circle-ir 4.14.2 → 4.16.0

package/dist/analysis/scalar-derivation.js

@@ -0,0 +1,368 @@
+/**
+ * Scalar-derivation taint barrier (#568, parent #349).
+ *
+ * A local whose whole initializer measures or tests a value — its length, a
+ * match count, a boolean from a regex test or a containment check — holds an
+ * integer or a boolean. That value carries the magnitude of the input, not
+ * its content, so it cannot deliver a string payload to an injection sink.
+ *
+ * This is a type rule, not sanitizer credit for the call: a string-returning
+ * matcher (`re.FindString(text)`, `text.match(re)`) still propagates taint.
+ * Numeric parses (`strconv.Atoi`, `parseInt`) are not covered here; a parsed
+ * number is attacker-chosen and stays tainted for size-sensitive consumers.
+ *
+ * The test reads the definition's own line. An initializer that is not a
+ * single complete expression on that line is not credited.
+ */
+/** Go calls that return an int or a bool computed from their argument. */
+const GO_SCALAR_FUNCS = new Set(['len', 'utf8.RuneCountInString', 'utf8.RuneCount']);
+/** `strings.X` / `bytes.X` functions with an int or bool result. */
+const GO_STRINGS_SCALAR = new Set([
+    'Contains', 'ContainsAny', 'ContainsRune', 'HasPrefix', 'HasSuffix', 'EqualFold',
+    'Count', 'Index', 'IndexAny', 'IndexByte', 'IndexRune', 'LastIndex', 'Compare',
+]);
+/** `*regexp.Regexp` methods with a bool result, on any receiver. */
+const GO_REGEXP_BOOL = new Set(['MatchString', 'Match']);
+/**
+ * JS/TS members that yield a number or a boolean. `search` is left out: on
+ * search-index objects (`idx.search(q)`) it returns result data, not a number.
+ */
+const JS_SCALAR_METHODS = new Set([
+    'test', 'includes', 'startsWith', 'endsWith', 'indexOf', 'lastIndexOf',
+]);
+function scalarLanguage(language) {
+    return language === 'go' || language === 'javascript' || language === 'typescript' ? language : null;
+}
+/**
+ * Split `expr` at depth 0 into its trailing segment. Returns null when the
+ * expression is not one postfix chain (an operator, a comma, whitespace or an
+ * unbalanced bracket at depth 0).
+ *
+ * The result names the last member, whether the chain ends in a call of it,
+ * and `head`, the chain text before that call (or before `.member`). A JS
+ * regex literal may open the chain (`/^\d+$/.test(x)`).
+ */
+function lastChainSegment(expr) {
+    let depth = 0;
+    let lastDot = -1;
+    let lastGroupOpen = -1;
+    let endsWithGroup = false;
+    let start = 0;
+    if (expr.startsWith('/')) {
+        let inClass = false;
+        let j = 1;
+        for (; j < expr.length; j++) {
+            const ch = expr[j];
+            if (ch === '\\') {
+                j++;
+                continue;
+            }
+            if (ch === '[')
+                inClass = true;
+            else if (ch === ']')
+                inClass = false;
+            else if (ch === '/' && !inClass)
+                break;
+        }
+        if (j >= expr.length)
+            return null;
+        start = j + 1;
+    }
+    for (let i = start; i < expr.length; i++) {
+        const c = expr[i];
+        if (c === '"' || c === "'" || c === '`') {
+            if (c === '`' && depth === 0)
+                return null; // template text may interpolate
+            let j = i + 1;
+            for (; j < expr.length && expr[j] !== c; j++)
+                if (expr[j] === '\\')
+                    j++;
+            if (j >= expr.length)
+                return null;
+            i = j;
+            endsWithGroup = false;
+            continue;
+        }
+        if (c === '(' || c === '[' || c === '{') {
+            if (depth === 0)
+                lastGroupOpen = i;
+            depth++;
+            continue;
+        }
+        if (c === ')' || c === ']' || c === '}') {
+            depth--;
+            if (depth < 0)
+                return null;
+            if (depth === 0)
+                endsWithGroup = true;
+            continue;
+        }
+        if (depth > 0)
+            continue;
+        if (c === '.') {
+            // `?.` optional chaining is still one chain
+            lastDot = i;
+            endsWithGroup = false;
+            continue;
+        }
+        if (c === '?' && expr[i + 1] === '.')
