circle-ir 4.15.0 → 4.16.0

package/dist/analysis/passes/language-sources-pass.js

@@ -18,6 +18,7 @@ import { attachSourceLineCode } from '../taint-matcher.js';
 import { javaReplaceCrLfCoverage } from '../java-crlf-strip.js';
 import { javaCallArgument, javaCanonicalBaseLacksSeparator } from '../java-canonical-prefix.js';
 import { findGoStringsReplacerSanitizers } from '../go-strings-replacer.js';
+import { findRustLiteralEqualityGuardSanitizers } from '../rust-literal-guard.js';
 import { constLookupTables, isConstTableLookup } from '../const-table-lookup.js';
 // ---------------------------------------------------------------------------
 // Pattern tables (moved from analyzer.ts)
@@ -222,6 +223,22 @@ export class LanguageSourcesPass {
                 });
             }
         }
+        // -- Java (#624): JSPWiki plugin `execute` return is HTML output ------------
+        if (language === 'java') {
+            const tm = ctx.getResult('taint-matcher');
+            const xssSan = tm.sanitizers.filter(sa => sa.sanitizes.includes('xss')).map(sa => ({ line: sa.line, method: sa.method }));
+            for (const r of findJavaWikiPluginReturnXSSSinks(code, types, graph.ir.imports, tm.sources, xssSan)) {
+                if (additionalSinks.some(s => s.line === r.sinkLine && s.type === 'xss'))
+                    continue;
+                additionalSinks.push({
+                    type: 'xss',
+                    cwe: 'CWE-79',
+                    line: r.sinkLine,
+                    location: `WikiPlugin.execute returns HTML with user input at line ${r.sinkLine}`,
+                    confidence: 0.9,
+                });
+            }
+        }
         // -- Python: assignment sources, trust-boundary sinks, return-XSS sinks --
         additionalSources.push(...findPythonAssignmentSources(code, language));
         const pyTaintedVars = language === 'python' ? buildPythonTaintedVars(code) : new Map();
@@ -342,6 +359,7 @@ export class LanguageSourcesPass {
             // recognition.
             additionalSanitizers.push(...findPythonRegexAllowlistWrapperSanitizers(code));
             additionalSanitizers.push(...findPythonSetMembershipXssGuardSanitizers(code));
+            additionalSanitizers.push(...findPythonLiteralMembershipGuardSanitizers(code));
             additionalSanitizers.push(...findPythonTraversalRejectGuardSanitizers(code));
             additionalSanitizers.push(...findPythonStringLiteralGuardSanitizers(code));
             additionalSanitizers.push(...findPythonDefaultSaxParserXxeSanitizers(code));
@@ -401,6 +419,8 @@ export class LanguageSourcesPass {
         if (language === 'rust') {
             additionalSanitizers.push(...findRustSetAllowlistGuardSanitizers(code));
             additionalSanitizers.push(...findRustCanonicalizeGuardSanitizers(code));
+            // cognium-dev#293: `if x != "a" && x != "b" { return Err(..) }` literal-equality guard.
+            additionalSanitizers.push(...findRustLiteralEqualityGuardSanitizers(code));
             // Sprint 77a (#216 Pattern X): argv-form Command::new(literal).arg(...)
             // sanitizer.
             additionalSanitizers.push(...findRustArgvCommandSanitizers(code));
@@ -544,8 +564,6 @@ export class LanguageSourcesPass {
                 const tm = ctx.getResult('taint-matcher');
                 const xssSan = tm.sanitizers.filter(sa => sa.sanitizes.includes('xss')).map(sa => sa.line);
                 for (const r of findJavaSpringReturnXSSSinks(code, types, tm.sources, xssSan)) {
-                    if (additionalSinks.some(s => s.line === r.sinkLine && s.type === 'xss'))
-                        continue;
                     additionalSinks.push({
                         type: 'xss',
                         cwe: 'CWE-79',
@@ -1610,6 +1628,50 @@ function findGoRequestBodySources(sourceCode, language) {
     }
     return sources;
 }
+/** cognium-dev#490 — split `a; b; c` on one line (no `{`), respecting string literals. */
+function splitCSharpDepth0Statements(line) {
+    if (line.includes('{'))
+        return [line];
+    const statements = [];
+    let start = 0;
+    let depth = 0;
+    let inStr = null;
+    let esc = false;
+    for (let i = 0; i < line.length; i++) {
+        const c = line[i];
+        if (inStr) {
+            if (esc) {
+                esc = false;
+                continue;
+            }
+            if (c === '\\') {
+                esc = true;
+                continue;
+            }
+            if (c === inStr)
+                inStr = null;
+            continue;
+        }
+        if (c === '"' || c === "'") {
+            inStr = c;
+            continue;
+        }
+        if (c === '(' || c === '[')
+            depth++;
+        else if (c === ')' || c === ']')
+            depth = Math.max(0, depth - 1);
+        else if (c === ';' && depth === 0) {
+            const part = line.slice(start, i + 1).trim();
+            if (part)
+                statements.push(part);
+            start = i + 1;
+        }
+    }
+    const tail = line.slice(start).trim();
+    if (tail)
+        statements.push(tail);
+    return statements.length > 1 ? statements : [line];
+}
 function findCSharpRequestSources(sourceCode, language) {
     if (language !== 'csharp')
         return [];
@@ -1632,6 +1694,13 @@ function findCSharpRequestSources(sourceCode, language) {
     // of defect as #350 (Java try-with-resources): a resource-declaration syntax
     // the scanner never looked at.
     const assignRe = /^\s*(?:await\s+)?(?:using\s*\(?\s*)?(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
+    // cognium-dev#638 — `arr[i] = req.QueryString["k"]` does not match `assignRe`
+    // (LHS is an indexer). Seed the array base so cross-file calls that pass
+    // `arr` carry taint into `string[]` / `object[]` callee parameters.
+    const arrayElementAssignRe = /^\s*([A-Za-z_]\w*)\s*\[[^\]]+\]\s*=\s*(.+?);?\s*$/;
+    // cognium-dev#638 step 3 — `box.value = req.QueryString["k"]` seeds the
+    // container local so cross-file calls that pass `box` carry taint.
+    const memberFieldAssignRe = /^\s*([A-Za-z_]\w*)\.([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
     // `Request.*` is the inherited controller member. A parameter typed
     // `HttpRequest` / `HttpRequestBase` is the same surface under whatever
     // name the method uses (`req` in Juliet) — cognium-dev#501.
@@ -1761,97 +1830,136 @@ function findCSharpRequestSources(sourceCode, language) {
     // when it is not the line's code.
     const embeddedAssignRe = /(?:^|[{;])\s*(?:await\s+)?(?:using\s*\(?\s*)?(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=(?!=)\s*([^;{}]+)/;
     for (let i = 0; i < lines.length; i++) {
-        const m = assignRe.exec(lines[i]);
-        // cognium-dev#502 — `assignRe` is anchored and greedy, so on a one-line
-        // block header that also contains the real assignment
-        //
-        //   using (StreamReader sr = new StreamReader(tcp.GetStream())) { data = sr.ReadLine(); }
-        //
-        // it captures `sr` with EVERYTHING after `=` as the right-hand side. That
-        // RHS contains `sr.ReadLine()`, so the line was classified as a read and
-        // bound to `sr` — the reader, not `data`. The embedded-assignment path
-        // handles exactly this shape and finds both `sr` and `data`, but it only
-        // ran when `assignRe` failed to match at all. Prefer it whenever the
-        // captured RHS crosses a block boundary. (#504 was the mirror of this:
-        // there `assignRe` did not match and the inner assignment was lost.)
-        const rhsCrossesBlock = m !== null && m[2].includes('{');
-        if (!m || rhsCrossesBlock) {
-            const stmt = lines[i];
-            if (stmt.includes('{') && !/^\s*(?:\/\/|\/\*|\*)/.test(stmt)) {
-                const emb = new RegExp(embeddedAssignRe.source, 'g');
-                let em;
-                let seeded = false;
-                while ((em = emb.exec(stmt)) !== null) {
-                    const varName = em[1];
-                    const rhs = em[2];
-                    const type = classify(rhs);
-                    if (!type)
-                        continue;
+        for (const stmt of splitCSharpDepth0Statements(lines[i])) {
+            const arrEl = arrayElementAssignRe.exec(stmt);
+            if (arrEl) {
+                const [, baseName, rhs] = arrEl;
+                const type = classify(rhs);
+                if (type && baseName) {
                     const lineNumber = i + 1;
-                    if (sources.some(s => s.line === lineNumber && s.variable === varName))
-                        continue;
-                    sources.push({
-                        type,
-                        location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''}`,
-                        // #502 — Java parity: a database row read is medium, I/O is high.
