal_kill_line: derivedLine,
+                        ...(owner ? { in_method: owner } : {}),
+                    });
+                }
                 existingVars.add(varName);
             }
         }
@@ -2331,7 +3537,217 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
     // tainted var (at the CommandText line) so the arg-scan links the Execute sink.
     if (language === 'csharp' && typeof code === 'string' && sourcesWithVar.length > 0) {
         const lines = code.split('\n');
-        const ctRe = /(\w+)\s*\.\s*CommandText\s*\+?=\s*(.+)/;
+        // cognium-dev#594: `X.StartInfo.FileName = <tainted>` is the same shape for a
+        // `System.Diagnostics.Process`: the executable path rides the process object
+        // and the zero-argument `X.Start()` is the injection point. Only the
+        // `FileName` write seeds it, and an `Arguments` write when the program is a
+        // shell (`ArgumentList` is a separate follow-up), so a constant `FileName`
+        // beside an unrelated tainted parameter stays clean.
+        // A write only: `+=` or a single `=` that is not part of `==`, `!=`, `<=`, `>=`
+        // (`if (p.StartInfo.FileName == tool)` is a comparison, not an assignment).
+        // `StartInfo.Arguments` seeds too, but only behind a shell (or a non-constant
+        // program), see `argumentsReachShell` below.
+        const ctRe = /(\w+)\s*\.\s*(?:CommandText|StartInfo\s*\.\s*(?:FileName|(Arguments)))\s*(?:\+=|(?<![=!<>])=(?!=))\s*(.+)/;
+        // cognium-dev#594: the same two writes on a local `ProcessStartInfo psi`
+        // (`psi.FileName = …`, `psi.Arguments = …`), read back by `Process.Start(psi)`.
+        // Gated on the receiver being declared as a `ProcessStartInfo`, so a `FileName`
+        // or `Arguments` property of any other type seeds nothing.
+        const psiVars = new Set();
+        for (const line of lines) {
+            for (const pm of line.matchAll(/\bProcessStartInfo\s+([\p{L}_][\p{L}\p{N}_]*)/gu))
+                psiVars.add(pm[1]);
+            for (const pm of line.matchAll(/\b([\p{L}_][\p{L}\p{N}_]*)\s*=\s*new\s+ProcessStartInfo\b/gu))
+                psiVars.add(pm[1]);
+        }
+        const psiRe = /(?<![\w.])(\w+)\s*\.\s*(?:FileName|(Arguments))\s*(?:\+=|(?<![=!<>])=(?!=))\s*(.+)/;
+        const psiOverwrittenByLiteral = (obj, prop, at) => {
+            const fn = csFnStart(at + 1);
+            const re = new RegExp(`(?<![\\w.])${obj}\\s*\\.\\s*${prop}\\s*=(?!=)\\s*@?"[^"]*"\\s*;\\s*(?://.*)?$`);
+            for (let j = at + 1; j < lines.length; j++) {
+                if (csFnStart(j + 1) !== fn)
+                    break;
+                if (re.test(lines[j]))
+                    return true;
+            }
+            return false;
+        };
+        const fileNameRe = (obj) => new RegExp(`\\b${obj}\\s*\\.\\s*(?:StartInfo\\s*\\.\\s*)?FileName\\s*=(?!=)\\s*(.+)`);
+        const shellProgramRe = /^(?:cmd|powershell|pwsh|sh|bash|zsh|dash|ksh|csh|tcsh|fish)(?:\.exe)?$/i;
+        // cognium-dev#594: with a constant, non-shell program the argument string is
+        // argv (the #272 / #328 safe shape), so a tainted `Arguments` does not by itself
+        // reach a shell. A constant shell program, or a program that is not a constant,
+        // lets the argument text choose what runs. No `FileName` write in the method
+        // (for example a `ProcessStartInfo` built elsewhere) seeds nothing.
