circle-ir 4.14.2 → 4.16.0

package/dist/analysis/constant-propagation/propagator.js

@@ -6,7 +6,8 @@
  */
 import { isKnown, createUnknown, getNodeText, getNodeLine } from './ast-utils.js';
 import { ExpressionEvaluator } from './evaluator.js';
-import { TAINT_PATTERN_REGEX, SANITIZER_METHODS, PROPAGATOR_METHODS, ANTI_SANITIZER_METHODS } from './patterns.js';
+import { TAINT_PATTERN_REGEX, SANITIZER_METHODS, PROPAGATOR_METHODS, ANTI_SANITIZER_METHODS, HTML_CONTEXT_ENCODER_METHODS, HTML_CONTEXT_ENCODER_UNCOVERED_SINKS, } from './patterns.js';
+import { javaArrayElementStorageKey } from '../java-array-element-keys.js';
 /**
  * Constant Propagator for taint analysis.
  *
@@ -23,6 +24,8 @@ export class ConstantPropagator {
     taintedCollections = new Map();
     // Track variables explicitly assigned from sanitizer calls
     sanitizedVars = new Set();
+    /** #589: per sanitized variable, the sink types its context-specific encoder does NOT clean. */
+    sanitizedVarUncovered = new Map();
     source = '';
     evaluator;
     // Track the expression node that defined each variable (for refinement)
@@ -33,10 +36,23 @@ export class ConstantPropagator {
     methodReturnsConstant = new Set();
     // Track which methods always return sanitized values (inter-procedural analysis)
     methodReturnsSanitized = new Set();
+    /** #581: same-file helpers named like a class-less sanitizer but not actually sanitizing. */
+    localNonSanitizing = new Set();
+    /**
+     * #589: same-file helpers whose every reachable return is a direct call to a
+     * context-specific HTML encoder (`return StringEscapeUtils.escapeHtml(v);`).
+     * Such a helper cleans `xss` like the encoder it wraps, but not `trust_boundary`.
+     */
+    methodReturnsHtmlEncoderOnly = new Set();
+    methodNotHtmlEncoderOnly = new Set();
     // Track which methods return a specific parameter (index) - for taint propagation
     methodReturnsParameter = new Map();
     // Track which methods return safe (non-tainted) values even with tainted input
     methodReturnsSafeValue = new Set();
+    /** Go locals (method-scoped) that were ever assigned a value const-prop cannot prove clean (#751). */
+    goUnknownVars = new Set();
+    /** Every method-scoped name handleGoAssignment wrote; these get no unscoped alias in the result. */
+    goScopedNames = new Set();
     // Additional taint patterns (for test harnesses to inject custom patterns)
     additionalTaintPatterns = [];
     // Track list elements by index for precise list taint tracking
@@ -103,13 +119,19 @@ export class ConstantPropagator {
         this.definitionNodes.clear();
         this.inConditionalBranch = false;
         this.methodReturnsConstant.clear();
+        this.goUnknownVars.clear();
+        this.goScopedNames.clear();
         this.methodReturnsSanitized.clear();
+        this.localNonSanitizing.clear();
+        this.methodReturnsHtmlEncoderOnly.clear();
+        this.methodNotHtmlEncoderOnly.clear();
         this.methodReturnsParameter.clear();
         this.methodReturnsSafeValue.clear();
         this.listElements.clear();
         this.loopVariables.clear();
         this.taintedArrayElements.clear();
         this.sanitizedVars.clear();
+        this.sanitizedVarUncovered.clear();
         this.currentMethod = null;
         this.conditionalTaints.clear();
         this.conditionStack = [];
@@ -162,6 +184,11 @@ export class ConstantPropagator {
                 resultTainted.add(unscoped);
             }
         }
+        // #589 review: do NOT copy sanitizedVarUncovered onto the bare name.
+        // The unscoped sanitizedVars alias stays for legacy readers, but uncovered
+        // sink types are decided from the scoped `method:var` key only — otherwise
+        // a sibling method's local of the same name inherits the encoder set.