+            continue;
+        if (/[\w$]/.test(c)) {
+            endsWithGroup = false;
+            continue;
+        }
+        return null;
+    }
+    if (depth !== 0)
+        return null;
+    if (endsWithGroup) {
+        // Trailing `( … )` must be the call of the last member.
+        if (expr[lastGroupOpen] !== '(')
+            return null;
+        const callee = expr.slice(0, lastGroupOpen).replace(/\?$/, '');
+        const m = /(?:^|\.)([\w$]+)$/.exec(callee);
+        if (!m || lastDot > lastGroupOpen)
+            return null;
+        return { member: m[1], isCall: true, head: callee };
+    }
+    const m = /\.([\w$]+)$/.exec(expr);
+    if (!m)
+        return null;
+    return { member: m[1], isCall: false, head: expr.slice(0, expr.length - m[0].length) };
+}
+/** True when `rhs` is a whole-expression measure or test of a value. */
+export function isScalarDerivation(rhs, language) {
+    const lang = scalarLanguage(language);
+    if (!lang)
+        return false;
+    let e = rhs.trim();
+    // A leading negation keeps a boolean a boolean.
+    while (e.startsWith('!'))
+        e = e.slice(1).trim();
+    if (e.length === 0)
+        return false;
+    const seg = lastChainSegment(e);
+    if (!seg)
+        return false;
+    if (lang === 'go') {
+        if (!seg.isCall)
+            return false;
+        if (GO_SCALAR_FUNCS.has(seg.head))
+            return true;
+        const pkg = /^(strings|bytes)\.(\w+)$/.exec(seg.head);
+        if (pkg)
+            return GO_STRINGS_SCALAR.has(pkg[2]);
+        return seg.head.includes('.') && GO_REGEXP_BOOL.has(seg.member);
+    }
+    if (!seg.isCall)
+        return seg.member === 'length';
+    return seg.head.includes('.') && JS_SCALAR_METHODS.has(seg.member);
+}
+/**
+ * The initializer of a single-variable local declared or assigned on `line`,
+ * or null when the line is not a complete single-target assignment of `name`.
+ */
+function initializerOf(line, name, lang) {
+    const esc = name.replace(/[$]/g, '\\$');
+    const code = line.replace(/\s*\/\/.*$/, '').trim().replace(/;$/, '').trim();
+    const re = lang === 'go'
+        ? new RegExp(`^(?:var\\s+)?${esc}(?:\\s+\\w+)?\\s*(?::=|=)\\s*(.+)$`)
+        : new RegExp(`^(?:(?:const|let|var)\\s+)?${esc}(?:\\s*:\\s*(?:number|boolean))?\\s*=(?!=)\\s*(.+)$`);
+    const m = re.exec(code);
+    return m ? m[1] : null;
+}
+/**
+ * DFG def ids whose value is an integer or boolean derived from another value
+ * by a whole-expression measure or test. Taint does not flow into these defs.
+ */
+export function scalarDerivedDefIds(defs, code, language) {
+    const out = new Set();
+    const lang = scalarLanguage(language);
+    if (!lang)
+        return out;
+    const lines = code.split('\n');
+    for (const def of defs) {
+        if (def.kind !== 'local')
+            continue;
+        const text = lines[def.line - 1];
+        if (text === undefined)
+            continue;
+        const rhs = initializerOf(text, def.variable, lang);
+        if (rhs !== null && isScalarDerivation(rhs, lang))
+            out.add(def.id);
+    }
+    return out;
+}
+/** An integer literal, optionally with `_` separators or a hex/binary/octal prefix. */
+const GO_INT_LITERAL = /^(?:0[xX][0-9a-fA-F_]+|0[bB][01_]+|0[oO]?[0-7_]+|[1-9][0-9_]*|0)$/;
+/** Braces in a Go line, with string, rune and raw-string literals blanked out. */
+function goBraceText(text) {
+    return text.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|`[^`]*`/g, '""');
+}
+/**
+ * Names `n` bounded by `if <... n > K | n >= K ...> { ...; return|panic|continue }`
+ * in `lines[from .. to)` where the guard still dominates line `to`. The condition
+ * may join the bound with `||` only: under `&&` the branch would not reject every
+ * large value. K is an integer literal or a name in `consts` (a same-file integer
+ * `const`, see `goIntConstNames`).