+        const argumentsReachShell = (obj, line) => {
+            const re = fileNameRe(obj);
+            const fnStart = csFnStart(line);
+            for (let j = 0; j < lines.length; j++) {
+                if (csFnStart(j + 1) !== fnStart)
+                    continue;
+                const fm = re.exec(lines[j]);
+                if (!fm)
+                    continue;
+                const lit = /^\s*@?"([^"]*)"\s*;?\s*(?:\/\/.*)?$/.exec(fm[1]);
+                if (!lit)
+                    return true;
+                const base = lit[1].split(/[\\/]/).pop() ?? '';
+                return shellProgramRe.test(base);
+            }
+            return false;
+        };
+        // cognium-dev#594: `X.StartInfo.ArgumentList.Add(<tainted>)` (or `psi.ArgumentList.Add(…)`
+        // on a local `ProcessStartInfo`) is argv, so it only reaches a command when the
+        // program is a shell that is told to run a command string. Seed only when the
+        // method writes `FileName` exactly once, to a constant shell program, and an
+        // `ArgumentList.Add` of a command flag (`-c`, `/c`, …) is in the same method.
+        // A non-constant or non-shell program, a second `FileName` write, an
+        // `ArgumentList.Clear()`, or an `Add(` that wraps over several lines seeds nothing.
+        const argListRe = /(?<![\w.])(\w+)\s*\.\s*(StartInfo\s*\.\s*)?ArgumentList\s*\.\s*Add\s*\(\s*(.+?)\s*\)\s*;?\s*(?:\/\/.*)?$/;
+        const shellFlagRe = /^(?:[-/](?:c|k|command|encodedcommand|ec))$/i;
+        // cognium-dev#750: the program may also be written by the `ProcessStartInfo`
+        // constructor's single argument or by a `FileName = …` entry of its object
+        // initializer, on the statement that creates `obj` (`var psi = new
+        // ProcessStartInfo("/bin/sh");`, `new ProcessStartInfo { FileName = "/bin/sh",
+        // … }`, possibly wrapped over several lines). Each counts as one `FileName`
+        // write, so the exactly-one-write rule still holds, and they apply only when the
+        // method has no explicit `obj.FileName = …` write. Any shape that is not
+        // plainly one constant program (two constructor arguments, an `Arguments`
+        // entry, a non-literal value) counts as a non-constant write.
+        const splitTopLevel = (text) => {
+            const parts = [];
+            let depth = 0;
+            let quote = '';
+            let cur = '';
+            for (let k = 0; k < text.length; k++) {
+                const ch = text[k];
+                if (quote) {
+                    cur += ch;
+                    if (ch === '\\' && quote === '"') {
+                        cur += text[++k] ?? '';
+                        continue;
+                    }
+                    if (ch === quote)
+                        quote = '';
+                    continue;
+                }
+                if (ch === '"') {
+                    quote = ch;
+                    cur += ch;
+                    continue;
+                }
+                if (ch === '(' || ch === '{' || ch === '[')
+                    depth++;
+                if (ch === ')' || ch === '}' || ch === ']')
+                    depth--;
+                if (ch === ',' && depth === 0) {
+                    parts.push(cur.trim());
+                    cur = '';
+                    continue;
+                }
+                cur += ch;
+            }
+            if (cur.trim())
+                parts.push(cur.trim());
+            return parts;
+        };
+        const constLiteral = (expr) => {
+            const m = /^@?"([^"]*)"$/.exec(expr.trim());
+            return m ? (m[1].split(/[\\/]/).pop() ?? '') : null;
+        };
+        // Returns null when line j does not create `obj` or the creation writes no program.
