circle-ir 4.14.2 → 4.16.0

package/dist/core/extractors/dfg.js

@@ -168,6 +168,7 @@ function buildCSharpDFG(tree, cache) {
  * Build DFG for Java code.
  */
 function buildJavaDFG(tree, cache) {
+    multiLineValueLinks = [];
     const defs = [];
     const uses = [];
     let defIdCounter = 1;
@@ -219,6 +220,7 @@ function buildJavaDFG(tree, cache) {
     }
     // Compute def-use chains
     const chains = computeChains(defs, uses);
+    linkMultiLineValues(chains, uses);
     return { defs, uses, chains };
 }
 /**
@@ -352,6 +354,51 @@ function processBlock(block, startDefId, startUseId, scopeStack, isJavaScript) {
     }
     return { defs, uses, nextDefId: defId, nextUseId: useId };
 }
+/**
+ * Java: a local whose initializer / assigned value wraps over several lines
+ * (`label = new String(\n  Base64.decode(\n    picked.getBytes()));`) holds uses on
+ * lines after the definition's own line, and `computeChains` links a use to a
+ * definition only on the same line. Each such definition is recorded here with
+ * the uses of its value, and `buildJavaDFG` links them once every use has its
+ * final reaching definition (cognium-dev#597).
+ */
+let multiLineValueLinks = [];
+function recordMultiLineValue(value, defId, valueUses, isJavaScript) {
+    if (isJavaScript || value.endPosition.row <= value.startPosition.row)
+        return;
+    // A lambda, anonymous class or switch expression inside the value has its own
+    // statements; their uses do not feed the value itself. Leave those alone.
+    if (findNodes(value, 'lambda_expression').length > 0
+        || findNodes(value, 'class_body').length > 0
+        || findNodes(value, 'switch_expression').length > 0)
+        return;
+    const useIds = valueUses.filter(u => u.line > value.startPosition.row + 1).map(u => u.id);
+    if (useIds.length > 0)
+        multiLineValueLinks.push({ defId, useIds });
+}
+/** Chain each use inside a wrapped value to the definition it feeds (#597). */
+function linkMultiLineValues(chains, uses) {
+    if (multiLineValueLinks.length === 0)
+        return;
+    const useById = new Map();
+    for (const u of uses)
+        useById.set(u.id, u);
+    const seen = new Set(chains.map(c => `${c.from_def}|${c.to_def}|${c.via}`));
+    for (const { defId, useIds } of multiLineValueLinks) {
+        for (const id of useIds) {
+            const u = useById.get(id);
+            if (!u || u.def_id === null || u.def_id === defId)
+                continue;
+            const key = `${u.def_id}|${defId}|${u.variable}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            chains.push({ from_def: u.def_id, to_def: defId, via: u.variable });
+        }
+    }
+    chains.sort((a, b) => a.from_def - b.from_def || a.to_def - b.to_def);
+    multiLineValueLinks = [];
+}
 /**
  * Process a single statement.
  */
@@ -368,6 +415,7 @@ function processStatement(stmt, startDefId, startUseId, scopeStack, isJavaScript
             const declarators = findNodes(stmt, 'variable_declarator');
             for (const decl of declarators) {
                 const nameNode = decl.childForFieldName('name');
+                let declaredDefId = null;
                 if (nameNode) {
                     // Handle simple identifiers
                     if (nameNode.type === 'identifier') {
@@ -380,6 +428,8 @@ function processStatement(stmt, startDefId, startUseId, scopeStack, isJavaScript
                         };
                         defs.push(def);
                         currentScope(scopeStack).set(name, def.id);
+                        markDeclared(currentScope(scopeStack), name);
+                        declaredDefId = def.id;
                     }
                     else if (isJavaScript) {
                         // Handle destructuring patterns in JavaScript
@@ -396,6 +446,8 @@ function processStatement(stmt, startDefId, startUseId, scopeStack, isJavaScript
                         const initUses = extractUses(init, useId, scopeStack, isJavaScript);
                         uses.push(...initUses.uses);
                         useId = initUses.nextId;
+                        if (declaredDefId !== null)
+                            recordMultiLineValue(init, declaredDefId, initUses.uses, isJavaScript);
                     }
                 }
             }
@@ -433,21 +485,37 @@ function processStatement(stmt, startDefId, startUseId, scopeStack, isJavaScript
             }
             // Process branches
             const consequence = stmt.childForFieldName('consequence');
+            const alternative = stmt.childForFieldName('alternative');
+            const topAlts = alternateDefs.get(currentScope(scopeStack));
+            const before = new Map();
+            if (topAlts)
+                for (const [name, ids] of topAlts)