+ *
+ * A guard only holds while the block it sits in is open: once the brace depth
+ * falls below the guard's depth (the enclosing `if`, loop, closure or `else`
+ * branch closed), or a new `case`/`default` clause of the same switch starts,
+ * other paths reach `to` without passing the guard. A write to `n` after the
+ * guard (`n = …`, `n op= …`, `n++`, `n--`, or `&n` handed to a callee such as
+ * `fmt.Sscanf`) voids every bound on it.
+ */
+function goUpperBoundGuardedAt(lines, from, to, name, consts) {
+    const esc = name.replace(/[$]/g, '\\$');
+    const bound = new RegExp(`^\\(*\\s*${esc}\\s*>=?\\s*([\\w]+)\\s*\\)*$`);
+    const reassign = new RegExp(`(?:^|[\\s,;(])${esc}(?:\\s*,\\s*\\w+)*\\s*(?::=|=(?!=)|\\+=|-=|\\*=|/=|%=|&=|\\|=|\\^=|&\\^=|<<=|>>=)` +
+        `|(?<![\\w.])${esc}\\s*(?:\\+\\+|--)` +
+        `|(?<![&\\w])&\\s*${esc}\\b`);
+    // Depth (in braces) of each guard still in force, in source order.
+    let guards = [];
+    let depth = 0;
+    for (let i = from; i < to; i++) {
+        const text = lines[i].replace(/\s*\/\/.*$/, '').trim();
+        if (guards.length > 0 && reassign.test(text))
+            guards = [];
+        const ifm = /^if\s+(.+?)\s*\{$/.exec(text);
+        if (ifm && i + 1 < to) {
+            const cond = ifm[1];
+            if (!cond.includes('&&')) {
+                const parts = cond.split('||').map((p) => p.trim());
+                const hit = parts.some((p) => {
+                    const m = bound.exec(p);
+                    return m !== null && (GO_INT_LITERAL.test(m[1]) || consts.has(m[1]));
+                });
+                if (hit) {
+                    // The guard block must end in an exit before its closing brace.
+                    let inner = 1;
+                    let last = '';
+                    let j = i + 1;
+                    for (; j < to; j++) {
+                        const t = lines[j].replace(/\s*\/\/.*$/, '').trim();
+                        for (const ch of goBraceText(t))
+                            inner += ch === '{' ? 1 : ch === '}' ? -1 : 0;
+                        if (inner <= 0)
+                            break;
+                        if (t)
+                            last = t;
+                    }
+                    if (inner <= 0 && /^(?:return\b|panic\(|continue\b)/.test(last)) {
+                        // The block opened and closed on lines i..j; depth is unchanged.
+                        guards.push(depth);
+                        i = j;
+                        continue;
+                    }
+                }
+            }
+        }
+        if (guards.length > 0 && /^(?:case\b.*|default\s*):$/.test(text)) {
+            guards = guards.filter((d) => d < depth);
+        }
+        for (const ch of goBraceText(text)) {
+            if (ch === '{')
+                depth++;
+            else if (ch === '}') {
+                depth--;
+                if (guards.length > 0)
+                    guards = guards.filter((d) => d <= depth);
+            }
+        }
+    }
+    return guards.length > 0;
+}
+/**
+ * Names declared exactly once in the file, as a package- or function-level
+ * `const NAME [type] = <integer literal>` (alone or inside a `const ( … )` block),
+ * and never otherwise defined: no `:=` or `var` of the same name, no parameter,
+ * result or range variable of that name, no second `const` of it. A name that
+ * could be shadowed by a variable is not a constant bound.
