circle-ir 4.15.0 → 4.16.0

package/dist/analysis/passes/sink-filter-pass.js

@@ -15,12 +15,13 @@
  *
  * Depends on: taint-matcher, constant-propagation, language-sources
  */
-import { CSHARP_SANITIZER_RES, CSharpCredit } from './csharp-sanitizer-credit.js';
+import { CSHARP_SANITIZER_RES, CSharpCredit, csharpSanitizersFor } from './csharp-sanitizer-credit.js';
 import { JS_TAINTED_PATTERNS } from './language-sources-pass.js';
 import { LIBRARY_API_SURFACE_TAG } from '../library-api-surface-downgrade.js';
 import { isNonExecutableSourceLine } from '../non-executable-lines.js';
 import { sanitizerCoversSink } from '../sanitizer-index.js';
 import { identifierOutsideSanitizerCalls } from '../taint-propagation.js';
+import { parseJavaArrayAccessExpression } from '../java-array-element-keys.js';
 import { resolveIdentifierType, resolveCallReturnType, isArgvContainerType, } from '../arg-type-resolver.js';
 /** Escape regex metacharacters for safe pattern building. */
 function escapeReSf(s) {
@@ -60,10 +61,8 @@ const JS_LOG_INJECTION_SANITIZERS = [
     /\bstripCRLF\s*\(/,
     /\bremoveNewlines\s*\(/,
     /\bsanitizeLogValue\s*\(/,
-    // Inline CRLF-stripping regex literal: .replace(/[\r\n]/g, '')
-    /\.replace\(\s*\/\[\s*\\r\s*\\n\s*\]\/[gimsu]*\s*,\s*['"`]['"`]\s*\)/,
-    // Inline CRLF sequence: .replace(/\r\n/g, '')
-    /\.replace\(\s*\/\\r\\n\/[gimsu]*\s*,\s*['"`]['"`]\s*\)/,
+    // Inline CRLF-stripping regex literal: .replace(/[\r\n]/g, '') — global required
+    /\.replace\(\s*\/\[\s*\\r\s*\\n\s*\]\/[gimsu]*g[gimsu]*\s*,\s*['"`]['"`]\s*\)/,
 ];
 // ---------------------------------------------------------------------------
 // Stage 17 — Python ldap_injection (CWE-90) regex-strip wrapper recognition.
@@ -291,6 +290,60 @@ function argvFirstLiteralIsShell(lineText) {
         .toLowerCase();
     return SHELL_PROGRAMS.has(base);
 }
+/**
+ * cognium-dev#626 — does a same-file call of the wrapper method that contains
+ * the sink pass a shell argv (`Arrays.asList("/bin/sh", "-c", ...)`,
+ * `List.of("bash", ...)`, `new String[]{"sh", ...}`) at the position of its
+ * parameter `paramName`?
+ *
+ * Reuses the #351 literal test (`argvFirstLiteralIsShell`) on the caller's
+ * argument text, so the criterion is the same one the inline form already
+ * obeys. The wrapper is the method (name and parameter list) of the declaring
+ * type that contains the sink line. A call counts only when it has no receiver
+ * or a `this` receiver, sits in that same type, and passes the same number of
+ * arguments, so a call on another object, another class's method of the same
+ * name or another overload is ignored, and so is a call inside a nested type
+ * that declares its own method of that name and arity (it calls that one, not
+ * the wrapper; `enclosing_type` is unset on the default path, so the nested
+ * type is found by its line range). A parameter that is not found answers
+ * `false` and today's suppression stands.
+ */
+function sameFileCallerPassesShellArgv(paramName, methodName, sinkLine, types, calls) {
+    if (!methodName)
+        return false;
+    for (const t of types) {
+        const m = t.methods.find(mm => mm.name === methodName && sinkLine >= mm.start_line && sinkLine <= mm.end_line);
+        if (!m)
+            continue;
+        const pos = m.parameters.findIndex(p => p.name === paramName);
+        if (pos < 0)
+            return false;
+        return calls.some(c => {
+            if (c.method_name !== methodName)
+                return false;
+            if (c.receiver != null && c.receiver !== 'this')
+                return false;
+            if (c.location.line < t.start_line || c.location.line > t.end_line)
+                return false;
+            if (c.arguments.length !== m.parameters.length)
+                return false;
+            // A call inside a nested type that declares its own `methodName` of the
+            // same arity calls that method, not this wrapper (the outer type's line
+            // span covers the nested one). A nested call with no such method still
+            // resolves to the outer wrapper and counts.