+        const resultScopes = new Map(this.sanitizedVarUncovered);
         for (const name of this.sanitizedVars) {
             if (name.includes(':')) {
                 const unscoped = name.substring(name.indexOf(':') + 1);
@@ -171,6 +198,11 @@ export class ConstantPropagator {
         // Add unscoped symbols for backward compatibility with tests
         // The scoped versions take priority in filterCleanVariableSinks
         for (const [name, value] of this.symbols) {
+            // cognium-dev#751: a Go local is only meaningful in its own function. An
+            // unscoped alias would let `query := "SELECT 1"` in one function make
+            // every other function's `query` look clean to the veto.
+            if (this.goScopedNames.has(name))
+                continue;
             if (name.includes(':')) {
                 const unscoped = name.substring(name.indexOf(':') + 1);
                 // Only add if not already present (scoped version wins on conflict)
@@ -186,10 +218,12 @@ export class ConstantPropagator {
             taintedCollections: new Map(this.taintedCollections),
             taintedArrayElements: new Map(this.taintedArrayElements),
             sanitizedVars: resultSanitized,
+            sanitizedVarUncovered: resultScopes,
             conditionalTaints: new Map(this.conditionalTaints),
             lineConditions: new Map(this.lineConditions),
             synchronizedLines: new Set(this.synchronizedLines),
             instanceFieldTaint: new Map(this.instanceFieldTaint),
+            constantReturningMethods: new Set(this.methodReturnsConstant),
         };
     }
     /**
@@ -259,6 +293,7 @@ export class ConstantPropagator {
             let allReturnsConstant = true;
             let allReturnsSanitized = true;
             let allReturnsSafe = true; // Track if all returns are non-tainted
+            let allReturnsHtmlEncoder = true; // #589: every return is a direct HTML-encoder call
             let returnedParamIndex = -1;
             let hasReachableReturn = false;
             for (const ret of returns) {
@@ -267,13 +302,23 @@ export class ConstantPropagator {
                     continue;
                 }
                 hasReachableReturn = true;
-                const valueNode = ret.children.find(c => c.type !== 'return' && c.type !== ';' && c.type !== 'comment');
+                const valueNode = this.returnExpressionValueNode(ret);
                 if (!valueNode) {
                     allReturnsConstant = false;
                     allReturnsSanitized = false;
+                    allReturnsHtmlEncoder = false;
                     allReturnsSafe = false; // void return or unknown - not safe
                     continue;
                 }
+                // #589: `return <Encoder>.<encode>(<the only parameter>)`.
+                const encoderArgs = valueNode.type === 'method_invocation'
+                    ? valueNode.childForFieldName('arguments')?.children.filter((c) => c.type !== '(' && c.type !== ')' && c.type !== ',')
+                    : undefined;
+                if (!(valueNode.type === 'method_invocation' &&
+                    HTML_CONTEXT_ENCODER_METHODS.has(getNodeText(valueNode.childForFieldName('name') ?? valueNode, this.source)) &&
+                    params.length === 1 && encoderArgs?.length === 1 && getNodeText(encoderArgs[0], this.source) === params[0])) {
+                    allReturnsHtmlEncoder = false;
+                }
                 const value = tempPropagator.evaluateExpression(valueNode);
                 if (!isKnown(value)) {
                     allReturnsConstant = false;
@@ -310,12 +355,25 @@ export class ConstantPropagator {
                 }
             }
             if (hasReachableReturn) {
+                // #589: an encoder-only helper is recorded only when no other method of
+                // this name (an overload, an annotated sanitizer) returns anything else.