+ */
+function goIntConstNames(lines) {
+    const decl = /^(?:const\s+)?([A-Za-z_]\w*)(?:\s+[\w.]+)?\s*=\s*([\w]+)\s*$/;
+    const found = new Map();
+    let inBlock = false;
+    const declLines = new Set();
+    for (let i = 0; i < lines.length; i++) {
+        const text = lines[i].replace(/\s*\/\/.*$/, '').trim();
+        if (inBlock) {
+            if (text === ')') {
+                inBlock = false;
+                continue;
+            }
+            const m = decl.exec(text);
+            if (m && GO_INT_LITERAL.test(m[2]) && !/^const\b/.test(text)) {
+                found.set(m[1], (found.get(m[1]) ?? 0) + 1);
+                declLines.add(i);
+            }
+            continue;
+        }
+        if (/^const\s*\($/.test(text)) {
+            inBlock = true;
+            continue;
+        }
+        if (/^const\s/.test(text)) {
+            const m = decl.exec(text);
+            if (m && GO_INT_LITERAL.test(m[2])) {
+                found.set(m[1], (found.get(m[1]) ?? 0) + 1);
+                declLines.add(i);
+            }
+        }
+    }
+    const out = new Set();
+    for (const [name, count] of found) {
+        if (count !== 1)
+            continue;
+        const esc = name.replace(/[$]/g, '\\$');
+        const other = new RegExp(`(?:^|[\\s,(])${esc}(?:\\s*,\\s*[\\w]+)*\\s*(?::=|=(?!=))` +
+            `|\\b(?:var|const|type|func)\\s+${esc}\\b` +
+            `|[(,]\\s*${esc}(?:\\s*,\\s*\\w+)*\\s+[\\w*\\[.]`);
+        const shadowed = lines.some((l, i) => {
+            if (declLines.has(i))
+                return false;
+            const t = l.replace(/\s*\/\/.*$/, '');
+            return new RegExp(`(?<![\\w.])${esc}(?![\\w])`).test(t) && other.test(t);
+        });
+        if (!shadowed)
+            out.add(name);
+    }
+    return out;
+}
+/**
+ * DFG def ids of a Go local initialised by `make(<type>, <len>[, <cap>])` whose
+ * every size argument is an integer literal or a variable rejected above a
+ * constant earlier in the same function (`if n > K { return }`). The buffer
+ * holds zero values; its size is bounded, so the request text that chose the
+ * size does not reach a sink through it. An unbounded size is not credited.
+ */
+export function boundedMakeDefIds(defs, code, language) {
+    const out = new Set();
+    if (language !== 'go')
+        return out;
+    const lines = code.split('\n');
+    const consts = goIntConstNames(lines);
+    for (const def of defs) {
+        if (def.kind !== 'local')
+            continue;
+        const text = lines[def.line - 1];
+        if (text === undefined)
+            continue;
+        const rhs = initializerOf(text, def.variable, 'go');
+        const mk = rhs === null ? null : /^make\(\s*(\[\][\w.*]+|map\[[^\]]+\][\w.*]+)\s*,\s*([^()]*?)\s*\)$/.exec(rhs);
+        if (!mk)
+            continue;
+        const sizes = mk[2].split(',').map((s) => s.trim());
+        if (sizes.length > 2 || sizes.some((s) => s === ''))
+            continue;
+        let fnStart = def.line - 1;
+        while (fnStart > 0 && !/^func\b/.test(lines[fnStart]))
+            fnStart--;
+        const ok = sizes.every((s) => GO_INT_LITERAL.test(s) || (/^[A-Za-z_]\w*$/.test(s) && goUpperBoundGuardedAt(lines, fnStart, def.line - 1, s, consts)));
+        if (ok)
+            out.add(def.id);
+    }
+    return out;
+}
+//# sourceMappingURL=scalar-derivation.js.map

package/dist/analysis/scalar-derivation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scalar-derivation.js","sourceRoot":"","sources":["../../src/analysis/scalar-derivation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,0EAA0E;AAC1E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,wBAAwB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AACrF,oEAAoE;AACpE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,UAAU,EAAE,aAAa,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW;IAChF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS;CAC/E,CAAC,CAAC;AACH,oEAAoE;AACpE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC;AAEzD;;;GAGG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa;CACvE,CAAC,CAAC;AAIH,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACvG,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;IACjB,IAAI,aAAa,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;YACpB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAAC,CAAC,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YACnC,IAAI,EAAE,KAAK,GAAG;gBAAE,OAAO,GAAG,IAAI,CAAC;iBAC1B,IAAI,EAAE,KAAK,GAAG;gBAAE,OAAO,GAAG,KAAK,CAAC;iBAChC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO;gBAAE,MAAM;QACzC,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAClC,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,CAAC,gCAAgC;YAC3E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE;gBAAE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,CAAC,EAAE,CAAC;YACxE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAClC,CAAC,GAAG,CAAC,CAAC;YACN,aAAa,GAAG,KAAK,CAAC;YACtB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,IAAI,KAAK,KAAK,CAAC;gBAAE,aAAa,GAAG,CAAC,CAAC;YACnC,KAAK,EAAE,CAAC;YACR,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3B,