circle-ir 4.15.0 → 4.16.0

package/dist/analysis/passes/weak-hash-pass.js

@@ -104,6 +104,183 @@ function literalAlgo(call, position) {
     const cleaned = stripQuotes(raw).toLowerCase();
     return cleaned || null;
 }
+/**
+ * Parse the text of a Java `.properties` file: `key=value`, `key:value` or
+ * `key value`, `#` / `!` comment lines, trailing-backslash continuation. A later
+ * duplicate key wins, as in `Properties.load`.
+ */
+export function parsePropertiesText(text) {
+    const out = new Map();
+    const rawLines = text.split(/\r?\n/);
+    for (let i = 0; i < rawLines.length; i++) {
+        let line = rawLines[i].replace(/^[ \t\f]+/, '');
+        if (line === '' || line.startsWith('#') || line.startsWith('!'))
+            continue;
+        while (/(?:^|[^\\])(?:\\\\)*\\$/.test(line) && i + 1 < rawLines.length) {
+            line = line.slice(0, -1) + rawLines[++i].replace(/^[ \t\f]+/, '');
+        }
+        const m = /^((?:\\.|[^\s=:\\])+)[ \t\f]*(?:[=:][ \t\f]*|[ \t\f]+)?(.*)$/s.exec(line);
+        if (!m)
+            continue;
+        // Decode \uXXXX before the generic one-char escape pass (Java Properties.load).
+        const unescape = (v) => v
+            .replace(/\\u([0-9a-fA-F]{4})/g, (_, h) => String.fromCharCode(parseInt(h, 16)))
+            .replace(/\\(.)/g, '$1');
+        out.set(unescape(m[1]), unescape(m[2].trimEnd()));
+    }
+    return out;
+}
+const lineOfIndex = (code, index) => {
+    let n = 1;
+    for (let i = 0; i < index; i++)
+        if (code.charCodeAt(i) === 10)
+            n++;
+    return n;
+};
+const STREAM_NAME = /get(?:System)?ResourceAsStream\s*\(\s*"([^"]+)"\s*\)/;
+/** `Class.getResource("name").openStream()` — cognium-dev#591 URL load style. */
+const URL_RESOURCE_STREAM = /\bgetResource\s*\(\s*"([^"]+)"\s*\)\s*\.\s*openStream\s*\(\s*\)\s*$/;
+const FILE_SOURCE = new RegExp(String.raw `^\s*(?:` +
+    // new FileInputStream("p") / new FileReader("p"), optionally through new File("p")
+    String.raw `new\s+(?:java\s*\.\s*io\s*\.\s*)?(?:FileInputStream|FileReader)\s*\(\s*` +
+    String.raw `(?:new\s+(?:java\s*\.\s*io\s*\.\s*)?File\s*\(\s*"([^"\\]+)"\s*\)|"([^"\\]+)")\s*\)` +
+    '|' +
+    // Files.newInputStream(Paths.get("p")) / Files.newBufferedReader(Path.of("p"))
+    String.raw `(?:java\s*\.\s*nio\s*\.\s*file\s*\.\s*)?Files\s*\.\s*(?:newInputStream|newBufferedReader)\s*\(\s*` +
+    String.raw `(?:(?:java\s*\.\s*nio\s*\.\s*file\s*\.\s*)?(?:Paths\s*\.\s*get|Path\s*\.\s*of))\s*\(\s*"([^"\\]+)"\s*\)\s*\)` +
+    String.raw `)(?:\s*\))*\s*$`);
+/**
+ * The resource or file a `Properties.load(...)` argument reads, as a path to match
+ * against the supplied resources, or null when it is anything but a single string
+ * literal in one of the recognised shapes (concatenation, variables, several path
+ * segments, wrappers, `..` segments).
+ */
+function resourceNameOf(expr) {
+    const viaClassLoader = STREAM_NAME.exec(expr)?.[1];
+    if (viaClassLoader)
+        return viaClassLoader;
+    const viaUrl = URL_RESOURCE_STREAM.exec(expr)?.[1];
+    if (viaUrl)
+        return viaUrl;
+    const f = FILE_SOURCE.exec(expr);
+    const path = f?.[1] ?? f?.[2] ?? f?.[3];
+    if (!path)
+        return null;
+    const clean = path.replace(/^(?:\.\/)+/, '');
+    if (!clean || clean.split('/').includes('..'))
+        return null;
+    return clean;
+}
+/**
+ * cognium-dev#591: resolve a `Properties.getProperty(key[, default])` algorithm
+ * through the resource the `Properties` object was loaded from. Driven by the
+ * `load(...)` argument — `p.load(X.getResourceAsStream("<name>"))`, directly or
+ * through an `InputStream` local — with no file-name or key-name allowlist.
+ *
+ * Returns the lowercased algorithm, or null when the chain does not resolve to
+ * exactly one supplied resource (the caller then keeps its existing behaviour).
+ * A key missing from the resolved resource yields the default literal, which is
+ * the value the program gets at run time.
+ */
+function resolveViaResources(code, expr, variable, callLine, resources, methodRange) {
+    if (!resources || resources.size === 0)
+        return null;
+    const getPropTail = String.raw `(\w+)\s*\.\s*getProperty\s*\(\s*"([^"]*)"\s*(?:,\s*([^;]*?))?\s*\)`;
+    let recv;
+    let key;
+    let dflt;
+    let propLine = callLine;
+    const methodStart = methodRange?.start ?? 1;
+    const methodEnd = methodRange?.end ?? Number.POSITIVE_INFINITY;
+    const direct = new RegExp(`^${getPropTail}$`).exec(expr.trim());
+    if (direct) {
+        [, recv, key, dflt] = direct;
+    }
+    else if (variable && /^[A-Za-z_]\w*$/.test(variable)) {
+        // cognium-dev#591 review: only assignments in the enclosing method, before the call.
