circle-ir 4.14.2 → 4.16.0

package/dist/core/extractors/calls.d.ts

@@ -10,5 +10,16 @@ import { type NodeCache } from '../parser.js';
  * @param cache Optional node cache for performance
  * @param language Optional language hint ('java' | 'javascript' | 'typescript' | 'python' | 'rust')
  */
-export declare function extractCalls(tree: Tree, cache?: NodeCache, language?: string): CallInfo[];
+/**
+ * Options for `extractCalls`. Every field is off by default, and the default
+ * output is unchanged: `ir.calls` is read by the SAST passes.
+ */
+export interface CallExtractionOptions {
+    /**
+     * Java only: give each argument its static type and start position
+     * (`ArgumentInfo.type` / `.location`), which overload selection needs.
+     */
+    navigationTypes?: boolean;
+}
+export declare function extractCalls(tree: Tree, cache?: NodeCache, language?: string, options?: CallExtractionOptions): CallInfo[];
 //# sourceMappingURL=calls.d.ts.map

package/dist/core/extractors/calls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"calls.d.ts","sourceRoot":"","sources":["../../../src/core/extractors/calls.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAQ,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAgC,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAA2D,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AA8EvG;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,EAAE,CAoDzF"}
+{"version":3,"file":"calls.d.ts","sourceRoot":"","sources":["../../../src/core/extractors/calls.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAQ,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,QAAQ,EAAgC,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAA2D,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AA8EvG;;;;;GAKG;AACH;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAgB,YAAY,CAC1B,IAAI,EAAE,IAAI,EACV,KAAK,CAAC,EAAE,SAAS,EACjB,QAAQ,CAAC,EAAE,MAAM,EACjB,OAAO,GAAE,qBAA0B,GAClC,QAAQ,EAAE,CAqDZ"}

package/dist/core/extractors/calls.js

@@ -47,13 +47,7 @@ function detectLanguageFromTree(tree, cache) {
     // Default to Java for backwards compatibility
     return javaIndicators >= jsIndicators ? 'java' : 'javascript';
 }
-/**
- * Extract all method calls from the tree.
- * @param tree The parsed AST tree
- * @param cache Optional node cache for performance
- * @param language Optional language hint ('java' | 'javascript' | 'typescript' | 'python' | 'rust')
- */
-export function extractCalls(tree, cache, language) {
+export function extractCalls(tree, cache, language, options = {}) {
     const calls = [];
     // Use language hint if provided, otherwise detect from tree
     const detectedLanguage = language ?? detectLanguageFromTree(tree, cache);
@@ -82,13 +76,14 @@ export function extractCalls(tree, cache, language) {
     const context = buildResolutionContext(tree, cache);
     // Find all method invocations
     const invocations = getNodesFromCache(tree.rootNode, 'method_invocation', cache);
+    const typed = options.navigationTypes === true;
     for (const inv of invocations) {
-        calls.push(extractCallInfo(inv, context));
+        calls.push(extractCallInfo(inv, context, typed));
     }
     // Find object creation expressions (constructor calls)
     const objectCreations = getNodesFromCache(tree.rootNode, 'object_creation_expression', cache);
     for (const creation of objectCreations) {
-        const callInfo = extractObjectCreation(creation, context);
+        const callInfo = extractObjectCreation(creation, context, typed);
         if (callInfo) {
             calls.push(callInfo);
         }
@@ -115,15 +110,16 @@ export function extractCalls(tree, cache, language) {
  * match only covers for static calls. Type comes from the declaration
  * (`HttpClient c = …`) or, for `var`, from the `new T(…)` initializer.
  */
-function buildCSharpReceiverTypeMap(tree, cache) {
+function buildCSharpReceiverTypeMap(tree, cache, scope) {
     const map = new Map();
+    const nodesOf = (type) => scope ? scope.descendantsOfType(type).filter((n) => n !== null) : getNodesFromCache(tree.rootNode, type, cache);
     const simple = (t) => t.replace(/<[^>]*>/g, '').split('.').pop()?.trim() ?? t;
     // cognium-dev#542 — method/constructor parameters. A receiver is just as often a parameter as a
     // local — `void Bad(HttpRequest req, HttpResponse resp)` is the canonical
     // ASP.NET handler shape — and omitting them meant every receiver gate keyed on
     // a declared type silently failed for parameters. Locals below win on a name
     // clash, since an inner declaration shadows the parameter.