IAAI,KAAK,KAAK,CAAC;gBAAE,aAAa,GAAG,IAAI,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS;QACxB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,4CAA4C;YAC5C,OAAO,GAAG,CAAC,CAAC;YACZ,aAAa,GAAG,KAAK,CAAC;YACtB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;YAAE,SAAS;QAC/C,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACpB,aAAa,GAAG,KAAK,CAAC;YACtB,SAAS;QACX,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7B,IAAI,aAAa,EAAE,CAAC;QAClB,wDAAwD;QACxD,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/D,MAAM,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC,IAAI,OAAO,GAAG,aAAa;YAAE,OAAO,IAAI,CAAC;QAC/C,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,QAAgB;IAC9D,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACnB,gDAAgD;IAChD,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC9B,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,GAAG,GAAG,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,GAAG;YAAE,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;QAC/C,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC;IAChD,OAAO,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,IAAY,EAAE,IAAU;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5E,MAAM,EAAE,GAAG,IAAI,KAAK,IAAI;QACtB,CAAC,CAAC,IAAI,MAAM,CAAC,gBAAgB,GAAG,oCAAoC,CAAC;QACrE,CAAC,CAAC,IAAI,MAAM,CAAC,8BAA8B,GAAG,qDAAqD,CAAC,CAAC;IACvG,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAuB,EAAE,IAAY,EAAE,QAAgB;IACzF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC;IACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,GAAG,KAAK,IAAI,IAAI,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,uFAAuF;AACvF,MAAM,cAAc,GAAG,mEAAmE,CAAC;AAE3F,kFAAkF;AAClF,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,8CAA8C,EAAE,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,qBAAqB,CAC5B,KAAwB,EACxB,IAAY,EACZ,EAAU,EACV,IAAY,EACZ,MAA2B;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,YAAY,GAAG,8BAA8B,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,IAAI,MAAM,CACzB,iBAAiB,GAAG,mFAAmF;QACrG,eAAe,GAAG,mBAAmB;QACrC,oBAAoB,GAAG,KAAK,CAC/B,CAAC;IACF,mEAAmE;IACnE,IAAI,MAAM,GAAa,EAAE,CAAC;IAC1B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,GAAG,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACpD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;oBAC3B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACxB,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;gBACzE,CAAC,CAAC,CAAC;gBACH,IAAI,GAAG,EAAE,CAAC;oBACR,gEAAgE;oBAChE,IAAI,KAAK,GAAG,CAAC,CAAC;oBACd,IAAI,IAAI,GAAG,EAAE,CAAC;oBACd,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBACd,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;wBACnB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;wBACrD,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC;4BAAE,KAAK,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;wBAC/E,IAAI,KAAK,IAAI,CAAC;4BAAE,MAAM;wBACtB,IAAI,CAAC;4BAAE,IAAI,GAAG,CAAC,CAAC;oBAClB,CAAC;oBACD,IAAI,KAAK,IAAI,CAAC,IAAI,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAChE,iEAAiE;wBACjE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBACnB,CAAC,GAAG,CAAC,CAAC;wBACN,SAAS;oBACX,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3C,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,EAAE,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAC;iBACnB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACpB,KAAK,EAAE,CAAC;gBACR,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,KAAwB;IAC/C,MAAM,IAAI,GAAG,8DAA8D,CAAC;IAC5E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAAC,OAAO,GAAG,KAAK,CAAC;gBAAC,SAAS;YAAC,CAAC;YAChD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC9D,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC9C,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5D,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;gBACpC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC9C,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;QAClC,IAAI,KAAK,KAAK,CAAC;YAAE,SAAS;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,MAAM,CACtB,gBAAgB,GAAG,uCAAuC;YACxD,kCAAkC,GAAG,KAAK;YAC1C,YAAY,GAAG,kCAAkC,CACpD,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACnC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YACnC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YACtC,OAAO,IAAI,MAAM,CAAC,cAAc,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAuB,EAAE,IAAY,EAAE,QAAgB;IACvF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;YAAE,SAAS;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,EAAE,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oEAAoE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChH,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;YAAE,SAAS;QAC9D,IAAI,OAAO,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3B,OAAO,OAAO,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAE,CAAC;YAAE,OAAO,EAAE,CAAC;QAClE,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CACpB,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAC9H,CAAC;QACF,IAAI,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/analysis/taint-matcher.d.ts

@@ -3,10 +3,10 @@
  *
  * Matches method calls and annotations against taint configurations.