+                if (allReturnsHtmlEncoder && allReturnsSanitized && !this.methodNotHtmlEncoderOnly.has(methodName) &&
+                    (!this.methodReturnsSanitized.has(methodName) || this.methodReturnsHtmlEncoderOnly.has(methodName))) {
+                    this.methodReturnsHtmlEncoderOnly.add(methodName);
+                }
+                else {
+                    this.methodNotHtmlEncoderOnly.add(methodName);
+                    this.methodReturnsHtmlEncoderOnly.delete(methodName);
+                }
                 if (allReturnsConstant) {
                     this.methodReturnsConstant.add(methodName);
                 }
                 if (allReturnsSanitized) {
                     this.methodReturnsSanitized.add(methodName);
                 }
+                if (hasReachableReturn && SANITIZER_METHODS.has(methodName) && !allReturnsSanitized) {
+                    this.localNonSanitizing.add(methodName);
+                }
                 if (returnedParamIndex >= 0) {
                     this.methodReturnsParameter.set(methodName, returnedParamIndex);
                 }
@@ -431,6 +489,18 @@ export class ConstantPropagator {
         }
         return null;
     }
+    /** Return the expression node from a `return_statement` (Java, Go, Python, …). */
+    returnExpressionValueNode(ret) {
+        const byField = ret.childForFieldName('result');
+        if (byField)
+            return byField;
+        const candidates = ret.children.filter((c) => c.type !== 'return' && c.type !== ';' && c.type !== 'comment');
+        let valueNode = candidates[0];
+        if (valueNode?.type === 'expression_list') {
+            valueNode = valueNode.children.find((c) => c.type !== '(' && c.type !== ')' && c.type !== ',');
+        }
+        return valueNode;
+    }
     getMethodParameters(method) {
         const params = [];
         const paramsNode = method.childForFieldName('parameters');
@@ -443,6 +513,20 @@ export class ConstantPropagator {
                     params.push(getNodeText(nameNode, this.source));
                 }
             }
+            else if (child.type === 'parameter_declaration') {
+                const nameNode = child.childForFieldName('name');
+                if (nameNode) {
+                    if (nameNode.type === 'identifier') {
+                        params.push(getNodeText(nameNode, this.source));
+                    }
+                    else {
+                        for (const id of nameNode.children) {
+                            if (id.type === 'identifier')
+                                params.push(getNodeText(id, this.source));
+                        }
+                    }
+                }
+            }
         }
         return params;
     }
@@ -451,7 +535,7 @@ export class ConstantPropagator {
             const nameNode = node.childForFieldName('name');
             if (nameNode) {
                 const methodName = getNodeText(nameNode, this.source);
-                if (SANITIZER_METHODS.has(methodName)) {
+                if (SANITIZER_METHODS.has(methodName) && !this.localNonSanitizing.has(methodName)) {
                     return true;
                 }
             }
@@ -832,6 +916,7 @@ export class ConstantPropagator {
         }
         switch (node.type) {
             case 'method_declaration':
+            case 'function_declaration':
             case 'constructor_declaration':
                 this.handleMethodDeclaration(node);
                 return true; // Don't visit children directly, handleMethodDeclaration does it
@@ -859,6 +944,10 @@ export class ConstantPropagator {
             case 'assignment_expression':
                 this.handleAssignment(node);
                 return false;
+            case 'short_var_declaration':
+            case 'assignment_statement':
+                this.handleGoAssignment(node);
+                return false;
             case 'update_expression':
                 this.handleUpdateExpression(node);
                 return false;
@@ -884,6 +973,10 @@ export class ConstantPropagator {
             case 'synchronized_statement':
                 this.handleSynchronizedStatement(node);
                 return true;
+            case 'try_statement':
+            case 'try_with_resources_statement':
+                this.handleTryStatement(node);
+                return true;
             default:
                 return false;
         }
@@ -1093,6 +1186,59 @@ export class ConstantPropagator {
                 this.collectLoopVariableNames(child, names);
         }
     }
+    /**
+     * cognium-dev#753 — try/catch must not let a catch-arm literal assignment
+     * erase taint established on the normal-completion path through the try body
+     * (`try { label = format(picked); } catch (…) { label = ""; }` then
+     * `exec(tool + label)`).