-    for (const prm of getNodesFromCache(tree.rootNode, 'parameter', cache)) {
+    for (const prm of nodesOf('parameter')) {
         const nameNode = prm.childForFieldName('name');
         const typeNode = prm.childForFieldName('type');
         if (nameNode?.type !== 'identifier' || !typeNode)
@@ -132,7 +128,7 @@ function buildCSharpReceiverTypeMap(tree, cache) {
         if (t && t !== 'var')
             map.set(getNodeText(nameNode), simple(t));
     }
-    for (const vd of getNodesFromCache(tree.rootNode, 'variable_declaration', cache)) {
+    for (const vd of nodesOf('variable_declaration')) {
         const typeNode = vd.childForFieldName('type');
         const declaredType = typeNode ? getNodeText(typeNode) : null;
         for (let i = 0; i < vd.childCount; i++) {
@@ -243,6 +239,25 @@ function csharpCreatedSimpleType(creation) {
 function extractCSharpCalls(tree, cache) {
     const calls = [];
     const typeMap = buildCSharpReceiverTypeMap(tree, cache);
+    // The file-wide map keeps one type per name, so `ProcessStartInfo proc` in one
+    // method hides `Process proc` in another. For a receiver check, look at the
+    // declarations of the method that holds the call first, then the file-wide map
+    // (fields, members declared outside any method).
+    const methodTypeMaps = new Map();
+    const csharpReceiverTypeAt = (inv, name) => {
+        let n = inv.parent;
+        while (n && n.type !== 'method_declaration' && n.type !== 'constructor_declaration' &&
+            n.type !== 'local_function_statement' && n.type !== 'accessor_declaration')
+            n = n.parent;
+        if (!n)
+            return typeMap.get(name);
+        let scoped = methodTypeMaps.get(n.id);
+        if (!scoped) {
+            scoped = buildCSharpReceiverTypeMap(tree, cache, n);
+            methodTypeMaps.set(n.id, scoped);
+        }
+        return scoped.get(name) ?? typeMap.get(name);
+    };
     const invocations = getNodesFromCache(tree.rootNode, 'invocation_expression', cache);
     for (const inv of invocations) {
         const fn = inv.childForFieldName('function');
@@ -271,6 +286,14 @@ function extractCSharpCalls(tree, cache) {
         if (receiver && CSHARP_COMMAND_EXECUTE_METHODS.has(methodName)) {
             args = [{ position: 0, expression: receiver, variable: receiver, literal: null, value: null }, ...args];
         }
+        // cognium-dev#594: `proc.Start()` takes no argument; the executable rides the
+        // `Process` object (`proc.StartInfo.FileName = tainted`, seeded in
+        // taint-propagation). Surface the receiver as arg[0], as for `Execute*()`
+        // above. Gated on the receiver being a declared `Process` so `Stopwatch`,
+        // `Timer` and `Thread` `Start()` calls are untouched.
+        if (receiver && methodName === 'Start' && args.length === 0 && csharpReceiverTypeAt(inv, receiver) === 'Process') {
+            args = [{ position: 0, expression: receiver, variable: receiver, literal: null, value: null }];
+        }
         // `Response.Headers.Add(name, value)` is the ASP.NET Core response-header
         // writer, but a bare `Add` is far too common to register as a CRLF sink
         // (List.Add, Dictionary.Add, …). Normalize the header-dictionary form to the
@@ -288,7 +311,7 @@ function extractCSharpCalls(tree, cache) {
         calls.push({
             method_name: methodName,
             receiver,
-            receiver_type: receiverTypeFromCreation ?? (receiver ? (typeMap.get(receiver) ?? null) : null),
+            receiver_type: receiverTypeFromCreation ?? (receiver ? (csharpReceiverTypeAt(inv, receiver) ?? null) : null),
             receiver_type_fqn: null,
             arguments: args,
             location: { line: inv.startPosition.row + 1, column: inv.startPosition.column },
@@ -1505,7 +1528,7 @@ const JAVA_LANG_TYPES = new Set([
 /**
  * Extract call information from a method_invocation node.
  */
-function extractCallInfo(node, context) {
+function extractCallInfo(node, context, typed = false) {
     // Get method name
     const nameNode = node.childForFieldName('name');
     const methodName = nameNode ? getNodeText(nameNode) : 'unknown';
@@ -1514,13 +1537,23 @@ function extractCallInfo(node, context) {
     const receiver = objectNode ? getNodeText(objectNode) : null;
     // Get arguments
     const argsNode = node.childForFieldName('arguments');
-    const args = argsNode ? extractArguments(argsNode) : [];
+    const args = argsNode ? extractArguments(argsNode, typed) : [];
     // Find enclosing method
     const enclosingMethod = findEnclosingMethod(node);
     // Resolve the call
     const { resolved, resolution } = resolveMethodCall(methodName, receiver, context);
-    // Resolve the receiver's declared type and FQN
-    const { simpleName, fqn } = resolveReceiverType(receiver, context);
+    // Resolve the receiver's declared type and FQN. For navigation, a plain
+    // variable is looked up where it is used, so a lambda parameter or a name
+    // two methods declare differently gets its own type, or none; the
+    // file-wide table is the fallback for what no enclosing scope declares.