-                        severity: type === 'db_input' ? 'medium' : 'high',
-                        line: lineNumber,
-                        confidence: 1.0,
-                        variable: varName,
-                    });
-                    seeded = true;
+                    if (!sources.some(s => s.line === lineNumber && s.variable === baseName)) {
+                        sources.push({
+                            type,
+                            location: `${baseName}[…] = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''}`,
+                            severity: type === 'db_input' ? 'medium' : 'high',
+                            line: lineNumber,
+                            confidence: 1.0,
+                            variable: baseName,
+                        });
+                    }
+                    continue;
                 }
-                if (seeded)
+            }
+            const memEl = memberFieldAssignRe.exec(stmt);
+            if (memEl) {
+                const [, baseName, fieldName, rhs] = memEl;
+                const type = classify(rhs);
+                if (type && baseName) {
+                    const lineNumber = i + 1;
+                    if (!sources.some(s => s.line === lineNumber && s.variable === baseName)) {
+                        sources.push({
+                            type,
+                            location: `${baseName}.${fieldName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''}`,
+                            severity: type === 'db_input' ? 'medium' : 'high',
+                            line: lineNumber,
+                            confidence: 1.0,
+                            variable: baseName,
+                        });
+                    }
                     continue;
+                }
             }
-            if (!exprStmtCallRe.test(stmt) || nonCallKeywordRe.test(stmt))
+            const m = assignRe.exec(stmt);
+            // cognium-dev#502 — `assignRe` is anchored and greedy, so on a one-line
+            // block header that also contains the real assignment
+            //
+            //   using (StreamReader sr = new StreamReader(tcp.GetStream())) { data = sr.ReadLine(); }
+            //
+            // it captures `sr` with EVERYTHING after `=` as the right-hand side. That
+            // RHS contains `sr.ReadLine()`, so the line was classified as a read and
+            // bound to `sr` — the reader, not `data`. The embedded-assignment path
+            // handles exactly this shape and finds both `sr` and `data`, but it only
+            // ran when `assignRe` failed to match at all. Prefer it whenever the
+            // captured RHS crosses a block boundary. (#504 was the mirror of this:
+            // there `assignRe` did not match and the inner assignment was lost.)
+            const rhsCrossesBlock = m !== null && m[2].includes('{');
+            if (!m || rhsCrossesBlock) {
+                if (stmt.includes('{') && !/^\s*(?:\/\/|\/\*|\*)/.test(stmt)) {
+                    const emb = new RegExp(embeddedAssignRe.source, 'g');
+                    let em;
+                    let seeded = false;
+                    while ((em = emb.exec(stmt)) !== null) {
+                        const varName = em[1];
+                        const rhs = em[2];
+                        const type = classify(rhs);
+                        if (!type)
+                            continue;
+                        const lineNumber = i + 1;
+                        if (sources.some(s => s.line === lineNumber && s.variable === varName))
+                            continue;
+                        sources.push({
+                            type,
+                            location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''}`,
+                            // #502 — Java parity: a database row read is medium, I/O is high.
+                            severity: type === 'db_input' ? 'medium' : 'high',
+                            line: lineNumber,
+                            confidence: 1.0,
+                            variable: varName,
+                        });
+                        seeded = true;
+                    }
+                    if (seeded)
+                        continue;
+                }
+                if (!exprStmtCallRe.test(stmt) || nonCallKeywordRe.test(stmt))
+                    continue;
+                const hit = inlineRead(stmt);
+                if (!hit)
+                    continue;
+                const { type, read } = hit;
+                const lineNumber = i + 1;
+                if (sources.some(s => s.line === lineNumber))
+                    continue;
+                // `variable` is the `<inline>` marker (the same one the inline
+                // colocation flow puts on its path steps), never a real name. It
+                // must be set, and must match nothing:
+                //   - with NO variable, `findInitialTaint` seeds every def on the
+                //     FOLLOWING line by adjacency, so `Log(file.FileName);` followed by
+                //     `var x = "/tmp/a";` tainted the constant `x`;
+                //   - with the read text itself (`file.FileName`) as the variable, the
+                //     colocation path treats it as an LHS binding and hands the pair
+                //     to the variable scan, which only looks at strictly later sinks —
+                //     so the same-line flow this exists for was lost.
+                // The marker reaches only a sink on this very statement.
+                const code = stmt.trim();
+                sources.push({
+                    type,
+                    location: `${read} in ${code.substring(0, 50)}${code.length > 50 ? '...' : ''}`,
+                    severity: type === 'db_input' ? 'medium' : 'high',
+                    line: lineNumber,
+                    confidence: 1.0,
+                    variable: '<inline>',
+                    code,
+                });
                 continue;
-            const hit = inlineRead(stmt);
-            if (!hit)
+            }
+            const [, varName, rhs] = m;
+            const type = classify(rhs);
+            if (!type)
                 continue;
-            const { type, read } = hit;
             const lineNumber = i + 1;
-            if (sources.some(s => s.line === lineNumber))
-                continue;
-            // `variable` is the `<inline>` marker (the same one the inline
-            // colocation flow puts on its path steps), never a real name. It
-            // must be set, and must match nothing:
-            //   - with NO variable, `findInitialTaint` seeds every def on the
-            //     FOLLOWING line by adjacency, so `Log(file.FileName);` followed by
-            //     `var x = "/tmp/a";` tainted the constant `x`;
-            //   - with the read text itself (`file.FileName`) as the variable, the
-            //     colocation path treats it as an LHS binding and hands the pair
-            //     to the variable scan, which only looks at strictly later sinks —
-            //     so the same-line flow this exists for was lost.
-            // The marker reaches only a sink on this very statement.
-            const code = stmt.trim();
+            if (sources.some(s => s.line === lineNumber && s.variable === varName))
+                continue;
             sources.push({
                 type,
-                location: `${read} in ${code.substring(0, 50)}${code.length > 50 ? '...' : ''}`,
+                location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''}`,
+                // #502 — Java parity: a database row read is medium, I/O is high.
                 severity: type === 'db_input' ? 'medium' : 'high',
                 line: lineNumber,
                 confidence: 1.0,
-                variable: '<inline>',
-                code,
+                variable: varName,
             });
-            continue;
         }
-        const [, varName, rhs] = m;
-        const type = classify(rhs);
-        if (!type)
-            continue;
-        const lineNumber = i + 1;
-        if (sources.some(s => s.line === lineNumber && s.variable === varName))
-            continue;
-        sources.push({
-            type,
-            location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''}`,
-            // #502 — Java parity: a database row read is medium, I/O is high.
-            severity: type === 'db_input' ? 'medium' : 'high',
-            line: lineNumber,
-            confidence: 1.0,
-            variable: varName,
-        });
     }
     return sources;
 }
@@ -2003,29 +2111,52 @@ function findJavaScriptAssignmentSources(sourceCode, language) {
     // #667: `REGISTRY[req.query.mod]` on a constant table yields a value the
     // program wrote, not request data.
     const lookupTables = constLookupTables(sourceCode, language);
+    // cognium-dev#582: scan every assignment on the line. A one-line
+    // `if (c) t = "b"; else t = req.query.t` (or braced `var` arms) has the
+    // source on a later assignment; matching only the first and truncating its
+    // RHS dropped that source. After a control-flow header before an
+    // assignment, that assignment owns only its own statement so a condition's
+    // read is not bound to a body variable (`if (req.query.m) { t = "a"; } else
+    // if (req.query.n) { … }`).
+    // cognium-dev#490: a TypeScript declaration may carry a type annotation
+    // (`const q: string = req.query.q`); the binding is the name before the colon,
+    // not the annotation, so the source's own definition is found on the line.