+     */
+    handleTryStatement(node) {
+        const body = node.childForFieldName('body');
+        const catches = node.children.filter((c) => c.type === 'catch_clause');
+        const finallyClause = node.children.find((c) => c.type === 'finally_clause');
+        const taintedBefore = new Set(this.tainted);
+        const symbolsBefore = new Map(this.symbols);
+        if (body)
+            this.visit(body);
+        const taintedAfterTry = new Set(this.tainted);
+        const symbolsAfterTry = new Map(this.symbols);
+        this.tainted = new Set(taintedBefore);
+        this.symbols = new Map(symbolsBefore);
+        for (const c of catches)
+            this.visit(c);
+        const taintedAfterCatch = new Set(this.tainted);
+        const symbolsAfterCatch = new Map(this.symbols);
+        this.tainted = new Set([...taintedBefore, ...taintedAfterTry, ...taintedAfterCatch]);
+        this.symbols = new Map(symbolsBefore);
+        const keys = new Set([...symbolsAfterTry.keys(), ...symbolsAfterCatch.keys()]);
+        for (const key of keys) {
+            const merged = this.mergeTryCatchSymbol(symbolsAfterTry.get(key), symbolsAfterCatch.get(key));
+            if (merged)
+                this.symbols.set(key, merged);
+        }
+        if (finallyClause)
+            this.visit(finallyClause);
+    }
+    /** Prefer unknown / non-literal over a definite literal when paths disagree. */
+    mergeTryCatchSymbol(tryVal, catchVal) {
+        if (!tryVal && !catchVal)
+            return undefined;
+        if (!tryVal)
+            return catchVal;
+        if (!catchVal)
+            return tryVal;
+        if (!isKnown(tryVal) || tryVal.type === 'unknown')
+            return tryVal;
+        if (!isKnown(catchVal) || catchVal.type === 'unknown')
+            return catchVal;
+        if (tryVal.type !== catchVal.type) {
+            return createUnknown(Math.max(tryVal.sourceLine ?? 0, catchVal.sourceLine ?? 0));
+        }
+        if (tryVal.type === 'string' && catchVal.type === 'string' && tryVal.value !== catchVal.value) {
+            return createUnknown(Math.max(tryVal.sourceLine ?? 0, catchVal.sourceLine ?? 0));
+        }
+        return tryVal;
+    }
     /**
      * Handle synchronized statements.
      * Operations inside synchronized blocks are atomic, so field strong updates are safe.
@@ -1170,6 +1316,7 @@ export class ConstantPropagator {
                         if (isTainted) {
                             this.tainted.add(scopedName);
                             this.sanitizedVars.delete(scopedName); // No longer sanitized if receiving tainted value
+                            this.sanitizedVarUncovered.delete(scopedName);
                             this.definitionNodes.set(scopedName, valueNode);
                             this.symbols.set(scopedName, createUnknown(line));
                         }
@@ -1182,15 +1329,23 @@ export class ConstantPropagator {
                             this.definitionNodes.delete(scopedName);
                             const value = this.evaluateExpression(valueNode);
                             this.symbols.set(scopedName, value);
-                            // Track if this variable was explicitly assigned from a sanitizer call
+                            // Track if this variable was explicitly assigned from a sanitizer call.
+                            // A constant / non-sanitizer overwrite must clear any prior encoder
+                            // scope (#589 review: `data = escapeHtml(x); data = "safe"`).
                             if (this.isSanitizerMethodCall(valueNode)) {
                                 this.sanitizedVars.add(scopedName);
+                                this.recordSanitizerScope(scopedName, valueNode);
+                            }
+                            else {
+                                this.sanitizedVars.delete(scopedName);
+                                this.sanitizedVarUncovered.delete(scopedName);
                             }
                             // Check if this is an anti-sanitizer call that reintroduces taint
                             // e.g., URLDecoder.decode(sanitizedVar) produces tainted output
                             if (this.antiSanitizerReintroducesTaint(valueNode)) {
                                 this.tainted.add(scopedName);
                                 this.sanitizedVars.delete(scopedName);
+                                this.sanitizedVarUncovered.delete(scopedName);
                             }
                         }
                     }
@@ -1201,6 +1356,101 @@ export class ConstantPropagator {
             }
         }
     }
+    /**
+     * Go `:=` / `=` (cognium-dev#751).
+     *
+     * Const-prop does not model Go request sources, so a right-hand side it does
+     * not see as tainted is usually just *unknown* (`r.URL.Query().Get("f")`,
+     * `"SELECT " + f`, `r.FormValue("x")`). Recording such a variable as a clean
+     * symbol makes the const-prop veto drop real flows downstream, so only a
+     * right-hand side that is provably clean — a constant, or a call to a local
+     * helper that always returns a constant — clears the variable. Anything else stops being tracked here, which is what Go
+     * assignments got before this handler existed: the DFG decides.