+    let { simpleName, fqn } = resolveReceiverType(receiver, context);
+    if (typed && objectNode?.type === 'identifier') {
+        const scoped = lookupInScope(objectNode, getNodeText(objectNode));
+        if (scoped === null)
+            ({ simpleName, fqn } = { simpleName: null, fqn: null });
+        else if (scoped !== undefined)
+            ({ simpleName, fqn } = resolveFqn(stripGenerics(scoped), context));
+    }
     return {
         method_name: methodName,
         receiver,
@@ -1539,7 +1572,7 @@ function extractCallInfo(node, context) {
 /**
  * Extract call information from an object_creation_expression (new ...).
  */
-function extractObjectCreation(node, context) {
+function extractObjectCreation(node, context, typed = false) {
     // Get the type being instantiated
     const typeNode = node.childForFieldName('type');
     if (!typeNode)
@@ -1547,7 +1580,7 @@ function extractObjectCreation(node, context) {
     const typeName = getNodeText(typeNode);
     // Get arguments
     const argsNode = node.childForFieldName('arguments');
-    const args = argsNode ? extractArguments(argsNode) : [];
+    const args = argsNode ? extractArguments(argsNode, typed) : [];
     // Find enclosing method
     const enclosingMethod = findEnclosingMethod(node);
     // Constructor calls are always resolved (we know the class)
@@ -1578,7 +1611,7 @@ function extractObjectCreation(node, context) {
 /**
  * Extract arguments from an argument_list node.
  */
-function extractArguments(argsNode) {
+function extractArguments(argsNode, typed = false) {
     const args = [];
     let position = 0;
     for (let i = 0; i < argsNode.childCount; i++) {
@@ -1591,16 +1624,293 @@ function extractArguments(argsNode) {
         }
         const expression = getNodeText(child);
         const { variable, literal } = analyzeArgument(child);
-        args.push({
+        const arg = {
             position,
             expression,
             variable,
             literal,
-        });
+        };
+        if (typed) {
+            arg.type = javaStaticType(child);
+            arg.location = { line: child.startPosition.row + 1, column: child.startPosition.column };
+        }
+        args.push(arg);
         position++;
     }
     return args;
 }
+const NUMERIC_RANK = { byte: 1, short: 2, char: 2, int: 3, long: 4, float: 5, double: 6 };
+const BOOLEAN_OPERATORS = new Set(['==', '!=', '<', '>', '<=', '>=', '&&', '||', 'instanceof']);
+/**
+ * The static type of a Java expression, as far as the syntax and the
+ * declarations in scope say it — and `null` past that.
+ *
+ * Read for overload selection, so it errs one way only: a type it cannot be
+ * sure of is `null` ("could be anything"), never a guess. A method call's
+ * result is not typed here; the navigation index types it by binding that
+ * call, which needs the whole tree.
+ */
+function javaStaticType(node) {
+    const text = getNodeText(node);
+    switch (node.type) {
+        case 'string_literal':
+        case 'text_block':
+            return 'String';
+        case 'character_literal':
+            return 'char';
+        case 'decimal_integer_literal':
+        case 'hex_integer_literal':
+        case 'octal_integer_literal':
+        case 'binary_integer_literal':
+            return /[lL]$/.test(text) ? 'long' : 'int';
+        case 'decimal_floating_point_literal':
+        case 'hex_floating_point_literal':
+            return /[fF]$/.test(text) ? 'float' : 'double';
+        case 'true':
+        case 'false':
+        case 'instanceof_expression':
+            return 'boolean';
+        case 'null_literal':
+            return 'null';
+        case 'class_literal':
+            return 'Class';
+        case 'parenthesized_expression': {
+            const inner = node.namedChild(0);
+            return inner ? javaStaticType(inner) : null;
+        }
+        case 'cast_expression': {
+            const t = node.childForFieldName('type');
+            return t ? getNodeText(t) : null;
+        }
+        case 'object_creation_expression': {
+            const t = node.childForFieldName('type');
+            return t ? getNodeText(t) : null;
+        }
+        case 'array_creation_expression': {
+            const t = node.childForFieldName('type');
+            if (!t)
+                return null;
+            const dims = (text.match(/\[/g) ?? []).length - (getNodeText(t).match(/\[/g) ?? []).length;
+            return `${getNodeText(t)}${'[]'.repeat(Math.max(dims, 1))}`;
+        }
+        case 'unary_expression': {
+            const op = node.childForFieldName('operator');
+            const operand = node.childForFieldName('operand');
+            if (op && getNodeText(op) === '!')