+            const shadowed = types.some(u => u !== t &&
+                u.start_line >= t.start_line && u.end_line <= t.end_line &&
+                (u.start_line > t.start_line || u.end_line < t.end_line) &&
+                c.location.line >= u.start_line && c.location.line <= u.end_line &&
+                u.methods.some(um => um.name === methodName && um.parameters.length === c.arguments.length));
+            if (shadowed)
+                return false;
+            const expr = c.arguments[pos]?.expression;
+            return typeof expr === 'string' && argvFirstLiteralIsShell(`new ProcessBuilder(${expr}`);
+        });
+    }
+    return false;
+}
 // ---------------------------------------------------------------------------
 // Stage 12 — Java throw-statement FP suppression.
 // (cognium-dev #157 — Sprint 45)
@@ -545,6 +598,27 @@ function constStringLiteralValue(code, name) {
         return null;
     return decodeJsHexEscapes(decls[0][1] ?? decls[0][2] ?? decls[0][3] ?? '');
 }
+/**
+ * The body of the template literal that is the first argument of the
+ * `new RegExp(` on `line` (1-indexed), or null. The literal may start on a
+ * following line, after whitespace or comments, as a formatter wraps a long
+ * constructor call; the `new RegExp(` itself must be on the sink line.
+ * (cognium-dev#717)
+ */
+function regExpTemplateArgument(code, lines, line) {
+    const text = lines[line - 1] ?? '';
+    let offset = 0;
+    for (let i = 0; i < line - 1; i++)
+        offset += lines[i].length + 1;
+    const argument = /^(?:\s|\/\/[^\n]*(?:\n|$)|\/\*[\s\S]*?\*\/)*`((?:\\.|[^`\\])*)`(?=\s*[,)])/;
+    for (const start of text.matchAll(/new\s+RegExp\s*\(/g)) {
+        // The literal must be the whole first argument: `` `…` + text `` is not constant.
+        const m = argument.exec(code.slice(offset + start.index + start[0].length));
+        if (m)
+            return m[1];
+    }
+    return null;
+}
 /** A group that holds an unbounded quantifier and is itself quantified: `(a+)+`, `(x*)*`, `(\w{2,})+`, `(a+){2,}`. */
 const NESTED_QUANTIFIER_RE = /\([^()]*(?:[+*]|\{\d+,\d*\})[^()]*\)\s*[+*{]/;
 /** A template literal that starts with `${IDENT}/` (cognium-dev#680). */
@@ -708,8 +782,10 @@ function jsSsrfHostGuardedLines(code) {
     return covered;
 }
 /**
- * Is this `plugin_param` source a map read of a key that was never written, on
- * a map whose entire contents we can see? (cognium-dev#328 prerequisite.)
+ * Is this `plugin_param` source a map read that provably yields `null` or a
+ * string literal — a key that was never written, or any key of a literal-only
+ * map (#584) — on a map whose entire contents we can see? (cognium-dev#328
+ * prerequisite.)
  *
  * Sound only when the map's provenance is fully known, so all three hold:
  *
@@ -720,10 +796,11 @@ function jsSsrfHostGuardedLines(code) {
  *  (b) the receiver never escapes — it is not passed as an argument to any
  *      call. `helper(m)` could `put` into it out of sight, so once it escapes
  *      the contents are no longer knowable from this file.
- *  (c) the read key is a string literal with **no** `put` of that same literal
- *      anywhere in the file. A matching `put` keeps the source regardless of
- *      whether the stored value looks tainted — this gate only removes reads
- *      that provably yield `null`, never reads whose value it judged clean.
+ *  (c) the read key is a string literal. A matching `put` of that literal no
+ *      longer keeps the source automatically: when every put value is itself a
+ *      string literal (`isLiteralOnlyLocalMap`), the read is still dropped as
+ *      non-tainted (#584). This gate only removes reads that provably yield
+ *      `null` or a literal-only local map, never reads whose value is uncertain.
  *
  * Deliberately narrow: `plugin_param` only, literal keys only, and any
  * uncertainty leaves the source untouched. Non-literal keys (`m.get(k)`) are
@@ -754,12 +831,36 @@ function isUnwrittenLocalMapKeyRead(code, source) {
         if (escapeRe.test(stripped))
             return false;
     }
-    // (c2) was this literal key ever written?