+        const startInfoCreation = (obj, j) => {
+            const head = new RegExp(`(?<![\\w.])${obj}(?:\\s*\\.\\s*StartInfo)?\\s*=(?!=)\\s*new\\s+ProcessStartInfo\\b`).exec(lines[j]);
+            if (!head)
+                return null;
+            let text = '';
+            for (let k = j; k < lines.length && k < j + 40; k++) {
+                text += (k === j ? lines[k].slice(head.index) : ' ' + lines[k]).replace(/\/\/.*$/, '');
+                if (text.includes(';'))
+                    break;
+            }
+            const m = /new\s+ProcessStartInfo\s*(?:\(([^()]*)\))?\s*(?:\{([\s\S]*)\})?\s*;/.exec(text);
+            if (!m)
+                return { program: null };
+            let program;
+            const ctorArgs = splitTopLevel(m[1] ?? '');
+            if (ctorArgs.length > 1)
+                return { program: null };
+            if (ctorArgs.length === 1)
+                program = constLiteral(ctorArgs[0]);
+            for (const member of splitTopLevel(m[2] ?? '')) {
+                const em = /^(\w+)\s*=(?!=)\s*([\s\S]*)$/.exec(member);
+                if (!em)
+                    return { program: null };
+                if (em[1] === 'FileName') {
+                    if (program !== undefined)
+                        return { program: null };
+                    program = constLiteral(em[2]);
+                }
+                else if (em[1] === 'Arguments' || em[1] === 'ArgumentList') {
+                    return { program: null };
+                }
+            }
+            return program === undefined ? null : { program };
+        };
+        const constStringFieldProgram = (fieldName) => {
+            const declRe = new RegExp(`\\b(?:\\w+\\s+)*const\\s+string\\s+${fieldName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=\\s*@?"([^"]*)"\\s*;`);
+            let hits = 0;
+            let base = null;
+            for (const srcLine of lines) {
+                const dm = declRe.exec(srcLine);
+                if (!dm)
+                    continue;
+                hits++;
+                base = dm[1].split(/[\\/]/).pop() ?? '';
+            }
+            return hits === 1 ? base : null;
+        };
+        const argListReachesShell = (obj, line) => {
+            const fnStart = csFnStart(line);
+            const nameRe = fileNameRe(obj);
+            const clearRe = new RegExp(`(?<![\\w.])${obj}\\s*\\.\\s*(?:StartInfo\\s*\\.\\s*)?ArgumentList\\s*\\.\\s*(?:Clear|Remove\\w*|Insert\\w*)\\s*\\(`);
+            const addRe = new RegExp(`(?<![\\w.])${obj}\\s*\\.\\s*(?:StartInfo\\s*\\.\\s*)?ArgumentList\\s*\\.\\s*Add\\s*\\(\\s*@?"([^"]*)"\\s*\\)`);
+            let program = null;
+            let writes = 0;
+            let creations = 0;
+            let createdProgram = null;
+            let flag = false;
+            for (let j = 0; j < lines.length; j++) {
+                if (csFnStart(j + 1) !== fnStart)
+                    continue;
+                if (clearRe.test(lines[j]))
+                    return false;
+                const fm = nameRe.exec(lines[j]);
+                if (fm) {
+                    writes++;
+                    const lit = /^\s*@?"([^"]*)"\s*;?\s*(?:\/\/.*)?$/.exec(fm[1]);
+                    if (lit) {
+                        program = lit[1].split(/[\\/]/).pop() ?? '';
+                    }
+                    else {
+                        const id = /^\s*(\w+)\s*;?\s*(?:\/\/.*)?$/.exec(fm[1]);
+                        program = id ? constStringFieldProgram(id[1]) : null;
+                    }
+                }
+                const created = startInfoCreation(obj, j);
+                if (created) {
+                    creations++;
+                    createdProgram = created.program;
+                }
+                const am = addRe.exec(lines[j]);
+                if (am && shellFlagRe.test(am[1]))
+                    flag = true;
+            }
+            // An explicit `obj.FileName = …` decides the program, as before. Only when the
+            // method has none does the creating statement's constant program count, and
+            // then it must be the only creation (a second `new ProcessStartInfo(…)` for
+            // the same variable could replace it).
+            if (writes === 0 && creations > 0) {
+                writes = creations;
+                program = createdProgram;
+            }
+            return writes === 1 && program !== null && shellProgramRe.test(program) && flag;
+        };
         // cognium-dev#548: seed per method, from sources in that method. The seed
         // used to be made once per file and matched by name, so `cmd.CommandText =
         // … + data` in `Bad()` tainted `cmd.ExecuteScalar()` in `GoodG2B()`, whose
@@ -2344,15 +3760,60 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
             added = false;
             guard++;
             for (let i = 0; i < lines.length; i++) {
-                const m = ctRe.exec(lines[i]);
+                const am = argListRe.exec(lines[i]);
+                if (am) {
+                    const [, aobj, viaStartInfo, aargs] = am;
+                    const akey = `${aobj}@${csFnStart(i + 1)}`;
+                    if ((viaStartInfo || psiVars.has(aobj)) && !seeded.has(akey) && argListReachesShell(aobj, i + 1)) {
+                        // A value set to a literal after the source and before this `Add` no longer
+                        // carries it (`cmd = name; cmd = "uptime"; …Add(cmd)`).
