circle-ir 4.14.2 → 4.16.0

package/dist/analysis/taint-matcher.js

@@ -3,8 +3,12 @@
  *
  * Matches method calls and annotations against taint configurations.
  */
+import { javaWikiTagInheritedContextReceiver } from './passes/language-sources-pass.js';
 import { DOM_ASSIGNMENT_SINK_METHODS, isProvablyLiteralExpression } from './literal-expression.js';
 import { getDefaultConfig } from './config-loader.js';
+import { javaReplaceCrLfCoverage } from './java-crlf-strip.js';
+import { jsChainTextAt, jsReplaceChainVerdict } from './js-crlf-strip.js';
+import { HTML_CONTEXT_ENCODER_METHODS } from './constant-propagation/patterns.js';
 import { resolveIdentifierType, resolveCallReturnType, isBoundedClassType, } from './arg-type-resolver.js';
 /**
  * Python tainted access patterns (regex-based).
@@ -79,14 +83,14 @@ function dropCSharpObjectCarriedWaypoints(sinks, calls) {
         return true;
     });
 }
-export function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy, language, code) {
+export function analyzeTaint(calls, types, config = getDefaultConfig(), typeHierarchy, language, code, imports) {
     const sourceLines = code !== undefined ? code.split('\n') : undefined;
-    const sources = findSources(calls, types, config.sources, sourceLines, language);
+    const sources = findSources(calls, types, config.sources, sourceLines, language, imports);
     let sinkPatterns = expandPromisifyAliases(config.sinks, sourceLines, language);
     sinkPatterns = expandIndirectEvalAliases(sinkPatterns, sourceLines, language);
     const sinks = findSinks(calls, sinkPatterns, typeHierarchy, language, sourceLines, types);
     const gatedSinks = language === 'csharp' ? dropCSharpObjectCarriedWaypoints(sinks, calls) : sinks;
-    const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines);
+    const sanitizers = findSanitizers(calls, types, config.sanitizers, sourceLines, language);
     return { sources, sinks: gatedSinks, sanitizers };
 }
 /**
@@ -264,7 +268,7 @@ export function attachSourceLineCode(sources, sinks, code) {
 /**
  * Find taint sources in method calls and annotated parameters.
  */
-function findSources(calls, types, patterns, sourceLines, language) {
+function findSources(calls, types, patterns, sourceLines, language, imports) {
     const sources = [];
     // #254 T2#7: pre-filter patterns by language once at function entry.
     // Previously the same 4-clause `pattern.languages && … !includes(language)`
@@ -281,7 +285,7 @@ function findSources(calls, types, patterns, sourceLines, language) {
     // Check method calls
     for (const call of calls) {
         for (const pattern of patternsForLanguage) {
-            if (matchesSourcePattern(call, pattern)) {
+            if (matchesSourcePattern(call, pattern, language, types, imports)) {
                 sources.push({
                     type: pattern.type,
                     location: formatCallLocation(call),
@@ -709,6 +713,10 @@ function isInterproceduralTaintableType(typeName, language) {
         if (elementType === 'String' || elementType === 'Object' || elementType === 'byte') {
             return true;
         }
+        // C# aliases (cognium-dev#638): `string[]` / `object[]` cross-file carriers.
+        if (language === 'csharp' && (elementType === 'string' || elementType === 'object')) {
+            return true;
+        }
     }
     return false;
 }
@@ -1032,6 +1040,35 @@ function processStartInfoExe(expr, sourceLines) {
     }
     return null;
 }
+// ---------------------------------------------------------------------------
+// Rust `serde_json` parse into `serde_json::Value` (cognium-dev#674).
+//
+// `serde_json` is a data-only parser: parsing into the dynamic `Value` tree
+// cannot instantiate an attacker-chosen type, so it is not CWE-502. A typed
+// target (`let c: Config = serde_json::from_str(..)`), an undeclared target
+// and every other format crate (`serde_yaml`, `toml`, ...) keep their sink.
+// Positive evidence only: the statement must carry an explicit `Value`
+// annotation on the binding it assigns to.
+// ---------------------------------------------------------------------------
+const RUST_VALUE_LET_RE = /\blet\s+(?:mut\s+)?[A-Za-z_]\w*\s*:\s*(?:[A-Za-z_]\w*::)*Value\s*=\s*[^;]*\bfrom_(?:str|slice|reader)\b/;
+function isRustSerdeJsonValueParse(call, pattern, language, sourceLines) {
+    if (language !== 'rust' || pattern.class !== 'serde_json' || pattern.type !== 'deserialization')
+        return false;
+    if (!sourceLines)
+        return false;
+    const lineNo = call.location.line;
+    const line = sourceLines[lineNo - 1];
+    if (line === undefined)
+        return false;
+    // A `let x: Value =` that rustfmt wrapped before the call lands on the previous line.
+    const prev = lineNo >= 2 ? (sourceLines[lineNo - 2] ?? '') : '';
+    const stmt = (prev.trimEnd().endsWith('=') ? prev + ' ' : '') + line;
+    // Two parse calls in one statement text: cannot attribute the annotation to this call.