+                return 'boolean';
+            const t = operand ? javaStaticType(operand) : null;
+            return t && t in NUMERIC_RANK ? (NUMERIC_RANK[t] < 3 ? 'int' : t) : null;
+        }
+        case 'binary_expression': {
+            const op = node.childForFieldName('operator');
+            const opText = op ? getNodeText(op) : '';
+            if (BOOLEAN_OPERATORS.has(opText))
+                return 'boolean';
+            const left = node.childForFieldName('left');
+            const right = node.childForFieldName('right');
+            const lt = left ? javaStaticType(left) : null;
+            const rt = right ? javaStaticType(right) : null;
+            if (opText === '+' && (lt === 'String' || rt === 'String'))
+                return 'String';
+            // Binary numeric promotion, only when both sides are known primitives.
+            if (lt && rt && lt in NUMERIC_RANK && rt in NUMERIC_RANK) {
+                const wider = NUMERIC_RANK[lt] >= NUMERIC_RANK[rt] ? lt : rt;
+                return NUMERIC_RANK[wider] < 3 ? 'int' : wider;
+            }
+            return null;
+        }
+        case 'ternary_expression': {
+            const a = node.childForFieldName('consequence');
+            const b = node.childForFieldName('alternative');
+            const at = a ? javaStaticType(a) : null;
+            const bt = b ? javaStaticType(b) : null;
+            return at !== null && at === bt ? at : null;
+        }
+        case 'identifier':
+            return declaredTypeInScope(node, text);
+        case 'field_access': {
+            const obj = node.childForFieldName('object');
+            const field = node.childForFieldName('field');
+            if (obj?.type !== 'this' || !field)
+                return null;
+            const body = findAncestor(node, 'class_body') ?? findAncestor(node, 'enum_body_declarations');
+            return body ? fieldTypeIn(body, getNodeText(field)) : null;
+        }
+        default:
+            return null;
+    }
+}
+/**
+ * The declared type of the variable `name` as seen from `node`: the nearest
+ * enclosing local, parameter, resource, loop or catch variable, then a field
+ * of an enclosing type. `null` when the nearest declaration has no written
+ * type (a lambda's inferred parameter, `var` without a readable initializer)
+ * or when nothing in the file declares it — an inherited field, say.
+ */
+function declaredTypeInScope(node, name) {
+    return lookupInScope(node, name) ?? null;
+}
+/** `declaredTypeInScope`, telling "declared without a written type" (`null`) from "not declared here" (`undefined`). */
+function lookupInScope(node, name) {
+    const typeOf = (typeNode, value) => {
+        if (!typeNode)
+            return null;
+        const t = getNodeText(typeNode);
+        if (t !== 'var')
+            return t;
+        return value ? javaStaticType(value) : null;
+    };
+    const fromDeclaration = (decl) => {
+        for (const d of decl.namedChildren) {
+            if (d?.type !== 'variable_declarator')
+                continue;
+            const n = d.childForFieldName('name');
+            if (n && getNodeText(n) === name)
+                return typeOf(decl.childForFieldName('type'), d.childForFieldName('value'));
+        }
+        return undefined;
+    };
+    const fromParameters = (params) => {
+        for (const p of params.namedChildren) {
+            if (!p)
+                continue;
+            if (p.type === 'formal_parameter') {
+                const n = p.childForFieldName('name');
+                if (n && getNodeText(n) === name)
+                    return typeOf(p.childForFieldName('type'), null);
+            }
+            else if (p.type === 'spread_parameter') {
+                const d = p.namedChildren.find(c => c?.type === 'variable_declarator');
+                const n = d?.childForFieldName('name');
+                const t = p.namedChildren.find(c => c !== null && /type/.test(c.type));
+                if (n && getNodeText(n) === name)
+                    return t ? `${getNodeText(t)}[]` : null;
+            }
+            else if (p.type === 'identifier' && getNodeText(p) === name) {
+                return null; // an inferred lambda parameter
+            }
+        }
+        return undefined;
+    };
+    let child = node;
+    for (let scope = node.parent; scope; child = scope, scope = scope.parent) {
+        let found;
+        switch (scope.type) {
+            case 'block':
+            case 'constructor_body':
+            case 'switch_block_statement_group':
+                for (const stmt of scope.namedChildren) {
+                    if (!stmt || stmt.startIndex >= child.startIndex)
+                        break;
+                    if (stmt.type === 'local_variable_declaration')
+                        found = fromDeclaration(stmt) ?? found;
+                }
+                break;
+            case 'for_statement':
+                for (const init of scope.childrenForFieldName('init')) {
+                    if (init?.type === 'local_variable_declaration')
+                        found = fromDeclaration(init) ?? found;
+                }
+                break;
+            case 'enhanced_for_statement': {
+                const n = scope.childForFieldName('name');
+                if (n && getNodeText(n) === name)
+                    found = typeOf(scope.childForFieldName('type'), null);
+                break;
+            }
+            case 'catch_clause': {
+                const p = scope.namedChildren.find(c => c?.type === 'catch_formal_parameter');
+                const n = p?.childForFieldName('name');
+                if (p && n && getNodeText(n) === name) {
+                    const ct = p.namedChildren.find(c => c?.type === 'catch_type');
+                    // A multi-catch has no single static type that names a class here.