+    const assignmentRe = /(?:(?:var|let|const)\s+(\w+)\s*:\s*[^=;]+?\s*=(?![>=])|(?:(?:var|let|const)\s+)?(\w+)\s*=)\s*/g;
+    const rhsOwnStmt = /^(?:"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'|`(?:[^`\\]|\\.)*`|[^;}"'`])*/;
     for (let lineNum = 0; lineNum < lines.length; lineNum++) {
         const line = lines[lineNum];
         const lineNumber = lineNum + 1;
-        const assignmentMatch = line.match(/(?:(?:var|let|const)\s+)?(\w+)\s*=\s*(.+)/);
-        if (!assignmentMatch)
-            continue;
-        const [, varName, rhs] = assignmentMatch;
-        if (isConstTableLookup(rhs, lookupTables))
-            continue;
-        for (const { pattern, type } of patterns) {
-            if (pattern.test(rhs)) {
-                const alreadyExists = sources.some(s => s.line === lineNumber && s.type === type);
-                if (!alreadyExists) {
-                    sources.push({
-                        type,
-                        location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''}`,
-                        severity: 'high',
-                        line: lineNumber,
-                        confidence: 1.0,
-                        variable: varName,
-                    });
+        assignmentRe.lastIndex = 0;
+        for (const assignmentMatch of line.matchAll(assignmentRe)) {
+            const varName = assignmentMatch[1] ?? assignmentMatch[2];
+            if (!varName)
+                continue;
+            let rhs = line.slice((assignmentMatch.index ?? 0) + assignmentMatch[0].length);
+            if (/\b(?:if|while|switch|else)\b/.test(line.slice(0, assignmentMatch.index ?? 0))) {
+                rhs = rhsOwnStmt.exec(rhs)?.[0] ?? rhs;
+            }
+            else if (line.includes(';', (assignmentMatch.index ?? 0) + assignmentMatch[0].length)) {
+                // Same-line later statements: do not let a greedy RHS attribute their
+                // reads to this variable (`a = 1; b = req.query.t`).
+                rhs = rhsOwnStmt.exec(rhs)?.[0] ?? rhs;
+            }
+            if (isConstTableLookup(rhs, lookupTables))
+                continue;
+            for (const { pattern, type } of patterns) {
+                if (pattern.test(rhs)) {
+                    const alreadyExists = sources.some(s => s.line === lineNumber && s.type === type && s.variable === varName);
+                    if (!alreadyExists) {
+                        sources.push({
+                            type,
+                            location: `${varName} = ${rhs.trim().substring(0, 50)}${rhs.length > 50 ? '...' : ''}`,
+                            severity: 'high',
+                            line: lineNumber,
+                            confidence: 1.0,
+                            variable: varName,
+                        });
+                    }
+                    break;
                 }
-                break;
             }
         }
     }
@@ -2041,8 +2172,8 @@ function findJavaScriptAssignmentSources(sourceCode, language) {
     // event-name allowlist to avoid firing on unrelated `.on('drain', cb)`
     // / `.on('close', cb)` etc. that carry non-user-input.
     sources.push(...findJavaScriptCallbackParamSources(sourceCode));
-    if (language === 'javascript') {
-        sources.push(...findExpressDestructuredRequestSources(sourceCode));
+    sources.push(...findExpressDestructuredRequestSources(sourceCode));
+    if (language === 'javascript' || language === 'typescript') {
         sources.push(...findGraphqlResolverArgSources(sourceCode));
     }
     return sources;
@@ -2062,6 +2193,36 @@ function matchBrace(text, open) {
     }
     return -1;
 }
+/**
+ * Index just past an optional TypeScript `: <type>` annotation starting at
+ * `from` (`}: Request<A, B>`), i.e. at the next top-level `,` or `)`. Returns
+ * `from` unchanged when no annotation follows.
+ */
+function skipTypeAnnotation(text, from) {
+    const m = /^\s*:/.exec(text.slice(from));
+    if (!m)
+        return from;
+    let depth = 0;
+    for (let i = from + m[0].length; i < text.length; i++) {
+        const ch = text[i];
+        if (ch === '<' || ch === '(' || ch === '[' || ch === '{')
+            depth++;
+        else if (ch === '>' || ch === ']' || ch === '}')
+            depth--;
+        else if (ch === ')') {
+            if (depth === 0)
+                return i;
+            depth--;
+        }
+        else if (ch === ',' && depth === 0)
+            return i;
+        else if (ch === '=' && text[i + 1] === '>' && depth === 0)
+            return from;
+        if (depth < 0)
+            return from;
+    }
+    return from;
+}
 const EXPRESS_REQUEST_KEYS = {
     query: 'http_param',
     params: 'http_param',
@@ -2080,7 +2241,7 @@ const EXPRESS_REQUEST_KEYS = {
 function findExpressDestructuredRequestSources(sourceCode) {
     const sources = [];
     const receivers = new Set();
-    for (const m of sourceCode.matchAll(/\b(?:const|let|var)\s+(\w+)\s*=\s*(?:express\s*\(\s*\)|express\s*\.\s*Router\s*\(\s*\)|Router\s*\(\s*\))/g)) {
+    for (const m of sourceCode.matchAll(/\b(?:const|let|var)\s+(\w+)\s*(?::\s*[\w.]+\s*)?=\s*(?:express\s*\(\s*\)|express\s*\.\s*Router\s*\(\s*\)|Router\s*\(\s*\))/g)) {
         receivers.add(m[1]);
     }
     if (receivers.size === 0)
@@ -2095,7 +2256,8 @@ function findExpressDestructuredRequestSources(sourceCode) {
             continue;
         // The pattern must be followed by another parameter or `)`, i.e. it is
         // the handler's first parameter.
-        if (!/^\s*[,)]/.test(sourceCode.slice(close)))
+        // A TypeScript `: Request` annotation after the pattern is skipped first.
+        if (!/^\s*[,)]/.test(sourceCode.slice(skipTypeAnnotation(sourceCode, close))))
             continue;
         const line = sourceCode.slice(0, m.index + m[0].length).split('\n').length;
         const inner = sourceCode.slice(open + 1, close - 1);
@@ -2140,11 +2302,127 @@ function findExpressDestructuredRequestSources(sourceCode) {
     }
     return sources;
 }
+/**
+ * The parameters of the call / function whose `(` is at `open`: each top-level,
+ * comma-separated entry with its offset into `text`. A comma inside `()`, `[]`,
+ * `{}` or a type's `<>` (the `>` of `=>` excluded) does not split. Returns null
+ * when the list does not close.
+ */
+function readParameterList(text, open) {
+    const params = [];
+    let depth = 0;
+    let start = open + 1;
+    for (let i = open; i < text.length; i++) {
+        const ch = text[i];
+        if (ch === '"' || ch === "'" || ch === '`') {
+            for (i++; i < text.length && text[i] !== ch; i++)
+                if (text[i] === '\\')
+                    i++;
+            continue;
+        }
+        if (ch === '(' || ch === '[' || ch === '{' || ch === '<')
+            depth++;
+        else if (ch === '>' && text[i - 1] !== '=')
+            depth--;
+        else if (ch === ')' || ch === ']' || ch === '}') {
+            depth--;
+            if (depth === 0) {
+                if (text.slice(start, i).trim() !== '')
+                    params.push({ text: text.slice(start, i), start });
+                return { params };
+            }
+        }
+        else if (ch === ',' && depth === 1) {
+            params.push({ text: text.slice(start, i), start });
+            start = i + 1;
+        }
+    }
+    return null;
+}
+/**
+ * The names a resolver's `args` parameter binds: the identifier itself
+ * (`args`, `args: Args`, `args?: Args`), or every name bound by an object
+ * pattern (`{ sku }`, `{ sku: s }`, `{ filter: { id } }`, `{ id = 1 }`,
+ * `{ ...rest }`), each with its offset into `param`. An array pattern or a
+ * computed key binds nothing here.