+        const assign = new RegExp(String.raw `(?:^|[^\w.])${variable}\s*=\s*${getPropTail}\s*;`, 'g');
+        let m;
+        while ((m = assign.exec(code)) !== null) {
+            const line = lineOfIndex(code, m.index);
+            if (line < methodStart)
+                continue;
+            if (line > callLine || line > methodEnd)
+                break;
+            [, recv, key, dflt] = m;
+            propLine = line;
+        }
+        // If any later assignment to the variable sits between the getProperty and the
+        // call, drop the resource value and let the literal / const-prop arms decide.
+        if (recv && key !== undefined) {
+            const later = new RegExp(String.raw `(?:^|[^\w.])${variable}\s*(?:\+=|=)(?!=)\s*`, 'g');
+            let lm;
+            while ((lm = later.exec(code)) !== null) {
+                const line = lineOfIndex(code, lm.index);
+                if (line <= propLine)
+                    continue;
+                if (line >= callLine || line > methodEnd)
+                    break;
+                return null;
+            }
+        }
+    }
+    if (!recv || key === undefined)
+        return null;
+    // The last `recv.load(<arg>)` before the lookup, in the same method: a
+    // same-named `Properties` loaded in another method says nothing about this one.
+    let loadArg;
+    let loadLine = propLine;
+    const loadRe = new RegExp(String.raw `(?:^|[^\w.])${recv}\s*\.\s*load\s*\(([^;]*)\)\s*;`, 'g');
+    let lm;
+    while ((lm = loadRe.exec(code)) !== null) {
+        const line = lineOfIndex(code, lm.index);
+        if (line < methodStart)
+            continue;
+        if (line > propLine)
+            break;
+        loadArg = lm[1];
+        loadLine = line;
+    }
+    if (loadArg === undefined)
+        return null;
+    let name = resourceNameOf(loadArg);
+    if (!name && /^\s*[A-Za-z_]\w*\s*$/.test(loadArg)) {
+        const stream = loadArg.trim();
+        // The last binding of the stream local before the load decides; one that is not a
+        // recognised resource or file source leaves the load unresolved.
+        const bind = new RegExp(String.raw `(?:^|[^\w.])${stream}\s*=(?!=)\s*([^;{]*)`, 'g');
+        let bm;
+        while ((bm = bind.exec(code)) !== null) {
+            const line = lineOfIndex(code, bm.index);
+            if (line < methodStart)
+                continue;
+            if (line > loadLine)
+                break;
+            // try-with-resources: `try (InputStream in = EXPR) {` — the bind capture keeps a trailing `)`.
+            let bound = bm[1].trim();
+            if (bound.endsWith(')') && !resourceNameOf(bound)) {
+                bound = bound.slice(0, -1).trimEnd();
+            }
+            name = resourceNameOf(bound);
+        }
+    }
+    if (!name)
+        return null;
+    const wanted = name.replace(/^\/+/, '');
+    const texts = new Set();
+    for (const [path, text] of resources) {
+        const p = path.replace(/\\/g, '/');
+        if (p === wanted || p.endsWith('/' + wanted))
+            texts.add(text);
+    }
+    if (texts.size !== 1)
+        return null;
+    const value = parsePropertiesText([...texts][0]).get(key);
+    if (value !== undefined)
+        return value.trim().toLowerCase() || null;
+    const lit = dflt === undefined ? null : /^"([^"]*)"$/.exec(dflt.trim());
+    return lit ? lit[1].toLowerCase() || null : null;
+}
 /**
  * Resolve the algorithm-name argument of a Java `getInstance(...)` call,
  * preferring an inline literal but falling back to:
@@ -115,10 +292,16 @@ function literalAlgo(call, position) {
  * Returns the lowercased algorithm name or null when unresolved.
  * cognium-dev #119: OWASP Java benchmark FNs come from these shapes.
  */
-function resolveJavaAlgo(call, position, constProp, javaBindings) {
+function resolveJavaAlgo(call, position, constProp, javaBindings, code = '', resources, methodRange) {
     const arg = call.arguments.find((a) => a.position === position);
     if (!arg)
         return null;
+    // 0. A `getProperty` value read from a supplied resource file (#591). Before the
+    //    default arm below, which would otherwise hide the file's value.
+    //    Scoped to the enclosing method; skipped when the variable is reassigned later.
+    const viaResource = resolveViaResources(code, arg.expression ?? '', arg.variable ?? undefined, call.location.line, resources, methodRange);
+    if (viaResource)
+        return viaResource;
     // 1. Inline literal (existing behaviour)
     if (arg.literal) {
         const cleaned = stripQuotes(arg.literal).toLowerCase();
@@ -202,7 +385,11 @@ export class WeakHashPass {
             ? scanJavaStringBindings(code)
             : new Map();
         for (const call of graph.ir.calls) {
-            const detection = this.detect(call, language, constProp, javaBindings);
+            const enclosing = language === 'java' ? graph.methodAtLine(call.location.line) : null;
+            const methodRange = enclosing
+                ? { start: enclosing.method.start_line, end: enclosing.method.end_line }
+                : null;
+            const detection = this.detect(call, language, constProp, javaBindings, code, ctx.resources, methodRange);
             if (!detection)
                 continue;
             const { algorithm, api } = detection;
@@ -229,13 +416,13 @@ export class WeakHashPass {
         }
         return { findings };
     }
-    detect(call, language, constProp, javaBindings) {
+    detect(call, language, constProp, javaBindings, code = '', resources, methodRange) {
         const method = call.method_name;
         const receiver = call.receiver ?? '';
         if (language === 'java') {
             // MessageDigest.getInstance("MD5") — literal or resolved variable.