+    // (c2) was this literal key ever written? If so, drop only a literal-only map.
     const putRe = new RegExp(`\\b${recv}\\s*\\.\\s*put\\s*\\(\\s*"${key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}"`);
     if (lines.some(l => putRe.test(l)))
-        return false;
+        return isLiteralOnlyLocalMap(lines, recv);
     return true;
 }
+/**
+ * cognium-dev#584 (slice) — the map's whole contents are string literals.
+ *
+ * Every mutation of `recv` in the file is a `put(<key>, "<string literal>")`:
+ * no `put` of a non-literal value under any key (so no key-shuffle can place a
+ * tainted value under the key being read), and no bulk or computing mutator
+ * (`putAll`, `putIfAbsent`, `compute*`, `merge`, `replace*`) that could store
+ * a value out of sight. Combined with (a) local construction and (b) no escape
+ * in the caller, a read of such a map yields a literal and is not a source.
+ */
+function isLiteralOnlyLocalMap(lines, recv) {
+    const anyPut = new RegExp(`\\b${recv}\\s*\\.\\s*put\\s*\\(`, 'g');
+    const literalPut = new RegExp(`\\b${recv}\\s*\\.\\s*put\\s*\\(\\s*(?:"(?:[^"\\\\]|\\\\.)*"|[A-Za-z_][\\w.]*)\\s*,\\s*"(?:[^"\\\\]|\\\\.)*"\\s*\\)`, 'g');
+    const otherMutator = new RegExp(`\\b${recv}\\s*\\.\\s*(?:putAll|putIfAbsent|compute|computeIfAbsent|computeIfPresent|merge|replace|replaceAll|entrySet|values)\\s*\\(`);
+    let puts = 0;
+    let literalPuts = 0;
+    for (const l of lines) {
+        if (otherMutator.test(l))
+            return false;
+        puts += (l.match(anyPut) ?? []).length;
+        literalPuts += (l.match(literalPut) ?? []).length;
+    }
+    return puts > 0 && puts === literalPuts;
+}
 /**
  * Is this C# `Content(...)` call the controller helper writing an HTML body
  * (cognium-dev#580)?
@@ -787,6 +888,126 @@ function csharpContentServesHtml(call) {
         return named[2] === 'Html' || named[2] === 'Xml';
     return true;
 }
+/**
+ * True when an unqualified / `this.` / `base.` call to `Content` sits in a type
+ * that can inherit the MVC helper (cognium-dev#580). The C# extractor does not
+ * record base lists, so they are read from the declaration text.
+ *   - a base named `Controller`, `ControllerBase` or `PageModel`: the helper;
+ *   - a `partial` class: the base may be in another part, so treat as unknown and keep;
+ *   - no base list, or only `I`-prefixed interface names: nothing is inherited,
+ *     so `Content(...)` is the type's own method;
+ *   - any other base: unknown, kept, unless the type declares its own `Content`
+ *     name, which hides an inherited one.
+ * Non-class IR kinds (and a missing owner) keep the sink. A controller that
+ * declares its own `Content` overload keeps the helper call.
+ */
+function csharpContentCallInheritsHelper(call, types, sourceLines) {
+    const line = call.location.line;
+    let owner;
+    for (const t of types) {
+        if (line < t.start_line || line > t.end_line)
+            continue;
+        if (!owner || t.end_line - t.start_line < owner.end_line - owner.start_line)
+            owner = t;
+    }
+    if (!owner || owner.kind !== 'class')
+        return true;
+    const header = sourceLines.slice(owner.start_line - 1, owner.start_line + 4).join(' ');
+    const decl = new RegExp(`\\bclass\\s+${owner.name}\\b(?:\\s*<[^>]*>)?\\s*(?::\\s*([^{]*?))?\\s*(?:where\\b[^{]*)?\\{`).exec(header);
+    if (!decl)
+        return true;
+    const bases = (decl[1] ?? '').split(',').map(b => b.trim().replace(/<.*$/, '').split('.').pop() ?? '').filter(Boolean);
+    if (bases.some(b => b === 'Controller' || b === 'ControllerBase' || b === 'PageModel'))
+        return true;
+    // Partial types may declare their base in another part of the type — unknown, keep.