+                    before.set(name, [...ids]);
+            let armA = null;
+            let armB = null;
             if (consequence) {
-                const result = processStatement(consequence, defId, useId, scopeStack, isJavaScript);
+                const result = processArm(consequence, defId, useId, scopeStack, isJavaScript);
+                armA = result.popped;
                 defs.push(...result.defs);
                 uses.push(...result.uses);
                 defId = result.nextDefId;
                 useId = result.nextUseId;
             }
-            const alternative = stmt.childForFieldName('alternative');
             if (alternative) {
-                const result = processStatement(alternative, defId, useId, scopeStack, isJavaScript);
+                const result = processArm(alternative, defId, useId, scopeStack, isJavaScript);
+                armB = result.popped;
                 defs.push(...result.defs);
                 uses.push(...result.uses);
                 defId = result.nextDefId;
                 useId = result.nextUseId;
             }
+            // An `else if` arm is merged too: its own merge has already put the chain's
+            // final def on the arm's scope only when every arm of the chain assigns, so
+            // a chain with no final `else` (or one arm that skips the name) keeps the
+            // reaching def.
+            if (armA && armB) {
+                mergeIfElseDefs(armA, armB, before, scopeStack);
+            }
             break;
         }
         case 'for_statement':
@@ -525,7 +593,7 @@ function processStatement(stmt, startDefId, startUseId, scopeStack, isJavaScript
             // Process body
             const body = stmt.childForFieldName('body');
             if (body) {
-                const result = processStatement(body, defId, useId, scopeStack, isJavaScript);
+                const result = processArm(body, defId, useId, scopeStack, isJavaScript);
                 defs.push(...result.defs);
                 uses.push(...result.uses);
                 defId = result.nextDefId;
@@ -555,13 +623,22 @@ function processStatement(stmt, startDefId, startUseId, scopeStack, isJavaScript
                     const group = body.child(i);
                     if (!group)
                         continue;
+                    // JS (#582): each `case` / `default` gets a scope of its own and its
+                    // defs are parked beside the others, so a constant in `default` does
+                    // not replace a tainted assignment in an earlier `case`.
+                    if (isJavaScript)
+                        scopeStack.push(new Map());
                     const result = processBlock(group, defId, useId, scopeStack, isJavaScript);
                     defs.push(...result.defs);
                     uses.push(...result.uses);
                     defId = result.nextDefId;
                     useId = result.nextUseId;
+                    if (isJavaScript)
+                        carryBranchDefsOut(scopeStack.pop(), scopeStack, false);
                 }
-                scopeStack.pop();
+                // Alternates parked on the switch scope go on to the enclosing scope.
+                const poppedSwitch = scopeStack.pop();
+                carryBranchDefsOut(poppedSwitch, scopeStack, false, true);
             }
             break;
         }
@@ -574,7 +651,33 @@ function processStatement(stmt, startDefId, startUseId, scopeStack, isJavaScript
             uses.push(...result.uses);
             defId = result.nextDefId;
             useId = result.nextUseId;
-            scopeStack.pop();
+            const popped = scopeStack.pop();
+            // A bare `{ … }` (or `synchronized (x) { … }`) always runs, so its defs
+            // replace the enclosing scope's; an if/loop/try/switch/lambda body may
+            // not, so its defs are kept beside them.
+            // JS: a bare `{ … }` inside a statement_block likewise always runs; the
+            // block of an `if` / `else` / loop / `try` may not, so (#582) its defs are
+            // carried out as alternates, as for Java (#692).
+            const alwaysRuns = stmt.parent?.type === 'block' || stmt.parent?.type === 'synchronized_statement' ||
+                (isJavaScript && stmt.parent?.type === 'statement_block');
+            lastPoppedBlock = popped;
+            carryBranchDefsOut(popped, scopeStack, alwaysRuns);
+            break;
+        }
+        case 'else_clause': {
+            // JavaScript: `else { … }` / `else if (…) { … }` hold their arm one level
+            // down; without this the arm fell to `default` and recorded no defs, so an
+            // assignment in an `else` never reached a use after the `if` (#582).