             if (method === 'getInstance' && (receiver === 'MessageDigest' || receiver.endsWith('.MessageDigest'))) {
-                const algo = resolveJavaAlgo(call, 0, constProp, javaBindings);
+                const algo = resolveJavaAlgo(call, 0, constProp, javaBindings, code, resources, methodRange);
                 if (algo && WEAK_HASH_NAMES.has(algo)) {
                     return { algorithm: algo, api: 'MessageDigest.getInstance' };
                 }

package/dist/analysis/passes/weak-hash-pass.js.map

@@ -1 +1 @@
-{"version":3,"file":"weak-hash-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/weak-hash-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAMH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,KAAK,EAAE,KAAK,EAAE,KAAK;IACnB,OAAO,EAAE,MAAM;CAChB,CAAC,CAAC;AAEH,0EAA0E;AAC1E,8EAA8E;AAC9E,uCAAuC;AACvC,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1D,0DAA0D;AAC1D,6EAA6E;AAC7E,4CAA4C;AAC5C,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC5C,eAAe,EAAE,oBAAoB,EAAE,MAAM,EAAE,cAAc;CAC9D,CAAC,CAAC;AACH,8EAA8E;AAC9E,yEAAyE;AACzE,MAAM,sBAAsB,GAA2B;IACrD,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK;IAC9C,yBAAyB,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IACvE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;CACjC,CAAC;AAEF,yEAAyE;AACzE,4EAA4E;AAC5E,0DAA0D;AAC1D,6EAA6E;AAC7E,SAAS,kBAAkB,CAAC,OAAsB;IAChD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACxE,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,MAAM,CAAC;IAClC,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,oEAAoE;AACpE,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,KAAK,EAAE,QAAQ;IACf,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,SAAS;IACjB,iEAAiE;IACjE,KAAK,EAAE,QAAQ;CAChB,CAAC,CAAC;AAEH,0EAA0E;AAC1E,+DAA+D;AAC/D,0EAA0E;AAC1E,MAAM,sBAAsB,GAA2B;IACrD,YAAY,EAAE,KAAK;IACnB,YAAY,EAAE,KAAK;IACnB,aAAa,EAAE,MAAM;IACrB,YAAY,EAAE,MAAM;CACrB,CAAC;AAEF,6EAA6E;AAC7E,+EAA+E;AAC/E,gEAAgE;AAChE,MAAM,sBAAsB,GAA2B;IACrD,6BAA6B,EAAE,KAAK;IACpC,6BAA6B,EAAE,KAAK;IACpC,+BAA+B,EAAE,MAAM;CACxC,CAAC;AAEF,qCAAqC;AACrC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAWtE,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,IACE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAClD,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,IAAc,EAAE,QAAgB;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAChE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/C,OAAO,OAAO,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CACtB,IAAc,EACd,QAAgB,EAChB,SAA0C,EAC1C,YAAiC;IAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAChE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,yCAAyC;IACzC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzE,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAChD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IAED,8CAA8C;IAC9C,IAAI,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACtE,gGAAgG;IAChG,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAEtE,gDAAgD;IAChD,IAAI,GAAG,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAClE,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YACrD,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,qEAAqE;IACrE,eAAe;IACf,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC;IACtB,qEAAqE;IACrE,qDAAqD;IACrD,MAAM,EAAE,GAAG,8HAA8H,CAAC;IAC1I,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,YAAY;IACd,IAAI,GAAG,WAAW,CAAC;IACnB,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,QAAQ,GAA+B,EAAE,CAAC;QAEhD,8DAA8D;QAC9D,oDAAoD;QACpD,uDAAuD;QACvD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC;YACrD,CAAC,CAAC,GAAG,CAAC,SAAS,CAA2B,sBAAsB,CAAC;YACjE,CAAC,CAAC,IAAI,CAAC;QAET,yEAAyE;QACzE,yDAAyD;QACzD,MAAM,YAAY,GAAG,QAAQ,KAAK,MAAM;YACtC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC;YAC9B,CAAC,CAAC,IAAI,GAAG,EAAkB,CAAC;QAE9B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;YACvE,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YAElD,GAAG,CAAC,UAAU,CAAC;gBACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;gBAClC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,SAAS;gBAChB,OAAO,EACL,yBAAyB,SAAS,CAAC,WAAW,EAAE,iBAAiB,GAAG,MAAM;oBAC1E,sEAAsE;oBACtE,qEAAqE;oBACrE,yBAAyB;gBAC3B,IAAI;gBACJ,IAAI;gBACJ,GAAG,EACD,oEAAoE;oBACpE,qEAAqE;gBACvE,QAAQ,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE;aACvC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IAEO,MAAM,CACZ,IAAc,EACd,QAAgB,EAChB,SAA0C,EAC1C,YAAiC;QAKjC,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QAErC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,mEAAmE;YACnE,IAAI,MAAM,KAAK,aAAa,IAAI,CAAC,QAAQ,KAAK,eAAe,IAAI,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;gBACtG,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;gBAC/D,IAAI,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,2BAA2B,EAAE,CAAC;gBAC/D,CAAC;YACH,CAAC;YACD,mEAAmE;YACnE,IAAI,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,aAAa,IAAI,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;gBAC5G,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAChE,MAAM,UAAU,GAAG,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC;gBACtE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,eAAe,MAAM,EAAE,EAAE,CAAC;YACjE,CAAC;YACD,kEAAkE;YAClE,wDAAwD;YACxD,IAAI,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,aAAa,IAAI,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;gBACxG,OAAO,EAAE,SAAS,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,eAAe,MAAM,EAAE,EAAE,CAAC;YACrF,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,qDAAqD;YACrD,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7F,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBACrB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;oBAClC,IAAI,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBACtC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;oBACjD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,MAAM,EAAE,EAAE,CAAC;YACzD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC3D,4DAA4D;YAC5D,IAAI,CAAC,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,YAAY,CAAC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAClF,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClC,IAAI,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC;gBACtD,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,wDAAwD;YACxD,MAAM,SAAS,GAAG,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,MAAM,CAAC;YAC5D,IAAI,SAAS,