+    const classAt = header.search(/\bclass\b/);
+    if (classAt >= 0 && /\bpartial\b/.test(header.slice(0, classAt)))
+        return true;
+    if (bases.every(b => /^I[A-Z]/.test(b)))
+        return false;
+    return !owner.methods.some(m => m.name === 'Content');
+}
+/**
+ * Does this Rust `.body(x)` call write a response whose builder chain declared
+ * a literal non-HTML content type (cognium-dev#478)? actix-web does not add a
+ * `Content-Type` of its own for `.body(...)`, so only an explicit
+ * `.content_type(<literal>)` earlier in the same chain proves the body is data:
+ *
+ *   - a string literal `type/subtype` that is not HTML, XHTML or a
+ *     script-capable XML type (`text/xml`, `application/xml`, any `+xml`);
+ *   - `ContentType::plaintext()` / `json()` / `octet_stream()` /
+ *     `form_url_encoded()` and the matching `mime::` constants.
+ *
+ * No content type, a computed one, `ContentType::html()` and every XML type
+ * keep the sink. When the chain sets the type more than once the last wins.
+ * Only a call made at the top level of the chain counts, so a nested
+ * `content_type(...)` inside an argument is never read as the response type.
+ */
+function rustBodyDeclaresNonHtmlType(call) {
+    const recv = call.receiver;
+    if (!recv)
+        return false;
+    let arg;
+    let depth = 0;
+    let quote = false;
+    for (let i = 0; i < recv.length; i++) {
+        const ch = recv[i];
+        if (quote) {
+            if (ch === '\\')
+                i++;
+            else if (ch === '"')
+                quote = false;
+            continue;
+        }
+        if (ch === '"') {
+            quote = true;
+            continue;
+        }
+        if (ch === '(' || ch === '[' || ch === '{') {
+            depth++;
+            continue;
+        }
+        if (ch === ')' || ch === ']' || ch === '}') {
+            depth--;
+            continue;
+        }
+        if (depth === 0 && recv.startsWith('.content_type(', i)) {
+            const start = i + '.content_type('.length;
+            let d = 1;
+            let q = false;
+            let j = start;
+            for (; j < recv.length && d > 0; j++) {
+                const c = recv[j];
+                if (q) {
+                    if (c === '\\')
+                        j++;
+                    else if (c === '"')
+                        q = false;
+                }
+                else if (c === '"')
+                    q = true;
+                else if (c === '(')
+                    d++;
+                else if (c === ')')
+                    d--;
+            }
+            arg = d === 0 ? recv.slice(start, j - 1).trim() : undefined;
+            i = j - 1;
+        }
+    }
+    if (arg === undefined)
+        return false;
+    const literal = /^"([^"]*)"$/.exec(arg);
+    if (literal) {
+        const type = literal[1];
+        if (!/^\s*[\w.-]+\/[\w.+-]+/.test(type))
+            return false;
+        return !/^\s*(?:text\/html|application\/xhtml\+xml|text\/xml|application\/xml|[\w.-]+\/[\w.-]+\+xml)\b/i.test(type);
+    }
+    if (/^(?:(?:actix_web\s*::\s*)?(?:http\s*::\s*header\s*::\s*)?)ContentType\s*::\s*(?:plaintext|json|octet_stream|form_url_encoded)\s*\(\s*\)$/.test(arg))
+        return true;
+    return /^(?:::)?mime\s*::\s*(?:TEXT_PLAIN|TEXT_PLAIN_UTF_8|APPLICATION_JSON|APPLICATION_OCTET_STREAM)$/.test(arg);
+}
 /**
  * Compute, per sink type, the set of C# variables whose value has passed through
  * a sanitizer for that type (cognium-dev C#/.NET Phase-1). Seeds from
@@ -800,6 +1021,7 @@ function csharpSanitizedVarsByType(code) {
     const lines = code.split('\n');
     const byType = new Map();
     const assignRe = /^\s*(?:var\s+|[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*(.+?);?\s*$/;
+    const sanitizers = csharpSanitizersFor(code);
     for (const { type } of CSHARP_SANITIZER_RES) {
         if (!byType.has(type))
             byType.set(type, new Set());
@@ -810,7 +1032,7 @@ function csharpSanitizedVarsByType(code) {
         if (!m)
             continue;
         const [, lhs, rhs] = m;
-        for (const { re, type } of CSHARP_SANITIZER_RES) {
+        for (const { re, type } of sanitizers) {
             if (re.test(rhs))
                 byType.get(type).add(lhs);
         }
@@ -1170,13 +1392,26 @@ export class SinkFilterPass {
         // That is SecuriBench Micro `Collections6:47`, an `/* OK */` line. The
         // false positive is currently masked by the const-prop veto in #328, so
         // this gate is behaviour-neutral today; its purpose is to make lifting that
-        // veto safe, which is the sequencing chosen on #328.