+            for (let i = 0; i < stmt.childCount; i++) {
+                const arm = stmt.child(i);
+                if (!arm || arm.type === 'else')
+                    continue;
+                const result = processStatement(arm, defId, useId, scopeStack, isJavaScript);
+                defs.push(...result.defs);
+                uses.push(...result.uses);
+                defId = result.nextDefId;
+                useId = result.nextUseId;
+            }
             break;
         }
         default: {
@@ -600,6 +703,7 @@ function processExpression(expr, startDefId, startUseId, scopeStack, isJavaScrip
         // 2. Then create a def for the left side
         const left = expr.childForFieldName('left');
         const right = expr.childForFieldName('right');
+        let assignedValueUses = [];
         // Process right side first - may contain nested assignments
         if (right) {
             if (right.type === 'assignment_expression') {
@@ -615,6 +719,7 @@ function processExpression(expr, startDefId, startUseId, scopeStack, isJavaScrip
                 const rightUses = extractUses(right, useId, scopeStack, isJavaScript);
                 uses.push(...rightUses.uses);
                 useId = rightUses.nextId;
+                assignedValueUses = rightUses.uses;
             }
         }
         // Now process left side as a definition
@@ -628,6 +733,10 @@ function processExpression(expr, startDefId, startUseId, scopeStack, isJavaScrip
             };
             defs.push(def);
             currentScope(scopeStack).set(name, def.id);
+            if (right && assignedValueUses.length > 0)
+                recordMultiLineValue(right, def.id, assignedValueUses, isJavaScript);
+            // A straight-line reassignment replaces any branch defs carried out (#596).
+            alternateDefs.get(currentScope(scopeStack))?.delete(name);
         }
         else if (left) {
             // Field access or array access - extract uses
@@ -740,6 +849,12 @@ function extractUses(node, startId, scopeStack, isJavaScript) {
                 line: n.startPosition.row + 1,
                 def_id: reachingDef,
             });
+            // A def made inside a nested block may also reach this use (#596).
+            for (const alt of findAlternateDefs(name, scopeStack)) {
+                if (alt === reachingDef)
+                    continue;
+                uses.push({ id: id++, variable: name, line: n.startPosition.row + 1, def_id: alt });
+            }
         }
     });
     return { uses, nextId: id };
@@ -825,7 +940,7 @@ function extractJSParameterDefs(params, startId) {
             addPatternDefs(nameNode, line);
             return;
         }
-        if (patternNode.type === 'assignment_pattern') {
+        if (isDestructuringDefaultPattern(patternNode.type)) {
             const leftNode = patternNode.childForFieldName('left');
             if (leftNode)
                 addPatternDefs(leftNode, line);
@@ -869,7 +984,7 @@ function extractJSParameterDefs(params, startId) {
             }
         }
         // Assignment pattern (default value): name = defaultValue
-        else if (param.type === 'assignment_pattern') {
+        else if (isDestructuringDefaultPattern(param.type)) {
             const leftNode = param.childForFieldName('left');
             if (leftNode && leftNode.type === 'identifier') {
                 defs.push({
@@ -932,6 +1047,10 @@ function extractJSFieldDefs(body, startId) {
     }
     return defs;
 }
+/** Tree-sitter-javascript object destructuring default (`{ sort = "name" }`). */
+function isDestructuringDefaultPattern(type) {
+    return type === 'assignment_pattern' || type === 'object_assignment_pattern';
+}
 /**
  * Extract definitions from destructuring patterns.
  */
@@ -982,7 +1101,7 @@ function extractDestructuringDefs(node, startId) {
                     });
                 }
             }
-            else if (child.type === 'assignment_pattern') {
+            else if (isDestructuringDefaultPattern(child.type)) {
                 // { foo = defaultValue }
                 const leftNode = child.childForFieldName('left');
                 if (leftNode && leftNode.type === 'shorthand_property_identifier_pattern') {
@@ -1028,7 +1147,7 @@ function extractDestructuringDefs(node, startId) {
                     });
                 }
             }
-            else if (child.type === 'assignment_pattern') {
+            else if (isDestructuringDefaultPattern(child.type)) {
                 // [x = defaultValue]
                 const leftNode = child.childForFieldName('left');
                 if (leftNode && leftNode.type === 'identifier') {
@@ -1056,6 +1175,213 @@ function extractDestructuringDefs(node, startId) {
 function currentScope(scopeStack) {
     return scopeStack[scopeStack.length - 1];
 }
+/**
+ * Java: an assignment inside a braced block to a variable declared outside it
+ * was bound in the block's own scope, so it was dropped when the block ended
+ * and later uses saw only the outer def (cognium-dev#596 / #597:
+ * `String t = ""; if (a) { if (b) t = tainted; } exec(c + t)` had no flow).