+                        const literalSince = (v, from) => {
+                            const re = new RegExp(`(?<![\\w.])${v.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=(?!=)\\s*@?"[^"]*"\\s*;`);
+                            const fn = csFnStart(i + 1);
+                            for (let j = from; j < i; j++)
+                                if (csFnStart(j + 1) === fn && re.test(lines[j]))
+                                    return true;
+                            return false;
+                        };
+                        const reachableA = sourcesWithVar.filter(sv => sv.line <= i + 1 && !csDifferentMethod(sv.variable, sv.line, i + 1) && !literalSince(sv.variable, sv.line));
+                        const maskedArg = aargs.replace(/\b(?:int|uint|long|ulong|short|ushort|byte|double|float|decimal|bool|Int16|Int32|Int64|Double|Decimal|Boolean|Guid)\s*\.\s*(?:Try)?Parse\s*\((?:[^()]|\([^()]*\))*\)|\bConvert\s*\.\s*To(?:Int16|Int32|Int64|Double|Decimal|Boolean|Byte)\s*\((?:[^()]|\([^()]*\))*\)/g, '0');
+                        if (reachableA.length > 0 && argsReferenceTaintedVar(maskedArg, reachableA)) {
+                            const fromA = reachableA.reduce((a, sv) => (sv.line < a.line ? sv : a), reachableA[0]);
+                            sourcesWithVar.push({ ...fromA, variable: aobj, line: i + 1 });
+                            seeded.add(akey);
+                            added = true;
+                        }
+                    }
+                    continue;
+                }
+                let m = ctRe.exec(lines[i]);
+                let viaLocal = false;
+                if (!m) {
+                    const pm = psiRe.exec(lines[i]);
+                    if (pm && psiVars.has(pm[1])) {
+                        m = pm;
+                        viaLocal = true;
+                    }
+                }
                 if (!m)
                     continue;
-                const [, obj, rhs] = m;
+                const [, obj, isArguments, rhs] = m;
+                // A later plain-literal write of the same property in this method replaces
+                // the tainted value before `Process.Start(psi)` reads it: do not credit it.
+                if (viaLocal && psiOverwrittenByLiteral(obj, isArguments ? 'Arguments' : 'FileName', i))
+                    continue;
                 const key = `${obj}@${csFnStart(i + 1)}`;
                 if (seeded.has(key))
                     continue;
+                if (isArguments && !argumentsReachShell(obj, i + 1))
+                    continue;
                 const reachable = sourcesWithVar.filter(sv => sv.line <= i + 1 && !csDifferentMethod(sv.variable, sv.line, i + 1));
-                if (reachable.length === 0 || !argsReferenceTaintedVar(rhs, reachable))
+                // A value converted to a number / Guid / bool cannot carry a command; the
+                // local-`psi` form masks such conversions so a raw operand beside one still counts.
+                const rhsForTaint = viaLocal
+                    ? rhs.replace(/\b(?:int|uint|long|ulong|short|ushort|byte|double|float|decimal|bool|Int16|Int32|Int64|Double|Decimal|Boolean|Guid)\s*\.\s*(?:Try)?Parse\s*\((?:[^()]|\([^()]*\))*\)|\bConvert\s*\.\s*To(?:Int16|Int32|Int64|Double|Decimal|Boolean|Byte)\s*\((?:[^()]|\([^()]*\))*\)/g, '0')
+                    : rhs;
+                if (reachable.length === 0 || !argsReferenceTaintedVar(rhsForTaint, reachable))
                     continue;
                 const from = reachable.reduce((a, sv) => (sv.line < a.line ? sv : a), reachable[0]);
                 sourcesWithVar.push({ ...from, variable: obj, line: i + 1 });
@@ -2552,6 +4013,19 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
                         if (srcFn !== -1 && sinkFn !== -1 && srcFn !== sinkFn)
                             continue;
                     }
+                    // cognium-dev#752: GraphQL resolver args are seeded by name only; scope
+                    // them to the resolver (or factory) they came from so a same-named
+                    // local in another recorded function does not inherit the seed.
+                    if (jsFnRanges.length > 0 &&
+                        typeof source.location === 'string' &&
+                        source.location.startsWith('GraphQL ')) {
+                        const sinkFn = jsFnStart(sink.line);
+                        if (sinkFn !== -1) {
+                            const range = jsFnRanges.find(([start]) => start === sinkFn);
+                            if (range && (source.line < range[0] || source.line > range[1]))
+                                continue;
+                        }
+                    }
                     // cognium-dev#530: a builder-seeded source must not escape its method.