+ */
+function graphqlArgBindings(param) {
+    const trimmed = param.replace(/^\s+/, '');
+    const lead = param.length - trimmed.length;
+    const ident = /^(?:\.\.\.)?([A-Za-z_$][\w$]*)\s*\??\s*(?::[\s\S]*|=[\s\S]*)?$/.exec(trimmed);
+    if (ident)
+        return [{ name: ident[1], offset: lead + trimmed.indexOf(ident[1]) }];
+    if (!trimmed.startsWith('{'))
+        return [];
+    const close = matchBrace(trimmed, 0);
+    if (close < 0)
+        return [];
+    return objectPatternBindings(trimmed, 1, close - 1).map(b => ({ name: b.name, offset: lead + b.offset }));
+}
+/** Every name a destructured (non-`args`) parameter binds, for the ambiguity check above. */
+function graphqlPatternNames(param) {
+    const t = param.trim();
+    if (!t.startsWith('{'))
+        return [];
+    const close = matchBrace(t, 0);
+    if (close < 0)
+        return [];
+    return objectPatternBindings(t, 1, close - 1).map(b => b.name);
+}
+function objectPatternBindings(text, from, to) {
+    const out = [];
+    let depth = 0;
+    let start = from;
+    const entries = [];
+    for (let i = from; i < to; i++) {
+        const ch = text[i];
+        if (ch === '{' || ch === '[' || ch === '(')
+            depth++;
+        else if (ch === '}' || ch === ']' || ch === ')')
+            depth--;
+        else if (ch === ',' && depth === 0) {
+            entries.push([start, i]);
+            start = i + 1;
+        }
+    }
+    entries.push([start, to]);
+    for (const [a, b] of entries) {
+        const raw = text.slice(a, b);
+        const body = raw.trimStart();
+        const at = a + (raw.length - body.length);
+        if (body.trim() === '')
+            continue;
+        const rest = /^\.\.\.\s*([A-Za-z_$][\w$]*)\s*$/.exec(body.trimEnd());
+        if (rest) {
+            out.push({ name: rest[1], offset: at + body.indexOf(rest[1]) });
+            continue;
+        }
+        const keyed = /^(?:[A-Za-z_$][\w$]*|'[^']*'|"[^"]*")\s*:\s*/.exec(body);
+        if (keyed) {
+            const targetAt = at + keyed[0].length;
+            const target = body.slice(keyed[0].length);
+            if (target.startsWith('{')) {
+                const end = matchBrace(text, targetAt);
+                if (end > 0)
+                    out.push(...objectPatternBindings(text, targetAt + 1, end - 1));
+                continue;
+            }
+            const id = /^([A-Za-z_$][\w$]*)\s*(?:=[\s\S]*)?$/.exec(target.trimEnd());
+            if (id)
+                out.push({ name: id[1], offset: targetAt });
+            continue;
+        }
+        const short = /^([A-Za-z_$][\w$]*)\s*(?:=[\s\S]*)?$/.exec(body.trimEnd());
+        if (short)
+            out.push({ name: short[1], offset: at });
+    }
+    return out;
+}
 /**
  * cognium-dev#586 — GraphQL resolver-map arguments. The second parameter of a
  * function under `Query` / `Mutation` / `Subscription` in the object passed as
  * `resolvers` to `new ApolloServer({…})` / `makeExecutableSchema({…})` (inline,
- * or a same-file `const resolvers = {…}`) is client-supplied. Parameter 0
+ * or a same-file `const resolvers = {…}`, optionally type-annotated) is client-supplied. Parameter 0
  * (`parent`) and 2 (`context`) are never seeded.
  */
 function findGraphqlResolverArgSources(sourceCode) {
@@ -2166,11 +2444,17 @@ function findGraphqlResolverArgSources(sourceCode) {
         if (!named)
             continue;
         const ident = named[1] ?? 'resolvers';
-        const decl = new RegExp(`\\b(?:const|let|var)\\s+${ident}\\s*=\\s*\\{`).exec(sourceCode);
+        // cognium-dev#752: an annotation between the name and `=` (`: Resolvers`,
+        // `: Resolvers<Context>`, `: gql.Resolvers<Ctx, Parent>`) does not hide the map.
+        const decl = new RegExp(`\\b(?:const|let|var)\\s+${ident}\\s*(?::\\s*[A-Za-z_$][\\w$]*(?:\\s*\\.\\s*[A-Za-z_$][\\w$]*)*` +
+            `(?:\\s*<[^<>=]*(?:<[^<>=]*>[^<>=]*)*>)?\\s*)?=\\s*\\{`).exec(sourceCode);
         if (decl)
             maps.push(decl.index + decl[0].length - 1);
     }
-    const FN_RE = /(?:^|[\s,{])(\w+)\s*(?::\s*(?:async\s+)?(?:function\s*\w*\s*)?\(|\()\s*\w+\s*,\s*(\w+)\s*[,)]/g;
+    // `name: (…) =>`, `name: async (…) =>`, `name: function (…)`, `name(…) {` and `async name(…)`.
+    // The parameter list is read whole, so a type annotation or a destructured
+    // pattern on any parameter does not hide the second one.
+    const FN_RE = /(?:^|[\s,{])(\w+)\s*(?::\s*(?:async\s+)?(?:function\s*\w*\s*)?\(|\()/g;
     for (const open of maps) {
         const close = matchBrace(sourceCode, open);
         if (close < 0)
@@ -2193,18 +2477,46 @@ function findGraphqlResolverArgSources(sourceCode) {
                 else if (ch === '}' || ch === ')')
                     depth--;
             }
+            const found = [];
+            // Names the resolvers in this type object bind from `parent` or `context`.
+            // A name shared with an `args` binding is ambiguous across functions, so
+            // it is not seeded.
+            const otherNames = new Set();
             for (const f of typeBody.matchAll(FN_RE)) {
                 const at = f.index + f[0].indexOf(f[1]);
                 if (depthAt[at] !== 0)
                     continue;
-                const line = sourceCode.slice(0, tOpen + 1 + at).split('\n').length;
+                const parenAt = f.index + f[0].length - 1;
+                const list = readParameterList(typeBody, parenAt);
+                if (!list)
+                    continue;
+                list.params.forEach((param, idx) => {
+                    if (idx === 1)
+                        return;
+                    for (const b of graphqlPatternNames(param.text))
+                        otherNames.add(b);
+                });
+                // Only the second parameter (`args`) is client-supplied. `parent` and
+                // `context` are never seeded, destructured or not.
+                const second = list.params[1];
+                if (!second)
+                    continue;
+                const absStart = tOpen + 1 + second.start;
+                for (const b of graphqlArgBindings(second.text)) {
+                    const line = sourceCode.slice(0, absStart + b.offset).split('\n').length;
+                    found.push({ fn: f[1], b: { name: b.name, line } });
+                }
+            }
+            for (const { fn, b } of found) {
+                if (otherNames.has(b.name))
+                    continue;
                 sources.push({
                     type: 'http_param',
-                    location: `GraphQL ${t[1]}.${f[1]} resolver args '${f[2]}' at line ${line}`,
+                    location: `GraphQL ${t[1]}.${fn} resolver args '${b.name}' at line ${b.line}`,
                     severity: 'high',
-                    line,
+                    line: b.line,
                     confidence: 0.9,
-                    variable: f[2],
+                    variable: b.name,
                 });
             }
         }
@@ -2832,6 +3144,480 @@ function isSafeJinjaReturnExpr(expr) {
     const trimmed = expr.trim();
     return JINJA_SAFE_RTS_RE.test(trimmed) || JINJA_SAFE_TEMPLATE_RE.test(trimmed);
 }
+/**
+ * The statements on one Java source line, split at each `;` that is outside a
+ * string / char literal and outside a comment. Comment text (`//` to the end of
+ * the line, inline or unterminated `/* ... *\/`) is dropped; literals are kept.
+ * `terminated` is false for a trailing piece with no `;` on this line.
+ */
+function javaLineStatements(line) {
+    const out = [];
+    let cur = '';
+    let inStr = null;
+    let escaped = false;
+    for (let i = 0; i < line.length; i++) {
+        const ch = line[i];
+        if (inStr) {
+            cur += ch;
+            if (escaped) {
+                escaped = false;
+                continue;
+            }
+            if (ch === '\\') {
+                escaped = true;
+                continue;
+            }
+            if (ch === inStr)
+                inStr = null;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            inStr = ch;
+            cur += ch;
+            continue;
+        }
+        if (ch === '/' && line[i + 1] === '/')
+            break;
+        if (ch === '/' && line[i + 1] === '*') {
+            const end = line.indexOf('*/', i + 2);
+            if (end < 0)
+                break;
+            cur += ' ';
+            i = end + 1;
+            continue;
+        }
+        if (ch === ';') {
+            out.push({ text: cur, terminated: true });
+            cur = '';
+            continue;
+        }
+        cur += ch;
+    }
+    if (cur.trim())
+        out.push({ text: cur, terminated: false });
+    return out;
+}
+/**
+ * `[modifiers] [Type] name = rhs` as ONE statement (no `;`; see
+ * `javaLineStatements`). `==` is not an assignment; `+=` and field targets
+ * (`a.b = x`) are not matched. Group 1 is the name, group 2 the right-hand side.
+ */
+const JAVA_STMT_ASSIGN = /^\s*(?:(?:final|public|private|protected|static|volatile|transient)\s+)*(?:[\p{L}_][\p{L}\p{N}_.]*(?:\s*<[^=]*>)?(?:\s*\[\s*\])*\s+)?([\p{L}_][\p{L}\p{N}_]*)\s*=(?!=)\s*([\s\S]*)$/u;
+/**
+ * Arguments of `receiver.append(...)` on one statement, including a chain of
+ * further `.append(...)` calls on the same expression. Stops at any other
+ * method (e.g. `.indexOf(...)`) or at the end of the statement. Nested calls
+ * inside an argument (e.g. `append(escape(who))`) stay inside that argument.
+ * String / char literal bodies are walked so a `)` inside a string does not
+ * close the argument.