+                    found = ct && ct.namedChildCount === 1 ? getNodeText(ct) : null;
+                }
+                break;
+            }
+            case 'try_with_resources_statement': {
+                const spec = scope.childForFieldName('resources');
+                for (const r of spec?.namedChildren ?? []) {
+                    const n = r?.childForFieldName('name');
+                    if (r && n && getNodeText(n) === name)
+                        found = typeOf(r.childForFieldName('type'), r.childForFieldName('value'));
+                }
+                break;
+            }
+            case 'lambda_expression': {
+                const params = scope.childForFieldName('parameters');
+                if (params?.type === 'identifier')
+                    found = getNodeText(params) === name ? forEachElementType(scope) : undefined;
+                else if (params?.type === 'inferred_parameters') {
+                    found = params.namedChildren.some(c => c && getNodeText(c) === name) ? null : undefined;
+                }
+                else if (params)
+                    found = fromParameters(params);
+                break;
+            }
+            case 'method_declaration':
+            case 'constructor_declaration':
+            case 'record_declaration': {
+                const params = scope.childForFieldName('parameters');
+                if (params)
+                    found = fromParameters(params);
+                break;
+            }
+            case 'class_body':
+            case 'interface_body':
+            case 'enum_body_declarations': {
+                const t = fieldTypeIn(scope, name);
+                if (t !== null)
+                    found = t;
+                break;
+            }
+            default:
+                break;
+        }
+        if (found !== undefined)
+            return found;
+    }
+    return undefined;
+}
+const ITERABLE_TYPES = new Set([
+    'Iterable', 'Collection', 'List', 'Set', 'SortedSet', 'NavigableSet', 'Queue', 'Deque',
+    'ArrayList', 'LinkedList', 'HashSet', 'LinkedHashSet', 'TreeSet', 'ArrayDeque',
+]);
+/**
+ * The parameter type of `xs.forEach(x -> …)`, where `xs` is declared as a JDK
+ * collection of one element type: `List<Loan> xs` gives `Loan`. Anything
+ * else — another method, a wildcard, a map, an untyped receiver — is `null`.
+ */
+function forEachElementType(lambda) {
+    const args = lambda.parent;
+    const inv = args?.parent;
+    if (args?.type !== 'argument_list' || inv?.type !== 'method_invocation' || args.namedChildCount !== 1)
+        return null;
+    const name = inv.childForFieldName('name');
+    const obj = inv.childForFieldName('object');
+    if (!name || getNodeText(name) !== 'forEach' || obj?.type !== 'identifier')
+        return null;
+    const declared = declaredTypeInScope(obj, getNodeText(obj));
+    const m = declared ? /^(?:java\.util\.|java\.lang\.)?(\w+)\s*<\s*([\w.]+)\s*>$/.exec(declared.trim()) : null;
+    return m && ITERABLE_TYPES.has(m[1]) ? m[2] : null;
+}
+/** The written type of field `name` declared directly in a type body, or `null`. */
+function fieldTypeIn(body, name) {
+    for (const f of body.namedChildren) {
+        if (f?.type !== 'field_declaration' && f?.type !== 'constant_declaration')
+            continue;
+        for (const d of f.namedChildren) {
+            if (d?.type !== 'variable_declarator')
+                continue;
+            const n = d.childForFieldName('name');
+            if (n && getNodeText(n) === name) {
+                const t = f.childForFieldName('type');
+                return t ? getNodeText(t) : null;
+            }
+        }
+    }
+    return null;
+}
 /**
  * Analyze an argument to extract variable name or literal value.
  */