+    const parseSegments = stmt.split(';').filter((seg) => /\bfrom_(?:str|slice|reader)\b/.test(seg));
+    if (parseSegments.length !== 1)
+        return false;
+    return RUST_VALUE_LET_RE.test(parseSegments[0]);
+}
 function isSafeCSharpProcessStartCall(call, pattern, language, sourceLines) {
     if (language !== 'csharp')
         return false;
@@ -1056,6 +1093,12 @@ function isSafeCSharpProcessStartCall(call, pattern, language, sourceLines) {
     if (method === 'Start' && call.arguments.length === 1) {
         const arg0 = call.arguments.find(a => a.position === 0);
         const expr = (arg0?.expression ?? '').trim();
+        // `proc.Start()` surfaces its receiver as the only argument (#594): the
+        // executable rides the `Process` object (`proc.StartInfo.FileName = …`), not a
+        // `ProcessStartInfo` of the same name built elsewhere in the file, so a name
+        // lookup for a constant-exe construction proves nothing here.
+        if (call.receiver != null && call.receiver.trim() === expr)
+            return false;
         return isConstNonShellExe(processStartInfoExe(expr, sourceLines));
     }
     return false;
@@ -1890,6 +1933,49 @@ function isGoFprintToNonResponseWriter(call, pattern, language, sourceLines) {
     }
     return true;
 }
+/**
+ * JDK types whose `getOutputStream()` is an outbound channel (a remote server,
+ * a peer socket, a child process) rather than the servlet response.
+ */
+const JAVA_OUTBOUND_STREAM_OWNERS = 'HttpURLConnection|HttpsURLConnection|URLConnection|JarURLConnection|Socket|SSLSocket|Process';
+/**
+ * #671 — true when a Java xss sink is `<base>.getOutputStream().<write>(...)`
+ * and `<base>` is declared in this file as a `URLConnection` / `Socket` /
+ * `Process` (or the chain is `….openConnection().getOutputStream()`). Bytes
+ * written there leave for another host or process; nothing is rendered in the
+ * requester's browser. Positive evidence only: an unresolved base keeps the
+ * sink.
+ */
+function isJavaOutboundOutputStreamWrite(call, pattern, language, sourceLines) {
+    if (language !== 'java' || pattern.type !== 'xss')
+        return false;
+    const receiver = (call.receiver ?? '').replace(/\s+/g, '');
+    if (!receiver.endsWith('.getOutputStream()'))
+        return false;
+    if (/\.openConnection\(\)\)?\.getOutputStream\(\)$/.test(receiver))
+        return true;
+    const m = receiver.match(/^\(?([A-Za-z_]\w*)\)?\.getOutputStream\(\)$/);
+    if (!m || !sourceLines)
+        return false;
+    const declRe = new RegExp(`\\b(?:[\\w.]+\\.)?(?:${JAVA_OUTBOUND_STREAM_OWNERS})\\s+${m[1]}\\s*[=;,)]`);
+    // Nearest declaration above the call wins; a re-declaration with another
+    // type (shadowing) stops the walk.
+    // `var x = …` (inferred type) also shadows, and its type is unknown here.
+    const anyDeclRe = new RegExp(`\\b(?:[A-Z][\\w.<>,\\[\\]]*|var)\\s+${m[1]}\\s*[=;,)]`);
+    for (let i = call.location.line - 1; i >= 0; i--) {
+        // Strip string literals, `//` comments and `/* … */` block comments so a
+        // commented-out declaration cannot match either regex.
+        const line = (sourceLines[i] ?? '')
+            .replace(/"(?:[^"\\]|\\.)*"/g, '""')
+            .replace(/\/\*[\s\S]*?\*\//g, '')
+            .replace(/\/\/.*$/, '');
+        if (declRe.test(line))
+            return true;
+        if (anyDeclRe.test(line))
+            return false;
+    }
+    return false;
+}
 /**
  * Gate for Go `json.Unmarshal(data, &dst)` / `json.NewDecoder(r).Decode(&dst)`
  * deserialization (CWE-502) sinks. Returns `true` when the destination is a
@@ -2126,6 +2212,11 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
                 if (isSafeCSharpProcessStartCall(call, pattern, language, sourceLines)) {
                     continue;
                 }
+                // Skip `serde_json::from_*` parses whose declared target is
+                // `serde_json::Value` — a data-only parse, not CWE-502. #674.
+                if (isRustSerdeJsonValueParse(call, pattern, language, sourceLines)) {
+                    continue;
+                }
                 // Skip C# SSRF sinks dominated by an inline exact-equality host
                 // allowlist (`if (host == "c") sink` / `if (host != "c") return; sink`).
                 // cognium-ai#328 shape 1.
@@ -2271,6 +2362,12 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
                 if (isGoFprintToNonResponseWriter(call, pattern, language, sourceLines)) {
                     continue;
                 }
+                // #671 — `conn.getOutputStream().write(...)` on an outbound
+                // URLConnection / Socket / Process writes to a remote peer or child
+                // process, not to the HTTP response. Not xss.
+                if (isJavaOutboundOutputStreamWrite(call, pattern, language, sourceLines)) {
+                    continue;
+                }
                 // #147 — Jinja2 safe render-context. Template("literal").render(**ctx)
                 // and render_template_string("literal", **ctx) and Template("literal")
                 // alone are safe: the template SOURCE is a constant string and Jinja2
@@ -2318,7 +2415,7 @@ function findSinks(calls, patterns, typeHierarchy, language, sourceLines, types)
 /**
  * Check if a call matches a source pattern.