+ */
+function javaAppendArgExprs(line) {
+    const start = /^\s*([\p{L}_][\p{L}\p{N}_]*)\s*\.\s*append\s*\(/u.exec(line);
+    if (!start)
+        return null;
+    const receiver = start[1];
+    const args = [];
+    let i = start[0].length;
+    const takeArg = () => {
+        let depth = 1;
+        let inStr = null;
+        let escaped = false;
+        const from = i;
+        for (; i < line.length; i++) {
+            const ch = line[i];
+            if (inStr) {
+                if (escaped) {
+                    escaped = false;
+                    continue;
+                }
+                if (ch === '\\') {
+                    escaped = true;
+                    continue;
+                }
+                if (ch === inStr)
+                    inStr = null;
+                continue;
+            }
+            if (ch === '"' || ch === "'") {
+                inStr = ch;
+                continue;
+            }
+            if (ch === '(') {
+                depth++;
+                continue;
+            }
+            if (ch === ')') {
+                depth--;
+                if (depth === 0) {
+                    const arg = line.slice(from, i);
+                    i++; // past ')'
+                    return arg;
+                }
+            }
+        }
+        return null;
+    };
+    while (true) {
+        const arg = takeArg();
+        if (arg === null)
+            return null;
+        args.push(arg);
+        // More chained .append(…)? Otherwise stop (other method, ';', end).
+        const rest = line.slice(i);
+        const next = /^\s*\.\s*append\s*\(/.exec(rest);
+        if (!next)
+            break;
+        i += next[0].length;
+    }
+    return { receiver, args };
+}
+/**
+ * The source call named by a source location (`req.getParameter() in execute`,
+ * `getParameter() in execute`) as a regex over `codeOnly` text: the receiver
+ * chain must match too (any spacing between its tokens), and a call with no
+ * receiver must not follow a `.`. `byName` is the method name alone, for a
+ * receiver whose text is not on the line as written. `method` / `receiver`
+ * are the unescaped names from the location. Null when the location names no
+ * call.
+ */
+function javaSourceCallRe(location) {
+    const callee = /^([\s\S]*?)\(\)(?:\s+in\s+[^()]*)?$/u.exec((location ?? '').trim())?.[1]?.trim();
+    if (!callee)
+        return null;
+    const cm = /^(?:([\s\S]*?)\s*\.\s*)?([\p{L}_$][\p{L}\p{N}_$]*)$/u.exec(callee);
+    if (!cm)
+        return null;
+    const esc = (t) => t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const methodName = cm[2];
+    const method = esc(methodName);
+    const byName = new RegExp(`(?<![\\p{L}\\p{N}_$])${method}\\s*\\(`, 'u');
+    if (!cm[1]) {
+        return {
+            exact: new RegExp(`(?<![\\p{L}\\p{N}_$.])(?<!\\.\\s+)${method}\\s*\\(`, 'u'),
+            byName, method: methodName, receiver: null,
+        };
+    }
+    // Receiver text as written in the location, with literal bodies blanked like the
+    // statement text it is matched against.
+    const recv = cm[1]
+        .replace(/"(?:[^"\\]|\\.)*"/g, ' ')
+        .replace(/'(?:[^'\\]|\\.)'/g, ' ');
+    const toks = recv.match(/[\p{L}\p{N}_$]+|\S/gu);
+    if (!toks)
+        return null;
+    return {
+        exact: new RegExp(`(?<![\\p{L}\\p{N}_$.])(?<!\\.\\s+)${toks.map(esc).join('\\s*')}\\s*\\.\\s*${method}\\s*\\(`, 'u'),
+        byName, method: methodName, receiver: toks.join(''),
+    };
+}
+/** Keywords that must not be treated as a Java type name in a declaration. */
+const JAVA_NON_TYPE_NAMES = new Set([
+    'return', 'if', 'else', 'while', 'for', 'switch', 'case', 'new', 'throw', 'try',
+    'catch', 'class', 'interface', 'package', 'import', 'assert', 'synchronized',
+    'do', 'break', 'continue', 'finally', 'default', 'this', 'super', 'true',
+    'false', 'null', 'instanceof', 'extends', 'implements', 'throws', 'enum',
+]);
+/**
+ * Simple type name → last segment of an FQN, generics stripped
+ * (`javax.servlet.http.HttpServletRequest` → `HttpServletRequest`).
+ */
+function javaSimpleTypeName(type) {
+    return type.replace(/\s+/g, '').replace(/<.*$/, '').replace(/^.*\./, '');
+}
+/**
+ * Locals and parameters declared in `[startLine, endLine]` (1-based), mapped to
+ * their simple type name. Used so a line that lost a second request-source to
+ * per-line dedup can still seed every receiver of that source class.
+ */
+function javaMethodVarTypes(lines, startLine, endLine) {
+    const out = new Map();
+    // Optional modifiers, then Type (FQN / simple, optional generics), then name,
+    // then `=` `,` `;` or `)` (parameter list). Strings / comments blanked first.
+    const decl = /(?:(?:public|private|protected|static|final|volatile|transient)\s+)*(?<![\p{L}\p{N}_$.])((?:[\p{L}_$][\p{L}\p{N}_$]*\s*\.\s*)*[\p{L}_$][\p{L}\p{N}_$]*)\s*(?:<[^;{}()=]*>)?\s+([\p{L}_$][\p{L}\p{N}_$]*)\s*(?:=|,|;|\))/gu;
+    for (let i = startLine - 1; i < endLine && i < lines.length; i++) {
+        const text = (lines[i] ?? '')
+            .replace(/"(?:[^"\\]|\\.)*"/g, ' ')
+            .replace(/'(?:[^'\\]|\\.)'/g, ' ')
+            .replace(/\/\*.*?\*\//g, ' ')
+            .replace(/\/\/.*$/, '');
+        decl.lastIndex = 0;
+        for (let m = decl.exec(text); m; m = decl.exec(text)) {
+            const simple = javaSimpleTypeName(m[1]);
+            if (!simple || JAVA_NON_TYPE_NAMES.has(simple))
+                continue;
+            out.set(m[2], simple);
+        }
+    }
+    return out;
+}
+/**
+ * Call matcher for a source location that accepts every receiver declared with
+ * the same simple type as the location's stored receiver (not only that
+ * receiver). Falls back to `exact` when the stored receiver's type is unknown.
+ * When the location names no receiver, returns `exact` (method-only form).
+ */
+function javaSameClassCallRe(srcRes, varTypes) {
+    if (!srcRes.receiver)
+        return srcRes.exact;
+    const esc = (t) => t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    // Location receiver may be a chain (`this.req`); the declared name is the
+    // last identifier.
+    const recvId = /[\p{L}_$][\p{L}\p{N}_$]*$/u.exec(srcRes.receiver)?.[0] ?? srcRes.receiver;
+    const names = new Set([recvId]);
+    const ty = varTypes.get(recvId);
+    if (ty) {
+        for (const [n, t] of varTypes)
+            if (t === ty)
+                names.add(n);
+    }
+    const alts = [...names].map(esc).join('|');
+    return new RegExp(`(?<![\\p{L}\\p{N}_$.])(?<!\\.\\s+)(?:${alts})\\s*\\.\\s*${esc(srcRes.method)}\\s*\\(`, 'u');
+}
+/**
+ * `expr` (already `codeOnly`) with every call to the named method blanked out,
+ * from its name through its closing `)` (or the end of `expr` when the call
+ * does not close there). `found` is true when at least one call was blanked.
+ */
+function blankJavaCalls(expr, method) {
+    const re = new RegExp(`(?<![\\p{L}\\p{N}_$])${method.replace(/[$]/g, '\\$&')}\\s*\\(`, 'gu');
+    let text = expr;
+    let found = false;
+    for (let m = re.exec(text); m; m = re.exec(text)) {
+        let depth = 1;
+        let k = m.index + m[0].length;
+        for (; k < text.length && depth > 0; k++) {
+            if (text[k] === '(')
+                depth++;
+            else if (text[k] === ')')
+                depth--;
+        }
+        text = `${text.slice(0, m.index)} 0 ${text.slice(k)}`;
+        re.lastIndex = m.index + 3;
+        found = true;
+    }
+    return { text, found };
+}
+/**
+ * cognium-dev#624 (minimal slice) — JSPWiki plugin output is rendered as HTML.
+ *
+ * The `String` returned from `execute(...)` of a class that implements
+ * `org.apache.wiki.api.plugin.WikiPlugin` (or the older `...plugin.Plugin`) is
+ * written into the page unescaped, so a request- or markup-derived value that
+ * reaches the return is reflected XSS. The rule keys on the interface (from the
+ * import or a fully-qualified `implements`), never on the method name: another
+ * class's `execute(...)` is untouched.