+     */
+    handleGoAssignment(node) {
+        const left = node.childForFieldName('left');
+        const right = node.childForFieldName('right');
+        if (!left || !right)
+            return;
+        const names = [];
+        if (left.type === 'identifier') {
+            names.push(getNodeText(left, this.source));
+        }
+        else if (left.type === 'expression_list') {
+            for (const c of left.children) {
+                if (c.type === 'identifier')
+                    names.push(getNodeText(c, this.source));
+            }
+        }
+        if (names.length === 0)
+            return;
+        // The Go grammar wraps every right-hand side in an `expression_list`, so
+        // pair each name with its own expression (`a, b := x, y`); one expression
+        // for several names (`v, err := f()`) applies to all of them.
+        const rhs = right.type === 'expression_list'
+            ? right.children.filter((c) => c.type !== ',' && c.type !== 'comment')
+            : [right];
+        const line = getNodeLine(node);
+        for (let i = 0; i < names.length; i++) {
+            const varName = names[i];
+            if (varName === '_')
+                continue;
+            const value = rhs.length === names.length ? rhs[i] : rhs.length === 1 ? rhs[0] : undefined;
+            const scopedName = this.getScopedName(varName);
+            this.goScopedNames.add(scopedName);
+            if (value && this.isTaintedExpression(value)) {
+                this.goUnknownVars.add(scopedName);
+                this.tainted.add(scopedName);
+                this.sanitizedVars.delete(scopedName);
+                this.sanitizedVarUncovered.delete(scopedName);
+                this.definitionNodes.set(scopedName, value);
+                this.symbols.set(scopedName, createUnknown(line));
+                continue;
+            }
+            if (!value || !this.isGoKnownCleanRhs(value) || this.goUnknownVars.has(scopedName)) {
+                // Unknown value: forget what we knew, and do not trust a later clean
+                // assignment either, since const-prop's symbols are not flow-sensitive
+                // and a sink between the two would be vetoed. In a conditional branch
+                // the other path may still carry the old value, so keep any taint.
+                this.goUnknownVars.add(scopedName);
+                this.symbols.delete(scopedName);
+                this.sanitizedVars.delete(scopedName);
+                this.sanitizedVarUncovered.delete(scopedName);
+                if (!this.inConditionalBranch) {
+                    this.tainted.delete(scopedName);
+                    this.definitionNodes.delete(scopedName);
+                }
+                continue;
+            }
+            // Provably clean, but only on this path: a branch must not clear taint
+            // or make an untracked variable look clean at the join.
+            if (this.inConditionalBranch) {
+                this.goUnknownVars.add(scopedName);
+                this.symbols.delete(scopedName);
+                continue;
+            }
+            this.tainted.delete(scopedName);
+            this.definitionNodes.delete(scopedName);
+            this.symbols.set(scopedName, this.evaluateExpression(value));
+            this.sanitizedVars.delete(scopedName);
+            this.sanitizedVarUncovered.delete(scopedName);
+        }
+    }
+    /**
+     * A Go right-hand side whose value is clean regardless of its inputs: a
+     * compile-time constant, or a call to a local helper whose every reachable
+     * return is a constant (#751). Sanitizer-style calls are deliberately not
+     * included: clearing here vetoes every sink type, and Go sanitizers are
+     * sink-specific (`strconv.Atoi` bounds nothing for a `make` size, #349).
+     */
+    isGoKnownCleanRhs(right) {
+        if (isKnown(this.evaluateExpression(right)))
+            return true;
+        if (right.type !== 'call_expression')
+            return false;
+        const callee = this.extractCallName(right);
+        return callee !== null && this.methodReturnsConstant.has(callee);
+    }
     handleAssignment(node) {
         const left = node.childForFieldName('left');
         const right = node.childForFieldName('right');
@@ -1225,6 +1475,7 @@ export class ConstantPropagator {
         if (this.isTaintedExpression(right)) {
             this.tainted.add(scopedName);
             this.sanitizedVars.delete(scopedName); // No longer sanitized if receiving tainted value
+            this.sanitizedVarUncovered.delete(scopedName);
             this.definitionNodes.set(scopedName, right);
             this.symbols.set(scopedName, createUnknown(line));
             // Track constructor field assignments: this.field = taintedParam
@@ -1269,9 +1520,15 @@ export class ConstantPropagator {
                 this.definitionNodes.delete(scopedName);
                 const value = this.evaluateExpression(right);
                 this.symbols.set(scopedName, value);
-                // Track if this variable was explicitly assigned from a sanitizer call
+                // Track if this variable was explicitly assigned from a sanitizer call.