+        // veto safe, which is the sequencing chosen on #328. #584 widened it: a read
+        // of a key that WAS put is also dropped when every value put on that local,
+        // non-escaping map is a string literal (`isLiteralOnlyLocalMap`).
         const sources = ctx.code
             ? executableSources.filter(s => !isUnwrittenLocalMapKeyRead(ctx.code, s))
             : executableSources;
         // Build merged sinks, deduplicating JS DOM sinks that may overlap with config sinks.
         const sinks = [...taintMatcher.sinks];
         for (const s of langSources.additionalSinks) {
+            const springReturn = s.type === 'xss' &&
+                typeof s.location === 'string' &&
+                s.location.startsWith('Spring handler returns HTML');
+            if (springReturn) {
+                const i = sinks.findIndex(x => x.line === s.line && x.type === 'xss');
+                if (i >= 0)
+                    sinks[i] = s;
+                else if (!sinks.some(x => x.line === s.line && x.cwe === s.cwe && x.type === s.type))
+                    sinks.push(s);
+                continue;
+            }
             if (!sinks.some(x => x.line === s.line && x.cwe === s.cwe && x.type === s.type)) {
                 sinks.push(s);
             }
@@ -1190,7 +1425,7 @@ export class SinkFilterPass {
         // Stage 2 — clean array elements
         filtered = filterCleanArraySinks(filtered, calls, constProp.taintedArrayElements, constProp.symbols);
         // Stage 3 — clean variables
-        filtered = filterCleanVariableSinks(filtered, calls, constProp.tainted, constProp.symbols, dfg, constProp.sanitizedVars, constProp.synchronizedLines, language);
+        filtered = filterCleanVariableSinks(filtered, calls, constProp.tainted, constProp.symbols, dfg, constProp.sanitizedVars, constProp.synchronizedLines, language, constProp.sanitizedVarUncovered);
         // Stage 4 — sanitized sinks. A sanitizer on one operand does not drop
         // the sink while another source operand is still raw (#641).
         filtered = filterSanitizedSinks(filtered, sanitizers, calls, sources);
@@ -1713,8 +1948,12 @@ export class SinkFilterPass {
                 // Bare identifier — parameter/field lookup.
                 if (varName !== '' && argExpr === varName && !/[(.]/.test(argExpr)) {
                     const t = resolveIdentifierType(varName, ctorCall.in_method, irTypes);
-                    if (isArgvContainerType(t))
+                    // cognium-dev#626: a `List<String>` PARAMETER is argv-form only while no
+                    // same-file caller hands it a shell argv (`/bin/sh -c <script>`): then
+                    // the tainted element is the script, so the suppression proves nothing.
+                    if (isArgvContainerType(t) && !sameFileCallerPassesShellArgv(varName, ctorCall.in_method, ctorCall.location.line, irTypes, irCalls)) {
                         return false;
+                    }
                 }
                 // Method call — return-type lookup. `variable` field carries the
                 // callee name for call-expression args.
@@ -2192,10 +2431,10 @@ export class SinkFilterPass {
             filtered = filtered.filter(sink => {
                 if (sink.type !== 'redos')
                     return true;
-                const m = (sourceLines[sink.line - 1] ?? '').match(/new\s+RegExp\s*\(\s*`((?:\\.|[^`\\])*)`/);
-                if (!m)
+                const tpl = regExpTemplateArgument(ctx.code, sourceLines, sink.line);
+                if (tpl === null)
                     return true;
-                let pattern = m[1];
+                let pattern = tpl;
                 let interpolations = 0;
                 let allConst = true;
                 // Replace each `${ NAME }` as written (whitespace inside the braces
@@ -2298,11 +2537,24 @@ export class SinkFilterPass {
         // at least one `Content` call on its line is the controller helper with an
         // HTML or unknown content type.
         if (language === 'csharp') {
+            const csContentLines = ctx.code.split('\n');
             filtered = filtered.filter(sink => {
                 if (sink.type !== 'xss' || sink.method !== 'Content')
                     return true;
                 const contentCalls = callsByLine.get(sink.line)?.filter(c => c.method_name === 'Content') ?? [];
-                return contentCalls.length === 0 || contentCalls.some(csharpContentServesHtml);
+                // The call must also sit in a type that can inherit the MVC helper (#580).