+ * The block def may or may not run, so it is kept as an *alternate* reaching
+ * def of the enclosing scope, next to the outer one, not in place of it.
+ */
+/** The scope the most recent `block` / `statement_block` case popped (read right after processing a block arm). */
+let lastPoppedBlock = null;
+/**
+ * True when the `if` / loop that owns `arm` sits directly in a bare `{ … }` or
+ * `synchronized` block. Only there is a braceless body given a scope of its own:
+ * at method level a braceless `if (!ALLOWED.contains(c)) c = "name";` overwrites
+ * the def on purpose (the allowlist idiom).
+ */
+function inAlwaysRunBlock(arm) {
+    let n = arm.parent;
+    while (n && (n.type === 'if_statement' || n.type === 'for_statement' || n.type === 'enhanced_for_statement' ||
+        n.type === 'while_statement' || n.type === 'do_statement'))
+        n = n.parent;
+    return !!n && n.type === 'block' && !!n.parent &&
+        (n.parent.type === 'block' || n.parent.type === 'synchronized_statement');
+}
+/**
+ * True when the `if` / loop that owns the braceless `arm` sits in a braced
+ * block that is not a method body (a braced `if` / `else` / loop / `try` arm, or
+ * a bare / `synchronized` block). That block shares one scope slot per name, so
+ * a braceless body there must not assign into it: the write may not run, and it
+ * would hide an earlier write in the same block.
+ */
+/** Braceless `if` / `else` arm at statement level (parent has an alternative). */
+function isBracelessIfElseArm(arm) {
+    const parent = arm.parent;
+    if (!parent || parent.type !== 'if_statement')
+        return false;
+    return parent.childForFieldName('alternative') != null;
+}
+function inNestedBlock(arm) {
+    let n = arm.parent;
+    while (n && (n.type === 'if_statement' || n.type === 'for_statement' || n.type === 'enhanced_for_statement' ||
+        n.type === 'while_statement' || n.type === 'do_statement'))
+        n = n.parent;
+    if (!n || n.type !== 'block' || !n.parent)
+        return false;
+    switch (n.parent.type) {
+        case 'block':
+        case 'synchronized_statement':
+        case 'if_statement':
+        case 'for_statement':
+        case 'enhanced_for_statement':
+        case 'while_statement':
+        case 'do_statement':
+        case 'try_statement':
+        case 'try_with_resources_statement':
+        case 'catch_clause':
+        case 'finally_clause':
+        case 'labeled_statement':
+            return true;
+        default:
+            return false;
+    }
+}
+/**
+ * Process the body of an `if` / `else` / loop. A braced body is a `block` and
+ * pops its own scope. A braceless body (`if (c) t = x;`) is a single statement
+ * that would otherwise assign in the enclosing scope as if it always ran, so for
+ * Java inside an always-run block it gets a scope of its own and its defs are
+ * carried out as alternates. Returns the scope the body assigned in (null
+ * elsewhere), for `if` / `else` merging.
+ */
+function processArm(node, defId, useId, scopeStack, isJavaScript) {
+    const isBlock = node.type === 'block' || node.type === 'statement_block';
+    const bracelessTopIfElse = !isBlock && isBracelessIfElseArm(node);
+    if (isJavaScript || (isBlock ? !inAlwaysRunBlock(node) : !inNestedBlock(node) && !bracelessTopIfElse)) {
+        lastPoppedBlock = null;
+        const result = processStatement(node, defId, useId, scopeStack, isJavaScript);
+        return { ...result, popped: null };
+    }
+    if (isBlock) {
+        lastPoppedBlock = null;
+        const result = processStatement(node, defId, useId, scopeStack, isJavaScript);
+        return { ...result, popped: lastPoppedBlock };
+    }
+    scopeStack.push(new Map());
+    const result = processStatement(node, defId, useId, scopeStack, isJavaScript);
+    const popped = scopeStack.pop();
+    carryBranchDefsOut(popped, scopeStack, false);
+    return { ...result, popped };
+}
+/**
+ * After an `if` / `else` whose two arms both assign `name` directly, every path
+ * writes it: the arm defs replace the reaching def (and the alternates that
+ * existed before the `if`) instead of sitting beside them.