  */
-import type { CallInfo, TypeInfo, TaintSource, TaintSink, Taint, SupportedLanguage } from '../types/index.js';
+import type { CallInfo, TypeInfo, ImportInfo, TaintSource, TaintSink, Taint, SupportedLanguage } from '../types/index.js';
 import type { TaintConfig, SinkPattern } from '../types/config.js';
 import type { TypeHierarchyResolver } from '../resolution/type-hierarchy.js';
-export declare function analyzeTaint(calls: CallInfo[], types: TypeInfo[], config?: TaintConfig, typeHierarchy?: TypeHierarchyResolver, language?: SupportedLanguage, code?: string): Taint;
+export declare function analyzeTaint(calls: CallInfo[], types: TypeInfo[], config?: TaintConfig, typeHierarchy?: TypeHierarchyResolver, language?: SupportedLanguage, code?: string, imports?: ReadonlyArray<ImportInfo>): Taint;
 /**
  * Attach trimmed source-line text to each TaintSource / TaintSink at its
  * recorded line. Idempotent — only fills `code` when missing. Used by passes

package/dist/analysis/taint-matcher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"taint-matcher.d.ts","sourceRoot":"","sources":["../../src/analysis/taint-matcher.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAgB,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAkB,KAAK,EAAwB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAElK,OAAO,KAAK,EAAE,WAAW,EAAiB,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACpG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAwF7E,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EAAE,EACjB,KAAK,EAAE,QAAQ,EAAE,EACjB,MAAM,GAAE,WAAgC,EACxC,aAAa,CAAC,EAAE,qBAAqB,EACrC,QAAQ,CAAC,EAAE,iBAAiB,EAC5B,IAAI,CAAC,EAAE,MAAM,GACZ,KAAK,CAWP;AA0JD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EAAE,EACtB,KAAK,EAAE,SAAS,EAAE,EAClB,IAAI,EAAE,MAAM,GACX,IAAI,CAYN;AAyjGD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,WAAW,GACnB,OAAO,CAET"}
+{"version":3,"file":"taint-matcher.d.ts","sourceRoot":"","sources":["../../src/analysis/taint-matcher.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAgB,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAkB,KAAK,EAAwB,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAG9K,OAAO,KAAK,EAAE,WAAW,EAAiB,WAAW,EAAoB,MAAM,oBAAoB,CAAC;AACpG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AA2F7E,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,EAAE,EACjB,KAAK,EAAE,QAAQ,EAAE,EACjB,MAAM,GAAE,WAAgC,EACxC,aAAa,CAAC,EAAE,qBAAqB,EACrC,QAAQ,CAAC,EAAE,iBAAiB,EAC5B,IAAI,CAAC,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,GAClC,KAAK,CAWP;AA0JD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,WAAW,EAAE,EACtB,KAAK,EAAE,SAAS,EAAE,EAClB,IAAI,EAAE,MAAM,GACX,IAAI,CAYN;AAwyGD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,WAAW,GACnB,OAAO,CAET"}