+ *
+ * Mirrors `findPythonReturnXSSSinks` (#368): one sink per tainted `return`, and
+ * `TaintPropagationPass` links it to a source. `StringBuilder.append` is
+ * deliberately not an xss sink on its own (#268) — a builder only matters here
+ * when it reaches the return. An xss-covering sanitizer between the source and
+ * the return suppresses the site.
+ */
+export function findJavaWikiPluginReturnXSSSinks(code, types, imports, sources, xssSanitizers) {
+    if (sources.length === 0)
+        return [];
+    const PKG = 'org.apache.wiki.api.plugin';
+    // Each simple name counts only when that name was imported (a wildcard of the
+    // plugin package accepts both): importing `WikiPlugin` does not make an
+    // `implements Plugin` (some other interface) a wiki plugin, nor the reverse.
+    const importedSimple = new Set();
+    let wildcardImported = false;
+    for (const i of imports) {
+        if (i.from_package !== PKG)
+            continue;
+        if (i.is_wildcard)
+            wildcardImported = true;
+        else if (i.imported_name === 'WikiPlugin' || i.imported_name === 'Plugin')
+            importedSimple.add(i.imported_name);
+    }
+    const isPluginIface = (name) => {
+        const bare = name.replace(/<.*$/, '').trim();
+        if (bare === `${PKG}.WikiPlugin` || bare === `${PKG}.Plugin`)
+            return true;
+        return (bare === 'WikiPlugin' || bare === 'Plugin') && (wildcardImported || importedSimple.has(bare));
+    };
+    const lines = code.split('\n');
+    // Code positions only: string / char literal bodies blanked, then inline `/* */` and
+    // trailing `//` comments dropped (after the literals, so a `"http://…"` is not cut).
+    const codeOnly = (expr) => expr
+        .replace(/"(?:[^"\\]|\\.)*"/g, ' ')
+        .replace(/'(?:[^'\\]|\\.)'/g, ' ')
+        .replace(/\/\*.*?\*\//g, ' ')
+        .replace(/\/\/.*$/, '');
+    const refs = (expr, name) => new RegExp(`(?<![\\p{L}\\p{N}_.])${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![\\p{L}\\p{N}_])`, 'u').test(expr);
+    const out = [];
+    for (const t of types) {
+        if (!t.implements.some(isPluginIface))
+            continue;
+        for (const m of t.methods) {
+            if (m.name !== 'execute' || m.return_type !== 'String')
+                continue;
+            const inMethod = sources.filter(sc => sc.line >= m.start_line && sc.line <= m.end_line);
+            if (inMethod.length === 0)
+                continue;
+            // Sources that name a variable (the carriers are walked per return below).
+            const perSource = inMethod
+                .filter((sc) => !!sc.variable)
+                .map(sc => ({ sc }));
+            if (perSource.length === 0)
+                continue;
+            for (let i = m.start_line - 1; i < m.end_line; i++) {
+                const rm = /^\s*return\s+(.+?);\s*$/.exec(lines[i] ?? '');
+                if (!rm)
+                    continue;
+                const sinkLine = i + 1;
+                let best = null;
+                for (const { sc } of perSource) {
+                    if (sc.line > sinkLine)
+                        continue;
+                    // Carriers: the names the source's value reaches before the return, with
+                    // the line each became tainted. Walked one statement at a time, in order,
+                    // from the source's own statement: a name is live only after the statement
+                    // that gives it a tainted value (the source call, or an already-live
+                    // carrier), so a statement earlier on the same line sees nothing. Only
+                    // names inside a statement's append(...) arguments (chained .append and
+                    // nested calls included) taint its receiver, only its `+=` right-hand
+                    // side taints its target, and only its `=` right-hand side taints the
+                    // assigned name. A name in another method or statement does not.
+                    const carriers = new Map();
+                    const refsCarrier = (expr) => {
+                        const c = codeOnly(expr);
+                        return [...carriers.keys()].some(v => refs(c, v));
+                    };
+                    // Where the source enters on its line. Call sources are deduped to one
+                    // per line, so the surviving location names only one receiver
+                    // ("req.getParameter() in execute"). Accept every call whose receiver
+                    // shares that source class (another HttpServletRequest on the line),
+                    // not only the stored receiver — otherwise a second request call never
+                    // seeds its value. `prefs.getParameter` stays out: different class.
+                    // `byName` (method alone) must not run when the line has another
+                    // same-named call: that reintroduces the method-name FP. A parameter /
+                    // annotation source (no call) is live from its own assignment on the
+                    // line, or from the start of the line.
+                    const srcStmts = javaLineStatements(lines[sc.line - 1] ?? '');
+                    const srcRes = javaSourceCallRe(sc.location);
+                    const varTypes = javaMethodVarTypes(lines, m.start_line, m.end_line);
+                    let callRe = null;
+                    if (srcRes) {
+                        const hasExact = srcStmts.some(st => srcRes.exact.test(codeOnly(st.text)));
+                        const byNameHits = srcStmts.filter(st => srcRes.byName.test(codeOnly(st.text))).length;
+                        if (hasExact)
+                            callRe = javaSameClassCallRe(srcRes, varTypes);
+                        else if (byNameHits === 1)
+                            callRe = srcRes.byName;
+                        else
+                            callRe = srcRes.receiver ? javaSameClassCallRe(srcRes, varTypes) : null;
+                    }
+                    const callsSource = (expr) => !!callRe && callRe.test(codeOnly(expr));
+                    const seeded = srcStmts.some(st => callsSource(st.text));
+                    // xss sanitizer calls on the source line: a value that reaches a
+                    // statement only inside one of them is not tainted by it. A sanitizer
+                    // that cannot be found in the line's text covers the whole line.
+                    const srcLineSan = sc.line < sinkLine
+                        ? xssSanitizers.filter(sa => sa.line === sc.line).map(sa => ({
+                            method: /([\p{L}_$][\p{L}\p{N}_$]*)\s*(?:\(\))?\s*$/u.exec(sa.method ?? '')?.[1],
+                        }))
+                        : [];
+                    const sanMethods = srcLineSan.map(sa => sa.method).filter((x) => !!x);
+                    const srcLineSanFound = srcLineSan.length > 0 && srcLineSan.every(sa => !!sa.method && srcStmts.some(st => blankJavaCalls(codeOnly(st.text), sa.method).found));
+                    const unsanitized = (expr) => {
+                        let text = codeOnly(expr);
+                        if (srcLineSanFound)
+                            for (const sm of sanMethods)
+                                text = blankJavaCalls(text, sm).text;
+                        return text;
+                    };
+                    // Unseeded: index of the statement after which `sc.variable` is live.
+                    let liveAfter = -1;
+                    if (!seeded)
+                        liveAfter = srcStmts.findIndex(st => JAVA_STMT_ASSIGN.exec(st.text)?.[1] === sc.variable);
+                    // A source on the return line itself is checked against the return as is.
+                    if ((!seeded && liveAfter < 0) || sc.line === sinkLine)
+                        carriers.set(sc.variable, sc.line);
+                    for (let j = sc.line - 1; j < i; j++) {
+                        const onSrcLine = j === sc.line - 1;
+                        const stmts = onSrcLine ? srcStmts : javaLineStatements(lines[j] ?? '');
+                        for (let k = 0; k < stmts.length; k++) {
+                            const st = stmts[k];
+                            const raw = (expr) => refsCarrier(expr) || (onSrcLine && seeded && callsSource(expr));
+                            const tainted = (expr) => (onSrcLine ? raw(unsanitized(expr)) : raw(expr));
+                            const as = JAVA_STMT_ASSIGN.exec(st.text);
+                            // A name reassigned on the source line from a sanitized value only
+                            // (`who = escapeHtml4(who)`) no longer carries the source.
+                            if (as && onSrcLine && srcLineSanFound && carriers.has(as[1]) && raw(as[2]) && !tainted(as[2]))
+                                carriers.delete(as[1]);
+                            else if (as && !carriers.has(as[1]) && tainted(as[2]))
+                                carriers.set(as[1], j + 1);
+                            const ap = javaAppendArgExprs(st.text);
+                            if (ap && !carriers.has(ap.receiver) && ap.args.some(a => tainted(a)))
+                                carriers.set(ap.receiver, j + 1);
+                            const cm = st.terminated ? /^\s*([\p{L}_][\p{L}\p{N}_]*)\s*\+=\s*(.+?)\s*$/u.exec(st.text) : null;
+                            if (cm && !carriers.has(cm[1]) && tainted(cm[2]))
+                                carriers.set(cm[1], j + 1);
+                            if (onSrcLine && !seeded && k === liveAfter && !carriers.has(sc.variable))
+                                carriers.set(sc.variable, sc.line);
+                        }
+                    }
+                    if (!refsCarrier(rm[1]))
+                        continue;
+                    // An xss-covering sanitizer only counts for this source when it is on a
+                    // later line that names one of its carriers. One on the source's own
+                    // line already took effect in the walk above (only the value inside
+                    // its argument is clean); one there that is not found in the line's
+                    // text, or a source on the return line, still covers the line.