+                // Constant / non-sanitizer overwrite clears prior encoder scope (#589).
                 if (this.isSanitizerMethodCall(right)) {
                     this.sanitizedVars.add(scopedName);
+                    this.recordSanitizerScope(scopedName, right);
+                }
+                else {
+                    this.sanitizedVars.delete(scopedName);
+                    this.sanitizedVarUncovered.delete(scopedName);
                 }
             }
             // Check if this is an anti-sanitizer call that reintroduces taint
@@ -1279,17 +1536,24 @@ export class ConstantPropagator {
             if (this.antiSanitizerReintroducesTaint(right)) {
                 this.tainted.add(scopedName);
                 this.sanitizedVars.delete(scopedName);
+                this.sanitizedVarUncovered.delete(scopedName);
             }
         }
     }
-    handleArrayElementAssignment(left, right, node) {
-        // Extract array name and index from array[index]
-        const arrayNode = left.childForFieldName('array') || left.child(0);
-        const indexNode = left.childForFieldName('index') || left.child(2);
-        if (!arrayNode)
+    handleArrayElementAssignment(left, right, _node) {
+        const chain = this.parseArrayAccessChain(left);
+        if (!chain)
             return;
-        const arrayName = getNodeText(arrayNode, this.source);
-        // Determine the index key (numeric or '*' for unknown)
+        const { arrayName, indexKey } = this.arrayElementStorageKey(chain);
+        const isTainted = this.isTaintedExpression(right);
+        this.setArrayElementTaint(arrayName, indexKey, isTainted);
+    }
+    /** cognium-dev#476: `grid[0][0]` and deeper element paths. */
+    parseArrayAccessChain(node) {
+        if (node.type !== 'array_access' && node.type !== 'subscript_expression') {
+            return null;
+        }
+        const indexNode = node.childForFieldName('index') || node.child(2);
         let indexKey = '*';
         if (indexNode) {
             const indexValue = this.evaluateExpression(indexNode);
@@ -1297,24 +1561,54 @@ export class ConstantPropagator {
                 indexKey = String(indexValue.value);
             }
         }
-        const isTainted = this.isTaintedExpression(right);
+        const arrayNode = node.childForFieldName('array') || node.child(0);
+        if (!arrayNode)
+            return null;
+        if (arrayNode.type === 'identifier') {
+            return { base: getNodeText(arrayNode, this.source), indices: [indexKey] };
+        }
+        if (arrayNode.type === 'array_access' || arrayNode.type === 'subscript_expression') {
+            const inner = this.parseArrayAccessChain(arrayNode);
+            if (!inner)
+                return null;
+            return { base: inner.base, indices: [...inner.indices, indexKey] };
+        }
+        return null;
+    }
+    arrayElementStorageKey(chain) {
+        return javaArrayElementStorageKey(chain.base, chain.indices);
+    }
+    setArrayElementTaint(arrayName, indexKey, isTainted) {
         if (isTainted) {
-            // Mark this array element as tainted
             if (!this.taintedArrayElements.has(arrayName)) {
                 this.taintedArrayElements.set(arrayName, new Set());
             }
             this.taintedArrayElements.get(arrayName).add(indexKey);
         }
         else {
-            // Mark this array element as clean (remove from tainted set)
             const taintedIndices = this.taintedArrayElements.get(arrayName);
             if (taintedIndices) {
                 taintedIndices.delete(indexKey);
-                // If we're assigning to a specific index and '*' is in the set,
-                // we can't remove '*' because other indices might still be tainted
             }
         }
     }
+    isArrayElementAccessTainted(chain) {
+        if (this.tainted.has(chain.base)) {
+            return true;
+        }
+        const { arrayName, indexKey } = this.arrayElementStorageKey(chain);
+        const taintedIndices = this.taintedArrayElements.get(arrayName);
+        if (!taintedIndices) {
+            return false;
+        }
+        if (taintedIndices.has('*')) {
+            return true;
+        }
+        if (indexKey === '*') {
+            return taintedIndices.size > 0;
+        }
+        return taintedIndices.has(indexKey);
+    }