  */
-function matchesSourcePattern(call, pattern) {
+function matchesSourcePattern(call, pattern, language, types, imports) {
     // Method-based matching
     if (pattern.method) {
         if (call.method_name !== pattern.method) {
@@ -2351,6 +2448,14 @@ function matchesSourcePattern(call, pattern) {
                     return false;
                 }
             }
+            else if (language === 'java' &&
+                types &&
+                imports &&
+                call.receiver &&
+                pattern.class &&
+                javaWikiTagInheritedContextReceiver(call.receiver, pattern.class, call, types, imports)) {
+                // JSPWiki tag handler inherited m_wikiContext (cognium-dev#624)
+            }
             else if (!receiverMightBeClass(call.receiver, pattern.class)) {
                 // The receiver might be a variable name, not the class name
                 // For now, we do a simple match - in a full implementation,
@@ -2559,7 +2664,98 @@ const SINK_FQN_EXCLUSIONS = {
         // Expression.accept(ExpressionVisitor), etc.
         'net.sf.jsqlparser.',
     ],
+    path_traversal: [
+        // Spring `ResourceLoader.getResource(location)` resolves a classpath /
+        // URL location, not a file path. A receiver named `loader` would
+        // otherwise be taken for `ClassLoader` by the receiver-name heuristic
+        // (the ClassLoader.getResource sink, #621).
+        'org.springframework.core.io.ResourceLoader',
+        'org.springframework.core.io.support.ResourcePatternResolver',
+    ],
 };
+/**
+ * Sink classes whose receiver-name heuristic is skipped when the declared
+ * receiver type is positively known NOT to be the sink class.
+ * `ClassLoader.getResource` is keyed on a receiver named like `loader`, which
+ * would otherwise also take Spring's `ResourceLoader loader` for a ClassLoader
+ * (#621 follow-up). A declared type that is merely unresolved (a user type
+ * from another file, a type parameter, `var`, a chained call) keeps the
+ * heuristic: it may well be a ClassLoader subclass.
+ */
+const DECLARED_TYPE_STRICT_SINK_CLASSES = {
+    path_traversal: ['ClassLoader'],
+};
+/**
+ * Declared receiver types known not to be a `ClassLoader`, matched by simple
+ * name so a wildcard import (`import org.springframework.core.io.*;`), which
+ * leaves `receiver_type_fqn` unresolved, is covered too.
+ */
+const KNOWN_NON_CLASSLOADER_SIMPLE_NAMES = new Set([
+    'ResourceLoader',
+    'ResourcePatternResolver',
+    'Object',
+]);
+/** Spring resource abstractions: none of them is a `ClassLoader`. */
+const KNOWN_NON_CLASSLOADER_FQN_PREFIXES = ['org.springframework.core.io.'];
+/**
+ * True when the type hierarchy knows `typeName` and its whole superclass chain,
+ * and that chain ends without reaching a ClassLoader. Any link that is not in
+ * the hierarchy (a parent declared in another file) means "unknown", never
+ * "not a ClassLoader". Interfaces and enums are never ClassLoaders.
+ */
+function hierarchyKnowsNotSubtype(typeName, sinkClass, typeHierarchy) {
+    let node = typeHierarchy.getType(typeName);
+    if (!node)
+        return false;
+    const seen = new Set();
+    while (node) {
+        if (seen.has(node.fqn))
+            return false;
+        seen.add(node.fqn);
+        if (node.name === sinkClass || typeHierarchy.isSubtypeOf(node.fqn, sinkClass))
+            return false;
+        if (node.kind === 'interface' || node.kind === 'enum')
+            return true;
+        if (!node.extends)
+            return true;
+        const parent = node.extends.replace(/<.*$/, '').trim();
+        if (parent.split('.').pop() === sinkClass)
+            return false;
+        node = typeHierarchy.getType(parent);
+    }
+    return false;
+}
+/**
+ * True when the call's declared receiver type is positively known not to be
+ * `pattern.class` (a ClassLoader): a Spring resource loader / resolver, `Object`,
+ * or a type the hierarchy resolves (e.g. declared in this file) without
+ * reaching ClassLoader. Unresolved types return false so the receiver-name
+ * heuristic still decides.
+ */
+function declaredReceiverTypeExcludes(call, pattern, typeHierarchy) {
+    if (!pattern.class || !DECLARED_TYPE_STRICT_SINK_CLASSES[pattern.type]?.includes(pattern.class)) {
+        return false;
+    }
+    const fqn = call.receiver_type_fqn?.replace(/<.*$/, '').trim();
+    const simpleDeclared = call.receiver_type?.replace(/<.*$/, '').trim();
+    if (fqn && KNOWN_NON_CLASSLOADER_FQN_PREFIXES.some((prefix) => fqn.startsWith(prefix))) {
+        return true;
+    }
+    if (fqn === 'java.lang.Object')
+        return true;
+    const declared = fqn || simpleDeclared;
+    if (!declared)
+        return false;
+    const simple = declared.split('.').pop() ?? '';
+    if (simple === '' || simple === 'var')
+        return false;
+    // A simple name only counts when no other FQN was resolved for it
+    // (`com.acme.ResourceLoader` is a user type, not Spring's).
+    if (KNOWN_NON_CLASSLOADER_SIMPLE_NAMES.has(simple) && (!fqn || fqn === simple)) {
+        return true;
+    }
+    return typeHierarchy !== undefined && hierarchyKnowsNotSubtype(declared, pattern.class, typeHierarchy);
+}
 /**
  * Check if a call matches a sink pattern.
  */
@@ -2660,6 +2856,13 @@ function matchesSinkPattern(call, pattern, typeHierarchy, language) {
             // If the mapped return type is a subtype of the sink class, accept.
             // — cognium-dev #241 Java
         }
+        else if (declaredReceiverTypeExcludes(call, pattern, typeHierarchy)) {
+            // Declared receiver type is positively known not to be the sink class
+            // (Spring `ResourceLoader`, `Object`, a same-file class that does not
+            // extend ClassLoader): the receiver-name heuristic below must not turn
+            // it into the sink class. Unresolved types still use the heuristic.