+                    const sanitized = xssSanitizers.some(({ line: l }) => l >= sc.line && l <= sinkLine &&
+                        (l === sc.line ? !srcLineSanFound : refsCarrier(lines[l - 1] ?? '')));
+                    if (sanitized)
+                        continue;
+                    if (!best || sc.line > best.line)
+                        best = { line: sc.line };
+                }
+                if (best)
+                    out.push({ sinkLine, sourceLine: best.line });
+            }
+        }
+    }
+    return out;
+}
+const JSPWIKI_TAG_PKG = 'org.apache.wiki.tags';
+const JSPWIKI_TAG_SUPER_NAMES = ['WikiTagBase', 'WikiBodyTag', 'WikiLinkTag'];
+/**
+ * cognium-dev#624 (WikiTag slice) — JSPWiki tag handlers inherit `protected
+ * WikiContext m_wikiContext` from `WikiTagBase`. The configured
+ * `WikiContext.getPage` source is class-scoped, so `m_wikiContext.getPage()`
+ * misses unless the enclosing type extends a JSPWiki tag base (import-gated,
+ * never from the field name alone).
+ */
+export function javaWikiTagInheritedContextReceiver(receiver, className, call, types, imports) {
+    if (className !== 'WikiContext' || receiver !== 'm_wikiContext')
+        return false;
+    const line = call.location.line;
+    const enclosing = types.find(t => line >= t.start_line && line <= t.end_line &&
+        (!call.in_method || t.methods.some(m => m.name === call.in_method && line >= m.start_line && line <= m.end_line)));
+    if (!enclosing?.extends)
+        return false;
+    const importedSimple = new Set();
+    let wildcardImported = false;
+    for (const i of imports) {
+        if (i.from_package !== JSPWIKI_TAG_PKG)
+            continue;
+        if (i.is_wildcard)
+            wildcardImported = true;
+        else if (JSPWIKI_TAG_SUPER_NAMES.includes(i.imported_name)) {
+            importedSimple.add(i.imported_name);
+        }
+    }
+    const isTagSuper = (name) => {
+        const bare = name.replace(/<.*$/, '').trim();
+        if (bare === `${JSPWIKI_TAG_PKG}.WikiTagBase` ||
+            bare === `${JSPWIKI_TAG_PKG}.WikiBodyTag` ||
+            bare === `${JSPWIKI_TAG_PKG}.WikiLinkTag`)
+            return true;
+        return JSPWIKI_TAG_SUPER_NAMES.includes(bare) &&
+            (wildcardImported || importedSimple.has(bare));
+    };
+    return isTagSuper(enclosing.extends);
+}
 export function findPythonReturnXSSSinks(sourceCode, taintedVars) {
     if (taintedVars.size === 0)
         return [];
@@ -3099,6 +3885,43 @@ export function buildRustTaintedVars(sourceCode, seedVars) {
     }
     return derived;
 }
+/**
+ * Join an assignment / declaration whose call argument list wraps over several
+ * lines into one line (`label = String.format("%s.tar",\n    picked);`), or null
+ * when line `i` does not start such a statement. The statement must start with
+ * `[Type] name =`, leave a parenthesis open on its first line, and close it and
+ * end in `;` within a few lines, with no `{`, `}`, lambda arrow or second `;`
+ * on the way (a lambda, anonymous class, switch expression or block is not a
+ * plain wrapped value).
+ */
+function joinWrappedJavaStatement(lines, i) {
+    const strip = (l) => l.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)'/g, '""').replace(/\/\/.*$/, '');
+    const first = strip(lines[i]);
+    if (!/^\s*(?:(?:final\s+)?[A-Za-z_][\w.]*(?:\s*<[^>]*>)?(?:\s*\[\s*\])*\s+)?[A-Za-z_]\w*\s*=(?!=)/.test(first))
+        return null;
+    if (/[;{}]|->/.test(first))
+        return null;
+    const depthOf = (t) => (t.match(/\(/g)?.length ?? 0) - (t.match(/\)/g)?.length ?? 0);
+    let depth = depthOf(first);
+    if (depth <= 0)
+        return null;
+    let text = lines[i].replace(/\/\/.*$/, '');
+    for (let j = i + 1; j < lines.length && j <= i + 12; j++) {
+        const next = strip(lines[j]);
+        if (/[{}]|->/.test(next))
+            return null;
+        const semi = next.indexOf(';');
+        if (semi >= 0 && next.slice(semi + 1).trim() !== '')
+            return null;
+        depth += depthOf(next);
+        if (depth < 0)
+            return null;
+        text += ' ' + lines[j].replace(/\/\/.*$/, '').trim();
+        if (semi >= 0)
+            return depth === 0 && text.trimEnd().endsWith(';') ? text : null;
+    }
+    return null;
+}
 /**
  * cognium-dev #220 — Java derived-taint expansion.
  *
@@ -3163,8 +3986,46 @@ export function buildJavaTaintedVars(sourceCode, seedVars) {
             const trimmed = line.trimStart();
             if (trimmed.startsWith('//') || trimmed.startsWith('*'))
                 continue;
-            const declMatch = declRe.exec(line);
-            const assignMatch = !declMatch ? assignRe.exec(line) : null;
+            // cognium-dev#476: non-assignment statements (must run before the #753
+            // wrap-join early-continue, which would skip them).
+            const arrayCopyRe = /\bSystem\.arraycopy\s*\(\s*([A-Za-z_]\w*)\s*,\s*[^,]+\s*,\s*([A-Za-z_]\w*)\s*,/;
+            const acMatch = arrayCopyRe.exec(line);
+            if (acMatch) {
+                const srcArr = acMatch[1];
+                const dstArr = acMatch[2];
+                if (knownTainted.has(srcArr) && !knownTainted.has(dstArr)) {
+                    derived.set(dstArr, i + 1);
+                    knownTainted.add(dstArr);
+                    changed = true;
+                }
+                continue;
+            }
+            const listAddRe = /^\s*([A-Za-z_]\w*)\.add\s*\(\s*([A-Za-z_]\w*)\s*\)\s*;?\s*$/;
+            const addMatch = listAddRe.exec(line.trimEnd());
+            if (addMatch) {
+                const listVar = addMatch[1];
+                const elem = addMatch[2];
+                if (knownTainted.has(elem) && !knownTainted.has(listVar)) {
+                    derived.set(listVar, i + 1);
+                    knownTainted.add(listVar);
+                    changed = true;
+                }
+                continue;
+            }
+            let statement = line;
+            let declMatch = declRe.exec(statement);
+            let assignMatch = !declMatch ? assignRe.exec(statement) : null;
+            if (!declMatch && !assignMatch) {
+                // cognium-dev#753: `label = String.format("%s.tar",\n  picked);` — a
+                // statement whose call argument list wraps over several lines reads like
+                // the same statement on one line.