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,KAAK,CAAC,EAAE,CAAC;gBACxD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,QAAQ,IAAI,MAAM,EAAE,EAAE,CAAC;YAC/D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,0EAA0E;YAC1E,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,UAAU,CAAC,IAAI,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7F,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,GAAG,QAAQ,IAAI,MAAM,EAAE,EAAE,CAAC;YAC7E,CAAC;YACD,oFAAoF;YACpF,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,gBAAgB,CAAC,IAAI,6BAA6B,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxG,MAAM,IAAI,GAAG,kBAAkB,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACtD,IAAI,IAAI;oBAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,QAAQ,IAAI,MAAM,EAAE,EAAE,CAAC;YACrE,CAAC;YACD,qFAAqF;YACrF,IAAI,IAAI,CAAC,cAAc,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1D,OAAO,EAAE,SAAS,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,MAAM,IAAI,EAAE,CAAC;YAC/E,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"weak-hash-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/weak-hash-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAMH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,KAAK,EAAE,KAAK,EAAE,KAAK;IACnB,OAAO,EAAE,MAAM;CAChB,CAAC,CAAC;AAEH,0EAA0E;AAC1E,8EAA8E;AAC9E,uCAAuC;AACvC,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1D,0DAA0D;AAC1D,6EAA6E;AAC7E,4CAA4C;AAC5C,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC;IAC5C,eAAe,EAAE,oBAAoB,EAAE,MAAM,EAAE,cAAc;CAC9D,CAAC,CAAC;AACH,8EAA8E;AAC9E,yEAAyE;AACzE,MAAM,sBAAsB,GAA2B;IACrD,wBAAwB,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK;IAC9C,yBAAyB,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IACvE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;CACjC,CAAC;AAEF,yEAAyE;AACzE,4EAA4E;AAC5E,0DAA0D;AAC1D,6EAA6E;AAC7E,SAAS,kBAAkB,CAAC,OAAsB;IAChD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACxE,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,MAAM,CAAC;IAClC,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,oEAAoE;AACpE,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,KAAK,EAAE,QAAQ;IACf,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,SAAS;IACjB,iEAAiE;IACjE,KAAK,EAAE,QAAQ;CAChB,CAAC,CAAC;AAEH,0EAA0E;AAC1E,+DAA+D;AAC/D,0EAA0E;AAC1E,MAAM,sBAAsB,GAA2B;IACrD,YAAY,EAAE,KAAK;IACnB,YAAY,EAAE,KAAK;IACnB,aAAa,EAAE,MAAM;IACrB,YAAY,EAAE,MAAM;CACrB,CAAC;AAEF,6EAA6E;AAC7E,+EAA+E;AAC/E,gEAAgE;AAChE,MAAM,sBAAsB,GAA2B;IACrD,6BAA6B,EAAE,KAAK;IACpC,6BAA6B,EAAE,KAAK;IACpC,+BAA+B,EAAE,MAAM;CACxC,CAAC;AAEF,qCAAqC;AACrC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAWtE,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,IACE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAClD,CAAC;QACD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,IAAc,EAAE,QAAgB;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAChE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/C,OAAO,OAAO,IAAI,IAAI,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,IAAI,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC1E,OAAO,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;YACvE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAE,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,GAAG,+DAA+D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrF,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,gFAAgF;QAChF,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAU,EAAE,CACrC,CAAC;aACE,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;aACvF,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC7B,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE;IAC1D,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,CAAC,EAAE,CAAC;IACnE,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,MAAM,WAAW,GAAG,sDAAsD,CAAC;AAC3E,iFAAiF;AACjF,MAAM,mBAAmB,GACvB,qEAAqE,CAAC;AACxE,MAAM,WAAW,GAAG,IAAI,MAAM,CAC5B,MAAM,CAAC,GAAG,CAAA,SAAS;IACjB,mFAAmF;IACnF,MAAM,CAAC,GAAG,CAAA,yEAAyE;IACnF,MAAM,CAAC,GAAG,CAAA,oFAAoF;IAC9F,GAAG;IACH,+EAA+E;IAC/E,MAAM,CAAC,GAAG,CAAA,mGAAmG;IAC7G,MAAM,CAAC,GAAG,CAAA,8GAA8G;IACxH,MAAM,CAAC,GAAG,CAAA,iBAAiB,CAC9B,CAAC;AAEF;;;;;GAKG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,cAAc,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAC1C,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,mBAAmB,CAC1B,IAAY,EACZ,IAAY,EACZ,QAA4B,EAC5B,QAAgB,EAChB,SAAkD,EAClD,WAAmD;IAEnD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAA,oEAAoE,CAAC;IACnG,IAAI,IAAwB,CAAC;IAC7B,IAAI,GAAuB,CAAC;IAC5B,IAAI,IAAwB,CAAC;IAC7B,IAAI,QAAQ,GAAG,QAAQ,CAAC;IACxB,MAAM,WAAW,GAAG,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,WAAW,EAAE,GAAG,IAAI,MAAM,CAAC,iBAAiB,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,IAAI,MAAM,EAAE,CAAC;QACX,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC;IAC/B,CAAC;SAAM,IAAI,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,qFAAqF;QACrF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,eAAe,QAAQ,UAAU,WAAW,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7F,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,IAAI,GAAG,WAAW;gBAAE,SAAS;YACjC,IAAI,IAAI,GAAG,QAAQ,IAAI,IAAI,GAAG,SAAS;gBAAE,MAAM;YAC/C,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YACxB,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,+EAA+E;QAC/E,8EAA8E;QAC9E,IAAI,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,IAAI,MAAM,CACtB,MAAM,CAAC,GAAG,CAAA,eAAe,QAAQ,sBAAsB,EACvD,GAAG,CACJ,CAAC;YACF,IAAI,EAA0B,CAAC;YAC/B,OAAO,CAAC,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;gBACzC,IAAI,IAAI,IAAI,QAAQ;oBAAE,SAAS;gBAC/B,IAAI,IAAI,IAAI,QAAQ,IAAI,IAAI,GAAG,SAAS;oBAAE,MAAM;gBAChD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5C,uEAAuE;IACvE,gFAAgF;IAChF,IAAI,OAA2B,CAAC;IAChC,IAAI,QAAQ,GAAG,QAAQ,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,eAAe,IAAI,gCAAgC,EAAE,GAAG,CAAC,CAAC;IAC9F,IAAI,EAA0B,CAAC;IAC/B,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,IAAI,GAAG,WAAW;YAAE,SAAS;QACjC,IAAI,IAAI,GAAG,QAAQ;YAAE,MAAM;QAC3B,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEvC,IAAI,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,IAAI,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC9B,kFAAkF;QAClF,iEAAiE;QACjE,MAAM,IAAI,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,eAAe,MAAM,sBAAsB,EAAE,GAAG,CAAC,CAAC;QACpF,IAAI,EAA0B,CAAC;QAC/B,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,IAAI,GAAG,WAAW;gBAAE,SAAS;YACjC,IAAI,IAAI,GAAG,QAAQ;gBAAE,MAAM;YAC3B,+FAA+F;YAC/F,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACvC,CAAC;YACD,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAElC,MAAM,KAAK,GAAG,mBAAmB,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACxE,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CACtB,IAAc,EACd,QAAgB,EAChB,SAA0C,EAC1C,YAAiC,EACjC,IAAI,GAAG,EAAE,EACT,SAAuC,EACvC,WAAmD;IAEnD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IAChE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAEtB,iFAAiF;IACjF,qEAAqE;IACrE,oFAAoF;IACpF,MAAM,WAAW,GAAG,mBAAmB,CACrC,IAAI,EACJ,GAAG,CAAC,UAAU,IAAI,EAAE,EACpB,GAAG,CAAC,QAAQ,IAAI,SAAS,EACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,EAClB,SAAS,EACT,WAAW,CACZ,CAAC;IACF,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,yCAAyC;IACzC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QACvD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzE,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAChD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IAED,8CAA8C;IAC9C,IAAI,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACtE,gGAAgG;IAChG,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,sBAAsB,CAAC,IAAI,CAAC;QAAE,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAEtE,gDAAgD;IAChD,IAAI,GAAG,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAClE,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YACrD,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,qEAAqE;IACrE,eAAe;IACf,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,GAAG,CAAC;IACtB,qEAAqE;IACrE,qDAAqD;IACrD,MAAM,EAAE,GAAG,8HAA8H,CAAC;IAC1I,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,YAAY;IACd,IAAI,GAAG,WAAW,CAAC;IACnB,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,QAAQ,GAA+B,EAAE,CAAC;QAEhD,8DAA8D;QAC9D,oDAAoD;QACpD,uDAAuD;QACvD,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC;YACrD,CAAC,CAAC,GAAG,CAAC,SAAS,CAA2B,sBAAsB,CAAC;YACjE,CAAC,CAAC,IAAI,CAAC;QAET,yEAAyE;QACzE,yDAAyD;QACzD,MAAM,YAAY,GAAG,QAAQ,KAAK,MAAM;YACtC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC;YAC9B,CAAC,CAAC,IAAI,GAAG,EAAkB,CAAC;QAE9B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,SAAS,GAAG,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACtF,MAAM,WAAW,GAAG,SAAS;gBAC3B,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE;gBACxE,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACzG,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;YAElD,GAAG,CAAC,UAAU,CAAC;gBACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;gBAClC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,SAAS;gBAChB,OAAO,EACL,yBAAyB,SAAS,CAAC,WAAW,EAAE,iBAAiB,GAAG,MAAM;oBAC1E,sEAAsE;oBACtE,qEAAqE;oBACrE,yBAAyB;gBAC3B,IAAI;gBACJ,IAAI;gBACJ,GAAG,EACD,oEAAoE;oBACpE,qEAAqE;gBACvE,QAAQ,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE;aACvC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IAEO,MAAM,CACZ,IAAc,EACd,QAAgB,EAChB,SAA0C,EAC1C,YAAiC,EACjC,IAAI,GAAG,EAAE,EACT,SAAuC,EACvC,WAAmD;QAKnD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QAErC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,mEAAmE;YACnE,IAAI,MAAM,KAAK,aAAa,IAAI,CAAC,QAAQ,KAAK,eAAe,IAAI,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC;gBACtG,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;gBAC7F,IAAI,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,2BAA2B,EAAE,CAAC;gBAC/D,CAAC;YACH,CAAC;YACD,mEAAmE;YACnE,IAAI,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,aAAa,IAAI,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;gBAC5G,MAAM,cAAc,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAChE,MAAM,UAAU,GAAG,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC;gBACtE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,EAAE,eAAe,MAAM,EAAE,EAAE,CAAC;YACjE,CAAC;YACD,kEAAkE;YAClE,wDAAwD;YACxD,IAAI,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,aAAa,IAAI,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;gBACxG,OAAO,EAAE,SAAS,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,eAAe,MAAM,EAAE,EAAE,CAAC;YACrF,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,qDAAqD;YACrD,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7F,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBACrB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;oBAClC,IAAI,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;wBACtC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;oBACjD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,MAAM,EAAE,EAAE,CAAC;YACzD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC3D,4DAA4D;YAC5D,IAAI,CAAC,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,YAAY,CAAC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAClF,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClC,IAAI,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,MAAM,EAAE,EAAE,CAAC;gBACtD,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,wDAAwD;YACxD,MAAM,SAAS,GAAG,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,MAAM,CAAC;YAC5D,IAAI,SAAS,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,KAAK,CAAC,EAAE,CAAC;gBACxD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,QAAQ,IAAI,MAAM,EAAE,EAAE,CAAC;YAC/D,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,0EAA0E;YAC1E,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,UAAU,CAAC,IAAI,wBAAwB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7F,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,GAAG,QAAQ,IAAI,MAAM,EAAE,EAAE,CAAC;YAC7E,CAAC;YACD,oFAAoF;YACpF,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,gBAAgB,CAAC,IAAI,6BAA6B,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxG,MAAM,IAAI,GAAG,kBAAkB,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBACtD,IAAI,IAAI;oBAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,QAAQ,IAAI,MAAM,EAAE,EAAE,CAAC;YACrE,CAAC;YACD,qFAAqF;YACrF,IAAI,IAAI,CAAC,cAAc,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1D,OAAO,EAAE,SAAS,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,MAAM,IAAI,EAAE,CAAC;YAC/E,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/analysis/passes/weak-random-pass.d.ts

@@ -43,6 +43,11 @@ export declare class WeakRandomPass implements AnalysisPass<WeakRandomResult> {
     run(ctx: PassContext): WeakRandomResult;
     private fixFor;
     private detect;
+    /**
+     * True when the call's receiver is a parameter of the innermost enclosing
+     * method (or constructor) that is declared with the type `Random`.