+ */
+function mergeIfElseDefs(armA, armB, before, scopeStack) {
+    const top = scopeStack[scopeStack.length - 1];
+    if (!top)
+        return;
+    const alts = alternateDefs.get(top);
+    for (const [name, idA] of armA) {
+        const idB = armB.get(name);
+        if (idB === undefined)
+            continue;
+        if (declaredNames.get(armA)?.has(name) || declaredNames.get(armB)?.has(name))
+            continue;
+        if (!scopeStack.some((scope) => scope.has(name)))
+            continue;
+        const prior = new Set(before.get(name) ?? []);
+        const arms = (alts?.get(name) ?? []).filter((id) => !prior.has(id) && id !== idB);
+        if (!arms.includes(idA))
+            arms.push(idA);
+        top.set(name, idB);
+        let map = alts;
+        if (!map) {
+            map = new Map();
+            alternateDefs.set(top, map);
+        }
+        map.set(name, arms);
+    }
+}
+const declaredNames = new WeakMap();
+const alternateDefs = new WeakMap();
+function markDeclared(scope, name) {
+    let set = declaredNames.get(scope);
+    if (!set) {
+        set = new Set();
+        declaredNames.set(scope, set);
+    }
+    set.add(name);
+    alternateDefs.get(scope)?.delete(name);
+}
+function carryBranchDefsOut(popped, scopeStack, alwaysRuns = false, altsOnly = false) {
+    const declared = declaredNames.get(popped);
+    const poppedAlts = alternateDefs.get(popped);
+    const top = scopeStack[scopeStack.length - 1];
+    if (!top)
+        return;
+    if (alwaysRuns) {
+        // Straight-line block: its defs run whenever it does, so they are as if
+        // made directly in the enclosing scope. They become that scope's reaching
+        // def and drop the alternates for the name; defs the block itself held as
+        // alternates stay alternates. (A def under a braceless `if` / loop body
+        // never lands in `popped`: that body has its own scope, see `processArm`.)
+        for (const [name, id] of popped) {
+            if (declared?.has(name))
+                continue;
+            if (!scopeStack.some((scope) => scope.has(name)))
+                continue;
+            top.set(name, id);
+            let alts = alternateDefs.get(top);
+            if (!alts) {
+                alts = new Map();
+                alternateDefs.set(top, alts);
+            }
+            alts.delete(name);
+            const kept = poppedAlts?.get(name);
+            if (kept && kept.length > 0)
+                alts.set(name, [...kept]);
+        }
+        // Alternates for a name the block did not assign itself stay alternates.
+        if (poppedAlts)
+            for (const [name, ids] of poppedAlts)
+                if (!popped.has(name))
+                    carry(name, ids);
+        return;
+    }
+    // The alternate is parked on the immediate parent whenever some outer scope
+    // declares the name, so a later assignment in that parent (or an enclosing
+    // straight-line block) can still kill it; the parent hands it on when it ends.
+    function carry(name, ids) {
+        if (declared?.has(name))
+            return;
+        if (!scopeStack.some((scope) => scope.has(name)))
+            return;
+        let alts = alternateDefs.get(top);
+        if (!alts) {
+            alts = new Map();
+            alternateDefs.set(top, alts);
+        }
+        const list = alts.get(name) ?? [];
+        for (const id of ids)
+            if (!list.includes(id))
+                list.push(id);
+        alts.set(name, list);
+    }
+    if (!altsOnly)
+        for (const [name, id] of popped)
+            carry(name, [id]);
+    if (poppedAlts)
+        for (const [name, ids] of poppedAlts)
+            carry(name, ids);
+}
+/** Alternate reaching defs of `name`: those parked on every scope down to the one that binds it. */
+function findAlternateDefs(name, scopeStack) {
+    const out = [];
+    for (let i = scopeStack.length - 1; i >= 0; i--) {
+        const alts = alternateDefs.get(scopeStack[i])?.get(name);
+        if (alts)
+            for (const id of alts)
+                if (!out.includes(id))
+                    out.push(id);
+        if (scopeStack[i].has(name))
+            break;
+    }
+    return out;
+}
 /**
  * Find the reaching definition for a variable.
  */