+                return contentCalls.length === 0 || contentCalls.some(c => csharpContentCallInheritsHelper(c, ctx.graph.ir.types, csContentLines) && csharpContentServesHtml(c));
+            });
+        }
+        // Stage 15k'' — Rust `.body(x)` with a literal non-HTML content type is
+        // data, not markup (cognium-dev#478). The xss sink stays unless every
+        // `body` call on its line sits on a chain that declared such a type.
+        if (language === 'rust') {
+            filtered = filtered.filter(sink => {
+                if (sink.type !== 'xss' || sink.method !== 'body')
+                    return true;
+                const bodyCalls = callsByLine.get(sink.line)?.filter(c => c.method_name === 'body') ?? [];
+                return bodyCalls.length === 0 || !bodyCalls.every(rustBodyDeclaresNonHtmlType);
             });
         }
         // Stage 15m — bash ssrf: fixed-host URL word (cognium-dev#495, #669).
@@ -2985,14 +3237,13 @@ function filterCleanArraySinks(sinks, calls, taintedArrayElements, symbols) {
         const callsAtSink = callsByLine.get(sink.line) ?? [];
         for (const call of callsAtSink) {
             for (const arg of call.arguments) {
-                const arrayAccessMatch = arg.expression?.match(/^(\w+)\[(\d+|[^[\]]+)\]$/);
-                if (arrayAccessMatch) {
-                    const arrayName = arrayAccessMatch[1];
-                    let indexStr = arrayAccessMatch[2];
-                    indexStr = evaluateSimpleExpression(indexStr, symbols);
-                    const taintedIndices = taintedArrayElements.get(arrayName);
+                const arrayAccess = parseJavaArrayAccessExpression(arg.expression);
+                if (arrayAccess) {
+                    let indexKey = arrayAccess.indexKey;
+                    indexKey = evaluateSimpleExpression(indexKey, symbols);
+                    const taintedIndices = taintedArrayElements.get(arrayAccess.arrayName);
                     if (taintedIndices !== undefined) {
-                        const isTainted = taintedIndices.has(indexStr) || taintedIndices.has('*');
+                        const isTainted = taintedIndices.has(indexKey) || taintedIndices.has('*');
                         if (!isTainted)
                             return false;
                     }
@@ -3002,7 +3253,7 @@ function filterCleanArraySinks(sinks, calls, taintedArrayElements, symbols) {
         return true;
     });
 }
-export function filterCleanVariableSinks(sinks, calls, taintedVars, symbols, dfg, sanitizedVars, synchronizedLines, language) {
+export function filterCleanVariableSinks(sinks, calls, taintedVars, symbols, dfg, sanitizedVars, synchronizedLines, language, sanitizedVarUncovered) {
     const fieldNames = new Set();
     if (dfg) {
         for (const def of dfg.defs) {
@@ -3068,8 +3319,33 @@ export function filterCleanVariableSinks(sinks, calls, taintedVars, symbols, dfg
                             argClean = false;
                             break;
                         }
-                        if (sanitizedVars?.has(scopedName) || sanitizedVars?.has(varName))
-                            continue;
+                        // #589 review: when any `method:var` sanitizer exists, decide from
+                        // the scoped name only — do not treat a sibling method's encoder
+                        // (or its unscoped alias) as sanitizing this method's local.
+                        const suffix = `:${varName}`;
+                        let hasScopedSanitizer = false;
+                        if (sanitizedVars) {
+                            for (const s of sanitizedVars) {
+                                if (s !== varName && s.endsWith(suffix)) {
+                                    hasScopedSanitizer = true;
+                                    break;
+                                }
+                            }
+                        }
+                        const isSanitizedHere = sanitizedVars?.has(scopedName)
+                            || (!hasScopedSanitizer && !!sanitizedVars?.has(varName));
+                        if (isSanitizedHere) {
+                            // #589: a context-specific encoder (`escapeHtml`, `encodeForHTML`, …)
+                            // does not clean `trust_boundary`; that sink on the same
+                            // variable stays.
+                            const uncovered = hasScopedSanitizer
+                                ? sanitizedVarUncovered?.get(scopedName)
+                                : (sanitizedVarUncovered?.get(scopedName) ?? sanitizedVarUncovered?.get(varName));
+                            if (!uncovered || !uncovered.has(sink.type))
+                                continue;
+                            argClean = false;
+                            break;
+                        }
                         if (taintedVars.has(scopedName) || taintedVars.has(varName)) {
                             argClean = false;
                             break;