+     */
+    private receiverIsRandomParameter;
     /**
      * Returns true when `math/rand` is the active `rand` identifier in this
      * file (i.e. `math/rand` imported unaliased; `crypto/rand` is either not

package/dist/analysis/passes/weak-random-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"weak-random-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/weak-random-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAyB9E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAED,qBAAa,cAAe,YAAW,YAAY,CAAC,gBAAgB,CAAC;IACnE,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,gBAAgB,CAiCtC;IAED,OAAO,CAAC,MAAM;IAqBd,OAAO,CAAC,MAAM;IAqEd;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;CAiB3B"}
+{"version":3,"file":"weak-random-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/weak-random-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAyB9E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,GAAG,EAAE,MAAM,CAAC;KACb,CAAC,CAAC;CACJ;AAED,qBAAa,cAAe,YAAW,YAAY,CAAC,gBAAgB,CAAC;IACnE,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,gBAAgB,CAiCtC;IAED,OAAO,CAAC,MAAM;IAqBd,OAAO,CAAC,MAAM;IA4Ed;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IAiBjC;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;CAiB3B"}

package/dist/analysis/passes/weak-random-pass.js

@@ -119,6 +119,13 @@ export class WeakRandomPass {
             // `someRandomInstance.nextInt()` — receiver_type is Random / SplittableRandom / ThreadLocalRandom
             if (JAVA_RANDOM_METHODS.has(method)) {
                 const rt = call.receiver_type ?? '';
+                if (rt === 'Random' && this.receiverIsRandomParameter(call, ctx)) {
+                    // #612 — a `Random`-typed method parameter is whatever the caller
+                    // passes (often a SecureRandom, often from another file): unknown,
+                    // not weak. Locals, fields, `Math.random()` and `ThreadLocalRandom`
+                    // are unaffected.
+                    return null;
+                }
                 if (rt === 'Random' || rt === 'SplittableRandom' || rt === 'ThreadLocalRandom') {
                     return `${rt}.${method}`;
                 }
@@ -167,6 +174,29 @@ export class WeakRandomPass {
         }
         return null;
     }
+    /**
+     * True when the call's receiver is a parameter of the innermost enclosing
+     * method (or constructor) that is declared with the type `Random`.
+     */
+    receiverIsRandomParameter(call, ctx) {
+        const receiver = (call.receiver ?? '').trim();
+        if (!/^[A-Za-z_$][\w$]*$/.test(receiver))
+            return false;
+        const line = call.location.line;
+        let best = null;
+        for (const type of ctx.graph.ir.types ?? []) {
+            for (const m of type.methods ?? []) {
+                if (line < m.start_line || line > m.end_line)
+                    continue;
+                const span = m.end_line - m.start_line;
+                if (best && span >= best.span)
+                    continue;
+                const p = m.parameters.find((x) => x.name === receiver);
+                best = { span, isParam: !!p && /^(?:[A-Za-z_$][\w$]*\.)*Random$/.test((p.type ?? '').trim()) };
+            }
+        }
+        return best?.isParam ?? false;
+    }
     /**
      * Returns true when `math/rand` is the active `rand` identifier in this
      * file (i.e. `math/rand` imported unaliased; `crypto/rand` is either not

package/dist/analysis/passes/weak-random-pass.js.map

@@ -1 +1 @@
-{"version":3,"file":"weak-random-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/weak-random-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAKH,OAAO;AACP,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa;IAC/D,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS;CACxD,CAAC,CAAC;AAEH,iCAAiC;AACjC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa;IAClE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe;IAClE,aAAa,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY;IAC9D,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc;CACnE,CAAC,CAAC;AAEH,yBAAyB;AACzB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ;IACnD,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY;IACjD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ;IAC7C,MAAM,EAAE,KAAK,EAAE,WAAW;CAC3B,CAAC,CAAC;AAUH,MAAM,OAAO,cAAc;IAChB,IAAI,GAAG,aAAa,CAAC;IACrB,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,QAAQ,GAAiC,EAAE,CAAC;QAElD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG;gBAAE,SAAS;YAEnB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;YAEvC,GAAG,CAAC,UAAU,CAAC;gBACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;gBAClC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,SAAS;gBAChB,OAAO,EACL,wCAAwC,GAAG,yBAAyB;oBACpE,uEAAuE;oBACvE,wEAAwE;gBAC1E,IAAI;gBACJ,IAAI;gBACJ,GAAG,EACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACvB,QAAQ,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IAEO,MAAM,CAAC,QAAgB;QAC7B,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,MAAM;gBACT,OAAO,6CAA6C;oBAClD,mFAAmF,CAAC;YACxF,KAAK,QAAQ;gBACX,OAAO,mDAAmD;oBACxD,8DAA8D,CAAC;YACnE,KAAK,YAAY,CAAC;YAClB,KAAK,YAAY,CAAC;YAClB,KAAK,KAAK;gBACR,OAAO,2CAA2C;oBAChD,iDAAiD,CAAC;YACtD,KAAK,IAAI;gBACP,OAAO,qDAAqD;oBAC1D,+EAA+E,CAAC;YACpF;gBACE,OAAO,6EAA6E,CAAC;QACzF,