+            return false;
+        }
         else if (call.receiver && !receiverMightBeClass(call.receiver, pattern.class)) {
             // Heuristic match failed; fall back to TypeHierarchyResolver if available
             if (typeHierarchy && typeHierarchy.couldBeType(call.receiver, pattern.class)) {
@@ -2806,6 +3009,21 @@ function receiverMightBeClassImpl(receiver, className) {
     if (receiver === className) {
         return true;
     }
+    // Inline CommonJS require receiver: `require('child_process').exec(x)`.
+    // The module is named at the call, so match it as if it were bound to a
+    // name (`const cp = require('child_process'); cp.exec(x)`). (cognium-dev#682)
+    const inlineRequire = receiver.match(/^require\(\s*['"`](?:node:)?([\w./-]+)['"`]\s*\)$/);
+    if (inlineRequire && inlineRequire[1] === className) {
+        return true;
+    }
+    // Chained JDK ClassLoader accessors: `Thread.currentThread()
+    // .getContextClassLoader().loadClass(x)`, `getClass().getClassLoader()
+    // .loadClass(x)`, `ClassLoader.getSystemClassLoader().loadClass(x)`.
+    // These return a ClassLoader, so match the receiver as one. (cognium-dev#623)
+    if (className === 'ClassLoader' &&
+        /(?:^|\.)(?:getContextClassLoader|getClassLoader|getSystemClassLoader)\(\s*\)$/.test(receiver.replace(/\s+/g, ''))) {
+        return true;
+    }
     // Constructor-call receiver: `ClassName(args)` — Python `Path(raw)`,
     // JS `new URL(s)` (handled separately), etc. When the receiver is a
     // direct function call whose function name equals the target class
@@ -3195,8 +3413,22 @@ export function isInDangerousPosition(argPosition, pattern) {
 /**
  * Find sanitizers in method calls and annotated parameters.
  */
-function findSanitizers(calls, types, patterns, sourceLines) {
+function findSanitizers(calls, types, patterns, sourceLines, language) {
     const sanitizers = [];
+    const javaReplace = (call) => {
+        if (!sourceLines || (call.method_name !== 'replace' && call.method_name !== 'replaceAll'))
+            return null;
+        if (language === 'java') {
+            return javaReplaceChainCredit(javaChainTextAt(sourceLines, call.location.line, call.location.column));
+        }
+        if (language === 'javascript' || language === 'typescript' || language === 'tsx') {
+            // #562: the class-less `replace` row credits log_injection; keep it only
+            // when the literal chain strips both CR and LF, or cannot be decided.
+            const verdict = jsReplaceChainVerdict(jsChainTextAt(sourceLines, call.location.line, call.location.column));
+            return verdict === 'leaves-crlf' ? [] : null;
+        }
+        return null;
+    };
     // Build a set of method names with @sanitizer annotation (from Javadoc comments)
     const sanitizerMethods = new Set();
     for (const type of types) {
@@ -3207,19 +3439,22 @@ function findSanitizers(calls, types, patterns, sourceLines) {
         }
     }
     // Sprint 9 #79 (Phase L): derive wrapper sanitizers.
-    // A method qualifies as a derived sanitizer when its body is exactly
-    // `return <known_sanitizer>(<param>)` (optionally `await`-prefixed).
+    // A method qualifies when its body is `return <sanitizer-expr>(<param>)`
+    // (optionally `await`-prefixed), span ≤ 2 lines (signature + single return).
     // We require:
-    //   1. Method body span ≤ 2 lines (signature + single return).
-    //   2. Exactly one non-recursive call inside the method's line range.
-    //   3. That call matches a configured sanitizer pattern with non-empty
-    //      `removes`.
-    //   4. The inner call's argument is exactly one of the wrapper's params.
-    //   5. When source is available, the inner call's source line, after
-    //      `return ` / `return await `, starts with the inner call's
-    //      `[receiver.]method(` prefix and ends with `)` — rejecting
-    //      unsafe shapes like `return x + shlex.quote(x)`.
+    //   1. One non-recursive call, OR every inner call is `replace` / `replaceAll`
+    //      (#517): use the call with the longest receiver for argument-aware credit.
+    //   2. That call matches a configured sanitizer pattern with non-empty
+    //      `removes` (Java `replace` chains use `javaReplaceChainCredit`).
+    //   3. The inner call's argument is a wrapper param, or (replace-chain only)
+    //      the receiver text starts with a param name.
+    //   4. When source is available, the return expression is a single sanitizer
+    //      call or a param-rooted replace chain ending with `)` — rejecting shapes
+    //      like `return x + shlex.quote(x)`.
     const wrapperSanitizers = new Map();
+    // #589: wrappers whose single inner call is a context-specific HTML encoder
+    // (every same-named wrapper, so an overload cannot lend its credit).