     handleUpdateExpression(node) {
         // Handle x++, ++x, x--, --x
         // The operand is a positional child (identifier), not a named field
@@ -1456,10 +1750,12 @@ export class ConstantPropagator {
             if (guardedVar) {
                 this.tainted.delete(guardedVar);
                 this.sanitizedVars.add(guardedVar);
+                this.sanitizedVarUncovered.delete(guardedVar);
                 const scoped = this.getScopedName(guardedVar);
                 if (scoped !== guardedVar) {
                     this.tainted.delete(scoped);
                     this.sanitizedVars.add(scoped);
+                    this.sanitizedVarUncovered.delete(scoped);
                 }
             }
         }
@@ -1682,6 +1978,7 @@ export class ConstantPropagator {
         for (const child of node.children) {
             if (child.type === 'method_invocation') {
                 this.checkCollectionTaint(child);
+                this.handleSystemArrayCopy(child);
             }
         }
         for (const child of node.children) {
@@ -1772,11 +2069,27 @@ export class ConstantPropagator {
      * Handles Java (`method_invocation`), Go/JS/TS (`call_expression`), and
      * Python (`call`) AST shapes.
      */
+    /**
+     * #589: remember which sink types the sanitizer behind `scopedName` does NOT
+     * clean. Only context-specific HTML/markup encoders carry an entry; any other
+     * sanitizer clears a previously recorded one (the variable was reassigned).
+     */
+    recordSanitizerScope(scopedName, node) {
+        const methodName = this.extractCallName(node);
+        if (methodName && ((HTML_CONTEXT_ENCODER_METHODS.has(methodName) && !this.methodReturnsSanitized.has(methodName)) ||
+            this.methodReturnsHtmlEncoderOnly.has(methodName))) {
+            this.sanitizedVarUncovered.set(scopedName, HTML_CONTEXT_ENCODER_UNCOVERED_SINKS);
+        }
+        else {
+            this.sanitizedVarUncovered.delete(scopedName);
+        }
+    }
     isSanitizerMethodCall(node) {
         const methodName = this.extractCallName(node);
         if (!methodName)
             return false;
-        return SANITIZER_METHODS.has(methodName) || this.methodReturnsSanitized.has(methodName);
+        return (SANITIZER_METHODS.has(methodName) && !this.localNonSanitizing.has(methodName))
+            || this.methodReturnsSanitized.has(methodName);
     }
     /**
      * Extract the trailing method/function name from any call node shape:
@@ -2013,7 +2326,7 @@ export class ConstantPropagator {
             const objectNode = node.childForFieldName('object');
             if (nameNode) {
                 const methodName = getNodeText(nameNode, this.source);
-                if (SANITIZER_METHODS.has(methodName)) {
+                if (SANITIZER_METHODS.has(methodName) && !this.localNonSanitizing.has(methodName)) {
                     return false;
                 }
                 if (this.methodReturnsConstant.has(methodName)) {
@@ -2177,43 +2490,50 @@ export class ConstantPropagator {
                 }
             }
         }
-        if (node.type === 'array_access' || node.type === 'subscript_expression') {
-            const arrayNode = node.childForFieldName('array') || node.child(0);
-            const indexNode = node.childForFieldName('index') || node.child(2);
-            if (arrayNode) {
-                const arrayName = getNodeText(arrayNode, this.source);
-                // Check if the whole array is tainted
-                if (arrayNode.type === 'identifier' && this.tainted.has(arrayName)) {
-                    return true;
+        if (node.type === 'call_expression' || node.type === 'call') {
+            const methodName = this.extractCallName(node);
+            if (methodName) {
+                if (SANITIZER_METHODS.has(methodName) && !this.localNonSanitizing.has(methodName)) {
+                    return false;
                 }
-                // Check element-level taint tracking
-                const taintedIndices = this.taintedArrayElements.get(arrayName);
-                if (taintedIndices) {
-                    // If '*' is in the set, the whole array has tainted elements
-                    if (taintedIndices.has('*')) {
-                        return true;
-                    }
-                    // Check specific index
-                    if (indexNode) {