+                const joined = joinWrappedJavaStatement(lines, i);
+                if (joined === null)
+                    continue;
+                statement = joined;
+                declMatch = declRe.exec(statement);
+                assignMatch = !declMatch ? assignRe.exec(statement) : null;
+            }
             const m = declMatch ?? assignMatch;
             if (!m)
                 continue;
@@ -4517,6 +5378,196 @@ function findPythonRegexAllowlistWrapperSanitizers(code) {
     }
     return sanitizers;
 }
+function isPythonQuotedStringLiteral(token) {
+    const t = token.trim();
+    return (/^"(?:[^"\\]|\\.)*"$/.test(t) ||
+        /^'(?:[^'\\]|\\.)*'$/.test(t));
+}
+function pythonRhsIsLiteralStringCollection(rhs) {
+    let s = rhs.trim();
+    if (/^frozenset\s*\(/.test(s) && s.endsWith(')')) {
+        s = s.slice(s.indexOf('(') + 1, -1).trim();
+    }
+    const splitElems = (inner) => {
+        const parts = [];
+        let depth = 0;
+        let quote = null;
+        let start = 0;
+        for (let i = 0; i < inner.length; i++) {
+            const c = inner[i];
+            if (quote) {
+                if (c === '\\') {
+                    i++;
+                    continue;
+                }
+                if (c === quote)
+                    quote = null;
+                continue;
+            }
+            if (c === '"' || c === "'") {
+                quote = c;
+                continue;
+            }
+            if (c === '(' || c === '[' || c === '{')
+                depth++;
+            else if (c === ')' || c === ']' || c === '}')
+                depth--;
+            else if (c === ',' && depth === 0) {
+                parts.push(inner.slice(start, i).trim());
+                start = i + 1;
+            }
+        }
+        const last = inner.slice(start).trim();
+        if (last || parts.length > 0)
+            parts.push(last);
+        return parts.filter(Boolean);
+    };
+    if (s.startsWith('{') && s.endsWith('}')) {
+        const inner = s.slice(1, -1).trim();
+        if (!inner)
+            return true;
+        return splitElems(inner).every(isPythonQuotedStringLiteral);
+    }
+    if (s.startsWith('[') && s.endsWith(']')) {
+        const inner = s.slice(1, -1).trim();
+        if (!inner)
+            return false;
+        return splitElems(inner).every(isPythonQuotedStringLiteral);
+    }
+    if (s.startsWith('(') && s.endsWith(')')) {
+        const inner = s.slice(1, -1).trim();
+        if (!inner || !inner.includes(','))
+            return false;
+        return splitElems(inner).every(isPythonQuotedStringLiteral);
+    }
+    return false;
+}
+function collectPythonLiteralMembershipCollections(code) {
+    const names = new Set();
+    const lines = code.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        const indent = raw.length - raw.trimStart().length;
+        if (indent !== 0)
+            continue;
+        const am = /^([A-Za-z_]\w*)\s*=\s*(.+)$/.exec(trimmed);
+        if (!am)
+            continue;
+        const name = am[1];
+        if (!pythonRhsIsLiteralStringCollection(am[2]))
+            continue;
+        if (new RegExp(String.raw `\b${name}\s*(?:\.add\s*\(|\.update\s*\(|\|=)|\b${name}\s*\[[^\]]+\]\s*=`).test(code)) {
+            continue;
+        }
+        names.add(name);
+    }
+    return names;
+}
+function pythonEnclosingDefEndLine(lines, fromLine) {
+    let defLine = -1;
+    let defIndent = -1;
+    for (let k = fromLine; k >= 0; k--) {
+        const dm = /^(\s*)def\s+/.exec(lines[k]);
+        if (dm) {
+            defLine = k;
+            defIndent = dm[1].length;
+            break;
+        }
+    }
+    if (defLine < 0)
+        return lines.length;
+    for (let j = defLine + 1; j < lines.length; j++) {
+        const line = lines[j];
+        if (line.trim() === '')
+            continue;
+        const indent = line.length - line.trimStart().length;
+        if (indent <= defIndent && /^\s*(?:def\s+|@|class\s+)/.test(line)) {
+            return j;
+        }
+    }
+    return lines.length;
+}
+/**
+ * Python literal set/list/tuple membership guard (cognium-dev #563).
+ *
+ *   if theme not in THEMES:
+ *       abort(400)
+ *   session["theme"] = theme
+ *
+ * Past the guard, `theme` is one of the module-level string literals in
+ * `THEMES`. The collection must be a literal of string constants that the
+ * file never mutates.
+ */
+function findPythonLiteralMembershipGuardSanitizers(code) {
+    const sanitizers = [];
+    const lines = code.split('\n');
+    const literalCollections = collectPythonLiteralMembershipCollections(code);
+    if (literalCollections.size === 0)
+        return sanitizers;
+    const guardOpen = /^(\s*)if\s+([A-Za-z_][A-Za-z0-9_]*)\s+not\s+in\s+([A-Za-z_][A-Za-z0-9_]*)\s*:\s*$/;
+    const terminator = /\b(return|raise|abort\s*\(|sys\.exit\s*\()/;
+    for (let i = 0; i < lines.length; i++) {
+        const m = guardOpen.exec(lines[i]);
+        if (!m)
+            continue;
+        const guardIndent = m[1].length;
+        const guardedVar = m[2];
+        const collectionName = m[3];
+        if (!literalCollections.has(collectionName))
+            continue;
+        let bodyHasTerminator = false;
+        let blockEnd = -1;
+        const maxScan = Math.min(lines.length, i + 26);
+        for (let j = i + 1; j < maxScan; j++) {
+            const line = lines[j];
+            if (line.trim() === '')
+                continue;
+            const indent = line.length - line.trimStart().length;
+            if (indent <= guardIndent) {
+                blockEnd = j - 1;
+                break;
+            }
+            if (terminator.test(line))
+                bodyHasTerminator = true;
+        }
+        if (blockEnd === -1)
+            blockEnd = Math.min(lines.length - 1, i + 25);
+        if (!bodyHasTerminator)
+            continue;
+        const varRe = new RegExp(String.raw `\b${guardedVar}\b`);
+        const reassign = new RegExp(String.raw `^\s*${guardedVar}\s*=(?!=)`);
+        const funcEnd = pythonEnclosingDefEndLine(lines, i);
+        for (let l = blockEnd + 2; l <= funcEnd; l++) {
+            const lineText = lines[l - 1];
+            if (!lineText || !varRe.test(lineText))
+                continue;
+            if (reassign.test(lineText))
+                break;
+            sanitizers.push({
+                type: 'python_literal_membership_guard',
+                method: 'if',
+                line: l,
+                sanitizes: [
+                    'trust_boundary',
+                    'sql_injection',
+                    'command_injection',
+                    'path_traversal',
+                    'ssrf',
+                    'ldap_injection',
+                    'xpath_injection',
+                    'log_injection',
+                    'xss',
+                    'open_redirect',
+                    'external_taint_escape',
+                ],
+            });
+        }
+    }
+    return sanitizers;
+}
 /**
  * Detect Python set-membership allow-list guards that should sanitize
  * `xss` flows (cognium-dev #216 Sprint 74 Pattern B, SSTI fixture).
@@ -11226,8 +12277,8 @@ function javaParensBalanced(expr) {
  *   - the method carries a `@*Mapping` annotation;
  *   - it returns `String` under a body-writing controller, or
  *     `ResponseEntity<String>` via `ResponseEntity.ok(x)` /
- *     `new ResponseEntity<>(x, …)` (the builder `.body(x)` form is left to
- *     SinkFilterPass Stage 15c's text/html content-type rule);
+ *     `new ResponseEntity<>(x, …)`, or `ResponseEntity.ok().body(x)` /
+ *     `ResponseEntity.status(...).body(x)` on a body-writing controller);
  *   - the returned expression references a request-bound parameter
  *     (`@RequestParam`, `@PathVariable`, `@RequestHeader`, `@CookieValue`,
  *     `@MatrixVariable`, a `String` `@RequestBody`) or an in-method source,
@@ -11312,14 +12363,20 @@ export function findJavaSpringReturnXSSSinks(code, types, sources, xssSanitizerL
                 const sinkLine = i + 1;
                 let expr = stmt;
                 if (entity) {
-                    // `ResponseEntity.ok(x)` / `new ResponseEntity<>(x, status)` only. The
-                    // builder `.body(x)` form stays with SinkFilterPass Stage 15c, which
-                    // keeps it only next to an explicit text/html signal.
-                    const em = /^\s*ResponseEntity\s*\.\s*ok\s*\(([\s\S]+)\)\s*$/.exec(stmt)
+                    // `ResponseEntity.ok(x)` / `new ResponseEntity<>(x, status)` /
+                    // `ResponseEntity.ok().body(x)` / `ResponseEntity.status(...).body(x)`.
+                    const em = /^\s*ResponseEntity\s*\.\s*ok\s*\(\s*\)\s*\.\s*body\s*\(([\s\S]+)\)\s*$/.exec(stmt)
+                        ?? /^\s*ResponseEntity\s*\.\s*status\s*\(([\s\S]+)\)\s*\.\s*body\s*\(([\s\S]+)\)\s*$/.exec(stmt)
+                        ?? /^\s*ResponseEntity\s*\.\s*ok\s*\(([\s\S]+)\)\s*$/.exec(stmt)
                         ?? /^\s*new\s+ResponseEntity\s*(?:<[^>]*>)?\s*\(([\s\S]+),[^,()]*\)\s*$/.exec(stmt);
-                    if (!em || !javaParensBalanced(em[1]))
+                    if (!em)
+                        continue;
+                    const payload = em.length === 3 ? em[2] : em[1];
+                    if (!payload || !javaParensBalanced(payload))
+                        continue;
+                    if (em.length === 3 && !javaParensBalanced(em[1]))
                         continue;
-                    expr = em[1];
+                    expr = payload;
                 }
                 const hit = [...carriers].find(([c, info]) => info.assignLine <= sinkLine && refers(expr, c));
                 if (!hit)