+    const wrapperEncoderOnly = new Map();
     for (const type of types) {
         for (const method of type.methods) {
             const bodySize = method.end_line - method.start_line;
@@ -3236,23 +3471,52 @@ function findSanitizers(calls, types, patterns, sourceLines) {
                     continue; // recursion guard
                 inside.push(c);
             }
-            if (inside.length !== 1)
+            if (inside.length === 0)
+                continue;
+            const allReplaceCalls = inside.every(c => c.method_name === 'replace' || c.method_name === 'replaceAll');
+            let innerCall;
+            let replaceChainHelper = false;
+            if (inside.length === 1) {
+                innerCall = inside[0];
+            }
+            else if (allReplaceCalls) {
+                replaceChainHelper = true;
+                innerCall = inside.reduce((best, c) => (c.receiver ?? '').length > (best.receiver ?? '').length ? c : best);
+            }
+            else {
                 continue;
-            const innerCall = inside[0];
+            }
             let matched;
-            for (const pattern of patterns) {
-                if (matchesSanitizerPattern(innerCall, pattern)) {
-                    matched = pattern;
-                    break;
+            const replaceCredit = javaReplace(innerCall);
+            if (replaceCredit) {
+                matched = replaceCredit.length > 0 ? { method: innerCall.method_name, removes: replaceCredit } : undefined;
+            }
+            else {
+                for (const pattern of patterns) {
+                    if (matchesSanitizerPattern(innerCall, pattern)) {
+                        matched = pattern;
+                        break;
+                    }
                 }
             }
             if (!matched || !matched.removes || matched.removes.length === 0)
                 continue;
             let argOk = false;
-            for (const arg of innerCall.arguments) {
-                if (arg.variable && paramNames.has(arg.variable)) {
-                    argOk = true;
-                    break;
+            if (replaceChainHelper) {
+                const recv = innerCall.receiver?.trim() ?? '';
+                for (const p of paramNames) {
+                    if (recv === p || recv.startsWith(`${p}.`)) {
+                        argOk = true;
+                        break;
+                    }
+                }
+            }
+            else {
+                for (const arg of innerCall.arguments) {
+                    if (arg.variable && paramNames.has(arg.variable)) {
+                        argOk = true;
+                        break;
+                    }
                 }
             }
             if (!argOk)
@@ -3264,14 +3528,24 @@ function findSanitizers(calls, types, patterns, sourceLines) {
                 if (!returnMatch)
                     continue;
                 const after = returnMatch[1].replace(/;\s*$/, '').trimEnd();
-                const callPrefix = innerCall.receiver
-                    ? `${innerCall.receiver}.${innerCall.method_name}(`
-                    : `${innerCall.method_name}(`;
-                if (!after.startsWith(callPrefix))
-                    continue;
+                if (replaceChainHelper) {
+                    const startsWithParam = [...paramNames].some(p => after === p || after.startsWith(`${p}.`));
+                    if (!startsWithParam)
+                        continue;
+                }
+                else {
+                    const callPrefix = innerCall.receiver
+                        ? `${innerCall.receiver}.${innerCall.method_name}(`
+                        : `${innerCall.method_name}(`;
+                    if (!after.startsWith(callPrefix))
+                        continue;
+                }
                 if (!after.endsWith(')'))
                     continue;
             }
+            const encoderWrapper = !replaceCredit && method.parameters.length === 1 &&
+                HTML_CONTEXT_ENCODER_METHODS.has(innerCall.method_name);
+            wrapperEncoderOnly.set(method.name, (wrapperEncoderOnly.get(method.name) ?? true) && encoderWrapper);
             const existing = wrapperSanitizers.get(method.name);
             if (existing) {
                 const set = new Set([...existing, ...matched.removes]);
@@ -3282,18 +3556,88 @@ function findSanitizers(calls, types, patterns, sourceLines) {
             }
         }
     }
+    // #589: delegate to an encoder-only wrapper in one hop (wrapEncode → encodeForPage → escapeHtml).
+    let transitiveWrapperAdded = true;
+    while (transitiveWrapperAdded) {
+        transitiveWrapperAdded = false;
+        for (const type of types) {
+            for (const method of type.methods) {
+                if (wrapperSanitizers.has(method.name))
+                    continue;
+                const bodySize = method.end_line - method.start_line;
+                if (bodySize < 0 || bodySize > 2)
+                    continue;
+                const paramNames = new Set(method.parameters.map(p => p.name));
+                if (paramNames.size === 0)
+                    continue;
+                const inside = [];
+                for (const c of calls) {
+                    if (c.location.line < method.start_line || c.location.line > method.end_line)
+                        continue;
+                    if (c.method_name === method.name)
+                        continue;
+                    inside.push(c);
+                }
+                if (inside.length !== 1)
+                    continue;
+                const innerCall = inside[0];
+                const delegateRemoves = wrapperSanitizers.get(innerCall.method_name);
+                if (!delegateRemoves || delegateRemoves.length === 0)
+                    continue;
+                let argOk = false;
+                for (const arg of innerCall.arguments) {
+                    if (arg.variable && paramNames.has(arg.variable)) {
+                        argOk = true;
+                        break;
+                    }
+                }
+                if (!argOk)
+                    continue;
+                if (sourceLines) {
+                    const lineText = sourceLines[innerCall.location.line - 1] ?? '';
+                    const stripped = lineText.trim();
+                    const returnMatch = stripped.match(/^return\s+(?:await\s+)?(.*)$/);
+                    if (!returnMatch)
+                        continue;
+                    const after = returnMatch[1].replace(/;\s*$/, '').trimEnd();
+                    const callPrefix = innerCall.receiver
+                        ? `${innerCall.receiver}.${innerCall.method_name}(`
+                        : `${innerCall.method_name}(`;
+                    if (!after.startsWith(callPrefix) || !after.endsWith(')'))
+                        continue;
+                }
+                const encoderDelegate = wrapperEncoderOnly.get(innerCall.method_name) === true;
+                wrapperEncoderOnly.set(method.name, encoderDelegate);
+                wrapperSanitizers.set(method.name, [...delegateRemoves]);
+                transitiveWrapperAdded = true;
+            }
+        }
+    }
     // Emit a derived-sanitizer entry at each call site to a wrapper method.
     for (const call of calls) {
         const removes = wrapperSanitizers.get(call.method_name);
         if (!removes)
             continue;
         sanitizers.push({
-            type: 'derived_wrapper',
+            // #589: a wrapper of an HTML encoder cleans `xss` but not `trust_boundary`,
+            // like the encoder itself, so it is told apart from other wrappers.