                     // The seed stands for "this StringBuilder now holds tainted text",
                     // which is true only of the one object in the one method where the
@@ -2605,14 +4079,16 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
                     if (aliasSanitizedFor.get(source.variable)?.has(sink.type)) {
                         break;
                     }
-                    // Sprint 9 #58.3 / #56: between source.line and sink.line, if
-                    // the tainted variable is reassigned to a pure string literal
-                    // (either naked `var = "lit"` or guarded by an allowlist check
-                    // such as `if (!ALLOWLIST.contains(var)) var = "lit"` /
+                    // Sprint 9 #58.3 / #56: between the alias derivation (or source)
+                    // line and sink.line, if the tainted variable is reassigned to a
+                    // pure string literal (either naked `var = "lit"` or guarded by an
+                    // allowlist check such as `if (!ALLOWLIST.contains(var)) var = "lit"` /
                     // `if var not in ALLOWLIST: var = "lit"`), the original taint
-                    // no longer reaches the sink — suppress the flow.
+                    // no longer reaches the sink — suppress the flow. Derived aliases
+                    // carry `literal_kill_line` so kill starts at the assignment that
+                    // created them (#753), while `source.line` stays on the anchor (#614).
                     if (typeof code === 'string' &&
-                        isReassignedToLiteralBetween(code, source.variable, source.line, sink.line, unreachableLines)) {
+                        isReassignedToLiteralBetween(code, source.variable, source.literal_kill_line ?? source.line, sink.line, unreachableLines)) {
                         break;
                     }
                     // Note: DFG-flow filter handles sanitizer-guard suppression
@@ -2635,6 +4111,73 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
             }
         }
     }
+    // cognium-dev#490 — same helper as `splitCSharpDepth0Statements` in language-sources-pass.
+    const splitCSharpDepth0Statements = (line) => {
+        if (line.includes('{'))
+            return [line];
+        const statements = [];
+        let start = 0;
+        let depth = 0;
+        let inStr = null;
+        let esc = false;
+        for (let i = 0; i < line.length; i++) {
+            const c = line[i];
+            if (inStr) {
+                if (esc) {
+                    esc = false;
+                    continue;
+                }
+                if (c === '\\') {
+                    esc = true;
+                    continue;
+                }
+                if (c === inStr)
+                    inStr = null;
+                continue;
+            }
+            if (c === '"' || c === "'") {
+                inStr = c;
+                continue;
+            }
+            if (c === '(' || c === '[')
+                depth++;
+            else if (c === ')' || c === ']')
+                depth = Math.max(0, depth - 1);
+            else if (c === ';' && depth === 0) {
+                const part = line.slice(start, i + 1).trim();
+                if (part)
+                    statements.push(part);
+                start = i + 1;
+            }
+        }
+        const tail = line.slice(start).trim();
+        if (tail)
+            statements.push(tail);
+        return statements.length > 1 ? statements : [line];
+    };
+    const boundInEarlierStatement = (code, variable, sinkMethod) => {
+        if (!variable || variable === '<inline>' || !sinkMethod)
+            return false;
+        const stmts = splitCSharpDepth0Statements(code);
+        if (stmts.length < 2)
+            return false;
+        const methodRe = new RegExp(`\\b${sinkMethod.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*\\(`);
+        let sinkIdx = -1;
+        for (let i = 0; i < stmts.length; i++) {
+            if (methodRe.test(stmts[i])) {
+                sinkIdx = i;
+                break;
+            }
+        }
+        if (sinkIdx <= 0)
+            return false;
+        const varAssign = new RegExp(`\\b${variable.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=(?!=)`);
+        for (let i = 0; i < sinkIdx; i++) {
+            if (varAssign.test(stmts[i]))
+                return true;
+        }
+        return false;
+    };
     // cognium-dev #83: inline-source colocation.
     //
     // When a source expression is used INLINE as a sink argument — e.g.
@@ -2723,6 +4266,9 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
                 if (new RegExp(`\\b${sourceVar.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`).test(rhs)) {
                     continue;
                 }
+                if (boundInEarlierStatement(sinkCode, sourceVar, sink.method)) {
+                    continue;
+                }
             }
             // Skip the degenerate `file_input` → `path_traversal` colocation
             // where the source and sink describe the SAME call (one being the