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,IAAc,EAAE,QAAgB,EAAE,GAAgB;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QAErC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,2CAA2C;YAC3C,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,MAAM,CAAC;gBACpB,IAAI,IAAI,KAAK,QAAQ;oBAAE,OAAO,YAAY,CAAC;gBAC3C,IAAI,IAAI,KAAK,kBAAkB;oBAAE,OAAO,sBAAsB,CAAC;YACjE,CAAC;YACD,kBAAkB;YAClB,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC/E,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,kGAAkG;YAClG,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;gBACpC,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,kBAAkB,IAAI,EAAE,KAAK,mBAAmB,EAAE,CAAC;oBAC/E,OAAO,GAAG,EAAE,IAAI,MAAM,EAAE,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,kFAAkF;YAClF,sEAAsE;YACtE,0EAA0E;YAC1E,mEAAmE;YACnE,yCAAyC;YACzC,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,OAAO,cAAc,MAAM,EAAE,CAAC;gBACvE,IAAI,8BAA8B,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,OAAO,wBAAwB,MAAM,EAAE,CAAC;YAC7F,CAAC;YACD,6EAA6E;YAC7E,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,gCAAgC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvF,OAAO,6BAA6B,MAAM,EAAE,CAAC;YAC/C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,iDAAiD;YACjD,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3F,OAAO,UAAU,MAAM,EAAE,CAAC;YAC5B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACjF,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC/E,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,kEAAkE;YAClE,kEAAkE;YAClE,oEAAoE;YACpE,kCAAkC;YAClC,IAAI,QAAQ,KAAK,MAAM,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrD,IAAI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjC,OAAO,QAAQ,MAAM,EAAE,CAAC;gBAC1B,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACK,kBAAkB,CAAC,GAAgB;QACzC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC;QAC3C,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,mBAAmB,GAAG,KAAK,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,aAAa,CAAC;YAClD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;YACxB,IAAI,GAAG,KAAK,WAAW,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,KAAK,MAAM,CAAC,EAAE,CAAC;gBACxD,iBAAiB,GAAG,IAAI,CAAC;YAC3B,CAAC;YACD,IAAI,GAAG,KAAK,aAAa,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,KAAK,MAAM,CAAC,EAAE,CAAC;gBAC1D,mBAAmB,GAAG,IAAI,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,wDAAwD;QACxD,OAAO,iBAAiB,IAAI,CAAC,mBAAmB,CAAC;IACnD,CAAC;CACF"}
+{"version":3,"file":"weak-random-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/weak-random-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAKH,OAAO;AACP,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa;IAC/D,WAAW,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS;CACxD,CAAC,CAAC;AAEH,iCAAiC;AACjC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa;IAClE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe;IAClE,aAAa,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY;IAC9D,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,cAAc;CACnE,CAAC,CAAC;AAEH,yBAAyB;AACzB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ;IACnD,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY;IACjD,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ;IAC7C,MAAM,EAAE,KAAK,EAAE,WAAW;CAC3B,CAAC,CAAC;AAUH,MAAM,OAAO,cAAc;IAChB,IAAI,GAAG,aAAa,CAAC;IACrB,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,MAAM,QAAQ,GAAiC,EAAE,CAAC;QAElD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG;gBAAE,SAAS;YAEnB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;YAEvC,GAAG,CAAC,UAAU,CAAC;gBACb,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;gBAClC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,IAAI,CAAC,IAAI;gBAClB,GAAG,EAAE,SAAS;gBACd,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,SAAS;gBAChB,OAAO,EACL,wCAAwC,GAAG,yBAAyB;oBACpE,uEAAuE;oBACvE,wEAAwE;gBAC1E,IAAI;gBACJ,IAAI;gBACJ,GAAG,EACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;gBACvB,QAAQ,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IAEO,MAAM,CAAC,QAAgB;QAC7B,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,MAAM;gBACT,OAAO,6CAA6C;oBAClD,mFAAmF,CAAC;YACxF,KAAK,QAAQ;gBACX,OAAO,mDAAmD;oBACxD,8DAA8D,CAAC;YACnE,KAAK,YAAY,CAAC;YAClB,KAAK,YAAY,CAAC;YAClB,KAAK,KAAK;gBACR,OAAO,2CAA2C;oBAChD,iDAAiD,CAAC;YACtD,KAAK,IAAI;gBACP,OAAO,qDAAqD;oBAC1D,+EAA+E,CAAC;YACpF;gBACE,OAAO,6EAA6E,CAAC;QACzF,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,IAAc,EAAE,QAAgB,EAAE,GAAgB;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QAErC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,2CAA2C;YAC3C,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,MAAM,CAAC;gBACpB,IAAI,IAAI,KAAK,QAAQ;oBAAE,OAAO,YAAY,CAAC;gBAC3C,IAAI,IAAI,KAAK,kBAAkB;oBAAE,OAAO,sBAAsB,CAAC;YACjE,CAAC;YACD,kBAAkB;YAClB,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC/E,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,kGAAkG;YAClG,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;gBACpC,IAAI,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;oBACjE,kEAAkE;oBAClE,mEAAmE;oBACnE,oEAAoE;oBACpE,kBAAkB;oBAClB,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,kBAAkB,IAAI,EAAE,KAAK,mBAAmB,EAAE,CAAC;oBAC/E,OAAO,GAAG,EAAE,IAAI,MAAM,EAAE,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,kFAAkF;YAClF,sEAAsE;YACtE,0EAA0E;YAC1E,mEAAmE;YACnE,yCAAyC;YACzC,