+            type: wrapperEncoderOnly.get(call.method_name) ? 'derived_html_encoder' : 'derived_wrapper',
             method: formatSanitizerMethod(call),
             line: call.location.line,
             sanitizes: removes,
         });
     }
+    const noopLocalHelpers = !sourceLines
+        ? new Set()
+        : language === 'java'
+            ? findJavaNoopHelpers(types, sourceLines)
+            : language === 'python'
+                ? findPythonNoopHelpers(types, sourceLines)
+                : language === 'go'
+                    ? findGoNoopHelpers(types, sourceLines)
+                    : language === 'javascript' || language === 'typescript' || language === 'tsx'
+                        ? findJsNoopHelpers(types, sourceLines)
+                        : new Set();
     // Check method calls for sanitizer methods
     for (const call of calls) {
         // Check if this call is to a method with @sanitizer annotation
@@ -3306,8 +3650,23 @@ function findSanitizers(calls, types, patterns, sourceLines) {
             });
             continue; // Skip pattern matching - already added as sanitizer
         }
+        const replaceCredit = javaReplace(call);
+        if (replaceCredit) {
+            if (replaceCredit.length > 0) {
+                sanitizers.push({
+                    type: 'method_call',
+                    method: formatSanitizerMethod(call),
+                    line: call.location.line,
+                    sanitizes: replaceCredit,
+                });
+            }
+            continue;
+        }
         for (const pattern of patterns) {
             if (matchesSanitizerPattern(call, pattern)) {
+                if (!pattern.class && noopLocalHelpers.has(call.method_name) && (!call.receiver || call.receiver === 'this' || call.receiver === 'self')) {
+                    continue; // same-file helper that does no escaping: not credited by name (#581)
+                }
                 sanitizers.push({
                     type: determineSanitizerType(pattern),
                     method: formatSanitizerMethod(call),
@@ -3336,6 +3695,308 @@ function findSanitizers(calls, types, patterns, sourceLines) {
     }
     return sanitizers;
 }
+/**
+ * Names of methods defined in this file whose every definition is a no-op
+ * shape: a single `return <expr>;` built only from the method's own
+ * parameters, string literals, `+` and the pass-through calls `trim`, `strip`,
+ * `toString`, `toLowerCase` and `toUpperCase`. A class-less sanitizer row must
+ * not credit a call to such a helper by name (#581). Any other body (a
+ * `replace`, a library call, a branch, a loop) keeps the by-name credit, and so
+ * does a name that has a non-no-op overload.
+ */
+function findJavaNoopHelpers(types, sourceLines) {
+    const noop = new Set();
+    const other = new Set();
+    for (const type of types) {
+        for (const method of type.methods) {
+            (isJavaNoopBody(method, sourceLines) ? noop : other).add(method.name);
+        }
+    }
+    for (const name of other)
+        noop.delete(name);
+    return noop;
+}
+function isJavaNoopBody(method, sourceLines) {
+    if (method.parameters.length === 0)
+        return false;
+    const text = sourceLines.slice(method.start_line - 1, method.end_line).join('\n');
+    const open = text.indexOf('{');
+    const close = text.lastIndexOf('}');
+    if (open < 0 || close < open)
+        return false;
+    const m = /^\s*return\s+([^;{}]+);\s*$/.exec(text.slice(open + 1, close));
+    if (!m)
+        return false;
+    const params = new Set(method.parameters.map(p => p.name));
+    const expr = m[1]
+        .replace(/"(?:\\.|[^"\\])*"/g, '""')
+        .replace(/\.(?:trim|strip|toString|toLowerCase|toUpperCase)\(\)/g, '');
+    const leftovers = expr.replace(/""|[+()\s]/g, ' ').trim();
+    if (leftovers === '')
+        return true;
+    return leftovers.split(/\s+/).every(tok => params.has(tok));
+}
+/**
+ * Python twin of `findJavaNoopHelpers` (#581): a `def` whose body is one
+ * `return <expr>` built only from its own parameters, string literals, `+`, the
+ * pass-through methods `strip` / `lstrip` / `rstrip` / `lower` / `upper` and the
+ * `str()` call. Any other body (a `re.sub`, `replace`, `html.escape`, a branch,
+ * a loop, a second statement) keeps the by-name credit, and so does a name with a
+ * non-no-op definition elsewhere in the file.
+ */
+function findPythonNoopHelpers(types, sourceLines) {
+    const noop = new Set();
+    const other = new Set();
+    for (const type of types) {
+        for (const method of type.methods) {
+            (isPythonNoopBody(method, sourceLines) ? noop : other).add(method.name);
+        }
+    }
+    for (const name of other)
+        noop.delete(name);
+    return noop;
+}
+function isPythonNoopBody(method, sourceLines) {
+    if (method.parameters.length === 0)
+        return false;
+    const text = sourceLines.slice(method.start_line - 1, method.end_line).join('\n');
+    // `def name(params) -> T:` then the body, on the same line or below. The header is
+    // matched without crossing a newline inside a default value or annotation.