-                        const indexValue = this.evaluateExpression(indexNode);
-                        if (isKnown(indexValue) && (indexValue.type === 'int' || indexValue.type === 'string')) {
-                            const indexKey = String(indexValue.value);
-                            if (taintedIndices.has(indexKey)) {
-                                return true;
-                            }
-                            // Specific index is NOT tainted - return false for this access
-                            return false;
-                        }
-                        // Unknown index - check if ANY element is tainted
-                        if (taintedIndices.size > 0) {
+                if (this.methodReturnsConstant.has(methodName)) {
+                    return false;
+                }
+                if (this.methodReturnsSanitized.has(methodName)) {
+                    return false;
+                }
+                if (this.methodReturnsSafeValue.has(methodName)) {
+                    return false;
+                }
+                const returnedParamIdx = this.methodReturnsParameter.get(methodName);
+                if (returnedParamIdx !== undefined && returnedParamIdx >= 0) {
+                    const argsNode = node.childForFieldName('arguments');
+                    if (argsNode) {
+                        const args = argsNode.children.filter((c) => c.type !== '(' && c.type !== ')' && c.type !== ',');
+                        if (args.length > returnedParamIdx && this.isTaintedExpression(args[returnedParamIdx])) {
                             return true;
                         }
                     }
                 }
-                // Recursively check if arrayNode itself is tainted
-                if (this.isTaintedExpression(arrayNode)) {
+            }
+        }
+        if (node.type === 'array_access' || node.type === 'subscript_expression') {
+            const chain = this.parseArrayAccessChain(node);
+            if (chain) {
+                if (this.isArrayElementAccessTainted(chain)) {
                     return true;
                 }
+                if (chain.indices.length === 1 && chain.indices[0] !== '*') {
+                    // Known 1-D index with no element taint recorded — not tainted.
+                    const taintedIndices = this.taintedArrayElements.get(chain.base);
+                    if (taintedIndices && !this.tainted.has(chain.base)) {
+                        return false;
+                    }
+                }
+            }
+            const arrayNode = node.childForFieldName('array') || node.child(0);
+            if (arrayNode && this.isTaintedExpression(arrayNode)) {
+                return true;
             }
         }
         if (node.type === 'ternary_expression') {
@@ -2318,6 +2638,33 @@ export class ConstantPropagator {
         // No verdict at this node — let the wrapper descend into children.
         return undefined;
     }
+    /** cognium-dev#476: copy tainted array element indices across `System.arraycopy`. */
+    handleSystemArrayCopy(node) {
+        const objectNode = node.childForFieldName('object');
+        const nameNode = node.childForFieldName('name');
+        const argsNode = node.childForFieldName('arguments');
+        if (!nameNode || !argsNode)
+            return;
+        if (getNodeText(nameNode, this.source) !== 'arraycopy')
+            return;
+        if (!objectNode || getNodeText(objectNode, this.source) !== 'System')
+            return;
+        const args = argsNode.children.filter((c) => c.type !== '(' && c.type !== ')' && c.type !== ',');
+        if (args.length < 3)
+            return;
+        const srcName = getNodeText(args[0], this.source);
+        const dstName = getNodeText(args[2], this.source);
+        const srcTainted = this.taintedArrayElements.get(srcName);
+        if (!srcTainted || srcTainted.size === 0)
+            return;
+        if (!this.taintedArrayElements.has(dstName)) {
+            this.taintedArrayElements.set(dstName, new Set());
+        }
+        const dstSet = this.taintedArrayElements.get(dstName);
+        for (const idx of srcTainted) {
+            dstSet.add(idx);
+        }
+    }
     checkCollectionTaint(node) {
         const objectNode = node.childForFieldName('object');
         const nameNode = node.childForFieldName('name');