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,OAAO,cAAc,MAAM,EAAE,CAAC;gBACvE,IAAI,8BAA8B,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,OAAO,wBAAwB,MAAM,EAAE,CAAC;YAC7F,CAAC;YACD,6EAA6E;YAC7E,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,gCAAgC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvF,OAAO,6BAA6B,MAAM,EAAE,CAAC;YAC/C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,iDAAiD;YACjD,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3F,OAAO,UAAU,MAAM,EAAE,CAAC;YAC5B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACjF,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC/E,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,kEAAkE;YAClE,kEAAkE;YAClE,oEAAoE;YACpE,kCAAkC;YAClC,IAAI,QAAQ,KAAK,MAAM,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrD,IAAI,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjC,OAAO,QAAQ,MAAM,EAAE,CAAC;gBAC1B,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACK,yBAAyB,CAAC,IAAc,EAAE,GAAgB;QAChE,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChC,IAAI,IAAI,GAA8C,IAAI,CAAC;QAC3D,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YAC5C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBACnC,IAAI,IAAI,GAAG,CAAC,CAAC,UAAU,IAAI,IAAI,GAAG,CAAC,CAAC,QAAQ;oBAAE,SAAS;gBACvD,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC;gBACvC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI;oBAAE,SAAS;gBACxC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;gBACxD,IAAI,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,iCAAiC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACjG,CAAC;QACH,CAAC;QACD,OAAO,IAAI,EAAE,OAAO,IAAI,KAAK,CAAC;IAChC,CAAC;IAED;;;;OAIG;IACK,kBAAkB,CAAC,GAAgB;QACzC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC;QAC3C,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,mBAAmB,GAAG,KAAK,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,aAAa,CAAC;YAClD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;YACxB,IAAI,GAAG,KAAK,WAAW,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,KAAK,MAAM,CAAC,EAAE,CAAC;gBACxD,iBAAiB,GAAG,IAAI,CAAC;YAC3B,CAAC;YACD,IAAI,GAAG,KAAK,aAAa,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,KAAK,MAAM,CAAC,EAAE,CAAC;gBAC1D,mBAAmB,GAAG,IAAI,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,wDAAwD;QACxD,OAAO,iBAAiB,IAAI,CAAC,mBAAmB,CAAC;IACnD,CAAC;CACF"}

package/dist/analysis/project-callee-escape-gate.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Project-callee escape gate (cognium-dev#637, C#).
+ *
+ * A file analysed on its own cannot see a method defined in another file, so
+ * a tainted argument passed to it is reported as an `external_taint_escape`
+ * (data handed to an unknown method). Inside `analyzeProject` the callee is
+ * known: the call is project code, not data leaving the program, and whether
+ * the value reaches a sink is decided by the cross-file phase and its callee
+ * reach check. With both classes in one file the same call reports nothing,
+ * so this step makes the project result agree with it.
+ *
+ * Runs after the per-file analyses and before the cross-file phase, so no
+ * cross-file path is built from the dropped sink. A sink is dropped only when
+ * every call at its line to that method name resolves exactly to a method
+ * declared in a different project file AND that method contains a registered
+ * sink and does not forward any of its parameters (directly, through an
+ * identity local alias, a field/property store, a return of a non-void method,
+ * or an interpolated-string hole): the cross-file phase and its callee-reach
+ * check then decide what is reported. A callee with no registered sink is a
+ * shape the registry does not know (for example a header or cookie write), and
+ * one that forwards the parameter elsewhere leaks it there; in both the escape
+ * is the only signal. An unresolved, inferred or polymorphic call also keeps
+ * it. When the call's receiver is a type-like name it must match the resolved
+ * class, so a second same-line call such as `Unknown.Run(data)` cannot inherit
+ * another call's cached resolution.
+ *
+ * The decision is transitive for a pure forwarder: a callee with no sink of its
+ * own whose only use of the parameter is to pass it to calls that each resolve
+ * exactly to a method in another project file is decided by those methods, to a
+ * depth of four hops with a visited set (so a loop stops). Any hop that does not
+ * resolve, ends without a sink, forwards elsewhere as well, stores or returns the
+ * value, or lies beyond the depth keeps the escape.
+ */
+import type { CircleIR } from '../types/index.js';
+import type { ProjectGraph } from '../graph/project-graph.js';
+export declare function dropEscapesToProjectCallees(fileAnalyses: ReadonlyArray<{
+    file: string;
+    analysis: CircleIR;
+}>, projectGraph: ProjectGraph): void;
+//# sourceMappingURL=project-callee-escape-gate.d.ts.map

package/dist/analysis/project-callee-escape-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-callee-escape-gate.d.ts","sourceRoot":"","sources":["../../src/analysis/project-callee-escape-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAgC,MAAM,mBAAmB,CAAC;AAChF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AA8K9D,wBAAgB,2BAA2B,CACzC,YAAY,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,EACjE,YAAY,EAAE,YAAY,GACzB,IAAI,CAiCN"}