+    const header = /^\s*(?:async\s+)?def\s+\w+\s*\(([^()]*)\)\s*(?:->\s*[\w.\[\], ]+)?\s*:/.exec(text);
+    if (!header)
+        return false;
+    const body = text.slice(header[0].length).replace(/#.*$/gm, '').trim();
+    const m = /^return\s+([^\n;]+)$/.exec(body);
+    if (!m)
+        return false;
+    const params = new Set(method.parameters.map(p => p.name.replace(/^\*+/, '')));
+    const expr = m[1]
+        .replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'/g, '""')
+        .replace(/\.(?:strip|lstrip|rstrip|lower|upper)\(\)/g, '')
+        .replace(/\bstr\(/g, '(');
+    const leftovers = expr.replace(/""|[+()\s]/g, ' ').trim();
+    if (leftovers === '')
+        return true;
+    return leftovers.split(/\s+/).every(tok => params.has(tok));
+}
+/**
+ * Go twin of `findJavaNoopHelpers` (#581): a `func` whose body is one
+ * `return <expr>` built only from its own parameters, string literals, `+`, the
+ * pass-through calls `strings.TrimSpace` / `strings.ToLower` / `strings.ToUpper`
+ * and the `string()` conversion. Any other body (a `strings.ReplaceAll`, an
+ * escaper call, a branch, a loop, a second statement) keeps the by-name credit,
+ * and so does a name with a non-no-op definition elsewhere in the file, a method
+ * or a function alike.
+ */
+function findGoNoopHelpers(types, sourceLines) {
+    const noop = new Set();
+    const other = new Set();
+    for (const type of types) {
+        for (const method of type.methods) {
+            (isGoNoopBody(method, sourceLines) ? noop : other).add(method.name);
+        }
+    }
+    for (const name of other)
+        noop.delete(name);
+    // A local of the same name (`sanitize := func(v string) string { … }`) is a
+    // different helper whose body is not read here.
+    const src = sourceLines.join('\n');
+    for (const name of [...noop]) {
+        if (new RegExp(`(?<![\\w.])${name}\\s*(?::=|=(?!=)|,\\s*\\w+\\s*:=)`).test(src))
+            noop.delete(name);
+    }
+    return noop;
+}
+function isGoNoopBody(method, sourceLines) {
+    if (method.parameters.length === 0)
+        return false;
+    const text = sourceLines.slice(method.start_line - 1, method.end_line).join('\n');
+    // `func name(params) T {` — a plain function; a method (`func (s *T) name`) is judged by a
+    // call through its receiver, which is never skipped, so it is not a no-op helper here.
+    const header = /^\s*func\s+\w+\s*\(([^()]*)\)\s*\(?[\w.\[\]*, ]*\)?\s*\{/.exec(text);
+    if (!header)
+        return false;
+    const close = text.lastIndexOf('}');
+    if (close < header[0].length)
+        return false;
+    const body = text.slice(header[0].length, close).replace(/\/\/.*$/gm, '').trim();
+    const m = /^return\s+([^;{}]+)$/.exec(body);
+    if (!m)
+        return false;
+    const params = new Set(method.parameters.map(p => p.name.replace(/^\.+/, '')));
+    for (const seg of header[1].split(',')) {
+        const name = seg.trim().split(/\s+/)[0]?.replace(/^\.+/, '');
+        if (name)
+            params.add(name);
+    }
+    const expr = m[1]
+        .replace(/"(?:\\.|[^"\\])*"|`[^`]*`/g, '""')
+        .replace(/\bstrings\s*\.\s*(?:TrimSpace|ToLower|ToUpper)\s*\(/g, '(')
+        .replace(/\bstring\s*\(/g, '(');
+    const leftovers = expr.replace(/""|[+()\s]/g, ' ').trim();
+    if (leftovers === '')
+        return true;
+    return leftovers.split(/\s+/).every(tok => params.has(tok));
+}
+/**
+ * JavaScript / TypeScript twin of `findJavaNoopHelpers` (#581): a `function` or
+ * method whose body is one `return <expr>` (or an arrow expression) built only
+ * from its own parameters, string literals, `+`, and the pass-through calls
+ * `trim` / `toLowerCase` / `toUpperCase` / `toString` / `String()`. Any other
+ * body keeps the by-name credit, and so does a name with a non-no-op overload.
+ */
+function findJsNoopHelpers(types, sourceLines) {
+    const fromDecl = new Set();
+    const otherDecl = new Set();
+    for (const type of types) {
+        for (const method of type.methods) {
+            (isJsNoopBody(method, sourceLines) ? fromDecl : otherDecl).add(method.name);
+        }
+    }
+    for (const name of otherDecl)
+        fromDecl.delete(name);
+    const src = sourceLines.join('\n');
+    for (const name of [...fromDecl]) {
+        if (new RegExp(`(?:const|let|var)\\s+${name}\\s*=`).test(src))
+            fromDecl.delete(name);
+    }
+    const fromBinding = new Set();
+    const otherBinding = new Set();
+    for (const line of sourceLines) {
+        const arrow = /(?:const|let|var)\s+(\w+)\s*=\s*\(([^)]*)\)\s*=>\s*([^;{]+)\s*;/.exec(line);
+        if (arrow) {
+            const params = jsParamNamesFromList(arrow[2]);
+            if (params.size > 0 && jsNoopReturnExpr(arrow[3], params))
+                fromBinding.add(arrow[1]);
+            else
+                otherBinding.add(arrow[1]);
+        }
+        const fnExpr = /(?:const|let|var)\s+(\w+)\s*=\s*function\s*\(([^)]*)\)\s*\{\s*return\s+([^;{}]+);\s*\}\s*;/.exec(line);
+        if (fnExpr) {
+            const params = jsParamNamesFromList(fnExpr[2]);
+            if (params.size > 0 && jsNoopReturnExpr(fnExpr[3], params))
+                fromBinding.add(fnExpr[1]);
+            else
+                otherBinding.add(fnExpr[1]);
+        }
+    }
+    for (const name of otherBinding)
+        fromBinding.delete(name);
+    return new Set([...fromDecl, ...fromBinding]);
+}
+function jsParamNamesFromList(list) {
+    const params = new Set();
+    for (const seg of list.split(',')) {
+        const name = seg.trim().split(':')[0]?.trim().replace(/^\.\.\./, '');
+        if (name)
+            params.add(name);
+    }
+    return params;
+}
+function isJsNoopBody(method, sourceLines) {
+    if (method.parameters.length === 0)
+        return false;
+    const text = sourceLines.slice(method.start_line - 1, method.end_line).join('\n');
+    const params = new Set(method.parameters.map(p => p.name.replace(/^\.\.\./, '')));
+    const arrowExpr = /(?:\([^)]*\)|[\w$]+)\s*=>\s*([^{;]+?)\s*$/.exec(text.trim());
+    if (arrowExpr) {
+        return jsNoopReturnExpr(arrowExpr[1], params);
+    }
+    const open = text.indexOf('{');
+    const close = text.lastIndexOf('}');
+    if (open < 0 || close < open)
+        return false;
+    const body = text.slice(open + 1, close).replace(/\/\/.*$/gm, '').trim();
+    const m = /^\s*return\s+([^;{}]+);\s*$/.exec(body);
+    if (!m)
+        return false;
+    return jsNoopReturnExpr(m[1], params);
+}
+function jsNoopReturnExpr(expr, params) {
+    const stripped = expr
+        .replace(/"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|`(?:\\.|[^`\\])*`/g, '""')
+        .replace(/\.(?:trim|toLowerCase|toUpperCase|toString)\(\)/g, '')
+        .replace(/\bString\s*\(/g, '(');
+    const leftovers = stripped.replace(/""|[+()\s]/g, ' ').trim();
+    if (leftovers === '')
+        return true;
+    return leftovers.split(/\s+/).every(tok => params.has(tok));
+}
+const JAVA_LIT = String.raw `(?:"((?:\\.|[^"\\])*)"|'((?:\\.|[^'\\])*)')`;
+const JAVA_REPLACE_ARGS_RE = new RegExp(String.raw `\.(replace|replaceAll)\(\s*${JAVA_LIT}\s*,\s*${JAVA_LIT}\s*\)`, 'g');
+/**
+ * The text of the call chain that starts at (line, column): the receiver
+ * expression plus the `.method(...)` segments after it, up to the first
+ * character that cannot continue the chain at nesting depth 0 (`;`, `,`, an
+ * operator, an unmatched closing bracket). A call reports the start of the
+ * whole chain it ends, so `a.replace("\n", "")` and `b.replace("\r", "")` on one
+ * line start at different columns and never credit each other. The chain may
+ * continue over following lines.
+ */
+function javaChainTextAt(sourceLines, line, column) {
+    const text = [(sourceLines[line - 1] ?? '').slice(column), ...sourceLines.slice(line, line + 7)].join('\n');
+    let depth = 0;
+    let i = 0;
+    for (; i < text.length; i++) {
+        const c = text[i];
+        if (c === '"' || c === "'") {
+            for (i++; i < text.length && text[i] !== c; i++)
+                if (text[i] === '\\')
+                    i++;
+            continue;
+        }
+        if (c === '(' || c === '[') {
+            depth++;
+            continue;
+        }
+        if (c === ')' || c === ']') {
+            if (depth === 0)
+                break;
+            depth--;
+            continue;
+        }
+        if (depth === 0 && !/[\w$.\s]/.test(c))
+            break;
+    }
+    return text.slice(0, i);
+}
+/**
+ * Java `String.replace` / `replaceAll` credit, decided from the literal
+ * arguments of the replace chain that contains the call instead of the method name
+ * (cognium-dev#562 / #605 / #517). The class-less `replace` row credited any
+ * replace as a log-injection sanitizer, so an LF-only strip silenced the
+ * finding while `replaceAll("[\r\n]", "")` got no credit at all.
+ *   - `log_injection`: the chain strips both CR and LF (double-quoted String or single-quoted char literals).
+ *   - `xss`: the chain maps both `<` and `>` to an entity.
+ * Returns the credited sink types (possibly empty).
+ */
+function javaReplaceChainCredit(chainText) {
+    let cr = false;
+    let lf = false;
+    let lt = false;
+    let gt = false;
+    for (const m of chainText.matchAll(JAVA_REPLACE_ARGS_RE)) {
+        const kind = m[1];
+        const rawFrom = m[2] ?? m[3] ?? '';
+        const from = rawFrom.replace(/\\\\/g, '\\');
+        const to = m[4] ?? m[5] ?? '';
+        const cov = javaReplaceCrLfCoverage(kind, rawFrom);
+        if (cov.cr)
+            cr = true;
+        if (cov.lf)
+            lf = true;
+        if (from === '<' && to.startsWith('&'))
+            lt = true;
+        if (from === '>' && to.startsWith('&'))
+            gt = true;
+    }
+    const out = [];
+    if (cr && lf)
+        out.push('log_injection');
+    if (lt && gt)
+        out.push('xss');
+    return out;
+}
 /**
  * Check if a call matches a sanitizer pattern.
  */